nuclie 1.0.0

package/dist/runtime/federation.js

@@ -0,0 +1,210 @@
+/**
+ * Nuclie Native Federation Runtime
+ * 100% self-contained, zero external dependencies
+ * Loads and manages federated modules using native ESM
+ * With advanced fallback strategies and circuit breaker pattern
+ */
+
+import { fallbackManager, CircuitState } from './federation-fallback.js';
+
+class FederationRuntime {
+    constructor() {
+        this.remotes = new Map();
+        this.sharedModules = new Map();
+        this.manifestCache = new Map();
+        this.moduleCache = new Map();
+    }
+
+    /**
+     * Register a remote application
+     * @param {string} name - Remote name
+     * @param {string} url - Base URL or manifest URL
+     */
+    async registerRemote(name, url) {
+        try {
+            // Fetch and parse manifest
+            const manifestUrl = url.endsWith('.json') ? url : `${url}/remoteEntry.json`;
+            const response = await fetch(manifestUrl);
+
+            if (!response.ok) {
+                throw new Error(`Failed to fetch manifest from ${manifestUrl}: ${response.statusText}`);
+            }
+
+            const manifest = await response.json();
+            this.manifestCache.set(name, manifest);
+
+            // Store remote configuration
+            this.remotes.set(name, {
+                name: manifest.name || name,
+                url: url.endsWith('.json') ? url.replace('/remoteEntry.json', '') : url,
+                manifest,
+                loaded: true
+            });
+
+            console.log(`[Federation] Registered remote: ${name}`, manifest);
+            return manifest;
+        } catch (error) {
+            console.error(`[Federation] Failed to register remote ${name}:`, error);
+            throw error;
+        }
+    }
+
+    /**
+     * Load a module from a remote
+     * @param {string} remoteName - Name of the remote
+     * @param {string} modulePath - Path to the module (e.g., './Button')
+     * @returns {Promise<any>} The loaded module
+     */
+    async loadRemoteModule(remoteName, modulePath) {
+        const cacheKey = `${remoteName}:${modulePath}`;
+
+        // Check cache first
+        if (this.moduleCache.has(cacheKey)) {
+            return this.moduleCache.get(cacheKey);
+        }
+
+        const remote = this.remotes.get(remoteName);
+        if (!remote) {
+            throw new Error(`Remote "${remoteName}" not registered. Call registerRemote() first.`);
+        }
+
+        const manifest = remote.manifest;
+        const exposed = manifest.exposes?.[modulePath];
+
+        if (!exposed) {
+            throw new Error(`Module "${modulePath}" not exposed by remote "${remoteName}"`);
+        }
+
+        try {
+            // Construct full URL
+            const moduleUrl = this.resolveModuleUrl(remote.url, exposed.import);
+
+            console.log(`[Federation] Loading module: ${remoteName}${modulePath} from ${moduleUrl}`);
+
+            // Dynamic import
+            const module = await import(/* @vite-ignore */ moduleUrl);
+
+            // Cache the module
+            this.moduleCache.set(cacheKey, module);
+
+            return module;
+        } catch (error) {
+            console.error(`[Federation] Failed to load module ${remoteName}${modulePath}:`, error);
+            throw error;
+        }
+    }
+
+    /**
+     * Resolve module URL from base URL and import path
+     * @private
+     */
+    resolveModuleUrl(baseUrl, importPath) {
+        // Handle absolute URLs
+        if (importPath.startsWith('http://') || importPath.startsWith('https://')) {
+            return importPath;
+        }
+
+        // Handle relative paths
+        if (importPath.startsWith('./') || importPath.startsWith('../')) {
+            return `${baseUrl}/${importPath.replace(/^\.\//, '')}`;
+        }
+
+        // Default: treat as relative
+        return `${baseUrl}/${importPath}`;
+    }
+
+    /**
+     * Register a shared module (for singleton dependencies like React)
+     * @param {string} name - Module name (e.g., 'react')
+     * @param {any} module - The actual module
+     * @param {string} version - Version string
+     */
+    registerShared(name, module, version) {
+        this.sharedModules.set(name, {
+            module,
+            version,
+            singleton: true
+        });
+        console.log(`[Federation] Registered shared module: ${name}@${version}`);
+    }
+
+    /**
+     * Get a shared module
+     * @param {string} name - Module name
+     * @returns {any} The shared module or undefined
+     */
+    getShared(name) {
+        return this.sharedModules.get(name)?.module;
+    }
+
+    /**
+     * Prefetch remote manifests for faster loading
+     * @param {Array<{name: string, url: string}>} remotes
+     */
+    async prefetchRemotes(remotes) {
+        const promises = remotes.map(({ name, url }) =>
+            this.registerRemote(name, url).catch(err => {
+                console.warn(`[Federation] Prefetch failed for ${name}:`, err);
+            })
+        );
+        await Promise.all(promises);
+    }
+
+    /**
+     * Health check for a remote
+     * @param {string} remoteName
+     * @returns {Promise<boolean>}
+     */
+    async healthCheck(remoteName) {
+        const remote = this.remotes.get(remoteName);
+        if (!remote) return false;
+
+        const manifest = remote.manifest;
+        if (manifest.health) {
+            try {
+                const response = await fetch(`${remote.url}${manifest.health}`);
+                return response.ok;
+            } catch {
+                return false;
+            }
+        }
+
+        // Default: check if manifest is accessible
+        return remote.loaded;
+    }
+
+    /**
+     * Clear module cache (useful for HMR)
+     * @param {string} [remoteName] - Optional: clear only specific remote
+     */
+    clearCache(remoteName) {
+        if (remoteName) {
+            for (const [key] of this.moduleCache) {
+                if (key.startsWith(`${remoteName}:`)) {
+                    this.moduleCache.delete(key);
+                }
+            }
+        } else {
+            this.moduleCache.clear();
+        }
+    }
+}
+
+// Global singleton instance
+if (typeof window !== 'undefined') {
+    window.__NUCLIE_FEDERATION__ = window.__NUCLIE_FEDERATION__ || new FederationRuntime();
+}
+
+// Export for module usage
+export default typeof window !== 'undefined' ? window.__NUCLIE_FEDERATION__ : new FederationRuntime();
+
+// Helper function for easier usage
+export async function loadRemote(remoteName, modulePath) {
+    const runtime = typeof window !== 'undefined' ? window.__NUCLIE_FEDERATION__ : new FederationRuntime();
+    return runtime.loadRemoteModule(remoteName, modulePath);
+}
+
+export async function registerRemote(name, url) {
+    const runtime = typeof window !== 'undefined' ? window.__NUCLIE_FEDERATION__ : new FederationRuntime();
+    return runtime.registerRemote(name, url);
+}

