
Product
Introducing Socket Firewall Enterprise: Flexible, Configurable Protection for Modern Package Ecosystems
Socket Firewall Enterprise is now available with flexible deployment, configurable policies, and expanded language support.
@forge/bundler
Advanced tools
The bundler package is responsible for compiling the user code, including dependencies (NPM packages), into files that get uploaded to AWS Lambda.
This is required for two reasons:
The bundler is used:
forge deploy)forge tunnel)Bundler uses webpack to compile user code.
Every entry point from the manifest (referenced in modules.function.handler)
and resource for Native UI is compiled into a single JavaScript file
containing all of its dependencies.
Some built-in Node modules and globals are not exposed in the sandbox JavaScript environment. Accessing those at runtime would throw an error.
Where possible, the unavailable modules and globals are replaced with
compatible implementations using
ProvidePlugin and
alias. If
there is no point in providing an implementation altogether (e.g. dns
module), it is replaced with a stub showing an "unsupported" message.
Some NPM modules provide different implementations for "browser" and "node"
environments, based on
package-browser-field-spec.
Even though Forge functions run in Node.js, our environment is more compatible
with "browser" implementations. The sandbox Webpack configuration sets the
resolve options to prefer those.
The interface for the Forge functions is different from the XIS interface, see Node runtime: Technical Details. Therefore, a layer of wrapper code is required to convert the calls and responses.
To maintain the correspondence between AWS Lambda handler and the handler in
the Forge manifest, the bundled user code is put into a new location, with the
wrapper code left in the original place. For example, if the manifest
specifies index.run as the handler, AWS Lambda function will have:
index.js - wrapper codebundled/index.js - bundled user code from src/index.jsThe wrapper code, when invoked:
The wrapper cannot load the user code before the environment is set up, as any actions that the user code does upon initialization might fail (e.g. because the proxy token is not yet set up).
However, wrapper needs to know which exports to make available. This
information is passed to the bundler from the manifest: if it contains
index.run and index.another as handlers, then the wrapper for index.js
will need to export run and another. Bundler uses
BannerPlugin to add this as a
constant to each wrapper.
To redirect console calls from the user code to Xen Logs Ingestor that backs
forge logs and the Forge Developer console, occurrences console are
replaced with a custom implementation via
ProvidePlugin.
TODO: Not documented
FAQs
Default bundler for Forge apps
The npm package @forge/bundler receives a total of 20,444 weekly downloads. As such, @forge/bundler popularity was classified as popular.
We found that @forge/bundler demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Product
Socket Firewall Enterprise is now available with flexible deployment, configurable policies, and expanded language support.

Security News
Open source dashboard CNAPulse tracks CVE Numbering Authorities’ publishing activity, highlighting trends and transparency across the CVE ecosystem.

Product
Detect malware, unsafe data flows, and license issues in GitHub Actions with Socket’s new workflow scanning support.