@nocobase/cli 2.2.0-alpha.1 → 2.2.0-alpha.11

package/dist/lib/env-proxy.js

@@ -20,9 +20,12 @@ const DEFAULT_API_BASE_PATH = '/api/';
 const DEFAULT_WS_PATH = '/ws';
 const DEFAULT_PLUGIN_STATICS_PATH = '/static/plugins/';
 const DEFAULT_MODERN_CLIENT_PREFIX = 'v';
+const DEFAULT_APP_CLIENT_ENTRY_MODE = 'legacy-default';
+const APP_CLIENT_ENTRY_MODES = new Set(['legacy-default', 'modern-default', 'modern-only']);
 const DEFAULT_API_CLIENT_STORAGE_PREFIX = 'NOCOBASE_';
 const DEFAULT_API_CLIENT_STORAGE_TYPE = 'localStorage';
 const DEFAULT_ESM_CDN_BASE_URL = 'https://esm.sh';
+const PORTAL_CLIENT_PREFIX = 'x';
 const LOCAL_APP_PACKAGE_JSON_PATH = 'node_modules/@nocobase/app/package.json';
 const MANAGED_PROXY_BLOCK_BEGIN = '# BEGIN NocoBase proxy';
 const MANAGED_PROXY_BLOCK_END = '# END NocoBase proxy';
@@ -68,6 +71,10 @@ function normalizeModernClientPrefix(value) {
         .replace(/^\/+|\/+$/g, '');
     return segment || DEFAULT_MODERN_CLIENT_PREFIX;
 }
+function normalizeAppClientEntryMode(value) {
+    const normalized = String(value || '').trim();
+    return APP_CLIENT_ENTRY_MODES.has(normalized) ? normalized : DEFAULT_APP_CLIENT_ENTRY_MODE;
+}
 function normalizeApiBasePath(value = DEFAULT_API_BASE_PATH) {
     return resolveAppPublicPath(value);
 }
@@ -259,7 +266,7 @@ export function applyEnvProxyAppEntryOptions(content, provider, options) {
 function toCaddyPathMatcher(prefixPath) {
     return `${prefixPath}*`;
 }
-export async function loadEnvProxySettings(runtime) {
+export async function loadEnvProxySettings(runtime, options) {
     const { envFilePath, envValues } = await readManagedRuntimeEnvValues(runtime);
     const appPublicPath = resolveAppPublicPath(runtime.env.config.appPublicPath || envValues.APP_PUBLIC_PATH || DEFAULT_APP_PUBLIC_PATH);
     const apiClientShareToken = /^true$/i.test(String(envValues.API_CLIENT_SHARE_TOKEN ?? '').trim());
@@ -274,7 +281,10 @@ export async function loadEnvProxySettings(runtime) {
             wsPath: prefixRuntimePath(appPublicPath, envValues.WS_PATH || DEFAULT_WS_PATH),
             pluginStaticsPath: prefixRuntimePath(appPublicPath, envValues.PLUGIN_STATICS_PATH || DEFAULT_PLUGIN_STATICS_PATH, { trailingSlash: true }),
             modernClientPrefix: normalizeModernClientPrefix(envValues.APP_MODERN_CLIENT_PREFIX),
-            cdnBaseUrl: trimValue(runtime.env.envVars?.CDN_BASE_URL) ?? trimValue(envValues.CDN_BASE_URL),
+            appClientEntryMode: normalizeAppClientEntryMode(envValues.APP_CLIENT_ENTRY_MODE),
+            cdnBaseUrl: trimValue(options?.cdnBaseUrl) ??
+                trimValue(runtime.env.envVars?.CDN_BASE_URL) ??
