@anchrd/intel 0.59.0

package/dist/build/build.js

@@ -0,0 +1,192 @@
+import { z } from "zod";
+import { UI_LANGUAGES } from "../contract/contract.js";
+const UiConfig = z.strictObject({
+    theme: z.string().min(1).optional(),
+    logo: z.string().min(1).optional(),
+    favicon: z.string().min(1).optional(),
+    defaultLanguage: z.string().min(1).default("en"),
+    languages: z.record(z.string().min(1), z.string().min(1)).default({}),
+});
+const IntelConfig = z.strictObject({
+    ui: UiConfig.default({ defaultLanguage: "en", languages: {} }),
+});
+const Catalog = z.record(z.string(), z.string());
+const defaultTheme = `/* Generated by \`intel build\`. Intel defaults are active. */\n`;
+const defaultLogo = `export const customLogoUrl: string | null = null;\n`;
+// The `_headers` file of Workers Assets, written INTO THE BUILD OUTPUT (#543, sibling of
+// anchrd/gate#329).
+//
+// Without it every asset answers with the platform default `public, max-age=0, must-revalidate`,
+// and `public` lets a browser store an ERROR answer too. A `403` that appears once during setup is
+// then replayed on BACK/FORWARD WITHOUT a request leaving the browser — invisible in the worker
+// log, in the Cloudflare Access log, in the firewall and in Cloudflare Analytics, while `curl`
+// against the same address keeps answering `200`. The second rule matters more here than in Gate:
+// the UI ships 1.9 MB of fingerprinted assets that are revalidated on every navigation today.
+//
+// ⚠️ The ERROR answer is NOT replayed on every navigation — that is the asset line right above, a
+// different statement about `/assets/*`, and it stays as it is. The narrower shape is what makes
+// this expensive to diagnose: `must-revalidate` DOES hold for a fresh navigation, so retyping the
+// address returns the REPAIRED page (`200 /` in the worker log), while a history navigation replays
+// the stored answer without any freshness check (`transferSize: 0`). Measured in Chromium with a
+// real cache, anchrd/gate#399. Whoever retypes the address rules the browser cache out and loses
+// the afternoon of anchrd/gate#329 a second time — going BACK is the only handle that shows the
+// frozen answer.
+//
+// ⚠️ `! Cache-Control` is not decoration, and the naive two-rule form from the ticket is WRONG.
+// A request matching several rules inherits ALL their headers, and a header named twice is joined
+// with a comma. Measured against `wrangler dev` 4.112.0 with both spellings side by side:
+//   without the detach   /assets/app.js → `no-store, public, max-age=31536000, immutable`
+//   with the detach      /assets/app.js → `public, max-age=31536000, immutable`
+// The joined value carries `no-store`, so those 1.9 MB would never be cached at all — the exact
+// opposite of the second rule's purpose.
+//
+// ⚠️ It has to be written into the TEMPORARY directory, before `replaceDir`. The next run's
+// `--emptyOutDir` applies to that directory, so a file placed into the live outDir afterwards
+// survives exactly one build. And `packages/intel/ui/public/` is no way either: the `files` field of
+// @anchrd/intel does not list `ui/public`, so the file would look right in the repository and never
+// reach a customer.
+//
+// The three `cache-control` writes in this package do not contradict it: `auth/auth.ts` (redirect),
+// `http/http.ts` (zipResponse, attachment bytes) all answer `no-store` under `/auth/*` and `/api/*`,
+// which the assets layer never sees. Nothing serves an SPA route under `/assets/`, so the
+// `immutable` rule cannot swallow one.
+const headersFile = `# Generated by \`intel build\` — do not edit by hand.
+/*
+  Cache-Control: no-store
+  Content-Security-Policy: default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' blob: data:; font-src 'self' data:; connect-src 'self'; worker-src 'self' blob:; object-src 'none'; base-uri 'self'; frame-ancestors 'none'
+
+/assets/*
+  ! Cache-Control
+  Cache-Control: public, max-age=31536000, immutable
+`;
+// Customer paths from intel.json are written into generated CSS and TypeScript comments. A path
