@tabbr/module-cli 0.1.0 → 0.2.0

package/src/auth.js

@@ -1,144 +1,144 @@
-'use strict';
-
-const crypto = require('crypto');
-const fs = require('fs');
-const http = require('http');
-const os = require('os');
-const path = require('path');
-
-// Same Keycloak client the tabbr-ui shell and the SDK's dev bridge use - see
-// tabbr-ui/src/environments/environment.ts and tabbr-module-sdk/src/dev-bridge.
-const KEYCLOAK_URL = 'https://auth.tabbr.net';
-const KEYCLOAK_REALM = 'tabbr';
-const KEYCLOAK_CLIENT_ID = 'tabbr';
-
-const CREDENTIALS_PATH = path.join(os.homedir(), '.tabbr', 'credentials.json');
-
-function base64url(buffer) {
-  return buffer.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
-}
-
-function readCachedCredentials() {
-  try {
-    return JSON.parse(fs.readFileSync(CREDENTIALS_PATH, 'utf-8'));
-  } catch {
-    return null;
-  }
-}
-
-function writeCachedCredentials(creds) {
-  fs.mkdirSync(path.dirname(CREDENTIALS_PATH), { recursive: true });
-  fs.writeFileSync(CREDENTIALS_PATH, JSON.stringify(creds, null, 2), { mode: 0o600 });
-}
-
-async function exchangeToken(params) {
-  const response = await fetch(`${KEYCLOAK_URL}/realms/${KEYCLOAK_REALM}/protocol/openid-connect/token`, {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-    body: new URLSearchParams(params).toString(),
-  });
-  if (!response.ok) {
-    throw new Error(`Token request failed: ${response.status} ${await response.text()}`);
-  }
-  return response.json();
-}
-
-function toCachedCredentials(tokenResponse) {
-  return {
-    accessToken: tokenResponse.access_token,
-    refreshToken: tokenResponse.refresh_token,
-    // A little slack so a token that's about to expire doesn't get used anyway.
-    expiresAt: Date.now() + (tokenResponse.expires_in - 30) * 1000,
-  };
-}
-
-async function refreshAccessToken(cached) {
-  const tokenResponse = await exchangeToken({
-    grant_type: 'refresh_token',
-    refresh_token: cached.refreshToken,
-    client_id: KEYCLOAK_CLIENT_ID,
-  });
-  return toCachedCredentials(tokenResponse);
-}
-
-/** Full-page-redirect + PKCE login via a temporary local HTTP server catching the callback. */
-async function interactiveLogin() {
-  const verifier = base64url(crypto.randomBytes(32));
-  const challenge = base64url(crypto.createHash('sha256').update(verifier).digest());
-
-  // Set once the server actually has a port (inside listen's callback) and reused below -
-  // server.address() returns null once server.close() has been called, so the request handler
-  // must not try to recompute it from the (by-then-closing) server itself.
-  let redirectUri;
-
-  const { code } = await new Promise((resolve, reject) => {
-    const server = http.createServer((req, res) => {
-      const url = new URL(req.url, 'http://localhost');
-      if (url.pathname !== '/callback') {
-        res.writeHead(404).end();
-        return;
-      }
-      const code = url.searchParams.get('code');
-      const error = url.searchParams.get('error');
-      res.writeHead(200, { 'Content-Type': 'text/html' });
-      res.end(error
-        ? `<h1>Login failed</h1><p>${error}</p><p>You can close this tab.</p>`
-        : '<h1>Logged in</h1><p>You can close this tab and return to the terminal.</p>');
-      server.close();
-      if (error) {
-        reject(new Error(`Keycloak login failed: ${error}`));
-      } else {
-        resolve({ code });
-      }
-    });
-    server.listen(0, 'localhost', () => {
-      const port = server.address().port;
-      redirectUri = `http://localhost:${port}/callback`;
-      const authUrl = new URL(`${KEYCLOAK_URL}/realms/${KEYCLOAK_REALM}/protocol/openid-connect/auth`);
-      authUrl.searchParams.set('client_id', KEYCLOAK_CLIENT_ID);
-      authUrl.searchParams.set('response_type', 'code');
-      authUrl.searchParams.set('scope', 'openid');
-      authUrl.searchParams.set('redirect_uri', redirectUri);
-      authUrl.searchParams.set('code_challenge', challenge);
-      authUrl.searchParams.set('code_challenge_method', 'S256');
-
-      console.log('Opening your browser to log in via Keycloak...');
-      console.log(`If it doesn't open automatically, visit:\n${authUrl.toString()}\n`);
-      import('open').then(({ default: open }) => open(authUrl.toString())).catch(() => {
-        // Non-fatal: the URL is already printed above for manual use.
