@bleedingdev/modern-js-app-tools-extensions 3.8.3-ultramodern.2

package/dist/esm/cloudflare-output-verifier/index.mjs

@@ -0,0 +1,133 @@
+import promises from "node:fs/promises";
+import node_path from "node:path";
+import { createCloudflareOutputPlan } from "../cloudflare-output-plan.mjs";
+import { verifyDeliveryUnitIdentity } from "./identity.mjs";
+import { addIssue, assertEqual, assertFlag } from "./issues.mjs";
+import { verifyManifestShape } from "./manifest.mjs";
+import { getEffectBffWorker, getWorkerBundleReferences, missingWorkerBundleMessage, resolveWorkerBundleReference, verifyWorkerBundleReferences, verifyWorkerImport } from "./worker-bundles.mjs";
+const pathExists = async (filePath)=>{
+    try {
+        await promises.access(filePath);
+        return true;
+    } catch  {
+        return false;
+    }
+};
+const readJson = async (filePath)=>JSON.parse(await promises.readFile(filePath, 'utf-8'));
+const verifyCloudflareOutput = async (options)=>{
+    const outputDirectory = node_path.resolve(options.outputDirectory);
+    const issues = [];
+    const outputPlan = createCloudflareOutputPlan(outputDirectory);
+    for (const relativePath of outputPlan.requiredFiles){
+        const filePath = node_path.join(outputDirectory, relativePath);
+        if (!await pathExists(filePath)) addIssue(issues, {
+            code: 'missing-file',
+            message: `Cloudflare output is missing ${relativePath}.`,
+            path: filePath
+        });
+    }
+    const manifestPath = outputPlan.paths.workerManifest;
+    const wranglerPath = outputPlan.paths.wranglerConfig;
+    const packagePath = outputPlan.paths.outputPackage;
+    const workerPackagePath = outputPlan.paths.workerPackage;
+    const manifest = await pathExists(manifestPath) ? await readJson(manifestPath) : void 0;
+    const wrangler = await pathExists(wranglerPath) ? await readJson(wranglerPath) : void 0;
+    const outputPackage = await pathExists(packagePath) ? await readJson(packagePath) : void 0;
+    const workerPackage = await pathExists(workerPackagePath) ? await readJson(workerPackagePath) : void 0;
+    if (manifest) {
+        verifyManifestShape(issues, manifest, manifestPath);
+        verifyDeliveryUnitIdentity(issues, manifest, manifestPath, options.deliveryUnit);
+        const workerReferences = getWorkerBundleReferences(manifest);
+        const providedWorkerPackages = new Set(workerPackage?.dependencies && 'object' == typeof workerPackage.dependencies ? Object.keys(workerPackage.dependencies) : []);
+        if (workerReferences.length > 0 && !await pathExists(workerPackagePath)) addIssue(issues, {
+            code: 'missing-file',
+            message: 'Cloudflare output is missing worker/package.json for referenced worker bundles.',
+            path: workerPackagePath
+        });
+        if (manifest.bff?.runtimeFramework === 'effect' && !getEffectBffWorker(manifest)) addIssue(issues, {
+            code: 'missing-worker-bundle',
+            message: 'Cloudflare Effect BFF manifest points to a missing worker bundle.'
+        });
+        for (const workerReference of workerReferences){
+            const resolvedWorker = resolveWorkerBundleReference(issues, outputDirectory, workerReference, manifestPath);
+            if (!resolvedWorker) continue;
+            const workerExists = await pathExists(resolvedWorker.path);
+            if (!workerExists) addIssue(issues, {
+                code: 'missing-worker-bundle',
+                message: missingWorkerBundleMessage(workerReference),
+                path: resolvedWorker.path
+            });
+            if (workerExists) {
+                const workerSource = await promises.readFile(resolvedWorker.path, 'utf-8');
+                await verifyWorkerBundleReferences(issues, resolvedWorker, workerSource, {
+                    providedPackages: providedWorkerPackages,
+                    workerRoot: outputPlan.paths.workerBundle
+                });
+                if ('effect-bff' === resolvedWorker.kind && (workerSource.includes(';entityKind;') || workerSource.includes(';entityKind,entityKind;'))) addIssue(issues, {
+                    code: 'invalid-worker-bundle',
+                    message: 'Cloudflare Effect BFF worker bundle contains invalid Drizzle entityKind marker references.',
+                    path: resolvedWorker.path
+                });
+            }
+        }
+    }
+    if (wrangler) {
+        assertEqual(issues, wrangler.main, outputPlan.wrangler.main, {
+            code: 'invalid-wrangler',
+            message: `wrangler.json main must be ${outputPlan.wrangler.main}.`,
+            path: wranglerPath
+        });
+        assertEqual(issues, wrangler.assets?.binding, outputPlan.wrangler.assets.binding, {
+            code: 'invalid-wrangler',
+            message: 'wrangler.json assets.binding must be ASSETS.',
+            path: wranglerPath
+        });
+        assertEqual(issues, wrangler.assets?.directory, outputPlan.wrangler.assets.directory, {
+            code: 'invalid-wrangler',
+            message: 'wrangler.json assets.directory must be ./public.',
+            path: wranglerPath
+        });
+        assertEqual(issues, wrangler.assets?.run_worker_first, outputPlan.wrangler.assets.run_worker_first, {
+            code: 'invalid-wrangler',
+            message: 'wrangler.json assets.run_worker_first must be true.',
+            path: wranglerPath
+        });
+        for (const flag of outputPlan.wrangler.requiredCompatibilityFlags)assertFlag(issues, wrangler.compatibility_flags, flag, {
+            code: 'invalid-wrangler',
+            message: `wrangler.json compatibility_flags must include ${flag}.`,
+            path: wranglerPath
+        });
+    }
+    if (outputPackage) assertEqual(issues, outputPackage.type, outputPlan.packages.output.type, {
+        code: 'invalid-package',
+        message: '.output/package.json must declare type module.',
+        path: packagePath
+    });
+    if (workerPackage) assertEqual(issues, workerPackage.type, outputPlan.packages.worker.type, {
+        code: 'invalid-package',
+        message: '.output/worker/package.json must declare type commonjs.',
+        path: workerPackagePath
+    });
+    for (const leakedPath of outputPlan.publicLeakDirectories){
+        const publicPath = node_path.join(outputPlan.paths.publicAssets, leakedPath);
+        if (await pathExists(publicPath)) addIssue(issues, {
+            code: 'public-output-leak',
+            message: `Framework-owned ${leakedPath} output leaked into public assets.`,
+            path: publicPath
+        });
+    }
+    if (false !== options.importWorker && await pathExists(outputPlan.paths.workerEntry)) await verifyWorkerImport(issues, outputPlan.paths.workerEntry, manifest);
+    return {
+        ok: 0 === issues.length,
+        issues
+    };
+};
+const assertCloudflareOutput = async (options)=>{
+    const result = await verifyCloudflareOutput(options);
+    if (!result.ok) throw new Error([
+        'Cloudflare output verification failed:',
+        ...result.issues.map((issue)=>`- ${issue.code}: ${issue.message}${issue.path ? ` (${issue.path})` : ''}`)
+    ].join('\n'));
+};
+export { verifyCloudflareOutputMutationPolicy } from "./mutation-policy.mjs";
+export { assertCloudflareOutput, verifyCloudflareOutput };

