@bleedingdev/modern-js-app-tools-extensions 3.9.0-ultramodern.14 → 3.9.0-ultramodern.16

package/dist/esm-node/templates/cloudflare-entry.005-worker-dispatch.mjs

@@ -160,14 +160,46 @@ async function dispatchRouteWorker(route, request, env, ctx) {
   );
 }
 
-function matchesPrefix(pathname, prefix) {
+// Worker Static Assets decode percent-encoded paths, so an encoded spelling
+// of a mounted prefix (`/%70refix/...`, `/prefix%2F...`) would otherwise skip
+// the BFF or service binding that owns the prefix and reach ASSETS directly.
+// Resolve such spellings to the canonical pathname the owner sees; a
+// backslash or undecodable spelling becomes a path the owner rejects.
+function resolvePrefixPathname(pathname, prefix) {
   if (!prefix || prefix === '/') {
-    return true;
+    return pathname;
   }
 
   const normalized = prefix.endsWith('/') ? prefix.slice(0, -1) : prefix;
+  let candidate = pathname;
+
+  for (let attempt = 0; attempt < 4; attempt += 1) {
+    if (candidate === normalized || candidate.startsWith(`${normalized}/`)) {
+      return candidate;
+    }
+    if (candidate.startsWith(`${normalized}\\`)) {
+      return `${normalized}/__invalid_encoded_path__`;
+    }
+
+    let decoded;
+    try {
+      decoded = decodeURIComponent(candidate);
+    } catch {
+      return candidate.toLowerCase().startsWith(normalized.toLowerCase())
+        ? `${normalized}/__invalid_encoded_path__`
+        : null;
+    }
+    if (decoded === candidate) {
+      return null;
+    }
+    candidate = decoded;
+  }
 
-  return pathname === normalized || pathname.startsWith(`${normalized}/`);
+  return null;
+}
+
+function matchesPrefix(pathname, prefix) {
+  return resolvePrefixPathname(pathname, prefix) !== null;
 }
 
 function createRequestForMountedPrefix(request, prefix) {
@@ -177,12 +209,13 @@ function createRequestForMountedPrefix(request, prefix) {
 
   const url = new URL(request.url);
   const normalized = prefix.endsWith('/') ? prefix.slice(0, -1) : prefix;
+  const matchedPathname = resolvePrefixPathname(url.pathname, normalized);
 
-  if (!matchesPrefix(url.pathname, normalized)) {
+  if (matchedPathname === null) {
     return request;
   }
 
-  const nextPath = url.pathname.slice(normalized.length) || '/';
+  const nextPath = matchedPathname.slice(normalized.length) || '/';
   url.pathname = nextPath.startsWith('/') ? nextPath : `/${nextPath}`;
 
   return new Request(url, request);
@@ -309,12 +342,21 @@ function getEffectBffDispatcher(bff, runtime) {
 async function dispatchBffRequest(request, env) {
   const bff = MODERN_WORKER_MANIFEST.bff;
 
-  if (
-    !bff?.worker ||
-    !matchesPrefix(new URL(request.url).pathname, bff.prefix)
-  ) {
+  const requestUrl = new URL(request.url);
+  const matchedPathname = resolvePrefixPathname(
+    requestUrl.pathname,
+    bff?.prefix,
+  );
+  if (!bff?.worker || matchedPathname === null) {
     return null;
   }
+  const canonicalRequest =
+    matchedPathname === requestUrl.pathname
+      ? request
+      : new Request(
+          Object.assign(requestUrl, { pathname: matchedPathname }),
+          request,
+        );
   if (bff.runtimeFramework !== 'effect') {
     return createEffectBffDispatcherErrorResponse(
       bff,
@@ -347,7 +389,7 @@ async function dispatchBffRequest(request, env) {
       return createEffectBffDispatcherErrorResponse(bff, error);
     }
 