+// containing `*/` or a newline would close the comment early, leaving broken output or — in
+// custom-logo.ts — customer-controlled text outside the comment and inside the UI bundle.
+function asComment(path) {
+    return path.replaceAll("*/", "*\\/").replace(/[\r\n]+/g, " ");
+}
+function validationMessage(error) {
+    return error.issues
+        .map((issue) => `${issue.path.join(".") || "intel.json"}: ${issue.message}`)
+        .join("; ");
+}
+function validateCatalog(source, candidate) {
+    const expected = Object.keys(source).sort();
+    const actual = Object.keys(candidate).sort();
+    const missing = expected.filter((key) => !actual.includes(key));
+    const unknown = actual.filter((key) => !expected.includes(key));
+    return { missing, unknown };
+}
+function asSvgDataUrl(svg) {
+    return `data:image/svg+xml,${encodeURIComponent(svg)}`;
+}
+export function createBuild(deps) {
+    async function readRequired(path, field) {
+        const content = await deps.readTextFile(path);
+        if (content === null)
+            throw new Error(`File not found: ${path} (${field})`);
+        return content;
+    }
+    async function readSvg(path, field) {
+        if (!path.toLowerCase().endsWith(".svg")) {
+            throw new Error(`${field} must point to an .svg file`);
+        }
+        return await readRequired(path, field);
+    }
+    return {
+        async build() {
+            const location = await deps.resolveUi();
+            if (!location) {
+                deps.log("Error: the Intel UI was not found in node_modules/@anchrd/intel/ui or packages/intel/ui.");
+                return 1;
+            }
+            try {
+                const rawConfig = await deps.readTextFile("intel.json");
+                let value = {};
+                if (rawConfig !== null) {
+                    try {
+                        value = JSON.parse(rawConfig);
+                    }
+                    catch {
+                        throw new Error("intel.json is not valid JSON");
+                    }
+                }
+                const parsed = IntelConfig.safeParse(value);
+                if (!parsed.success)
+                    throw new Error(validationMessage(parsed.error));
+                const config = parsed.data.ui;
+                const englishPath = `${location.dir}/src/i18n/en.json`;
+                const englishRaw = await readRequired(englishPath, "built-in English catalog");
+                let englishJson;
+                try {
+                    englishJson = JSON.parse(englishRaw);
+                }
+                catch {
+                    throw new Error(`${englishPath} is not valid JSON`);
+                }
+                const englishParsed = Catalog.safeParse(englishJson);
+                if (!englishParsed.success)
+                    throw new Error("Intel's built-in English catalog is invalid");
+                const english = englishParsed.data;
+                const catalogs = {};
+                for (const [language, path] of Object.entries(config.languages)) {
+                    const candidateRaw = await readRequired(path, `ui.languages.${language}`);
+                    let candidateJson;
+                    try {
+                        candidateJson = JSON.parse(candidateRaw);
+                    }
+                    catch {
+                        throw new Error(`${path} is not valid JSON`);
+                    }
+                    const candidateParsed = Catalog.safeParse(candidateJson);
+                    if (!candidateParsed.success)
+                        throw new Error(`${path} must contain only string values`);
+                    const difference = validateCatalog(english, candidateParsed.data);
+                    if (difference.missing.length || difference.unknown.length) {
+                        throw new Error(`${path} does not match en.json; missing: ${difference.missing.join(", ") || "none"}; unknown: ${difference.unknown.join(", ") || "none"}`);
+                    }
+                    catalogs[language] = candidateParsed.data;
