@4399ywkf/core 5.1.6 → 5.3.0

package/dist/cli/index.js

@@ -879,7 +879,7 @@ function createMockMiddleware(mockPath, options) {
   scanMockFiles(mockPath);
   return async (_req, _res, next) => {
     if (delay > 0) {
-      await new Promise((resolve5) => setTimeout(resolve5, delay));
+      await new Promise((resolve6) => setTimeout(resolve6, delay));
     }
     next();
   };
@@ -1833,11 +1833,11 @@ var zustandPlugin = createPlugin((options = {}) => ({
     const hooks = {
       modifyRspackConfig(rspackConfig) {
         logger.info("Zustand \u5DF2\u542F\u7528");
-        const resolve5 = rspackConfig.resolve || {};
-        const alias = resolve5.alias || {};
+        const resolve6 = rspackConfig.resolve || {};
+        const alias = resolve6.alias || {};
         alias["@store"] = storePath;
-        resolve5.alias = alias;
-        rspackConfig.resolve = resolve5;
+        resolve6.alias = alias;
+        rspackConfig.resolve = resolve6;
         return rspackConfig;
       },
       generateFiles(_ctx) {
@@ -2175,7 +2175,9 @@ var defaultConfig = {
   tools: {},
   env: {
     publicEnvFile: "config/env/.env.public",
-    envDir: "config/env"
+    envDir: "config/env",
+    expose: [],
+    exposePrefixes: ["YWKF_PUBLIC_", "NEXT_PUBLIC_"]
   },
   alias: {},
   plugins: []
@@ -3437,6 +3439,69 @@ var YwkfGeneratorPlugin = class {
   }
 };
 
+// src/rspack/client-env.ts
+import { existsSync as existsSync12, readFileSync as readFileSync4 } from "fs";
+import { resolve as resolve3 } from "path";
+import dotenv from "dotenv";
+var FRAMEWORK_ENV_KEYS = [
+  "APP_CNAME",
+  "APP_HOST",
+  "APP_MODE",
+  "APP_NAME",
+  "APP_PORT",
+  "DEBUG",
+  "NODE_ENV",
+  "OUTPUT_PATH",
+  "PUBLIC_PATH",
+  "YWKF_BUILD_ID",
+  "YWKF_PREFIX_CLS"
+];
+var DEFAULT_EXPOSE_PREFIXES = ["YWKF_PUBLIC_", "NEXT_PUBLIC_"];
+var SECRET_KEY_PATTERN = /TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL|PRIVATE|AUTH|ACCESS_KEY|API_KEY|SIGNING_KEY/i;
+var SECRET_VALUE_PATTERN = /^(sntry[su]_|sk-|ghp_|gho_|ghu_|ghs_|github_pat_|glpat-|xox[abprs]-|AKIA|ya29\.)/;
+function readEnvFileKeys(filePath) {
+  if (!existsSync12(filePath)) return [];
+  try {
+    return Object.keys(dotenv.parse(readFileSync4(filePath, "utf-8")));
+  } catch {
+    return [];
+  }
+}
+function collectClientEnvKeys(options) {
+  const { cwd, env = {}, mode = process.env.APP_MODE || "development" } = options;
+  const keys = new Set(FRAMEWORK_ENV_KEYS);
+  const files = [
+    env.publicEnvFile ?? "config/env/.env.public",
+    ".env.public",
+    ".env",
+    `${env.envDir ?? "config/env"}/.env.${mode}`,
+    `.env.${mode}`
+  ];
+  for (const file of files) {
+    for (const key of readEnvFileKeys(resolve3(cwd, file))) keys.add(key);
+  }
+  for (const key of env.expose ?? []) keys.add(key);
+  return keys;
+}
+function buildClientEnv(options) {
+  const { cwd, env = {}, mode, processEnv = process.env } = options;
+  const prefixes = env.exposePrefixes ?? DEFAULT_EXPOSE_PREFIXES;
+  const allowed = collectClientEnvKeys({ cwd, env, mode });
+  const result = {};
+  const dropped = [];
+  for (const [key, value] of Object.entries(processEnv)) {
+    if (value === void 0) continue;
+    const isAllowed = allowed.has(key) || prefixes.some((prefix) => key.startsWith(prefix));
+    if (!isAllowed) continue;
+    if (SECRET_KEY_PATTERN.test(key) || SECRET_VALUE_PATTERN.test(value)) {
+      dropped.push(key);
+      continue;
+    }
+    result[key] = value;
+  }
+  return { env: result, dropped };
+}
+
 // src/rspack/base.ts
 var require2 = createRequire(import.meta.url);
 var __dirname = dirname(fileURLToPath(import.meta.url));
@@ -3455,6 +3520,12 @@ function createBaseConfig(config, cwd, options = {}) {
   const { resolveApp } = createPathResolver(cwd);
   const { appName, appCName, output, html, alias: userAlias, microFrontend, router, reactCompiler } = config;
   const buildId = resolveYwkfBuildId(appName);
+  const { env: clientEnv, dropped: droppedEnvKeys } = buildClientEnv({ cwd, env: config.env });
+  if (droppedEnvKeys.length > 0) {
+    console.warn(
+      `[ywkf] \u4EE5\u4E0B\u73AF\u5883\u53D8\u91CF\u7591\u4F3C\u5BC6\u94A5,\u5DF2\u4ECE\u5BA2\u6237\u7AEF\u4EA7\u7269\u4E2D\u5254\u9664:${droppedEnvKeys.join(", ")}\u3002\u5982\u786E\u4E3A\u516C\u5F00\u914D\u7F6E,\u8BF7\u91CD\u547D\u540D\u6216\u8C03\u6574 env.expose\u3002`
+    );
+  }
   const ywkfOutputDir = resolveApp(".ywkf");
   const defaultAlias = {
     "@": resolveApp("src"),
@@ -3579,7 +3650,10 @@ function createBaseConfig(config, cwd, options = {}) {
       }),
       new rspack2.DefinePlugin({
         "globalThis.__YWKF_BUILD_ID__": JSON.stringify(buildId),
-        "process.env": JSON.stringify(process.env)
+        // 只内联白名单内的公开配置。整包 process.env 会把构建机环境(CI 凭据、内网地址)
+        // 写进公网可下载的产物,见 client-env.ts。外层括号不可省:该值以 `{` 开头,
+        // `() => process.env.X` 会被替换成 `() => {…}` 而当成函数块体,导致整条 chunk 语法失败。
+        "process.env": `(${JSON.stringify(clientEnv)})`
       }),
       new rspack2.HtmlRspackPlugin({
         template: resolveApp(html.template ?? "public/index.html"),
@@ -4097,28 +4171,28 @@ function createRspackConfig(config, cwd, options = {}) {
 }
 
