npm - @arcote.tech/arc-cli - Versions diffs - 0.7.1 → 0.7.3 - Mend

@arcote.tech/arc-cli 0.7.1 → 0.7.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (4) hide show

package/dist/index.js +63 -23
package/package.json +7 -7
package/src/builder/module-builder.ts +66 -23
package/src/platform/server.ts +52 -26

package/dist/index.js CHANGED Viewed

@@ -26942,7 +26942,9 @@ async function buildContextClient(pkg, rootDir, client, cache, noCache) {
   console.log(`  building: ${pkg.name} (${client.name})`);
   const peerDeps = Object.keys(pkg.packageJson.peerDependencies ?? {});
   const allDeps = pkg.packageJson.dependencies ?? {};
-  const externals = [...peerDeps, ...Object.keys(allDeps)];
+  const isBrowser2 = client.name === "browser";
+  const workspaceDeps = isBrowser2 ? Object.keys(allDeps) : Object.entries(allDeps).filter(([, spec]) => !spec.startsWith("workspace:")).map(([name]) => name);
+  const externals = [...peerDeps, ...workspaceDeps];
   const result = await Bun.build({
     entrypoints: [pkg.entrypoint],
     outdir: join8(outDir, "main"),
@@ -26971,9 +26973,39 @@ async function buildContextPackages(rootDir, packages, cache, noCache) {
   const contexts = packages.filter((p) => isContextPackage(p.packageJson));
   if (contexts.length === 0)
     return { declarationErrors: [] };
-  const tasks = contexts.flatMap((pkg) => CONTEXT_CLIENTS.map((client) => () => buildContextClient(pkg, rootDir, client, cache, noCache)));
-  const results = await pAll(tasks);
-  const declarationErrors = results.flatMap((r) => r.declarationErrors);
+  const byName = new Map(contexts.map((p) => [p.name, p]));
+  const remaining = new Set(contexts.map((p) => p.name));
+  const done = new Set;
+  const ordered = [];
+  const workspaceDepsOf = (pkg) => {
+    const deps = pkg.packageJson.dependencies ?? {};
+    return Object.entries(deps).filter(([name, spec]) => spec.startsWith("workspace:") && byName.has(name)).map(([name]) => name);
+  };
+  while (remaining.size > 0) {
+    const layer = [];
+    for (const name of remaining) {
+      const pkg = byName.get(name);
+      const unmetDeps = workspaceDepsOf(pkg).filter((d) => !done.has(d));
+      if (unmetDeps.length === 0)
+        layer.push(pkg);
+    }
+    if (layer.length === 0) {
+      const cycle = [...remaining].join(", ");
+      throw new Error(`Workspace dependency cycle detected: ${cycle}`);
+    }
+    ordered.push(layer);
+    for (const pkg of layer) {
+      done.add(pkg.name);
+      remaining.delete(pkg.name);
+    }
+  }
+  const declarationErrors = [];
+  for (const layer of ordered) {
+    const tasks = layer.flatMap((pkg) => CONTEXT_CLIENTS.map((client) => () => buildContextClient(pkg, rootDir, client, cache, noCache)));
+    const results = await pAll(tasks);
+    for (const r of results)
+      declarationErrors.push(...r.declarationErrors);
+  }
   if (declarationErrors.length > 0) {
     console.warn(`
 \x1B[33mType declaration errors:\x1B[0m`);
@@ -31454,11 +31486,12 @@ async function createArcServer(config) {
 init_i18n();
 import { existsSync as existsSync18, mkdirSync as mkdirSync14 } from "fs";
 import { join as join20 } from "path";
-function generateShellHtml(appName, manifest, initial) {
+function generateShellHtml(appName, manifest, initial, stylesHash) {
   const initialUrl = initial ? `/browser/${initial.file}` : null;
   if (!initialUrl) {
     throw new Error("generateShellHtml: initial bundle missing from manifest");
   }