-      });
-    });
-    server.on('error', reject);
-  });
-
-  const tokenResponse = await exchangeToken({
-    grant_type: 'authorization_code',
-    code,
-    redirect_uri: redirectUri,
-    client_id: KEYCLOAK_CLIENT_ID,
-    code_verifier: verifier,
-  });
-  return toCachedCredentials(tokenResponse);
-}
-
-/** Returns a valid access token, reusing/refreshing the cache before falling back to a fresh login. */
-async function getAccessToken() {
-  const cached = readCachedCredentials();
-  if (cached && cached.expiresAt > Date.now()) {
-    return cached.accessToken;
-  }
-  if (cached && cached.refreshToken) {
-    try {
-      const refreshed = await refreshAccessToken(cached);
-      writeCachedCredentials(refreshed);
-      return refreshed.accessToken;
-    } catch {
-      // Refresh token expired/revoked - fall through to interactive login.
-    }
-  }
-  const creds = await interactiveLogin();
-  writeCachedCredentials(creds);
-  return creds.accessToken;
-}
-
-module.exports = { getAccessToken, CREDENTIALS_PATH };
+'use strict';
+
+const crypto = require('crypto');
+const fs = require('fs');
+const http = require('http');
+const os = require('os');
+const path = require('path');
+
+// Same Keycloak client the tabbr-ui shell and the SDK's dev bridge use - see
+// tabbr-ui/src/environments/environment.ts and tabbr-module-sdk/src/dev-bridge.
+const KEYCLOAK_URL = 'https://auth.tabbr.net';
+const KEYCLOAK_REALM = 'tabbr';
+const KEYCLOAK_CLIENT_ID = 'tabbr';
+
+const CREDENTIALS_PATH = path.join(os.homedir(), '.tabbr', 'credentials.json');
+
+function base64url(buffer) {
+  return buffer.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+
+function readCachedCredentials() {
+  try {
+    return JSON.parse(fs.readFileSync(CREDENTIALS_PATH, 'utf-8'));
+  } catch {
+    return null;
+  }
+}
+
+function writeCachedCredentials(creds) {
+  fs.mkdirSync(path.dirname(CREDENTIALS_PATH), { recursive: true });
+  fs.writeFileSync(CREDENTIALS_PATH, JSON.stringify(creds, null, 2), { mode: 0o600 });
+}
+
+async function exchangeToken(params) {
+  const response = await fetch(`${KEYCLOAK_URL}/realms/${KEYCLOAK_REALM}/protocol/openid-connect/token`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+    body: new URLSearchParams(params).toString(),
+  });
+  if (!response.ok) {
+    throw new Error(`Token request failed: ${response.status} ${await response.text()}`);
+  }
+  return response.json();
+}
+
+function toCachedCredentials(tokenResponse) {
+  return {
+    accessToken: tokenResponse.access_token,
+    refreshToken: tokenResponse.refresh_token,
+    // A little slack so a token that's about to expire doesn't get used anyway.
+    expiresAt: Date.now() + (tokenResponse.expires_in - 30) * 1000,
+  };
+}
+
+async function refreshAccessToken(cached) {
+  const tokenResponse = await exchangeToken({
+    grant_type: 'refresh_token',
+    refresh_token: cached.refreshToken,
+    client_id: KEYCLOAK_CLIENT_ID,
+  });
+  return toCachedCredentials(tokenResponse);
+}
+
+/** Full-page-redirect + PKCE login via a temporary local HTTP server catching the callback. */
+async function interactiveLogin() {
+  const verifier = base64url(crypto.randomBytes(32));
+  const challenge = base64url(crypto.createHash('sha256').update(verifier).digest());
+
+  // Set once the server actually has a port (inside listen's callback) and reused below -
+  // server.address() returns null once server.close() has been called, so the request handler
+  // must not try to recompute it from the (by-then-closing) server itself.
