@xfe-repo/web-app 2.0.0-beta.1 → 2.0.0-beta.2

package/dist/node.mjs

@@ -0,0 +1,343 @@
+// src/node.ts
+import { once } from "events";
+import { rm } from "fs/promises";
+import { Server } from "http";
+import path3 from "path";
+import { pathToFileURL } from "url";
+import express from "express";
+
+// src/config.ts
+import fs from "fs";
+import path from "path";
+import { fileURLToPath } from "url";
+import yaml from "yaml";
+var DEFAULT_BUILD_DIRECTORY = "dist";
+var protectedDirectories = /* @__PURE__ */ new Set(["src", "types", "public", "node_modules", ".git"]);
+var configDirectory = typeof __dirname === "string" ? __dirname : path.dirname(fileURLToPath(import.meta.url));
+var loadXfeConfig = (root = process.cwd()) => {
+  const xfeConfigPath = path.join(root, "xfe.json");
+  if (!fs.existsSync(xfeConfigPath)) {
+    throw new Error("xfe.json \u914D\u7F6E\u6587\u4EF6\u4E0D\u5B58\u5728\uFF0C\u8BF7\u5728\u9879\u76EE\u6839\u76EE\u5F55\u4E0B\u521B\u5EFA\u8BE5\u6587\u4EF6\u3002");
+  }
+  const xfeConfigContent = fs.readFileSync(xfeConfigPath, "utf8");
+  const config = JSON.parse(xfeConfigContent);
+  const renderMode = config.webapp?.renderMode;
+  if (renderMode !== void 0 && renderMode !== "client" && renderMode !== "server") {
+    throw new Error("xfe.json.webapp.renderMode \u53EA\u80FD\u4E3A client \u6216 server");
+  }
+  getBuildDirectory(root, config.webapp);
+  getServerEntry(root, config.webapp);
+  return config;
+};
+var getBuildDirectory = (projectRoot, webapp = {}) => {
+  const configured = webapp?.buildDirectory === void 0 ? DEFAULT_BUILD_DIRECTORY : webapp.buildDirectory;
+  if (typeof configured !== "string" || !configured.trim() || /[\0\r\n]/.test(configured)) {
+    throw new Error("xfe.json.webapp.buildDirectory \u5FC5\u987B\u662F\u975E\u7A7A\u7684\u5355\u884C\u5B57\u7B26\u4E32");
+  }
+  const directory = configured.trim().replaceAll("\\", "/");
+  const root = path.resolve(projectRoot);
+  const output = path.resolve(root, directory);
+  const relative = path.relative(root, output);
+  const [firstDirectory = ""] = relative.split(path.sep);
+  const escapesProject = path.isAbsolute(directory) || Boolean(path.win32.parse(directory).root) || firstDirectory === "..";
+  const overwritesInput = !relative || protectedDirectories.has(firstDirectory.toLowerCase());
+  if (escapesProject || overwritesInput) {
+    throw new Error("xfe.json.webapp.buildDirectory \u5FC5\u987B\u662F\u9879\u76EE\u5185\u72EC\u7ACB\u7684\u8F93\u51FA\u76EE\u5F55\uFF0C\u4E0D\u80FD\u8986\u76D6\u9879\u76EE\u3001\u6E90\u7801\u6216\u4F9D\u8D56");
+  }
+  let currentDirectory = root;
+  for (const segment of relative.split(path.sep)) {
+    currentDirectory = path.join(currentDirectory, segment);
+    if (fs.lstatSync(currentDirectory, { throwIfNoEntry: false })?.isSymbolicLink()) {
+      throw new Error("xfe.json.webapp.buildDirectory \u4E0D\u80FD\u7ECF\u8FC7\u7B26\u53F7\u94FE\u63A5\uFF0C\u4EE5\u514D\u6E05\u7406\u5176\u4ED6\u76EE\u5F55");
+    }
+  }
+  return output;
+};
+var getServerEntry = (projectRoot, webapp = {}) => {
+  const entry = webapp?.serverEntry;
+  if (entry === void 0) return;
+  if (typeof entry !== "string" || !entry.trim() || /[\0\r\n]/.test(entry)) {
+    throw new Error("xfe.json.webapp.serverEntry \u5FC5\u987B\u662F\u9879\u76EE\u5185\u7684 TypeScript / JavaScript \u76F8\u5BF9\u8DEF\u5F84");
+  }
+  const normalized = entry.trim().replaceAll("\\", "/");
+  const absolute = path.resolve(projectRoot, normalized);
+  const relative = path.relative(path.resolve(projectRoot), absolute);
+  const outside = Boolean(path.win32.parse(normalized).root) || relative.split(path.sep)[0] === "..";
+  if (outside || !/\.(?:[jt]sx?|m[jt]s)$/.test(relative)) {
+    throw new Error("xfe.json.webapp.serverEntry \u5FC5\u987B\u662F\u9879\u76EE\u5185\u7684 TypeScript / JavaScript \u76F8\u5BF9\u8DEF\u5F84");
+  }
+  return absolute;
+};
+
+// src/framework.ts
+import fs2 from "fs";
+import { createRequire } from "module";
+import path2 from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+var frameworkDirectory = typeof __dirname === "string" ? __dirname : path2.dirname(fileURLToPath2(import.meta.url));
+var requireFromFramework = createRequire(path2.join(frameworkDirectory, "framework.js"));
