@nimbus-sh/worker 0.1.0

package/scripts/bundle-tailwind-play.mjs

@@ -0,0 +1,130 @@
+#!/usr/bin/env node
+/**
+ * bundle-tailwind-play.mjs — vendor the Tailwind Play CDN bundle.
+ *
+ * Why this exists
+ * ───────────────
+ * Nimbus's preview HTML used to inject
+ *
+ *   <script src="https://cdn.tailwindcss.com/3.4.17"></script>
+ *
+ * (src/vite-dev-server.ts) so projects using Tailwind classes had a
+ * working JIT compiler in the browser. That violates the 100% edge
+ * contract: every preview load fetches a third-party CDN.
+ *
+ * This script downloads the Play CDN bundle ONCE at sourcing time
+ * (analogous to npm install fetching tarballs from registry) and
+ * embeds it as a string constant in src/tailwind-play.generated.ts.
+ * The supervisor then serves it from
+ *
+ *   /preview/__nimbus_assets/tailwind-play.js
+ *
+ * with proper Content-Type + immutable cache headers, and the HTML
+ * injection points at the local URL.
+ *
+ * Browser-runtime bytes: ~408 KiB raw → embedded as a JS string in
+ * the supervisor bundle. JSON.stringify-quoting adds ~0.5% overhead
+ * (escapes for ", \, control chars), so the generated file sits at
+ * ~410 KiB. Trivial relative to the 16 MiB esbuild-wasm bundle and
+ * the 4.8 MiB real-vite bundle already in the supervisor.
+ *
+ * Version pinning
+ * ───────────────
+ * We pin to a specific Tailwind Play CDN version so deploys are
+ * reproducible — a freshly-deployed worker should serve the same
+ * bytes as one deployed last week, regardless of upstream CDN
+ * updates. Bump TAILWIND_PLAY_VERSION when intentional.
+ *
+ * The Play CDN is a SEPARATE build from the `tailwindcss` npm
+ * package — `packages/@tailwindcss-cdn/` in the upstream repo. It
+ * embeds the JIT compiler + utility detection + style injection
+ * pipeline as a self-contained browser IIFE. Not available via npm.
+ *
+ * Output: src/tailwind-play.generated.ts
+ *   export const TAILWIND_PLAY_VERSION: string;
+ *   export const TAILWIND_PLAY_BUNDLE: string;
+ *   export const TAILWIND_PLAY_INTEGRITY: string; // sha-256 hex
+ */
+
+import { promises as fs } from 'node:fs';
+import { createHash } from 'node:crypto';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const ROOT = path.resolve(__dirname, '..');
+const OUT = path.join(ROOT, 'src', 'tailwind-play.generated.ts');
+
+// Pin to a specific version so deploys are reproducible. Bump
+// intentionally when we want a new Tailwind release; the generated
+// file is committed so reproducibility doesn't depend on the CDN
+// being reachable at deploy time.
+const TAILWIND_PLAY_VERSION = '3.4.17';
+const SOURCE_URL = `https://cdn.tailwindcss.com/${TAILWIND_PLAY_VERSION}`;
+
+// Sanity-check the bundle isn't HTML / 404 / unexpected content. The
+// real bundle is a minified IIFE starting with `(()=>{`. If we get
+// anything else, fail loud rather than silently embedding garbage.