+                trimValue(envValues.CDN_BASE_URL),
             apiClientStoragePrefix: trimValue(envValues.API_CLIENT_STORAGE_PREFIX) ?? DEFAULT_API_CLIENT_STORAGE_PREFIX,
             apiClientStorageType: trimValue(envValues.API_CLIENT_STORAGE_TYPE) ?? DEFAULT_API_CLIENT_STORAGE_TYPE,
             apiClientShareToken,
@@ -284,6 +294,54 @@ export async function loadEnvProxySettings(runtime) {
         },
     };
 }
+function createManualProxyEnvSettings(input) {
+    const appPublicPath = resolveAppPublicPath(input.appPublicPath || DEFAULT_APP_PUBLIC_PATH);
+    return {
+        appPublicPath,
+        apiBasePath: prefixRuntimePath(appPublicPath, DEFAULT_API_BASE_PATH, {
+            trailingSlash: true,
+        }),
+        distPath: resolveDistPublicPath(appPublicPath),
+        wsPath: prefixRuntimePath(appPublicPath, DEFAULT_WS_PATH),
+        pluginStaticsPath: prefixRuntimePath(appPublicPath, DEFAULT_PLUGIN_STATICS_PATH, {
+            trailingSlash: true,
+        }),
+        modernClientPrefix: DEFAULT_MODERN_CLIENT_PREFIX,
+        appClientEntryMode: normalizeAppClientEntryMode(process.env.APP_CLIENT_ENTRY_MODE),
+        cdnBaseUrl: trimValue(input.cdnBaseUrl),
+        apiClientStoragePrefix: DEFAULT_API_CLIENT_STORAGE_PREFIX,
+        apiClientStorageType: DEFAULT_API_CLIENT_STORAGE_TYPE,
+        apiClientShareToken: false,
+        wsUrl: '',
+        esmCdnBaseUrl: DEFAULT_ESM_CDN_BASE_URL,
+        esmCdnSuffix: '',
+    };
+}
+function normalizeManualNginxInput(input) {
+    const upstreamPort = trimValue(input.upstreamPort) ?? trimValue(input.appPort);
+    return {
+        name: String(input.name).trim(),
+        storagePath: String(input.storagePath).trim(),
+        distRootPath: String(input.distRootPath).trim(),
+        runtimeVersion: String(input.runtimeVersion).trim(),
+        appPublicPath: trimValue(input.appPublicPath),
+        upstreamHost: trimValue(input.upstreamHost),
+        upstreamPort,
+        appPort: trimValue(input.appPort),
+        cdnBaseUrl: trimValue(input.cdnBaseUrl),
+    };
+}
+function normalizeProxyPort(value) {
+    const normalized = trimValue(value);
+    if (!normalized || !/^\d+$/.test(normalized)) {
+        return undefined;
+    }
+    const port = Number(normalized);
+    if (!Number.isInteger(port) || port < 1 || port > 65535) {
+        return undefined;
+    }
+    return normalized;
+}
 async function parseVersionFromPackageJson(content, sourceLabel) {
     let parsed;
     try {
@@ -438,7 +496,9 @@ function rewriteHtmlAssetPublicPath(html, currentPublicPath, nextPublicPath) {
 }
 function buildNginxManagedConfigBlock(context) {
     const v2PublicPathNoTrailingSlash = trimTrailingSlash(context.v2PublicPath);
+    const apiBasePathNoTrailingSlash = trimTrailingSlash(context.apiBasePath);
     const appPublicPathNoTrailingSlash = trimTrailingSlash(context.appPublicPath);
+    const fileAccessPath = `${context.appPublicPath}files/`;
     const isRootMounted = context.appPublicPath === '/';
     const appPublicPathRedirectBlock = isRootMounted
         ? ''
@@ -476,6 +536,26 @@ function buildNginxManagedConfigBlock(context) {
         `        include ${context.snippetsDir}/proxy-location.conf;`,
         '    }',
         '',
+        `    location ^~ ${fileAccessPath} {`,
+        `        proxy_pass ${context.backendUrl};`,
+        `        include ${context.snippetsDir}/proxy-location.conf;`,
+        '    }',
+        ...(!isRootMounted
+            ? [
+                '',
+                '    location ^~ /files/ {',
+                `        proxy_pass ${context.backendUrl};`,
+                `        include ${context.snippetsDir}/proxy-location.conf;`,
+                '    }',
+            ]
+            : []),
+        '',
+        buildNginxPortalLocationBlock(context),
+        '',
