@bleedingdev/modern-js-app-tools-extensions 3.8.3-ultramodern.2

package/src/release-envelope/plugin.ts

@@ -0,0 +1,125 @@
+import path from 'node:path';
+import {
+  emitFrameworkMicroVerticalReleaseEnvelope,
+  emitNodeStagedReleaseEnvelope,
+  verifyBuildOutputReleaseEnvelope,
+  verifyNodeReleaseEnvelopeStaging,
+} from './framework-output';
+
+type ReleaseEnvelopeTarget = 'cloudflare' | 'node' | string;
+
+export interface ReleaseEnvelopeConfig {
+  deploy?: { target?: string };
+}
+
+export interface ReleaseEnvelopeAppContext {
+  apiOnly: boolean;
+  appDirectory: string;
+  distDirectory: string;
+  metaName: string;
+}
+
+export interface ReleaseEnvelopePluginApi<
+  Config extends ReleaseEnvelopeConfig = ReleaseEnvelopeConfig,
+> {
+  getAppContext(): ReleaseEnvelopeAppContext;
+  getNormalizedConfig(): Config;
+  onAfterBuild(handler: () => Promise<void>): void;
+  onBeforeDeploy(handler: () => Promise<void>): void;
+  onAfterDeploy(handler: () => Promise<void>): void;
+}
+
+export interface ReleaseEnvelopePlugin<
+  Config extends ReleaseEnvelopeConfig = ReleaseEnvelopeConfig,
+> {
+  name: string;
+  pre: string[];
+  post: string[];
+  setup(api: ReleaseEnvelopePluginApi<Config>): void;
+}
+
+export type ResolveDeployTarget<
+  Config extends ReleaseEnvelopeConfig = ReleaseEnvelopeConfig,
+> = (config: Config) => ReleaseEnvelopeTarget;
+
+const resolveActiveDeployTarget = <Config extends ReleaseEnvelopeConfig>(
+  api: ReleaseEnvelopePluginApi<Config>,
+  resolveDeployTarget: ResolveDeployTarget<Config>,
+) => {
+  const { metaName } = api.getAppContext();
+  const config = api.getNormalizedConfig();
+  if (
+    metaName !== 'modern-js' &&
+    !config.deploy?.target &&
+    !process.env.MODERNJS_DEPLOY
+  ) {
+    return undefined;
+  }
+  return resolveDeployTarget(config);
+};
+
+export const createUltramodernReleaseEnvelopePlugin = <
+  Config extends ReleaseEnvelopeConfig,
+>({
+  resolveDeployTarget,
+}: {
+  resolveDeployTarget: ResolveDeployTarget<Config>;
+}): ReleaseEnvelopePlugin<Config> => {
+  return {
+    name: '@modern-js/ultramodern-release-envelope',
+    pre: ['@modern-js/backend-federation-build', '@modern-js/plugin-bff'],
+    post: ['@modern-js/plugin-deploy'],
+    setup(api) {
+      const emitBuildEnvelope = async (target: 'node' | 'cloudflare') => {
+        const { apiOnly, distDirectory } = api.getAppContext();
+        await emitFrameworkMicroVerticalReleaseEnvelope({
+          apiOnly,
+          distDirectory,
+          target,
+        });
+      };
+
+      api.onAfterBuild(async () => {
+        const configuredTarget = resolveDeployTarget(api.getNormalizedConfig());
+        if (configuredTarget !== 'node' && configuredTarget !== 'cloudflare') {
+          return;
+        }
+        await emitBuildEnvelope(configuredTarget);
+      });
+
+      api.onBeforeDeploy(async () => {
+        const configuredTarget = resolveActiveDeployTarget(
+          api,
+          resolveDeployTarget,
+        );
+        if (configuredTarget !== 'node') {
+          return;
+        }
+        await emitBuildEnvelope(configuredTarget);
+        const { distDirectory } = api.getAppContext();