+const EXPECTED_PREFIX = '(()=>{';
+const MIN_SIZE = 200_000;
+const MAX_SIZE = 2_000_000;
+
+async function main() {
+  console.log(`[bundle-tailwind-play] fetching ${SOURCE_URL} ...`);
+  const resp = await fetch(SOURCE_URL);
+  if (!resp.ok) {
+    throw new Error(
+      `[bundle-tailwind-play] download failed: ${resp.status} ${resp.statusText}`,
+    );
+  }
+  const code = await resp.text();
+  if (code.length < MIN_SIZE || code.length > MAX_SIZE) {
+    throw new Error(
+      `[bundle-tailwind-play] downloaded bundle has unexpected size ${code.length} ` +
+        `(expected ${MIN_SIZE}..${MAX_SIZE}). Refusing to embed.`,
+    );
+  }
+  if (!code.startsWith(EXPECTED_PREFIX)) {
+    throw new Error(
+      `[bundle-tailwind-play] downloaded bundle does not start with ${JSON.stringify(EXPECTED_PREFIX)}. ` +
+        `First 80 chars: ${JSON.stringify(code.slice(0, 80))}. Refusing to embed.`,
+    );
+  }
+
+  const sha256 = createHash('sha256').update(code).digest('hex');
+  console.log(
+    `[bundle-tailwind-play] version=${TAILWIND_PLAY_VERSION} size=${(code.length / 1024).toFixed(1)} KiB sha256=${sha256.slice(0, 16)}…`,
+  );
+
+  const header = `/**
+ * tailwind-play.generated.ts — AUTO-GENERATED by scripts/bundle-tailwind-play.mjs
+ * DO NOT EDIT.
+ *
+ * Vendored Tailwind Play CDN ${TAILWIND_PLAY_VERSION} bundle, served
+ * from /preview/__nimbus_assets/tailwind-play.js so preview pages get
+ * Tailwind JIT without fetching from cdn.tailwindcss.com (100% edge
+ * contract).
+ *
+ * Source: ${SOURCE_URL} (downloaded at build time).
+ * SHA-256: ${sha256}
+ *
+ * If you change this file by hand it WILL be overwritten by the next
+ * predev / predeploy / postinstall.
+ */
+
+export const TAILWIND_PLAY_VERSION: string = ${JSON.stringify(TAILWIND_PLAY_VERSION)};
+export const TAILWIND_PLAY_INTEGRITY: string = ${JSON.stringify('sha256-' + sha256)};
+export const TAILWIND_PLAY_BUNDLE: string = ${JSON.stringify(code)};
+`;
+
+  await fs.writeFile(OUT, header, 'utf8');
+  const stat = await fs.stat(OUT);
+  console.log(
+    `[bundle-tailwind-play] wrote ${path.relative(ROOT, OUT)} (${(stat.size / 1024).toFixed(1)} KiB)`,
+  );
+}
+
+main().catch((e) => {
+  console.error('[bundle-tailwind-play] failed:', e);
+  process.exit(1);
+});

package/scripts/patch-lifo-ui.mjs

@@ -0,0 +1,131 @@
+/**
+ * patch-lifo-ui.mjs — postinstall fix-ups for the Nimbus build chain.
+ *
+ *   1. Create a stub `@lifo-sh/ui` (legacy alias; some imports still
+ *      reference it).
+ *   2. Patch every installed copy of `isomorphic-git` (cf-git fork) so
+ *      its `exports` map points at `src/...` paths (the published
+ *      tarball's package.json points at root-level paths but the
+ *      tarball actually ships files under `src/`).
+ *   3. Symlink cf-git's missing deps into its nested `node_modules`
+ *      so wrangler's esbuild can resolve them.
+ *
+ * Walks both root node_modules AND every packages/* / apps/*
+ * sub-node_modules. Idempotent — re-running is a no-op once patched.
+ */
+
+import { mkdirSync, writeFileSync, existsSync, readFileSync, readdirSync, symlinkSync, statSync } from 'node:fs';
+import { join, dirname, resolve, relative } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+// The script lives at packages/worker/scripts/. Walk up to the repo
+// root so we can patch every node_modules tree below it.