package/dist/runtime/federation_runtime.js

@@ -0,0 +1,90 @@
+/**
+ * Microfrontend Runtime Loader
+ * Handles loading remote modules and managing shared dependencies.
+ */
+
+// Global scope for shared dependencies
+const shareScope = {
+    default: {}
+};
+
+// Map of loaded remotes
+const containerMap = {};
+
+// Map of loading promises
+const loadingMap = {};
+
+/**
+ * Initialize a remote container
+ */
+async function initRemote(container, scope) {
+    if (!container.__initialized && !container.__initializing) {
+        container.__initializing = true;
+        if (!container.init) {
+            console.warn('Remote container does not have init method');
+            return;
+        }
+        await container.init(scope);
+        container.__initialized = true;
+    }
+}
+
+/**
+ * Load a remote module
+ * @param {string} url - URL of the remoteEntry.js
+ * @param {string} scope - Name of the remote container
+ * @param {string} module - Path of the module to load
+ */
+export async function loadRemote(url, scope, module) {
+    // 1. Load the remote entry script if not already loaded
+    if (!window[scope]) {
+        if (!loadingMap[url]) {
+            loadingMap[url] = new Promise((resolve, reject) => {
+                const script = document.createElement('script');
+                script.src = url;
+                script.type = 'text/javascript';
+                script.async = true;
+
+                script.onload = () => {
+                    resolve(window[scope]);
+                };
+
+                script.onerror = (e) => {
+                    reject(new Error(`Failed to load remote script: ${url}`));
+                };
+
+                document.head.appendChild(script);
+            });
+        }
+
+        await loadingMap[url];
+    }
+
+    const container = window[scope];
+    if (!container) {
+        throw new Error(`Remote container '${scope}' not found after loading script`);
+    }
+
+    // 2. Initialize the container with shared scope
+    await initRemote(container, shareScope.default);
+
+    // 3. Get the module factory
+    const factory = await container.get(module);
+
+    // 4. Return the module exports
+    return factory();
+}
+
+/**
+ * Register a shared module
+ */
+export function registerShared(name, version, factory) {
+    if (!shareScope.default[name]) {
+        shareScope.default[name] = {};
+    }
+
+    shareScope.default[name][version] = {
+        loaded: false,
+        get: factory
+    };
+}