package/dist/esm/cloudflare-output-verifier/issues.mjs

@@ -0,0 +1,10 @@
+const addIssue = (issues, issue)=>{
+    issues.push(issue);
+};
+const assertEqual = (issues, actual, expected, issue)=>{
+    if (actual !== expected) addIssue(issues, issue);
+};
+const assertFlag = (issues, flags, flag, issue)=>{
+    if (!Array.isArray(flags) || !flags.includes(flag)) addIssue(issues, issue);
+};
+export { addIssue, assertEqual, assertFlag };

package/dist/esm/cloudflare-output-verifier/manifest.mjs

@@ -0,0 +1,51 @@
+import { BFF_EFFECT_WORKER_DISPATCHER_EXPORT } from "../cloudflare/constants.mjs";
+import { CLOUDFLARE_ASSETS_BINDING, CLOUDFLARE_PUBLIC_ASSETS_DIRECTORY, CLOUDFLARE_RUNTIME_TYPE, CLOUDFLARE_WORKER_ENTRY } from "../cloudflare-output-contract.mjs";
+import { addIssue, assertEqual } from "./issues.mjs";
+const verifyManifestShape = (issues, manifest, manifestPath)=>{
+    assertEqual(issues, manifest.runtime?.type, CLOUDFLARE_RUNTIME_TYPE, {
+        code: 'invalid-manifest',
+        message: 'Cloudflare output manifest runtime.type must be cloudflare-module-worker.',
+        path: manifestPath
+    });
+    assertEqual(issues, manifest.runtime?.entry, CLOUDFLARE_WORKER_ENTRY, {
+        code: 'invalid-manifest',
+        message: `Cloudflare output manifest runtime.entry must be ${CLOUDFLARE_WORKER_ENTRY}.`,
+        path: manifestPath
+    });
+    assertEqual(issues, manifest.runtime?.fetchExport, true, {
+        code: 'invalid-manifest',
+        message: 'Cloudflare output manifest runtime.fetchExport must be true.',
+        path: manifestPath
+    });
+    assertEqual(issues, manifest.runtime?.nodeListen, false, {
+        code: 'invalid-manifest',
+        message: 'Cloudflare output manifest runtime.nodeListen must be false.',
+        path: manifestPath
+    });
+    assertEqual(issues, manifest.assets?.binding, CLOUDFLARE_ASSETS_BINDING, {
+        code: 'invalid-manifest',
+        message: 'Cloudflare output manifest assets.binding must be ASSETS.',
+        path: manifestPath
+    });
+    assertEqual(issues, manifest.assets?.directory, `./${CLOUDFLARE_PUBLIC_ASSETS_DIRECTORY}`, {
+        code: 'invalid-manifest',
+        message: 'Cloudflare output manifest assets.directory must be ./public.',
+        path: manifestPath
+    });
+    assertEqual(issues, manifest.assets?.runWorkerFirst, true, {
+        code: 'invalid-manifest',
+        message: 'Cloudflare output manifest assets.runWorkerFirst must be true.',
+        path: manifestPath
+    });
+    if (!Array.isArray(manifest.routeSpec?.routes)) addIssue(issues, {
+        code: 'invalid-manifest',
+        message: 'Cloudflare output manifest routeSpec.routes must be array.',
+        path: manifestPath
+    });
+    if (manifest.bff?.runtimeFramework === 'effect') assertEqual(issues, manifest.bff.dispatcherExport, BFF_EFFECT_WORKER_DISPATCHER_EXPORT, {
+        code: 'invalid-manifest',
+        message: `Cloudflare Effect BFF manifest dispatcherExport must be ${BFF_EFFECT_WORKER_DISPATCHER_EXPORT}.`,
+        path: manifestPath
+    });
+};
+export { verifyManifestShape };

package/dist/esm/cloudflare-output-verifier/mutation-policy.mjs

@@ -0,0 +1,99 @@
+import promises from "node:fs/promises";
+import node_path from "node:path";
+import { addIssue } from "./issues.mjs";
+const SOURCE_SCAN_FILE_PATTERN = /\.(?:[cm]?[jt]s|json)$/u;
+const SOURCE_SCAN_IGNORED_DIRECTORY_NAMES = new Set([
+    '.codex',
+    '.fastcontext',
+    '.git',
+    '.mf',
+    '.modernjs',
+    '.output',
+    'coverage',