+        `    location = ${apiBasePathNoTrailingSlash} {`,
+        `        return 308 ${context.apiBasePath}$is_args$args;`,
+        '    }',
+        '',
         `    location ^~ ${context.apiBasePath} {`,
         `        proxy_pass ${context.backendUrl};`,
         `        include ${context.snippetsDir}/proxy-location.conf;`,
@@ -497,7 +577,7 @@ function buildNginxManagedConfigBlock(context) {
         `        include ${context.snippetsDir}/spa-location.conf;`,
         '    }',
         '',
-        `    location ^~ ${context.appPublicPath} {`,
+        `    location ${context.appPublicPath} {`,
         `        alias ${context.publicDir}/;`,
         `        try_files $uri /index-v1.html =404;`,
         `        include ${context.snippetsDir}/spa-location.conf;`,
@@ -506,11 +586,71 @@ function buildNginxManagedConfigBlock(context) {
         `    ${MANAGED_NGINX_CONFIG_BLOCK_END}`,
     ].join('\n');
 }
+function buildNginxPortalRootPublicPath(appPublicPath) {
+    return appPublicPath === DEFAULT_APP_PUBLIC_PATH
+        ? `/${PORTAL_CLIENT_PREFIX}/`
+        : `${trimTrailingSlash(appPublicPath)}/${PORTAL_CLIENT_PREFIX}/`;
+}
+function buildNginxPortalLocationBlock(context) {
+    const portalBasePath = trimTrailingSlash(buildNginxPortalRootPublicPath(context.appPublicPath));
+    const portalBasePathPattern = escapeRegExp(portalBasePath);
+    return [
+        `    location ^~ ${portalBasePath}/apps/ {`,
+        '        absolute_redirect off;',
+        '',
+        `        if ($uri ~ ^${portalBasePathPattern}/apps/(?<subapp>[A-Za-z0-9_-]+)/(?<portal>[A-Za-z0-9_-]+)$) {`,
+        `            return 308 ${portalBasePath}/apps/$subapp/$portal/$is_args$args;`,
+        '        }',
+        '',
+        `        if ($uri !~ ^${portalBasePathPattern}/apps/(?<subapp>[A-Za-z0-9_-]+)/(?<portal>[A-Za-z0-9_-]+)/(?<portal_path>.*)$) {`,
+        '            return 404;',
+        '        }',
+        '',
+        `        root ${context.storageDir};`,
+        '',
+        '        if ($portal_path = "") {',
+        '            rewrite ^ /portals/$subapp/$portal/dist/index.html break;',
+        '        }',
+        '',
+        '        try_files',
+        '            /portals/$subapp/$portal/dist/$portal_path',
+        '            /portals/$subapp/$portal/dist/$portal_path/',
+        '            /portals/$subapp/$portal/dist/index.html',
+        '            =404;',
+        '    }',
+        '',
+        `    location ^~ ${portalBasePath}/ {`,
+        '        absolute_redirect off;',
+        '',
+        `        if ($uri ~ ^${portalBasePathPattern}/(?<portal>[A-Za-z0-9_-]+)$) {`,
+        `            return 308 ${portalBasePath}/$portal/$is_args$args;`,
+        '        }',
+        '',
+        `        if ($uri !~ ^${portalBasePathPattern}/(?<portal>[A-Za-z0-9_-]+)/(?<portal_path>.*)$) {`,
+        '            return 404;',
+        '        }',
+        '',
+        `        root ${context.storageDir};`,
+        '',
+        '        if ($portal_path = "") {',
+        '            rewrite ^ /portals/main/$portal/dist/index.html break;',
+        '        }',
+        '',
+        '        try_files',
+        '            /portals/main/$portal/dist/$portal_path',
+        '            /portals/main/$portal/dist/$portal_path/',
+        '            /portals/main/$portal/dist/index.html',
+        '            =404;',
+        '    }',
+        '',
+    ].join('\n');
+}
 function buildNginxRuntimeConfig(context, variant) {
     return {
         __webpack_public_path__: context.cdnBaseUrl,
         __nocobase_public_path__: variant === 'v1' ? context.appPublicPath : context.v2PublicPath,
         ...(variant === 'v2' ? { __nocobase_modern_client_prefix__: context.modernClientPrefix } : {}),
+        __nocobase_app_client_entry_mode__: context.appClientEntryMode,
