@xfe-repo/web-app 2.0.0-beta.1 → 2.0.0-beta.2

package/dist/config.d.mts

@@ -1,9 +1,13 @@
 type WebAppConfig = {
     basename?: string;
+    /** 相对于项目根目录的输出路径，默认 dist；旧项目可显式设置 build。 */
+    buildDirectory?: string;
     host?: string;
     port?: number;
     /** 渲染方式由 XFE 转换为底层框架配置；省略时兼容已有服务端应用。 */
     renderMode?: 'client' | 'server';
+    /** 项目内默认导出 Node 工厂的源码入口；省略时保留原有 SPA / SSR 启动。 */
+    serverEntry?: string;
     title?: string;
     lang?: string;
     themeColor?: string;
@@ -16,8 +20,14 @@ type JwtEnv = {
     XFE_JWT_KEY_ID: string;
     XFE_JWT_PRIVATE_KEY: string;
 };
+/** 读取业务配置，并在构建或启动前拒绝无效的渲染方式和输出路径。 */
 declare const loadXfeConfig: (root?: string) => XfeConfig;
+/** 返回构建和启动共用的绝对路径，防止清空项目根目录或框架输入目录。 */
+declare const getBuildDirectory: (projectRoot: string, webapp?: WebAppConfig) => string;
+/** 生产仅校验入口约定而不读取源码，构建阶段由编译器检查文件存在。 */
+declare const getServerEntry: (projectRoot: string, webapp?: WebAppConfig) => string | undefined;
+/** 将输出目录传给 Docker 构建，并沿用现有的集群、域名与 Helm 配置。 */
 declare const configDeploy: () => void;
 declare const getJwtEnv: () => Promise<Partial<JwtEnv>>;
 
-export { type JwtEnv, type WebAppConfig, type XfeConfig, configDeploy, getJwtEnv, loadXfeConfig };
+export { type JwtEnv, type WebAppConfig, type XfeConfig, configDeploy, getBuildDirectory, getJwtEnv, getServerEntry, loadXfeConfig };

package/dist/config.d.ts

@@ -1,9 +1,13 @@
 type WebAppConfig = {
     basename?: string;
+    /** 相对于项目根目录的输出路径，默认 dist；旧项目可显式设置 build。 */
+    buildDirectory?: string;
     host?: string;
     port?: number;
     /** 渲染方式由 XFE 转换为底层框架配置；省略时兼容已有服务端应用。 */
     renderMode?: 'client' | 'server';
+    /** 项目内默认导出 Node 工厂的源码入口；省略时保留原有 SPA / SSR 启动。 */
+    serverEntry?: string;
     title?: string;
     lang?: string;
     themeColor?: string;
@@ -16,8 +20,14 @@ type JwtEnv = {
     XFE_JWT_KEY_ID: string;
     XFE_JWT_PRIVATE_KEY: string;
 };
+/** 读取业务配置，并在构建或启动前拒绝无效的渲染方式和输出路径。 */
 declare const loadXfeConfig: (root?: string) => XfeConfig;
+/** 返回构建和启动共用的绝对路径，防止清空项目根目录或框架输入目录。 */
+declare const getBuildDirectory: (projectRoot: string, webapp?: WebAppConfig) => string;
+/** 生产仅校验入口约定而不读取源码，构建阶段由编译器检查文件存在。 */
+declare const getServerEntry: (projectRoot: string, webapp?: WebAppConfig) => string | undefined;
+/** 将输出目录传给 Docker 构建，并沿用现有的集群、域名与 Helm 配置。 */
 declare const configDeploy: () => void;
 declare const getJwtEnv: () => Promise<Partial<JwtEnv>>;
 
-export { type JwtEnv, type WebAppConfig, type XfeConfig, configDeploy, getJwtEnv, loadXfeConfig };
+export { type JwtEnv, type WebAppConfig, type XfeConfig, configDeploy, getBuildDirectory, getJwtEnv, getServerEntry, loadXfeConfig };

