@bascik/adapter-cloudflare 1.0.0-rc.1 → 1.0.0-rc.10

package/dist/headers-file.js

@@ -0,0 +1,298 @@
+/**
+ * The generated public/_headers on Cloudflare.
+ *
+ * Static files are served by the asset layer without the Worker, so the
+ * headers the Worker sends on what it answers have to be written here for
+ * them: the security headers (`security.headers`, `security.hsts`) as one
+ * site-wide `/*` rule, and the opt-in `contentSecurityPolicy` as one
+ * exact-path rule per static page (from the same pkg function the Node
+ * servers and the Worker use, with the build's hashes). Responses the Worker
+ * makes itself never get `_headers` rules, and an asset it forwards gets them
+ * once, from the asset layer, so no header is sent twice.
+ *
+ * How Cloudflare reads the file (workers-shared, which miniflare runs): rules
+ * are a record keyed by path, so a second rule with a path the author used
+ * replaces the author's, at the place of the first; the rules that match a
+ * URL apply in file order; a header two of them set is joined with a comma;
+ * `! Name` in a rule removes what earlier rules set, before that rule's own
+ * values; a line over 2000 characters is skipped; and it stops reading at the
+ * 101st path line.
+ *
+ * So, whenever Bascik writes anything into the file:
+ *   1. the site-wide rule comes first (Bascik's, or the author's own `/*`
+ *      moved to the top with Bascik's headers it does not set added);
+ *   2. the static pages' CSP rules come next, never as a second rule for a
+ *      path the author has (the line goes into the author's rule), and not at
+ *      all for a page an author rule already sets or removes the CSP header
+ *      on: the author's value wins there;
+ *   3. the author's other rules follow, and each one that sets a security
+ *      header (any Bascik can write, whatever the toggles say) or a header
+ *      the author's `/*` sets gets a `! Name` line first: a later, more
+ *      specific rule replaces the value instead of being joined to it, the
+ *      same way under every security setting.
+ * When Bascik writes nothing (headers, HSTS and CSP all off), the author's
+ * file ships as written.
+ */
+import { contentSecurityPolicyHeader, DEFAULT_RESPONSE_SECURITY, SECURITY_HEADERS, } from "@bascik/bascik/runtime";
+/** Cloudflare reads at most this many rules (path lines) from _headers. */
+export const CLOUDFLARE_HEADERS_RULE_LIMIT = 100;
+/** Cloudflare skips any _headers line longer than this, with no error. */
+export const CLOUDFLARE_HEADERS_LINE_LIMIT = 2000;
+const SITE_WIDE_PATH = "/*";
+/** How Cloudflare tells a path line from a header line (its own pattern). */
+const PATH_LINE = /^([^\s]+:\/\/|\/)/;
+const UNSET_PREFIX = "! ";
+const CSP_NAMES = [
+    "content-security-policy",
+    "content-security-policy-report-only",
+];
+/**
+ * Every header Bascik can write here, whatever `security` turns on or off:
+ * an author's rule that sets one replaces the earlier value under every
+ * setting, so a toggle never changes how the author's own rules combine.
+ */
+const MANAGED_HEADERS = new Set([
+    ...Object.keys(SECURITY_HEADERS),
+    "strict-transport-security",
+    ...CSP_NAMES,
+]);
+/** `x-frame-options` -> `X-Frame-Options`. Cloudflare matches names in any case. */
+const headerName = (lower) => lower.replace(/(^|-)([a-z])/g, (_, dash, c) => `${dash}${c.toUpperCase()}`);
+/** The rules of a _headers text, as Cloudflare reads them (indentation is not significant). */
+const parseRules = (lines) => {
+    const rules = [];
+    let rule;
+    lines.forEach((raw, index) => {
+        const line = raw.trim();
+        if (line === "" || line.startsWith("#"))
+            return;
+        if (PATH_LINE.test(line)) {
+            if (rule)
+                rule.end = index;
+            rule = {
+                path: line,
+                line: index,
+                end: lines.length,
+                sets: new Set(),
+                unsets: new Set(),
+            };
+            rules.push(rule);
+            return;
+        }
+        if (!rule)
+            return;
+        if (line.startsWith(UNSET_PREFIX))
+            rule.unsets.add(line.slice(UNSET_PREFIX.length).trim().toLowerCase());
+        else if (line.includes(":"))
+            rule.sets.add(line.slice(0, line.indexOf(":")).trim().toLowerCase());
+    });
+    return rules;
+};
+const linesOf = (text) => text === "" ? [] : text.replace(/\s*$/, "").split(/\r?\n/);
+/**
+ * How many rules Cloudflare reads from a _headers text: one per path line
+ * that has a header or a `! Name` under it. A path written twice counts
+ * twice, because Cloudflare stops at a count of path lines, not of paths.
