fix(cloudflare): keep Undici out of Worker bundles (#860)

Author: harlan-zw

packages/script/src/module.ts

@@ -45,7 +45,7 @@ import { NuxtScriptBundleTransformer } from './plugins/transform'
 import{aliasProxyValue,buildDomainAliasMap,invertAliasMap,isSafeAliasSegment}from'./proxy-alias'
 import{buildProxyConfigsFromRegistry,generatePartytownResolveUrl,getPartytownForwards,registry,resolveCapabilities}from'./registry'
 import{ensureNuxtScriptsCacheStorage}from'./runtime/server/utils/cache-config'
-import{isPublicNetworkHostname}from'./runtime/server/utils/network-host'
+import{isPublicNetworkHostname}from'./runtime/server/utils/network-hostname'
 import{registerTypeTemplates,templatePlugin,templateTriggerResolver}from'./templates'
 import{hasUnheadSourceLessScriptLoaderFile}from'./unhead-features'
 import{validateScriptsEnvVars}from'./validate-env'
@@ -594,6 +594,15 @@ export default defineNuxtModule<ModuleOptions>({
 logger.debug('The module is disabled, skipping setup.')
 return
 }
+constnetworkDispatcherAlias='#nuxt-scripts/network-dispatcher'
+constnodeNetworkDispatcherPath=awaitresolvePath('./runtime/server/utils/network-dispatcher.node')
+constplatformNetworkDispatcherPath=awaitresolvePath('./runtime/server/utils/network-dispatcher.platform')
+nuxt.options.alias[networkDispatcherAlias]=nodeNetworkDispatcherPath
+nuxt.hook('nitro:init',(nitro)=>{
+nitro.options.alias[networkDispatcherAlias]=nitro.options.node
+ ? nodeNetworkDispatcherPath
+ : platformNetworkDispatcherPath
+})
 awaitsetupNitroRuntimeCompatibility(nuxt)
 if(nuxt.options.dev){
 setupDevtools(nuxt,{standalone: config._standaloneDevtools})

packages/script/src/runtime/server/utils/network-dispatcher.node.ts

@@ -0,0 +1,23 @@
+importtype{CreateNetworkDispatcher,NetworkAddress}from'./network-host'
+import{lookup}from'node:dns'
+import{Agent,fetch}from'undici'
+
+exportconstcreateNetworkDispatcher: CreateNetworkDispatcher=async(createLookup,resolveHostnameOverride)=>{
+constresolveHostname=resolveHostnameOverride||((hostname,callback)=>{
+lookup(hostname,{all: true,verbatim: true},(error,addresses)=>{
+callback(error,addressesasNetworkAddress[])
+})
+})
+constdispatcher=newAgent({
+connect: {
+lookup: createLookup(resolveHostname),
+},
+})
+return{
+fetch: ((input,init)=>fetch(inputasstring|URL,{
+ ...(initasunknownasNonNullable<Parameters<typeoffetch>[1]>),
+ dispatcher,
+})asunknownasPromise<Response>)astypeofglobalThis.fetch,
+close: ()=>dispatcher.close(),
+}
+}

packages/script/src/runtime/server/utils/network-dispatcher.platform.ts

@@ -0,0 +1,6 @@
+importtype{CreateNetworkDispatcher}from'./network-host'
+
+exportconstcreateNetworkDispatcher: CreateNetworkDispatcher=async()=>({
+fetch: globalThis.fetch,
+close: async()=>{},
+})

packages/script/src/runtime/server/utils/network-host.ts

@@ -1,21 +1,15 @@
 importtype{LookupFunction}from'node:net'
-import{runtime}from'std-env'
+import{createNetworkDispatcher}from'#nuxt-scripts/network-dispatcher'
+import{isPublicNetworkHostname}from'./network-hostname'
 
-constLOCAL_HOST_SUFFIXES=[
-'home',
-'internal',
-'lan',
-'local',
-'localdomain',
-'localhost',
-]
+export{isPublicNetworkHostname}from'./network-hostname'
 
-interfaceNetworkAddress{
+exportinterfaceNetworkAddress{
 address: string
 family: 4|6
 }
 
-typeResolveNetworkHostname=(
+exporttypeResolveNetworkHostname=(
 hostname: string,
 callback: (error: Error|null,addresses: NetworkAddress[])=>void,
 )=>void
@@ -31,6 +25,11 @@ export interface PublicNetworkDispatcher {
 close: ()=>Promise<void>
 }
 
+exporttypeCreateNetworkDispatcher=(
+createLookup: (resolveHostname: ResolveNetworkHostname)=>LookupFunction,
+resolveHostnameOverride?: ResolveNetworkHostname,
+)=>Promise<PublicNetworkDispatcher>
+
 /** Close a dispatcher without replacing the request or stream error already in flight. */
 exportasyncfunctionclosePublicNetworkDispatcher(
 dispatcher: PublicNetworkDispatcher|undefined,
@@ -48,68 +47,6 @@ export async function closePublicNetworkDispatcher(
 })
 }
 