+var extensions = [".tsx", ".ts", ".jsx", ".js"];
+var findSource = (directory, name) => extensions.map((extension) => path2.join(directory, `${name}${extension}`)).find(fs2.existsSync);
+var findValueExports = (file) => [...fs2.readFileSync(file, "utf8").matchAll(/^\s*export\s+(?:async\s+)?(?:const|let|var|function|class)\s+([A-Za-z_$][\w$]*)/gm)].map(
+  ([, name]) => name
+);
+var importPath = (from, target) => {
+  const relative = path2.relative(from, target).replace(path2.extname(target), "").replaceAll(path2.sep, "/");
+  return relative.startsWith(".") ? relative : `./${relative}`;
+};
+var writeGenerated = (file, content) => {
+  if (fs2.existsSync(file) && fs2.readFileSync(file, "utf8") === content) return;
+  fs2.writeFileSync(file, content);
+};
+var defaultRootSource = (projectRoot, appDirectory) => {
+  const { webapp = {} } = loadXfeConfig(projectRoot);
+  const layoutSource = findSource(path2.join(projectRoot, "src"), "layout");
+  const layoutExports = layoutSource ? findValueExports(layoutSource) : [];
+  const hasErrorView = layoutExports.includes("ErrorView");
+  const layoutImport = layoutSource ? `import AppLayout${hasErrorView ? ", { ErrorView }" : ""} from ${JSON.stringify(importPath(appDirectory, layoutSource))}
+` : "";
+  return `import { createElement, type ReactNode } from 'react'
+import { Outlet } from 'react-router'
+import { Document, PageError, PageLoading } from '@xfe-repo/web-app/dist/root.mjs'
+${layoutImport}
+export const meta = () => [{ title: ${JSON.stringify(webapp.title || "XFE App")} }]
+export const Layout = ({ children }: { children: ReactNode }) => createElement(Document, { children, lang: ${JSON.stringify(webapp.lang || "zh-CN")}, themeColor: ${JSON.stringify(webapp.themeColor)} })
+export default function Root() { return ${layoutSource ? "createElement(AppLayout, { children: createElement(Outlet) })" : "createElement(Outlet)"} }
+export function ErrorBoundary() { return createElement(PageError, { ${hasErrorView ? "view: ErrorView" : ""} }) }
+export function HydrateFallback() { return createElement(PageLoading) }
+`;
+};
+var getFrameworkRoot = (projectRoot) => path2.join(projectRoot, "node_modules/.cache/xfe-web/react-router");
+var prepareFramework = (projectRoot = process.cwd()) => {
+  const sourceDirectory = path2.join(projectRoot, "src");
+  const rootSource = findSource(sourceDirectory, "root");
+  const appServerSource = findSource(sourceDirectory, "app.server");
+  const pagesSource = path2.join(sourceDirectory, "pages");
+  if (!fs2.existsSync(pagesSource)) throw new Error("\u672A\u627E\u5230 src/pages");
+  const rootDirectory = getFrameworkRoot(projectRoot);
+  const appDirectory = path2.join(rootDirectory, "app");
+  fs2.mkdirSync(appDirectory, { recursive: true });
+  const routerDirectory = path2.dirname(requireFromFramework.resolve("react-router/package.json"));
+  const routerLink = path2.join(rootDirectory, "node_modules/react-router");
+  fs2.mkdirSync(path2.dirname(routerLink), { recursive: true });
+  if (!fs2.lstatSync(routerLink, { throwIfNoEntry: false })?.isSymbolicLink() || fs2.readlinkSync(routerLink) !== routerDirectory) {
+    fs2.rmSync(routerLink, { force: true });
+    fs2.symlinkSync(routerDirectory, routerLink, "junction");
+  }
+  const rootTarget = path2.join(appDirectory, "root.tsx");
+  const rootImport = rootSource ? importPath(appDirectory, rootSource) : "";
+  const rootExports = rootSource ? findValueExports(rootSource).filter((name) => name !== "middleware" || !appServerSource) : [];
+  const namedExports = rootExports.length ? `export { ${rootExports.join(", ")} } from ${JSON.stringify(rootImport)}
+` : "";
+  const errorBoundaryExport = rootExports.includes("ErrorBoundary") ? "" : "export { DefaultErrorBoundary as ErrorBoundary } from '@xfe-repo/web-router/errors'\n";
+  const middlewareExport = appServerSource ? `export { middleware } from ${JSON.stringify(importPath(appDirectory, appServerSource))}
+` : "";
+  writeGenerated(
+    rootTarget,
+    rootSource ? `export * from ${JSON.stringify(rootImport)}
+export { default } from ${JSON.stringify(rootImport)}
+${namedExports}${errorBoundaryExport}${middlewareExport}` : `${defaultRootSource(projectRoot, appDirectory)}${middlewareExport}`
+  );
+  const pagesLink = path2.join(appDirectory, "pages");
