@ultimat3/cli 22.3.3 → 22.3.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ultimat3/cli",
-  "version": "22.3.3",
+  "version": "22.3.5",
   "description": "The `x` binary: new, dev, build, verify, generate, db, mcp, doctor, deploy",
   "license": "MIT",
   "type": "module",
@@ -38,33 +38,33 @@
   },
   "dependencies": {
     "@babel/core": "^8.0.1",
-    "@ultimat3/action": "22.3.3",
-    "@ultimat3/admin": "22.3.3",
-    "@ultimat3/ai": "22.3.3",
-    "@ultimat3/auth": "22.3.3",
-    "@ultimat3/cache": "22.3.3",
-    "@ultimat3/core": "22.3.3",
-    "@ultimat3/db": "22.3.3",
-    "@ultimat3/entity": "22.3.3",
-    "@ultimat3/flags": "22.3.3",
-    "@ultimat3/http": "22.3.3",
-    "@ultimat3/i18n": "22.3.3",
-    "@ultimat3/jobs": "22.3.3",
-    "@ultimat3/mail": "22.3.3",
-    "@ultimat3/manifest": "22.3.3",
-    "@ultimat3/mcp": "22.3.3",
-    "@ultimat3/money": "22.3.3",
-    "@ultimat3/notify": "22.3.3",
-    "@ultimat3/policy": "22.3.3",
-    "@ultimat3/pwa": "22.3.3",
-    "@ultimat3/query": "22.3.3",
-    "@ultimat3/realtime": "22.3.3",
-    "@ultimat3/render": "22.3.3",
-    "@ultimat3/schema": "22.3.3",
-    "@ultimat3/seo": "22.3.3",
-    "@ultimat3/storage": "22.3.3",
-    "@ultimat3/testing": "22.3.3",
-    "@ultimat3/time": "22.3.3",
+    "@ultimat3/action": "22.3.5",
+    "@ultimat3/admin": "22.3.5",
+    "@ultimat3/ai": "22.3.5",
+    "@ultimat3/auth": "22.3.5",
+    "@ultimat3/cache": "22.3.5",
+    "@ultimat3/core": "22.3.5",
+    "@ultimat3/db": "22.3.5",
+    "@ultimat3/entity": "22.3.5",
+    "@ultimat3/flags": "22.3.5",
+    "@ultimat3/http": "22.3.5",
+    "@ultimat3/i18n": "22.3.5",
+    "@ultimat3/jobs": "22.3.5",
+    "@ultimat3/mail": "22.3.5",
+    "@ultimat3/manifest": "22.3.5",
+    "@ultimat3/mcp": "22.3.5",
+    "@ultimat3/money": "22.3.5",
+    "@ultimat3/notify": "22.3.5",
+    "@ultimat3/policy": "22.3.5",
+    "@ultimat3/pwa": "22.3.5",
+    "@ultimat3/query": "22.3.5",
+    "@ultimat3/realtime": "22.3.5",
+    "@ultimat3/render": "22.3.5",
+    "@ultimat3/schema": "22.3.5",
+    "@ultimat3/seo": "22.3.5",
+    "@ultimat3/storage": "22.3.5",
+    "@ultimat3/testing": "22.3.5",
+    "@ultimat3/time": "22.3.5",
     "babel-preset-solid": "^1.9.15"
   }
 }

package/src/app-load.ts

@@ -115,6 +115,28 @@ export function resetAppLoad(): void {
   routeSources.clear();
 }
 
+/**
+ * Every module path the app globs match, SORTED. `Bun.Glob` answers in directory order, which is
+ * the filesystem's — ext4 hashes names with a per-filesystem seed — so two pods of one image
+ * imported the app in two orders, registered its stylesheets in two orders, and served two
+ * different `/styles/<hash>.css` for one page (notificado.co, 22.3.2). Import order is the
+ * stylesheet cascade's order, so it must be the same everywhere.
+ */
+export async function appModulePaths(root: string): Promise<readonly string[]> {
+  // Pattern by pattern, as before — only the order WITHIN a pattern was the filesystem's.
+  const found: string[] = [];
+  const seen = new Set<string>();
+  for (const pattern of APP_GLOBS) {
+    const matched: string[] = [];
+    for await (const absolute of new Bun.Glob(pattern).scan({ cwd: root, absolute: true })) {
+      if (!seen.has(absolute)) matched.push(absolute);
+      seen.add(absolute);
+    }
+    found.push(...matched.sort((a, b) => (a < b ? -1 : a > b ? 1 : 0)));
+  }
+  return found;
+}
+
 export async function loadApp(root: string): Promise<LoadedApp> {
   // Before any import: a stylesheet's surface is read below the app root, never off its absolute
   // path — under the container's `WORKDIR /app` that path's first segment is `app/`, and every
@@ -127,36 +149,34 @@ export async function loadApp(root: string): Promise<LoadedApp> {
   const files: string[] = [];
   const findings: Finding[] = [];
 