+    'dist',
+    'dist-cloudflare',
+    'node_modules',
+    'repos',
+    'topology'
+]);
+const FORBIDDEN_MUTATION_PATTERNS = [
+    {
+        code: 'forbidden-mutation-pattern',
+        message: "Generated Cloudflare server worker output must not be rewritten by app scripts.",
+        pattern: /\.output\/server\/index\.mjs/u
+    },
+    {
+        code: 'forbidden-mutation-pattern',
+        message: "Generated Cloudflare server worker output must not be rewritten by app scripts.",
+        pattern: /path\.(?:join|resolve)\(\s*['"`]\.output['"`]\s*,\s*['"`]server['"`]\s*,\s*['"`]index\.mjs['"`]\s*\)/u
+    },
+    {
+        code: 'forbidden-mutation-pattern',
+        message: "Generated Cloudflare BFF worker bundles must not be rewritten by app scripts.",
+        pattern: /\.output\/worker\/[^'"`]*\.(?:mjs|cjs|js)/u
+    },
+    {
+        code: 'forbidden-mutation-pattern',
+        message: "Generated Cloudflare BFF worker bundles must not be rewritten by app scripts.",
+        pattern: /path\.(?:join|resolve)\(\s*['"`]\.output['"`]\s*,\s*['"`]worker['"`]\s*,\s*['"`][^'"`]+\.(?:mjs|cjs|js)['"`]\s*\)/u
+    },
+    {
+        code: 'forbidden-mutation-pattern',
+        message: "Drizzle entityKind worker bundle markers must be fixed in the framework toolchain, not post-build scripts.",
+        pattern: /replaceAll\(\s*['"`];entityKind(?:,entityKind)?;/u
+    },
+    {
+        code: 'forbidden-mutation-pattern',
+        message: "Effect BFF Cloudflare dispatch must not depend on duck-typed runtime helper probing in app scripts.",
+        pattern: /(?:typeof\s+[^;\n]*dispatchEffectBffRequest|['"`]dispatchEffectBffRequest['"`]\s+in\s+|\.dispatchEffectBffRequest\b)/u
+    },
+    {
+        code: 'forbidden-mutation-pattern',
+        message: "Effect BFF Cloudflare dispatch must not branch on handler.length in app scripts.",
+        pattern: /\bhandler\s*\.\s*length\b/u
+    }
+];
+const pathExists = async (filePath)=>{
+    try {
+        await promises.access(filePath);
+        return true;
+    } catch  {
+        return false;
+    }
+};
+const walkFiles = async (root)=>{
+    if (!await pathExists(root)) return [];
+    const entries = await promises.readdir(root, {
+        withFileTypes: true
+    });
+    const files = [];
+    for (const entry of entries){
+        if (SOURCE_SCAN_IGNORED_DIRECTORY_NAMES.has(entry.name)) continue;
+        const entryPath = node_path.join(root, entry.name);
+        if (entry.isDirectory()) {
+            files.push(...await walkFiles(entryPath));
+            continue;
+        }
+        if (SOURCE_SCAN_FILE_PATTERN.test(entry.name)) files.push(entryPath);
+    }
+    return files;
+};
+const verifyCloudflareOutputMutationPolicy = async (options)=>{
+    const issues = [];
+    const excludedFiles = new Set((options.excludePaths ?? []).map((entry)=>node_path.resolve(entry)));
+    const files = (await Promise.all(options.scanRoots.map((scanRoot)=>walkFiles(node_path.resolve(scanRoot))))).flat();
+    for (const file of files){
+        if (excludedFiles.has(file)) continue;
+        const source = await promises.readFile(file, 'utf-8');
+        for (const forbidden of FORBIDDEN_MUTATION_PATTERNS)if (forbidden.pattern.test(source)) addIssue(issues, {
+            code: forbidden.code,
+            message: forbidden.message,
+            path: file
+        });
+    }
+    return {
+        ok: 0 === issues.length,
+        issues
+    };
+};
+export { verifyCloudflareOutputMutationPolicy, walkFiles };

