@uniflowed/vite 0.0.0-alpha.7 → 0.0.0-alpha.8

package/internal/rsc.js

@@ -0,0 +1,151 @@
+// @noflow
+//
+// Plain JavaScript: executed by the host that runs Vite, before any transform.
+//
+// The server/client split, as the bundler applies it.
+//
+// `crates/uf_rsc` decides which modules a `"use client"` boundary is reachable
+// from. That answer used to reach nothing: `virtual:uf/routes` emitted
+// `page: () => import(<file>)` for every route, `virtual:uf/client` imported
+// that table, and so every page in the application was a chunk of the *client*
+// bundle whether or not a browser had anything to do with it.
+//
+// This module is the first thing that reads the answer. What is done with it
+// is in `routesModuleSource`, including the one thing a dropped route keeps.
+//
+// # Why the unit is a route and not a module
+//
+// Dropping a single Server Component from the client bundle is what Next.js
+// does, and it works there because the browser is handed a Flight payload
+// describing the tree the server rendered. uf has no such payload yet:
+// `packages/router/client.js` hydrates by re-rendering the matched tree from
+// the same modules the server rendered it from, so a module missing from the
+// client bundle is a module React cannot hydrate. What *can* be dropped is a
+// route the browser never renders at all — one where no client boundary is
+// reachable from the page, its layouts, its loading fallbacks or the
+// boundaries that cover it. Nothing under it is ever re-rendered in the
+// browser, so nothing under it has to be shipped. See ubugeeei-prod/uf#350.
+//
+// # Why "unknown" means "ship it"
+//
+// The analysis scans `.js`. A page written as `.mdx`, a `.jsx` module, a file
+// past the scanner's size limit: none of them is in the manifest, and the
+// honest reading of a module the analysis never saw is that it might reach a
+// boundary. Every unknown answers `true`, so the split can only ever remove a
+// route uf has positively decided needs no browser — and a manifest that is
+// missing, unreadable, or written by an older uf removes nothing at all.
+
+import { readFileSync } from "node:fs";
+import path from "node:path";
+
+/** Environment variable naming the manifest, set by `uf build` and `uf dev`. */
+export const RSC_MANIFEST_ENV = "UF_RSC_MANIFEST";
+
+/**
+ * The manifest schema this understands.
+ *
+ * Version 1 published the client boundaries and nothing that said which
+ * modules sat *above* one, so it cannot answer the question this module asks.
+ * An older manifest is therefore refused rather than read optimistically: a
+ * missing `proximity` would read as `undefined`, compare unequal to
+ * `"reaches-boundary"`, and quietly drop every route from the client bundle.
+ */
+const SUPPORTED_VERSION = 2;
+
+/**
+ * Read the RSC manifest, or `null` when there is nothing usable to read.
+ *
+ * Never throws. The split is an optimisation over a build that is already
+ * correct without it, so no failure here may be a failure of the build.
+ *
+ * @param {string | undefined} file absolute path, from the environment
+ */
+export function readRscManifest(file) {
+  if (file == null || file === "") return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync(file, "utf8"));
+  } catch {
+    return null;
+  }
+  if (parsed == null || typeof parsed !== "object") return null;
+  if (parsed.version !== SUPPORTED_VERSION || !Array.isArray(parsed.modules)) return null;
+  return parsed;
+}
+
+/**
+ * Which modules the browser has to be able to evaluate, keyed by project path.
+ *
+ * A `"use client"` module is a client bundle root by definition, and
+ * `proximity` never says so about it — it is the far side of the boundary
+ * rather than a module above one — so both halves are asked. This mirrors
+ * `RscModule::requires_client_bundle` in `crates/uf_rsc/src/graph.rs`.
+ */
+function clientModules(manifest) {
+  const modules = new Map();
+  for (const module of manifest.modules) {
+    if (module == null || typeof module.path !== "string") continue;
+    modules.set(
+      module.path,
+      module.environment === "client" || module.proximity === "reaches-boundary",
+    );
+  }
+  return modules;
+}
+
+/**
+ * Whether `boundary`'s route path covers `route`'s.
+ *
+ * Deliberately "covers" and not "is nearest to". `packages/router` picks the
+ * nearest not-found and error boundary above a path at render time; asking the
+ * same question here would be a second implementation of that rule, and the
+ * two would disagree the first time either moved. Every boundary that could
+ * apply is counted instead, which can only decide that more routes need the
+ * browser than strictly do.
+ */
+function covers(boundaryPath, routePath) {
+  return (
+    boundaryPath === "/" || routePath === boundaryPath || routePath.startsWith(`${boundaryPath}/`)
+  );
+}
+
+/**
+ * Build the predicate `routesModuleSource` asks about each route.
+ *
+ * Returns `(route) => boolean`: true when the route's page module belongs in
+ * the client bundle. With no manifest every route answers true, which is the
+ * whole table and exactly what the build emitted before this existed.
+ *
+ * @param {object | null} manifest from {@link readRscManifest}
+ * @param {string} root absolute project root
+ * @param {{notFound?: Array<object>, errors?: Array<object>}} [boundaries]
+ *   the scanned table, so a boundary that needs the browser keeps the routes
+ *   it covers in the client bundle
+ */
+export function clientRouteFilter(manifest, root, boundaries = {}) {
+  if (manifest == null) return () => true;
+  const modules = clientModules(manifest);
+
+  const needed = (file) => {
+    if (typeof file !== "string") return true;
+    const relative = path.relative(root, file).split(path.sep).join("/");
+    const answer = modules.get(relative);
+    return answer === undefined ? true : answer;
+  };
+
+  const notFound = boundaries.notFound ?? [];
+  const errors = boundaries.errors ?? [];
+
+  return (route) => {
+    if (needed(route.page)) return true;
+    if (route.layouts.some(needed)) return true;
+    if ((route.loading ?? []).some((entry) => needed(entry.module))) return true;
+    for (const boundary of notFound) {
+      if (covers(boundary.path, route.path) && needed(boundary.page)) return true;
+    }
+    for (const boundary of errors) {
+      if (covers(boundary.path, route.path) && needed(boundary.module)) return true;
+    }
+    return false;
+  };
+}

