@bleedingdev/modern-js-app-tools-extensions 3.9.0-ultramodern.11 → 3.9.0-ultramodern.13

package/dist/esm/backend-federation-build/emit.mjs

@@ -5,7 +5,7 @@ import { resolveUltramodernReleaseIdentity } from "@modern-js/app-tools-extensio
 import { BACKEND_FEDERATION_MANIFEST_FILE, BACKEND_FEDERATION_REMOTE_ENTRY_FILE, ULTRAMODERN_BUILD_ARTIFACT_FILE, stampUltramodernBuildArtifactIdentity } from "@modern-js/backend-federation-contracts";
 import { createBackendFederationEntryIntegrity } from "@modern-js/server-runtime-extensions/backend-federation-security/node";
 import { createBackendManifest, createBackendRemoteEntrySource } from "./codegen.mjs";
-import { COMPACT_CONFIG_PATH, buildArtifactPathFor, createStampedDeliveryUnit, findBackendFederationApp, findWorkspaceRoot, readBuildIdentity, resolveWorkspaceSourceRevision } from "./config.mjs";
+import { REFERENCE_TOPOLOGY_PATH, buildArtifactPathFor, createStampedDeliveryUnit, findBackendFederationApp, findWorkspaceRoot, readBuildIdentity, resolveWorkspaceSourceRevision } from "./config.mjs";
 const emitBackendFederationArtifacts = async (appDirectory, distDirectory)=>{
     const workspaceRoot = findWorkspaceRoot(appDirectory);
     if (!workspaceRoot) return;
@@ -15,35 +15,39 @@ const emitBackendFederationArtifacts = async (appDirectory, distDirectory)=>{
     const app = await findBackendFederationApp(workspaceRoot, appDirectory);
     if (!app) return;
     const buildIdentity = await readBuildIdentity(appDirectory);
-    const compactDeliveryUnit = app.compactDeliveryUnit;
-    const hasCompactDeliveryUnit = void 0 !== compactDeliveryUnit && (void 0 !== compactDeliveryUnit.unitId || void 0 !== compactDeliveryUnit.buildMarker || void 0 !== compactDeliveryUnit.packageName || void 0 !== compactDeliveryUnit.version);
+    const topologyDeliveryUnit = app.topologyDeliveryUnit;
+    const hasTopologyDeliveryUnit = void 0 !== topologyDeliveryUnit && (void 0 !== topologyDeliveryUnit.unitId || void 0 !== topologyDeliveryUnit.buildMarker || void 0 !== topologyDeliveryUnit.packageName || void 0 !== topologyDeliveryUnit.version);
     const hasBuildIdentity = void 0 !== buildIdentity.unitId || void 0 !== buildIdentity.buildVersion || void 0 !== buildIdentity.packageName || void 0 !== buildIdentity.version;
     if (hasBuildIdentity) {
-        const compactConfigPath = node_path.join(workspaceRoot, COMPACT_CONFIG_PATH);
+        const topologyPath = node_path.join(workspaceRoot, REFERENCE_TOPOLOGY_PATH);
         const buildIdentityPath = buildArtifactPathFor(appDirectory);
         const mismatches = [];
         const compare = (label, a, b, leftLabel = 'deliveryUnit')=>{
             if (void 0 !== a && void 0 !== b && a !== b) mismatches.push(`${label}: ${leftLabel}=${a} vs ultramodern-build=${b}`);