-functionparseIPv4(hostname: string): [number,number,number,number]|undefined{
-constparts=hostname.split('.')
-if(parts.length!==4||parts.some(part=>!/^\d{1,3}$/.test(part)))
-return
-constoctets=parts.map(Number)
-returnoctets.every(octet=>octet>=0&&octet<=255)
- ? octetsas[number,number,number,number]
- : undefined
-}
-
-functionisPublicIPv4([a,b,c]: [number,number,number,number]): boolean{
-returna!==0
-&&a!==10
-&&a!==127
-&&!(a===100&&b>=64&&b<=127)
-&&!(a===169&&b===254)
-&&!(a===172&&b>=16&&b<=31)
-&&!(a===192&&b===0&&c===0)
-&&!(a===192&&b===0&&c===2)
-&&!(a===192&&b===88&&c===99)
-&&!(a===192&&b===168)
-&&!(a===198&&(b===18||b===19))
-&&!(a===198&&b===51&&c===100)
-&&!(a===203&&b===0&&c===113)
-&&a<224
-}
-
-functionisPublicIPv6(hostname: string): boolean{
-constgroups=hostname.split(':')
-constfirstGroup=Number.parseInt(groups[0]||'0',16)
-if(!Number.isInteger(firstGroup)||firstGroup<0x2000||firstGroup>0x3FFF)
-returnfalse
-// Documentation, Teredo, and 6to4 ranges can encode or route to non-public targets.
-constsecondGroup=Number.parseInt(groups[1]||'0',16)
-return!(firstGroup===0x2001&&(secondGroup===0||secondGroup===0xDB8))
-&&firstGroup!==0x2002
-}
-
-/** Reject hostnames that directly address local, private, link-local, or reserved networks. */
-exportfunctionisPublicNetworkHostname(input: string): boolean{
-consthostname=input
-.trim()
-.toLowerCase()
-.replace(/^\[|\]$/g,'')
-.split('%',1)[0]!
-.replace(/\.$/,'')
-if(!hostname)
-returnfalse
-
-constipv4=parseIPv4(hostname)
-if(ipv4)
-returnisPublicIPv4(ipv4)
-if(hostname.includes(':'))
-returnisPublicIPv6(hostname)
-
-constlabels=hostname.split('.')
-if(labels.length<2)
-returnfalse
-constsuffix=labels.at(-1)!
-return!LOCAL_HOST_SUFFIXES.includes(suffix)
-}
-
 /** Resolve once inside the socket connection, reject mixed/private answers, then pin the selected address. */
 exportfunctioncreatePublicNetworkLookup(resolveHostname: ResolveNetworkHostname): LookupFunction{
 constnetworkLookup: NetworkLookup=(hostname,options,callback)=>{
@@ -142,33 +79,9 @@ export function createPublicNetworkLookup(resolveHostname: ResolveNetworkHostnam
 returnnetworkLookupasLookupFunction
 }
 
-/** Create a Node fetch dispatcher whose socket lookup validates and pins every DNS answer. */
+/** Create a host fetch implementation that validates and pins every DNS answer when Node permits it. */
 exportasyncfunctioncreatePublicNetworkDispatcher(resolveHostnameOverride?: ResolveNetworkHostname): Promise<PublicNetworkDispatcher>{
-if(runtime!=='node')
-return{fetch: globalThis.fetch,close: async()=>{}}
-
-// Loaded only on Node. Other runtimes keep their platform fetch behavior;
-// call sites still reject direct non-public hostnames before fetching.
-const{ Agent, fetch }=awaitimport('undici')
-letresolveHostname=resolveHostnameOverride
-if(!resolveHostname){
-const{ lookup }=awaitimport('node:dns')
-resolveHostname=(hostname,callback)=>lookup(hostname,{all: true,verbatim: true},(error,addresses)=>{
-callback(error,addressesasNetworkAddress[])
-})
-}
-constdispatcher=newAgent({
-connect: {
-lookup: createPublicNetworkLookup(resolveHostname),
-},
-})
-return{
-fetch: ((input,init)=>fetch(inputasstring|URL,{
- ...(initasunknownasNonNullable<Parameters<typeoffetch>[1]>),
- dispatcher,
-})asunknownasPromise<Response>)astypeofglobalThis.fetch,
-close: ()=>dispatcher.close(),
-}
+returncreateNetworkDispatcher(createPublicNetworkLookup,resolveHostnameOverride)
 }
 