package/dist/config.js

@@ -31,33 +31,89 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var config_exports = {};
 __export(config_exports, {
   configDeploy: () => configDeploy,
+  getBuildDirectory: () => getBuildDirectory,
   getJwtEnv: () => getJwtEnv,
+  getServerEntry: () => getServerEntry,
   loadXfeConfig: () => loadXfeConfig
 });
 module.exports = __toCommonJS(config_exports);
-var import_path = __toESM(require("path"));
-var import_fs = __toESM(require("fs"));
+var import_node_fs = __toESM(require("fs"));
+var import_node_path = __toESM(require("path"));
+var import_node_url = require("url");
 var import_yaml = __toESM(require("yaml"));
+var import_meta = {};
+var DEFAULT_BUILD_DIRECTORY = "dist";
+var BUILD_DIRECTORY_ARGUMENT = "XFE_BUILD_DIRECTORY";
+var protectedDirectories = /* @__PURE__ */ new Set(["src", "types", "public", "node_modules", ".git"]);
+var configDirectory = typeof __dirname === "string" ? __dirname : import_node_path.default.dirname((0, import_node_url.fileURLToPath)(import_meta.url));
 var loadXfeConfig = (root = process.cwd()) => {
-  const xfeConfigPath = import_path.default.join(root, "xfe.json");
-  if (!import_fs.default.existsSync(xfeConfigPath)) {
+  const xfeConfigPath = import_node_path.default.join(root, "xfe.json");
+  if (!import_node_fs.default.existsSync(xfeConfigPath)) {
     throw new Error("xfe.json \u914D\u7F6E\u6587\u4EF6\u4E0D\u5B58\u5728\uFF0C\u8BF7\u5728\u9879\u76EE\u6839\u76EE\u5F55\u4E0B\u521B\u5EFA\u8BE5\u6587\u4EF6\u3002");
   }
-  const xfeConfigContent = import_fs.default.readFileSync(xfeConfigPath, "utf8");
+  const xfeConfigContent = import_node_fs.default.readFileSync(xfeConfigPath, "utf8");
   const config = JSON.parse(xfeConfigContent);
   const renderMode = config.webapp?.renderMode;
   if (renderMode !== void 0 && renderMode !== "client" && renderMode !== "server") {
     throw new Error("xfe.json.webapp.renderMode \u53EA\u80FD\u4E3A client \u6216 server");
   }
+  getBuildDirectory(root, config.webapp);
+  getServerEntry(root, config.webapp);
   return config;
 };
+var getBuildDirectory = (projectRoot, webapp = {}) => {
+  const configured = webapp?.buildDirectory === void 0 ? DEFAULT_BUILD_DIRECTORY : webapp.buildDirectory;
+  if (typeof configured !== "string" || !configured.trim() || /[\0\r\n]/.test(configured)) {
+    throw new Error("xfe.json.webapp.buildDirectory \u5FC5\u987B\u662F\u975E\u7A7A\u7684\u5355\u884C\u5B57\u7B26\u4E32");
+  }
+  const directory = configured.trim().replaceAll("\\", "/");
+  const root = import_node_path.default.resolve(projectRoot);
+  const output = import_node_path.default.resolve(root, directory);
+  const relative = import_node_path.default.relative(root, output);
+  const [firstDirectory = ""] = relative.split(import_node_path.default.sep);
+  const escapesProject = import_node_path.default.isAbsolute(directory) || Boolean(import_node_path.default.win32.parse(directory).root) || firstDirectory === "..";
+  const overwritesInput = !relative || protectedDirectories.has(firstDirectory.toLowerCase());
+  if (escapesProject || overwritesInput) {
+    throw new Error("xfe.json.webapp.buildDirectory \u5FC5\u987B\u662F\u9879\u76EE\u5185\u72EC\u7ACB\u7684\u8F93\u51FA\u76EE\u5F55\uFF0C\u4E0D\u80FD\u8986\u76D6\u9879\u76EE\u3001\u6E90\u7801\u6216\u4F9D\u8D56");
+  }
+  let currentDirectory = root;
+  for (const segment of relative.split(import_node_path.default.sep)) {
+    currentDirectory = import_node_path.default.join(currentDirectory, segment);
+    if (import_node_fs.default.lstatSync(currentDirectory, { throwIfNoEntry: false })?.isSymbolicLink()) {