package/dist/esm/cloudflare-output-verifier/worker-bundles.mjs

@@ -0,0 +1,313 @@
+import promises from "node:fs/promises";
+import node_path from "node:path";
+import { pathToFileURL } from "node:url";
+import { isDeepStrictEqual } from "node:util";
+import { parse } from "@babel/parser";
+import traverse from "@babel/traverse";
+import { CLOUDFLARE_WORKER_BUNDLE_DIRECTORY, CLOUDFLARE_WORKER_NODE_BUILTINS } from "../cloudflare-output-contract.mjs";
+import { addIssue } from "./issues.mjs";
+const getReferencedRouteWorkers = (manifest)=>Array.isArray(manifest?.routeSpec?.routes) ? manifest.routeSpec.routes.map((route)=>'string' == typeof route?.worker && route.worker.length > 0 ? route.worker : void 0).filter((worker)=>'string' == typeof worker) : [];
+const getEffectBffWorker = (manifest)=>manifest?.bff?.runtimeFramework === 'effect' && 'string' == typeof manifest.bff.worker ? manifest.bff.worker : void 0;
+const getWorkerBundleReferences = (manifest)=>{
+    const effectBffWorker = getEffectBffWorker(manifest);
+    return [
+        ...effectBffWorker ? [
+            {
+                dispatcherExport: 'string' == typeof manifest.bff?.dispatcherExport ? manifest.bff.dispatcherExport : void 0,
+                kind: 'effect-bff',
+                reference: effectBffWorker
+            }
+        ] : [],
+        ...getReferencedRouteWorkers(manifest).map((reference)=>({
+                kind: 'route',
+                reference
+            }))
+    ];
+};
+const resolveWorkerBundleReference = (issues, outputDirectory, reference, manifestPath)=>{
+    const workerRoot = node_path.resolve(outputDirectory, CLOUDFLARE_WORKER_BUNDLE_DIRECTORY);
+    const workerPath = node_path.resolve(outputDirectory, reference.reference);
+    const relativeToWorkerRoot = node_path.relative(workerRoot, workerPath);
+    if (node_path.isAbsolute(reference.reference) || relativeToWorkerRoot.startsWith('..') || node_path.isAbsolute(relativeToWorkerRoot)) {
+        addIssue(issues, {
+            code: 'invalid-manifest',
+            message: 'Cloudflare output manifest worker bundle references must stay under worker/.',
+            path: manifestPath
+        });
+        return null;
+    }
+    return {
+        ...reference,
+        path: workerPath
+    };
+};
+const missingWorkerBundleMessage = (reference)=>'effect-bff' === reference.kind ? 'Cloudflare Effect BFF manifest points to a missing worker bundle.' : 'Cloudflare route worker manifest points to a missing worker bundle.';
+const isAstNode = (value)=>null !== value && 'object' == typeof value && 'type' in value && 'string' == typeof value.type;
+const getNodeName = (node)=>{
+    if (!isAstNode(node)) return;
+    return 'Identifier' === node.type && 'string' == typeof node.name ? node.name : 'StringLiteral' === node.type && 'string' == typeof node.value ? node.value : void 0;
+};
+const getStringLiteralValue = (node)=>isAstNode(node) && 'StringLiteral' === node.type && 'string' == typeof node.value ? node.value : void 0;
+const collectBindingNames = (node, names)=>{
+    if (!isAstNode(node)) return;
+    const name = getNodeName(node);
+    if (name) return void names.add(name);
+    if ('ObjectPattern' === node.type && Array.isArray(node.properties)) {
+        for (const property of node.properties)if (isAstNode(property)) collectBindingNames('RestElement' === property.type ? property.argument : property.value, names);
+    } else if ('ArrayPattern' === node.type && Array.isArray(node.elements)) for (const element of node.elements)collectBindingNames(element, names);
+    else if ('AssignmentPattern' === node.type || 'RestElement' === node.type) collectBindingNames('AssignmentPattern' === node.type ? node.left : node.argument, names);
+};
+const getMemberPropertyName = (node)=>{
+    if ('MemberExpression' !== node.type) return;
+    return true === node.computed ? getStringLiteralValue(node.property) : getNodeName(node.property);
+};
+const isAmbientModuleRequire = (node, modulePath)=>isAstNode(node) && 'MemberExpression' === node.type && isAstNode(node.object) && 'Identifier' === node.object.type && 'module' === node.object.name && void 0 === modulePath.scope.getBinding('module') && 'require' === getMemberPropertyName(node);
+const isModuleExports = (node)=>isAstNode(node) && 'MemberExpression' === node.type && isAstNode(node.object) && 'Identifier' === node.object.type && 'module' === node.object.name && 'exports' === getMemberPropertyName(node);
