@bleedingdev/modern-js-app-tools 3.5.0-ultramodern.9 → 3.5.0-ultramodern.90

package/dist/cjs/plugins/deploy/platforms/cloudflare-output-verifier/worker-bundles.js

@@ -0,0 +1,302 @@
+"use strict";
+var __webpack_require__ = {};
+(()=>{
+    __webpack_require__.n = (module)=>{
+        var getter = module && module.__esModule ? ()=>module['default'] : ()=>module;
+        __webpack_require__.d(getter, {
+            a: getter
+        });
+        return getter;
+    };
+})();
+(()=>{
+    __webpack_require__.d = (exports1, getters, values)=>{
+        var define = (defs, kind)=>{
+            for(var key in defs)if (__webpack_require__.o(defs, key) && !__webpack_require__.o(exports1, key)) Object.defineProperty(exports1, key, {
+                enumerable: true,
+                [kind]: defs[key]
+            });
+        };
+        define(getters, "get");
+        define(values, "value");
+    };
+})();
+(()=>{
+    __webpack_require__.o = (obj, prop)=>Object.prototype.hasOwnProperty.call(obj, prop);
+})();
+(()=>{
+    __webpack_require__.r = (exports1)=>{
+        if ("u" > typeof Symbol && Symbol.toStringTag) Object.defineProperty(exports1, Symbol.toStringTag, {
+            value: 'Module'
+        });
+        Object.defineProperty(exports1, '__esModule', {
+            value: true
+        });
+    };
+})();
+var __webpack_exports__ = {};
+__webpack_require__.r(__webpack_exports__);
+__webpack_require__.d(__webpack_exports__, {
+    getEffectBffWorker: ()=>getEffectBffWorker,
+    getWorkerBundleReferences: ()=>getWorkerBundleReferences,
+    missingWorkerBundleMessage: ()=>missingWorkerBundleMessage,
+    resolveWorkerBundleReference: ()=>resolveWorkerBundleReference,
+    verifyWorkerBundleReferences: ()=>verifyWorkerBundleReferences,
+    verifyWorkerImport: ()=>verifyWorkerImport
+});
+const promises_namespaceObject = require("node:fs/promises");
+var promises_default = /*#__PURE__*/ __webpack_require__.n(promises_namespaceObject);
+const external_node_path_namespaceObject = require("node:path");
+var external_node_path_default = /*#__PURE__*/ __webpack_require__.n(external_node_path_namespaceObject);
+const external_node_url_namespaceObject = require("node:url");
+const parser_namespaceObject = require("@babel/parser");
+const external_cloudflare_output_contract_js_namespaceObject = require("../cloudflare-output-contract.js");
+const external_issues_js_namespaceObject = require("./issues.js");
+const getReferencedRouteWorkers = (manifest)=>Array.isArray(manifest?.routeSpec?.routes) ? manifest.routeSpec.routes.map((route)=>'string' == typeof route?.worker && route.worker.length > 0 ? route.worker : void 0).filter((worker)=>'string' == typeof worker) : [];
+const getEffectBffWorker = (manifest)=>manifest?.bff?.runtimeFramework === 'effect' && 'string' == typeof manifest.bff.worker ? manifest.bff.worker : void 0;
+const getWorkerBundleReferences = (manifest)=>{
+    const effectBffWorker = getEffectBffWorker(manifest);
+    return [
+        ...effectBffWorker ? [
+            {
+                dispatcherExport: 'string' == typeof manifest.bff?.dispatcherExport ? manifest.bff.dispatcherExport : void 0,
+                kind: 'effect-bff',
+                reference: effectBffWorker
+            }
+        ] : [],
+        ...getReferencedRouteWorkers(manifest).map((reference)=>({
+                kind: 'route',
+                reference
+            }))
+    ];
+};
+const resolveWorkerBundleReference = (issues, outputDirectory, reference, manifestPath)=>{
+    const workerRoot = external_node_path_default().resolve(outputDirectory, external_cloudflare_output_contract_js_namespaceObject.CLOUDFLARE_WORKER_BUNDLE_DIRECTORY);
+    const workerPath = external_node_path_default().resolve(outputDirectory, reference.reference);