+      throw new Error("xfe.json.webapp.buildDirectory \u4E0D\u80FD\u7ECF\u8FC7\u7B26\u53F7\u94FE\u63A5\uFF0C\u4EE5\u514D\u6E05\u7406\u5176\u4ED6\u76EE\u5F55");
+    }
+  }
+  return output;
+};
+var getServerEntry = (projectRoot, webapp = {}) => {
+  const entry = webapp?.serverEntry;
+  if (entry === void 0) return;
+  if (typeof entry !== "string" || !entry.trim() || /[\0\r\n]/.test(entry)) {
+    throw new Error("xfe.json.webapp.serverEntry \u5FC5\u987B\u662F\u9879\u76EE\u5185\u7684 TypeScript / JavaScript \u76F8\u5BF9\u8DEF\u5F84");
+  }
+  const normalized = entry.trim().replaceAll("\\", "/");
+  const absolute = import_node_path.default.resolve(projectRoot, normalized);
+  const relative = import_node_path.default.relative(import_node_path.default.resolve(projectRoot), absolute);
+  const outside = Boolean(import_node_path.default.win32.parse(normalized).root) || relative.split(import_node_path.default.sep)[0] === "..";
+  if (outside || !/\.(?:[jt]sx?|m[jt]s)$/.test(relative)) {
+    throw new Error("xfe.json.webapp.serverEntry \u5FC5\u987B\u662F\u9879\u76EE\u5185\u7684 TypeScript / JavaScript \u76F8\u5BF9\u8DEF\u5F84");
+  }
+  return absolute;
+};
 var configDeploy = () => {
   const xfeConfig = loadXfeConfig();
   if (!xfeConfig?.deploy) return;
-  const droneConfigFilePath = import_path.default.resolve(__dirname, "../deploy/.drone.yml");
-  import_fs.default.cpSync(droneConfigFilePath, xfeConfig.deploy.droneConfigPath || "./.drone.yml");
-  const valuesYamlFilePath = import_path.default.resolve(__dirname, "../deploy/helm/values.yaml");
-  const valuesYamlFile = import_fs.default.readFileSync(valuesYamlFilePath, "utf8");
+  const projectRoot = process.cwd();
+  const buildDirectory = import_node_path.default.relative(projectRoot, getBuildDirectory(projectRoot, xfeConfig.webapp)).replaceAll(import_node_path.default.sep, "/");
+  const droneConfigFilePath = import_node_path.default.resolve(configDirectory, "../deploy/.drone.yml");
+  const droneTarget = import_node_path.default.resolve(projectRoot, xfeConfig.deploy.droneConfigPath || "./.drone.yml");
+  const defaultArgument = JSON.stringify(`${BUILD_DIRECTORY_ARGUMENT}=${DEFAULT_BUILD_DIRECTORY}`);
+  const configuredArgument = JSON.stringify(`${BUILD_DIRECTORY_ARGUMENT}=${buildDirectory}`);
+  const droneConfig = import_node_fs.default.readFileSync(droneConfigFilePath, "utf8").replace(defaultArgument, configuredArgument);
+  import_node_fs.default.mkdirSync(import_node_path.default.dirname(droneTarget), { recursive: true });
+  import_node_fs.default.writeFileSync(droneTarget, droneConfig);
+  const valuesYamlFilePath = import_node_path.default.resolve(configDirectory, "../deploy/helm/values.yaml");
+  const valuesYamlFile = import_node_fs.default.readFileSync(valuesYamlFilePath, "utf8");
   const valuesYaml = import_yaml.default.parse(valuesYamlFile);
   if (!valuesYaml.virtualService) valuesYaml.virtualService = {};
   if (!valuesYaml.virtualService.hosts) valuesYaml.virtualService.hosts = { test: [], stage: [], prod: [] };
@@ -77,7 +133,7 @@ var configDeploy = () => {
   valuesYaml.targetK8s = targetK8s;
   valuesYaml.namespace = targetNamespace;
   const valuesYamlStr = import_yaml.default.stringify(valuesYaml, { defaultStringType: "QUOTE_SINGLE", defaultKeyType: "PLAIN" });
-  import_fs.default.writeFileSync(valuesYamlFilePath, valuesYamlStr, "utf8");
+  import_node_fs.default.writeFileSync(valuesYamlFilePath, valuesYamlStr, "utf8");
 };
 var getJwtEnv = async () => {
   const xfeConfig = loadXfeConfig();
@@ -101,6 +157,8 @@ var getJwtEnv = async () => {
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   configDeploy,
+  getBuildDirectory,
   getJwtEnv,
+  getServerEntry,
   loadXfeConfig
 });