+const collectCommonJsExports = (statement, exports)=>{
+    if ('ExpressionStatement' !== statement.type || !isAstNode(statement.expression) || 'AssignmentExpression' !== statement.expression.type) return;
+    const { left, right } = statement.expression;
+    if (isAstNode(left) && 'MemberExpression' === left.type && (isAstNode(left.object) && 'Identifier' === left.object.type && 'exports' === left.object.name || isModuleExports(left.object))) {
+        const exportName = getMemberPropertyName(left);
+        if (exportName) exports.add(exportName);
+        return;
+    }
+    if (isModuleExports(left) && isAstNode(right) && 'ObjectExpression' === right.type && Array.isArray(right.properties)) {
+        for (const property of right.properties)if (isAstNode(property)) {
+            const exportName = getNodeName(property.key);
+            if (exportName) exports.add(exportName);
+        }
+    }
+};
+const collectEsmExports = (statement, exports)=>{
+    if ('ExportDefaultDeclaration' === statement.type) return void exports.add('default');
+    if ('ExportNamedDeclaration' !== statement.type) return;
+    if (isAstNode(statement.declaration)) {
+        const declaration = statement.declaration;
+        const declarationName = getNodeName(declaration.id);
+        if (declarationName) exports.add(declarationName);
+        if ('VariableDeclaration' === declaration.type && Array.isArray(declaration.declarations)) {
+            for (const declarator of declaration.declarations)if (isAstNode(declarator)) collectBindingNames(declarator.id, exports);
+        }
+    }
+    if (Array.isArray(statement.specifiers)) {
+        for (const specifier of statement.specifiers)if (isAstNode(specifier)) {
+            const exportName = getNodeName(specifier.exported);
+            if (exportName) exports.add(exportName);
+        }
+    }
+};
+const getStaticImport = (modulePath)=>{
+    const node = modulePath.node;
+    if (('ImportDeclaration' === node.type || 'ExportNamedDeclaration' === node.type || 'ExportAllDeclaration' === node.type) && isAstNode(node.source)) return getStringLiteralValue(node.source);
+    if ('ImportExpression' === node.type && isAstNode(node.source)) return getStringLiteralValue(node.source);
+    if ('CallExpression' === node.type && Array.isArray(node.arguments) && 1 === node.arguments.length && isAstNode(node.callee) && ('Identifier' === node.callee.type && 'require' === node.callee.name && void 0 === modulePath.scope.getBinding('require') || isAmbientModuleRequire(node.callee, modulePath) || 'Import' === node.callee.type)) return getStringLiteralValue(node.arguments[0]);
+};
+const isAmbientLoaderWrite = (modulePath)=>{
+    let targetPath = modulePath;
+    while(true){
+        const parentPath = targetPath.parentPath;
+        if (null === parentPath) return false;
+        if (parentPath.isAssignmentExpression()) return 'left' === targetPath.key;
+        if (parentPath.isUpdateExpression()) return 'argument' === targetPath.key;
+        if (parentPath.isForInStatement() || parentPath.isForOfStatement()) return 'left' === targetPath.key;
+        if (parentPath.isObjectProperty()) {
+            if ('value' !== targetPath.key) return false;
+            targetPath = parentPath;
+            continue;
+        }
+        if (parentPath.isObjectPattern() || parentPath.isArrayPattern() || parentPath.isRestElement() || parentPath.isAssignmentPattern()) {
+            targetPath = parentPath;
+            continue;
+        }
+        return false;
+    }
+};
+const analyzeWorkerModule = (source)=>{
+    const ast = parse(source, {
+        sourceType: 'unambiguous'
+    });
+    const exports = new Set();
+    const imports = new Set();
+    let unsafeCommonJsLoaderUsage = false;
+    let unsafeDynamicImport = false;
+    for (const statement of ast.program.body){
+        collectEsmExports(statement, exports);
+        collectCommonJsExports(statement, exports);
+    }
+    traverse(ast, {
+        enter (modulePath) {
+            const node = modulePath.node;
+            if (('ImportExpression' === node.type || 'CallExpression' === node.type && isAstNode(node.callee) && 'Import' === node.callee.type) && void 0 === getStaticImport(modulePath)) unsafeDynamicImport = true;
+            if (modulePath.isReferencedIdentifier({
+                name: 'require'
+            }) && void 0 === modulePath.scope.getBinding('require')) {
+                const parentPath = modulePath.parentPath;