+    const relativeToWorkerRoot = external_node_path_default().relative(workerRoot, workerPath);
+    if (external_node_path_default().isAbsolute(reference.reference) || relativeToWorkerRoot.startsWith('..') || external_node_path_default().isAbsolute(relativeToWorkerRoot)) {
+        (0, external_issues_js_namespaceObject.addIssue)(issues, {
+            code: 'invalid-manifest',
+            message: 'Cloudflare output manifest worker bundle references must stay under worker/.',
+            path: manifestPath
+        });
+        return null;
+    }
+    return {
+        ...reference,
+        path: workerPath
+    };
+};
+const missingWorkerBundleMessage = (reference)=>'effect-bff' === reference.kind ? 'Cloudflare Effect BFF manifest points to a missing worker bundle.' : 'Cloudflare route worker manifest points to a missing worker bundle.';
+const isAstNode = (value)=>null !== value && 'object' == typeof value && 'type' in value && 'string' == typeof value.type;
+const getNodeName = (node)=>{
+    if (!isAstNode(node)) return;
+    return 'Identifier' === node.type && 'string' == typeof node.name ? node.name : 'StringLiteral' === node.type && 'string' == typeof node.value ? node.value : void 0;
+};
+const collectBindingNames = (node, names)=>{
+    if (!isAstNode(node)) return;
+    const name = getNodeName(node);
+    if (name) return void names.add(name);
+    if ('ObjectPattern' === node.type && Array.isArray(node.properties)) {
+        for (const property of node.properties)if (isAstNode(property)) collectBindingNames('RestElement' === property.type ? property.argument : property.value, names);
+    } else if ('ArrayPattern' === node.type && Array.isArray(node.elements)) for (const element of node.elements)collectBindingNames(element, names);
+    else if ('AssignmentPattern' === node.type || 'RestElement' === node.type) collectBindingNames('AssignmentPattern' === node.type ? node.left : node.argument, names);
+};
+const getMemberPropertyName = (node)=>'MemberExpression' === node.type ? getNodeName(node.property) : void 0;
+const isModuleExports = (node)=>isAstNode(node) && 'MemberExpression' === node.type && isAstNode(node.object) && 'Identifier' === node.object.type && 'module' === node.object.name && 'exports' === getMemberPropertyName(node);
+const collectCommonJsExports = (statement, exports1)=>{
+    if ('ExpressionStatement' !== statement.type || !isAstNode(statement.expression) || 'AssignmentExpression' !== statement.expression.type) return;
+    const { left, right } = statement.expression;
+    if (isAstNode(left) && 'MemberExpression' === left.type && (isAstNode(left.object) && 'Identifier' === left.object.type && 'exports' === left.object.name || isModuleExports(left.object))) {
+        const exportName = getMemberPropertyName(left);
+        if (exportName) exports1.add(exportName);
+        return;
+    }
+    if (isModuleExports(left) && isAstNode(right) && 'ObjectExpression' === right.type && Array.isArray(right.properties)) {
+        for (const property of right.properties)if (isAstNode(property)) {
+            const exportName = getNodeName(property.key);
+            if (exportName) exports1.add(exportName);
+        }
+    }
+};
+const collectEsmExports = (statement, exports1)=>{
+    if ('ExportDefaultDeclaration' === statement.type) return void exports1.add('default');
+    if ('ExportNamedDeclaration' !== statement.type) return;
+    if (isAstNode(statement.declaration)) {
+        const declaration = statement.declaration;
+        const declarationName = getNodeName(declaration.id);
+        if (declarationName) exports1.add(declarationName);
+        if ('VariableDeclaration' === declaration.type && Array.isArray(declaration.declarations)) {