+                }
+                // A built-in language needs no entry in ui.languages — its catalog is already in the UI.
+                // Without this exception, `ui.defaultLanguage: "de"` would force the customer to list a copy
+                // of de.json that rots at every UI update, and nobody maintains that copy.
+                const builtIn = UI_LANGUAGES;
+                if (!builtIn.includes(config.defaultLanguage) && !(config.defaultLanguage in catalogs)) {
+                    throw new Error(`ui.defaultLanguage ${JSON.stringify(config.defaultLanguage)} is neither built in (${UI_LANGUAGES.join(", ")}) nor listed in ui.languages`);
+                }
+                const theme = config.theme
+                    ? `/* Generated by \`intel build\` from ${asComment(config.theme)}. */\n${await readRequired(config.theme, "ui.theme")}\n`
+                    : defaultTheme;
+                const logoSvg = config.logo ? await readSvg(config.logo, "ui.logo") : null;
+                const faviconPath = config.favicon ?? config.logo;
+                const faviconSvg = faviconPath
+                    ? await readSvg(faviconPath, config.favicon ? "ui.favicon" : "ui.logo")
+                    : await readRequired(`${location.dir}/src/branding/favicon.default.svg`, "default favicon");
+                const logoModule = config.logo && logoSvg
+                    ? `/* Generated by \`intel build\` from ${asComment(config.logo)}. */\nexport const customLogoUrl = ${JSON.stringify(asSvgDataUrl(logoSvg))};\n`
+                    : defaultLogo;
+                const languageBundle = `${JSON.stringify({ defaultLanguage: config.defaultLanguage, catalogs }, null, 2)}\n`;
+                await deps.writeTextFile(`${location.dir}/src/theme/custom.css`, theme);
+                await deps.writeTextFile(`${location.dir}/src/branding/custom-logo.ts`, logoModule);
+                await deps.writeTextFile(`${location.dir}/src/branding/favicon.svg`, faviconSvg);
+                await deps.writeTextFile(`${location.dir}/src/i18n/custom.json`, languageBundle);
+                const temporaryOutDir = `${location.outDir}.tmp`;
+                const exitCode = await deps.exec("npm", ["run", "build", "--", "--outDir", temporaryOutDir, "--emptyOutDir"], { cwd: location.dir });
+                if (exitCode !== 0) {
+                    deps.log(`Error: Intel UI build exited with ${exitCode}.`);
+                    return 1;
+                }
+                // Into the temporary directory, not into outDir — see `headersFile`. Vite has just emptied
+                // and refilled this directory; anything written here travels with the swap.
+                await deps.writeTextFile(`${temporaryOutDir}/_headers`, headersFile);
+                await deps.replaceDir(temporaryOutDir, location.outDir);
+                deps.log(`Intel UI built at ${location.outDir}.`);
+                return 0;
+            }
+            catch (error) {
+                deps.log(`Error: ${error instanceof Error ? error.message : String(error)}`);
+                return 1;
+            }
+        },
+    };
+}

package/dist/build/build.types.d.ts

@@ -0,0 +1,17 @@
+export interface UiLocation {
+    dir: string;
+    outDir: string;
+}
+export interface BuildDeps {
+    readTextFile(path: string): Promise<string | null>;
+    writeTextFile(path: string, content: string): Promise<void>;
+    resolveUi(): Promise<UiLocation | null>;
+    exec(command: string, args: string[], options: {
+        cwd: string;
+    }): Promise<number>;
+    replaceDir(from: string, to: string): Promise<void>;
+    log(message: string): void;
+}
+export interface BuildResult {
+    build(): Promise<number>;
+}

package/dist/build/build.types.js

@@ -0,0 +1 @@
+export {};

package/dist/bundle/bundle.d.ts

@@ -0,0 +1,4 @@
+import type { BundleDeps, BundleService } from "./bundle.types.js";
+export declare const MaxImportZipBytes: number;
+export declare const MaxImportEntryBytes: number;
+export declare function createBundle(deps: BundleDeps): BundleService;