+  if (!fs2.existsSync(pagesLink)) fs2.symlinkSync(path2.relative(appDirectory, pagesSource), pagesLink, "dir");
+  writeGenerated(
+    path2.join(rootDirectory, "react-router.config.js"),
+    "export { default } from '@xfe-repo/web-app/dist/react-router-config.mjs'\n"
+  );
+  writeGenerated(
+    path2.join(appDirectory, "routes.js"),
+    `import { collectPageRoutes } from '@xfe-repo/web-router/routes'
+export default collectPageRoutes(${JSON.stringify(appDirectory)})
+`
+  );
+  const defaultsDirectory = path2.join(path2.dirname(requireFromFramework.resolve("@react-router/dev/package.json")), "dist/config/defaults");
+  writeGenerated(
+    path2.join(appDirectory, "entry.server.tsx"),
+    `export { default, streamTimeout } from ${JSON.stringify(importPath(appDirectory, path2.join(defaultsDirectory, "entry.server.web.tsx")))}
+`
+  );
+  const typeScriptConfig = path2.join(rootDirectory, "tsconfig.json");
+  writeGenerated(
+    typeScriptConfig,
+    JSON.stringify(
+      {
+        extends: path2.join(projectRoot, "tsconfig.json"),
+        compilerOptions: { rootDirs: [projectRoot, rootDirectory, path2.join(rootDirectory, ".react-router/types")] },
+        include: [
+          path2.join(sourceDirectory, "**/*"),
+          path2.join(projectRoot, "types/**/*"),
+          path2.join(appDirectory, "*.tsx"),
+          path2.join(rootDirectory, ".react-router/types/**/*")
+        ],
+        exclude: []
+      },
+      null,
+      2
+    )
+  );
+  return {
+    appDirectory,
+    rootDirectory,
+    viteConfig: path2.resolve(frameworkDirectory, "vite.mjs"),
+    typeScriptConfig
+  };
+};
+
+// src/node.ts
+var NODE_OUTPUT = "server/node.mjs";
+var HMR_PATH = "/_xfe/hmr";
+var SHUTDOWN_TIMEOUT = 3e4;
+async function buildNode({ projectRoot, webapp }) {
+  const { build } = await import("esbuild");
+  const entry = getServerEntry(projectRoot, webapp);
+  if (!entry) throw new Error("\u7F3A\u5C11 xfe.json.webapp.serverEntry");
+  if (webapp.renderMode === "client") await rm(path3.join(getBuildDirectory(projectRoot, webapp), "server"), { recursive: true, force: true });
+  await build({
+    absWorkingDir: projectRoot,
+    entryPoints: [entry],
+    outfile: path3.join(getBuildDirectory(projectRoot, webapp), NODE_OUTPUT),
+    tsconfig: path3.join(projectRoot, "tsconfig.json"),
+    bundle: true,
+    packages: "external",
+    platform: "node",
+    format: "esm",
+    target: "node22.22",
+    sourcemap: true
+  });
+}
+async function runNode({ projectRoot, webapp, development }) {
+  const entry = development ? getServerEntry(projectRoot, webapp) : path3.join(getBuildDirectory(projectRoot, webapp), NODE_OUTPUT);
+  if (!entry) throw new Error("\u7F3A\u5C11 xfe.json.webapp.serverEntry");
+  if (development) {
+    const { loadEnv } = await import("vite");
+    Object.assign(process.env, { ...loadEnv("development", projectRoot, ""), ...process.env });
+  } else process.env.NODE_ENV ??= "production";
+  const module = await import(pathToFileURL(entry).href);
+  if (typeof module.default !== "function") throw new Error("serverEntry \u5FC5\u987B\u9ED8\u8BA4\u5BFC\u51FA Node \u670D\u52A1\u5DE5\u5382\u51FD\u6570");
+  const frontend = express().disable("x-powered-by");
+  const application = await module.default({ frontend, mode: development ? "development" : "production" });
+  const upgrades = /* @__PURE__ */ new Set();
+  let vite;
+  let closing;
+  const close = () => closing ??= disposeApplication(application, { vite, upgrades });
+  const onSignal = async () => {
+    try {
+      await close();
+    } catch (error) {
+      console.error("XFE Node \u5173\u95ED\u5931\u8D25:", error);
+      process.exit(1);
+    } finally {
+      process.off("SIGINT", onSignal);
+      process.off("SIGTERM", onSignal);
+    }
+  };
+  try {
+    const server = application?.server;
+    if (!(server instanceof Server) || server.listening) throw new Error("Node \u5DE5\u5382\u5FC5\u987B\u8FD4\u56DE\u5C1A\u672A listen \u7684 http.Server");
+    if (server.listenerCount("upgrade")) throw new Error("\u8BF7\u901A\u8FC7\u5DE5\u5382\u8FD4\u56DE\u7684 upgrade \u5904\u7406\u5347\u7EA7\uFF0C\u4E0D\u8981\u76F4\u63A5\u6CE8\u518C server \u7684 upgrade \u4E8B\u4EF6");