+            for (const declarator of declaration.declarations)if (isAstNode(declarator)) collectBindingNames(declarator.id, exports1);
+        }
+    }
+    if (Array.isArray(statement.specifiers)) {
+        for (const specifier of statement.specifiers)if (isAstNode(specifier)) {
+            const exportName = getNodeName(specifier.exported);
+            if (exportName) exports1.add(exportName);
+        }
+    }
+};
+const visitAst = (node, visitor)=>{
+    visitor(node);
+    for (const [key, value] of Object.entries(node))if ('loc' !== key && 'start' !== key && 'end' !== key && 'leadingComments' !== key && 'trailingComments' !== key && 'innerComments' !== key) {
+        if (isAstNode(value)) visitAst(value, visitor);
+        else if (Array.isArray(value)) {
+            for (const item of value)if (isAstNode(item)) visitAst(item, visitor);
+        }
+    }
+};
+const getStaticImport = (node)=>{
+    if (('ImportDeclaration' === node.type || 'ExportNamedDeclaration' === node.type || 'ExportAllDeclaration' === node.type) && isAstNode(node.source)) return getNodeName(node.source);
+    if ('ImportExpression' === node.type && isAstNode(node.source)) return getNodeName(node.source);
+    if ('CallExpression' === node.type && Array.isArray(node.arguments) && 1 === node.arguments.length && isAstNode(node.callee) && ('Identifier' === node.callee.type && 'require' === node.callee.name || 'Import' === node.callee.type)) return getNodeName(node.arguments[0]);
+};
+const analyzeWorkerModule = (source)=>{
+    const ast = (0, parser_namespaceObject.parse)(source, {
+        sourceType: 'unambiguous'
+    });
+    const exports1 = new Set();
+    const imports = new Set();
+    for (const statement of ast.program.body){
+        collectEsmExports(statement, exports1);
+        collectCommonJsExports(statement, exports1);
+    }
+    visitAst(ast.program, (node)=>{
+        const specifier = getStaticImport(node);
+        if (specifier) imports.add(specifier);
+    });
+    return {
+        exports: exports1,
+        imports
+    };
+};
+const getPackageName = (specifier)=>specifier.startsWith('@') ? specifier.split('/').slice(0, 2).join('/') : specifier.split('/')[0];
+const CLOUDFLARE_WORKER_NODE_BUILTIN_SPECIFIERS = new Set(external_cloudflare_output_contract_js_namespaceObject.CLOUDFLARE_WORKER_NODE_BUILTINS.map((builtin)=>`node:${builtin}`));
+const isInsideDirectory = (directory, filePath)=>{
+    const relative = external_node_path_default().relative(directory, filePath);
+    return 0 === relative.length || !relative.startsWith('..') && !external_node_path_default().isAbsolute(relative);
+};
+const resolveWorkerModule = async (importer, specifier)=>{
+    const unresolvedPath = external_node_path_default().resolve(external_node_path_default().dirname(importer), specifier);
+    const candidates = [
+        unresolvedPath,
+        `${unresolvedPath}.js`,
+        `${unresolvedPath}.mjs`,
+        `${unresolvedPath}.cjs`,
+        external_node_path_default().join(unresolvedPath, 'index.js'),
+        external_node_path_default().join(unresolvedPath, 'index.mjs'),
+        external_node_path_default().join(unresolvedPath, 'index.cjs')
+    ];
+    for (const candidate of candidates)try {
+        if ((await promises_default().stat(candidate)).isFile()) return await promises_default().realpath(candidate);
+    } catch  {}
+};
+const verifyWorkerModuleClosure = async (issues, entryPath, entrySource, contract)=>{
+    const visited = new Set();
+    let entryAnalysis;
+    const [realWorkerRoot, realEntryPath] = await Promise.all([
+        promises_default().realpath(contract.workerRoot),
+        promises_default().realpath(entryPath)
+    ]);
