@scenar/cli 0.1.20 → 0.2.1

package/src/serve/static-server.js

@@ -0,0 +1,91 @@
+import { createServer } from "node:http";
+import { createReadStream } from "node:fs";
+import { stat } from "node:fs/promises";
+import { resolve, sep } from "node:path";
+import { contentTypeFor, resolveStaticPath } from "./request-path.js";
+/**
+ * Create (but do not start) an HTTP server that serves a packed bundle as a
+ * static site. Only GET/HEAD are allowed; every response carries the bundle
+ * contract's canonical content type and `Cache-Control: no-cache` (a local
+ * preview should always reflect the latest pack, never a stale asset).
+ *
+ * No CSP or other security headers are emitted: that envelope is the serving
+ * edge's responsibility (and is enforced + tested in scenar-cloud). A local
+ * preview deliberately matches the headerless behaviour of a plain static host
+ * such as GitHub Pages — the other Phase 1 target — so what you see locally is
+ * what a `scenar publish` visitor sees.
+ */
+export function createBundleServer(rootDir) {
+    const root = resolve(rootDir);
+    return createServer((req, res) => {
+        void serveRequest(root, req, res).catch(() => {
+            if (!res.headersSent)
+                res.writeHead(500, { "content-type": "text/plain" });
+            res.end("Internal Server Error");
+        });
+    });
+}
+async function serveRequest(root, req, res) {
+    if (req.method !== "GET" && req.method !== "HEAD") {
+        res.writeHead(405, { allow: "GET, HEAD", "content-type": "text/plain" });
+        res.end("Method Not Allowed");
+        return;
+    }
+    const relativePath = resolveStaticPath(req.url ?? "/");
+    if (relativePath === null) {
+        res.writeHead(400, { "content-type": "text/plain" });
+        res.end("Bad Request");
+        return;
+    }
+    const absolutePath = resolve(root, relativePath);
+    // Defence in depth: the resolved path must stay within the bundle root even
+    // if resolveStaticPath ever let something through.
+    if (absolutePath !== root && !absolutePath.startsWith(root + sep)) {
+        res.writeHead(403, { "content-type": "text/plain" });
+        res.end("Forbidden");
+        return;
+    }
+    const info = await stat(absolutePath).catch(() => null);
+    if (!info || !info.isFile()) {
+        res.writeHead(404, { "content-type": "text/plain" });
+        res.end("Not Found");
+        return;
+    }
+    res.writeHead(200, {
+        "content-type": contentTypeFor(relativePath),
+        "content-length": info.size,
+        "cache-control": "no-cache",
+    });
+    if (req.method === "HEAD") {
+        res.end();
+        return;
+    }
+    createReadStream(absolutePath).pipe(res);
+}
+/**
+ * Start an HTTP server for a packed bundle and resolve once it is listening.
+ * Rejects if the port is already in use (the caller surfaces a clear message).
+ */
+export function startBundleServer(options) {
+    const host = options.host ?? "localhost";
+    const server = createBundleServer(options.rootDir);
+    return new Promise((resolvePromise, reject) => {
+        const onError = (error) => reject(error);
+        server.once("error", onError);
+        server.listen(options.port, host, () => {
+            server.removeListener("error", onError);
+            const address = server.address();
+            const port = typeof address === "object" && address ? address.port : options.port;
+            // Wildcard binds are not dialable hostnames; advertise localhost instead.
+            const displayHost = host === "0.0.0.0" || host === "::" ? "localhost" : host;
+            resolvePromise({
+                url: `http://${displayHost}:${port}/`,
+                port,
+                close: () => new Promise((done, fail) => {
+                    server.close((err) => (err ? fail(err) : done()));
+                }),
+            });
+        });
+    });
+}
+//# sourceMappingURL=static-server.js.map

package/src/serve/static-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"static-server.js","sourceRoot":"","sources":["../../../src/serve/static-server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AACjG,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAsBtE;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9B,OAAO,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC/B,KAAK,YAAY,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YAC3C,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;YAC3E,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,GAAoB,EAAE,GAAmB;IACjF,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAClD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;QACzE,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;QAC9B,OAAO;IACT,CAAC;IAED,MAAM,YAAY,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;IACvD,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QAC1B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;QACrD,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACvB,OAAO;IACT,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACjD,4EAA4E;IAC5E,mDAAmD;IACnD,IAAI,YAAY,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;QAClE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;QACrD,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACxD,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QAC5B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;QACrD,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;QACjB,cAAc,EAAE,cAAc,CAAC,YAAY,CAAC;QAC5C,gBAAgB,EAAE,IAAI,CAAC,IAAI;QAC3B,eAAe,EAAE,UAAU;KAC5B,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC1B,GAAG,CAAC,GAAG,EAAE,CAAC;QACV,OAAO;IACT,CAAC;IACD,gBAAgB,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAiC;IACjE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;IACzC,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAEnD,OAAO,IAAI,OAAO,CAAqB,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE;QAChE,MAAM,OAAO,GAAG,CAAC,KAAY,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;YACrC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACxC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;YAClF,0EAA0E;YAC1E,MAAM,WAAW,GAAG,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7E,cAAc,CAAC;gBACb,GAAG,EAAE,UAAU,WAAW,IAAI,IAAI,GAAG;gBACrC,IAAI;gBACJ,KAAK,EAAE,GAAG,EAAE,CACV,IAAI,OAAO,CAAO,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;oBAC/B,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBACpD,CAAC,CAAC;aACL,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/src/serve/static-server.ts