+  let redirectUri;
+
+  const { code } = await new Promise((resolve, reject) => {
+    const server = http.createServer((req, res) => {
+      const url = new URL(req.url, 'http://localhost');
+      if (url.pathname !== '/callback') {
+        res.writeHead(404).end();
+        return;
+      }
+      const code = url.searchParams.get('code');
+      const error = url.searchParams.get('error');
+      res.writeHead(200, { 'Content-Type': 'text/html' });
+      res.end(error
+        ? `<h1>Login failed</h1><p>${error}</p><p>You can close this tab.</p>`
+        : '<h1>Logged in</h1><p>You can close this tab and return to the terminal.</p>');
+      server.close();
+      if (error) {
+        reject(new Error(`Keycloak login failed: ${error}`));
+      } else {
+        resolve({ code });
+      }
+    });
+    server.listen(0, 'localhost', () => {
+      const port = server.address().port;
+      redirectUri = `http://localhost:${port}/callback`;
+      const authUrl = new URL(`${KEYCLOAK_URL}/realms/${KEYCLOAK_REALM}/protocol/openid-connect/auth`);
+      authUrl.searchParams.set('client_id', KEYCLOAK_CLIENT_ID);
+      authUrl.searchParams.set('response_type', 'code');
+      authUrl.searchParams.set('scope', 'openid');
+      authUrl.searchParams.set('redirect_uri', redirectUri);
+      authUrl.searchParams.set('code_challenge', challenge);
+      authUrl.searchParams.set('code_challenge_method', 'S256');
+
+      console.log('Opening your browser to log in via Keycloak...');
+      console.log(`If it doesn't open automatically, visit:\n${authUrl.toString()}\n`);
+      import('open').then(({ default: open }) => open(authUrl.toString())).catch(() => {
+        // Non-fatal: the URL is already printed above for manual use.
+      });
+    });
+    server.on('error', reject);
+  });
+
+  const tokenResponse = await exchangeToken({
+    grant_type: 'authorization_code',
+    code,
+    redirect_uri: redirectUri,
+    client_id: KEYCLOAK_CLIENT_ID,
+    code_verifier: verifier,
+  });
+  return toCachedCredentials(tokenResponse);
+}
+
+/** Returns a valid access token, reusing/refreshing the cache before falling back to a fresh login. */
+async function getAccessToken() {
+  const cached = readCachedCredentials();
+  if (cached && cached.expiresAt > Date.now()) {
+    return cached.accessToken;
+  }
+  if (cached && cached.refreshToken) {
+    try {
+      const refreshed = await refreshAccessToken(cached);
+      writeCachedCredentials(refreshed);
+      return refreshed.accessToken;
+    } catch {
+      // Refresh token expired/revoked - fall through to interactive login.
+    }
+  }
+  const creds = await interactiveLogin();
+  writeCachedCredentials(creds);
+  return creds.accessToken;
+}
+
+module.exports = { getAccessToken, CREDENTIALS_PATH };

package/src/backend-build.js

@@ -0,0 +1,74 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+const DEFAULT_ENTRY = 'backend/src/index.ts';
+
+/** Matches BackendModuleRuntimeService's MODULE_GLOBAL on the server - a `export function foo() {}`
+ * in the module's TS ends up reachable as the global `__module.foo` once bundled this way. */
+const GLOBAL_NAME = '__module';
+
+/**
+ * Bundles a module workspace's backend part (if configured) into a single, dependency-free
+ * `bundle.js`, using esbuild so module authors can write normal TypeScript (types, imports,
+ * `export function`) even though nothing beyond that single file is ever loaded at runtime - the
+ * server evaluates it in a sandboxed GraalVM context with no module resolution of its own (see
+ * `BackendModuleRuntimeService`).
+ *
+ * Returns `null` when the workspace has no backend part configured, so `build.js` can skip it
+ * entirely for a frontend-only module.
+ */
+async function buildBackend(cwd, config) {
+  const backendConfig = config.backend;
+  if (!backendConfig) {
+    return null;
+  }
+  const entry = backendConfig.entry || DEFAULT_ENTRY;
+  const entryPath = path.join(cwd, entry);
+  if (!fs.existsSync(entryPath)) {
+    if (backendConfig.entry) {
+      // Explicitly configured but missing - fail loudly rather than silently skipping.