package/internal/serve.js

@@ -4,13 +4,11 @@
 //
 // Serving what `uf build` wrote — one request handler, behind two front doors.
 //
-// `uf build` writes three things and, until this module existed, nothing could
-// answer a request with any of them: a client bundle and prerendered HTML in
+// `uf build` writes three things: a client bundle and prerendered HTML in
 // `dist/`, and a server bundle in `.uf/build/server/server.js` that exports
-// `render`, `dispatch`, `routes` and `notFound`. The prerendered half could be
-// put on a static host; the other half could only be reached from `uf dev`, so
-// a route handler and a route with parameters and no `generateStaticParams`
-// worked in development and did not exist in a build.
+// `render`, `dispatch`, `runMiddleware`, `routes`, `middleware`, `notFound`
+// and `errors`. This module finds them, reads the client manifest, and hands
+// both to the handler `uf preview` and `uf start` mount.
 //
 // `uf preview` and `uf start` are the two front doors, and they share
 // everything below on purpose. A preview whose answers differ from the
@@ -26,58 +24,71 @@
 //             running a production build should not need Vite installed to
 //             answer a request.
 //
-// # Why this is JavaScript
+// # Where the answering actually happens
 //
-// The rest of uf's hot paths are Rust, and this one deliberately is not: it
-// runs in the deployed application rather than in the build, and
-// `ubugeeei-redundancy.md` is explicit that a deployment must not inherit a
-// native dependency from the toolchain that produced it. An edge or serverless
-// target that cannot run a Rust binary still has to be able to run this.
+// Not here, any more. Every decision about *what* a request is answered with
+// lives in `@uniflowed/server` — `@uniflowed/server/fetch` for the application
+// half and `@uniflowed/server/node` for the files and the socket — and this
+// module is the part that is genuinely Vite's: finding the build on disk and
+// reading the manifest a Vite build wrote.
 //
-// # The seam the adapters need
+// It moved because of `uf build --adapter`. `tests/library/serve.test.js` said
+// what was wrong with the old arrangement while it was still the only one:
+// "`internal/serve.js` is the seam a deploy adapter will need, and naming it
+// in `exports` before one exists would be promising an interface nothing has
+// used yet." An adapter exists now, and it may not import this package —
+// `@uniflowed/vite` is the bundler, and the whole claim of deployable output
+// is that the host needs neither the bundler nor the toolchain. So the seam is
+// a package export of `@uniflowed/server`, and `uf preview`, `uf start` and
+// every adapter now answer out of one implementation instead of copies that
+// agree until they do not.
 //
-// [`createApplicationHandler`] takes a `Request` and returns a `Response` and
-// touches no filesystem, so it is the part that ports to a worker unchanged.
-// [`createStaticHandler`] reads files and is therefore host-specific, which is
-// exactly the split a deploy adapter has to make: on a CDN-backed target the
-// static half is not the application's job at all.
+// # Why those imports are dynamic
+//
+// `@uniflowed/server` is Flow, and `driver.js` registers the loader hooks that
+// make Flow importable *in its body* — after every static import in this graph
+// has already been evaluated. So they are reached the same way the server
+// bundle is: with `await import`, from [`loadBuild`], which is the point at
+// which this process stops being plain JavaScript and starts being the
+// project's.
+//
+// # Who owns the request
+//
+// The host does, and none of the three handlers below: each of them has a
+// `Response` in hand rather than a response on the wire, and what `after()`
+// promises is the wire. [`withRequest`] is the shape for a caller that writes
+// into a Node response itself — `uf dev` and `uf preview` — and
+// `@uniflowed/server/node`'s `nodeListener` does the same thing for `uf start`
+// and for the `server.js` an adapter writes. Each of them begins the request
+// with `entry.beginRequest`, runs the whole of answering it inside `run`, and
+// settles it on the line after the last byte.
+//
+// It has to be the *entry's* `beginRequest` rather than one imported here: the
+// request lives in an `AsyncLocalStorage` belonging to one copy of
+// `@uniflowed/server`, and the copy that matters is the one inside the
+// application bundle. A host that resolved its own would begin a request the
+// application cannot see, and nothing would fail loudly — the guard would run,
+// the page would render, and every `cookies()` in it would throw as though no
+// host had run at all. See ubugeeei-prod/uf#389.
 