+    const hmrPath = path3.posix.join(webapp.basename || "/", HMR_PATH);
+    server.on(
+      "upgrade",
+      /** HMR 与业务互斥分流，升级连接由关闭流程统一回收。 */
+      (request, socket, head) => {
+        upgrades.add(socket);
+        socket.once(
+          "close",
+          /** 不保留已经断开的升级连接。 */
+          () => upgrades.delete(socket)
+        );
+        if (development && request.url?.split("?")[0] === hmrPath) {
+          if (!["vite-hmr", "vite-ping"].includes(String(request.headers["sec-websocket-protocol"]))) socket.destroy();
+          return;
+        }
+        if (application.upgrade) application.upgrade(request, socket, head);
+        else socket.destroy();
+      }
+    );
+    if (development) vite = await createDevelopmentServer(server, projectRoot);
+    await mountFrontend(frontend, { projectRoot, webapp, vite });
+    const listening = once(server, "listening");
+    const host = process.env.HOST || webapp.host || "0.0.0.0";
+    const port = Number(process.env.PORT ?? webapp.port ?? 3e3);
+    server.listen(port, host);
+    await listening;
+    console.info(`XFE Node: http://${host}:${port}`);
+    process.on("SIGINT", onSignal);
+    process.on("SIGTERM", onSignal);
+  } catch (error) {
+    await close();
+    throw error;
+  }
+}
+async function createDevelopmentServer(server, projectRoot) {
+  const { createServer } = await import("vite");
+  const framework = prepareFramework(projectRoot);
+  const events = [[process, "SIGINT"], [process, "SIGTERM"], [process.stdin, "end"]];
+  const snapshots = events.map(
+    /** 只记录当前监听，恢复时保留宿主和业务原有的处理器。 */
+    ([source, event]) => ({ source, event, listeners: new Set(source.listeners(event)) })
+  );
+  try {
+    return await createServer({
+      root: framework.rootDirectory,
+      configFile: framework.viteConfig,
+      server: { middlewareMode: true, ws: { server, path: HMR_PATH } },
+      appType: "custom"
+    });
+  } finally {
+    for (const { source, event, listeners } of snapshots) {
+      for (const listener of source.listeners(event)) {
+        if (!listeners.has(listener)) source.removeListener(event, listener);
+      }
+    }
+  }
+}
+async function mountFrontend(frontend, { projectRoot, webapp, vite }) {
+  let build;
+  if (vite) {
+    const { isRunnableDevEnvironment } = await import("vite");
+    const environment = vite.environments.ssr;
+    if (!isRunnableDevEnvironment(environment)) throw new Error("React Router \u5F00\u53D1\u73AF\u5883\u672A\u5C31\u7EEA");
+    frontend.use(vite.middlewares);
+    build = async () => environment.runner.import("virtual:react-router/server-build");
+  } else {
+    const directory = getBuildDirectory(projectRoot, webapp);
+    const basename = webapp.basename || "/";
+    frontend.use(path3.posix.join(basename, "assets"), express.static(path3.join(directory, "client/assets"), { immutable: true, maxAge: "1y", fallthrough: false }));
+    frontend.use(basename, express.static(path3.join(directory, "client")));
+    if (webapp.renderMode === "client") {
+      frontend.get(
+        path3.posix.join(basename, "{*path}"),
+        /** SPA 深链接始终返回构建后的首页。 */
+        (_request, response) => response.sendFile(path3.join(directory, "client/index.html"))
+      );
+      return;
+    }
+    build = await import(pathToFileURL(path3.join(directory, "server/index.js")).href);
+  }
+  const { createRequestHandler } = await import("@react-router/express");
+  frontend.use(createRequestHandler({ build, mode: vite ? "development" : "production" }));
+}
+async function disposeApplication(application, { vite, upgrades }) {
+  const server = application?.server instanceof Server ? application.server : void 0;
+  const forced = setTimeout(
+    /** 生产关闭时中断超过等待上限的普通 HTTP 请求。 */
+    () => server?.closeAllConnections(),
+    SHUTDOWN_TIMEOUT
+  );
+  forced.unref();
+  try {
+    const drained = server?.listening ? server[Symbol.asyncDispose]() : void 0;
+    for (const socket of upgrades) socket.destroy();
+    const results = await Promise.allSettled([drained, vite?.close()]);
+    await application?.close?.();
+    const failure = results.find((result) => result.status === "rejected");
+    if (failure?.status === "rejected") throw failure.reason;
+  } finally {
+    clearTimeout(forced);
+  }
+}
+export {
+  buildNode,
+  runNode
+};