+  const stylesQs = stylesHash ? `?v=${stylesHash.slice(0, 16)}` : "";
   return `<!doctype html>
 <html lang="en">
 <head>
@@ -31467,8 +31500,8 @@ function generateShellHtml(appName, manifest, initial) {
   <title>${manifest?.title ?? appName}</title>${manifest?.favicon ? `
   <link rel="icon" href="${manifest.favicon}">` : ""}${manifest ? `
   <link rel="manifest" href="/manifest.json">` : ""}
-  <link rel="stylesheet" href="/styles.css" />
-  <link rel="stylesheet" href="/theme.css" />
+  <link rel="stylesheet" href="/styles.css${stylesQs}" />
+  <link rel="stylesheet" href="/theme.css${stylesQs}" />
   <link rel="modulepreload" href="${initialUrl}" />
 </head>
 <body>
@@ -31507,7 +31540,6 @@ function serveFile(filePath, headers = {}) {
   });
 }
 var MODULE_SIG_SECRET = process.env.ARC_MODULE_SECRET ?? "";
-var MODULE_SIG_TTL = 3600;
 function ensureModuleSigSecret(ws, devMode) {
   if (MODULE_SIG_SECRET)
     return;
@@ -31520,19 +31552,16 @@ function ensureModuleSigSecret(ws, devMode) {
   }
 }
 function signGroupUrl(file) {
-  const exp = Math.floor(Date.now() / 1000) + MODULE_SIG_TTL;
   const hasher = new Bun.CryptoHasher("sha256");
-  hasher.update(`${file}:${exp}:${MODULE_SIG_SECRET}`);
+  hasher.update(`${file}:${MODULE_SIG_SECRET}`);
   const sig = hasher.digest("hex").slice(0, 16);
-  return `/browser/${file}?sig=${sig}&exp=${exp}`;
+  return `/browser/${file}?sig=${sig}`;
 }
-function verifyGroupSignature(file, sig, exp) {
-  if (!sig || !exp)
-    return false;
-  if (Number(exp) < Date.now() / 1000)
+function verifyGroupSignature(file, sig) {
+  if (!sig)
     return false;
   const hasher = new Bun.CryptoHasher("sha256");
-  hasher.update(`${file}:${exp}:${MODULE_SIG_SECRET}`);
+  hasher.update(`${file}:${MODULE_SIG_SECRET}`);
   return hasher.digest("hex").slice(0, 16) === sig;
 }
 function decodeTokenPayload(jwt2) {
@@ -31622,8 +31651,7 @@ function staticFilesHandler(ws, devMode, getManifest) {
       const isGroupEntry = Object.values(manifest.groups).some((g3) => g3.file === file);
       if (isGroupEntry) {
         const sig = url.searchParams.get("sig");
-        const exp = url.searchParams.get("exp");
-        if (!verifyGroupSignature(file, sig, exp)) {
+        if (!verifyGroupSignature(file, sig)) {
           return new Response("Forbidden", { status: 403, headers: ctx.corsHeaders });
         }
       }
@@ -31633,13 +31661,25 @@ function staticFilesHandler(ws, devMode, getManifest) {
       });
     }
     if (path4.startsWith("/locales/"))
-      return serveFile(join20(ws.arcDir, path4.slice(1)), ctx.corsHeaders);
+      return serveFile(join20(ws.arcDir, path4.slice(1)), {
+        ...ctx.corsHeaders,
+        "Cache-Control": devMode ? "no-cache" : "max-age=300,stale-while-revalidate=3600"
+      });
     if (path4.startsWith("/assets/"))
-      return serveFile(join20(ws.assetsDir, path4.slice(8)), ctx.corsHeaders);
+      return serveFile(join20(ws.assetsDir, path4.slice(8)), {
+        ...ctx.corsHeaders,
+        "Cache-Control": devMode ? "no-cache" : "max-age=31536000,immutable"
+      });
     if (path4 === "/styles.css")
-      return serveFile(join20(ws.arcDir, "styles.css"), ctx.corsHeaders);
+      return serveFile(join20(ws.arcDir, "styles.css"), {
+        ...ctx.corsHeaders,
+        "Cache-Control": devMode ? "no-cache" : "max-age=31536000,immutable"
+      });
     if (path4 === "/theme.css")
-      return serveFile(join20(ws.arcDir, "theme.css"), ctx.corsHeaders);
+      return serveFile(join20(ws.arcDir, "theme.css"), {