         };
         compare('appId', app.id, buildIdentity.appId, 'topology');
-        if (hasCompactDeliveryUnit) {
-            compare('unitId', compactDeliveryUnit?.unitId, buildIdentity.unitId);
-            compare('buildMarker/build', compactDeliveryUnit?.buildMarker, buildIdentity.buildVersion);
-            compare('packageName', compactDeliveryUnit?.packageName, buildIdentity.packageName);
-            compare('version', compactDeliveryUnit?.version, buildIdentity.version);
+        if (hasTopologyDeliveryUnit) {
+            compare('unitId', topologyDeliveryUnit?.unitId, buildIdentity.unitId);
+            compare('buildMarker/build', topologyDeliveryUnit?.buildMarker, buildIdentity.buildVersion);
+            compare('packageName', topologyDeliveryUnit?.packageName, buildIdentity.packageName);
+            compare('version', topologyDeliveryUnit?.version, buildIdentity.version);
         }
-        if (mismatches.length > 0) throw new Error(`[backend-federation-build] Delivery-unit identity drift between ${compactConfigPath} (topology) and ${buildIdentityPath}: ${mismatches.join('; ')}`);
+        compare('packageName', app.packageName, buildIdentity.packageName, 'package.json');
+        compare('packageName', topologyDeliveryUnit?.packageName, app.packageName, 'topology');
+        compare('version', app.version, buildIdentity.version, 'package.json');
+        compare('version', topologyDeliveryUnit?.version, app.version, 'topology');
+        if (mismatches.length > 0) throw new Error(`[backend-federation-build] Delivery-unit identity drift between ${topologyPath}, package.json and ${buildIdentityPath}: ${mismatches.join('; ')}`);
     }
-    const unitId = compactDeliveryUnit?.unitId ?? buildIdentity.unitId;
-    const generationBuildMarker = compactDeliveryUnit?.buildMarker ?? buildIdentity.buildVersion;
+    const unitId = topologyDeliveryUnit?.unitId ?? buildIdentity.unitId;
+    const generationBuildMarker = topologyDeliveryUnit?.buildMarker ?? buildIdentity.buildVersion;
     const sourceRevision = await resolveWorkspaceSourceRevision(workspaceRoot);
     const buildVersion = generationBuildMarker && unitId ? resolveUltramodernReleaseIdentity({
         generationBuildMarker,
         unitId,
         workspaceRoot
     }).buildMarker : void 0;
-    const packageName = compactDeliveryUnit?.packageName ?? buildIdentity.packageName ?? app.packageName;
-    const version = compactDeliveryUnit?.version ?? buildIdentity.version;
+    const packageName = app.packageName;
+    const version = app.version;
     const deliveryUnit = createStampedDeliveryUnit({
         appId: app.id,
         unitId,