-import { createReadStream } from "node:fs";
 import { readFile, stat } from "node:fs/promises";
 import path from "node:path";
-import { Readable } from "node:stream";
 import { pathToFileURL } from "node:url";
 
 /**
- * Content types for what a uf build emits.
+ * `@uniflowed/server`'s two halves, loaded once.
  *
- * A closed table rather than a dependency, and deliberately short: every entry
- * is an extension `uf build` actually writes or a project actually puts in
- * `public/`. Anything else is `application/octet-stream`, which a browser
- * downloads rather than executes — the safe answer for a file whose type we do
- * not know, and the reason this is not a guess based on the bytes.
+ * Cached as the promise rather than the modules, so two concurrent callers
+ * share one import rather than racing to start two.
  */
-const CONTENT_TYPES = Object.freeze({
-  ".avif": "image/avif",
-  ".css": "text/css; charset=utf-8",
-  ".gif": "image/gif",
-  ".html": "text/html; charset=utf-8",
-  ".ico": "image/x-icon",
-  ".jpeg": "image/jpeg",
-  ".jpg": "image/jpeg",
-  ".js": "text/javascript; charset=utf-8",
-  ".json": "application/json; charset=utf-8",
-  ".map": "application/json; charset=utf-8",
-  ".mjs": "text/javascript; charset=utf-8",
-  ".png": "image/png",
-  ".svg": "image/svg+xml",
-  ".txt": "text/plain; charset=utf-8",
-  ".webmanifest": "application/manifest+json",
-  ".webp": "image/webp",
-  ".woff": "font/woff",
-  ".woff2": "font/woff2",
-  ".xml": "application/xml; charset=utf-8",
-});
+let deploymentModules = null;
+function deployment() {
+  deploymentModules ??= Promise.all([
+    import("@uniflowed/server/fetch"),
+    import("@uniflowed/server/node"),
+  ]).then(([application, host]) => ({ ...application, ...host }));
+  return deploymentModules;
+}
 
