ignotum 0.0.3 → 0.0.5

package/src/cli/build/client.ts

@@ -0,0 +1,111 @@
+import { Array, Effect, FileSystem, Path, String } from "effect";
+import tailwindcss from "@tailwindcss/vite";
+import { sha256 } from "@ignotum/deployment";
+import type { ClientRoute } from "@ignotum/contracts/deployment";
+
+import { resolveClientBuildConfig, validateClientFiles } from "../client-config.js";
+import { loadClientEntryTitle } from "../client-entry.js";
+import { clientEntryId, ignotumClientPlugin, renderClientDocument } from "../client-plugin.js";
+import { moduleBoundariesPlugin } from "../module-boundaries.js";
+import { InvalidBuildOutput, runViteBuild } from "./artifact.js";
+import { copyPublicFiles } from "./public.js";
+
+export interface ClientBuildResult {
+  readonly assets: number;
+  readonly routes: ReadonlyArray<ClientRoute>;
+  readonly shellPath: string;
+}
+
+export const buildClient = Effect.fn("Deploy.buildClient")(function* (
+  appDirectory: string,
+  outputDirectory: string,
+) {
+  const fileSystem = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const clientFiles = yield* validateClientFiles(appDirectory);
+  const clientDirectory = clientFiles.clientDirectory;
+  const title = yield* loadClientEntryTitle(clientFiles.entryPath);
+  const clientConfig = yield* resolveClientBuildConfig(false);
+  const boundaries = yield* moduleBoundariesPlugin("Client", appDirectory);
+
+  yield* fileSystem.makeDirectory(outputDirectory, { recursive: true });
+
+  const output = yield* runViteBuild("client", {
+    appType: "spa",
+    build: {
+      assetsDir: "_ignotum/assets",
+      emptyOutDir: true,
+      outDir: outputDirectory,
+      rolldownOptions: {
+        input: clientEntryId,
+        output: {
+          assetFileNames: (asset) =>
+            asset.names.some((name) => name.endsWith(".css"))
+              ? "_ignotum/assets/styles-[hash][extname]"
+              : "_ignotum/assets/[name]-[hash][extname]",
+          chunkFileNames: "_ignotum/assets/chunks/[name]-[hash].js",
+          entryFileNames: "_ignotum/assets/main-[hash].js",
+        },
+      },
+      sourcemap: false,
+    },
+    configFile: false,
+    logLevel: "warn",
+    mode: "production",
+    oxc: {
+      jsx: {
+        importSource: "ignotum/client",
+        runtime: "automatic",
+      },
+    },
+    plugins: [
+      boundaries,
+      ignotumClientPlugin({ development: false, icon: undefined, loadTitle: undefined }),
+      tailwindcss(),
+    ],
+    publicDir: false,
+    resolve: {
+      alias: clientConfig.aliases,
+      conditions: [...clientConfig.conditions],
+      dedupe: ["preact"],
+      tsconfigPaths: true,
+    },
+    root: clientDirectory,
+  });
+  const entry = Array.findFirst(output, (item) => item.type === "chunk" && item.isEntry);
+  const entryFile = yield* Effect.fromOption(entry, () =>
+    InvalidBuildOutput.make({ message: "The client build did not emit an entry chunk." }),
+  ).pipe(Effect.map((item) => item.fileName));
+  const styles = Array.sort(String.Order)(
+    Array.map(
+      Array.filter(output, (item) => item.type === "asset" && item.fileName.endsWith(".css")),
+      (item) => item.fileName,
+    ),
+  );
+  let icon: string | undefined;
+  if (clientFiles.iconPath !== undefined) {
+    const bytes = yield* fileSystem.readFile(clientFiles.iconPath);
+    const digest = yield* sha256(bytes);
+    const fileName = `icon-${digest}.svg`;
+    const assetsDirectory = path.join(outputDirectory, "_ignotum", "assets");
+    yield* fileSystem.makeDirectory(assetsDirectory, { recursive: true });
+    yield* fileSystem.writeFile(path.join(assetsDirectory, fileName), bytes);
+    icon = `/_ignotum/assets/${fileName}`;
+  }
+  const shellPath = path.join(outputDirectory, "_shell.html");
+  const document = renderClientDocument({
+    icon,
+    scripts: [{ source: entryFile, type: "External" }],
+    styles,
+    title,
+  });
+
+  yield* fileSystem.writeFileString(shellPath, document);
+  const publicBuild = yield* copyPublicFiles(appDirectory, outputDirectory);
+
+  return {
+    assets: output.length + (icon === undefined ? 0 : 1) + publicBuild.files,
+    routes: publicBuild.routes,
+    shellPath,
+  } satisfies ClientBuildResult;
+});

