@bleedingdev/modern-js-app-tools-extensions 3.8.3-ultramodern.2

package/src/config.ts

@@ -0,0 +1,196 @@
+export type DeployTarget =
+  | 'node'
+  | 'vercel'
+  | 'netlify'
+  | 'ghPages'
+  | 'cloudflare';
+
+export type CloudflareWorkerSecurityCspMode = 'enforce' | 'report-only' | 'off';
+
+export type JsonValue =
+  | string
+  | number
+  | boolean
+  | null
+  | JsonValue[]
+  | { [key: string]: JsonValue };
+
+export interface CloudflareWorkerArtifactConfig {
+  /**
+   * Source file or directory, relative to the app root, to copy into
+   * `.output` after framework output has been staged.
+   */
+  from: string;
+  /**
+   * Destination path relative to `.output`.
+   */
+  to: string;
+}
+
+export interface CloudflareWorkerPublicAssetConfig {
+  /**
+   * Source file or directory, relative to the app root, to copy into
+   * Cloudflare Worker Static Assets.
+   */
+  from: string;
+  /**
+   * Destination path relative to `.output/public`.
+   */
+  to: string;
+}
+
+export interface CloudflareWorkerD1DatabaseConfig {
+  /**
+   * Worker binding name, for example `DB`.
+   */
+  binding: string;
+  /**
+   * Cloudflare D1 database name.
+   */
+  databaseName: string;
+  /**
+   * Cloudflare D1 database id.
+   */
+  databaseId: string;
+  /**
+   * Optional local migrations directory, relative to the app root. When set,
+   * Modern.js stages it into `.output` and points Wrangler at the staged copy.
+   */
+  migrationsDir?: string;
+  /**
+   * Optional preview database id used by Wrangler preview/local flows.
+   */
+  previewDatabaseId?: string;
+  /**
+   * Wrangler remote flag for D1 commands.
+   */
+  remote?: boolean;
+}
+
+export interface CloudflareWorkerServiceBindingConfig {
+  /** Worker binding name exposed on the module worker `env` object. */
+  binding: string;
+  /** Target Cloudflare Worker service name. */
+  service: string;
+  /**
+   * Optional application path prefix that Modern.js should dispatch to this
+   * service binding with `env[binding].fetch(request)`.
+   */
+  prefix?: string;
+  /**
+   * Server-rendered Module Federation fragments exposed by this Worker.
+   * These fields are written to the Modern.js worker manifest, but stripped
+   * from Wrangler's `services` entries.
+   */
+  fragments?: CloudflareWorkerServiceBindingFragmentConfig[];
+}
+
+export interface CloudflareWorkerServiceBindingFragmentConfig {
+  /** Stable remote id used by the shell's composition contract. */
+  remote: string;
+  /** Module Federation expose rendered by the fragment route. */
+  expose: string;
+  /** Expected boundary marker in the rendered fragment HTML. */
+  boundaryId: string;
+  /**
+   * Route path on the bound Worker. `{locale}` is replaced with the first
+   * locale segment from the incoming shell request.
+   */
+  path: string;
+}
+
+export interface CloudflareWorkerSecurityCspConfig {
+  mode?: CloudflareWorkerSecurityCspMode;
+  directives?: Record<string, string[] | string | false>;
+  additionalScriptSrc?: string[];
+  additionalStyleSrc?: string[];
+  additionalConnectSrc?: string[];
+  additionalImgSrc?: string[];
+  frameAncestors?: string[] | false;
+  reportUri?: string;
+  reason?: string;
+}
+
+export interface CloudflareWorkerSecurityNoindexConfig {
+  workersDev?: boolean;
+  localhost?: boolean;
+  previewHostnames?: string[];
+  reason?: string;
+}
+
+export interface CloudflareWorkerSecurityCorsConfig {
+  /**
+   * Origins allowed to read application responses (BFF APIs, SSR HTML,
+   * route fallbacks) cross-origin. Accepts exact origins
+   * (e.g. `https://shell.example.com`) or `'*'`.
+   * When empty, application responses carry no CORS headers (same-origin).
+   * @default []
+   */
+  allowedOrigins?: string[];
+  /**
+   * Methods advertised on CORS preflight responses for application routes.
+   * @default ['GET', 'HEAD', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS']
+   */
+  allowedMethods?: string[];
+  /**
+   * Headers advertised on CORS preflight responses for application routes.
+   * @default ['*']
+   */
+  allowedHeaders?: string[];
+  /**
+   * Apply wildcard CORS to static asset responses so federated remotes
+   * (remote entries, manifests, CSS) can be loaded cross-origin.
+   * @default true
+   */
+  assets?: boolean;
+  reason?: string;
+}
+
+export interface CloudflareWorkerSecurityConfig {
+  /**
+   * Disable all Cloudflare worker security defaults for this app.
+   * Prefer narrower escape hatches when possible.
+   */
+  enabled?: boolean;
+  headers?: {
+    referrerPolicy?: string | false;
+    contentTypeOptions?: 'nosniff' | false;
+    permissionsPolicy?: string | false;
+  };
+  contentSecurityPolicy?: CloudflareWorkerSecurityCspConfig;
+  noindex?: boolean | CloudflareWorkerSecurityNoindexConfig;
+  /**
+   * Cross-origin resource sharing policy applied by the generated worker.
+   * Asset responses default to wildcard CORS for federated loading;
+   * application responses (BFF, SSR) default to no CORS headers.
+   */
+  cors?: CloudflareWorkerSecurityCorsConfig;
+  /**
+   * @deprecated Write-only: this option never had any runtime effect — the
+   * generated worker never mutates application `Set-Cookie` headers.
+   * Kept temporarily so configs emitted by existing `modern create`
+   * templates keep typechecking; will be removed once the generator stops
+   * emitting it. Use {@link CloudflareWorkerSecurityConfig.cors} for the
+   * worker's cross-origin policy.
+   */
+  cookies?: {
+    mutateSetCookie?: false;
+    reason?: string;
+  };
+  reason?: string;
+}
+
+export interface CloudflareDeployConfig {
+  worker?: {
+    name?: string;
+    compatibilityDate?: string;
+    ssr?: boolean;
+    security?: CloudflareWorkerSecurityConfig;
+    wrangler?: Record<string, JsonValue>;
+    artifacts?: CloudflareWorkerArtifactConfig[];
+    publicAssets?: CloudflareWorkerPublicAssetConfig[];
+    d1Databases?: CloudflareWorkerD1DatabaseConfig[];
+    services?: CloudflareWorkerServiceBindingConfig[];
+    publicAssetExcludes?: string[];
+  };
+}