package/dist/runtime/hmr-client.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Nuclie HMR Client Runtime
+ * Provides the `import.meta.hot` API and handles WebSocket updates.
+ */
+export {};

package/dist/runtime/hmr-client.js

@@ -0,0 +1,70 @@
+/**
+ * Nuclie HMR Client Runtime
+ * Provides the `import.meta.hot` API and handles WebSocket updates.
+ */
+class HMRClient {
+    constructor() {
+        this.registry = new Map();
+        this.boundaries = new Map();
+        const protocol = location.protocol === 'https:' ? 'wss:' : 'ws:';
+        this.socket = new WebSocket(`${protocol}//${location.host}`);
+        this.socket.onmessage = (e) => this.handleMessage(JSON.parse(e.data));
+    }
+    handleMessage(msg) {
+        console.log('[Nuclie] HMR Message:', msg);
+        switch (msg.type) {
+            case 'connected':
+                console.log('[Nuclie] Connected to Dev Server');
+                break;
+            case 'update':
+                this.applyUpdate(msg.payload.updates);
+                break;
+            case 'reload':
+                console.warn('[Nuclie] Reload triggered:', msg.payload.reason);
+                location.reload();
+                break;
+            case 'error':
+                console.error('[Nuclie] Build Error:', msg.payload.message);
+                // Show Error Overlay (Phase 5.11)
+                break;
+        }
+    }
+    async applyUpdate(updates) {
+        for (const update of updates) {
+            console.log(`[Nuclie] Hot Updating: ${update.moduleId}`);
+            try {
+                // 1. Dispose old module
+                const old = this.registry.get(update.moduleId);
+                if (old && old.hot && old.hot._dispose) {
+                    old.hot._dispose();
+                }
+                // 2. Import new module (with cache buster)
+                const newModule = await import(update.url + '?t=' + Date.now());
+                this.registry.set(update.moduleId, newModule);
+                // 3. Re-execute boundary or notify parents
+                // This requires a dependency map on the client
+            }
+            catch (err) {
+                console.error('[Nuclie] Update Failed:', err);
+                location.reload();
+            }
+        }
+    }
+    // API provided to modules
+    createHotContext(moduleId) {
+        return {
+            accept: (cb) => {
+                this.boundaries.set(moduleId, cb || true);
+            },
+            dispose: (cb) => {
+                const mod = this.registry.get(moduleId);
+                if (mod && mod.hot)
+                    mod.hot._dispose = cb;
+            },
+            invalidate: () => location.reload(),
+            data: {}
+        };
+    }
+}
+window.__NUCLIE_HMR__ = new HMRClient();
+export {};

package/dist/security/anomaly.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Anomaly Detection System (Day 41)
+ *
+ * Monitors runtime and build-time security events including:
+ * - CSP Violations
+ * - XSS Patterns in Requests
+ * - Plugin Escape Attempts
+ */
+export interface SecurityEvent {
+    type: 'csp-violation' | 'xss-attempt' | 'plugin-escape' | 'auth-failure' | 'anomaly';
+    severity: 'low' | 'medium' | 'high' | 'critical';
+    details: any;
+    timestamp: number;
+    source?: string;
+}
+export declare class AnomalyDetector {
+    private events;
+    private blockedIPs;
+    /**
+     * Report a security event
+     */
+    report(event: Omit<SecurityEvent, 'timestamp'>): void;
+    /**
+     * Analyze incoming HTTP request for XSS signatures
+     */
+    scanRequest(req: {
+        url: string;
+        headers: any;
+        method: string;
+    }): boolean;
+    /**
+     * Get scan summary
+     */
+    getDashboard(): {
+        totalEvents: number;
+        critical: number;
+        high: number;
+        recentEvents: SecurityEvent[];
+    };
+}
+export declare const anomalyDetector: AnomalyDetector;