         __nocobase_api_base_url__: context.apiBasePath,
         __nocobase_api_client_storage_prefix__: context.apiClientStoragePrefix,
         __nocobase_api_client_storage_type__: context.apiClientStorageType,
@@ -525,65 +665,95 @@ function buildNginxRuntimeConfig(context, variant) {
 function buildCaddyRuntimeConfig(context, variant) {
     return buildNginxRuntimeConfig(context, variant);
 }
-async function buildEnvProxyNginxRenderContext(runtime, options) {
-    const apiPort = trimValue(runtime.env.appPort ?? runtime.env.config.appPort);
-    if (!apiPort) {
-        throw new Error(translateCli('commands.envProxy.errors.missingAppPort', { envName: runtime.envName }, {
-            fallback: `Missing appPort for env "${runtime.envName}". Save or update the app port before generating proxy config.`,
-        }));
-    }
-    const activeVersion = trimValue(await readDistClientActiveVersion(runtime.env.storagePath));
-    if (!activeVersion) {
-        throw new Error(translateCli('commands.envProxy.errors.missingVersion', { envName: runtime.envName }, {
-            fallback: `Couldn't determine the app version for env "${runtime.envName}". Run \`nb env update ${runtime.envName}\` and try again.`,
-        }));
-    }
-    const { envFilePath, settings } = await loadEnvProxySettings(runtime);
+async function buildEnvProxyNginxRenderContext(source, options) {
     const proxyHost = await resolveProxyUpstreamHost(options);
-    const backendUrl = `http://${proxyHost}:${apiPort}`;
-    const cdnBaseUrl = settings.cdnBaseUrl ?? buildDefaultCdnBaseUrl(settings.appPublicPath, activeVersion);
-    const entryDir = resolveEnvProxyEntryDir(runtime.envName, { scope: options?.scope });
-    const publicDir = resolveEnvProxyNginxPublicOutputDir(runtime.envName, { scope: options?.scope });
+    const upstreamPort = normalizeProxyPort(options?.upstreamPort) ?? source.apiPort;
+    const backendUrl = `http://${proxyHost}:${upstreamPort}`;
+    const cdnBaseUrl = source.settings.cdnBaseUrl ?? buildDefaultCdnBaseUrl(source.settings.appPublicPath, source.activeVersion);
+    const entryDir = resolveEnvProxyEntryDir(source.envName, { scope: options?.scope });
+    const publicDir = resolveEnvProxyNginxPublicOutputDir(source.envName, { scope: options?.scope });
     const snippetsDir = resolveEnvProxyNginxSnippetsOutputDir({ scope: options?.scope });
-    const distRootDir = resolveDistClientRoot(runtime.env.storagePath);
-    const uploadsDir = path.join(runtime.env.storagePath, 'uploads');
+    const distRootDir = source.distRootPath;
+    const uploadsDir = path.join(source.storagePath, 'uploads');
     const mappedEntryDir = await mapProxyPathFromCliRoot(entryDir, options);
     const mappedPublicDir = await mapProxyPathFromCliRoot(publicDir, options);
     const mappedSnippetsDir = await mapProxyPathFromCliRoot(snippetsDir, options);
     const mappedDistRootDir = await mapProxyPathFromCliRoot(distRootDir, options);
+    const mappedStorageDir = await mapProxyPathFromCliRoot(source.storagePath, options);
     const mappedUploadsDir = await mapProxyPathFromCliRoot(uploadsDir, options);
-    const v2PublicPath = `${settings.appPublicPath.replace(/\/$/, '')}/${settings.modernClientPrefix}/`;
+    const v2PublicPath = `${source.settings.appPublicPath.replace(/\/$/, '')}/${source.settings.modernClientPrefix}/`;
     return {
-        envName: runtime.envName,
-        envFilePath,
-        apiBasePath: settings.apiBasePath,
-        apiClientShareToken: settings.apiClientShareToken,
-        apiClientStoragePrefix: settings.apiClientStoragePrefix,
-        apiClientStorageType: settings.apiClientStorageType,
-        apiPort,
-        appPublicPath: settings.appPublicPath,
+        envName: source.envName,
+        envFilePath: source.envFilePath,
+        apiBasePath: source.settings.apiBasePath,