-  for (const pattern of APP_GLOBS) {
-    for await (const absolute of new Bun.Glob(pattern).scan({ cwd: root, absolute: true })) {
-      // A SEGMENT, never a substring: an app checked out under
-      // `~/dev/node_modules-experiments/myapp` answered `includes('node_modules')` for every
-      // file it holds, so this loop imported none of them and the app registered nothing.
-      // The ROOT-RELATIVE path is tested, never the absolute one: an app checked out under
-      // `~/work/my.test.app` matched `.test.` on every file and loaded none of them.
-      const file = relative(root, absolute).split(sep).join('/');
-      if (hasPathSegment(absolute, 'node_modules') || isTest(file)) continue;
-      if (ENTRY_POINT.test(file) || CLIENT_ENTRY_POINT.test(file) || STATES_FILE.test(file)) {
-        continue;
-      }
-      // The source is read BEFORE the import, and only on the file's first pass — a rescan of a
-      // registered module reads nothing here. A route entry is bound to the bytes the module was
-      // evaluated from, and a read AFTER the import cannot know which bytes those were: a save
-      // landing between the two bound V1's component to V2's hash, so the next scan saw nothing to
-      // do and served V1 until the save after. Read first, the worst case is one re-import the
-      // next tick, of a file that did change.
-      const snapshot = registered.has(absolute) ? undefined : await Bun.file(absolute).text();
-      let module: Record<string, unknown>;
-      try {
-        module = (await import(absolute)) as Record<string, unknown>;
-      } catch (error) {
-        findings.push({ ...findingFrom(error), at: file });
-        continue;
-      }
-      files.push(file);
-      const finding = await register(absolute, file, module, snapshot);
-      if (finding !== undefined) findings.push(finding);
+  for (const absolute of await appModulePaths(root)) {
+    // A SEGMENT, never a substring: an app checked out under
+    // `~/dev/node_modules-experiments/myapp` answered `includes('node_modules')` for every
+    // file it holds, so this loop imported none of them and the app registered nothing.
+    // The ROOT-RELATIVE path is tested, never the absolute one: an app checked out under
+    // `~/work/my.test.app` matched `.test.` on every file and loaded none of them.
+    const file = relative(root, absolute).split(sep).join('/');
+    if (hasPathSegment(absolute, 'node_modules') || isTest(file)) continue;
+    if (ENTRY_POINT.test(file) || CLIENT_ENTRY_POINT.test(file) || STATES_FILE.test(file)) {
+      continue;
+    }
+    // The source is read BEFORE the import, and only on the file's first pass — a rescan of a
+    // registered module reads nothing here. A route entry is bound to the bytes the module was
+    // evaluated from, and a read AFTER the import cannot know which bytes those were: a save
+    // landing between the two bound V1's component to V2's hash, so the next scan saw nothing to
+    // do and served V1 until the save after. Read first, the worst case is one re-import the
+    // next tick, of a file that did change.
+    const snapshot = registered.has(absolute) ? undefined : await Bun.file(absolute).text();
+    let module: Record<string, unknown>;
+    try {
+      module = (await import(absolute)) as Record<string, unknown>;
+    } catch (error) {
+      findings.push({ ...findingFrom(error), at: file });
+      continue;
     }
+    files.push(file);
+    const finding = await register(absolute, file, module, snapshot);
+    if (finding !== undefined) findings.push(finding);
   }
 
   files.sort();

package/src/island-routes.ts

@@ -3,7 +3,7 @@
 // would be a page that boots in `x dev` and 404s in the image.
 
 import type { Route, UltimateRequest } from '@ultimat3/http';
-import { applyCacheHeaders, json } from '@ultimat3/http';
+import { applyCacheHeaders, json, NO_STORE } from '@ultimat3/http';
 import type { IslandBundle } from './island-bundle';
 import { ISLAND_BASE_PATH } from './island-bundle';
 