package/dist/esm/build-config/remote-address.mjs

@@ -0,0 +1,18 @@
+import { resolveBrowserManifestAddress } from "@modern-js/surface-resolution";
+import { getBuildConfigEnvironment } from "./build-environment.mjs";
+function createRemoteManifestUrl(options) {
+    const env = Object.fromEntries([
+        options.manifestEnv,
+        options.publicUrlEnv,
+        'MODERNJS_DEPLOY',
+        'ULTRAMODERN_CLOUDFLARE_WORKERS_DEV_SUBDOMAIN',
+        'ULTRAMODERN_CLOUDFLARE_REQUIRE_PUBLIC_URLS'
+    ].map((name)=>[
+            name,
+            getBuildConfigEnvironment(name)
+        ]));
+    const address = resolveBrowserManifestAddress(env, options, getBuildConfigEnvironment('NODE_ENV') ?? 'production');
+    if (!address.ok) throw new Error(`Remote ${options.mfName}: ${address.reason}`);
+    return env[options.manifestEnv]?.trim() || `${options.mfName}@${address.manifestUrl}`;
+}
+export { createRemoteManifestUrl };

package/dist/esm/cloudflare/delivery-unit.mjs

@@ -3,11 +3,11 @@ import { ULTRAMODERN_BUILD_ARTIFACT_PATH, isUltramodernBuildArtifact, nonEmptySt
 import { fs } from "@modern-js/utils";
 import { resolveUltramodernReleaseIdentity } from "../release-identity.mjs";
 import { isRecord } from "./utils.mjs";
-const COMPACT_CONFIG_PATH = '.modernjs/ultramodern.json';
+const TOPOLOGY_PATH = 'topology/reference-topology.json';
 const findWorkspaceRoot = async (appDirectory)=>{
     let current = node_path.resolve(appDirectory);
     for(;;){
-        if (await fs.pathExists(node_path.join(current, COMPACT_CONFIG_PATH))) return current;
+        if (await fs.pathExists(node_path.join(current, TOPOLOGY_PATH))) return current;
         const parent = node_path.dirname(current);
         if (parent === current) return;
         current = parent;
@@ -24,36 +24,25 @@ const stampReleaseIdentity = (identity, workspaceRoot)=>{
         })
     };
 };
-const resolveCompactApp = async (appDirectory)=>{
+const resolveTopologyApp = async (appDirectory)=>{
     const workspaceRoot = await findWorkspaceRoot(appDirectory);
     if (!workspaceRoot) return;
-    let compactConfig;
-    try {
-        compactConfig = await fs.readJSON(node_path.join(workspaceRoot, COMPACT_CONFIG_PATH));
-    } catch  {
-        return {
-            workspaceRoot
-        };
-    }
-    if (!isRecord(compactConfig)) return {
-        workspaceRoot
-    };
-    const topology = isRecord(compactConfig.topology) ? compactConfig.topology : void 0;
-    const apps = Array.isArray(topology?.apps) ? topology.apps : void 0;
-    if (!apps) return {
-        app: compactConfig,
-        workspaceRoot
-    };
+    const topology = await fs.readJSON(node_path.join(workspaceRoot, TOPOLOGY_PATH));
+    if (!isRecord(topology) || !isRecord(topology.shell) || !Array.isArray(topology.verticals) || void 0 !== topology.shells && !Array.isArray(topology.shells)) throw new Error('[cloudflare-delivery-unit] Invalid declared reference topology.');
+    const apps = [
+        topology.shell,
+        ...topology.verticals,
+        ...Array.isArray(topology.shells) ? topology.shells : []
+    ];
     const resolvedAppDirectory = node_path.resolve(appDirectory);
     const app = apps.find((candidate)=>{
         if (!isRecord(candidate)) return false;
         const appPath = nonEmptyString(candidate.path);
         return void 0 !== appPath && node_path.resolve(workspaceRoot, appPath.replace(/^\.\/+/u, '')) === resolvedAppDirectory;
     });
+    if (!isRecord(app)) throw new Error(`[cloudflare-delivery-unit] ${appDirectory} is missing from the declared reference topology.`);
     return {
-        ...isRecord(app) ? {
-            app
-        } : {},
+        app,
         workspaceRoot
     };
 };
@@ -80,10 +69,11 @@ const createDeliveryUnitStamp = (identity, app)=>{
     };
 };
 const resolveTopologyDeliveryUnit = async (appDirectory)=>{
-    const resolved = await resolveCompactApp(appDirectory);
+    const resolved = await resolveTopologyApp(appDirectory);
     if (!resolved?.app) return;
     const identity = toDeliveryUnitIdentity(resolved.app.deliveryUnit);
-    return identity ? createDeliveryUnitStamp(stampReleaseIdentity(identity, resolved.workspaceRoot), resolved.app) : void 0;
+    if (!identity) throw new Error('[cloudflare-delivery-unit] Declared app is missing a valid delivery-unit identity.');
+    return createDeliveryUnitStamp(stampReleaseIdentity(identity, resolved.workspaceRoot), resolved.app);
 };
 const resolveWorkerDeliveryUnitStamp = async (appDirectory)=>{
     const buildArtifactPath = node_path.join(appDirectory, ULTRAMODERN_BUILD_ARTIFACT_PATH);
@@ -94,7 +84,7 @@ const resolveWorkerDeliveryUnitStamp = async (appDirectory)=>{
         identity = toDeliveryUnitIdentity(artifact.deliveryUnit);
     }
     if (!identity) return;
-    const resolved = await resolveCompactApp(appDirectory);
+    const resolved = await resolveTopologyApp(appDirectory);
     if (resolved) identity = stampReleaseIdentity(identity, resolved.workspaceRoot);
     return createDeliveryUnitStamp(identity, resolved?.app);
 };

