@bleedingdev/modern-js-app-tools-extensions 3.9.0-ultramodern.11 → 3.9.0-ultramodern.13

package/src/cloudflare/index.ts

@@ -1,4 +1,9 @@
 import path from 'node:path';
+import {
+  BACKEND_FEDERATION_MANIFEST_FILE,
+  BACKEND_FEDERATION_REMOTE_ENTRY_FILE,
+  ULTRAMODERN_BUILD_ARTIFACT_FILE,
+} from '@modern-js/backend-federation-contracts';
 import { fs as fse } from '@modern-js/utils';
 import { createCloudflareOutputPlan } from '../cloudflare-output-plan';
 import { assertCloudflareOutput } from '../cloudflare-output-verifier/index';
@@ -93,12 +98,7 @@ export const createCloudflarePreset: CreateCloudflarePreset = ({
       await fse.remove(outputDirectory);
     },
     async writeOutput() {
-      if (
-        releaseEnvelopeEnabled &&
-        (await fse.pathExists(
-          path.join(distDirectory, MICROVERTICAL_RELEASE_ENVELOPE_PATH),
-        ))
-      ) {
+      if (releaseEnvelopeEnabled) {
         await emitFrameworkMicroVerticalReleaseEnvelope({
           apiOnly,
           distDirectory,
@@ -113,6 +113,20 @@ export const createCloudflarePreset: CreateCloudflarePreset = ({
           const relativePath = path
             .relative(distDirectory, src)
             .replace(/\\/gu, '/');
+          // API-only builds emit server modules at arbitrary paths under dist,
+          // including transitive imports outside api/. Only the framework's
+          // published backend contract belongs beside the explicit public tree.
+          if (
+            apiOnly &&
+            relativePath !== '' &&
+            ![
+              BACKEND_FEDERATION_MANIFEST_FILE,
+              BACKEND_FEDERATION_REMOTE_ENTRY_FILE,
+              ULTRAMODERN_BUILD_ARTIFACT_FILE,
+            ].includes(relativePath)
+          ) {
+            return false;
+          }
           return (
             relativePath !== 'release' &&
             !relativePath.startsWith('release/') &&

package/src/cloudflare-builder.ts

@@ -39,6 +39,7 @@ export interface CloudflareBuilderNormalizedConfig {
 }
 
 export interface CloudflareBuilderAppContext {
+  apiOnly?: boolean;
   apiDirectory: string;
   appDirectory: string;
 }
@@ -403,12 +404,14 @@ const getWorkerEntries = (
   appContext: CloudflareBuilderAppContext,
 ) => {
   const configuredEntries = environment.source?.entry;
-  if (!configuredEntries) {
+  const effectApiEntry = getEffectBffEntry(normalizedConfig, appContext);
+  if (!configuredEntries && !effectApiEntry) {
     return undefined;
   }
 
-  const entries = rewriteWorkerEntries(configuredEntries);
-  const effectApiEntry = getEffectBffEntry(normalizedConfig, appContext);
+  const entries = configuredEntries
+    ? rewriteWorkerEntries(configuredEntries)
+    : {};
   return effectApiEntry
     ? {
         ...entries,
@@ -595,7 +598,14 @@ export function getCloudflareBuilderEnvironments({
     return environments;
   }
 
-  const workerEnvironment = environments[SERVICE_WORKER_ENVIRONMENT_NAME];
+  const workerEnvironment =
+    environments[SERVICE_WORKER_ENVIRONMENT_NAME] ??
+    (appContext.apiOnly
+      ? {
+          output: { target: 'web-worker' as const },
+          source: { entry: {} },
+        }
+      : undefined);
   if (!workerEnvironment) {
     return environments;
   }
@@ -625,6 +635,10 @@ export function getCloudflareBuilderEnvironments({
     createCloudflareBundlerChain(appContext, Object.keys(workerEntries)),
   );
 
+  if (appContext.apiOnly) {
+    return { [SERVICE_WORKER_ENVIRONMENT_NAME]: cloudflareWorkerEnvironment };
+  }
+
   return {
     ...environments,
     [SERVICE_WORKER_ENVIRONMENT_NAME]: cloudflareWorkerEnvironment,

package/src/cloudflare-output-contract.ts

@@ -27,6 +27,7 @@ export const CLOUDFLARE_WORKER_NODE_BUILTINS = [
   'fs/promises',
   'http',
   'http2',
+  'https',
   'inspector',
   'module',
   'net',

package/src/cloudflare-output-verifier/identity.ts

@@ -51,6 +51,10 @@ export const verifyDeliveryUnitIdentity = (
       const marker = stamped.surfaces[surface];
       const expected = declared?.surfaces?.[surface];
 