+        apiClientShareToken: source.settings.apiClientShareToken,
+        apiClientStoragePrefix: source.settings.apiClientStoragePrefix,
+        apiClientStorageType: source.settings.apiClientStorageType,
+        apiPort: source.apiPort,
+        appPublicPath: source.settings.appPublicPath,
         backendUrl,
         cdnBaseUrl: ensureTrailingSlash(cdnBaseUrl),
-        distPath: settings.distPath,
+        distPath: source.settings.distPath,
         distRootDir: mappedDistRootDir,
         entryDir: mappedEntryDir,
         publicDir: mappedPublicDir,
-        esmCdnBaseUrl: settings.esmCdnBaseUrl,
-        esmCdnSuffix: settings.esmCdnSuffix,
-        indexV1Path: await mapProxyPathFromCliRoot(resolveEnvProxyNginxIndexOutputPath(runtime.envName, 'v1', { scope: options?.scope }), options),
-        indexV2Path: await mapProxyPathFromCliRoot(resolveEnvProxyNginxIndexOutputPath(runtime.envName, 'v2', { scope: options?.scope }), options),
-        modernClientPrefix: settings.modernClientPrefix,
+        esmCdnBaseUrl: source.settings.esmCdnBaseUrl,
+        esmCdnSuffix: source.settings.esmCdnSuffix,
+        indexV1Path: await mapProxyPathFromCliRoot(resolveEnvProxyNginxIndexOutputPath(source.envName, 'v1', { scope: options?.scope }), options),
+        indexV2Path: await mapProxyPathFromCliRoot(resolveEnvProxyNginxIndexOutputPath(source.envName, 'v2', { scope: options?.scope }), options),
+        modernClientPrefix: source.settings.modernClientPrefix,
+        appClientEntryMode: source.settings.appClientEntryMode,
         proxyHost,
         snippetsDir: mappedSnippetsDir,
+        storageDir: mappedStorageDir,
         uploadsDir: mappedUploadsDir,
         v2PublicPath,
-        wsPath: settings.wsPath,
-        wsUrl: settings.wsUrl,
+        wsPath: source.settings.wsPath,
+        wsUrl: source.settings.wsUrl,
+        activeVersion: source.activeVersion,
+    };
+}
+async function resolveRuntimeNginxBundleSource(runtime, options) {
+    const apiPort = trimValue(runtime.env.appPort ?? runtime.env.config.appPort);
+    if (!apiPort) {
+        throw new Error(translateCli('commands.envProxy.errors.missingAppPort', { envName: runtime.envName }, {
+            fallback: `Missing appPort for env "${runtime.envName}". Save or update the app port before generating proxy config.`,
+        }));
+    }
+    const activeVersion = trimValue(await readDistClientActiveVersion(runtime.env.storagePath));
+    if (!activeVersion) {
+        throw new Error(translateCli('commands.envProxy.errors.missingVersion', { envName: runtime.envName }, {
+            fallback: `Couldn't determine the app version for env "${runtime.envName}". Run \`nb env update ${runtime.envName}\` and try again.`,
+        }));
+    }
+    const { envFilePath, settings } = await loadEnvProxySettings(runtime, options);
+    return {
+        envName: runtime.envName,
+        envFilePath,
+        storagePath: runtime.env.storagePath,
+        distRootPath: resolveDistClientRoot(runtime.env.storagePath),
+        settings,
+        apiPort,
         activeVersion,
     };
 }
+async function resolveManualNginxBundleSource(input) {
+    const normalized = normalizeManualNginxInput(input);
+    return {
+        envName: normalized.name,
+        envFilePath: undefined,
+        storagePath: normalized.storagePath,
+        distRootPath: normalized.distRootPath,
+        settings: createManualProxyEnvSettings(normalized),
+        apiPort: normalized.upstreamPort,
+        activeVersion: normalized.runtimeVersion,
+    };
+}
 async function buildEnvProxyCaddyRenderContext(runtime, options) {
-    return await buildEnvProxyNginxRenderContext(runtime, {
+    return await buildEnvProxyCaddyRenderContextFromSource(await resolveRuntimeNginxBundleSource(runtime), options);
+}
+async function buildEnvProxyCaddyRenderContextFromSource(source, options) {