+      throw new Error(`Backend entry ${entryPath} does not exist (check "backend.entry" in tabbr.config.json).`);
+    }
+    return null;
+  }
+
+  let esbuild;
+  try {
+    // Resolved from the workspace being built, not from wherever this CLI happens to be installed -
+    // esbuild is the module author's devDependency, and the CLI may be hoisted, copied or linked.
+    esbuild = require(require.resolve('esbuild', { paths: [cwd] }));
+  } catch (err) {
+    throw new Error(
+      'esbuild is required to build this module\'s backend part. Run "npm install --save-dev esbuild" in your module workspace.'
+    );
+  }
+
+  console.log(`Building backend module ${entryPath} ...`);
+  const result = await esbuild.build({
+    entryPoints: [entryPath],
+    bundle: true,
+    write: false,
+    format: 'iife',
+    globalName: GLOBAL_NAME,
+    target: 'es2022',
+    platform: 'neutral',
+    logLevel: 'silent',
+  });
+  if (!result.outputFiles || result.outputFiles.length === 0) {
+    throw new Error(`esbuild produced no output for ${entryPath}`);
+  }
+  const bundleJs = result.outputFiles[0].text;
+
+  const manifest = {
+    // localAllowedHosts (e.g. a mock on localhost) only ever go into a --local publish, never into one for a real environment.
+    allowedHosts: [...(backendConfig.allowedHosts || []), ...(config.local ? backendConfig.localAllowedHosts || [] : [])],
+    secretFieldNames: backendConfig.secretFieldNames || [],
+    triggers: backendConfig.triggers || [],
+  };
+
+  return { bundleJs, manifestJson: JSON.stringify(manifest, null, 2) };
+}
+
+module.exports = { buildBackend, DEFAULT_ENTRY };

package/src/build.js

@@ -1,91 +1,121 @@
-'use strict';
-
-const { execFileSync } = require('child_process');
-const fs = require('fs');
-const path = require('path');
-const archiver = require('archiver');
-
-/** Reads angular.json and resolves the browser output directory for the workspace's one project. */
-function resolveOutputDir(cwd) {
-  const angularJsonPath = path.join(cwd, 'angular.json');
-  if (!fs.existsSync(angularJsonPath)) {
-    throw new Error(`No angular.json found in ${cwd} - run this from an Angular workspace root (or pass --cwd).`);
-  }
-  const angularJson = JSON.parse(fs.readFileSync(angularJsonPath, 'utf-8'));
-  const projectName = Object.keys(angularJson.projects)[0];
-  const project = angularJson.projects[projectName];
-  // native-federation's build target wraps the real Angular application builder under
-  // "build-original" (see tabbr-ui/angular.json and tabbr-custom-module-poc/angular.json) -
-  // that's where the actual outputPath lives.
-  const buildTarget = project.architect['build-original'] || project.architect['build'];
-  const outputPath = buildTarget.options.outputPath;
-  const base = typeof outputPath === 'string' ? outputPath : outputPath.base;
-  // Angular's application builder always nests the actual browser bundle under a "browser/"
-  // subfolder of outputPath - confirmed empirically against this exact builder this session.
-  return path.join(cwd, base, 'browser');
-}
-
-/**
- * Runs `ng build` in `cwd` by invoking the workspace's own locally-installed Angular CLI entry
- * point directly with the current Node binary.
- *
- * Deliberately NOT `execFileSync('npx', ['ng', 'build'], { shell: true })`, which was the previous
- * implementation and had three problems at once:
- *   - Node's DEP0190 deprecation warning (passing an args array together with `shell: true`).
- *   - Passing args through a shell at all means they're re-parsed by the shell, so anything less
- *     trusted than a hardcoded literal would need manual escaping.
- *   - On Windows `npx` is `npx.cmd`, and since the CVE-2024-27980 fix Node refuses to spawn
- *     `.cmd`/`.bat` WITHOUT `shell: true` - so dropping the shell alone wasn't an option there.
- * Going straight to `node node_modules/@angular/cli/bin/ng.js` sidesteps all three: no shell, no
- * args re-parsing, no platform-specific launcher script, and it's faster (skips npx resolution).