package/dist/esm/cloudflare/index.mjs

@@ -1,4 +1,5 @@
 import node_path from "node:path";
+import { BACKEND_FEDERATION_MANIFEST_FILE, BACKEND_FEDERATION_REMOTE_ENTRY_FILE, ULTRAMODERN_BUILD_ARTIFACT_FILE } from "@modern-js/backend-federation-contracts";
 import { fs } from "@modern-js/utils";
 import { createCloudflareOutputPlan } from "../cloudflare-output-plan.mjs";
 import { assertCloudflareOutput } from "../cloudflare-output-verifier/index.mjs";
@@ -36,7 +37,7 @@ const createCloudflarePreset = ({ api, appContext, modernConfig })=>{
             await fs.remove(outputDirectory);
         },
         async writeOutput () {
-            if (releaseEnvelopeEnabled && await fs.pathExists(node_path.join(distDirectory, MICROVERTICAL_RELEASE_ENVELOPE_PATH))) await emitFrameworkMicroVerticalReleaseEnvelope({
+            if (releaseEnvelopeEnabled) await emitFrameworkMicroVerticalReleaseEnvelope({
                 apiOnly,
                 distDirectory,
                 target: 'cloudflare'
@@ -45,6 +46,11 @@ const createCloudflarePreset = ({ api, appContext, modernConfig })=>{
             await fs.copy(distDirectory, publicDirectory, {
                 filter: (src)=>{
                     const relativePath = node_path.relative(distDirectory, src).replace(/\\/gu, '/');
+                    if (apiOnly && '' !== relativePath && ![
+                        BACKEND_FEDERATION_MANIFEST_FILE,
+                        BACKEND_FEDERATION_REMOTE_ENTRY_FILE,
+                        ULTRAMODERN_BUILD_ARTIFACT_FILE
+                    ].includes(relativePath)) return false;
                     return 'release' !== relativePath && !relativePath.startsWith('release/') && 'public' !== relativePath && !relativePath.startsWith('public/') && shouldCopyToPublicAssets(src, distDirectory, publicAssetExcludes);
                 }
             });

package/dist/esm/cloudflare-builder.mjs

@@ -205,9 +205,9 @@ const prependBundlerChain = (environment, handler)=>{
 };
 const getWorkerEntries = (environment, normalizedConfig, appContext)=>{
     const configuredEntries = environment.source?.entry;
-    if (!configuredEntries) return;
-    const entries = rewriteWorkerEntries(configuredEntries);
     const effectApiEntry = getEffectBffEntry(normalizedConfig, appContext);
+    if (!configuredEntries && !effectApiEntry) return;
+    const entries = configuredEntries ? rewriteWorkerEntries(configuredEntries) : {};
     return effectApiEntry ? {
         ...entries,
         [BFF_EFFECT_WORKER_ENTRY_NAME]: [
@@ -287,7 +287,14 @@ const createCloudflareBundlerChain = (appContext, workerEntryNames)=>{
 };
 function getCloudflareBuilderEnvironments({ appContext, environments, normalizedConfig, resolveDeployProvider = resolveStdEnvDeployProvider }) {
     if (!isCloudflareWorkerDeploy(normalizedConfig, resolveDeployProvider)) return environments;
-    const workerEnvironment = environments[SERVICE_WORKER_ENVIRONMENT_NAME];
+    const workerEnvironment = environments[SERVICE_WORKER_ENVIRONMENT_NAME] ?? (appContext.apiOnly ? {
+        output: {
+            target: 'web-worker'
+        },
+        source: {
+            entry: {}
+        }
+    } : void 0);
     if (!workerEnvironment) return environments;
     const workerEntries = getWorkerEntries(workerEnvironment, normalizedConfig, appContext);
     if (!workerEntries) return environments;
@@ -303,6 +310,9 @@ function getCloudflareBuilderEnvironments({ appContext, environments, normalized
             entry: workerEntries
         }
     }, createCloudflareBundlerChain(appContext, Object.keys(workerEntries)));
+    if (appContext.apiOnly) return {
+        [SERVICE_WORKER_ENVIRONMENT_NAME]: cloudflareWorkerEnvironment
+    };
     return {
         ...environments,
         [SERVICE_WORKER_ENVIRONMENT_NAME]: cloudflareWorkerEnvironment