 /**
  * Everything a served build consists of.
@@ -86,6 +97,11 @@ const CONTENT_TYPES = Object.freeze({
  * while the server runs, and importing the server bundle again per request
  * would re-evaluate every module in the application.
  *
+ * `@uniflowed/server` is loaded here too, and not lazily on the first request:
+ * a missing or broken install should fail the command that starts the server,
+ * with the message the import raises, rather than a minute later inside
+ * whichever request happened to arrive first.
+ *
  * @param {{root: string, outDir: string, serverDir: string}} build
  */
 export async function loadBuild({ root, outDir, serverDir }) {
@@ -101,6 +117,7 @@ export async function loadBuild({ root, outDir, serverDir }) {
 
   const manifest = JSON.parse(await readFile(manifestFile, "utf8"));
   const entry = await import(pathToFileURL(entryFile).href);
+  await deployment();
   return { entry, assets: assetsFromManifest(manifest), distDir };
 }
 
@@ -130,6 +147,11 @@ async function readable(file, message) {
  *
  * The entry is found by its `isEntry` flag rather than by key, because a
  * virtual module's manifest key is an implementation detail of the bundler.
+ *
+ * This is the one piece of serving a build that is genuinely Vite's — a Vite
+ * manifest, read the way Vite writes it — which is why it stayed behind when
+ * the rest moved to `@uniflowed/server`. `uf build --adapter` calls it too,
+ * at build time, and bakes the answer into what it emits.
  */
 export function assetsFromManifest(manifest) {
   const entry = Object.values(manifest).find((chunk) => chunk.isEntry);
@@ -167,96 +189,76 @@ export function assetsFromManifest(manifest) {
   };
 }
 
+/**
+ * Answer one request inside it, and settle it when the answer has been written.
+ *
+ * `body` is everything that decides the response *and writes it*; this is the
+ * line after. `settle` is in a `finally` because a request that failed is
+ * still a request that happened: a middleware that logged the arrival is owed
+ * its callback whether the render threw or not, and `drainDeferred` already
+ * reports a failing task rather than propagating it.
+ *
+ * `entry.beginRequest` and not an import: the request lives in an
+ * `AsyncLocalStorage` belonging to one copy of `@uniflowed/server`, and the
+ * copy that matters is the one inside the application bundle. See
+ * `serverModuleSource` in `./routes.js`.
+ *
+ * The one case this cannot be exact about is a request uf hands back rather
+ * than answers: a caller whose `catch` is `next(error)` gives the response to
+ * Vite's chain, which writes a 500 at a moment nothing here can observe, so
+ * such a request settles when uf lets go of it. `nodeListener` and the
+ * compiled binary write their own failures and settle after them. It is worth
+ * naming rather than papering over, and it is the failure path of a request
+ * that already went wrong — not the ordinary one this exists for.
+ *
+ * @param {{beginRequest: (request: Request) => {run: <T>(body: () => Promise<T>) => Promise<T>, settle: () => Promise<void>}}} entry
+ * @param {Request} request
+ * @param {() => Promise<mixed>} body
+ */
+export async function withRequest(entry, request, body) {
+  const { run, settle } = entry.beginRequest(request);
+  try {
+    return await run(body);
+  } finally {
+    await settle();
+  }
+}
+
 /**
  * The application half: route handlers, then rendering.
  *
- * Touches no filesystem and holds no Node types, so this is the function a
- * deploy adapter for a worker or a serverless function wraps. Returns `null`
- * for nothing, ever — a request that matches no handler and no route is a
- * rendered 404, because the renderer is what knows what the project's
- * `_uf.not-found` page says.
+ * `@uniflowed/server/fetch`'s `createFetchHandler`, reached through the
+ * dynamic import above. Kept as a function here — rather than making every
+ * caller await the module — because the two servers construct their handler
+ * before they take a socket, and an `await` in that position would put the
+ * import between the port and the first request rather than before both.
  *
- * The order is the dev server's, and has to stay the dev server's: handlers
- * first and for every method, because a handler is the only thing that can
- * answer a `POST` and it may also answer a `GET` for a path that has no page.
- * A page cannot answer a `POST`, so a non-navigation that no handler claimed
- * is a 404 rather than a rendered page with a 200.
+ * It must be called inside a request its caller began; it begins none, because
+ * it has a `Response` in hand and not a response on the wire. A caller that
+ * forgets is not left to discover it: `entry.runMiddleware` refuses outside a
+ * request and names what establishes one. See "Who owns the request" above.
  *
  * @param {{entry: object, assets: object}} build
  */
 export function createApplicationHandler({ entry, assets }) {
+  const ready = deployment().then(({ createFetchHandler }) =>
+    createFetchHandler({ app: entry, document: assets }),
+  );
   return async function handle(request) {
-    const handled = await entry.dispatch(request);
-    if (handled != null) return handled;
-
-    const method = request.method.toUpperCase();
-    if (method !== "GET" && method !== "HEAD") {
-      return new Response(null, { status: 404 });
-    }
-
-    const url = new URL(request.url);
-    const result = await entry.render(url.pathname + url.search, assets);
-    const headers = new Headers(result.headers ?? {});
-    headers.set("content-type", "text/html; charset=utf-8");
-    // A `HEAD` gets the status and the headers and no body, which is what the
-    // renderer cannot know to do for itself.
-    return new Response(method === "HEAD" ? null : result.html, {
-      status: result.status ?? 200,
-      headers,
-    });
+    return (await ready)(request);
   };
 }
 
