first commit

2026-07-12 15:55:18 +05:30
commit ee98026cc5
404 changed files with 44522 additions and 0 deletions
@@ -0,0 +1,127 @@
+import { existsSync } from "node:fs";
+import { readFile, stat } from "node:fs/promises";
+import { extname, join, relative, resolve, sep } from "node:path";
+import { isSafeRequestPath } from "@wrnexus/core";
+import type { Mode } from "@wrnexus/core";
+
+const CONTENT_TYPES: Record<string, string> = {
+  ".avif": "image/avif",
+  ".css": "text/css; charset=utf-8",
+  ".gif": "image/gif",
+  ".html": "text/html; charset=utf-8",
+  ".ico": "image/x-icon",
+  ".jpeg": "image/jpeg",
+  ".jpg": "image/jpeg",
+  ".js": "text/javascript; charset=utf-8",
+  ".json": "application/json; charset=utf-8",
+  ".mjs": "text/javascript; charset=utf-8",
+  ".pdf": "application/pdf",
+  ".png": "image/png",
+  ".svg": "image/svg+xml",
+  ".txt": "text/plain; charset=utf-8",
+  ".wasm": "application/wasm",
+  ".webp": "image/webp",
+  ".woff": "font/woff",
+  ".woff2": "font/woff2",
+  ".xml": "application/xml; charset=utf-8",
+};
+
+const IMMUTABLE_CACHE = "public, max-age=31536000, immutable";
+const REVALIDATE_CACHE = "public, max-age=0, must-revalidate";
+
+function cachePolicy(filePath: string, mode: Mode): string {
+  if (mode !== "production") return "no-cache";
+  const name = filePath.split(/[\\/]/).pop() ?? "";
+  if (/\.html?$/i.test(name)) return REVALIDATE_CACHE;
+  return /(?:^|[.-])[a-f0-9]{8,}(?:[.-]|$)/i.test(name) ? IMMUTABLE_CACHE : "public, max-age=3600";
+}
+
+/** Cache the public-dir existence check so it isn't a sync stat on every request. */
+const publicDirExistsCache = new Map<string, boolean>();
+function publicDirExists(dir: string): boolean {
+  let exists = publicDirExistsCache.get(dir);
+  if (exists === undefined) {
+    exists = existsSync(dir);
+    publicDirExistsCache.set(dir, exists);
+  }
+  return exists;
+}
+
+const DEFAULT_FAVICON = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <rect width="64" height="64" rx="14" fill="#0f172a"/>
+  <path d="M15 18h8l5 22 7-22h7l7 22 5-22h8L53 50h-8l-7-21-7 21h-8L15 18z" fill="#6c8cff"/>
+</svg>`;
+
+export async function servePublicAsset(
+  publicDir: string | undefined,
+  pathname: string,
+  mode: Mode,
+): Promise<Response | null> {
+  if (pathname === "/" || pathname.startsWith("/__wrnexus/")) return null;
+  if (!isSafeRequestPath(pathname)) return null;
+
+  const fallback = pathname === "/favicon.ico" ? defaultFaviconResponse(mode) : null;
+  if (!publicDir || !publicDirExists(publicDir)) return fallback;
+
+  const rel = safePublicRelativePath(pathname);
+  if (!rel) return fallback;
+
+  const base = resolve(publicDir);
+  let filePath = resolve(base, rel);
+  if (!isInside(base, filePath)) return fallback;
+
+  try {
+    const info = await stat(filePath);
+    if (info.isDirectory()) {
+      filePath = resolve(filePath, "index.html");
+      if (!isInside(base, filePath)) return null;
+    }
+
+    const fileInfo = await stat(filePath);
+    if (!fileInfo.isFile()) return null;
+
+    const body = await readFile(filePath);
+    const contentType =
+      CONTENT_TYPES[extname(filePath).toLowerCase()] ?? "application/octet-stream";
+    return new Response(body, {
+      headers: {
+        "content-type": contentType,
+        "cache-control": cachePolicy(filePath, mode),
+        "x-content-type-options": "nosniff",
+      },
+    });
+  } catch {
+    return fallback;
+  }
+}
+
+function defaultFaviconResponse(mode: Mode): Response {
+  return new Response(DEFAULT_FAVICON, {
+    headers: {
+      "content-type": "image/svg+xml; charset=utf-8",
+      "cache-control": mode === "production" ? "public, max-age=86400" : "no-cache",
+      "x-content-type-options": "nosniff",
+    },
+  });
+}
+
+function safePublicRelativePath(pathname: string): string | null {
+  let decoded: string;
+  try {
+    decoded = decodeURIComponent(pathname);
+  } catch {
+    return null;
+  }
+
+  const segments = decoded.split("/").filter(Boolean);
+  if (segments.some((segment) => segment.startsWith(".") || segment.includes("\\"))) {
+    return null;
+  }
+
+  return segments.length ? join(...segments) : null;
+}
+
+function isInside(base: string, target: string): boolean {
+  const rel = relative(base, target);
+  return rel === "" || (!!rel && !rel.startsWith("..") && !rel.includes(`..${sep}`));
+}