package/dist/config.mjs

@@ -1,7 +1,12 @@
 // src/config.ts
-import path from "path";
 import fs from "fs";
+import path from "path";
+import { fileURLToPath } from "url";
 import yaml from "yaml";
+var DEFAULT_BUILD_DIRECTORY = "dist";
+var BUILD_DIRECTORY_ARGUMENT = "XFE_BUILD_DIRECTORY";
+var protectedDirectories = /* @__PURE__ */ new Set(["src", "types", "public", "node_modules", ".git"]);
+var configDirectory = typeof __dirname === "string" ? __dirname : path.dirname(fileURLToPath(import.meta.url));
 var loadXfeConfig = (root = process.cwd()) => {
   const xfeConfigPath = path.join(root, "xfe.json");
   if (!fs.existsSync(xfeConfigPath)) {
@@ -13,14 +18,62 @@ var loadXfeConfig = (root = process.cwd()) => {
   if (renderMode !== void 0 && renderMode !== "client" && renderMode !== "server") {
     throw new Error("xfe.json.webapp.renderMode \u53EA\u80FD\u4E3A client \u6216 server");
   }
+  getBuildDirectory(root, config.webapp);
+  getServerEntry(root, config.webapp);
   return config;
 };
+var getBuildDirectory = (projectRoot, webapp = {}) => {
+  const configured = webapp?.buildDirectory === void 0 ? DEFAULT_BUILD_DIRECTORY : webapp.buildDirectory;
+  if (typeof configured !== "string" || !configured.trim() || /[\0\r\n]/.test(configured)) {
+    throw new Error("xfe.json.webapp.buildDirectory \u5FC5\u987B\u662F\u975E\u7A7A\u7684\u5355\u884C\u5B57\u7B26\u4E32");
+  }
+  const directory = configured.trim().replaceAll("\\", "/");
+  const root = path.resolve(projectRoot);
+  const output = path.resolve(root, directory);
+  const relative = path.relative(root, output);
+  const [firstDirectory = ""] = relative.split(path.sep);
+  const escapesProject = path.isAbsolute(directory) || Boolean(path.win32.parse(directory).root) || firstDirectory === "..";
+  const overwritesInput = !relative || protectedDirectories.has(firstDirectory.toLowerCase());
+  if (escapesProject || overwritesInput) {
+    throw new Error("xfe.json.webapp.buildDirectory \u5FC5\u987B\u662F\u9879\u76EE\u5185\u72EC\u7ACB\u7684\u8F93\u51FA\u76EE\u5F55\uFF0C\u4E0D\u80FD\u8986\u76D6\u9879\u76EE\u3001\u6E90\u7801\u6216\u4F9D\u8D56");
+  }
+  let currentDirectory = root;
+  for (const segment of relative.split(path.sep)) {
+    currentDirectory = path.join(currentDirectory, segment);
+    if (fs.lstatSync(currentDirectory, { throwIfNoEntry: false })?.isSymbolicLink()) {
+      throw new Error("xfe.json.webapp.buildDirectory \u4E0D\u80FD\u7ECF\u8FC7\u7B26\u53F7\u94FE\u63A5\uFF0C\u4EE5\u514D\u6E05\u7406\u5176\u4ED6\u76EE\u5F55");
+    }
+  }
+  return output;
+};
+var getServerEntry = (projectRoot, webapp = {}) => {
+  const entry = webapp?.serverEntry;
+  if (entry === void 0) return;
+  if (typeof entry !== "string" || !entry.trim() || /[\0\r\n]/.test(entry)) {
+    throw new Error("xfe.json.webapp.serverEntry \u5FC5\u987B\u662F\u9879\u76EE\u5185\u7684 TypeScript / JavaScript \u76F8\u5BF9\u8DEF\u5F84");
+  }
+  const normalized = entry.trim().replaceAll("\\", "/");
+  const absolute = path.resolve(projectRoot, normalized);
+  const relative = path.relative(path.resolve(projectRoot), absolute);
+  const outside = Boolean(path.win32.parse(normalized).root) || relative.split(path.sep)[0] === "..";
+  if (outside || !/\.(?:[jt]sx?|m[jt]s)$/.test(relative)) {
+    throw new Error("xfe.json.webapp.serverEntry \u5FC5\u987B\u662F\u9879\u76EE\u5185\u7684 TypeScript / JavaScript \u76F8\u5BF9\u8DEF\u5F84");
+  }
+  return absolute;
+};
 var configDeploy = () => {
   const xfeConfig = loadXfeConfig();
   if (!xfeConfig?.deploy) return;
-  const droneConfigFilePath = path.resolve(__dirname, "../deploy/.drone.yml");
-  fs.cpSync(droneConfigFilePath, xfeConfig.deploy.droneConfigPath || "./.drone.yml");
-  const valuesYamlFilePath = path.resolve(__dirname, "../deploy/helm/values.yaml");
+  const projectRoot = process.cwd();
+  const buildDirectory = path.relative(projectRoot, getBuildDirectory(projectRoot, xfeConfig.webapp)).replaceAll(path.sep, "/");
+  const droneConfigFilePath = path.resolve(configDirectory, "../deploy/.drone.yml");
+  const droneTarget = path.resolve(projectRoot, xfeConfig.deploy.droneConfigPath || "./.drone.yml");
+  const defaultArgument = JSON.stringify(`${BUILD_DIRECTORY_ARGUMENT}=${DEFAULT_BUILD_DIRECTORY}`);
+  const configuredArgument = JSON.stringify(`${BUILD_DIRECTORY_ARGUMENT}=${buildDirectory}`);
+  const droneConfig = fs.readFileSync(droneConfigFilePath, "utf8").replace(defaultArgument, configuredArgument);
+  fs.mkdirSync(path.dirname(droneTarget), { recursive: true });
+  fs.writeFileSync(droneTarget, droneConfig);
+  const valuesYamlFilePath = path.resolve(configDirectory, "../deploy/helm/values.yaml");
   const valuesYamlFile = fs.readFileSync(valuesYamlFilePath, "utf8");
   const valuesYaml = yaml.parse(valuesYamlFile);
   if (!valuesYaml.virtualService) valuesYaml.virtualService = {};
@@ -64,6 +117,8 @@ var getJwtEnv = async () => {
 };
 export {
   configDeploy,
+  getBuildDirectory,
   getJwtEnv,
+  getServerEntry,
   loadXfeConfig
 };

package/dist/framework.js

@@ -34,49 +34,95 @@ __export(framework_exports, {
   prepareFramework: () => prepareFramework
 });
 module.exports = __toCommonJS(framework_exports);
-var import_node_fs = __toESM(require("fs"));
+var import_node_fs2 = __toESM(require("fs"));
 var import_node_module = require("module");
-var import_node_path = __toESM(require("path"));
-var import_node_url = require("url");
+var import_node_path2 = __toESM(require("path"));
+var import_node_url2 = require("url");
 