+    if (!isInsideDirectory(realWorkerRoot, realEntryPath)) return void (0, external_issues_js_namespaceObject.addIssue)(issues, {
+        code: 'invalid-worker-bundle',
+        message: 'Cloudflare worker bundles must not resolve outside the staged worker directory.',
+        path: entryPath
+    });
+    const visitModule = async (modulePath, source, isEntry = false)=>{
+        if (visited.has(modulePath)) return;
+        visited.add(modulePath);
+        let analysis;
+        try {
+            analysis = analyzeWorkerModule(source ?? await promises_default().readFile(modulePath, 'utf-8'));
+        } catch (error) {
+            (0, external_issues_js_namespaceObject.addIssue)(issues, {
+                code: 'invalid-worker-bundle',
+                message: `Cloudflare worker bundle module could not be parsed: ${error instanceof Error ? error.message : String(error)}`,
+                path: modulePath
+            });
+            return;
+        }
+        if (isEntry) entryAnalysis = analysis;
+        for (const specifier of analysis.imports){
+            if (!specifier.startsWith('.') && !external_node_path_default().isAbsolute(specifier)) {
+                if (CLOUDFLARE_WORKER_NODE_BUILTIN_SPECIFIERS.has(specifier)) continue;
+                if (specifier.startsWith('node:')) {
+                    (0, external_issues_js_namespaceObject.addIssue)(issues, {
+                        code: 'invalid-worker-bundle',
+                        message: `Cloudflare worker bundle import "${specifier}" is not a supported Worker node: builtin.`,
+                        path: modulePath
+                    });
+                    continue;
+                }
+                if (!contract.providedPackages.has(getPackageName(specifier))) (0, external_issues_js_namespaceObject.addIssue)(issues, {
+                    code: 'invalid-worker-bundle',
+                    message: `Cloudflare worker bundle import "${specifier}" is not provided by worker/package.json dependencies.`,
+                    path: modulePath
+                });
+                continue;
+            }
+            const resolved = await resolveWorkerModule(modulePath, specifier);
+            if (resolved && !isInsideDirectory(realWorkerRoot, resolved)) {
+                (0, external_issues_js_namespaceObject.addIssue)(issues, {
+                    code: 'invalid-worker-bundle',
+                    message: 'Cloudflare worker bundles must not resolve outside the staged worker directory.',
+                    path: modulePath
+                });
+                continue;
+            }
+            if (!resolved) {
+                (0, external_issues_js_namespaceObject.addIssue)(issues, {
+                    code: 'invalid-worker-bundle',
+                    message: `Cloudflare worker bundle import "${specifier}" does not resolve inside worker/.`,
+                    path: modulePath
+                });
+                continue;
+            }
+            await visitModule(resolved);
+        }
+    };
+    await visitModule(realEntryPath, entrySource, true);
+    return entryAnalysis;
+};
+const verifyWorkerBundleReferences = async (issues, worker, source, contract)=>{
+    const entryAnalysis = await verifyWorkerModuleClosure(issues, worker.path, source, contract);
+    if ('effect-bff' === worker.kind && 'string' == typeof worker.dispatcherExport && !entryAnalysis?.exports.has(worker.dispatcherExport)) (0, external_issues_js_namespaceObject.addIssue)(issues, {
+        code: 'invalid-worker-bundle',
+        message: 'Cloudflare Effect BFF worker bundle must expose its manifest dispatcherExport.',
+        path: worker.path
+    });
+};
+const verifyWorkerImport = async (issues, entryPath)=>{
+    try {