+ */
+export const countHeadersRules = (text) => parseRules(linesOf(text)).filter((rule) => rule.sets.size + rule.unsets.size)
+    .length;
+/** Cloudflare's own pattern match (workers-shared generateRuleRegExp), for path rules. */
+const ruleMatches = (rulePath, path) => {
+    if (!rulePath.startsWith("/"))
+        return false;
+    const source = rulePath
+        .split("*")
+        .map((part) => part.replace(/[-/\\^$*+?.()|[\]{}]/g, "\\$&"))
+        .join(".*")
+        .replace(/:[A-Za-z]\w*/g, "[^/]+");
+    try {
+        return new RegExp(`^${source}$`).test(path);
+    }
+    catch {
+        return false;
+    }
+};
+/** What to do when the static headers do not fit in _headers, for this variant. */
+const remedy = (variant) => variant === "workers"
+    ? `Let the Worker send the headers on every response instead: in your wrangler.jsonc (or wrangler.json or wrangler.toml) set ` +
+        `"assets": { "run_worker_first": true }, and Bascik writes no _headers rules for them.`
+    : `Cloudflare Pages cannot run the Worker before static files, so build with --target cloudflare-workers and set ` +
+        `"assets": { "run_worker_first": true } in your wrangler.jsonc; the Worker then sends the headers on every response.`;
+/**
+ * The whole public/_headers text: the site-wide security rule, the static
+ * pages' CSP rules, and the author's rules. The author's text unchanged when
+ * Bascik has nothing to write; "" when there is no file at all.
+ */
+export const buildHeadersFile = ({ authored, security = DEFAULT_RESPONSE_SECURITY, base, csp, variant = "workers", }) => {
+    const lines = linesOf(authored);
+    const rules = parseRules(lines);
+    // Cloudflare keeps the last rule written for a path, at the place of the first.
+    const effective = new Map();
+    for (const rule of rules)
+        effective.set(rule.path, rule);
+    const authorSiteWide = effective.get(SITE_WIDE_PATH);
+    // name (lowercase) -> value, in the order Node sends them.
+    const siteWide = new Map(Object.entries(security.headers));
+    if (security.hsts !== null)
+        siteWide.set("strict-transport-security", security.hsts);
+    /** Lines to add right after a rule's path line, by that line's index. */
+    const additions = new Map();
+    const add = (rule, line) => {
+        const list = additions.get(rule.line) ?? [];
+        list.push(line);
+        additions.set(rule.line, list);
+    };
+    // The static pages' CSP.
+    const prefix = base === "/" ? "" : base.replace(/\/$/, "");
+    const cspRules = [];
+    const cspInAuthorRules = [];
+    const cspRoutes = new Map();
+    if (csp) {
+        for (const route of csp.staticRoutes) {
+            const { name, value } = contentSecurityPolicyHeader(csp.policy, csp.hashes[route]);
+            const path = `${prefix}${route}`;
+            const line = `  ${headerName(name)}: ${value}`;
+            // An author's rule that sets or removes this header on the page wins.