- *
- * Explicitly `--configuration production`, not a bare `ng build`: a module workspace's
- * angular.json typically sets `defaultConfiguration: "development"` on the native-federation
- * build target (so a plain `ng build`/`ng serve` during local development doesn't need the flag
- * spelled out every time) - which a bare `ng build` here would silently inherit, publishing an
- * unoptimized dev build (unminified, `dev: true`, native-federation's build-notifications
- * live-reload hook baked in) to the club instead of the production one. The live-reload hook in
- * particular then 404s at runtime (it points at a dev server that doesn't exist once statically
- * published) and the unshared-per-pass token identities a dev build produces differently from
- * prod have caused real `NG0201: No provider found for ...` failures in published modules.
- */
-function runNgBuild(cwd) {
-  const ngJs = path.join(cwd, 'node_modules', '@angular', 'cli', 'bin', 'ng.js');
-  if (!fs.existsSync(ngJs)) {
-    throw new Error(
-      `No local Angular CLI found at ${ngJs} - run "npm install" in ${cwd} first.`
-    );
-  }
-  console.log(`Building in ${cwd} ...`);
-  execFileSync(process.execPath, [ngJs, 'build', '--configuration', 'production'], { cwd, stdio: 'inherit' });
-}
-
-/** Zips outputDir's contents flat (remoteEntry.json at the zip root) into a Buffer. */
-function zipDirectory(outputDir) {
-  return new Promise((resolve, reject) => {
-    const archive = archiver('zip', { zlib: { level: 9 } });
-    const chunks = [];
-    archive.on('data', chunk => chunks.push(chunk));
-    archive.on('end', () => resolve(Buffer.concat(chunks)));
-    archive.on('error', reject);
-    archive.directory(outputDir, false);
-    archive.finalize();
-  });
-}
-
-/** Builds the workspace at `cwd`, verifies remoteEntry.json exists, and returns a zip Buffer. */
-async function buildAndZip(cwd) {
-  runNgBuild(cwd);
-  const outputDir = resolveOutputDir(cwd);
-  const remoteEntryPath = path.join(outputDir, 'remoteEntry.json');
-  if (!fs.existsSync(remoteEntryPath)) {
-    throw new Error(
-      `Build output at ${outputDir} has no remoteEntry.json. ` +
-      `Is this workspace's federation.config.js missing an "exposes" entry?`
-    );
-  }
-  console.log(`Zipping ${outputDir} ...`);
-  return zipDirectory(outputDir);
-}
-
-module.exports = { buildAndZip, resolveOutputDir };
+'use strict';
+
+const { execFileSync } = require('child_process');
+const fs = require('fs');
+const path = require('path');
+const archiver = require('archiver');
+const { buildBackend } = require('./backend-build');
+
+/** Reads angular.json and resolves the browser output directory for the workspace's one project. */
+function resolveOutputDir(cwd) {
+  const angularJsonPath = path.join(cwd, 'angular.json');
+  if (!fs.existsSync(angularJsonPath)) {
+    throw new Error(`No angular.json found in ${cwd} - run this from an Angular workspace root (or pass --cwd).`);
+  }
+  const angularJson = JSON.parse(fs.readFileSync(angularJsonPath, 'utf-8'));
+  const projectName = Object.keys(angularJson.projects)[0];
+  const project = angularJson.projects[projectName];
+  // native-federation's build target wraps the real Angular application builder under
+  // "build-original" (see tabbr-ui/angular.json and tabbr-custom-module-poc/angular.json) -
+  // that's where the actual outputPath lives.
+  const buildTarget = project.architect['build-original'] || project.architect['build'];
+  const outputPath = buildTarget.options.outputPath;
+  const base = typeof outputPath === 'string' ? outputPath : outputPath.base;
+  // Angular's application builder always nests the actual browser bundle under a "browser/"
+  // subfolder of outputPath - confirmed empirically against this exact builder this session.
+  return path.join(cwd, base, 'browser');
+}
+
+/**
+ * Runs `ng build` in `cwd` by invoking the workspace's own locally-installed Angular CLI entry
+ * point directly with the current Node binary.
+ *
+ * Deliberately NOT `execFileSync('npx', ['ng', 'build'], { shell: true })`, which was the previous
+ * implementation and had three problems at once:
+ *   - Node's DEP0190 deprecation warning (passing an args array together with `shell: true`).