+        await verifyBuildOutputReleaseEnvelope(distDirectory, configuredTarget);
+      });
+
+      api.onAfterDeploy(async () => {
+        const configuredTarget = resolveActiveDeployTarget(
+          api,
+          resolveDeployTarget,
+        );
+        if (configuredTarget !== 'node') {
+          return;
+        }
+        const { appDirectory, distDirectory } = api.getAppContext();
+        const outputDirectory = path.join(appDirectory, '.output');
+        const releaseEnvelope = await emitNodeStagedReleaseEnvelope({
+          distDirectory,
+          outputDirectory,
+        });
+        if (releaseEnvelope) {
+          await verifyNodeReleaseEnvelopeStaging({
+            outputDirectory,
+          });
+        }
+      });
+    },
+  };
+};

package/src/release-envelope/types.ts

@@ -0,0 +1,83 @@
+export const MICROVERTICAL_RELEASE_ENVELOPE_SCHEMA_VERSION = 3 as const;
+
+export const MICROVERTICAL_RELEASE_ENVELOPE_KIND =
+  'ultramodern-target-microvertical-release-envelope' as const;
+
+export const MICROVERTICAL_RELEASE_TARGETS = ['node', 'cloudflare'] as const;
+
+export type MicroVerticalReleaseTarget =
+  (typeof MICROVERTICAL_RELEASE_TARGETS)[number];
+
+export type MicroVerticalReleaseIdentity = {
+  unitId: string;
+  buildMarker: string;
+  sourceRevision: string;
+  releaseVersion: string;
+};
+
+export type MicroVerticalReleaseArtifactInput = {
+  logicalPath: string;
+  runtime: string;
+};
+
+export type MicroVerticalReleaseFileArtifact =
+  MicroVerticalReleaseArtifactInput & {
+    kind: 'file';
+    byteLength: number;
+    sha256: string;
+  };
+
+export type MicroVerticalReleaseSymbolicLinkArtifact =
+  MicroVerticalReleaseArtifactInput & {
+    kind: 'symbolic-link';
+    linkTarget: string;
+    targetKind: 'directory' | 'file';
+    targetLogicalPath: string;
+  };
+
+export type MicroVerticalReleaseArtifact =
+  | MicroVerticalReleaseFileArtifact
+  | MicroVerticalReleaseSymbolicLinkArtifact;
+
+export type MicroVerticalReleaseArtifactInputs = {
+  artifacts: MicroVerticalReleaseArtifactInput[];
+  surfaces: MicroVerticalReleaseSurfaces;
+};
+
+export type MicroVerticalReleaseSurfaces = {
+  uiClient: string[];
+  ssr: string[];
+  apiBackend: string[];
+  backendFederation: {
+    manifest: string;
+    container: string;
+  };
+};
+
+export type MicroVerticalReleaseEnvelopePayload = {
+  schemaVersion: typeof MICROVERTICAL_RELEASE_ENVELOPE_SCHEMA_VERSION;
+  kind: typeof MICROVERTICAL_RELEASE_ENVELOPE_KIND;
+  target: MicroVerticalReleaseTarget;
+  identity: MicroVerticalReleaseIdentity;
+  artifacts: MicroVerticalReleaseArtifact[];
+  surfaces: MicroVerticalReleaseSurfaces;
+};
+
+export type MicroVerticalReleaseEnvelope =
+  MicroVerticalReleaseEnvelopePayload & {
+    envelopeDigest: string;
+  };
+
+export type CreateMicroVerticalReleaseEnvelopeInput = {
+  artifactRoot: string;
+  target: MicroVerticalReleaseTarget;
+  identity: MicroVerticalReleaseIdentity;
+  artifacts: MicroVerticalReleaseArtifactInput[];
+  surfaces: MicroVerticalReleaseSurfaces;
+};
+
+export type VerifyMicroVerticalReleaseEnvelopeOptions = {
+  artifactRoot: string;
+  logicalPathForArtifact?: (artifact: MicroVerticalReleaseArtifact) => string;
