ignotum 0.0.4 → 0.0.6

package/src/cli/build/public.ts

@@ -0,0 +1,186 @@
+import {
+  ArtifactPath,
+  ClientPath,
+  clientPublicFileExtensions,
+  deploymentArtifactLimits,
+  type ClientRoute,
+} from "@ignotum/contracts/deployment";
+import { artifactReference } from "@ignotum/deployment";
+import { Effect, FileSystem, Option, Path, Schema } from "effect";
+
+export class InvalidPublicFile extends Schema.TaggedError<InvalidPublicFile>()(
+  "InvalidPublicFile",
+  {
+    message: Schema.String,
+    path: Schema.String,
+  },
+) {}
+
+export interface PublicBuildResult {
+  readonly files: number;
+  readonly routes: ReadonlyArray<ClientRoute>;
+}
+
+interface PublicFile {
+  readonly bytes: Uint8Array;
+  readonly destination: string;
+  readonly route: ClientRoute;
+  readonly source: string;
+}
+
+const pathSegmentPattern = /^[A-Za-z0-9._~-]+$/;
+
+const startsWith = (bytes: Uint8Array, signature: ReadonlyArray<number>, offset = 0): boolean =>
+  signature.every((byte, index) => bytes[offset + index] === byte);
+
+const asciiAt = (bytes: Uint8Array, value: string, offset = 0): boolean =>
+  startsWith(
+    bytes,
+    globalThis.Array.from(value, (character) => character.charCodeAt(0)),
+    offset,
+  );
+
+const hasValidSignature = (extension: string, bytes: Uint8Array): boolean => {
+  switch (extension) {
+    case ".avif": {
+      if (!asciiAt(bytes, "ftyp", 4)) return false;
+      const headerLength = Math.min(bytes.length, 64);
+      for (let offset = 8; offset + 4 <= headerLength; offset += 4) {
+        if (asciiAt(bytes, "avif", offset) || asciiAt(bytes, "avis", offset)) return true;
+      }
+      return false;
+    }
+    case ".gif":
+      return asciiAt(bytes, "GIF87a") || asciiAt(bytes, "GIF89a");
+    case ".ico":
+      return startsWith(bytes, [0x00, 0x00, 0x01, 0x00]);
+    case ".jpeg":
+    case ".jpg":
+      return startsWith(bytes, [0xff, 0xd8, 0xff]);
+    case ".pdf":
+      return asciiAt(bytes, "%PDF-");
+    case ".png":
+      return startsWith(bytes, [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
+    case ".webp":
+      return asciiAt(bytes, "RIFF") && asciiAt(bytes, "WEBP", 8);
+    default:
+      return false;
+  }
+};
+
+const invalid = (path: string, message: string) => InvalidPublicFile.make({ message, path });
+
+export const copyPublicFiles = Effect.fn("Deploy.copyPublicFiles")(function* (
+  appDirectory: string,
+  outputDirectory: string,
+) {
+  const fileSystem = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const publicDirectory = path.join(appDirectory, "public");
+  if (!(yield* fileSystem.exists(publicDirectory))) {
+    return { files: 0, routes: [] } satisfies PublicBuildResult;
+  }
+
+  if (Option.isSome(yield* Effect.option(fileSystem.readLink(publicDirectory)))) {
+    return yield* invalid(
+      publicDirectory,
+      "The top-level public directory cannot be a symbolic link.",
+    );
+  }
+  const publicInfo = yield* fileSystem.stat(publicDirectory);
+  if (publicInfo.type !== "Directory") {
+    return yield* invalid(publicDirectory, "The top-level public path must be a directory.");
+  }
+
+  const entries = (yield* fileSystem.readDirectory(publicDirectory, {
+    recursive: true,
+  })).toSorted();
+  const publicFiles = yield* Effect.forEach(entries, (entry) =>
+    Effect.gen(function* () {
+      const relativePath = entry.replaceAll("\\", "/");
+      const source = path.join(publicDirectory, entry);
+      if (Option.isSome(yield* Effect.option(fileSystem.readLink(source)))) {
+        return yield* invalid(source, "Public entries cannot be symbolic links.");
+      }
+      const info = yield* fileSystem.stat(source);
+      if (info.type === "Directory") return undefined;
+      if (info.type !== "File") {