+        const worker = (await import(`${(0, external_node_url_namespaceObject.pathToFileURL)(entryPath).href}?t=${Date.now()}`)).default;
+        if (!worker || 'function' != typeof worker.fetch) (0, external_issues_js_namespaceObject.addIssue)(issues, {
+            code: 'worker-import-failed',
+            message: 'Cloudflare server entry must default-export a Worker with fetch.',
+            path: entryPath
+        });
+    } catch (error) {
+        (0, external_issues_js_namespaceObject.addIssue)(issues, {
+            code: 'worker-import-failed',
+            message: `Cloudflare server entry could not be imported: ${error instanceof Error ? error.message : String(error)}`,
+            path: entryPath
+        });
+    }
+};
+exports.getEffectBffWorker = __webpack_exports__.getEffectBffWorker;
+exports.getWorkerBundleReferences = __webpack_exports__.getWorkerBundleReferences;
+exports.missingWorkerBundleMessage = __webpack_exports__.missingWorkerBundleMessage;
+exports.resolveWorkerBundleReference = __webpack_exports__.resolveWorkerBundleReference;
+exports.verifyWorkerBundleReferences = __webpack_exports__.verifyWorkerBundleReferences;
+exports.verifyWorkerImport = __webpack_exports__.verifyWorkerImport;
+for(var __rspack_i in __webpack_exports__)if (-1 === [
+    "getEffectBffWorker",
+    "getWorkerBundleReferences",
+    "missingWorkerBundleMessage",
+    "resolveWorkerBundleReference",
+    "verifyWorkerBundleReferences",
+    "verifyWorkerImport"
+].indexOf(__rspack_i)) exports[__rspack_i] = __webpack_exports__[__rspack_i];
+Object.defineProperty(exports, '__esModule', {
+    value: true
+});

package/dist/cjs/plugins/deploy/platforms/node.js

@@ -45,7 +45,8 @@ const utils_namespaceObject = require("@modern-js/utils");
 const external_ndepe_namespaceObject = require("ndepe");
 const index_js_namespaceObject = require("../utils/index.js");
 const generator_js_namespaceObject = require("../utils/generator.js");
-const createNodePreset = ({ appContext, modernConfig, api })=>{
+const npmAliases_js_namespaceObject = require("../utils/npmAliases.js");
+const createNodePreset = ({ appContext, modernConfig })=>{
     const { appDirectory, distDirectory, moduleType } = appContext;
     const isEsmProject = 'module' === moduleType;
     const outputDirectory = external_node_path_default().join(appDirectory, '.output');
@@ -56,7 +57,12 @@ const createNodePreset = ({ appContext, modernConfig, api })=>{
             await utils_namespaceObject.fs.remove(outputDirectory);
         },
         async writeOutput () {
-            await utils_namespaceObject.fs.copy(distDirectory, outputDirectory);
+            await utils_namespaceObject.fs.copy(distDirectory, outputDirectory, {
+                filter: (src)=>{
+                    const relativePath = external_node_path_default().relative(distDirectory, src).replace(/\\/gu, '/');
+                    return 'release' !== relativePath && !relativePath.startsWith('release/');
+                }
+            });
         },
         async genEntry () {
             const template = await (0, index_js_namespaceObject.readTemplate)(`node-entry.${isEsmProject ? 'mjs' : 'cjs'}`);
@@ -72,6 +78,7 @@ const createNodePreset = ({ appContext, modernConfig, api })=>{
             const filter = (filePath)=>!filePath.startsWith(staticDirectory) && !filePath.endsWith('.map');
             const entry = isEsmProject ? await (0, index_js_namespaceObject.resolveESMDependency)('@modern-js/prod-server') : require.resolve('@modern-js/prod-server');
             if (!entry) throw new Error('Cannot find @modern-js/prod-server');
+            const prodServerPackage = await (0, npmAliases_js_namespaceObject.readPackageIdentity)(entry);
             await (0, external_ndepe_namespaceObject.nodeDepEmit)({