+  expectedTarget?: MicroVerticalReleaseTarget;
+};

package/src/release-identity.ts

@@ -0,0 +1,134 @@
+import { execFileSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+
+const BUILD_MARKER_NAMESPACE =
+  'ultramodern-delivery-unit-release-build-marker:v1';
+const PROMOTABLE_SOURCE_REVISION_PATTERN = /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/u;
+
+export type UltramodernReleaseIdentity = {
+  buildMarker: string;
+  sourceRevision: string;
+};
+
+const gitOutput = (
+  workspaceRoot: string,
+  args: string[],
+): string | undefined => {
+  try {
+    return execFileSync('git', ['-C', workspaceRoot, ...args], {
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+    }).trim();
+  } catch {
+    return undefined;
+  }
+};
+
+export const createUltramodernReleaseBuildMarker = ({
+  generationBuildMarker,
+  sourceRevision,
+  unitId,
+}: {
+  generationBuildMarker: string;
+  sourceRevision: string;
+  unitId: string;
+}): string =>
+  createHash('sha256')
+    .update(
+      `${BUILD_MARKER_NAMESPACE}:${unitId}:${generationBuildMarker}:${sourceRevision}`,
+    )
+    .digest('hex')
+    .slice(0, 16);
+
+export const resolveUltramodernSourceRevision = (
+  workspaceRoot = process.cwd(),
+  configuredSourceRevision?: string,
+): string => {
+  const configuredArgumentValue = configuredSourceRevision?.trim();
+  const configuredEnvironmentValue =
+    process.env.ULTRAMODERN_SOURCE_REVISION?.trim();
+  const configuredArgument =
+    configuredArgumentValue && configuredArgumentValue !== 'workspace'
+      ? configuredArgumentValue
+      : undefined;
+  const configuredEnvironment =
+    configuredEnvironmentValue && configuredEnvironmentValue !== 'workspace'
+      ? configuredEnvironmentValue
+      : undefined;
+  if (
+    configuredArgument &&
+    configuredEnvironment &&
+    configuredArgument !== configuredEnvironment
+  ) {
+    throw new Error(
+      `Configured source revision ${configuredArgument} does not match environment source revision ${configuredEnvironment}.`,
+    );
+  }
+  const configured = configuredArgument ?? configuredEnvironment;
+  const gitRoot = gitOutput(workspaceRoot, ['rev-parse', '--show-toplevel']);
+  if (!gitRoot) {
+    // Source archives and synthetic non-Git proofs can provide an externally
+    // authenticated immutable revision. Git worktrees are handled below so
+    // this override can never conceal dirty or mismatched checkout bytes.
+    if (!configured) {
+      return 'workspace';
+    }
+    if (!PROMOTABLE_SOURCE_REVISION_PATTERN.test(configured)) {
+      throw new Error(
+        `Configured source revision ${configured} must be an exact lowercase 40- or 64-character Git object ID.`,
+      );
+    }
+    return configured;
+  }
+
+  const revision = gitOutput(gitRoot, ['rev-parse', 'HEAD']);
+  const status = gitOutput(gitRoot, [
+    'status',
+    '--porcelain=v1',
+    '--untracked-files=all',
+  ]);
+  if (!revision || status === undefined || status.length > 0) {
+    // Development remains usable, but the release-envelope gate rejects this
+    // non-promotable identity. Never label dirty bytes with the clean HEAD.