+                const isStaticRequireCall = parentPath?.isCallExpression() && 'callee' === modulePath.key && void 0 !== getStaticImport(parentPath);
+                const isAvailabilityCheck = parentPath?.isUnaryExpression({
+                    operator: 'typeof'
+                });
+                if (!isStaticRequireCall && !isAvailabilityCheck) unsafeCommonJsLoaderUsage = true;
+            }
+            if ('Identifier' === node.type && isAmbientLoaderWrite(modulePath) && ('require' === node.name || 'module' === node.name) && void 0 === modulePath.scope.getBinding(node.name)) unsafeCommonJsLoaderUsage = true;
+            if (modulePath.isReferencedIdentifier({
+                name: 'module'
+            }) && void 0 === modulePath.scope.getBinding('module')) {
+                const parentPath = modulePath.parentPath;
+                const isExportsAccess = null !== parentPath && isModuleExports(parentPath.node);
+                const isStaticModuleRequireCall = null !== parentPath && isAmbientModuleRequire(parentPath.node, parentPath) && parentPath.parentPath?.isCallExpression() === true && 'callee' === parentPath.key && void 0 !== getStaticImport(parentPath.parentPath);
+                if (!isExportsAccess && !isStaticModuleRequireCall) unsafeCommonJsLoaderUsage = true;
+            }
+            if (isAmbientModuleRequire(node, modulePath)) {
+                const parentPath = modulePath.parentPath;
+                const isStaticRequireCall = parentPath?.isCallExpression() && 'callee' === modulePath.key && void 0 !== getStaticImport(parentPath);
+                if (!isStaticRequireCall) unsafeCommonJsLoaderUsage = true;
+            }
+            const specifier = getStaticImport(modulePath);
+            if (void 0 !== specifier) imports.add(specifier);
+        }
+    });
+    return {
+        exports,
+        imports,
+        unsafeCommonJsLoaderUsage,
+        unsafeDynamicImport
+    };
+};
+const getPackageName = (specifier)=>specifier.startsWith('@') ? specifier.split('/').slice(0, 2).join('/') : specifier.split('/')[0];
+const CLOUDFLARE_WORKER_NODE_BUILTIN_SPECIFIERS = new Set(CLOUDFLARE_WORKER_NODE_BUILTINS.map((builtin)=>`node:${builtin}`));
+const isInsideDirectory = (directory, filePath)=>{
+    const relative = node_path.relative(directory, filePath);
+    return 0 === relative.length || !relative.startsWith('..') && !node_path.isAbsolute(relative);
+};
+const resolveWorkerModule = async (importer, specifier)=>{
+    const unresolvedPath = node_path.resolve(node_path.dirname(importer), specifier);
+    const candidates = [
+        unresolvedPath,
+        `${unresolvedPath}.js`,
+        `${unresolvedPath}.mjs`,
+        `${unresolvedPath}.cjs`,
+        node_path.join(unresolvedPath, 'index.js'),
+        node_path.join(unresolvedPath, 'index.mjs'),
+        node_path.join(unresolvedPath, 'index.cjs')
+    ];
+    for (const candidate of candidates)try {
+        if ((await promises.stat(candidate)).isFile()) return await promises.realpath(candidate);
+    } catch  {}
+};
+const verifyWorkerModuleClosure = async (issues, entryPath, entrySource, contract)=>{
+    const visited = new Set();
+    let entryAnalysis;
+    const [realWorkerRoot, realEntryPath] = await Promise.all([
+        promises.realpath(contract.workerRoot),
+        promises.realpath(entryPath)
+    ]);
+    if (!isInsideDirectory(realWorkerRoot, realEntryPath)) return void addIssue(issues, {
+        code: 'invalid-worker-bundle',
+        message: 'Cloudflare worker bundles must not resolve outside the staged worker directory.',
+        path: entryPath
+    });
+    const visitModule = async (modulePath, source, isEntry = false)=>{
+        if (visited.has(modulePath)) return;
+        visited.add(modulePath);
+        let analysis;
+        try {
+            analysis = analyzeWorkerModule(source ?? await promises.readFile(modulePath, 'utf-8'));
+        } catch (error) {
+            addIssue(issues, {
+                code: 'invalid-worker-bundle',
+                message: `Cloudflare worker bundle module could not be parsed: ${error instanceof Error ? error.message : String(error)}`,
+                path: modulePath
+            });
+            return;
+        }
+        if (isEntry) entryAnalysis = analysis;
+        if (analysis.unsafeCommonJsLoaderUsage) addIssue(issues, {
+            code: 'invalid-worker-bundle',