 // src/config.ts
-var import_path = __toESM(require("path"));
-var import_fs = __toESM(require("fs"));
+var import_node_fs = __toESM(require("fs"));
+var import_node_path = __toESM(require("path"));
+var import_node_url = require("url");
 var import_yaml = __toESM(require("yaml"));
+var import_meta = {};
+var DEFAULT_BUILD_DIRECTORY = "dist";
+var protectedDirectories = /* @__PURE__ */ new Set(["src", "types", "public", "node_modules", ".git"]);
+var configDirectory = typeof __dirname === "string" ? __dirname : import_node_path.default.dirname((0, import_node_url.fileURLToPath)(import_meta.url));
 var loadXfeConfig = (root = process.cwd()) => {
-  const xfeConfigPath = import_path.default.join(root, "xfe.json");
-  if (!import_fs.default.existsSync(xfeConfigPath)) {
+  const xfeConfigPath = import_node_path.default.join(root, "xfe.json");
+  if (!import_node_fs.default.existsSync(xfeConfigPath)) {
     throw new Error("xfe.json \u914D\u7F6E\u6587\u4EF6\u4E0D\u5B58\u5728\uFF0C\u8BF7\u5728\u9879\u76EE\u6839\u76EE\u5F55\u4E0B\u521B\u5EFA\u8BE5\u6587\u4EF6\u3002");
   }
-  const xfeConfigContent = import_fs.default.readFileSync(xfeConfigPath, "utf8");
+  const xfeConfigContent = import_node_fs.default.readFileSync(xfeConfigPath, "utf8");
   const config = JSON.parse(xfeConfigContent);
   const renderMode = config.webapp?.renderMode;
   if (renderMode !== void 0 && renderMode !== "client" && renderMode !== "server") {
     throw new Error("xfe.json.webapp.renderMode \u53EA\u80FD\u4E3A client \u6216 server");
   }
+  getBuildDirectory(root, config.webapp);
+  getServerEntry(root, config.webapp);
   return config;
 };
+var getBuildDirectory = (projectRoot, webapp = {}) => {
+  const configured = webapp?.buildDirectory === void 0 ? DEFAULT_BUILD_DIRECTORY : webapp.buildDirectory;
+  if (typeof configured !== "string" || !configured.trim() || /[\0\r\n]/.test(configured)) {
+    throw new Error("xfe.json.webapp.buildDirectory \u5FC5\u987B\u662F\u975E\u7A7A\u7684\u5355\u884C\u5B57\u7B26\u4E32");
+  }
+  const directory = configured.trim().replaceAll("\\", "/");
+  const root = import_node_path.default.resolve(projectRoot);
+  const output = import_node_path.default.resolve(root, directory);
+  const relative = import_node_path.default.relative(root, output);
+  const [firstDirectory = ""] = relative.split(import_node_path.default.sep);
+  const escapesProject = import_node_path.default.isAbsolute(directory) || Boolean(import_node_path.default.win32.parse(directory).root) || firstDirectory === "..";
+  const overwritesInput = !relative || protectedDirectories.has(firstDirectory.toLowerCase());
+  if (escapesProject || overwritesInput) {
+    throw new Error("xfe.json.webapp.buildDirectory \u5FC5\u987B\u662F\u9879\u76EE\u5185\u72EC\u7ACB\u7684\u8F93\u51FA\u76EE\u5F55\uFF0C\u4E0D\u80FD\u8986\u76D6\u9879\u76EE\u3001\u6E90\u7801\u6216\u4F9D\u8D56");
+  }
+  let currentDirectory = root;
+  for (const segment of relative.split(import_node_path.default.sep)) {
+    currentDirectory = import_node_path.default.join(currentDirectory, segment);
+    if (import_node_fs.default.lstatSync(currentDirectory, { throwIfNoEntry: false })?.isSymbolicLink()) {
+      throw new Error("xfe.json.webapp.buildDirectory \u4E0D\u80FD\u7ECF\u8FC7\u7B26\u53F7\u94FE\u63A5\uFF0C\u4EE5\u514D\u6E05\u7406\u5176\u4ED6\u76EE\u5F55");
+    }
+  }
+  return output;
+};
+var getServerEntry = (projectRoot, webapp = {}) => {
+  const entry = webapp?.serverEntry;
+  if (entry === void 0) return;
+  if (typeof entry !== "string" || !entry.trim() || /[\0\r\n]/.test(entry)) {
+    throw new Error("xfe.json.webapp.serverEntry \u5FC5\u987B\u662F\u9879\u76EE\u5185\u7684 TypeScript / JavaScript \u76F8\u5BF9\u8DEF\u5F84");
+  }
+  const normalized = entry.trim().replaceAll("\\", "/");
+  const absolute = import_node_path.default.resolve(projectRoot, normalized);
+  const relative = import_node_path.default.relative(import_node_path.default.resolve(projectRoot), absolute);
+  const outside = Boolean(import_node_path.default.win32.parse(normalized).root) || relative.split(import_node_path.default.sep)[0] === "..";
+  if (outside || !/\.(?:[jt]sx?|m[jt]s)$/.test(relative)) {
+    throw new Error("xfe.json.webapp.serverEntry \u5FC5\u987B\u662F\u9879\u76EE\u5185\u7684 TypeScript / JavaScript \u76F8\u5BF9\u8DEF\u5F84");
+  }
+  return absolute;
+};
 