+            const authorDecides = [...effective.values()].some((rule) => (rule.sets.has(name) || rule.unsets.has(name)) &&
+                ruleMatches(rule.path, path));
+            if (authorDecides)
+                continue;
+            if (line.trim().length > CLOUDFLARE_HEADERS_LINE_LIMIT)
+                throw new Error(`[bascik] --target cloudflare: the ${headerName(name)} line for the static page ${path} is ` +
+                    `${line.trim().length} characters (one hash for each of its inline scripts and styles), but Cloudflare ` +
+                    `skips any _headers line over ${CLOUDFLARE_HEADERS_LINE_LIMIT} characters, so the page would ship with no ` +
+                    `policy and no error. ${remedy(variant)} Or move some of the page's inline scripts and styles into files.`);
+            cspRoutes.set(path, route);
+            const own = effective.get(path);
+            // Never a second rule for the author's path: it would replace theirs.
+            if (own)
+                cspInAuthorRules.push([own, line]);
+            else
+                cspRules.push(path, line);
+        }
+    }
+    if (siteWide.size === 0 && cspRoutes.size === 0)
+        return authored;
+    // A later rule replaces a security header (or one the author's `/*` sets)
+    // instead of joining it.
+    const replaced = new Set([
+        ...MANAGED_HEADERS,
+        ...siteWide.keys(),
+        ...(authorSiteWide?.sets ?? []),
+    ]);
+    for (const rule of effective.values()) {
+        if (rule === authorSiteWide) {
+            // The author's own `/*`: their values and removals stand.
+            for (const [name, value] of siteWide)
+                if (!rule.sets.has(name) && !rule.unsets.has(name))
+                    add(rule, `  ${headerName(name)}: ${value}`);
+            continue;
+        }
+        for (const name of rule.sets)
+            if (replaced.has(name) && !rule.unsets.has(name))
+                add(rule, `  ${UNSET_PREFIX}${headerName(name)}`);
+    }
+    for (const [rule, line] of cspInAuthorRules)
+        add(rule, line);
+    const skip = new Set();
+    const rendered = (from, to) => {
+        const out = [];
+        for (let i = from; i < to; i++) {
+            if (skip.has(i))
+                continue;
+            out.push(lines[i]);
+            const extra = additions.get(i);
+            if (extra)
+                out.push(...extra);
+        }
+        while (out.length && out[out.length - 1].trim() === "")
+            out.pop();
+        return out;
+    };
+    const blocks = [];
+    if (authorSiteWide) {
+        // First: the author's `/*` (with the comments above it when it is their
+        // first rule). An earlier `/*` rule Cloudflare already ignores (the last
+        // one written wins) is left out, or it would take the moved rule's place.
+        const from = authorSiteWide === rules[0] ? 0 : authorSiteWide.line;
+        blocks.push(rendered(from, authorSiteWide.end));
+        for (let i = from; i < authorSiteWide.end; i++)
+            skip.add(i);
+        for (const rule of rules)
+            if (rule.path === SITE_WIDE_PATH)
+                for (let i = rule.line; i < rule.end; i++)
+                    skip.add(i);
+    }
+    else if (siteWide.size > 0) {
+        blocks.push([
+            SITE_WIDE_PATH,
+            ...[...siteWide].map(([name, value]) => `  ${headerName(name)}: ${value}`),
+        ]);
+    }
+    if (cspRules.length)
+        blocks.push(cspRules);
+    const rest = rendered(0, lines.length);
+    if (rest.length)
+        blocks.push(rest);
+    const text = `${blocks.map((b) => b.join("\n")).join("\n\n")}\n`;
+    const tooLong = text
+        .split("\n")
+        .findIndex((line) => line.trim().length > CLOUDFLARE_HEADERS_LINE_LIMIT);
+    if (tooLong !== -1) {
+        const line = text.split("\n")[tooLong].trim();
+        throw new Error(`[bascik] --target cloudflare: a line in your _headers is ${line.length} characters ` +
+            `(${line.slice(0, 60)}...), but Cloudflare skips any _headers line over ${CLOUDFLARE_HEADERS_LINE_LIMIT} ` +
+            `characters with no error. Shorten it.`);
+    }
+    const total = countHeadersRules(text);
+    if (total > CLOUDFLARE_HEADERS_RULE_LIMIT) {
+        const newSiteWide = !authorSiteWide && siteWide.size > 0 ? 1 : 0;
+        const cspPages = cspRules.length / 2;
+        const authoredRules = total - newSiteWide - cspPages;
+        const parts = [
+            ...(cspPages
+                ? [`${cspPages} for contentSecurityPolicy, one for each static page`]
+                : []),
+            ...(newSiteWide
+                ? ["1 site-wide rule for security.headers and security.hsts"]
+                : []),
+            ...(authoredRules ? [`${authoredRules} already in your _headers`] : []),
+        ];
+        throw new Error(`[bascik] --target cloudflare: public/_headers needs ${total} rules (${parts.join(", ")}), but Cloudflare ` +
+            `reads at most ${CLOUDFLARE_HEADERS_RULE_LIMIT} and drops the rest with no error. ${remedy(variant)} ` +
+            `Or remove rules from your _headers (a path written twice counts twice).`);
+    }
+    return text;
+};
+/**
+ * The author's _headers rules that set or remove a security header on a page
+ * the Worker renders. `_headers` reaches static files only, so on those pages
+ * the Worker keeps `security.headers`' value: one warning per rule, naming a
+ * page, so the author can move the value into the config.