+            message: 'Cloudflare worker bundles must use exactly one string-literal specifier in ambient CommonJS loader calls and must not pass or alias the loader.',
+            path: modulePath
+        });
+        if (analysis.unsafeDynamicImport) addIssue(issues, {
+            code: 'invalid-worker-bundle',
+            message: 'Cloudflare worker bundles must not contain non-static dynamic module imports.',
+            path: modulePath
+        });
+        for (const specifier of analysis.imports){
+            if (0 === specifier.length) {
+                addIssue(issues, {
+                    code: 'invalid-worker-bundle',
+                    message: 'Cloudflare worker bundle module specifiers must not be empty.',
+                    path: modulePath
+                });
+                continue;
+            }
+            if (!specifier.startsWith('.') && !node_path.isAbsolute(specifier)) {
+                if (CLOUDFLARE_WORKER_NODE_BUILTIN_SPECIFIERS.has(specifier)) continue;
+                if (specifier.startsWith('node:')) {
+                    addIssue(issues, {
+                        code: 'invalid-worker-bundle',
+                        message: `Cloudflare worker bundle import "${specifier}" is not a supported Worker node: builtin.`,
+                        path: modulePath
+                    });
+                    continue;
+                }
+                if (!contract.providedPackages.has(getPackageName(specifier))) addIssue(issues, {
+                    code: 'invalid-worker-bundle',
+                    message: `Cloudflare worker bundle import "${specifier}" is not provided by worker/package.json dependencies.`,
+                    path: modulePath
+                });
+                continue;
+            }
+            const resolved = await resolveWorkerModule(modulePath, specifier);
+            if (resolved && !isInsideDirectory(realWorkerRoot, resolved)) {
+                addIssue(issues, {
+                    code: 'invalid-worker-bundle',
+                    message: 'Cloudflare worker bundles must not resolve outside the staged worker directory.',
+                    path: modulePath
+                });
+                continue;
+            }
+            if (!resolved) {
+                addIssue(issues, {
+                    code: 'invalid-worker-bundle',
+                    message: `Cloudflare worker bundle import "${specifier}" does not resolve inside worker/.`,
+                    path: modulePath
+                });
+                continue;
+            }
+            await visitModule(resolved);
+        }
+    };
+    await visitModule(realEntryPath, entrySource, true);
+    return entryAnalysis;
+};
+const verifyWorkerBundleReferences = async (issues, worker, source, contract)=>{
+    const entryAnalysis = await verifyWorkerModuleClosure(issues, worker.path, source, contract);
+    if ('effect-bff' === worker.kind && 'string' == typeof worker.dispatcherExport && !entryAnalysis?.exports.has(worker.dispatcherExport)) addIssue(issues, {
+        code: 'invalid-worker-bundle',
+        message: 'Cloudflare Effect BFF worker bundle must expose its manifest dispatcherExport.',
+        path: worker.path
+    });
+};
+const verifyWorkerImport = async (issues, entryPath, expectedManifest)=>{
+    try {
+        const workerModule = await import(`${pathToFileURL(entryPath).href}?t=${Date.now()}`);
+        const worker = workerModule.default;
+        if (!worker || 'function' != typeof worker.fetch) addIssue(issues, {
+            code: 'worker-import-failed',
+            message: 'Cloudflare server entry must default-export a Worker with fetch.',
+            path: entryPath
+        });
+        if (void 0 !== expectedManifest && !isDeepStrictEqual(workerModule.modernWorkerManifest, expectedManifest)) addIssue(issues, {
+            code: 'worker-import-failed',
+            message: 'Cloudflare server entry runtime manifest must exactly match modern-worker-manifest.json.',
+            path: entryPath
+        });
+    } catch (error) {
+        addIssue(issues, {
+            code: 'worker-import-failed',
+            message: `Cloudflare server entry could not be imported: ${error instanceof Error ? error.message : String(error)}`,
+            path: entryPath
+        });
+    }
+};
+export { getEffectBffWorker, getWorkerBundleReferences, missingWorkerBundleMessage, resolveWorkerBundleReference, verifyWorkerBundleReferences, verifyWorkerImport };

