@bleedingdev/modern-js-app-tools-extensions 3.9.0-ultramodern.12 → 3.9.0-ultramodern.14

package/src/cloudflare-output-verifier/manifest.ts

@@ -61,6 +61,83 @@ export const verifyManifestShape = (
       path: manifestPath,
     });
   }
+  const security = manifest.security;
+  if (
+    !security ||
+    typeof security !== 'object' ||
+    typeof security.enabled !== 'boolean'
+  ) {
+    addIssue(issues, {
+      code: 'invalid-manifest',
+      message: 'Cloudflare output manifest security.enabled must be a boolean.',
+      path: manifestPath,
+    });
+  } else {
+    const cors = security.cors;
+    if (
+      !cors ||
+      typeof cors !== 'object' ||
+      typeof cors.assets !== 'boolean' ||
+      !Array.isArray(cors.allowedOrigins) ||
+      !Array.isArray(cors.allowedMethods) ||
+      !Array.isArray(cors.allowedHeaders)
+    ) {
+      addIssue(issues, {
+        code: 'invalid-manifest',
+        message: 'Cloudflare output manifest security.cors is incomplete.',
+        path: manifestPath,
+      });
+    }
+    if (security.enabled) {
+      const headers = security.headers;
+      const csp = security.contentSecurityPolicy;
+      const noindex = security.noindex;
+      if (
+        !headers ||
+        typeof headers !== 'object' ||
+        !['string', 'boolean'].includes(typeof headers.referrerPolicy) ||
+        !['string', 'boolean'].includes(typeof headers.contentTypeOptions) ||
+        !['string', 'boolean'].includes(typeof headers.permissionsPolicy)
+      ) {
+        addIssue(issues, {
+          code: 'invalid-manifest',
+          message: 'Cloudflare output manifest security.headers is incomplete.',
+          path: manifestPath,
+        });
+      }
+      if (
+        !csp ||
+        !['off', 'report-only', 'enforce'].includes(csp.mode) ||
+        !csp.directives ||
+        typeof csp.directives !== 'object' ||
+        Array.isArray(csp.directives) ||
+        Object.values(csp.directives).some(
+          value =>
+            !Array.isArray(value) ||
+            value.some(entry => typeof entry !== 'string'),
+        )
+      ) {
+        addIssue(issues, {
+          code: 'invalid-manifest',
+          message:
+            'Cloudflare output manifest security.contentSecurityPolicy is invalid.',
+          path: manifestPath,
+        });
+      }
+      if (
+        !noindex ||
+        typeof noindex.workersDev !== 'boolean' ||
+        typeof noindex.localhost !== 'boolean' ||
+        !Array.isArray(noindex.previewHostnames)
+      ) {
+        addIssue(issues, {
+          code: 'invalid-manifest',
+          message: 'Cloudflare output manifest security.noindex is incomplete.',
+          path: manifestPath,
+        });
+      }
+    }
+  }
   if (manifest.bff?.runtimeFramework === 'effect') {
     assertEqual(
       issues,

package/src/cloudflare-output-verifier/mutation-policy.ts

@@ -140,7 +140,17 @@ export const verifyCloudflareOutputMutationPolicy = async (
     if (excludedFiles.has(file)) {
       continue;
     }
-    const source = await fs.readFile(file, 'utf-8');
+    let source: string;
+    try {
+      source = await fs.readFile(file, 'utf-8');
+    } catch (error) {
+      // Concurrent sibling builds delete transient files (for example tsgo
+      // resolved configs) between the walk and the read.
+      if ((error as NodeJS.ErrnoException).code === 'ENOENT') {
+        continue;
+      }
+      throw error;
+    }
     for (const forbidden of FORBIDDEN_MUTATION_PATTERNS) {
       if (forbidden.pattern.test(source)) {
         addIssue(issues, {

package/src/cloudflare-output-verifier/worker-bundles.ts

@@ -5,6 +5,7 @@ import { isDeepStrictEqual } from 'node:util';
 import { parse } from '@babel/parser';
 import traverse, { type NodePath } from '@babel/traverse';
 import {
+  CLOUDFLARE_ROUTE_DATA_HANDLER_EXPORT,
   CLOUDFLARE_WORKER_BUNDLE_DIRECTORY,
   CLOUDFLARE_WORKER_NODE_BUILTINS,
   CLOUDFLARE_WORKER_PLATFORM_MODULES,
@@ -14,7 +15,7 @@ import { addIssue } from './issues';
 
 interface WorkerBundleReference {
   dispatcherExport?: string;
-  kind: 'effect-bff' | 'route';
+  kind: 'effect-bff' | 'route' | 'route-data';
   reference: string;
 }
 
@@ -22,12 +23,15 @@ interface ResolvedWorkerBundleReference extends WorkerBundleReference {
   path: string;
 }
 