 // src/cli/env.ts
-import { existsSync as existsSync12, readFileSync as readFileSync4 } from "fs";
-import { resolve as resolve3 } from "path";
-import dotenv from "dotenv";
+import { existsSync as existsSync13, readFileSync as readFileSync5 } from "fs";
+import { resolve as resolve4 } from "path";
+import dotenv2 from "dotenv";
 function preloadEnv(cwd, mode, nodeEnv) {
   process.env.NODE_ENV = nodeEnv;
   process.env.APP_MODE = mode;
   const defaultPaths = [
-    resolve3(cwd, "config/env/.env.public"),
-    resolve3(cwd, ".env.public"),
-    resolve3(cwd, ".env")
+    resolve4(cwd, "config/env/.env.public"),
+    resolve4(cwd, ".env.public"),
+    resolve4(cwd, ".env")
   ];
   for (const envPath of defaultPaths) {
-    if (existsSync12(envPath)) {
-      dotenv.config({ path: envPath });
+    if (existsSync13(envPath)) {
+      dotenv2.config({ path: envPath });
       break;
     }
   }
-  const modeEnvPaths = [resolve3(cwd, `config/env/.env.${mode}`), resolve3(cwd, `.env.${mode}`)];
+  const modeEnvPaths = [resolve4(cwd, `config/env/.env.${mode}`), resolve4(cwd, `.env.${mode}`)];
   for (const envPath of modeEnvPaths) {
-    if (existsSync12(envPath)) {
-      const envContent = readFileSync4(envPath, "utf-8");
-      const parsed = dotenv.parse(envContent);
+    if (existsSync13(envPath)) {
+      const envContent = readFileSync5(envPath, "utf-8");
+      const parsed = dotenv2.parse(envContent);
       for (const key in parsed) {
         process.env[key] = parsed[key];
       }
@@ -4130,14 +4204,14 @@ function preloadEnv(cwd, mode, nodeEnv) {
 }
 function loadEnv(config, cwd, mode, nodeEnv) {
   const { env } = config;
-  const publicEnvPath = resolve3(cwd, env.publicEnvFile ?? "config/env/.env.public");
-  if (existsSync12(publicEnvPath)) {
-    dotenv.config({ path: publicEnvPath });
-  }
-  const modeEnvPath = resolve3(cwd, env.envDir ?? "config/env", `.env.${mode}`);
-  if (existsSync12(modeEnvPath)) {
-    const envContent = readFileSync4(modeEnvPath, "utf-8");
-    const parsed = dotenv.parse(envContent);
+  const publicEnvPath = resolve4(cwd, env.publicEnvFile ?? "config/env/.env.public");
+  if (existsSync13(publicEnvPath)) {
+    dotenv2.config({ path: publicEnvPath });
+  }
+  const modeEnvPath = resolve4(cwd, env.envDir ?? "config/env", `.env.${mode}`);
+  if (existsSync13(modeEnvPath)) {
+    const envContent = readFileSync5(modeEnvPath, "utf-8");
+    const parsed = dotenv2.parse(envContent);
     for (const key in parsed) {
       process.env[key] = parsed[key];
     }
@@ -4415,7 +4489,7 @@ async function build(options = {}) {
     rspackConfig.stats = "none";
     rspackConfig.infrastructureLogging = { level: "none" };
     const compiler = rspack4(rspackConfig);
-    const stats = await new Promise((resolve5, reject) => {
+    const stats = await new Promise((resolve6, reject) => {
       compiler.run((err, stats2) => {
         if (err) {
           reject(err);
@@ -4425,13 +4499,13 @@ async function build(options = {}) {
           reject(new Error("Build failed: no stats available"));
           return;
         }
-        resolve5(stats2);
+        resolve6(stats2);
       });
     });
-    await new Promise((resolve5, reject) => {
+    await new Promise((resolve6, reject) => {
       compiler.close((err) => {
         if (err) reject(err);
-        else resolve5();
+        else resolve6();
       });
     });
     const hasErrors = stats.hasErrors();
@@ -4473,7 +4547,7 @@ var PortInUseError = class extends Error {
   }
 };
 function ensurePortAvailable(port, host) {
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve6, reject) => {
     const server = net.createServer();
     server.once("error", (err) => {
       if (err.code === "EADDRINUSE") {
@@ -4483,7 +4557,7 @@ function ensurePortAvailable(port, host) {
       }
     });
     server.once("listening", () => {
-      server.close(() => resolve5());
+      server.close(() => resolve6());
     });
     server.listen(port, host);
   });
@@ -4531,8 +4605,8 @@ function parseWindowsNetstatPid(stdout, port) {
 }
 