+        ...ctx.corsHeaders,
+        "Cache-Control": devMode ? "no-cache" : "max-age=31536000,immutable"
+      });
     if ((path4 === "/manifest.json" || path4 === "/manifest.webmanifest") && ws.manifest) {
       return serveFile(ws.manifest.path, ctx.corsHeaders);
     }
@@ -31718,7 +31758,7 @@ async function startPlatformServer(opts) {
   const setManifest = (m4) => {
     manifest = m4;
   };
-  const getShellHtml = () => generateShellHtml(ws.appName, ws.manifest, manifest?.initial);
+  const getShellHtml = () => generateShellHtml(ws.appName, ws.manifest, manifest?.initial, manifest?.stylesHash);
   const sseClients = new Set;
   const notifyReload = (m4) => {
     const data = JSON.stringify(m4);

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@arcote.tech/arc-cli",
-  "version": "0.7.1",
+  "version": "0.7.3",
   "description": "CLI tool for Arc framework",
   "module": "index.ts",
   "main": "dist/index.js",
@@ -12,12 +12,12 @@
     "build": "bun build --target=bun ./src/index.ts --outdir=dist --external @arcote.tech/arc --external @arcote.tech/arc-ds --external @arcote.tech/arc-react --external @arcote.tech/platform && chmod +x dist/index.js"
   },
   "dependencies": {
-    "@arcote.tech/arc": "^0.7.1",
-    "@arcote.tech/arc-ds": "^0.7.1",
-    "@arcote.tech/arc-react": "^0.7.1",
-    "@arcote.tech/arc-host": "^0.7.1",
-    "@arcote.tech/arc-adapter-db-sqlite": "^0.7.1",
-    "@arcote.tech/platform": "^0.7.1",
+    "@arcote.tech/arc": "^0.7.3",
+    "@arcote.tech/arc-ds": "^0.7.3",
+    "@arcote.tech/arc-react": "^0.7.3",
+    "@arcote.tech/arc-host": "^0.7.3",
+    "@arcote.tech/arc-adapter-db-sqlite": "^0.7.3",
+    "@arcote.tech/platform": "^0.7.3",
     "@clack/prompts": "^0.9.0",
     "commander": "^11.1.0",
     "chokidar": "^3.5.3",

package/src/builder/module-builder.ts CHANGED Viewed

@@ -277,26 +277,32 @@ async function buildContextClient(
   console.log(`  building: ${pkg.name} (${client.name})`);
-  // Externals: framework peers + npm dependencies + workspace deps.
+  // Externals depend on the target client:
   //
-  // Workspace deps used to be bundled inline (because the deploy image has
-  // no workspace symlinks). The consequence: every context package's dist
-  // carried its own copy of every workspace dep — `@ndt/strategy/dist`
-  // shipped `@ndt/workspace` inlined, `@ndt/content/dist` shipped another
-  // copy, etc. At deploy-build time the top-level Bun.build saw N
-  // pre-inlined copies and could no longer dedupe them — context-package
-  // singletons (e.g. `WorkspaceContext = createContext`) duplicated per
-  // entry, breaking `useWorkspace()` provider lookup.
+  // - BROWSER client: workspace deps MUST be external. Inlining them per
+  //   package would make every context package's dist ship its own copy
+  //   of every workspace dep — the top-level browser Bun.build would see
+  //   N pre-inlined copies of context singletons (`WorkspaceContext =
+  //   createContext`) and could not dedupe them, breaking provider lookup.
   //
-  // Treating workspace deps as `external` makes per-package dist emit bare
-  // specifiers (`import { workspace } from "@ndt/workspace"`), which the
-  // browser-side Bun.build then resolves ONCE across all entries → single
-  // module instance, splitting hoists into a shared chunk. The deploy
-  // image is unaffected: the browser bundle is self-contained at that
-  // layer (we only ship the final chunks, not per-package dist/browser).