+ */
+export const workerPageHeaderOverrides = ({ authored, security = DEFAULT_RESPONSE_SECURITY, base, workerPages, }) => {
+    const prefix = base === "/" ? "" : base.replace(/\/$/, "");
+    const watched = new Set([
+        ...MANAGED_HEADERS,
+        ...Object.keys(security.headers),
+    ]);
+    const warnings = [];
+    const effective = new Map();
+    for (const rule of parseRules(linesOf(authored)))
+        effective.set(rule.path, rule);
+    for (const rule of effective.values()) {
+        const names = [...rule.sets, ...rule.unsets].filter((n) => watched.has(n));
+        if (!names.length)
+            continue;
+        const page = workerPages
+            .map((p) => `${prefix}${p}`)
+            .find((p) => ruleMatches(rule.path, p));
+        if (!page)
+            continue;
+        warnings.push(`[bascik] --target cloudflare: your _headers rule ${rule.path} sets ${[...new Set(names)].map(headerName).join(", ")}, ` +
+            `but ${page} is rendered by the Worker and _headers rules reach static files only, so that page keeps ` +
+            `Bascik's value. To change the header on every page, set it in security.headers.`);
+    }
+    return warnings;
+};
+//# sourceMappingURL=headers-file.js.map

package/dist/headers-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"headers-file.js","sourceRoot":"","sources":["../src/headers-file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,gBAAgB,GAIjB,MAAM,wBAAwB,CAAC;AAEhC,2EAA2E;AAC3E,MAAM,CAAC,MAAM,6BAA6B,GAAG,GAAG,CAAC;AAEjD,0EAA0E;AAC1E,MAAM,CAAC,MAAM,6BAA6B,GAAG,IAAI,CAAC;AAElD,MAAM,cAAc,GAAG,IAAI,CAAC;AAE5B,6EAA6E;AAC7E,MAAM,SAAS,GAAG,mBAAmB,CAAC;AACtC,MAAM,YAAY,GAAG,IAAI,CAAC;AAE1B,MAAM,SAAS,GAAG;IAChB,yBAAyB;IACzB,qCAAqC;CACtC,CAAC;AAEF;;;;GAIG;AACH,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC;IACnD,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC;IAChC,2BAA2B;IAC3B,GAAG,SAAS;CACb,CAAC,CAAC;AAEH,oFAAoF;AACpF,MAAM,UAAU,GAAG,CAAC,KAAa,EAAU,EAAE,CAC3C,KAAK,CAAC,OAAO,CACX,eAAe,EACf,CAAC,CAAC,EAAE,IAAY,EAAE,CAAS,EAAE,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAC5D,CAAC;AAcJ,+FAA+F;AAC/F,MAAM,UAAU,GAAG,CAAC,KAAe,EAAU,EAAE;IAC7C,MAAM,KAAK,GAAW,EAAE,CAAC;IACzB,IAAI,IAAsB,CAAC;IAC3B,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;QAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO;QAChD,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,IAAI,IAAI;gBAAE,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC;YAC3B,IAAI,GAAG;gBACL,IAAI,EAAE,IAAI;gBACV,IAAI,EAAE,KAAK;gBACX,GAAG,EAAE,KAAK,CAAC,MAAM;gBACjB,IAAI,EAAE,IAAI,GAAG,EAAE;gBACf,MAAM,EAAE,IAAI,GAAG,EAAE;aAClB,CAAC;YACF,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;aACnE,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,MAAM,OAAO,GAAG,CAAC,IAAY,EAAY,EAAE,CACzC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AAE7D;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,IAAY,EAAU,EAAE,CACxD,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;KAC1E,MAAM,CAAC;AAEZ,0FAA0F;AAC1F,MAAM,WAAW,GAAG,CAAC,QAAgB,EAAE,IAAY,EAAW,EAAE;IAC9D,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,MAAM,GAAG,QAAQ;SACpB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;SAC5D,IAAI,CAAC,IAAI,CAAC;SACV,OAAO,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;IACrC,IAAI,CAAC;QACH,OAAO,IAAI,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAsBF,mFAAmF;AACnF,MAAM,MAAM,GAAG,