@@ -28,7 +28,7 @@ export function islandRoutes(source: IslandSource): readonly Route[] {
       handler: (request: UltimateRequest): Response => {
         const chunk = source().chunkAt(request.pathname);
         if (chunk === undefined) {
-          return json(
+          const missing = json(
             {
               ok: false,
               error: {
@@ -45,6 +45,8 @@ export function islandRoutes(source: IslandSource): readonly Route[] {
             },
             { status: 404 },
           );
+          // `no-store`: a miss on a content-hashed URL must not be pinned by a CDN or a proxy.
+          return applyCacheHeaders(missing, NO_STORE);
         }
         return applyCacheHeaders(
           new Response(chunk.code, { headers: { 'content-type': 'text/javascript' } }),

package/src/island-store.ts

@@ -7,11 +7,12 @@
 // that names a different set of islands than the app has, or a chunk whose bytes do not hash to
 // what the index recorded is refused, and the boot builds instead — with the reason logged.
 
-import { join } from 'node:path'; // why: Bun ships no path-join primitive.
+import { join, relative, sep } from 'node:path'; // why: Bun ships no path-join primitive.
 import { frameworkVersion, logger } from '@ultimat3/core';
-import { contentHash } from '@ultimat3/render/server';
+import { contentHash, loadStylesheet } from '@ultimat3/render/server';
 import type { IslandBundle, IslandChunk } from './island-bundle';
 import { buildIslands, discoverIslands, islandBundle } from './island-bundle';
+import { islandStylesheets } from './island-styles';
 
 /** App-root-relative: `COPY . .` carries it into the image with the rest of `.x/`. */
 export const ISLAND_STORE_DIR = '.x/islands';
@@ -28,6 +29,13 @@ interface StoreIndex {
   readonly framework: string;
   readonly bun: string;
   readonly chunks: readonly StoredChunk[];
+  /**
+   * The stylesheets the island build registered, app-relative and sorted. Registered again at boot
+   * from the app's own sources, so a container serving these chunks joins the SAME surface
+   * stylesheet a build would — without them an island-only sheet was missing from every pod that
+   * read the store, and present on any that rebuilt.
+   */
+  readonly stylesheets: readonly string[];
 }
 
 const chunkFile = (url: string): string => url.slice(url.lastIndexOf('/') + 1);
@@ -50,7 +58,16 @@ export async function writeIslandStore(
       identity: contentHash(chunk.code),
     });
   }
-  const index: StoreIndex = { framework: frameworkVersion(), bun: Bun.version, chunks };
+  const stylesheets = islandStylesheets()
+    .map((path) => relative(root, path).split(sep).join('/'))
+    .filter((path) => !path.startsWith('..'))
+    .sort();
+  const index: StoreIndex = {
+    framework: frameworkVersion(),
+    bun: Bun.version,
+    chunks,
+    stylesheets,
+  };
   await Bun.write(join(dir, INDEX), `${JSON.stringify(index, null, 2)}\n`);
   return [...written, `${ISLAND_STORE_DIR}/${INDEX}`];
 }
@@ -74,7 +91,10 @@ function parseIndex(value: unknown): StoreIndex | undefined {
       return undefined;
     parsed.push({ file, moduleId, url, identity });
   }
-  return { framework: record['framework'], bun: record['bun'], chunks: parsed };
+  const sheets = record['stylesheets'];
+  // Absent in a 22.3.2 store: read as none, and the boot builds when it matters (see below).
+  const stylesheets = Array.isArray(sheets) ? sheets.filter(isString) : [];
+  return { framework: record['framework'], bun: record['bun'], chunks: parsed, stylesheets };
 }
 
 /** A verified store, or the one sentence saying why it cannot be served. */
@@ -113,6 +133,13 @@ export async function readIslandStore(root: string): Promise<StoreRead> {
       bytes: new TextEncoder().encode(code).byteLength,
     });
   }
+  // In sorted order, as `island` sheets: `stylesFor` orders those by path, so this is the same
+  // surface stylesheet the build that wrote the store joined.
+  for (const sheet of index.stylesheets) {
+    const source = Bun.file(join(root, sheet));
+    if (!(await source.exists())) return { stale: `${sheet}, an island stylesheet, is missing` };
+    loadStylesheet(join(root, sheet), await source.text(), 'island');
+  }
   return { bundle: islandBundle(chunks) };
 }
 

package/src/island-styles.ts

@@ -16,6 +16,16 @@ import { IslandBuildFailedError } from './errors';
  */
 const STYLESHEET = /\.s?css$/;
 