 // src/cli/restart-watcher.ts
-import { existsSync as existsSync13, watch as watch2 } from "fs";
-import { resolve as resolve4 } from "path";
+import { existsSync as existsSync14, watch as watch2 } from "fs";
+import { resolve as resolve5 } from "path";
 function isTriggerFile(filename, mode) {
   if (!filename) return false;
   if (CONFIG_FILES.includes(filename)) return true;
@@ -4562,8 +4636,8 @@ function watchForRestart(opts) {
     }, debounceMs);
   };
   watchers.push(watch2(cwd, { recursive: false }, (_event, filename) => trigger(filename)));
-  const envDir = resolve4(cwd, "config/env");
-  if (existsSync13(envDir)) {
+  const envDir = resolve5(cwd, "config/env");
+  if (existsSync14(envDir)) {
     watchers.push(watch2(envDir, { recursive: false }, (_event, filename) => trigger(filename)));
   }
   return {
@@ -4670,10 +4744,10 @@ async function startDevServer(cwd, config) {
     if (closed) return;
     closed = true;
     await server.stop();
-    await new Promise((resolve5, reject) => {
+    await new Promise((resolve6, reject) => {
       compiler.close((err) => {
         if (err) reject(err);
-        else resolve5();
+        else resolve6();
       });
     });
   };