+    return await buildEnvProxyNginxRenderContext(source, {
         ...options,
         provider: 'caddy',
     });
@@ -636,11 +806,21 @@ export function resolveEnvProxyCaddyIndexOutputPath(envName, variant, options) {
     return path.join(resolveEnvProxyCaddyPublicOutputDir(envName, { scope: options?.scope }), `index-${variant}.html`);
 }
 export async function buildEnvProxyNginxBundle(runtime, options) {
-    const context = await buildEnvProxyNginxRenderContext(runtime, options);
+    return await buildNginxBundleFromSource(await resolveRuntimeNginxBundleSource(runtime, options), options);
+}
+export async function buildManualEnvProxyNginxBundle(input, options) {
+    return await buildNginxBundleFromSource(await resolveManualNginxBundleSource(input), {
+        ...options,
+        upstreamHost: trimValue(input.upstreamHost) ?? options?.upstreamHost,
+        upstreamPort: normalizeProxyPort(input.upstreamPort) ?? options?.upstreamPort,
+    });
+}
+async function buildNginxBundleFromSource(source, options) {
+    const context = await buildEnvProxyNginxRenderContext(source, options);
     const appTemplate = await readEnvProxyNginxAssetText('app.conf.tpl');
     const mainTemplate = await readEnvProxyNginxAssetText('nocobase.conf.tpl');
-    const sourceIndexV1Path = path.join(runtime.env.storagePath, 'dist-client', context.activeVersion, 'index.html');
-    const sourceIndexV2Path = path.join(runtime.env.storagePath, 'dist-client', context.activeVersion, DEFAULT_MODERN_CLIENT_PREFIX, 'index.html');
+    const sourceIndexV1Path = path.join(source.distRootPath, context.activeVersion, 'index.html');
+    const sourceIndexV2Path = path.join(source.distRootPath, context.activeVersion, DEFAULT_MODERN_CLIENT_PREFIX, 'index.html');
     const [sourceIndexV1Content, sourceIndexV2Content] = await Promise.all([
         readFile(sourceIndexV1Path, 'utf8'),
         readFile(sourceIndexV2Path, 'utf8'),
@@ -667,13 +847,13 @@ export async function buildEnvProxyNginxBundle(runtime, options) {
         wsPath: context.wsPath,
     };
     return {
-        envName: runtime.envName,
+        envName: source.envName,
         envFilePath: context.envFilePath,
-        entryDir: resolveEnvProxyEntryDir(runtime.envName, { scope: options?.scope, provider: 'nginx' }),
-        publicDir: resolveEnvProxyNginxPublicOutputDir(runtime.envName, { scope: options?.scope }),
-        appConfigPath: resolveEnvProxyAppOutputPath(runtime.envName, { scope: options?.scope, provider: 'nginx' }),
-        indexV1Path: resolveEnvProxyNginxIndexOutputPath(runtime.envName, 'v1', { scope: options?.scope }),
-        indexV2Path: resolveEnvProxyNginxIndexOutputPath(runtime.envName, 'v2', { scope: options?.scope }),
+        entryDir: resolveEnvProxyEntryDir(source.envName, { scope: options?.scope, provider: 'nginx' }),
+        publicDir: resolveEnvProxyNginxPublicOutputDir(source.envName, { scope: options?.scope }),
+        appConfigPath: resolveEnvProxyAppOutputPath(source.envName, { scope: options?.scope, provider: 'nginx' }),
+        indexV1Path: resolveEnvProxyNginxIndexOutputPath(source.envName, 'v1', { scope: options?.scope }),
+        indexV2Path: resolveEnvProxyNginxIndexOutputPath(source.envName, 'v2', { scope: options?.scope }),
         mainConfigPath: resolveEnvProxyMainOutputPath({ scope: options?.scope, provider: 'nginx' }),
         snippetsDir: resolveEnvProxyNginxSnippetsOutputDir({ scope: options?.scope }),
         appPublicPath: context.appPublicPath,
@@ -694,9 +874,19 @@ export async function buildEnvProxyNginxBundle(runtime, options) {
     };
 }
 export async function buildEnvProxyCaddyBundle(runtime, options) {
-    const context = await buildEnvProxyCaddyRenderContext(runtime, options);
-    const sourceIndexV1Path = path.join(runtime.env.storagePath, 'dist-client', context.activeVersion, 'index.html');