-    return effectDispatcher.dispatch(request, { env });
+    return effectDispatcher.dispatch(canonicalRequest, { env });
   }
 
   const directHandler =

package/dist/types/cloudflare/artifacts.d.ts

@@ -4,12 +4,13 @@ export declare const getCloudflareArtifacts: (modernConfig: CloudflareModernConf
     to: string;
     index: number;
 }[];
-export declare const getCloudflarePublicAssets: (modernConfig: CloudflareModernConfig) => {
-    from: string;
-    to: string;
-    index: number;
-}[];
+export declare const getCloudflarePublicAssets: (modernConfig: CloudflareModernConfig) => import("../deploy-output/public-assets.js").DeclaredPublicAsset[];
 export declare const copyCloudflareArtifacts: (appDirectory: string, outputDirectory: string, artifacts: ReturnType<typeof getCloudflareArtifacts>) => Promise<void>;
-export declare const copyCloudflarePublicAssets: (appDirectory: string, publicDirectory: string, publicAssets: ReturnType<typeof getCloudflarePublicAssets>) => Promise<void>;
+/**
+ * Stage `deploy.worker.publicAssets` into Worker Static Assets.
+ *
+ * @returns the staged files relative to the Cloudflare output root.
+ */
+export declare const copyCloudflarePublicAssets: (appDirectory: string, outputDirectory: string, publicAssets: ReturnType<typeof getCloudflarePublicAssets>) => Promise<string[]>;
 export declare const copyCloudflareD1Migrations: (appDirectory: string, outputDirectory: string, modernConfig: CloudflareModernConfig) => Promise<void>;
 export declare const readRouteSpec: (outputDirectory: string) => Promise<any>;

package/dist/types/config.d.ts

@@ -28,6 +28,17 @@ export interface CloudflareWorkerPublicAssetConfig {
      */
     to: string;
 }
+export interface NodePublicAssetConfig {
+    /**
+     * Source file or directory, relative to the app root, to copy into the
+     * Node deploy output's public directory.
+     */
+    from: string;
+    /**
+     * Destination path relative to `.output/public`.
+     */
+    to: string;
+}
 export interface CloudflareWorkerD1DatabaseConfig {
     /**
      * Worker binding name, for example `DB`.
@@ -176,3 +187,16 @@ export interface CloudflareDeployConfig {
         publicAssetExcludes?: string[];
     };
 }
+export interface NodeDeployConfig {
+    node?: {
+        /**
+         * Additional app-root files or directories to stage under
+         * `.output/public` when `modern deploy` targets Node, the counterpart of
+         * `deploy.worker.publicAssets`. The Node server does not route these
+         * files; serve them from the app, for example from an API handler.
+         * Release envelopes record them as declared public assets, so API-only
+         * units may ship them.
+         */
+        publicAssets?: NodePublicAssetConfig[];
+    };
+}

package/dist/types/deploy-output/plugin.d.ts

@@ -1,3 +1,4 @@
+import type { NodePublicAssetConfig } from '../config.js';
 import { type DeployOutputConfig } from './target.js';
 export interface DeployOutputPluginApi {
     getAppContext(): {
@@ -13,3 +14,28 @@ export declare const createDeployOutputAliasesPlugin: ({ resolveDeployTarget, }?
     name: string;
     setup(api: DeployOutputPluginApi): void;
 };
+export interface DeployOutputPublicAssetsConfig extends DeployOutputConfig {
+    deploy?: DeployOutputConfig['deploy'] & {
+        node?: {
+            publicAssets?: NodePublicAssetConfig[];
+        };
+    };
+}
+export interface DeployOutputPublicAssetsPluginApi {
+    getAppContext(): {
+        appDirectory: string;
+        metaName: string;
+    };
+    getNormalizedConfig(): DeployOutputPublicAssetsConfig;
+    onAfterDeploy(handler: () => Promise<void>): void;
+}
+/**
+ * Stage `deploy.node.publicAssets` into the Node deploy output. Cloudflare
+ * stages `deploy.worker.publicAssets` inside its deploy preset.
+ */
+export declare const createDeployOutputPublicAssetsPlugin: ({ resolveDeployTarget, }?: {
+    resolveDeployTarget?: (config: DeployOutputConfig) => string;
+}) => {
+    name: string;
+    setup(api: DeployOutputPublicAssetsPluginApi): void;
+};