+    return 'workspace';
+  }
+  if (!PROMOTABLE_SOURCE_REVISION_PATTERN.test(revision)) {
+    return 'workspace';
+  }
+  if (configured && configured !== revision) {
+    throw new Error(
+      `Configured source revision ${configured} does not match clean Git HEAD ${revision}.`,
+    );
+  }
+
+  return revision;
+};
+
+export const resolveUltramodernReleaseIdentity = ({
+  generationBuildMarker,
+  sourceRevision: configuredSourceRevision,
+  unitId,
+  workspaceRoot,
+}: {
+  generationBuildMarker: string;
+  sourceRevision?: string;
+  unitId: string;
+  workspaceRoot?: string;
+}): UltramodernReleaseIdentity => {
+  const explicitSourceRevision = configuredSourceRevision?.trim();
+  const sourceRevision = resolveUltramodernSourceRevision(
+    workspaceRoot,
+    explicitSourceRevision,
+  );
+  return {
+    buildMarker:
+      sourceRevision === 'workspace'
+        ? generationBuildMarker
+        : createUltramodernReleaseBuildMarker({
+            generationBuildMarker,
+            sourceRevision,
+            unitId,
+          }),
+    sourceRevision,
+  };
+};

package/src/templates/cloudflare-entry.001-bootstrap-security.mjs

@@ -0,0 +1,251 @@
+const ASSETS_BINDING = 'ASSETS';
+const MODERN_WORKER_MANIFEST = p_workerManifest;
+export const modernWorkerManifest = MODERN_WORKER_MANIFEST;
+const WORKER_MODULE_LOADERS = p_workerModuleLoaders;
+const workerModulePromises = new Map();
+const effectBffDispatcherPromises = new Map();
+const remoteJsonPromises = new Map();
+const CORS_POLICY = MODERN_WORKER_MANIFEST.security?.cors || {};
+const ASSET_CORS_ENABLED = CORS_POLICY.assets !== false;
+const APP_CORS_ALLOWED_ORIGINS = (CORS_POLICY.allowedOrigins || []).map(
+  origin => String(origin).toLowerCase(),
+);
+const APP_CORS_ALLOWED_METHODS = (
+  CORS_POLICY.allowedMethods?.length
+    ? CORS_POLICY.allowedMethods
+    : ['GET', 'HEAD', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS']
+).join(', ');
+const APP_CORS_ALLOWED_HEADERS = (
+  CORS_POLICY.allowedHeaders?.length ? CORS_POLICY.allowedHeaders : ['*']
+).join(', ');
+const ASSET_CORS_HEADERS = {
+  'access-control-allow-headers': '*',
+  'access-control-allow-methods': 'GET, HEAD, OPTIONS',
+  'access-control-allow-origin': '*',
+};
+
+globalThis.__dirname ??= '/';
+globalThis.__filename ??= '/index.js';
+
+function getAllowedAppCorsOrigin(request) {
+  if (APP_CORS_ALLOWED_ORIGINS.length === 0) {
+    return null;
+  }
+
+  const origin = request.headers.get('origin');
+
+  if (!origin) {
+    return null;
+  }
+
+  if (APP_CORS_ALLOWED_ORIGINS.includes('*')) {
+    return '*';
+  }
+
+  return APP_CORS_ALLOWED_ORIGINS.includes(origin.toLowerCase())
+    ? origin
+    : null;
+}
+
+function appendVaryOrigin(headers) {
+  const vary = headers.get('vary');
+
+  if (!vary) {
+    headers.set('vary', 'origin');
+    return;
+  }
+
+  const varyValues = vary.split(',').map(value => value.trim().toLowerCase());
+
+  if (!varyValues.includes('origin')) {
+    headers.set('vary', `${vary}, origin`);
+  }
+}
+
+function withAppCorsHeaders(response, request) {
+  const allowedOrigin = getAllowedAppCorsOrigin(request);
+
+  if (!allowedOrigin) {
+    return response;
+  }
+
+  const headers = new Headers(response.headers);
+
+  if (!headers.has('access-control-allow-origin')) {
+    headers.set('access-control-allow-origin', allowedOrigin);
+  }
+
+  if (allowedOrigin !== '*') {
+    appendVaryOrigin(headers);
+  }
+
+  return new Response(response.body, {
+    headers,
+    status: response.status,
+    statusText: response.statusText,
+  });
+}
+
+function withAssetCorsHeaders(response) {
+  if (!ASSET_CORS_ENABLED) {
+    return response;
+  }
+
+  const headers = new Headers(response.headers);
+
+  for (const [name, value] of Object.entries(ASSET_CORS_HEADERS)) {
+    if (!headers.has(name)) {