package/src/css-extract-runtime-plugin.ts

@@ -0,0 +1,70 @@
+import type { Rspack } from '@rsbuild/core';
+
+const PLUGIN_NAME = 'ModernjsCssExtractRuntimePlugin';
+const CSS_LOADING_RUNTIME_MODULE = 'webpack/runtime/css loading';
+const CSS_EXTRACT_STYLESHEET_MATCH =
+  '\t\tif (tag.rel === "stylesheet" && (dataHref === href || dataHref === fullhref)) return tag;';
+const CSS_EXTRACT_STYLESHEET_MATCH_WITH_NORMALIZED_URL = `\t\tvar absoluteHref = tag.href;
+\t\tvar absoluteFullHref = new URL(fullhref, document.baseURI).href;
+\t\tif (tag.rel === "stylesheet" && (dataHref === href || dataHref === fullhref || absoluteHref === absoluteFullHref)) return tag;`;
+
+const isAutomaticPublicPath = (publicPath: unknown) =>
+  publicPath === 'auto' || publicPath === 'auto/';
+
+export const normalizeCssExtractRuntimeStylesheetLookup = (
+  source: string,
+): string => {
+  // CssExtractRspackPlugin concatenates automatic public paths and CSS asset
+  // names as strings. A path such as `/static/js/../../static/css/lazy.css`
+  // is browser-equivalent to the SSR link `/static/css/lazy.css`, but its
+  // runtime lookup compares the two raw strings and inserts a duplicate link.
+  // Compare the complete resolved URLs as well, while preserving the upstream
+  // raw `data-href` and `href` matching behaviour. Query strings remain part
+  // of canonical identity so a newly versioned stylesheet is never suppressed.
+  if (!source.includes('__webpack_require__.miniCssF')) {
+    return source;
+  }
+
+  const occurrences = source.split(CSS_EXTRACT_STYLESHEET_MATCH).length - 1;
+  if (occurrences !== 1) {
+    throw new Error(
+      `Unsupported CssExtractRspackPlugin runtime shape: expected one stylesheet lookup, found ${occurrences}.`,
+    );
+  }
+
+  return source.replace(
+    CSS_EXTRACT_STYLESHEET_MATCH,
+    CSS_EXTRACT_STYLESHEET_MATCH_WITH_NORMALIZED_URL,
+  );
+};
+
+export class CssExtractRuntimePlugin {
+  readonly name = PLUGIN_NAME;
+
+  apply(compiler: Rspack.Compiler) {
+    if (!isAutomaticPublicPath(compiler.options.output.publicPath)) {
+      return;
+    }
+
+    compiler.hooks.thisCompilation.tap(PLUGIN_NAME, compilation => {
+      compilation.hooks.runtimeModule.tap(PLUGIN_NAME, runtimeModule => {
+        if (runtimeModule.identifier() !== CSS_LOADING_RUNTIME_MODULE) {
+          return;
+        }
+
+        const source = runtimeModule.source;
+        if (!source) {
+          return;
+        }
+
+        const runtimeSource = source.source;
+        if (typeof runtimeSource !== 'string') {
+          return;
+        }
+
+        source.source =
+          normalizeCssExtractRuntimeStylesheetLookup(runtimeSource);
+      });
+    });
+  }
+}