package/dist/types/deploy-output/public-assets.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Deploy output directory that receives declared public assets on every
+ * target: Cloudflare Worker Static Assets and the Node deploy output.
+ */
+export declare const DECLARED_PUBLIC_ASSET_DIRECTORY = "public";
+export interface DeclaredPublicAssetConfig {
+    from: string;
+    to: string;
+}
+export interface DeclaredPublicAssetScope {
+    /** Config path used in errors, for example `deploy.node.publicAssets`. */
+    label: string;
+    /** Output described in destination errors. */
+    output: string;
+}
+export interface DeclaredPublicAsset {
+    from: string;
+    to: string;
+    index: number;
+}
+export declare const CLOUDFLARE_PUBLIC_ASSET_SCOPE: DeclaredPublicAssetScope;
+export declare const NODE_PUBLIC_ASSET_SCOPE: DeclaredPublicAssetScope;
+export declare const normalizeDeclaredPublicAssets: (assets: readonly DeclaredPublicAssetConfig[] | undefined, scope: DeclaredPublicAssetScope) => DeclaredPublicAsset[];
+/**
+ * Resolve the files declared public assets add to a deploy output that was
+ * copied from `generatedRoot`, relative to the deploy output root. Declared
+ * files that replace a generated file are not part of the result, matching
+ * {@link stageDeclaredPublicAssets}.
+ */
+export declare const resolveAddedDeclaredPublicAssetPaths: ({ appDirectory, assets, generatedRoot, scope, }: {
+    appDirectory: string;
+    assets: readonly DeclaredPublicAsset[];
+    generatedRoot: string;
+    scope: DeclaredPublicAssetScope;
+}) => Promise<string[]>;
+/**
+ * Copy declared public assets into the deploy output after the framework has
+ * staged its own public files.
+ *
+ * A declared file may replace a generated public file, such as an app-owned
+ * `robots.txt`; the replaced file keeps its generated release classification.
+ *
+ * @returns the files the declarations added, relative to the deploy output
+ * root. The release envelope records these as declared public assets.
+ */
+export declare const stageDeclaredPublicAssets: ({ appDirectory, outputDirectory, assets, scope, }: {
+    appDirectory: string;
+    outputDirectory: string;
+    assets: readonly DeclaredPublicAsset[];
+    scope: DeclaredPublicAssetScope;
+}) => Promise<string[]>;

package/dist/types/release-envelope/framework-output.d.ts

@@ -18,7 +18,9 @@ export declare const verifyNodeReleaseEnvelopeStaging: ({ outputDirectory, }: {
     distDirectory?: string;
     outputDirectory: string;
 }) => Promise<MicroVerticalReleaseEnvelope | undefined>;
-export declare const emitNodeStagedReleaseEnvelope: ({ distDirectory, outputDirectory, }: {
+export declare const emitNodeStagedReleaseEnvelope: ({ declaredPublicAssets, distDirectory, outputDirectory, }: {
+    /** Staged `deploy.node.publicAssets` files, relative to `outputDirectory`. */
+    declaredPublicAssets?: readonly string[];
     distDirectory: string;
     outputDirectory: string;
 }) => Promise<MicroVerticalReleaseEnvelope | undefined>;
@@ -26,7 +28,9 @@ export declare const stageCloudflareReleaseEnvelope: ({ distDirectory, outputDir
     distDirectory: string;
     outputDirectory: string;
 }) => Promise<MicroVerticalReleaseEnvelope | undefined>;
-export declare const emitCloudflareStagedReleaseEnvelope: ({ distDirectory, outputDirectory, }: {
+export declare const emitCloudflareStagedReleaseEnvelope: ({ declaredPublicAssets, distDirectory, outputDirectory, }: {
+    /** Staged `deploy.worker.publicAssets` files, relative to `outputDirectory`. */
+    declaredPublicAssets?: readonly string[];
     distDirectory: string;
     outputDirectory: string;
 }) => Promise<MicroVerticalReleaseEnvelope | undefined>;

package/dist/types/release-envelope/plugin.d.ts

@@ -1,7 +1,11 @@
+import type { NodePublicAssetConfig } from '../config.js';
 type ReleaseEnvelopeTarget = 'cloudflare' | 'node' | string;
 export interface ReleaseEnvelopeConfig {
     deploy?: {
         target?: string;
+        node?: {
+            publicAssets?: NodePublicAssetConfig[];
+        };
     };
 }
 export interface ReleaseEnvelopeAppContext {