 // src/framework.ts
-var import_meta = {};
-var frameworkDirectory = typeof __dirname === "string" ? __dirname : import_node_path.default.dirname((0, import_node_url.fileURLToPath)(import_meta.url));
-var requireFromFramework = (0, import_node_module.createRequire)(import_node_path.default.join(frameworkDirectory, "framework.js"));
+var import_meta2 = {};
+var frameworkDirectory = typeof __dirname === "string" ? __dirname : import_node_path2.default.dirname((0, import_node_url2.fileURLToPath)(import_meta2.url));
+var requireFromFramework = (0, import_node_module.createRequire)(import_node_path2.default.join(frameworkDirectory, "framework.js"));
 var extensions = [".tsx", ".ts", ".jsx", ".js"];
-var findSource = (directory, name) => extensions.map((extension) => import_node_path.default.join(directory, `${name}${extension}`)).find(import_node_fs.default.existsSync);
-var findValueExports = (file) => [...import_node_fs.default.readFileSync(file, "utf8").matchAll(/^\s*export\s+(?:async\s+)?(?:const|let|var|function|class)\s+([A-Za-z_$][\w$]*)/gm)].map(
+var findSource = (directory, name) => extensions.map((extension) => import_node_path2.default.join(directory, `${name}${extension}`)).find(import_node_fs2.default.existsSync);
+var findValueExports = (file) => [...import_node_fs2.default.readFileSync(file, "utf8").matchAll(/^\s*export\s+(?:async\s+)?(?:const|let|var|function|class)\s+([A-Za-z_$][\w$]*)/gm)].map(
   ([, name]) => name
 );
 var importPath = (from, target) => {
-  const relative = import_node_path.default.relative(from, target).replace(import_node_path.default.extname(target), "").replaceAll(import_node_path.default.sep, "/");
+  const relative = import_node_path2.default.relative(from, target).replace(import_node_path2.default.extname(target), "").replaceAll(import_node_path2.default.sep, "/");
   return relative.startsWith(".") ? relative : `./${relative}`;
 };
 var writeGenerated = (file, content) => {
-  if (import_node_fs.default.existsSync(file) && import_node_fs.default.readFileSync(file, "utf8") === content) return;
-  import_node_fs.default.writeFileSync(file, content);
+  if (import_node_fs2.default.existsSync(file) && import_node_fs2.default.readFileSync(file, "utf8") === content) return;
+  import_node_fs2.default.writeFileSync(file, content);
 };
 var defaultRootSource = (projectRoot, appDirectory) => {
   const { webapp = {} } = loadXfeConfig(projectRoot);
-  const layoutSource = findSource(import_node_path.default.join(projectRoot, "src"), "layout");
+  const layoutSource = findSource(import_node_path2.default.join(projectRoot, "src"), "layout");
   const layoutExports = layoutSource ? findValueExports(layoutSource) : [];
   const hasErrorView = layoutExports.includes("ErrorView");
   const layoutImport = layoutSource ? `import AppLayout${hasErrorView ? ", { ErrorView }" : ""} from ${JSON.stringify(importPath(appDirectory, layoutSource))}
@@ -92,24 +138,24 @@ export function ErrorBoundary() { return createElement(PageError, { ${hasErrorVi
 export function HydrateFallback() { return createElement(PageLoading) }
 `;
 };
-var getFrameworkRoot = (projectRoot) => import_node_path.default.join(projectRoot, "node_modules/.cache/xfe-web/react-router");
+var getFrameworkRoot = (projectRoot) => import_node_path2.default.join(projectRoot, "node_modules/.cache/xfe-web/react-router");
 var prepareFramework = (projectRoot = process.cwd()) => {
-  const sourceDirectory = import_node_path.default.join(projectRoot, "src");
+  const sourceDirectory = import_node_path2.default.join(projectRoot, "src");
   const rootSource = findSource(sourceDirectory, "root");
   const appServerSource = findSource(sourceDirectory, "app.server");
-  const pagesSource = import_node_path.default.join(sourceDirectory, "pages");
-  if (!import_node_fs.default.existsSync(pagesSource)) throw new Error("\u672A\u627E\u5230 src/pages");
+  const pagesSource = import_node_path2.default.join(sourceDirectory, "pages");
+  if (!import_node_fs2.default.existsSync(pagesSource)) throw new Error("\u672A\u627E\u5230 src/pages");
   const rootDirectory = getFrameworkRoot(projectRoot);
-  const appDirectory = import_node_path.default.join(rootDirectory, "app");
-  import_node_fs.default.mkdirSync(appDirectory, { recursive: true });
-  const routerDirectory = import_node_path.default.dirname(requireFromFramework.resolve("react-router/package.json"));
-  const routerLink = import_node_path.default.join(rootDirectory, "node_modules/react-router");
-  import_node_fs.default.mkdirSync(import_node_path.default.dirname(routerLink), { recursive: true });
-  if (!import_node_fs.default.lstatSync(routerLink, { throwIfNoEntry: false })?.isSymbolicLink() || import_node_fs.default.readlinkSync(routerLink) !== routerDirectory) {
-    import_node_fs.default.rmSync(routerLink, { force: true });
-    import_node_fs.default.symlinkSync(routerDirectory, routerLink, "junction");
+  const appDirectory = import_node_path2.default.join(rootDirectory, "app");