CAAC,OAA4B,EAAU,EAAE,CACtD,OAAO,KAAK,SAAS;IACnB,CAAC,CAAC,4HAA4H;QAC5H,uFAAuF;IACzF,CAAC,CAAC,gHAAgH;QAChH,qHAAqH,CAAC;AAE5H;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,EAC/B,QAAQ,EACR,QAAQ,GAAG,yBAAyB,EACpC,IAAI,EACJ,GAAG,EACH,OAAO,GAAG,SAAS,GACF,EAAU,EAAE;IAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChC,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAChC,gFAAgF;IAChF,MAAM,SAAS,GAAG,IAAI,GAAG,EAAgB,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACzD,MAAM,cAAc,GAAG,SAAS,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAErD,2DAA2D;IAC3D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAiB,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3E,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI;QACxB,QAAQ,CAAC,GAAG,CAAC,2BAA2B,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IAE3D,yEAAyE;IACzE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC9C,MAAM,GAAG,GAAG,CAAC,IAAU,EAAE,IAAY,EAAE,EAAE;QACvC,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChB,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACjC,CAAC,CAAC;IAEF,yBAAyB;IACzB,MAAM,MAAM,GAAG,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,gBAAgB,GAAqB,EAAE,CAAC;IAC9C,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,IAAI,GAAG,EAAE,CAAC;QACR,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;YACrC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,2BAA2B,CACjD,GAAG,CAAC,MAAM,EACV,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAClB,CAAC;YACF,MAAM,IAAI,GAAG,GAAG,MAAM,GAAG,KAAK,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,KAAK,UAAU,CAAC,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC;YAC/C,sEAAsE;YACtE,MAAM,aAAa,GAAG,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAChD,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC9C,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAC/B,CAAC;YACF,IAAI,aAAa;gBAAE,SAAS;YAC5B,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,6BAA6B;gBACpD,MAAM,IAAI,KAAK,CACb,qCAAqC,UAAU,CAAC,IAAI,CAAC,6BAA6B,IAAI,MAAM;oBAC1F,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,mFAAmF;oBACxG,gCAAgC,6BAA6B,8CAA8C;oBAC3G,wBAAwB,MAAM,CAAC,OAAO,CAAC,mEAAmE,CAC7G,CAAC;YACJ,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC3B,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAChC,sEAAsE;YACtE,IAAI,GAAG;gBAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;;gBACvC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAEjE,0EAA0E;IAC1E,yBAAyB;IACzB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;QACvB,GAAG,eAAe;QAClB,GAAG,QAAQ,CAAC,IAAI,EAAE;QAClB,GAAG,CAAC,cAAc,EAAE,IAAI,IAAI,EAAE,CAAC;KAChC,CAAC,CAAC;IACH,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;QACtC,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;YAC5B,0DAA0D;YAC1D,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,QAAQ;gBAClC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;oBAChD,GAAG,CAAC,IAAI,EAAE,KAAK,UAAU,CAAC,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;YACjD,SAAS;QACX,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI;YAC1B,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;gBAC9C,GAAG,CAAC,IAAI,EAAE,KAAK,YAAY,GAAG,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,gBAAgB;QAAE,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAE7D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,EAAU,EAAY,EAAE;QACtD,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