package/dist/security/anomaly.js

@@ -0,0 +1,77 @@
+/**
+ * Anomaly Detection System (Day 41)
+ *
+ * Monitors runtime and build-time security events including:
+ * - CSP Violations
+ * - XSS Patterns in Requests
+ * - Plugin Escape Attempts
+ */
+export class AnomalyDetector {
+    constructor() {
+        this.events = [];
+        this.blockedIPs = new Set();
+    }
+    /**
+     * Report a security event
+     */
+    report(event) {
+        const fullEvent = {
+            ...event,
+            timestamp: Date.now()
+        };
+        this.events.push(fullEvent);
+        // Log critical events immediately
+        if (fullEvent.severity === 'critical' || fullEvent.severity === 'high') {
+            // Using console directly to ensure visibility, or use logger if available
+            console.error(`🚨 [SECURITY] ${fullEvent.type.toUpperCase()}:`, fullEvent.details);
+        }
+    }
+    /**
+     * Analyze incoming HTTP request for XSS signatures
+     */
+    scanRequest(req) {
+        const xssPatterns = [
+            /<script>/i,
+            /javascript:/i,
+            /onload\s*=/i,
+            /onerror\s*=/i,
+            /eval\(/i
+        ];
+        // Decode URL to catch encoded attacks (e.g. %3Cscript%3E)
+        let decodedUrl = req.url || '';
+        try {
+            decodedUrl = decodeURIComponent(req.url || '');
+        }
+        catch (e) {
+            // malformed URI sequence, use raw
+        }
+        const target = decodedUrl + JSON.stringify(req.headers);
+        for (const pattern of xssPatterns) {
+            if (pattern.test(target)) {
+                this.report({
+                    type: 'xss-attempt',
+                    severity: 'high',
+                    details: {
+                        url: req.url,
+                        pattern: pattern.toString(),
+                        method: req.method
+                    }
+                });
+                return false; // Block request
+            }
+        }
+        return true; // Safe
+    }
+    /**
+     * Get scan summary
+     */
+    getDashboard() {
+        return {
+            totalEvents: this.events.length,
+            critical: this.events.filter(e => e.severity === 'critical').length,
+            high: this.events.filter(e => e.severity === 'high').length,
+            recentEvents: this.events.slice(-10)
+        };
+    }
+}
+export const anomalyDetector = new AnomalyDetector();

package/dist/server/security-headers.d.ts

@@ -0,0 +1,37 @@
+import { IncomingMessage, ServerResponse } from 'http';
+export interface SecurityHeadersConfig {
+    csp?: string | boolean;
+    hsts?: boolean;
+    frameOptions?: 'DENY' | 'SAMEORIGIN' | string;
+    xssProtection?: boolean;
+    contentTypeNosniff?: boolean;
+    referrerPolicy?: string;
+    permissionsPolicy?: string;
+}
+/**
+ * Production-grade security headers middleware
+ */
+export declare class SecurityHeaders {
+    private config;
+    constructor(config?: SecurityHeadersConfig);
+    /**
+     * Apply security headers to response
+     */
+    apply(req: IncomingMessage, res: ServerResponse): void;
+    /**
+     * Get default Content Security Policy for development
+     */
+    private getDefaultCSP;
+    /**
+     * Get production-grade CSP (stricter)
+     */
+    static getProductionCSP(nonce?: string): string;
+    /**
+     * Middleware function for Express-like servers
+     */
+    middleware(): (req: IncomingMessage, res: ServerResponse, next?: () => void) => void;
+}
+/**
+ * Create security headers middleware with config
+ */
+export declare function createSecurityHeaders(config?: SecurityHeadersConfig): SecurityHeaders;