+  import_node_fs2.default.mkdirSync(appDirectory, { recursive: true });
+  const routerDirectory = import_node_path2.default.dirname(requireFromFramework.resolve("react-router/package.json"));
+  const routerLink = import_node_path2.default.join(rootDirectory, "node_modules/react-router");
+  import_node_fs2.default.mkdirSync(import_node_path2.default.dirname(routerLink), { recursive: true });
+  if (!import_node_fs2.default.lstatSync(routerLink, { throwIfNoEntry: false })?.isSymbolicLink() || import_node_fs2.default.readlinkSync(routerLink) !== routerDirectory) {
+    import_node_fs2.default.rmSync(routerLink, { force: true });
+    import_node_fs2.default.symlinkSync(routerDirectory, routerLink, "junction");
   }
-  const rootTarget = import_node_path.default.join(appDirectory, "root.tsx");
+  const rootTarget = import_node_path2.default.join(appDirectory, "root.tsx");
   const rootImport = rootSource ? importPath(appDirectory, rootSource) : "";
   const rootExports = rootSource ? findValueExports(rootSource).filter((name) => name !== "middleware" || !appServerSource) : [];
   const namedExports = rootExports.length ? `export { ${rootExports.join(", ")} } from ${JSON.stringify(rootImport)}
@@ -123,36 +169,36 @@ var prepareFramework = (projectRoot = process.cwd()) => {
 export { default } from ${JSON.stringify(rootImport)}
 ${namedExports}${errorBoundaryExport}${middlewareExport}` : `${defaultRootSource(projectRoot, appDirectory)}${middlewareExport}`
   );
-  const pagesLink = import_node_path.default.join(appDirectory, "pages");
-  if (!import_node_fs.default.existsSync(pagesLink)) import_node_fs.default.symlinkSync(import_node_path.default.relative(appDirectory, pagesSource), pagesLink, "dir");
+  const pagesLink = import_node_path2.default.join(appDirectory, "pages");
+  if (!import_node_fs2.default.existsSync(pagesLink)) import_node_fs2.default.symlinkSync(import_node_path2.default.relative(appDirectory, pagesSource), pagesLink, "dir");
   writeGenerated(
-    import_node_path.default.join(rootDirectory, "react-router.config.js"),
+    import_node_path2.default.join(rootDirectory, "react-router.config.js"),
     "export { default } from '@xfe-repo/web-app/dist/react-router-config.mjs'\n"
   );
   writeGenerated(
-    import_node_path.default.join(appDirectory, "routes.js"),
+    import_node_path2.default.join(appDirectory, "routes.js"),
     `import { collectPageRoutes } from '@xfe-repo/web-router/routes'
 export default collectPageRoutes(${JSON.stringify(appDirectory)})
 `
   );
-  const defaultsDirectory = import_node_path.default.join(import_node_path.default.dirname(requireFromFramework.resolve("@react-router/dev/package.json")), "dist/config/defaults");
+  const defaultsDirectory = import_node_path2.default.join(import_node_path2.default.dirname(requireFromFramework.resolve("@react-router/dev/package.json")), "dist/config/defaults");
   writeGenerated(
-    import_node_path.default.join(appDirectory, "entry.server.tsx"),
-    `export { default, streamTimeout } from ${JSON.stringify(importPath(appDirectory, import_node_path.default.join(defaultsDirectory, "entry.server.web.tsx")))}
+    import_node_path2.default.join(appDirectory, "entry.server.tsx"),
+    `export { default, streamTimeout } from ${JSON.stringify(importPath(appDirectory, import_node_path2.default.join(defaultsDirectory, "entry.server.web.tsx")))}
 `
   );
-  const typeScriptConfig = import_node_path.default.join(rootDirectory, "tsconfig.json");
+  const typeScriptConfig = import_node_path2.default.join(rootDirectory, "tsconfig.json");
   writeGenerated(
     typeScriptConfig,
     JSON.stringify(
       {
-        extends: import_node_path.default.join(projectRoot, "tsconfig.json"),
-        compilerOptions: { rootDirs: [projectRoot, rootDirectory, import_node_path.default.join(rootDirectory, ".react-router/types")] },
+        extends: import_node_path2.default.join(projectRoot, "tsconfig.json"),
+        compilerOptions: { rootDirs: [projectRoot, rootDirectory, import_node_path2.default.join(rootDirectory, ".react-router/types")] },
         include: [
-          import_node_path.default.join(sourceDirectory, "**/*"),
-          import_node_path.default.join(projectRoot, "types/**/*"),
-          import_node_path.default.join(appDirectory, "*.tsx"),
-          import_node_path.default.join(rootDirectory, ".react-router/types/**/*")
+          import_node_path2.default.join(sourceDirectory, "**/*"),
+          import_node_path2.default.join(projectRoot, "types/**/*"),
+          import_node_path2.default.join(appDirectory, "*.tsx"),
+          import_node_path2.default.join(rootDirectory, ".react-router/types/**/*")
         ],
         exclude: []
       },
@@ -163,7 +209,7 @@ export default collectPageRoutes(${JSON.stringify(appDirectory)})
   return {
     appDirectory,
     rootDirectory,
-    viteConfig: import_node_path.default.resolve(frameworkDirectory, "vite.mjs"),
+    viteConfig: import_node_path2.default.resolve(frameworkDirectory, "vite.mjs"),
     typeScriptConfig
   };
 };