package/dist/esm/css-extract-runtime-plugin.mjs

@@ -0,0 +1,32 @@
+const PLUGIN_NAME = 'ModernjsCssExtractRuntimePlugin';
+const CSS_LOADING_RUNTIME_MODULE = 'webpack/runtime/css loading';
+const CSS_EXTRACT_STYLESHEET_MATCH = '\t\tif (tag.rel === "stylesheet" && (dataHref === href || dataHref === fullhref)) return tag;';
+const CSS_EXTRACT_STYLESHEET_MATCH_WITH_NORMALIZED_URL = `\t\tvar absoluteHref = tag.href;
+\t\tvar absoluteFullHref = new URL(fullhref, document.baseURI).href;
+\t\tif (tag.rel === "stylesheet" && (dataHref === href || dataHref === fullhref || absoluteHref === absoluteFullHref)) return tag;`;
+const isAutomaticPublicPath = (publicPath)=>'auto' === publicPath || 'auto/' === publicPath;
+const normalizeCssExtractRuntimeStylesheetLookup = (source)=>{
+    if (!source.includes('__webpack_require__.miniCssF')) return source;
+    const occurrences = source.split(CSS_EXTRACT_STYLESHEET_MATCH).length - 1;
+    if (1 !== occurrences) throw new Error(`Unsupported CssExtractRspackPlugin runtime shape: expected one stylesheet lookup, found ${occurrences}.`);
+    return source.replace(CSS_EXTRACT_STYLESHEET_MATCH, CSS_EXTRACT_STYLESHEET_MATCH_WITH_NORMALIZED_URL);
+};
+class CssExtractRuntimePlugin {
+    apply(compiler) {
+        if (!isAutomaticPublicPath(compiler.options.output.publicPath)) return;
+        compiler.hooks.thisCompilation.tap(PLUGIN_NAME, (compilation)=>{
+            compilation.hooks.runtimeModule.tap(PLUGIN_NAME, (runtimeModule)=>{
+                if (runtimeModule.identifier() !== CSS_LOADING_RUNTIME_MODULE) return;
+                const source = runtimeModule.source;
+                if (!source) return;
+                const runtimeSource = source.source;
+                if ('string' != typeof runtimeSource) return;
+                source.source = normalizeCssExtractRuntimeStylesheetLookup(runtimeSource);
+            });
+        });
+    }
+    constructor(){
+        this.name = PLUGIN_NAME;
+    }
+}
+export { CssExtractRuntimePlugin, normalizeCssExtractRuntimeStylesheetLookup };

package/dist/esm/index.mjs

@@ -0,0 +1,10 @@
+export * from "./cloudflare/index.mjs";
+export * from "./cloudflare-builder.mjs";
+export * from "./cloudflare-output-contract.mjs";
+export * from "./cloudflare-output-plan.mjs";
+export * from "./cloudflare-output-verifier/index.mjs";
+export * from "./config.mjs";
+export * from "./css-extract-runtime-plugin.mjs";
+export * from "./release-envelope/index.mjs";
+export * from "./release-envelope/plugin.mjs";
+export * from "./release-identity.mjs";

package/dist/esm/read-template.mjs

@@ -0,0 +1,5 @@
+import node_path from "node:path";
+import { fs } from "@modern-js/utils";
+const getTemplatePath = (file)=>node_path.join(__dirname, 'templates', file);
+const readTemplate = async (file)=>(await fs.readFile(getTemplatePath(file))).toString();
+export { getTemplatePath, readTemplate };