 /**
  * The static half: a file under `root`, or `null` for the caller to carry on.
  *
- * `GET` and `HEAD` only. A `POST` to a path that happens to have a file under
- * it belongs to a route handler, and answering it with the file's bytes would
- * be the same mistake as rendering a page for it.
- *
- * # The path is checked once, after it is resolved
- *
- * `docs/security.md` rule 2: never authorize against a raw request string or a
- * partially decoded path. The pathname is decoded first, then resolved against
- * the root, and *then* checked to be inside it — so `%2e%2e%2f`, a backslash
- * on Windows, and a symlinked directory all reduce to the same question, asked
- * once, of the value that is actually opened.
+ * `@uniflowed/server/node`'s, for the same reason as above: what a deployment
+ * runs and what `uf start` runs have to be the same code, not the same idea.
  */
 export function createStaticHandler({ root }) {
-  const distDir = path.resolve(root);
-
+  const ready = deployment().then(({ createStaticHandler: create }) => create({ root }));
   return async function serveStatic(request) {
-    const method = request.method.toUpperCase();
-    if (method !== "GET" && method !== "HEAD") return null;
-
-    const pathname = decodePathname(new URL(request.url).pathname);
-    if (pathname == null) return null;
-
-    const resolved = path.resolve(distDir, `.${pathname}`);
-    if (resolved !== distDir && !resolved.startsWith(distDir + path.sep)) return null;
-
-    // `/guide/` and `/guide` are the same prerendered document, and neither
-    // spelling is the one a person types. `<path>.html` is last because a
-    // build writes `guide/index.html`, and only a hand-placed file in
-    // `public/` is ever `guide.html`.
-    const candidates = pathname.endsWith("/")
-      ? [path.join(resolved, "index.html")]
-      : [resolved, path.join(resolved, "index.html"), `${resolved}.html`];
-
-    for (const candidate of candidates) {
-      const info = await statFile(candidate);
-      if (info == null || !info.isFile()) continue;
-      const headers = {
-        "content-type":
-          CONTENT_TYPES[path.extname(candidate).toLowerCase()] ?? "application/octet-stream",
-        "content-length": String(info.size),
-      };
-      if (method === "HEAD") return new Response(null, { headers });
-      // Streamed rather than read into memory, so serving a large asset costs
-      // a buffer rather than the file.
-      return new Response(Readable.toWeb(createReadStream(candidate)), { headers });
-    }
-    return null;
+    return (await ready)(request);
   };
 }
 
@@ -280,107 +282,27 @@ export function createServeHandler({ entry, assets, distDir }) {
   };
 }
 