@@ -0,0 +1,118 @@
+import { createServer, type IncomingMessage, type Server, type ServerResponse } from "node:http";
+import { createReadStream } from "node:fs";
+import { stat } from "node:fs/promises";
+import { resolve, sep } from "node:path";
+import { contentTypeFor, resolveStaticPath } from "./request-path.js";
+
+/** A running bundle server: where it is reachable and how to stop it. */
+export interface BundleServerHandle {
+  /** The base URL the bundle is served at (e.g. http://localhost:4173/). */
+  readonly url: string;
+  /** The port the server actually bound (useful when port 0 was requested). */
+  readonly port: number;
+  /** Stop accepting connections and release the port. */
+  close(): Promise<void>;
+}
+
+/** Options for {@link startBundleServer}. */
+export interface StartBundleServerOptions {
+  /** Bundle directory to serve (a `scenar pack` output). */
+  readonly rootDir: string;
+  /** Port to bind; 0 lets the OS pick a free one (handy in tests). */
+  readonly port: number;
+  /** Host/interface to bind. Defaults to "localhost". */
+  readonly host?: string;
+}
+
+/**
+ * Create (but do not start) an HTTP server that serves a packed bundle as a
+ * static site. Only GET/HEAD are allowed; every response carries the bundle
+ * contract's canonical content type and `Cache-Control: no-cache` (a local
+ * preview should always reflect the latest pack, never a stale asset).
+ *
+ * No CSP or other security headers are emitted: that envelope is the serving
+ * edge's responsibility (and is enforced + tested in scenar-cloud). A local
+ * preview deliberately matches the headerless behaviour of a plain static host
+ * such as GitHub Pages — the other Phase 1 target — so what you see locally is
+ * what a `scenar publish` visitor sees.
+ */
+export function createBundleServer(rootDir: string): Server {
+  const root = resolve(rootDir);
+  return createServer((req, res) => {
+    void serveRequest(root, req, res).catch(() => {
+      if (!res.headersSent) res.writeHead(500, { "content-type": "text/plain" });
+      res.end("Internal Server Error");
+    });
+  });
+}
+
+async function serveRequest(root: string, req: IncomingMessage, res: ServerResponse): Promise<void> {
+  if (req.method !== "GET" && req.method !== "HEAD") {
+    res.writeHead(405, { allow: "GET, HEAD", "content-type": "text/plain" });
+    res.end("Method Not Allowed");
+    return;
+  }
+
+  const relativePath = resolveStaticPath(req.url ?? "/");
+  if (relativePath === null) {
+    res.writeHead(400, { "content-type": "text/plain" });
+    res.end("Bad Request");
+    return;
+  }
+
+  const absolutePath = resolve(root, relativePath);
+  // Defence in depth: the resolved path must stay within the bundle root even
+  // if resolveStaticPath ever let something through.
+  if (absolutePath !== root && !absolutePath.startsWith(root + sep)) {
+    res.writeHead(403, { "content-type": "text/plain" });
+    res.end("Forbidden");
+    return;
+  }
+
+  const info = await stat(absolutePath).catch(() => null);
+  if (!info || !info.isFile()) {
+    res.writeHead(404, { "content-type": "text/plain" });
+    res.end("Not Found");
+    return;
+  }
+
+  res.writeHead(200, {
+    "content-type": contentTypeFor(relativePath),
+    "content-length": info.size,
+    "cache-control": "no-cache",
+  });
+  if (req.method === "HEAD") {
+    res.end();
+    return;
+  }
+  createReadStream(absolutePath).pipe(res);
+}
+
+/**
+ * Start an HTTP server for a packed bundle and resolve once it is listening.
+ * Rejects if the port is already in use (the caller surfaces a clear message).
+ */
+export function startBundleServer(options: StartBundleServerOptions): Promise<BundleServerHandle> {
+  const host = options.host ?? "localhost";
+  const server = createBundleServer(options.rootDir);
+
+  return new Promise<BundleServerHandle>((resolvePromise, reject) => {
+    const onError = (error: Error) => reject(error);
+    server.once("error", onError);
+    server.listen(options.port, host, () => {
+      server.removeListener("error", onError);
+      const address = server.address();
+      const port = typeof address === "object" && address ? address.port : options.port;
+      // Wildcard binds are not dialable hostnames; advertise localhost instead.
+      const displayHost = host === "0.0.0.0" || host === "::" ? "localhost" : host;
+      resolvePromise({
+        url: `http://${displayHost}:${port}/`,
+        port,
+        close: () =>
+          new Promise<void>((done, fail) => {
+            server.close((err) => (err ? fail(err) : done()));
+          }),
+      });
+    });
+  });
+}