package/dist/esm/cloudflare-output-contract.mjs

@@ -25,6 +25,7 @@ const CLOUDFLARE_WORKER_NODE_BUILTINS = [
     'fs/promises',
     'http',
     'http2',
+    'https',
     'inspector',
     'module',
     'net',

package/dist/esm/cloudflare-output-verifier/identity.mjs

@@ -24,30 +24,32 @@ const verifyDeliveryUnitIdentity = (issues, manifest, manifestPath, declared)=>{
     ]){
         const marker = stamped.surfaces[surface];
         const expected = declared?.surfaces?.[surface];
-        if (declared?.surfaces && !expected) {
-            if (marker) addIssue(issues, {
-                code: 'delivery-unit-drift',
-                message: `Cloudflare worker manifest declares an unexpected ${surface} delivery-unit surface for this topology profile.`,
-                path: manifestPath
-            });
-            continue;
-        }
-        if (!marker || 'object' != typeof marker) {
-            addIssue(issues, {
-                code: 'missing-delivery-unit',
-                message: `Cloudflare worker manifest is missing the ${surface} delivery-unit surface marker.`,
-                path: manifestPath
-            });
-            continue;
-        }
-        for (const field of DELIVERY_UNIT_IDENTITY_FIELDS){
-            const markerValue = deliveryUnitIdentityFieldValue(marker, field);
-            const stampedValue = deliveryUnitIdentityFieldValue(stamped, field);
-            assertEqual(issues, markerValue, stampedValue, {
-                code: 'delivery-unit-drift',
-                message: `Cloudflare worker manifest ${surface} surface deliveryUnit.${field} must derive from one delivery-unit record (expected ${stampedValue ?? 'undefined'}, received ${markerValue ?? 'undefined'}).`,
-                path: manifestPath
-            });
+        if (expected || marker) {
+            if (declared?.surfaces && !expected) {
+                if (marker) addIssue(issues, {
+                    code: 'delivery-unit-drift',
+                    message: `Cloudflare worker manifest declares an unexpected ${surface} delivery-unit surface for this topology profile.`,
+                    path: manifestPath
+                });
+                continue;
+            }
+            if (!marker || 'object' != typeof marker) {
+                addIssue(issues, {
+                    code: 'missing-delivery-unit',
+                    message: `Cloudflare worker manifest is missing the ${surface} delivery-unit surface marker.`,
+                    path: manifestPath
+                });
+                continue;
+            }
+            for (const field of DELIVERY_UNIT_IDENTITY_FIELDS){
+                const markerValue = deliveryUnitIdentityFieldValue(marker, field);
+                const stampedValue = deliveryUnitIdentityFieldValue(stamped, field);
+                assertEqual(issues, markerValue, stampedValue, {
+                    code: 'delivery-unit-drift',
+                    message: `Cloudflare worker manifest ${surface} surface deliveryUnit.${field} must derive from one delivery-unit record (expected ${stampedValue ?? 'undefined'}, received ${markerValue ?? 'undefined'}).`,
+                    path: manifestPath
+                });
+            }
         }
     }
 };