,KAAK,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;YAC/B,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,SAAS;YAC1B,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACnB,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC/B,IAAI,KAAK;gBAAE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,GAAG,CAAC,GAAG,EAAE,CAAC;QAClE,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEF,MAAM,MAAM,GAAe,EAAE,CAAC;IAC9B,IAAI,cAAc,EAAE,CAAC;QACnB,wEAAwE;QACxE,yEAAyE;QACzE,0EAA0E;QAC1E,MAAM,IAAI,GAAG,cAAc,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC;QACnE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;QAChD,KAAK,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,cAAc,CAAC,GAAG,EAAE,CAAC,EAAE;YAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC5D,KAAK,MAAM,IAAI,IAAI,KAAK;YACtB,IAAI,IAAI,CAAC,IAAI,KAAK,cAAc;gBAC9B,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE;oBAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7D,CAAC;SAAM,IAAI,QAAQ,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC;YACV,cAAc;YACd,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,GAAG,CAClB,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,UAAU,CAAC,IAAI,CAAC,KAAK,KAAK,EAAE,CACrD;SACF,CAAC,CAAC;IACL,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM;QAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,IAAI,CAAC,MAAM;QAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;IAEjE,MAAM,OAAO,GAAG,IAAI;SACjB,KAAK,CAAC,IAAI,CAAC;SACX,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,6BAA6B,CAAC,CAAC;IAC3E,IAAI,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,4DAA4D,IAAI,CAAC,MAAM,cAAc;YACnF,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,qDAAqD,6BAA6B,GAAG;YAC1G,uCAAuC,CAC1C,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,KAAK,GAAG,6BAA6B,EAAE,CAAC;QAC1C,MAAM,WAAW,GAAG,CAAC,cAAc,IAAI,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;QACrC,MAAM,aAAa,GAAG,KAAK,GAAG,WAAW,GAAG,QAAQ,CAAC;QACrD,MAAM,KAAK,GAAG;YACZ,GAAG,CAAC,QAAQ;gBACV,CAAC,CAAC,CAAC,GAAG,QAAQ,sDAAsD,CAAC;gBACrE,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,WAAW;gBACb,CAAC,CAAC,CAAC,yDAAyD,CAAC;gBAC7D,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,GAAG,aAAa,2BAA2B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACxE,CAAC;QACF,MAAM,IAAI,KAAK,CACb,uDAAuD,KAAK,WAAW,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB;YACzG,iBAAiB,6BAA6B,sCAAsC,MAAM,CAAC,OAAO,CAAC,GAAG;YACtG,yEAAyE,CAC5E,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,EACxC,QAAQ,EACR,QAAQ,GAAG,yBAAyB,EACpC,IAAI,EACJ,WAAW,GAOZ,EAAY,EAAE;IACb,MAAM,MAAM,GAAG,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC;QACtB,GAAG,eAAe;QAClB,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;KACjC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,SAAS,GAAG,IAAI,GAAG,EAAgB,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC9C,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3E,IAAI,CAAC,KAAK,CAAC,MAAM;YAAE,SAAS;QAC5B,MAAM,IAAI,GAAG,WAAW;aACrB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC;aAC3B,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,QAAQ,CAAC,IAAI,CACX,oDAAoD,IAAI,CAAC,IAAI,SAAS,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YACtH,OAAO,IAAI,4FAA4F;YACvG,iFAAiF,CACpF,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC"}

package/dist/index.d.ts

@@ -3,7 +3,7 @@
  *
  * Default export of @bascik/adapter-cloudflare.