package/package.json

@@ -11,7 +11,7 @@
     "directory": "packages/solutions/app-tools-extensions"
   },
   "license": "MIT",
-  "version": "3.9.0-ultramodern.14",
+  "version": "3.9.0-ultramodern.16",
   "files": [
     "dist",
     "src"
@@ -145,16 +145,16 @@
     "@babel/parser": "^8.0.6",
     "@babel/traverse": "^8.0.6",
     "@loadable/component": "5.16.7",
-    "@modern-js/backend-federation-contracts": "npm:@bleedingdev/modern-js-backend-federation-contracts@3.9.0-ultramodern.14",
-    "@modern-js/builder": "npm:@bleedingdev/modern-js-builder@3.9.0-ultramodern.14",
-    "@modern-js/prod-server": "npm:@bleedingdev/modern-js-prod-server@3.9.0-ultramodern.14",
-    "@modern-js/runtime-renderer-extensions": "npm:@bleedingdev/modern-js-runtime-renderer-extensions@3.9.0-ultramodern.14",
-    "@modern-js/runtime-utils": "npm:@bleedingdev/modern-js-runtime-utils@3.9.0-ultramodern.14",
-    "@modern-js/server-core": "npm:@bleedingdev/modern-js-server-core@3.9.0-ultramodern.14",
-    "@modern-js/server-runtime-extensions": "npm:@bleedingdev/modern-js-server-runtime-extensions@3.9.0-ultramodern.14",
-    "@modern-js/surface-resolution": "npm:@bleedingdev/modern-js-surface-resolution@3.9.0-ultramodern.14",
-    "@modern-js/types": "npm:@bleedingdev/modern-js-types@3.9.0-ultramodern.14",
-    "@modern-js/utils": "npm:@bleedingdev/modern-js-utils@3.9.0-ultramodern.14",
+    "@modern-js/backend-federation-contracts": "npm:@bleedingdev/modern-js-backend-federation-contracts@3.9.0-ultramodern.16",
+    "@modern-js/builder": "npm:@bleedingdev/modern-js-builder@3.9.0-ultramodern.16",
+    "@modern-js/prod-server": "npm:@bleedingdev/modern-js-prod-server@3.9.0-ultramodern.16",
+    "@modern-js/runtime-renderer-extensions": "npm:@bleedingdev/modern-js-runtime-renderer-extensions@3.9.0-ultramodern.16",
+    "@modern-js/runtime-utils": "npm:@bleedingdev/modern-js-runtime-utils@3.9.0-ultramodern.16",
+    "@modern-js/server-core": "npm:@bleedingdev/modern-js-server-core@3.9.0-ultramodern.16",
+    "@modern-js/server-runtime-extensions": "npm:@bleedingdev/modern-js-server-runtime-extensions@3.9.0-ultramodern.16",
+    "@modern-js/surface-resolution": "npm:@bleedingdev/modern-js-surface-resolution@3.9.0-ultramodern.16",
+    "@modern-js/types": "npm:@bleedingdev/modern-js-types@3.9.0-ultramodern.16",
+    "@modern-js/utils": "npm:@bleedingdev/modern-js-utils@3.9.0-ultramodern.16",
     "@swc/helpers": "^0.5.23",
     "compression-webpack-plugin": "^12.0.0",
     "esbuild": "^0.28.2",
@@ -164,9 +164,9 @@
     "@rsbuild/core": "2.2.9"
   },
   "devDependencies": {
-    "@modern-js/plugin": "npm:@bleedingdev/modern-js-plugin@3.9.0-ultramodern.14",
-    "@modern-js/plugin-bff-extensions": "npm:@bleedingdev/modern-js-plugin-bff-extensions@3.9.0-ultramodern.14",
-    "@modern-js/plugin-data-loader": "npm:@bleedingdev/modern-js-plugin-data-loader@3.9.0-ultramodern.14",
+    "@modern-js/plugin": "npm:@bleedingdev/modern-js-plugin@3.9.0-ultramodern.16",
+    "@modern-js/plugin-bff-extensions": "npm:@bleedingdev/modern-js-plugin-bff-extensions@3.9.0-ultramodern.16",
+    "@modern-js/plugin-data-loader": "npm:@bleedingdev/modern-js-plugin-data-loader@3.9.0-ultramodern.16",
     "@module-federation/runtime-tools": "npm:@bleedingdev/mf-runtime-tools@2.9.1",
     "@rsbuild/core": "2.2.9",
     "@rslib/core": "1.0.2",