package/dist/react-router-config.js

@@ -33,25 +33,70 @@ __export(react_router_config_exports, {
   default: () => react_router_config_default
 });
 module.exports = __toCommonJS(react_router_config_exports);
-var import_node_path = __toESM(require("path"));
 
 // src/config.ts
-var import_path = __toESM(require("path"));
-var import_fs = __toESM(require("fs"));
+var import_node_fs = __toESM(require("fs"));
+var import_node_path = __toESM(require("path"));
+var import_node_url = require("url");
 var import_yaml = __toESM(require("yaml"));
+var import_meta = {};
+var DEFAULT_BUILD_DIRECTORY = "dist";
+var protectedDirectories = /* @__PURE__ */ new Set(["src", "types", "public", "node_modules", ".git"]);
+var configDirectory = typeof __dirname === "string" ? __dirname : import_node_path.default.dirname((0, import_node_url.fileURLToPath)(import_meta.url));
 var loadXfeConfig = (root = process.cwd()) => {
-  const xfeConfigPath = import_path.default.join(root, "xfe.json");
-  if (!import_fs.default.existsSync(xfeConfigPath)) {
+  const xfeConfigPath = import_node_path.default.join(root, "xfe.json");
+  if (!import_node_fs.default.existsSync(xfeConfigPath)) {
     throw new Error("xfe.json \u914D\u7F6E\u6587\u4EF6\u4E0D\u5B58\u5728\uFF0C\u8BF7\u5728\u9879\u76EE\u6839\u76EE\u5F55\u4E0B\u521B\u5EFA\u8BE5\u6587\u4EF6\u3002");
   }
-  const xfeConfigContent = import_fs.default.readFileSync(xfeConfigPath, "utf8");
+  const xfeConfigContent = import_node_fs.default.readFileSync(xfeConfigPath, "utf8");
   const config = JSON.parse(xfeConfigContent);
   const renderMode = config.webapp?.renderMode;
   if (renderMode !== void 0 && renderMode !== "client" && renderMode !== "server") {
     throw new Error("xfe.json.webapp.renderMode \u53EA\u80FD\u4E3A client \u6216 server");
   }
+  getBuildDirectory(root, config.webapp);
+  getServerEntry(root, config.webapp);
   return config;
 };
+var getBuildDirectory = (projectRoot2, webapp2 = {}) => {
+  const configured = webapp2?.buildDirectory === void 0 ? DEFAULT_BUILD_DIRECTORY : webapp2.buildDirectory;
+  if (typeof configured !== "string" || !configured.trim() || /[\0\r\n]/.test(configured)) {
+    throw new Error("xfe.json.webapp.buildDirectory \u5FC5\u987B\u662F\u975E\u7A7A\u7684\u5355\u884C\u5B57\u7B26\u4E32");
+  }
+  const directory = configured.trim().replaceAll("\\", "/");
+  const root = import_node_path.default.resolve(projectRoot2);
+  const output = import_node_path.default.resolve(root, directory);
+  const relative = import_node_path.default.relative(root, output);
+  const [firstDirectory = ""] = relative.split(import_node_path.default.sep);
+  const escapesProject = import_node_path.default.isAbsolute(directory) || Boolean(import_node_path.default.win32.parse(directory).root) || firstDirectory === "..";
+  const overwritesInput = !relative || protectedDirectories.has(firstDirectory.toLowerCase());
+  if (escapesProject || overwritesInput) {
+    throw new Error("xfe.json.webapp.buildDirectory \u5FC5\u987B\u662F\u9879\u76EE\u5185\u72EC\u7ACB\u7684\u8F93\u51FA\u76EE\u5F55\uFF0C\u4E0D\u80FD\u8986\u76D6\u9879\u76EE\u3001\u6E90\u7801\u6216\u4F9D\u8D56");
+  }
+  let currentDirectory = root;
+  for (const segment of relative.split(import_node_path.default.sep)) {
+    currentDirectory = import_node_path.default.join(currentDirectory, segment);
+    if (import_node_fs.default.lstatSync(currentDirectory, { throwIfNoEntry: false })?.isSymbolicLink()) {
+      throw new Error("xfe.json.webapp.buildDirectory \u4E0D\u80FD\u7ECF\u8FC7\u7B26\u53F7\u94FE\u63A5\uFF0C\u4EE5\u514D\u6E05\u7406\u5176\u4ED6\u76EE\u5F55");
+    }
+  }
+  return output;
+};
+var getServerEntry = (projectRoot2, webapp2 = {}) => {
+  const entry = webapp2?.serverEntry;
+  if (entry === void 0) return;
+  if (typeof entry !== "string" || !entry.trim() || /[\0\r\n]/.test(entry)) {
+    throw new Error("xfe.json.webapp.serverEntry \u5FC5\u987B\u662F\u9879\u76EE\u5185\u7684 TypeScript / JavaScript \u76F8\u5BF9\u8DEF\u5F84");
+  }
+  const normalized = entry.trim().replaceAll("\\", "/");
+  const absolute = import_node_path.default.resolve(projectRoot2, normalized);
+  const relative = import_node_path.default.relative(import_node_path.default.resolve(projectRoot2), absolute);
+  const outside = Boolean(import_node_path.default.win32.parse(normalized).root) || relative.split(import_node_path.default.sep)[0] === "..";
+  if (outside || !/\.(?:[jt]sx?|m[jt]s)$/.test(relative)) {
+    throw new Error("xfe.json.webapp.serverEntry \u5FC5\u987B\u662F\u9879\u76EE\u5185\u7684 TypeScript / JavaScript \u76F8\u5BF9\u8DEF\u5F84");
+  }
+  return absolute;
+};
 