-    const sourceIndexV2Path = path.join(runtime.env.storagePath, 'dist-client', context.activeVersion, DEFAULT_MODERN_CLIENT_PREFIX, 'index.html');
+    return await buildCaddyBundleFromSource(await resolveRuntimeNginxBundleSource(runtime), options);
+}
+export async function buildManualEnvProxyCaddyBundle(input, options) {
+    return await buildCaddyBundleFromSource(await resolveManualNginxBundleSource(input), {
+        ...options,
+        upstreamHost: trimValue(input.upstreamHost) ?? options?.upstreamHost,
+        upstreamPort: normalizeProxyPort(input.upstreamPort) ?? options?.upstreamPort,
+    });
+}
+async function buildCaddyBundleFromSource(source, options) {
+    const context = await buildEnvProxyCaddyRenderContextFromSource(source, options);
+    const sourceIndexV1Path = path.join(source.distRootPath, context.activeVersion, 'index.html');
+    const sourceIndexV2Path = path.join(source.distRootPath, context.activeVersion, DEFAULT_MODERN_CLIENT_PREFIX, 'index.html');
     const [sourceIndexV1Content, sourceIndexV2Content] = await Promise.all([
         readFile(sourceIndexV1Path, 'utf8'),
         readFile(sourceIndexV2Path, 'utf8'),
@@ -707,9 +897,9 @@ export async function buildEnvProxyCaddyBundle(runtime, options) {
     const sourceV2PublicPath = extractRuntimePublicPath(sourceIndexV2Content);
     const indexV1AssetPublicPath = context.cdnBaseUrl;
     const indexV2AssetPublicPath = `${trimTrailingSlash(context.cdnBaseUrl)}/${DEFAULT_MODERN_CLIENT_PREFIX}/`;
-    const appConfigPath = resolveEnvProxyAppOutputPath(runtime.envName, { scope: options?.scope, provider: 'caddy' });
-    const entryDir = resolveEnvProxyEntryDir(runtime.envName, { scope: options?.scope, provider: 'caddy' });
-    const publicDir = resolveEnvProxyCaddyPublicOutputDir(runtime.envName, { scope: options?.scope });
+    const appConfigPath = resolveEnvProxyAppOutputPath(source.envName, { scope: options?.scope, provider: 'caddy' });
+    const entryDir = resolveEnvProxyEntryDir(source.envName, { scope: options?.scope, provider: 'caddy' });
+    const publicDir = resolveEnvProxyCaddyPublicOutputDir(source.envName, { scope: options?.scope });
     const renderedPublicDir = await mapProxyPathFromCliRoot(publicDir, { ...options, provider: 'caddy' });
     const appConfigContent = renderCaddyAppTemplate(buildCaddySiteAddress(), {
         appPublicPath: context.appPublicPath,
@@ -725,13 +915,13 @@ export async function buildEnvProxyCaddyBundle(runtime, options) {
         wsPath: context.wsPath,
     }, renderedPublicDir);
     return {
-        envName: runtime.envName,
+        envName: source.envName,
         envFilePath: context.envFilePath,
         entryDir,
         publicDir,
         appConfigPath,
-        indexV1Path: resolveEnvProxyCaddyIndexOutputPath(runtime.envName, 'v1', { scope: options?.scope }),
-        indexV2Path: resolveEnvProxyCaddyIndexOutputPath(runtime.envName, 'v2', { scope: options?.scope }),
+        indexV1Path: resolveEnvProxyCaddyIndexOutputPath(source.envName, 'v1', { scope: options?.scope }),
+        indexV2Path: resolveEnvProxyCaddyIndexOutputPath(source.envName, 'v2', { scope: options?.scope }),
         mainConfigPath: resolveEnvProxyMainOutputPath({ scope: options?.scope, provider: 'caddy' }),
         appPublicPath: context.appPublicPath,
         apiBasePath: context.apiBasePath,
@@ -893,20 +1083,23 @@ function buildNginxOtherLocation(appPublicPath, v2PublicPath, modernClientPrefix
 function renderNginxLocationTemplate(context) {
     const proxyPassBlock = buildNginxProxyPassBlock(context.proxyHost, context.apiPort);
     const wsProxyPassTarget = `http://${context.proxyHost}:${context.apiPort}${context.wsPath}`;
+    const apiBasePathNoTrailingSlash = trimTrailingSlash(context.apiBasePath);
     return `    location ~* ^${context.appPublicPath}storage/uploads/(.*\\.md)$ {