package/src/cloudflare/artifacts.ts

@@ -1,9 +1,11 @@
 import path from 'node:path';
 import { fs as fse } from '@modern-js/utils';
-import type {
-  CloudflareWorkerArtifactConfig,
-  CloudflareWorkerPublicAssetConfig,
-} from '../config';
+import type { CloudflareWorkerArtifactConfig } from '../config';
+import {
+  CLOUDFLARE_PUBLIC_ASSET_SCOPE,
+  normalizeDeclaredPublicAssets,
+  stageDeclaredPublicAssets,
+} from '../deploy-output/public-assets';
 import {
   RESERVED_ARTIFACT_DESTINATION_DIRECTORIES,
   RESERVED_ARTIFACT_DESTINATION_FILES,
@@ -54,34 +56,12 @@ export const getCloudflareArtifacts = (modernConfig: CloudflareModernConfig) =>
     normalizeCloudflareArtifact,
   );
 
-const normalizeCloudflarePublicAsset = (
-  asset: CloudflareWorkerPublicAssetConfig,
-  index: number,
-) => {
-  const from = normalizeRelativePath(
-    asset.from,
-    `deploy.worker.publicAssets[${index}].from`,
-    'app root',
-  );
-  const to = normalizeRelativePath(
-    asset.to,
-    `deploy.worker.publicAssets[${index}].to`,
-    'Cloudflare public output',
-    { allowRoot: true },
-  );
-
-  return {
-    from,
-    to,
-    index,
-  };
-};
-
 export const getCloudflarePublicAssets = (
   modernConfig: CloudflareModernConfig,
 ) =>
-  (modernConfig.deploy?.worker?.publicAssets ?? []).map(
-    normalizeCloudflarePublicAsset,
+  normalizeDeclaredPublicAssets(
+    modernConfig.deploy?.worker?.publicAssets,
+    CLOUDFLARE_PUBLIC_ASSET_SCOPE,
   );
 
 export const copyCloudflareArtifacts = async (
@@ -102,23 +82,22 @@ export const copyCloudflareArtifacts = async (
   }
 };
 
+/**
+ * Stage `deploy.worker.publicAssets` into Worker Static Assets.
+ *
+ * @returns the staged files relative to the Cloudflare output root.
+ */
 export const copyCloudflarePublicAssets = async (
   appDirectory: string,
-  publicDirectory: string,
+  outputDirectory: string,
   publicAssets: ReturnType<typeof getCloudflarePublicAssets>,
-) => {
-  for (const asset of publicAssets) {
-    const sourcePath = path.join(appDirectory, asset.from);
-
-    if (!(await fse.pathExists(sourcePath))) {
-      throw new Error(
-        `deploy.worker.publicAssets[${asset.index}].from does not exist: ${asset.from}`,
-      );
-    }
-
-    await fse.copy(sourcePath, path.join(publicDirectory, asset.to));
-  }
-};
+) =>
+  stageDeclaredPublicAssets({
+    appDirectory,
+    outputDirectory,
+    assets: publicAssets,
+    scope: CLOUDFLARE_PUBLIC_ASSET_SCOPE,
+  });
 
 export const copyCloudflareD1Migrations = async (
   appDirectory: string,

package/src/cloudflare/index.ts

@@ -92,6 +92,7 @@ export const createCloudflarePreset: CreateCloudflarePreset = ({
     '@modern-js/ultramodern-release-envelope',
   );
   let hasReleaseEnvelope = false;
+  let declaredPublicAssets: string[] = [];
 
   return {
     async prepare() {
@@ -187,9 +188,9 @@ export const createCloudflarePreset: CreateCloudflarePreset = ({
         outputDirectory,
         cloudflareArtifacts,
       );
-      await copyCloudflarePublicAssets(
+      declaredPublicAssets = await copyCloudflarePublicAssets(
         appDirectory,
-        publicDirectory,
+        outputDirectory,
         getCloudflarePublicAssets(modernConfig),
       );
       await copyCloudflareD1Migrations(
@@ -255,6 +256,7 @@ export const createCloudflarePreset: CreateCloudflarePreset = ({
       });
       if (hasReleaseEnvelope) {
         await emitCloudflareStagedReleaseEnvelope({
+          declaredPublicAssets,
           distDirectory,
           outputDirectory,
         });

package/src/config.ts

@@ -47,6 +47,18 @@ export interface CloudflareWorkerPublicAssetConfig {
   to: string;
 }
 