package/dist/esm/cloudflare-output-verifier/index.mjs

@@ -72,6 +72,16 @@ const verifyCloudflareOutput = async (options)=>{
         }
     }
     if (wrangler) {
+        if ('string' != typeof wrangler.name || 0 === wrangler.name.trim().length) addIssue(issues, {
+            code: 'invalid-wrangler',
+            message: 'wrangler.json name must be a non-empty worker name.',
+            path: wranglerPath
+        });
+        if ('string' != typeof wrangler.compatibility_date || !/^\d{4}-\d{2}-\d{2}$/u.test(wrangler.compatibility_date)) addIssue(issues, {
+            code: 'invalid-wrangler',
+            message: 'wrangler.json compatibility_date must use YYYY-MM-DD.',
+            path: wranglerPath
+        });
         assertEqual(issues, wrangler.main, outputPlan.wrangler.main, {
             code: 'invalid-wrangler',
             message: `wrangler.json main must be ${outputPlan.wrangler.main}.`,

package/dist/esm/cloudflare-output-verifier/manifest.mjs

@@ -42,6 +42,52 @@ const verifyManifestShape = (issues, manifest, manifestPath)=>{
         message: 'Cloudflare output manifest routeSpec.routes must be array.',
         path: manifestPath
     });
+    const security = manifest.security;
+    if (security && 'object' == typeof security && 'boolean' == typeof security.enabled) {
+        const cors = security.cors;
+        if (!cors || 'object' != typeof cors || 'boolean' != typeof cors.assets || !Array.isArray(cors.allowedOrigins) || !Array.isArray(cors.allowedMethods) || !Array.isArray(cors.allowedHeaders)) addIssue(issues, {
+            code: 'invalid-manifest',
+            message: 'Cloudflare output manifest security.cors is incomplete.',
+            path: manifestPath
+        });
+        if (security.enabled) {
+            const headers = security.headers;
+            const csp = security.contentSecurityPolicy;
+            const noindex = security.noindex;
+            if (!headers || 'object' != typeof headers || ![
+                'string',
+                'boolean'
+            ].includes(typeof headers.referrerPolicy) || ![
+                'string',
+                'boolean'
+            ].includes(typeof headers.contentTypeOptions) || ![
+                'string',
+                'boolean'
+            ].includes(typeof headers.permissionsPolicy)) addIssue(issues, {
+                code: 'invalid-manifest',
+                message: 'Cloudflare output manifest security.headers is incomplete.',
+                path: manifestPath
+            });
+            if (!csp || ![
+                'off',
+                'report-only',
+                'enforce'
+            ].includes(csp.mode) || !csp.directives || 'object' != typeof csp.directives || Array.isArray(csp.directives) || Object.values(csp.directives).some((value)=>!Array.isArray(value) || value.some((entry)=>'string' != typeof entry))) addIssue(issues, {
+                code: 'invalid-manifest',
+                message: 'Cloudflare output manifest security.contentSecurityPolicy is invalid.',
+                path: manifestPath
+            });
+            if (!noindex || 'boolean' != typeof noindex.workersDev || 'boolean' != typeof noindex.localhost || !Array.isArray(noindex.previewHostnames)) addIssue(issues, {
+                code: 'invalid-manifest',
+                message: 'Cloudflare output manifest security.noindex is incomplete.',
+                path: manifestPath
+            });
+        }
+    } else addIssue(issues, {
+        code: 'invalid-manifest',
+        message: 'Cloudflare output manifest security.enabled must be a boolean.',
+        path: manifestPath
+    });
     if (manifest.bff?.runtimeFramework === 'effect') assertEqual(issues, manifest.bff.dispatcherExport, BFF_EFFECT_WORKER_DISPATCHER_EXPORT, {
         code: 'invalid-manifest',
         message: `Cloudflare Effect BFF manifest dispatcherExport must be ${BFF_EFFECT_WORKER_DISPATCHER_EXPORT}.`,