package/src/cli/build/public.ts

@@ -0,0 +1,182 @@
+import {
+  ArtifactPath,
+  ClientPath,
+  clientPublicFileExtensions,
+  deploymentArtifactLimits,
+  type ClientRoute,
+} from "@ignotum/contracts/deployment";
+import { Effect, FileSystem, Option, Path, Schema } from "effect";
+
+export class InvalidPublicFile extends Schema.TaggedError<InvalidPublicFile>()(
+  "InvalidPublicFile",
+  {
+    message: Schema.String,
+    path: Schema.String,
+  },
+) {}
+
+export interface PublicBuildResult {
+  readonly files: number;
+  readonly routes: ReadonlyArray<ClientRoute>;
+}
+
+interface PublicFile {
+  readonly bytes: Uint8Array;
+  readonly destination: string;
+  readonly route: ClientRoute;
+  readonly source: string;
+}
+
+const pathSegmentPattern = /^[A-Za-z0-9._~-]+$/;
+
+const startsWith = (bytes: Uint8Array, signature: ReadonlyArray<number>, offset = 0): boolean =>
+  signature.every((byte, index) => bytes[offset + index] === byte);
+
+const asciiAt = (bytes: Uint8Array, value: string, offset = 0): boolean =>
+  startsWith(
+    bytes,
+    globalThis.Array.from(value, (character) => character.charCodeAt(0)),
+    offset,
+  );
+
+const hasValidSignature = (extension: string, bytes: Uint8Array): boolean => {
+  switch (extension) {
+    case ".avif": {
+      if (!asciiAt(bytes, "ftyp", 4)) return false;
+      const headerLength = Math.min(bytes.length, 64);
+      for (let offset = 8; offset + 4 <= headerLength; offset += 4) {
+        if (asciiAt(bytes, "avif", offset) || asciiAt(bytes, "avis", offset)) return true;
+      }
+      return false;
+    }
+    case ".gif":
+      return asciiAt(bytes, "GIF87a") || asciiAt(bytes, "GIF89a");
+    case ".ico":
+      return startsWith(bytes, [0x00, 0x00, 0x01, 0x00]);
+    case ".jpeg":
+    case ".jpg":
+      return startsWith(bytes, [0xff, 0xd8, 0xff]);
+    case ".pdf":
+      return asciiAt(bytes, "%PDF-");
+    case ".png":
+      return startsWith(bytes, [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
+    case ".webp":
+      return asciiAt(bytes, "RIFF") && asciiAt(bytes, "WEBP", 8);
+    default:
+      return false;
+  }
+};
+
+const invalid = (path: string, message: string) => InvalidPublicFile.make({ message, path });
+
+export const copyPublicFiles = Effect.fn("Deploy.copyPublicFiles")(function* (
+  appDirectory: string,
+  outputDirectory: string,
+) {
+  const fileSystem = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const publicDirectory = path.join(appDirectory, "public");
+  if (!(yield* fileSystem.exists(publicDirectory))) {
+    return { files: 0, routes: [] } satisfies PublicBuildResult;
+  }
+
+  if (Option.isSome(yield* Effect.option(fileSystem.readLink(publicDirectory)))) {
+    return yield* invalid(
+      publicDirectory,
+      "The top-level public directory cannot be a symbolic link.",
+    );
+  }
+  const publicInfo = yield* fileSystem.stat(publicDirectory);
+  if (publicInfo.type !== "Directory") {
+    return yield* invalid(publicDirectory, "The top-level public path must be a directory.");
+  }
+
+  const entries = (yield* fileSystem.readDirectory(publicDirectory, {
+    recursive: true,
+  })).toSorted();
+  const publicFiles = yield* Effect.forEach(entries, (entry) =>
+    Effect.gen(function* () {
+      const relativePath = entry.replaceAll("\\", "/");
+      const source = path.join(publicDirectory, entry);
+      if (Option.isSome(yield* Effect.option(fileSystem.readLink(source)))) {
+        return yield* invalid(source, "Public entries cannot be symbolic links.");
+      }
+      const info = yield* fileSystem.stat(source);
+      if (info.type === "Directory") return undefined;
+      if (info.type !== "File") {
+        return yield* invalid(source, "Public entries must be regular files or directories.");
+      }
+
+      const segments = relativePath.split("/");
+      if (segments.some((segment) => !pathSegmentPattern.test(segment))) {
+        return yield* invalid(
+          source,
+          "Public file paths may only contain letters, numbers, dots, underscores, tildes, hyphens, and directory separators.",
+        );
+      }
+      if (segments[0] === "_ignotum") {
+        return yield* invalid(source, "The /_ignotum namespace is reserved by the platform.");
+      }
+
+      const extension = path.extname(relativePath).toLowerCase();
+      if (!clientPublicFileExtensions.some((allowedExtension) => allowedExtension === extension)) {
+        return yield* invalid(
+          source,
+          `Unsupported public file type '${extension || "(none)"}'. Allowed types: ${clientPublicFileExtensions.join(", ")}.`,
+        );
+      }
+      if (info.size > BigInt(deploymentArtifactLimits.fileBytes)) {
+        return yield* invalid(
+          source,
+          `Public files cannot exceed ${deploymentArtifactLimits.fileBytes} bytes.`,
+        );
+      }
+
+      const bytes = yield* fileSystem.readFile(source);
+      if (!hasValidSignature(extension, bytes)) {
+        return yield* invalid(
+          source,
+          `The contents do not match the '${extension}' file extension.`,
+        );
+      }
+
+      const pathname = `/${relativePath}`;
+      return {
+        bytes,
+        destination: path.join(outputDirectory, entry),
+        route: {
+          pathname: ClientPath.make(pathname),
+          artifact: ArtifactPath.make(`client/${relativePath}`),
+        },
+        source,
+      } satisfies PublicFile;
+    }),
+  );
+  const files = publicFiles.filter((file): file is PublicFile => file !== undefined);
+
+  yield* Effect.forEach(files, (file) =>
+    Effect.gen(function* () {
+      if (yield* fileSystem.exists(file.destination)) {
+        return yield* invalid(
+          file.source,
+          `Public route '${file.route.pathname}' overlaps generated client output.`,
+        );
+      }
+    }),
+  );
+
+  yield* Effect.forEach(
+    files,
+    (file) =>
+      Effect.gen(function* () {
+        yield* fileSystem.makeDirectory(path.dirname(file.destination), { recursive: true });
+        yield* fileSystem.writeFile(file.destination, file.bytes);
+      }),
+    { discard: true },
+  );
+
+  return {
+    files: files.length,
+    routes: files.map((file) => file.route),
+  } satisfies PublicBuildResult;
+});