                 appDir: appDirectory,
                 sourceDir: outputDirectory,
@@ -90,6 +97,17 @@ const createNodePreset = ({ appContext, modernConfig, api })=>{
                     };
                 }
             });
+            await (0, npmAliases_js_namespaceObject.preserveNpmAliases)({
+                appDirectory,
+                outputDirectory,
+                implicitAliases: [
+                    {
+                        aliasName: '@modern-js/prod-server',
+                        targetName: prodServerPackage.name,
+                        targetVersion: prodServerPackage.version
+                    }
+                ]
+            });
             console.log('Static directory:', utils_namespaceObject.chalk.blue(external_node_path_default().relative(appDirectory, staticDirectory).replace(/\\/g, '/')));
             console.log("You can preview this build by", utils_namespaceObject.chalk.blue('node .output/index'));
         }

package/dist/cjs/plugins/deploy/platforms/templates/cloudflare-entry.001-bootstrap-security.mjs

@@ -0,0 +1,250 @@
+const ASSETS_BINDING = 'ASSETS';
+const MODERN_WORKER_MANIFEST = p_workerManifest;
+const WORKER_MODULE_LOADERS = p_workerModuleLoaders;
+const workerModulePromises = new Map();
+const effectBffDispatcherPromises = new Map();
+const remoteJsonPromises = new Map();
+const CORS_POLICY = MODERN_WORKER_MANIFEST.security?.cors || {};
+const ASSET_CORS_ENABLED = CORS_POLICY.assets !== false;
+const APP_CORS_ALLOWED_ORIGINS = (CORS_POLICY.allowedOrigins || []).map(
+  origin => String(origin).toLowerCase(),
+);
+const APP_CORS_ALLOWED_METHODS = (
+  CORS_POLICY.allowedMethods?.length
+    ? CORS_POLICY.allowedMethods
+    : ['GET', 'HEAD', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS']
+).join(', ');
+const APP_CORS_ALLOWED_HEADERS = (
+  CORS_POLICY.allowedHeaders?.length ? CORS_POLICY.allowedHeaders : ['*']
+).join(', ');
+const ASSET_CORS_HEADERS = {
+  'access-control-allow-headers': '*',
+  'access-control-allow-methods': 'GET, HEAD, OPTIONS',
+  'access-control-allow-origin': '*',
+};
+
+globalThis.__dirname ??= '/';
+globalThis.__filename ??= '/index.js';
+
+function getAllowedAppCorsOrigin(request) {
+  if (APP_CORS_ALLOWED_ORIGINS.length === 0) {
+    return null;
+  }
+
+  const origin = request.headers.get('origin');
+
+  if (!origin) {
+    return null;
+  }
+
+  if (APP_CORS_ALLOWED_ORIGINS.includes('*')) {
+    return '*';
+  }
+
+  return APP_CORS_ALLOWED_ORIGINS.includes(origin.toLowerCase())
+    ? origin
+    : null;
+}
+
+function appendVaryOrigin(headers) {
+  const vary = headers.get('vary');
+
+  if (!vary) {
+    headers.set('vary', 'origin');
+    return;
+  }
+
+  const varyValues = vary.split(',').map(value => value.trim().toLowerCase());
+
+  if (!varyValues.includes('origin')) {
+    headers.set('vary', `${vary}, origin`);
+  }
+}
+
+function withAppCorsHeaders(response, request) {
+  const allowedOrigin = getAllowedAppCorsOrigin(request);
+
+  if (!allowedOrigin) {
+    return response;
+  }
+
+  const headers = new Headers(response.headers);
+
+  if (!headers.has('access-control-allow-origin')) {
+    headers.set('access-control-allow-origin', allowedOrigin);
+  }
+
+  if (allowedOrigin !== '*') {
+    appendVaryOrigin(headers);
+  }
+
+  return new Response(response.body, {
+    headers,
+    status: response.status,
+    statusText: response.statusText,
+  });
+}
+
+function withAssetCorsHeaders(response) {
+  if (!ASSET_CORS_ENABLED) {
+    return response;
+  }
+
+  const headers = new Headers(response.headers);
+
+  for (const [name, value] of Object.entries(ASSET_CORS_HEADERS)) {
+    if (!headers.has(name)) {
+      headers.set(name, value);
+    }
+  }
+