 // src/react-router-config.ts
 var projectRoot = process.env.XFE_WEB_ROOT;
@@ -60,7 +105,7 @@ var { webapp = {} } = loadXfeConfig(projectRoot);
 var react_router_config_default = {
   appDirectory: "app",
   basename: webapp.basename || "/",
-  buildDirectory: import_node_path.default.join(projectRoot, "build"),
+  buildDirectory: getBuildDirectory(projectRoot, webapp),
   future: { unstable_optimizeDeps: true },
   ssr: webapp.renderMode !== "client"
 };

package/dist/react-router-config.mjs

@@ -1,10 +1,11 @@
-// src/react-router-config.ts
-import path2 from "path";
-
 // src/config.ts
-import path from "path";
 import fs from "fs";
+import path from "path";
+import { fileURLToPath } from "url";
 import yaml from "yaml";
+var DEFAULT_BUILD_DIRECTORY = "dist";
+var protectedDirectories = /* @__PURE__ */ new Set(["src", "types", "public", "node_modules", ".git"]);
+var configDirectory = typeof __dirname === "string" ? __dirname : path.dirname(fileURLToPath(import.meta.url));
 var loadXfeConfig = (root = process.cwd()) => {
   const xfeConfigPath = path.join(root, "xfe.json");
   if (!fs.existsSync(xfeConfigPath)) {
@@ -16,8 +17,49 @@ var loadXfeConfig = (root = process.cwd()) => {
   if (renderMode !== void 0 && renderMode !== "client" && renderMode !== "server") {
     throw new Error("xfe.json.webapp.renderMode \u53EA\u80FD\u4E3A client \u6216 server");
   }
+  getBuildDirectory(root, config.webapp);
+  getServerEntry(root, config.webapp);
   return config;
 };
+var getBuildDirectory = (projectRoot2, webapp2 = {}) => {
+  const configured = webapp2?.buildDirectory === void 0 ? DEFAULT_BUILD_DIRECTORY : webapp2.buildDirectory;
+  if (typeof configured !== "string" || !configured.trim() || /[\0\r\n]/.test(configured)) {
+    throw new Error("xfe.json.webapp.buildDirectory \u5FC5\u987B\u662F\u975E\u7A7A\u7684\u5355\u884C\u5B57\u7B26\u4E32");
+  }
+  const directory = configured.trim().replaceAll("\\", "/");
+  const root = path.resolve(projectRoot2);
+  const output = path.resolve(root, directory);
+  const relative = path.relative(root, output);
+  const [firstDirectory = ""] = relative.split(path.sep);
+  const escapesProject = path.isAbsolute(directory) || Boolean(path.win32.parse(directory).root) || firstDirectory === "..";
+  const overwritesInput = !relative || protectedDirectories.has(firstDirectory.toLowerCase());
+  if (escapesProject || overwritesInput) {
+    throw new Error("xfe.json.webapp.buildDirectory \u5FC5\u987B\u662F\u9879\u76EE\u5185\u72EC\u7ACB\u7684\u8F93\u51FA\u76EE\u5F55\uFF0C\u4E0D\u80FD\u8986\u76D6\u9879\u76EE\u3001\u6E90\u7801\u6216\u4F9D\u8D56");
+  }
+  let currentDirectory = root;
+  for (const segment of relative.split(path.sep)) {
+    currentDirectory = path.join(currentDirectory, segment);
+    if (fs.lstatSync(currentDirectory, { throwIfNoEntry: false })?.isSymbolicLink()) {
+      throw new Error("xfe.json.webapp.buildDirectory \u4E0D\u80FD\u7ECF\u8FC7\u7B26\u53F7\u94FE\u63A5\uFF0C\u4EE5\u514D\u6E05\u7406\u5176\u4ED6\u76EE\u5F55");
+    }
+  }
+  return output;
+};
+var getServerEntry = (projectRoot2, webapp2 = {}) => {
+  const entry = webapp2?.serverEntry;
+  if (entry === void 0) return;
+  if (typeof entry !== "string" || !entry.trim() || /[\0\r\n]/.test(entry)) {
+    throw new Error("xfe.json.webapp.serverEntry \u5FC5\u987B\u662F\u9879\u76EE\u5185\u7684 TypeScript / JavaScript \u76F8\u5BF9\u8DEF\u5F84");
+  }
+  const normalized = entry.trim().replaceAll("\\", "/");
+  const absolute = path.resolve(projectRoot2, normalized);
+  const relative = path.relative(path.resolve(projectRoot2), absolute);
+  const outside = Boolean(path.win32.parse(normalized).root) || relative.split(path.sep)[0] === "..";
+  if (outside || !/\.(?:[jt]sx?|m[jt]s)$/.test(relative)) {
+    throw new Error("xfe.json.webapp.serverEntry \u5FC5\u987B\u662F\u9879\u76EE\u5185\u7684 TypeScript / JavaScript \u76F8\u5BF9\u8DEF\u5F84");
+  }
+  return absolute;
+};
 