 /** Detect the tagged DNS policy error through fetch/ofetch cause wrappers. */

packages/script/src/runtime/server/utils/network-hostname.ts

@@ -0,0 +1,67 @@
+constLOCAL_HOST_SUFFIXES=[
+'home',
+'internal',
+'lan',
+'local',
+'localdomain',
+'localhost',
+]
+functionparseIPv4(hostname: string): [number,number,number,number]|undefined{
+constparts=hostname.split('.')
+if(parts.length!==4||parts.some(part=>!/^\d{1,3}$/.test(part)))
+return
+constoctets=parts.map(Number)
+returnoctets.every(octet=>octet>=0&&octet<=255)
+ ? octetsas[number,number,number,number]
+ : undefined
+}
+functionisPublicIPv4([a,b,c]: [number,number,number,number]): boolean{
+returna!==0
+&&a!==10
+&&a!==127
+&&!(a===100&&b>=64&&b<=127)
+&&!(a===169&&b===254)
+&&!(a===172&&b>=16&&b<=31)
+&&!(a===192&&b===0&&c===0)
+&&!(a===192&&b===0&&c===2)
+&&!(a===192&&b===88&&c===99)
+&&!(a===192&&b===168)
+&&!(a===198&&(b===18||b===19))
+&&!(a===198&&b===51&&c===100)
+&&!(a===203&&b===0&&c===113)
+&&a<224
+}
+functionisPublicIPv6(hostname: string): boolean{
+constgroups=hostname.split(':')
+constfirstGroup=Number.parseInt(groups[0]||'0',16)
+if(!Number.isInteger(firstGroup)||firstGroup<0x2000||firstGroup>0x3FFF)
+returnfalse
+// Documentation, Teredo, and 6to4 ranges can encode or route to non-public targets.
+constsecondGroup=Number.parseInt(groups[1]||'0',16)
+return!(firstGroup===0x2001&&(secondGroup===0||secondGroup===0xDB8))
+&&firstGroup!==0x2002
+}
+
+/** Reject hostnames that directly address local, private, link-local, or reserved networks. */
+exportfunctionisPublicNetworkHostname(input: string): boolean{
+consthostname=input
+.trim()
+.toLowerCase()
+.replace(/^\[|\]$/g,'')
+.split('%',1)[0]!
+.replace(/\.$/,'')
+if(!hostname)
+returnfalse
+
+constipv4=parseIPv4(hostname)
+if(ipv4)
+returnisPublicIPv4(ipv4)
+if(hostname.includes(':'))
+returnisPublicIPv6(hostname)
+
+constlabels=hostname.split('.')
+if(labels.length<2)
+returnfalse
+constsuffix=labels.at(-1)!
+return!LOCAL_HOST_SUFFIXES.includes(suffix)
+}

test/unit/network-host.test.ts

@@ -1,4 +1,5 @@
 import{describe,expect,it,vi}from'vitest'
+import{createNetworkDispatcherascreatePlatformNetworkDispatcher}from'../../packages/script/src/runtime/server/utils/network-dispatcher.platform'
 import{createPublicNetworkDispatcher,createPublicNetworkLookup,isPrivateNetworkResolutionError,isPublicNetworkHostname}from'../../packages/script/src/runtime/server/utils/network-host'
 
 describe('public network hostname boundary',()=>{
@@ -65,6 +66,13 @@ describe('public network hostname boundary', () => {
 expect(error).toMatchObject({code: 'ERR_NUXT_SCRIPTS_PRIVATE_ADDRESS'})
 })
 
+it('uses the runtime fetch on platforms without Node dispatchers',async()=>{
+constnetwork=awaitcreatePlatformNetworkDispatcher()
+
+expect(network.fetch).toBe(globalThis.fetch)
+awaitexpect(network.close()).resolves.toBeUndefined()
+})
+
 it('uses the validated lookup for the actual Node fetch connection',async()=>{
 constnetwork=awaitcreatePublicNetworkDispatcher((_hostname,callback)=>callback(null,[
 {address: '127.0.0.1',family: 4},

vitest.config.ts

@@ -26,6 +26,7 @@ export default defineConfig({
 '@unhead/vue/scripts': newURL('./packages/script/node_modules/@unhead/vue/dist/scripts.mjs',import.meta.url).pathname,
 '#nuxt-scripts/h3': 'h3',
 '#nuxt-scripts/nitro': newURL('./test/unit/__mocks__/empty.ts',import.meta.url).pathname,
+'#nuxt-scripts/network-dispatcher': newURL('./packages/script/src/runtime/server/utils/network-dispatcher.node.ts',import.meta.url).pathname,
 // Virtual emitted by the Nuxt module at build time; unit tests
 // mock it via `vi.mock('#build/nuxt-scripts-snippets')`, but the
 // import must first resolve to *something* the bundler accepts.