+  return new Response(response.body, {
+    headers,
+    status: response.status,
+    statusText: response.statusText,
+  });
+}
+
+function setHeaderIfEnabled(headers, name, value) {
+  if (value === false || typeof value !== 'string' || value.trim() === '') {
+    return;
+  }
+
+  if (!headers.has(name)) {
+    headers.set(name, value);
+  }
+}
+
+function renderContentSecurityPolicy(directives) {
+  return Object.entries(directives || {})
+    .filter(([, values]) => Array.isArray(values) && values.length > 0)
+    .sort(([left], [right]) => left.localeCompare(right))
+    .map(([name, values]) => `${name} ${values.join(' ')}`)
+    .join('; ');
+}
+
+function isHtmlResponse(response) {
+  return (response.headers.get('content-type') || '').includes('text/html');
+}
+
+function matchesPreviewHostname(hostname, pattern) {
+  const normalizedHostname = hostname.toLowerCase();
+  const normalizedPattern = String(pattern || '').toLowerCase();
+
+  if (!normalizedPattern) {
+    return false;
+  }
+
+  if (normalizedPattern.startsWith('*.')) {
+    return normalizedHostname.endsWith(normalizedPattern.slice(1));
+  }
+
+  return normalizedHostname === normalizedPattern;
+}
+
+function shouldNoindex(request, noindex) {
+  if (!noindex || noindex === false) {
+    return false;
+  }
+
+  const { hostname } = new URL(request.url);
+  const normalizedHostname = hostname.toLowerCase();
+
+  if (
+    noindex.localhost !== false &&
+    (normalizedHostname === 'localhost' ||
+      normalizedHostname === '127.0.0.1' ||
+      normalizedHostname === '[::1]')
+  ) {
+    return true;
+  }
+
+  if (
+    noindex.workersDev !== false &&
+    normalizedHostname.endsWith('.workers.dev')
+  ) {
+    return true;
+  }
+
+  return (noindex.previewHostnames || []).some(pattern =>
+    matchesPreviewHostname(normalizedHostname, pattern),
+  );
+}
+
+function withCloudflareSecurityHeaders(response, request) {
+  const security = MODERN_WORKER_MANIFEST.security;
+
+  if (!security || security.enabled === false) {
+    return response;
+  }
+
+  const headers = new Headers(response.headers);
+  const configuredHeaders = security.headers || {};
+
+  setHeaderIfEnabled(
+    headers,
+    'referrer-policy',
+    configuredHeaders.referrerPolicy,
+  );
+  setHeaderIfEnabled(
+    headers,
+    'x-content-type-options',
+    configuredHeaders.contentTypeOptions,
+  );
+  setHeaderIfEnabled(
+    headers,
+    'permissions-policy',
+    configuredHeaders.permissionsPolicy,
+  );
+
+  const csp = security.contentSecurityPolicy;
+  const cspHeader =
+    csp?.mode === 'enforce'
+      ? 'content-security-policy'
+      : 'content-security-policy-report-only';
+  const cspValue = renderContentSecurityPolicy(csp?.directives);
+
+  if (
+    isHtmlResponse(response) &&
+    csp?.mode !== 'off' &&
+    cspValue &&
+    !headers.has(cspHeader)
+  ) {
+    headers.set(cspHeader, cspValue);
+  }
+
+  if (shouldNoindex(request, security.noindex)) {
+    headers.set('x-robots-tag', 'noindex, nofollow');
+  }
+
+  return new Response(response.body, {
+    headers,
+    status: response.status,
+    statusText: response.statusText,
+  });
+}
+
+function createRenderableRequest(request) {
+  if (request.method !== 'HEAD') {
+    return request;
+  }
+
+  return new Request(request, { method: 'GET' });
+}
+
+function finalizeResponseForRequest(response, request) {
+  const securedResponse = withCloudflareSecurityHeaders(response, request);
+
+  if (request.method !== 'HEAD') {
+    return securedResponse;
+  }
+
+  const headers = new Headers(securedResponse.headers);
+  headers.delete('content-length');
+
+  return new Response(null, {
+    headers,
+    status: securedResponse.status,
+    statusText: securedResponse.statusText,
+  });
+}