+  // - SERVER client: workspace deps MUST be bundled inline. The deploy
+  //   image flattens each package's server bundle to
+  //   `.arc/platform/server/<pkg>.js` and runs them via a single
+  //   `loadServerContext()` import loop. There is no `node_modules/@ndt/*`
+  //   tree inside the image, so bare `@ndt/workspace` specifiers would
+  //   fail to resolve at startup. Inline duplication is harmless on the
+  //   server: it's a single Node/Bun process and Arc modules register via
+  //   a shared platform registry singleton (registry.ts), so two physical
+  //   copies of the workspace module still merge into one context.
   const peerDeps = Object.keys(pkg.packageJson.peerDependencies ?? {});
   const allDeps = (pkg.packageJson.dependencies ?? {}) as Record<string, string>;
-  const externals = [...peerDeps, ...Object.keys(allDeps)];
+  const isBrowser = client.name === "browser";
+  const workspaceDeps = isBrowser
+    ? Object.keys(allDeps)
+    : Object.entries(allDeps)
+        .filter(([, spec]) => !spec.startsWith("workspace:"))
+        .map(([name]) => name);
+  const externals = [...peerDeps, ...workspaceDeps];
   const result = await Bun.build({
     entrypoints: [pkg.entrypoint],
@@ -349,14 +355,51 @@ export async function buildContextPackages(
   const contexts = packages.filter((p) => isContextPackage(p.packageJson));
   if (contexts.length === 0) return { declarationErrors: [] };
-  const tasks = contexts.flatMap((pkg) =>
-    CONTEXT_CLIENTS.map((client) => () =>
-      buildContextClient(pkg, rootDir, client, cache, noCache),
-    ),
-  );
+  // Topological order — each package's server bundle inlines its workspace
+  // deps, so those deps must have their `dist/` ready before Bun.build tries
+  // to resolve them. Without this, a fresh checkout (no dist/ yet) fails the
+  // first build because content's resolve of @ndt/strategy hits a missing
+  // file. Inside a topological level, packages are built in parallel.
+  const byName = new Map(contexts.map((p) => [p.name, p]));
+  const remaining = new Set(contexts.map((p) => p.name));
+  const done = new Set<string>();
+  const ordered: WorkspacePackage[][] = [];
+  const workspaceDepsOf = (pkg: WorkspacePackage): string[] => {
+    const deps = (pkg.packageJson.dependencies ?? {}) as Record<string, string>;
+    return Object.entries(deps)
+      .filter(([name, spec]) => spec.startsWith("workspace:") && byName.has(name))
+      .map(([name]) => name);
+  };
+  while (remaining.size > 0) {
+    const layer: WorkspacePackage[] = [];
+    for (const name of remaining) {
+      const pkg = byName.get(name)!;
+      const unmetDeps = workspaceDepsOf(pkg).filter((d) => !done.has(d));
+      if (unmetDeps.length === 0) layer.push(pkg);
+    }
+    if (layer.length === 0) {
+      const cycle = [...remaining].join(", ");
+      throw new Error(`Workspace dependency cycle detected: ${cycle}`);
+    }
+    ordered.push(layer);
+    for (const pkg of layer) {
+      done.add(pkg.name);
+      remaining.delete(pkg.name);
+    }
+  }
-  const results = await pAll(tasks);
-  const declarationErrors = results.flatMap((r) => r.declarationErrors);
+  const declarationErrors: string[] = [];
+  for (const layer of ordered) {
+    const tasks = layer.flatMap((pkg) =>
+      CONTEXT_CLIENTS.map((client) => () =>
+        buildContextClient(pkg, rootDir, client, cache, noCache),
+      ),
+    );
+    const results = await pAll(tasks);
+    for (const r of results) declarationErrors.push(...r.declarationErrors);
+  }
   if (declarationErrors.length > 0) {
     console.warn("\n\x1b[33mType declaration errors:\x1b[0m");

package/src/platform/server.ts CHANGED Viewed

@@ -73,6 +73,7 @@ export function generateShellHtml(
   appName: string,
   manifest?: { title: string; favicon?: string },
   initial?: { file: string; hash: string },
+  stylesHash?: string,
 ): string {
   // Initial bundle carries framework, public modules, and PlatformApp re-export.