-const getReferencedRouteWorkers = (manifest: JsonObject) =>
+const getReferencedRouteWorkers = (
+  manifest: JsonObject,
+  field: 'routeDataWorker' | 'worker',
+) =>
   Array.isArray(manifest?.routeSpec?.routes)
     ? manifest.routeSpec.routes
         .map((route: any) =>
-          typeof route?.worker === 'string' && route.worker.length > 0
-            ? route.worker
+          typeof route?.[field] === 'string' && route[field].length > 0
+            ? route[field]
             : undefined,
         )
         .filter(
@@ -58,10 +62,19 @@ export const getWorkerBundleReferences = (
           },
         ]
       : []),
-    ...getReferencedRouteWorkers(manifest).map((reference: string) => ({
-      kind: 'route' as const,
-      reference,
-    })),
+    ...getReferencedRouteWorkers(manifest, 'worker').map(
+      (reference: string) => ({
+        kind: 'route' as const,
+        reference,
+      }),
+    ),
+    ...getReferencedRouteWorkers(manifest, 'routeDataWorker').map(
+      (reference: string) => ({
+        dispatcherExport: CLOUDFLARE_ROUTE_DATA_HANDLER_EXPORT,
+        kind: 'route-data' as const,
+        reference,
+      }),
+    ),
   ];
 };
 
@@ -101,7 +114,9 @@ export const resolveWorkerBundleReference = (
 export const missingWorkerBundleMessage = (reference: WorkerBundleReference) =>
   reference.kind === 'effect-bff'
     ? 'Cloudflare Effect BFF manifest points to a missing worker bundle.'
-    : 'Cloudflare route worker manifest points to a missing worker bundle.';
+    : reference.kind === 'route-data'
+      ? 'Cloudflare route data worker manifest points to a missing worker bundle.'
+      : 'Cloudflare route worker manifest points to a missing worker bundle.';
 
 interface AstNode {
   type: string;
@@ -611,14 +626,15 @@ export const verifyWorkerBundleReferences = async (
     contract,
   );
   if (
-    worker.kind === 'effect-bff' &&
     typeof worker.dispatcherExport === 'string' &&
     !entryAnalysis?.exports.has(worker.dispatcherExport)
   ) {
     addIssue(issues, {
       code: 'invalid-worker-bundle',
       message:
-        'Cloudflare Effect BFF worker bundle must expose its manifest dispatcherExport.',
+        worker.kind === 'route-data'
+          ? `Cloudflare route data worker bundle must expose ${worker.dispatcherExport}.`
+          : 'Cloudflare Effect BFF worker bundle must expose its manifest dispatcherExport.',
       path: worker.path,
     });
   }

package/src/deploy-output/npmAliases.ts

@@ -5,6 +5,7 @@ type PackageJson = {
   name?: string;
   version?: string;
   dependencies?: Record<string, string>;
+  devDependencies?: Record<string, string>;
   optionalDependencies?: Record<string, string>;
   [key: string]: unknown;
 };
@@ -21,6 +22,7 @@ export type NpmAlias = {
 };
 
 const dependencyKeys = ['dependencies', 'optionalDependencies'] as const;
+const rootDependencyKeys = [...dependencyKeys, 'devDependencies'] as const;
 const exactVersionPattern =
   /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/u;
 
@@ -51,9 +53,12 @@ function parseNpmAlias(
   };
 }
 
-function aliasesFromPackageJson(packageJson: PackageJson): NpmAlias[] {
+function aliasesFromPackageJson(
+  packageJson: PackageJson,
+  keys: readonly (typeof rootDependencyKeys)[number][] = dependencyKeys,
+): NpmAlias[] {
   const aliases: NpmAlias[] = [];
-  for (const dependencyKey of dependencyKeys) {
+  for (const dependencyKey of keys) {
     for (const [aliasName, specifier] of Object.entries(
       packageJson[dependencyKey] ?? {},
     )) {
@@ -66,6 +71,46 @@ function aliasesFromPackageJson(packageJson: PackageJson): NpmAlias[] {
   return aliases;
 }
 
+async function catalogAliasesFromInstalledPackages(
+  appDirectory: string,
+  packageJson: PackageJson,
+): Promise<NpmAlias[]> {
+  const aliases: NpmAlias[] = [];
+  for (const dependencyKey of rootDependencyKeys) {
+    for (const [aliasName, specifier] of Object.entries(
+      packageJson[dependencyKey] ?? {},
+    )) {
+      if (!specifier.startsWith('catalog:')) {
+        continue;
+      }
+      let installedPackage: PackageJson;
+      try {
+        installedPackage = await readPackageJson(
+          path.join(appDirectory, 'node_modules', aliasName, 'package.json'),
+        );
+      } catch (error) {
+        if ((error as NodeJS.ErrnoException).code === 'ENOENT') {
+          continue;
+        }
+        throw error;
+      }
+      if (!installedPackage.name || !installedPackage.version) {
+        throw new Error(
+          `Installed catalog package ${aliasName} has no identity`,
+        );
+      }
+      if (installedPackage.name !== aliasName) {
+        aliases.push({
+          aliasName,
+          targetName: installedPackage.name,
+          targetVersion: installedPackage.version,
+        });
+      }
+    }
+  }
+  return aliases;
+}
+
 async function collectPackageRecords(
   nodeModulesDirectory: string,
 ): Promise<PackageRecord[]> {
@@ -278,7 +323,11 @@ export async function preserveNpmAliases({
     path.join(appDirectory, 'package.json'),
   );
   const rootAliases = [
-    ...aliasesFromPackageJson(appPackageJson),
+    ...aliasesFromPackageJson(appPackageJson, rootDependencyKeys),
+    ...(await catalogAliasesFromInstalledPackages(
+      appDirectory,
+      appPackageJson,
+    )),
     ...implicitAliases,
   ].filter(alias => alias.aliasName !== alias.targetName);