 // src/react-router-config.ts
 var projectRoot = process.env.XFE_WEB_ROOT;
@@ -26,7 +68,7 @@ var { webapp = {} } = loadXfeConfig(projectRoot);
 var react_router_config_default = {
   appDirectory: "app",
   basename: webapp.basename || "/",
-  buildDirectory: path2.join(projectRoot, "build"),
+  buildDirectory: getBuildDirectory(projectRoot, webapp),
   future: { unstable_optimizeDeps: true },
   ssr: webapp.renderMode !== "client"
 };

package/dist/vite.d.mts

@@ -4,6 +4,7 @@ declare const adaptPageRoute: (code: string, options: string | {
     id: string;
     clientOnly?: boolean;
 }) => string | undefined;
+/** Node 入口按 basename 托管前端，构建与开发必须生成相同前缀的资源 URL。 */
 declare const _default: vite.UserConfigFnObject;
 
 export { adaptPageRoute, _default as default };

package/dist/vite.d.ts

@@ -4,6 +4,7 @@ declare const adaptPageRoute: (code: string, options: string | {
     id: string;
     clientOnly?: boolean;
 }) => string | undefined;
+/** Node 入口按 basename 托管前端，构建与开发必须生成相同前缀的资源 URL。 */
 declare const _default: vite.UserConfigFnObject;
 
 export { adaptPageRoute, _default as default };

package/dist/vite.js

@@ -34,28 +34,74 @@ __export(vite_exports, {
   default: () => vite_default
 });
 module.exports = __toCommonJS(vite_exports);
-var import_node_path = __toESM(require("path"));
-var import_node_fs = require("fs");
+var import_node_path2 = __toESM(require("path"));
+var import_node_fs2 = require("fs");
 var import_vite = require("@react-router/dev/vite");
 var import_vite2 = require("vite");
 