package/dist/esm/cloudflare-output-verifier/mutation-policy.mjs

@@ -84,7 +84,13 @@ const verifyCloudflareOutputMutationPolicy = async (options)=>{
     const files = (await Promise.all(options.scanRoots.map((scanRoot)=>walkFiles(node_path.resolve(scanRoot))))).flat();
     for (const file of files){
         if (excludedFiles.has(file)) continue;
-        const source = await promises.readFile(file, 'utf-8');
+        let source;
+        try {
+            source = await promises.readFile(file, 'utf-8');
+        } catch (error) {
+            if ('ENOENT' === error.code) continue;
+            throw error;
+        }
         for (const forbidden of FORBIDDEN_MUTATION_PATTERNS)if (forbidden.pattern.test(source)) addIssue(issues, {
             code: forbidden.code,
             message: forbidden.message,

package/dist/esm/config.mjs

@@ -1 +1,2 @@
 export { getBuildConfigEnvironment, resolveEffectTsgoCompiler, withBuildConfigEnvironment } from "./build-config/public.mjs";
+export { createRemoteManifestUrl } from "./build-config/remote-address.mjs";

package/dist/esm/deploy-output/npmAliases.mjs

@@ -4,6 +4,10 @@ const dependencyKeys = [
     'dependencies',
     'optionalDependencies'
 ];
+const rootDependencyKeys = [
+    ...dependencyKeys,
+    'devDependencies'
+];
 const exactVersionPattern = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/u;
 async function readPackageJson(filePath) {
     return JSON.parse(await promises.readFile(filePath, 'utf8'));
@@ -19,14 +23,34 @@ function parseNpmAlias(aliasName, specifier) {
         targetVersion: target.slice(versionSeparator + 1)
     };
 }
-function aliasesFromPackageJson(packageJson) {
+function aliasesFromPackageJson(packageJson, keys = dependencyKeys) {
     const aliases = [];
-    for (const dependencyKey of dependencyKeys)for (const [aliasName, specifier] of Object.entries(packageJson[dependencyKey] ?? {})){
+    for (const dependencyKey of keys)for (const [aliasName, specifier] of Object.entries(packageJson[dependencyKey] ?? {})){
         const alias = parseNpmAlias(aliasName, specifier);
         if (alias) aliases.push(alias);
     }
     return aliases;
 }
+async function catalogAliasesFromInstalledPackages(appDirectory, packageJson) {
+    const aliases = [];
+    for (const dependencyKey of rootDependencyKeys)for (const [aliasName, specifier] of Object.entries(packageJson[dependencyKey] ?? {})){
+        if (!specifier.startsWith('catalog:')) continue;
+        let installedPackage;
+        try {
+            installedPackage = await readPackageJson(node_path.join(appDirectory, 'node_modules', aliasName, 'package.json'));
+        } catch (error) {
+            if ('ENOENT' === error.code) continue;
+            throw error;
+        }
+        if (!installedPackage.name || !installedPackage.version) throw new Error(`Installed catalog package ${aliasName} has no identity`);
+        if (installedPackage.name !== aliasName) aliases.push({
+            aliasName,
+            targetName: installedPackage.name,
+            targetVersion: installedPackage.version
+        });
+    }
+    return aliases;
+}
 async function collectPackageRecords(nodeModulesDirectory) {
     const records = [];
     const visitedNodeModules = new Set();
@@ -148,7 +172,8 @@ async function preserveNpmAliases({ appDirectory, outputDirectory, implicitAlias
     const records = await collectPackageRecords(node_path.join(outputDirectory, 'node_modules'));
     const appPackageJson = await readPackageJson(node_path.join(appDirectory, 'package.json'));
     const rootAliases = [
-        ...aliasesFromPackageJson(appPackageJson),
+        ...aliasesFromPackageJson(appPackageJson, rootDependencyKeys),
+        ...await catalogAliasesFromInstalledPackages(appDirectory, appPackageJson),
         ...implicitAliases
     ].filter((alias)=>alias.aliasName !== alias.targetName);
     const emittedRootAliases = [];