+      headers.set(name, value);
+    }
+  }
+
+  return new Response(response.body, {
+    headers,
+    status: response.status,
+    statusText: response.statusText,
+  });
+}
+
+function setHeaderIfEnabled(headers, name, value) {
+  if (value === false || typeof value !== 'string' || value.trim() === '') {
+    return;
+  }
+
+  if (!headers.has(name)) {
+    headers.set(name, value);
+  }
+}
+
+function renderContentSecurityPolicy(directives) {
+  return Object.entries(directives || {})
+    .filter(([, values]) => Array.isArray(values) && values.length > 0)
+    .sort(([left], [right]) => left.localeCompare(right))
+    .map(([name, values]) => `${name} ${values.join(' ')}`)
+    .join('; ');
+}
+
+function isHtmlResponse(response) {
+  return (response.headers.get('content-type') || '').includes('text/html');
+}
+
+function matchesPreviewHostname(hostname, pattern) {
+  const normalizedHostname = hostname.toLowerCase();
+  const normalizedPattern = String(pattern || '').toLowerCase();
+
+  if (!normalizedPattern) {
+    return false;
+  }
+
+  if (normalizedPattern.startsWith('*.')) {
+    return normalizedHostname.endsWith(normalizedPattern.slice(1));
+  }
+
+  return normalizedHostname === normalizedPattern;
+}
+
+function shouldNoindex(request, noindex) {
+  if (!noindex || noindex === false) {
+    return false;
+  }
+
+  const { hostname } = new URL(request.url);
+  const normalizedHostname = hostname.toLowerCase();
+
+  if (
+    noindex.localhost !== false &&
+    (normalizedHostname === 'localhost' ||
+      normalizedHostname === '127.0.0.1' ||
+      normalizedHostname === '[::1]')
+  ) {
+    return true;
+  }
+
+  if (
+    noindex.workersDev !== false &&
+    normalizedHostname.endsWith('.workers.dev')
+  ) {
+    return true;
+  }
+
+  return (noindex.previewHostnames || []).some(pattern =>
+    matchesPreviewHostname(normalizedHostname, pattern),
+  );
+}
+
+function withCloudflareSecurityHeaders(response, request) {
+  const security = MODERN_WORKER_MANIFEST.security;
+
+  if (!security || security.enabled === false) {
+    return response;
+  }
+
+  const headers = new Headers(response.headers);
+  const configuredHeaders = security.headers || {};
+
+  setHeaderIfEnabled(
+    headers,
+    'referrer-policy',
+    configuredHeaders.referrerPolicy,
+  );
+  setHeaderIfEnabled(
+    headers,
+    'x-content-type-options',
+    configuredHeaders.contentTypeOptions,
+  );
+  setHeaderIfEnabled(
+    headers,
+    'permissions-policy',
+    configuredHeaders.permissionsPolicy,
+  );
+
+  const csp = security.contentSecurityPolicy;
+  const cspHeader =
+    csp?.mode === 'enforce'
+      ? 'content-security-policy'
+      : 'content-security-policy-report-only';
+  const cspValue = renderContentSecurityPolicy(csp?.directives);
+
+  if (
+    isHtmlResponse(response) &&
+    csp?.mode !== 'off' &&
+    cspValue &&
+    !headers.has(cspHeader)
+  ) {
+    headers.set(cspHeader, cspValue);
+  }
+
+  if (shouldNoindex(request, security.noindex)) {
+    headers.set('x-robots-tag', 'noindex, nofollow');
+  }
+
+  return new Response(response.body, {
+    headers,
+    status: response.status,
+    statusText: response.statusText,
+  });
+}
+
+function createRenderableRequest(request) {
+  if (request.method !== 'HEAD') {
+    return request;
+  }
+
+  return new Request(request, { method: 'GET' });
+}
+
+function finalizeResponseForRequest(response, request) {
+  const securedResponse = withCloudflareSecurityHeaders(response, request);
+
+  if (request.method !== 'HEAD') {
+    return securedResponse;
+  }
+
+  const headers = new Headers(securedResponse.headers);
+  headers.delete('content-length');
+
+  return new Response(null, {
+    headers,
+    status: securedResponse.status,
+    statusText: securedResponse.statusText,
+  });
+}