package/dist/framework.mjs

@@ -2,12 +2,16 @@
 import fs2 from "fs";
 import { createRequire } from "module";
 import path2 from "path";
-import { fileURLToPath } from "url";
+import { fileURLToPath as fileURLToPath2 } from "url";
 
 // src/config.ts
-import path from "path";
 import fs from "fs";
+import path from "path";
+import { fileURLToPath } from "url";
 import yaml from "yaml";
+var DEFAULT_BUILD_DIRECTORY = "dist";
+var protectedDirectories = /* @__PURE__ */ new Set(["src", "types", "public", "node_modules", ".git"]);
+var configDirectory = typeof __dirname === "string" ? __dirname : path.dirname(fileURLToPath(import.meta.url));
 var loadXfeConfig = (root = process.cwd()) => {
   const xfeConfigPath = path.join(root, "xfe.json");
   if (!fs.existsSync(xfeConfigPath)) {
@@ -19,11 +23,52 @@ var loadXfeConfig = (root = process.cwd()) => {
   if (renderMode !== void 0 && renderMode !== "client" && renderMode !== "server") {
     throw new Error("xfe.json.webapp.renderMode \u53EA\u80FD\u4E3A client \u6216 server");
   }
+  getBuildDirectory(root, config.webapp);
+  getServerEntry(root, config.webapp);
   return config;
 };
+var getBuildDirectory = (projectRoot, webapp = {}) => {
+  const configured = webapp?.buildDirectory === void 0 ? DEFAULT_BUILD_DIRECTORY : webapp.buildDirectory;
+  if (typeof configured !== "string" || !configured.trim() || /[\0\r\n]/.test(configured)) {
+    throw new Error("xfe.json.webapp.buildDirectory \u5FC5\u987B\u662F\u975E\u7A7A\u7684\u5355\u884C\u5B57\u7B26\u4E32");
+  }
+  const directory = configured.trim().replaceAll("\\", "/");
+  const root = path.resolve(projectRoot);
+  const output = path.resolve(root, directory);
+  const relative = path.relative(root, output);
+  const [firstDirectory = ""] = relative.split(path.sep);
+  const escapesProject = path.isAbsolute(directory) || Boolean(path.win32.parse(directory).root) || firstDirectory === "..";
+  const overwritesInput = !relative || protectedDirectories.has(firstDirectory.toLowerCase());
+  if (escapesProject || overwritesInput) {
+    throw new Error("xfe.json.webapp.buildDirectory \u5FC5\u987B\u662F\u9879\u76EE\u5185\u72EC\u7ACB\u7684\u8F93\u51FA\u76EE\u5F55\uFF0C\u4E0D\u80FD\u8986\u76D6\u9879\u76EE\u3001\u6E90\u7801\u6216\u4F9D\u8D56");
+  }
+  let currentDirectory = root;
+  for (const segment of relative.split(path.sep)) {
+    currentDirectory = path.join(currentDirectory, segment);
+    if (fs.lstatSync(currentDirectory, { throwIfNoEntry: false })?.isSymbolicLink()) {
+      throw new Error("xfe.json.webapp.buildDirectory \u4E0D\u80FD\u7ECF\u8FC7\u7B26\u53F7\u94FE\u63A5\uFF0C\u4EE5\u514D\u6E05\u7406\u5176\u4ED6\u76EE\u5F55");
+    }
+  }
+  return output;
+};
+var getServerEntry = (projectRoot, webapp = {}) => {
+  const entry = webapp?.serverEntry;
+  if (entry === void 0) return;
+  if (typeof entry !== "string" || !entry.trim() || /[\0\r\n]/.test(entry)) {
+    throw new Error("xfe.json.webapp.serverEntry \u5FC5\u987B\u662F\u9879\u76EE\u5185\u7684 TypeScript / JavaScript \u76F8\u5BF9\u8DEF\u5F84");
+  }
+  const normalized = entry.trim().replaceAll("\\", "/");
+  const absolute = path.resolve(projectRoot, normalized);
+  const relative = path.relative(path.resolve(projectRoot), absolute);
+  const outside = Boolean(path.win32.parse(normalized).root) || relative.split(path.sep)[0] === "..";
+  if (outside || !/\.(?:[jt]sx?|m[jt]s)$/.test(relative)) {
+    throw new Error("xfe.json.webapp.serverEntry \u5FC5\u987B\u662F\u9879\u76EE\u5185\u7684 TypeScript / JavaScript \u76F8\u5BF9\u8DEF\u5F84");
+  }
+  return absolute;
+};
 
 // src/framework.ts
-var frameworkDirectory = typeof __dirname === "string" ? __dirname : path2.dirname(fileURLToPath(import.meta.url));
+var frameworkDirectory = typeof __dirname === "string" ? __dirname : path2.dirname(fileURLToPath2(import.meta.url));
 var requireFromFramework = createRequire(path2.join(frameworkDirectory, "framework.js"));
 var extensions = [".tsx", ".ts", ".jsx", ".js"];
 var findSource = (directory, name) => extensions.map((extension) => path2.join(directory, `${name}${extension}`)).find(fs2.existsSync);

package/dist/node-dev.d.mts

@@ -0,0 +1,2 @@
+
+export {  }

package/dist/node-dev.d.ts

@@ -0,0 +1,2 @@
+
+export {  }