         alias ${context.uploadsPath}/$1;
         default_type text/markdown;
         add_header Cache-Control "public";
         add_header Content-Disposition "inline";
+        add_header Content-Security-Policy "sandbox" always;
         add_header X-Content-Type-Options "nosniff" always;
         access_log off;
         autoindex off;
     }
 
-    location ~* ^${context.appPublicPath}storage/uploads/(.*\\.(?:htm|html|svg|svgz|xhtml|pdf))$ {
+    location ~* ^${context.appPublicPath}storage/uploads/(.*\\.(?:htm|html|pdf|svg|svgz|xht|xhtml|xml|xsl|xslt))$ {
         alias ${context.uploadsPath}/$1;
         add_header Cache-Control "public";
         add_header Content-Disposition "attachment" always;
+        add_header Content-Security-Policy "sandbox" always;
         add_header X-Content-Type-Options "nosniff" always;
         access_log off;
         autoindex off;
@@ -915,6 +1108,7 @@ function renderNginxLocationTemplate(context) {
     location ${context.appPublicPath}storage/uploads/ {
         alias ${context.uploadsPath}/;
         add_header Cache-Control "public";
+        add_header Content-Security-Policy "sandbox" always;
         add_header X-Content-Type-Options "nosniff" always;
         access_log off;
         autoindex off;
@@ -938,6 +1132,10 @@ function renderNginxLocationTemplate(context) {
         ${proxyPassBlock}
     }${context.otherLocation}
 
+    location = ${apiBasePathNoTrailingSlash} {
+        return 308 ${context.apiBasePath}$is_args$args;
+    }
+
     location ^~ ${context.apiBasePath} {
         ${proxyPassBlock}
     }
@@ -989,6 +1187,7 @@ function buildCaddyContextCommentLines(siteAddress, context, publicDir) {
 }
 function renderCaddyAppTemplate(siteAddress, context, publicDir) {
     const uploadsPath = `${context.appPublicPath}storage/uploads/`;
+    const fileAccessPathMatcher = toCaddyPathMatcher(`${context.appPublicPath}files/`);
     const distPathMatcher = toCaddyPathMatcher(context.distPath);
     const uploadsPathMatcher = toCaddyPathMatcher(uploadsPath);
     const apiPathMatcher = toCaddyPathMatcher(context.apiBasePath);
@@ -1030,10 +1229,14 @@ function renderCaddyAppTemplate(siteAddress, context, publicDir) {
         `${siteAddress} {`,
         `    encode zstd gzip${rootRedirectBlock}${appPublicPathRedirectBlock}${modernClientRedirectBlock}${shorthandModernClientRedirectBlock}`,
         '',
+        '    @activeUploadedContent path_regexp activeUploadedContent (?i)\\.(?:htm|html|pdf|svg|svgz|xht|xhtml|xml|xsl|xslt)$',
+        '',
         `    handle_path ${uploadsPathMatcher} {`,
         `        root * ${context.uploadsPath}`,
         '        header Cache-Control public',
+        '        header Content-Security-Policy sandbox',
         '        header X-Content-Type-Options nosniff',
+        '        header @activeUploadedContent Content-Disposition attachment',
         '        file_server',
         '    }',
         '',
@@ -1055,7 +1258,19 @@ function renderCaddyAppTemplate(siteAddress, context, publicDir) {
         `        reverse_proxy ${context.proxyHost}:${context.apiPort}`,
         '    }',
         '',
-        '    # Keep API and WS routes above the SPA fallbacks.',
+        '    # Keep file, API and WS routes above the SPA fallbacks.',
+        `    handle ${fileAccessPathMatcher} {`,
+        `        reverse_proxy ${context.proxyHost}:${context.apiPort}`,
+        '    }',
+        ...(context.appPublicPath === DEFAULT_APP_PUBLIC_PATH
+            ? []
+            : [
+                '',
+                '    handle /files/* {',
+                `        reverse_proxy ${context.proxyHost}:${context.apiPort}`,
+                '    }',
+            ]),
+        '',
         `    handle ${apiPathMatcher} {`,
         `        reverse_proxy ${context.proxyHost}:${context.apiPort}`,
         '    }',