   // No importmap — single Bun.build with splitting:true inlines + dedups everything
@@ -81,14 +82,19 @@ export function generateShellHtml(
   if (!initialUrl) {
     throw new Error("generateShellHtml: initial bundle missing from manifest");
   }
+  // Append the styles content hash as a query string. Filenames are stable
+  // (/styles.css, /theme.css) but their content changes between builds; the
+  // hash invalidates the browser cache exactly when the content changes,
+  // letting us serve them with `Cache-Control: immutable`.
+  const stylesQs = stylesHash ? `?v=${stylesHash.slice(0, 16)}` : "";
   return `<!doctype html>
 <html lang="en">
 <head>
   <meta charset="UTF-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1.0" />
   <title>${manifest?.title ?? appName}</title>${manifest?.favicon ? `\n  <link rel="icon" href="${manifest.favicon}">` : ""}${manifest ? `\n  <link rel="manifest" href="/manifest.json">` : ""}
-  <link rel="stylesheet" href="/styles.css" />
-  <link rel="stylesheet" href="/theme.css" />
+  <link rel="stylesheet" href="/styles.css${stylesQs}" />
+  <link rel="stylesheet" href="/theme.css${stylesQs}" />
   <link rel="modulepreload" href="${initialUrl}" />
 </head>
 <body>
@@ -148,7 +154,6 @@ function serveFile(
 // without this, every restart invalidates every signed URL in the open page).
 // Prod uses ARC_MODULE_SECRET if set, otherwise a random UUID per process.
 let MODULE_SIG_SECRET: string = process.env.ARC_MODULE_SECRET ?? "";
-const MODULE_SIG_TTL = 3600; // 1 hour
 function ensureModuleSigSecret(ws: WorkspaceInfo, devMode: boolean): void {
   if (MODULE_SIG_SECRET) return;
@@ -163,29 +168,31 @@ function ensureModuleSigSecret(ws: WorkspaceInfo, devMode: boolean): void {
 }
 /**
- * Signed URL for a token-group bundle. HMAC payload binds the filename so
- * a sig minted for `/browser/admin.<hash>.js` cannot be replayed for any
- * other file. Shared chunks (chunk-<hash>.js) are NEVER signed — their
- * filenames are content-hashed and they don't carry private code on their
- * own (group entries side-effect-register the modules).
+ * Signed URL for a token-group bundle. HMAC binds the filename so a sig minted
+ * for `/browser/admin.<hash>.js` cannot be replayed for any other file. Shared
+ * chunks (`chunk-<hash>.js`) are NEVER signed — their names are content-hashed
+ * and they don't carry private code on their own (group entries side-effect-
+ * register the modules).
+ *
+ * The signature is intentionally NOT time-bound. A per-request TTL would
+ * mutate the URL on every `/api/modules` poll, blowing the browser cache for
+ * the (potentially multi-megabyte) protected bundle. Without `exp`:
+ *   - Content hash in the filename invalidates URLs on deploy.
+ *   - In-process secret rotation (new UUID on restart) rotates all sigs.
+ *   - Threat model: a stolen sig only buys access to the JS code itself —
+ *     all runtime API calls re-validate the JWT independently.