package/src/index.ts

@@ -0,0 +1,10 @@
+export * from './cloudflare';
+export * from './cloudflare-builder';
+export * from './cloudflare-output-contract';
+export * from './cloudflare-output-plan';
+export * from './cloudflare-output-verifier';
+export * from './config';
+export * from './css-extract-runtime-plugin';
+export * from './release-envelope';
+export * from './release-envelope/plugin';
+export * from './release-identity';

package/src/read-template.ts

@@ -0,0 +1,8 @@
+import path from 'node:path';
+import { fs as fse } from '@modern-js/utils';
+
+export const getTemplatePath = (file: string) =>
+  path.join(__dirname, 'templates', file);
+
+export const readTemplate = async (file: string) =>
+  (await fse.readFile(getTemplatePath(file))).toString();

package/src/release-envelope/canonical.ts

@@ -0,0 +1,58 @@
+import { createHash } from 'node:crypto';
+import type {
+  MicroVerticalReleaseEnvelope,
+  MicroVerticalReleaseEnvelopePayload,
+} from './types';
+
+type CanonicalValue =
+  | null
+  | boolean
+  | number
+  | string
+  | CanonicalValue[]
+  | { [key: string]: CanonicalValue };
+
+const serializeCanonicalValue = (value: CanonicalValue): string => {
+  if (value === null || typeof value !== 'object') {
+    if (typeof value === 'number' && !Number.isFinite(value)) {
+      throw new Error('Canonical release-envelope values must be finite.');
+    }
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map(serializeCanonicalValue).join(',')}]`;
+  }
+  return `{${Object.keys(value)
+    .sort()
+    .map(
+      key =>
+        `${JSON.stringify(key)}:${serializeCanonicalValue(value[key] as CanonicalValue)}`,
+    )
+    .join(',')}}`;
+};
+
+export const releaseEnvelopePayload = (
+  envelope: MicroVerticalReleaseEnvelope,
+): MicroVerticalReleaseEnvelopePayload => ({
+  schemaVersion: envelope.schemaVersion,
+  kind: envelope.kind,
+  target: envelope.target,
+  identity: envelope.identity,
+  artifacts: envelope.artifacts,
+  surfaces: envelope.surfaces,
+});
+
+export const canonicalSerializeMicroVerticalReleaseEnvelopePayload = (
+  payload: MicroVerticalReleaseEnvelopePayload,
+) => serializeCanonicalValue(payload as unknown as CanonicalValue);
+
+export const canonicalSerializeMicroVerticalReleaseEnvelope = (
+  envelope: MicroVerticalReleaseEnvelope,
+) => serializeCanonicalValue(envelope as unknown as CanonicalValue);
+
+export const digestMicroVerticalReleaseEnvelopePayload = (
+  payload: MicroVerticalReleaseEnvelopePayload,
+) =>
+  createHash('sha256')
+    .update(canonicalSerializeMicroVerticalReleaseEnvelopePayload(payload))
+    .digest('hex');