 // src/config.ts
-var import_path = __toESM(require("path"));
-var import_fs = __toESM(require("fs"));
+var import_node_fs = __toESM(require("fs"));
+var import_node_path = __toESM(require("path"));
+var import_node_url = require("url");
 var import_yaml = __toESM(require("yaml"));
+var import_meta = {};
+var DEFAULT_BUILD_DIRECTORY = "dist";
+var protectedDirectories = /* @__PURE__ */ new Set(["src", "types", "public", "node_modules", ".git"]);
+var configDirectory = typeof __dirname === "string" ? __dirname : import_node_path.default.dirname((0, import_node_url.fileURLToPath)(import_meta.url));
 var loadXfeConfig = (root = process.cwd()) => {
-  const xfeConfigPath = import_path.default.join(root, "xfe.json");
-  if (!import_fs.default.existsSync(xfeConfigPath)) {
+  const xfeConfigPath = import_node_path.default.join(root, "xfe.json");
+  if (!import_node_fs.default.existsSync(xfeConfigPath)) {
     throw new Error("xfe.json \u914D\u7F6E\u6587\u4EF6\u4E0D\u5B58\u5728\uFF0C\u8BF7\u5728\u9879\u76EE\u6839\u76EE\u5F55\u4E0B\u521B\u5EFA\u8BE5\u6587\u4EF6\u3002");
   }
-  const xfeConfigContent = import_fs.default.readFileSync(xfeConfigPath, "utf8");
+  const xfeConfigContent = import_node_fs.default.readFileSync(xfeConfigPath, "utf8");
   const config = JSON.parse(xfeConfigContent);
   const renderMode = config.webapp?.renderMode;
   if (renderMode !== void 0 && renderMode !== "client" && renderMode !== "server") {
     throw new Error("xfe.json.webapp.renderMode \u53EA\u80FD\u4E3A client \u6216 server");
   }
+  getBuildDirectory(root, config.webapp);
+  getServerEntry(root, config.webapp);
   return config;
 };
+var getBuildDirectory = (projectRoot, webapp = {}) => {
+  const configured = webapp?.buildDirectory === void 0 ? DEFAULT_BUILD_DIRECTORY : webapp.buildDirectory;
+  if (typeof configured !== "string" || !configured.trim() || /[\0\r\n]/.test(configured)) {
+    throw new Error("xfe.json.webapp.buildDirectory \u5FC5\u987B\u662F\u975E\u7A7A\u7684\u5355\u884C\u5B57\u7B26\u4E32");
+  }
+  const directory = configured.trim().replaceAll("\\", "/");
+  const root = import_node_path.default.resolve(projectRoot);
+  const output = import_node_path.default.resolve(root, directory);
+  const relative = import_node_path.default.relative(root, output);
+  const [firstDirectory = ""] = relative.split(import_node_path.default.sep);
+  const escapesProject = import_node_path.default.isAbsolute(directory) || Boolean(import_node_path.default.win32.parse(directory).root) || firstDirectory === "..";
+  const overwritesInput = !relative || protectedDirectories.has(firstDirectory.toLowerCase());
+  if (escapesProject || overwritesInput) {
+    throw new Error("xfe.json.webapp.buildDirectory \u5FC5\u987B\u662F\u9879\u76EE\u5185\u72EC\u7ACB\u7684\u8F93\u51FA\u76EE\u5F55\uFF0C\u4E0D\u80FD\u8986\u76D6\u9879\u76EE\u3001\u6E90\u7801\u6216\u4F9D\u8D56");
+  }
+  let currentDirectory = root;
+  for (const segment of relative.split(import_node_path.default.sep)) {
+    currentDirectory = import_node_path.default.join(currentDirectory, segment);
+    if (import_node_fs.default.lstatSync(currentDirectory, { throwIfNoEntry: false })?.isSymbolicLink()) {
+      throw new Error("xfe.json.webapp.buildDirectory \u4E0D\u80FD\u7ECF\u8FC7\u7B26\u53F7\u94FE\u63A5\uFF0C\u4EE5\u514D\u6E05\u7406\u5176\u4ED6\u76EE\u5F55");
+    }
+  }
+  return output;
+};
+var getServerEntry = (projectRoot, webapp = {}) => {
+  const entry = webapp?.serverEntry;
+  if (entry === void 0) return;
+  if (typeof entry !== "string" || !entry.trim() || /[\0\r\n]/.test(entry)) {
+    throw new Error("xfe.json.webapp.serverEntry \u5FC5\u987B\u662F\u9879\u76EE\u5185\u7684 TypeScript / JavaScript \u76F8\u5BF9\u8DEF\u5F84");
+  }
+  const normalized = entry.trim().replaceAll("\\", "/");
+  const absolute = import_node_path.default.resolve(projectRoot, normalized);
+  const relative = import_node_path.default.relative(import_node_path.default.resolve(projectRoot), absolute);
+  const outside = Boolean(import_node_path.default.win32.parse(normalized).root) || relative.split(import_node_path.default.sep)[0] === "..";
+  if (outside || !/\.(?:[jt]sx?|m[jt]s)$/.test(relative)) {
+    throw new Error("xfe.json.webapp.serverEntry \u5FC5\u987B\u662F\u9879\u76EE\u5185\u7684 TypeScript / JavaScript \u76F8\u5BF9\u8DEF\u5F84");
+  }
+  return absolute;
+};
 
 // src/vite.ts
 var chromeDevToolsConfigPath = "/.well-known/appspecific/com.chrome.devtools.json";
@@ -87,11 +133,12 @@ var vite_default = (0, import_vite2.defineConfig)(({ mode }) => {
   const { webapp = {} } = loadXfeConfig(projectRoot);
   const publicEnv = (key) => process.env[key] || env[key] || "";
   return {
+    ...webapp.serverEntry ? { base: import_node_path2.default.posix.join(webapp.basename || "/", "/") } : {},
     plugins: [frameworkPlugin(webapp.renderMode === "client"), (0, import_vite.reactRouter)()],
     build: { emptyOutDir: true },
     envDir: projectRoot,
     envPrefix: ["VITE_", "REACT_APP_"],
-    publicDir: import_node_path.default.join(projectRoot, "public"),
+    publicDir: import_node_path2.default.join(projectRoot, "public"),
     define: {
       "import.meta.env.XFE_JWT_AUD": JSON.stringify(publicEnv("XFE_JWT_AUD")),
       "import.meta.env.XFE_JWT_KEY_ID": JSON.stringify(publicEnv("XFE_JWT_KEY_ID")),
@@ -106,7 +153,7 @@ var vite_default = (0, import_vite2.defineConfig)(({ mode }) => {
       preprocessorOptions: {
         less: {
           javascriptEnabled: true,
-          paths: [import_node_path.default.join(projectRoot, "src")]
+          paths: [import_node_path2.default.join(projectRoot, "src")]
         }
       }
     },
@@ -114,7 +161,7 @@ var vite_default = (0, import_vite2.defineConfig)(({ mode }) => {
       tsconfigPaths: true,
       // workspace 和本地框架链接均使用消费应用的 React 与状态管理实例。
       dedupe: ["react", "react-dom", "react-redux", "@reduxjs/toolkit"].filter(
-        (name) => (0, import_node_fs.existsSync)(import_node_path.default.join(projectRoot, "node_modules", name))
+        (name) => (0, import_node_fs2.existsSync)(import_node_path2.default.join(projectRoot, "node_modules", name))
       )
     },
     ssr: {