  */
 function signGroupUrl(file: string): string {
-  const exp = Math.floor(Date.now() / 1000) + MODULE_SIG_TTL;
   const hasher = new Bun.CryptoHasher("sha256");
-  hasher.update(`${file}:${exp}:${MODULE_SIG_SECRET}`);
+  hasher.update(`${file}:${MODULE_SIG_SECRET}`);
   const sig = hasher.digest("hex").slice(0, 16);
-  return `/browser/${file}?sig=${sig}&exp=${exp}`;
+  return `/browser/${file}?sig=${sig}`;
 }
-function verifyGroupSignature(
-  file: string,
-  sig: string | null,
-  exp: string | null,
-): boolean {
-  if (!sig || !exp) return false;
-  if (Number(exp) < Date.now() / 1000) return false;
+function verifyGroupSignature(file: string, sig: string | null): boolean {
+  if (!sig) return false;
   const hasher = new Bun.CryptoHasher("sha256");
-  hasher.update(`${file}:${exp}:${MODULE_SIG_SECRET}`);
+  hasher.update(`${file}:${MODULE_SIG_SECRET}`);
   return hasher.digest("hex").slice(0, 16) === sig;
 }
@@ -311,8 +318,7 @@ function staticFilesHandler(
       );
       if (isGroupEntry) {
         const sig = url.searchParams.get("sig");
-        const exp = url.searchParams.get("exp");
-        if (!verifyGroupSignature(file, sig, exp)) {
+        if (!verifyGroupSignature(file, sig)) {
           return new Response("Forbidden", { status: 403, headers: ctx.corsHeaders });
         }
       }
@@ -322,14 +328,34 @@ function staticFilesHandler(
         "Cache-Control": devMode ? "no-cache" : "max-age=31536000,immutable",
       });
     }
+    // Locales (compiled .po → .json) — short TTL with SWR; catalogs change
+    // build-to-build but rarely within a session, and they're tiny.
     if (path.startsWith("/locales/"))
-      return serveFile(join(ws.arcDir, path.slice(1)), ctx.corsHeaders);
+      return serveFile(join(ws.arcDir, path.slice(1)), {
+        ...ctx.corsHeaders,
+        "Cache-Control": devMode ? "no-cache" : "max-age=300,stale-while-revalidate=3600",
+      });
+    // Browser assets (SQLite WASM worker, etc.) — content-addressed in their
+    // source paths, safe to cache forever in prod.
     if (path.startsWith("/assets/"))
-      return serveFile(join(ws.assetsDir, path.slice(8)), ctx.corsHeaders);
+      return serveFile(join(ws.assetsDir, path.slice(8)), {
+        ...ctx.corsHeaders,
+        "Cache-Control": devMode ? "no-cache" : "max-age=31536000,immutable",
+      });
+    // /styles.css and /theme.css have stable URLs but their CONTENT changes
+    // between builds. HTML references them with `?v=<stylesHash>` (see
+    // generateShellHtml), so the URL changes on rebuild and immutable caching
+    // is safe — the handler ignores the query string itself.
     if (path === "/styles.css")
-      return serveFile(join(ws.arcDir, "styles.css"), ctx.corsHeaders);
+      return serveFile(join(ws.arcDir, "styles.css"), {
+        ...ctx.corsHeaders,
+        "Cache-Control": devMode ? "no-cache" : "max-age=31536000,immutable",
+      });
     if (path === "/theme.css")
-      return serveFile(join(ws.arcDir, "theme.css"), ctx.corsHeaders);
+      return serveFile(join(ws.arcDir, "theme.css"), {
+        ...ctx.corsHeaders,
+        "Cache-Control": devMode ? "no-cache" : "max-age=31536000,immutable",
+      });
     // Serve manifest.json from root dir
     if ((path === "/manifest.json" || path === "/manifest.webmanifest") && ws.manifest) {
@@ -442,7 +468,7 @@ export async function startPlatformServer(
   // Recompute on every request — manifest.initial.hash changes when public
   // modules are rebuilt in dev, and we want the new URL in the HTML.
   const getShellHtml = (): string =>
-    generateShellHtml(ws.appName, ws.manifest, manifest?.initial);
+    generateShellHtml(ws.appName, ws.manifest, manifest?.initial, manifest?.stylesHash);
   const sseClients = new Set<ReadableStreamDefaultController>();
   const notifyReload = (m: BuildManifest) => {