+/**
+ * Every stylesheet an island build has loaded in this process, absolute. `x build --target docker`
+ * writes them into the island store, so a container that serves the stored chunks registers the
+ * same sheets a build would have — and every pod of one image joins the same surface stylesheet.
+ */
+const islandSheets = new Set<string>();
+
+/** Sorted, so the store index is byte-identical for identical input. */
+export const islandStylesheets = (): readonly string[] => [...islandSheets].sort();
+
 /**
  * `loadStylesheet`, not `compileStylesheet`: compiling alone answers the class names and drops the
  * RULES on the floor, and an island is the one importer a document's own module graph never sees.
@@ -28,7 +38,8 @@ export const islandStylesPlugin: BunPlugin = {
     build.onLoad({ filter: STYLESHEET }, async ({ path }) => {
       const source = await Bun.file(path).text();
       try {
-        return { contents: loadStylesheet(path, source), loader: 'js' };
+        islandSheets.add(path);
+        return { contents: loadStylesheet(path, source, 'island'), loader: 'js' };
       } catch (error) {
         // A coded failure already names the file and carries a fix — re-wrapping it would bury
         // both. Anything else is rendered through `renderThrowable`, because this is the plugin's

package/src/style-bundle.ts

@@ -72,15 +72,37 @@ let memo: { readonly revision: number; readonly bundle: StyleBundle } | undefine
 export function styleBundle(): StyleBundle {
   const revision = stylesheetsRevision();
   if (memo !== undefined && memo.revision === revision) return memo.bundle;
-  const bundle = styleBundleOf(
+  const current = styleBundleOf(
     STYLED_SURFACES.map((surface) => ({ surface, css: stylesFor(surface) })).filter(
       (sheet) => sheet.css.length > 0,
     ),
   );
+  for (const chunk of current.chunks) {
+    minted.delete(chunk.url);
+    minted.set(chunk.url, chunk);
+  }
+  while (minted.size > MINTED_KEPT) {
+    const oldest = minted.keys().next().value;
+    if (oldest === undefined) break;
+    minted.delete(oldest);
+  }
+  const bundle: StyleBundle = {
+    ...current,
+    chunkAt: (url: string): StyleChunk | undefined => current.chunkAt(url) ?? minted.get(url),
+  };
   memo = { revision, bundle };
   return bundle;
 }
 
+/**
+ * Every stylesheet this process has minted, newest last, so a URL it once linked keeps answering
+ * after the registry moves — a module imported late, an island rebuilt under `x dev`. The worker
+ * precached the boot-time URL and a document rendered a minute ago names it; a 404 there is a page
+ * with no CSS. Bounded, because `x dev` mints one per edit.
+ */
+const minted = new Map<string, StyleChunk>();
+const MINTED_KEPT = 32;
+
 /**
  * Test seam, and the shape `islandBundle` has: a table built from what the caller supplies.
  *

package/src/style-routes.ts

@@ -4,7 +4,7 @@
 // image.
 
 import type { Route, UltimateRequest } from '@ultimat3/http';
-import { applyCacheHeaders, json } from '@ultimat3/http';
+import { applyCacheHeaders, json, NO_STORE } from '@ultimat3/http';
 import type { StyleBundle } from './style-bundle';
 import { STYLE_BASE_PATH } from './style-bundle';
 
@@ -32,7 +32,7 @@ export function styleRoutes(source: StyleSource): readonly Route[] {
       handler: (request: UltimateRequest): Response => {
         const chunk = source().chunkAt(request.pathname);
         if (chunk === undefined) {
-          return json(
+          const missing = json(
             {
               ok: false,
               error: {
@@ -45,6 +45,8 @@ export function styleRoutes(source: StyleSource): readonly Route[] {
             },
             { status: 404 },
           );
+          // `no-store`: a miss on a content-hashed URL must not be pinned by a CDN or a proxy.
+          return applyCacheHeaders(missing, NO_STORE);
         }
         return applyCacheHeaders(
           new Response(chunk.css, { headers: { 'content-type': 'text/css; charset=utf-8' } }),