+const repoRoot = resolve(__dirname, '..', '..', '..');
+
+// ── 1. @lifo-sh/ui stub at root node_modules ────────────────────────
+{
+  const dir = join(repoRoot, 'node_modules', '@lifo-sh', 'ui');
+  if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+  writeFileSync(
+    join(dir, 'package.json'),
+    JSON.stringify({ name: '@lifo-sh/ui', version: '0.0.1', main: 'index.js' }, null, 2),
+  );
+  writeFileSync(join(dir, 'index.js'), 'module.exports = {};');
+  writeFileSync(join(dir, 'index.d.ts'), 'export {};');
+  console.log('[patch] @lifo-sh/ui stub created');
+}
+
+// ── 2 + 3. Walk every node_modules and patch cf-git copies ──────────
+function walkForNodeModules(base, depth = 0) {
+  if (depth > 5) return [];          // safety
+  if (!existsSync(base)) return [];
+  const out = [];
+  let entries;
+  try { entries = readdirSync(base, { withFileTypes: true }); }
+  catch { return []; }
+  for (const ent of entries) {
+    if (!ent.isDirectory()) continue;
+    if (ent.name === 'node_modules') {
+      out.push(join(base, ent.name));
+    } else if (ent.name === 'packages' || ent.name === 'apps') {
+      // recurse one level into packages/* and apps/*
+      for (const sub of readdirSync(join(base, ent.name), { withFileTypes: true })) {
+        if (sub.isDirectory()) {
+          out.push(...walkForNodeModules(join(base, ent.name, sub.name), depth + 1));
+        }
+      }
+    }
+  }
+  return out;
+}
+
+const nmDirs = walkForNodeModules(repoRoot);
+for (const nm of nmDirs) {
+  const igPkgPath = join(nm, 'isomorphic-git', 'package.json');
+  if (!existsSync(igPkgPath)) continue;
+  try {
+    const pkg = JSON.parse(readFileSync(igPkgPath, 'utf8'));
+    const igDir = dirname(igPkgPath);
+    const needsPatch =
+      pkg.exports?.['.']?.worker === './index.js'
+      && !existsSync(join(igDir, 'index.js'))
+      && existsSync(join(igDir, 'src', 'index.js'));
+    if (needsPatch) {
+      pkg.exports['.'] = {
+        types: './src/index.d.ts',
+        worker: './src/index.js',
+        import: './src/index.js',
+        default: './src/index.js',
+      };
+      if (pkg.exports['./http/web']) {
+        pkg.exports['./http/web'] = {
+          import: { types: './src/http/web/index.d.ts', default: './src/http/web/index.js' },
+        };
+      }
+      if (pkg.exports['./http/node']) {
+        pkg.exports['./http/node'] = {
+          import: { types: './src/http/node/index.d.ts', default: './src/http/node/index.js' },
+        };
+      }
+      pkg.main = './src/index.js';
+      writeFileSync(igPkgPath, JSON.stringify(pkg, null, 2) + '\n');
+      console.log(`[patch] cf-git exports patched: ${igPkgPath}`);
+    }
+
+    // Symlink missing nested deps so wrangler's esbuild can resolve them.
+    const igNm = join(igDir, 'node_modules');
+    if (existsSync(igNm)) {
+      const needed = ['clean-git-ref', 'is-git-ref-name-valid', 'crc-32', 'sha.js', 'simple-get', 'minimisted'];
+      // Walk up to find the nearest node_modules with each needed pkg.
+      for (const need of needed) {
+        const target = join(igNm, need);
+        if (existsSync(target)) continue;
+        // Search up the dir chain.
+        let search = dirname(nm);
+        let found = null;
+        while (search !== '/') {
+          const candidate = join(search, 'node_modules', need);
+          if (existsSync(candidate)) { found = candidate; break; }
+          search = dirname(search);
+        }
+        if (!found) continue;
+        // Compute relative symlink target (path-from-symlink-dir-to-target).
+        const rel = relative(igNm, found);
+        try {
+          symlinkSync(rel, target);
+          console.log(`[patch] cf-git dep linked: ${target} → ${rel}`);
+        } catch (e) {
+          // Common when symlink already exists or two processes race.
+          if (!String(e?.message).includes('EEXIST')) {
+            console.warn(`[patch] cf-git symlink failed: ${need} — ${e?.message}`);
+          }
+        }
+      }
+    }
+  } catch (e) {
+    console.warn(`[patch] cf-git patch skipped at ${igPkgPath}:`, e?.message);
+  }
+}
+
+