  */
-export { CLOUDFLARE_COMPATIBILITY_DATE, CLOUDFLARE_COMPATIBILITY_FLAGS } from "./compat.js";
+export { CLOUDFLARE_COMPATIBILITY_DATE, CLOUDFLARE_COMPATIBILITY_FLAGS, } from "./compat.js";
 export { buildInvocationRoutes } from "./build.js";
 declare const _default: import("@bascik/bascik/adapter").HostingAdapter;
 export default _default;

package/dist/index.js

@@ -5,7 +5,7 @@
  */
 import { defineAdapter } from "@bascik/bascik/adapter";
 import { build } from "./build.js";
-export { CLOUDFLARE_COMPATIBILITY_DATE, CLOUDFLARE_COMPATIBILITY_FLAGS } from "./compat.js";
+export { CLOUDFLARE_COMPATIBILITY_DATE, CLOUDFLARE_COMPATIBILITY_FLAGS, } from "./compat.js";
 export { buildInvocationRoutes } from "./build.js";
 export default defineAdapter({
     name: "cloudflare",

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAEnC,OAAO,EAAE,6BAA6B,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAC;AAC5F,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAEnD,eAAe,aAAa,CAAC;IAC3B,IAAI,EAAE,YAAY;IAClB,KAAK;CACN,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAEnC,OAAO,EACL,6BAA6B,EAC7B,8BAA8B,GAC/B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAEnD,eAAe,aAAa,CAAC;IAC3B,IAAI,EAAE,YAAY;IAClB,KAAK;CACN,CAAC,CAAC"}

package/dist/runtime.d.ts

@@ -4,10 +4,12 @@
  * The request handler that runs inside a Cloudflare Worker (prompt 134).
  * ─────────────────────────────────────────────────────────────────────────────
  *
- * Portable: no Node imports. It is bundled into the generated `_worker.js`
- * together with the site graph emitted by `serverless-artifacts.ts`, and it
- * drives the same execution core the Node server uses
- * (`lib/request-execution.ts`).
+ * Portable: no Node imports (the request-time component host,
+ * component-host.ts, uses `node:crypto` under `nodejs_compat` and is bundled
+ * only for sites with components, prompt 157). It is bundled into the
+ * generated `_worker.js` together with the site graph emitted by
+ * `serverless-artifacts.ts`, and it drives the same execution core the Node
+ * server uses (`lib/request-execution.ts`).
  *
  * Request flow inside the Worker:
  *
@@ -28,16 +30,41 @@
  * (`{ name: "cloudflare", env, waitUntil }`). Nothing is copied onto globals
  * and `process.env` is never touched.
  */
-import { type ApiHandlerModule, type PlatformContext, type ScriptJobRunner, type ApiRouteDefinition } from "@bascik/bascik/runtime";
+import { type ApiHandlerModule, type ExecutionPlan, type PlatformContext, type RenderHost, type ScriptJobRunner, type ApiRouteDefinition, type ContentSecurityPolicyConfig, type CspRouteHashes, type RequestRenderLimits, type ResponseSecurity } from "@bascik/bascik/runtime";
 /** A request-time script job inside a dynamic page template. */
 export interface GraphScriptJob {
     id: string;
     mode: "server" | "stream";
+    /**
+     * The component's element classes for this job's output (prompt 157):
+     * set on component scripts, and on a page job a component placed
+     * statically, so their returned markup is styled like the component's own.
+     */
+    outputScope?: string;
+    /**
+     * Where a component script is authored (`server script in
+     * src/components/x.html:12`), set on component jobs (prompt 157): the
+     * bundled stack names only the Worker file, so a failure is located from
+     * this instead.
+     */
+    owner?: string;
     /** Loader for the compiled module; `default` is the handler. */
     load: () => Promise<{
         default: unknown;
     }>;
 }
+/** The build's component manifest, as the portable renderer reads it. */
+export type ComponentManifest = NonNullable<RenderHost["manifest"]>;
+/**
+ * Request-time components (prompt 157): the manifest, emitted by build.ts
+ * only when it lists a component, and the component scripts it names, keyed
+ * by job id. They belong to no page: any page's script may return any
+ * component.