+export interface NodePublicAssetConfig {
+  /**
+   * Source file or directory, relative to the app root, to copy into the
+   * Node deploy output's public directory.
+   */
+  from: string;
+  /**
+   * Destination path relative to `.output/public`.
+   */
+  to: string;
+}
+
 export interface CloudflareWorkerD1DatabaseConfig {
   /**
    * Worker binding name, for example `DB`.
@@ -202,3 +214,17 @@ export interface CloudflareDeployConfig {
     publicAssetExcludes?: string[];
   };
 }
+
+export interface NodeDeployConfig {
+  node?: {
+    /**
+     * Additional app-root files or directories to stage under
+     * `.output/public` when `modern deploy` targets Node, the counterpart of
+     * `deploy.worker.publicAssets`. The Node server does not route these
+     * files; serve them from the app, for example from an API handler.
+     * Release envelopes record them as declared public assets, so API-only
+     * units may ship them.
+     */
+    publicAssets?: NodePublicAssetConfig[];
+  };
+}

package/src/deploy-output/plugin.ts

@@ -1,6 +1,12 @@
 import { createRequire } from 'node:module';
 import path from 'node:path';
+import type { NodePublicAssetConfig } from '../config';
 import { preserveNpmAliases, readPackageIdentity } from './npmAliases';
+import {
+  NODE_PUBLIC_ASSET_SCOPE,
+  normalizeDeclaredPublicAssets,
+  stageDeclaredPublicAssets,
+} from './public-assets';
 import {
   type DeployOutputConfig,
   resolveDeployTarget as defaultResolveDeployTarget,
@@ -47,3 +53,51 @@ export const createDeployOutputAliasesPlugin = ({
     });
   },
 });
+
+export interface DeployOutputPublicAssetsConfig extends DeployOutputConfig {
+  deploy?: DeployOutputConfig['deploy'] & {
+    node?: { publicAssets?: NodePublicAssetConfig[] };
+  };
+}
+
+export interface DeployOutputPublicAssetsPluginApi {
+  getAppContext(): { appDirectory: string; metaName: string };
+  getNormalizedConfig(): DeployOutputPublicAssetsConfig;
+  onAfterDeploy(handler: () => Promise<void>): void;
+}
+
+/**
+ * Stage `deploy.node.publicAssets` into the Node deploy output. Cloudflare
+ * stages `deploy.worker.publicAssets` inside its deploy preset.
+ */
+export const createDeployOutputPublicAssetsPlugin = ({
+  resolveDeployTarget = defaultResolveDeployTarget,
+}: {
+  resolveDeployTarget?: (config: DeployOutputConfig) => string;
+} = {}) => ({
+  name: '@modern-js/deploy-output-public-assets',
+  setup(api: DeployOutputPublicAssetsPluginApi) {
+    api.onAfterDeploy(async () => {
+      const { appDirectory, metaName } = api.getAppContext();
+      const config = api.getNormalizedConfig();
+      if (
+        (metaName !== 'modern-js' &&
+          !config.deploy?.target &&
+          !process.env.MODERNJS_DEPLOY) ||
+        resolveDeployTarget(config) !== 'node'
+      ) {
+        return;
+      }
+
+      await stageDeclaredPublicAssets({
+        appDirectory,
+        outputDirectory: path.join(appDirectory, '.output'),
+        assets: normalizeDeclaredPublicAssets(
+          config.deploy?.node?.publicAssets,
+          NODE_PUBLIC_ASSET_SCOPE,
+        ),
+        scope: NODE_PUBLIC_ASSET_SCOPE,
+      });
+    });
+  },
+});