package/dist/server/security-headers.js

@@ -0,0 +1,110 @@
+/**
+ * Production-grade security headers middleware
+ */
+export class SecurityHeaders {
+    constructor(config = {}) {
+        this.config = {
+            csp: config.csp ?? true,
+            hsts: config.hsts ?? true,
+            frameOptions: config.frameOptions ?? 'SAMEORIGIN',
+            xssProtection: config.xssProtection ?? true,
+            contentTypeNosniff: config.contentTypeNosniff ?? true,
+            referrerPolicy: config.referrerPolicy ?? 'strict-origin-when-cross-origin',
+            permissionsPolicy: config.permissionsPolicy
+        };
+    }
+    /**
+     * Apply security headers to response
+     */
+    apply(req, res) {
+        // Content Security Policy
+        if (this.config.csp) {
+            const cspValue = typeof this.config.csp === 'string'
+                ? this.config.csp
+                : this.getDefaultCSP();
+            res.setHeader('Content-Security-Policy', cspValue);
+        }
+        // HTTP Strict Transport Security
+        if (this.config.hsts) {
+            res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains; preload');
+        }
+        // X-Frame-Options
+        if (this.config.frameOptions) {
+            res.setHeader('X-Frame-Options', this.config.frameOptions);
+        }
+        // X-XSS-Protection (legacy, but still useful)
+        if (this.config.xssProtection) {
+            res.setHeader('X-XSS-Protection', '1; mode=block');
+        }
+        // X-Content-Type-Options
+        if (this.config.contentTypeNosniff) {
+            res.setHeader('X-Content-Type-Options', 'nosniff');
+        }
+        // Referrer-Policy
+        if (this.config.referrerPolicy) {
+            res.setHeader('Referrer-Policy', this.config.referrerPolicy);
+        }
+        // Permissions-Policy (formerly Feature-Policy)
+        if (this.config.permissionsPolicy) {
+            res.setHeader('Permissions-Policy', this.config.permissionsPolicy);
+        }
+        else {
+            // Default: restrict dangerous features
+            res.setHeader('Permissions-Policy', 'camera=(), microphone=(), geolocation=(), interest-cohort=()');
+        }
+        // Additional security headers
+        res.setHeader('X-DNS-Prefetch-Control', 'off');
+        res.setHeader('X-Download-Options', 'noopen');
+        res.setHeader('X-Permitted-Cross-Domain-Policies', 'none');
+    }
+    /**
+     * Get default Content Security Policy for development
+     */
+    getDefaultCSP() {
+        return [
+            "default-src 'self'",
+            "script-src 'self' 'unsafe-inline' 'unsafe-eval'", // Relaxed for dev
+            "style-src 'self' 'unsafe-inline'",
+            "img-src 'self' data: blob: https:",
+            "font-src 'self' data:",
+            "connect-src 'self' ws: wss:", // WebSocket for HMR
+            "frame-ancestors 'self'",
+            "base-uri 'self'",
+            "form-action 'self'"
+        ].join('; ');
+    }
+    /**
+     * Get production-grade CSP (stricter)
+     */
+    static getProductionCSP(nonce) {
+        const nonceAttr = nonce ? ` 'nonce-${nonce}'` : '';
+        return [
+            "default-src 'self'",
+            `script-src 'self'${nonceAttr}`,
+            "style-src 'self' 'unsafe-inline'", // Some frameworks need this
+            "img-src 'self' data: https:",
+            "font-src 'self'",
+            "connect-src 'self'",
+            "frame-ancestors 'none'",
+            "base-uri 'self'",
+            "form-action 'self'",
+            "upgrade-insecure-requests"
+        ].join('; ');
+    }
+    /**
+     * Middleware function for Express-like servers
+     */
+    middleware() {
+        return (req, res, next) => {
+            this.apply(req, res);
+            if (next)
+                next();
+        };
+    }
+}
+/**
+ * Create security headers middleware with config
+ */
+export function createSecurityHeaders(config) {
+    return new SecurityHeaders(config);
+}

package/dist/ssr/adapters/edge.d.ts

@@ -0,0 +1,12 @@
+import { SSRAdapter } from '../universal-engine.js';
+/**
+ * Nuclie Vercel Edge / Cloudflare Workers Adapter
+ * Day 54: SSR Power Locked
+ */
+export declare function createEdgeHandler(adapter: SSRAdapter): (request: Request) => Promise<Response>;
+/**
+ * Cloudflare Workers entry point bridge
+ */
+export declare function exportToCloudflare(handler: any): {
+    fetch(request: Request, env: any, ctx: any): Promise<any>;
+};

package/dist/ssr/adapters/edge.js

@@ -0,0 +1,26 @@
+import { UniversalSSREngine } from '../universal-engine.js';
+/**
+ * Nuclie Vercel Edge / Cloudflare Workers Adapter
+ * Day 54: SSR Power Locked
+ */
+export function createEdgeHandler(adapter) {
+    const engine = new UniversalSSREngine(adapter);
+    return async (request) => {
+        const response = await engine.handleRequest(request);
+        if (response instanceof Response) {
+            return response;
+        }
+        // Fallback for non-standard response
+        return new Response('Edge runtime internal error', { status: 500 });
+    };
+}
+/**
+ * Cloudflare Workers entry point bridge
+ */
+export function exportToCloudflare(handler) {
+    return {
+        async fetch(request, env, ctx) {
+            return await handler(request);
+        }
+    };
+}