+ */
+export interface GraphComponents {
+    manifest: ComponentManifest;
+    jobs: Record<string, GraphScriptJob>;
+}
 export interface GraphPageSegment {
     kind: "static" | "script";
     /** UTF-8 text for static segments. */
@@ -67,12 +94,46 @@ export interface SiteGraph {
     onServerScriptError: "error" | "warn" | "ignore";
     /** Dynamic pages by canonical path. */
     pages: Record<string, GraphPage>;
-    /** Sorted API routes (static before dynamic). */
+    /** Sorted API routes (static, then `[param]`, then catch-all). */
     apiRoutes: GraphApiRoute[];
     /** Optional authored 500 page body. */
     custom500?: string;
+    /** A static `404.html` is deployed; its own URLs answer 404, as on Node. */
+    staticNotFoundPage?: boolean;
     /** Release identity for diagnostics headers. */
     release: string;
+    /** Present when the site renders component tags in script output. */
+    components?: GraphComponents;
+    /**
+     * Opt-in `contentSecurityPolicy`: the policy and the build hashes of each
+     * page the Worker renders (static pages carry theirs in _headers).
+     */
+    contentSecurityPolicy?: {
+        policy: ContentSecurityPolicyConfig;
+        hashes: Record<string, CspRouteHashes>;
+    };
+    /**
+     * The build's `security.headers`, `security.hsts` and
+     * `security.privateDynamicPages`, resolved. Absent: the defaults.
+     */
+    responseSecurity?: ResponseSecurity;
+    /**
+     * Set when the Worker runs before every static file (`run_worker_first:
+     * true` in the authored wrangler config): the build writes no `_headers`
+     * rules, and the Worker adds the security headers, and each listed static
+     * page's CSP, to what the asset layer returns. A header the response
+     * already has (from the author's own `_headers`) is kept.
+     */
+    assetHeaders?: {
+        /** Static pages (paths without the base) whose CSP the Worker sends. */
+        cspRoutes: string[];
+    };
+    /** The build's `security.hideDotfiles`. Absent: true. */
+    hideDotfiles?: boolean;
+    /** The build's `scripts.stripAnsi`. Absent: true. */
+    stripAnsi?: boolean;
+    /** The build's `scripts.renderLimits`. Absent: the defaults. */
+    renderLimits?: Partial<RequestRenderLimits>;
 }
 export interface CloudflareAssetsBinding {
     fetch(request: Request): Promise<Response>;
@@ -93,15 +154,28 @@ export declare const stripBase: (pathname: string, base: string) => string | nul
 /** Derive the client IP from Cloudflare's trusted header; never from X-Forwarded-For. */
 export declare const cloudflareRemoteIp: (request: Request) => string;
 /**
- * Build a `ScriptJobRunner` for one request. Output handling mirrors
- * `runServerScriptJob`: a string or stringifiable value is the fragment;
- * failure under `onServerScriptError: "error"` throws (500 before commit,
- * empty after), `warn` logs and yields empty, `ignore` yields empty.
+ * Build a `ScriptJobRunner` for one request: the page's own jobs, then the
+ * component scripts of `graph.components` (prompt 157), under the graph's
+ * script deadline and error policy (see `runGraphJob`).
  */
 export declare const createGraphJobRunner: (page: GraphPage, graph: SiteGraph, request: Request, context: {
     remoteIp: string;
     platform: PlatformContext;
 }, log: (message: string) => void) => ScriptJobRunner;
+/**
+ * The page's plan and runner for one request. With a component manifest
+ * that has something to render (prompt 157), the runner is wrapped so
+ * component tags in job output are rendered (component-host.ts), and the
+ * component scripts run like page jobs with the parent's remaining budget.
+ * Without one, plan and runner are exactly what they always were.
+ */
+export declare const createPageExecution: (page: GraphPage, graph: SiteGraph, request: Request, context: {
+    remoteIp: string;
+    platform: PlatformContext;
+}, log: (message: string) => void) => {
+    plan: ExecutionPlan;
+    run: ScriptJobRunner;
+};
 export interface CreateWorkerOptions {
     /** Diagnostics sink; defaults to `console.error`. Never reaches the client. */
     log?: (message: string) => void;