+        return yield* invalid(source, "Public entries must be regular files or directories.");
+      }
+
+      const segments = relativePath.split("/");
+      if (segments.some((segment) => !pathSegmentPattern.test(segment))) {
+        return yield* invalid(
+          source,
+          "Public file paths may only contain letters, numbers, dots, underscores, tildes, hyphens, and directory separators.",
+        );
+      }
+      if (segments[0] === "_ignotum") {
+        return yield* invalid(source, "The /_ignotum namespace is reserved by the platform.");
+      }
+
+      const extension = path.extname(relativePath).toLowerCase();
+      if (!clientPublicFileExtensions.some((allowedExtension) => allowedExtension === extension)) {
+        return yield* invalid(
+          source,
+          `Unsupported public file type '${extension || "(none)"}'. Allowed types: ${clientPublicFileExtensions.join(", ")}.`,
+        );
+      }
+      if (info.size > BigInt(deploymentArtifactLimits.fileBytes)) {
+        return yield* invalid(
+          source,
+          `Public files cannot exceed ${deploymentArtifactLimits.fileBytes} bytes.`,
+        );
+      }
+
+      const bytes = yield* fileSystem.readFile(source);
+      if (!hasValidSignature(extension, bytes)) {
+        return yield* invalid(
+          source,
+          `The contents do not match the '${extension}' file extension.`,
+        );
+      }
+
+      const pathname = `/${relativePath}`;
+      return {
+        bytes,
+        destination: path.join(outputDirectory, "routes", entry),
+        route: {
+          pathname: ClientPath.make(pathname),
+          artifact: yield* artifactReference(
+            ArtifactPath.make(`client/routes/${relativePath}`),
+            bytes,
+          ),
+        },
+        source,
+      } satisfies PublicFile;
+    }),
+  );
+  const files = publicFiles.filter((file): file is PublicFile => file !== undefined);
+
+  yield* Effect.forEach(files, (file) =>
+    Effect.gen(function* () {
+      if (yield* fileSystem.exists(file.destination)) {
+        return yield* invalid(
+          file.source,
+          `Public route '${file.route.pathname}' overlaps generated client output.`,
+        );
+      }
+    }),
+  );
+
+  yield* Effect.forEach(
+    files,
+    (file) =>
+      Effect.gen(function* () {
+        yield* fileSystem.makeDirectory(path.dirname(file.destination), { recursive: true });
+        yield* fileSystem.writeFile(file.destination, file.bytes);
+      }),
+    { discard: true },
+  );
+
+  return {
+    files: files.length,
+    routes: files.map((file) => file.route),
+  } satisfies PublicBuildResult;
+});

package/src/cli/build/server.ts

@@ -429,6 +429,7 @@ const buildServerFunction = Effect.fn("Deploy.buildServerFunction")(function* (
     logLevel: "warn",
     mode: "production",
     plugins: [boundaries, serverFunctionEntryPlugin(definition)],
+    publicDir: false,
     resolve: {
       conditions: [...conditions],
       noExternal: true,

package/src/cli/client-config.ts

@@ -58,6 +58,13 @@ export const validateClientFiles = Effect.fn("ClientConfig.validateFiles")(funct
   const fileSystem = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
   const clientDirectory = path.join(appDirectory, "client");
+  const nestedPublicDirectory = path.join(clientDirectory, "public");
+  if (yield* fileSystem.exists(nestedPublicDirectory)) {
+    return yield* InvalidClientFile.make({
+      message: `Client public files must be placed in the top-level public directory, not ${nestedPublicDirectory}.`,
+      path: nestedPublicDirectory,
+    });
+  }
   const entryPath = path.join(clientDirectory, clientEntryFileName);
   if (!(yield* fileSystem.exists(entryPath))) {
     return yield* ClientFileNotFound.make({