-function decodePathname(pathname) {
-  try {
-    const decoded = decodeURIComponent(pathname);
-    // A NUL truncates the name every C-level `open` sees, so a path holding
-    // one is refused rather than normalised into something shorter.
-    return decoded.includes("\0") ? null : decoded;
-  } catch {
-    // A percent escape that is not one. There is no file behind it.
-    return null;
-  }
-}
-
-async function statFile(file) {
-  try {
-    return await stat(file);
-  } catch {
-    return null;
-  }
-}
-
 /**
  * A `Request`/`Response` handler as a Node request listener.
  *
- * The handler contract is the platform's, so this adapter belongs here rather
- * than in every host that wants to run one — `uf dev`'s middleware, `uf
- * preview`'s, and `uf start`'s own server all reach for the same two halves.
+ * `@uniflowed/server/node`'s, which is also what the `server.js` an adapter
+ * writes runs — so a request reaching `uf start` and the same request reaching
+ * a deployed directory go through one translation rather than two, and settle
+ * at one moment rather than at two.
  *
- * A handler that throws is answered with a bare 500 and reported on stderr:
- * the body must not carry the stack, because the body goes to whoever asked,
- * and stderr is where the operator is already looking. It is not an event on
- * stdout because a request failing is the application's news, not the driver's
- * — the driver's stdout says what the *server* is doing.
+ * `entry` is the second argument rather than something this reaches for: it is
+ * the application bundle's own `beginRequest` that has to own the request, for
+ * the reason in "Who owns the request" above. It is required, and a listener
+ * built without one fails on its first request — the same trade
+ * `createFetchHandler` makes about `app.runMiddleware`, and for the same
+ * reason: an optional lifecycle is a lifecycle somebody forgets, and what is
+ * lost when they do is every `after()` in the application.
  */
-export function nodeListener(handle) {
+export function nodeListener(handle, entry) {
+  const ready = deployment().then(({ nodeListener: create }) =>
+    create(handle, { beginRequest: entry.beginRequest }),
+  );
   return async function listener(incoming, outgoing) {
-    try {
-      await send(outgoing, await handle(await toRequest(incoming)));
-    } catch (error) {
-      console.error(error);
-      if (outgoing.headersSent) {
-        outgoing.destroy();
-        return;
-      }
-      outgoing.statusCode = 500;
-      outgoing.setHeader("content-type", "text/plain; charset=utf-8");
-      outgoing.end("500 Internal Server Error\n");
-    }
+    return (await ready)(incoming, outgoing);
   };
 }
-
-/**
- * A Node request as a `Request`.
- *
- * The body is read as a stream where the host supports it, because a handler
- * that accepts an upload should not need the whole thing buffered before it
- * starts.
- */
-export async function toRequest(incoming, config) {
-  const host = incoming.headers.host ?? "localhost";
-  const protocol = config?.server?.https == null ? "http" : "https";
-  const url = new URL(incoming.originalUrl ?? incoming.url ?? "/", `${protocol}://${host}`);
-
-  const headers = new Headers();
-  for (const [name, value] of Object.entries(incoming.headers)) {
-    if (value == null) continue;
-    for (const entry of Array.isArray(value) ? value : [value]) {
-      headers.append(name, entry);
-    }
-  }
-
-  const method = (incoming.method ?? "GET").toUpperCase();
-  const init = { method, headers };
-  if (method !== "GET" && method !== "HEAD") {
-    // `duplex` is required by the specification whenever a body is a stream,
-    // and Node throws without it.
-    init.body = incoming;
-    init.duplex = "half";
-  }
-  return new Request(url, init);
-}
-
-/** Write a `Response` to a Node response. */
-export async function send(outgoing, result) {
-  outgoing.statusCode = result.status;
-  if (result.statusText !== "") {
-    outgoing.statusMessage = result.statusText;
-  }
-  for (const [name, value] of result.headers) {
-    outgoing.setHeader(name, value);
-  }
-  if (result.body == null) {
-    outgoing.end();
-    return;
-  }
-  // Streamed rather than buffered, so a handler returning a large or
-  // open-ended body is not read into memory first.
-  const reader = result.body.getReader();
-  while (true) {
-    const { done, value } = await reader.read();
-    if (done) break;
-    outgoing.write(value);
-  }
-  outgoing.end();
-}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@uniflowed/vite",
-  "version": "0.0.0-alpha.7",
+  "version": "0.0.0-alpha.8",
   "description": "Vite, driven by uf.config.js: every Flow module through `uf transform`, MDX, the file-system router and static rendering as Vite plugins.",
   "type": "module",
   "license": "MIT",
@@ -25,7 +25,8 @@
   "dependencies": {
     "@mdx-js/rollup": "^3.1.1",
     "@shikijs/rehype": "^3.23.0",
-    "@uniflowed/host": "0.0.0-alpha.7",
+    "@uniflowed/host": "0.0.0-alpha.8",
+    "@uniflowed/server": "0.0.0-alpha.8",
     "rehype-slug": "^6.0.0",
     "remark-frontmatter": "^5.0.0",
     "remark-gfm": "^4.0.1",