+ *   - Passing args through a shell at all means they're re-parsed by the shell, so anything less
+ *     trusted than a hardcoded literal would need manual escaping.
+ *   - On Windows `npx` is `npx.cmd`, and since the CVE-2024-27980 fix Node refuses to spawn
+ *     `.cmd`/`.bat` WITHOUT `shell: true` - so dropping the shell alone wasn't an option there.
+ * Going straight to `node node_modules/@angular/cli/bin/ng.js` sidesteps all three: no shell, no
+ * args re-parsing, no platform-specific launcher script, and it's faster (skips npx resolution).
+ *
+ * Explicitly `--configuration production`, not a bare `ng build`: a module workspace's
+ * angular.json typically sets `defaultConfiguration: "development"` on the native-federation
+ * build target (so a plain `ng build`/`ng serve` during local development doesn't need the flag
+ * spelled out every time) - which a bare `ng build` here would silently inherit, publishing an
+ * unoptimized dev build (unminified, `dev: true`, native-federation's build-notifications
+ * live-reload hook baked in) to the club instead of the production one. The live-reload hook in
+ * particular then 404s at runtime (it points at a dev server that doesn't exist once statically
+ * published) and the unshared-per-pass token identities a dev build produces differently from
+ * prod have caused real `NG0201: No provider found for ...` failures in published modules.
+ */
+function runNgBuild(cwd) {
+  const ngJs = path.join(cwd, 'node_modules', '@angular', 'cli', 'bin', 'ng.js');
+  if (!fs.existsSync(ngJs)) {
+    throw new Error(
+      `No local Angular CLI found at ${ngJs} - run "npm install" in ${cwd} first.`
+    );
+  }
+  console.log(`Building in ${cwd} ...`);
+  execFileSync(process.execPath, [ngJs, 'build', '--configuration', 'production'], { cwd, stdio: 'inherit' });
+}
+
+/**
+ * Zips frontendDir's contents flat at the zip root (remoteEntry.json at the root, as before) plus,
+ * when present, the backend bundle/manifest under a `backend/` prefix - one zip, one upload, no
+ * separate publish step per side (see `CustomModuleService#publish` on the server, which splits
+ * them back apart by that same prefix).
+ */
+function zipModule(frontendDir, backend) {
+  return new Promise((resolve, reject) => {
+    const archive = archiver('zip', { zlib: { level: 9 } });
+    const chunks = [];
+    archive.on('data', chunk => chunks.push(chunk));
+    archive.on('end', () => resolve(Buffer.concat(chunks)));
+    archive.on('error', reject);
+    if (frontendDir) {
+      archive.directory(frontendDir, false);
+    }
+    if (backend) {
+      archive.append(backend.bundleJs, { name: 'backend/bundle.js' });
+      archive.append(backend.manifestJson, { name: 'backend/manifest.json' });
+    }
+    archive.finalize();
+  });
+}
+
+/**
+ * Builds whichever parts of the workspace at `cwd` are present - a frontend (an Angular project,
+ * i.e. angular.json exists) and/or a backend (`config.backend` set, see `backend-build.js`) - and
+ * returns a single zip Buffer with both. At least one part must be present.
+ */
+async function buildAndZip(cwd, config) {
+  const hasFrontend = fs.existsSync(path.join(cwd, 'angular.json'));
+  let frontendDir = null;
+  if (hasFrontend) {
+    runNgBuild(cwd);
+    frontendDir = resolveOutputDir(cwd);
+    const remoteEntryPath = path.join(frontendDir, 'remoteEntry.json');
+    if (!fs.existsSync(remoteEntryPath)) {
+      throw new Error(
+        `Build output at ${frontendDir} has no remoteEntry.json. ` +
+        `Is this workspace's federation.config.js missing an "exposes" entry?`
+      );
+    }
+  }
+
+  const backend = await buildBackend(cwd, config || {});
+
+  if (!hasFrontend && !backend) {
+    throw new Error(
+      `Nothing to build in ${cwd}: no angular.json (frontend) and no backend part configured ` +
+      `("backend" in tabbr.config.json, entry file missing).`
+    );
+  }
+
+  console.log('Zipping module ...');
+  return zipModule(frontendDir, backend);
+}
+
+module.exports = { buildAndZip, resolveOutputDir };