+      if (!expected && !marker) {
+        continue;
+      }
+
       if (declared?.surfaces && !expected) {
         if (marker) {
           addIssue(issues, {

package/src/cloudflare-output-verifier/index.ts

@@ -174,6 +174,26 @@ export const verifyCloudflareOutput = async (
   }
 
   if (wrangler) {
+    if (
+      typeof wrangler.name !== 'string' ||
+      wrangler.name.trim().length === 0
+    ) {
+      addIssue(issues, {
+        code: 'invalid-wrangler',
+        message: 'wrangler.json name must be a non-empty worker name.',
+        path: wranglerPath,
+      });
+    }
+    if (
+      typeof wrangler.compatibility_date !== 'string' ||
+      !/^\d{4}-\d{2}-\d{2}$/u.test(wrangler.compatibility_date)
+    ) {
+      addIssue(issues, {
+        code: 'invalid-wrangler',
+        message: 'wrangler.json compatibility_date must use YYYY-MM-DD.',
+        path: wranglerPath,
+      });
+    }
     assertEqual(issues, wrangler.main, outputPlan.wrangler.main, {
       code: 'invalid-wrangler',
       message: `wrangler.json main must be ${outputPlan.wrangler.main}.`,

package/src/cloudflare-output-verifier/manifest.ts

@@ -61,6 +61,83 @@ export const verifyManifestShape = (
       path: manifestPath,
     });
   }
+  const security = manifest.security;
+  if (
+    !security ||
+    typeof security !== 'object' ||
+    typeof security.enabled !== 'boolean'
+  ) {
+    addIssue(issues, {
+      code: 'invalid-manifest',
+      message: 'Cloudflare output manifest security.enabled must be a boolean.',
+      path: manifestPath,
+    });
+  } else {
+    const cors = security.cors;
+    if (
+      !cors ||
+      typeof cors !== 'object' ||
+      typeof cors.assets !== 'boolean' ||
+      !Array.isArray(cors.allowedOrigins) ||
+      !Array.isArray(cors.allowedMethods) ||
+      !Array.isArray(cors.allowedHeaders)
+    ) {
+      addIssue(issues, {
+        code: 'invalid-manifest',
+        message: 'Cloudflare output manifest security.cors is incomplete.',
+        path: manifestPath,
+      });
+    }
+    if (security.enabled) {
+      const headers = security.headers;
+      const csp = security.contentSecurityPolicy;
+      const noindex = security.noindex;
+      if (
+        !headers ||
+        typeof headers !== 'object' ||
+        !['string', 'boolean'].includes(typeof headers.referrerPolicy) ||
+        !['string', 'boolean'].includes(typeof headers.contentTypeOptions) ||
+        !['string', 'boolean'].includes(typeof headers.permissionsPolicy)
+      ) {
+        addIssue(issues, {
+          code: 'invalid-manifest',
+          message: 'Cloudflare output manifest security.headers is incomplete.',
+          path: manifestPath,
+        });
+      }
+      if (
+        !csp ||
+        !['off', 'report-only', 'enforce'].includes(csp.mode) ||
+        !csp.directives ||
+        typeof csp.directives !== 'object' ||
+        Array.isArray(csp.directives) ||
+        Object.values(csp.directives).some(
+          value =>
+            !Array.isArray(value) ||
+            value.some(entry => typeof entry !== 'string'),
+        )
+      ) {
+        addIssue(issues, {
+          code: 'invalid-manifest',
+          message:
+            'Cloudflare output manifest security.contentSecurityPolicy is invalid.',
+          path: manifestPath,
+        });
+      }
+      if (
+        !noindex ||
+        typeof noindex.workersDev !== 'boolean' ||
+        typeof noindex.localhost !== 'boolean' ||
+        !Array.isArray(noindex.previewHostnames)
+      ) {
+        addIssue(issues, {
+          code: 'invalid-manifest',
+          message: 'Cloudflare output manifest security.noindex is incomplete.',
+          path: manifestPath,
+        });
+      }
+    }
+  }
   if (manifest.bff?.runtimeFramework === 'effect') {
     assertEqual(
       issues,

package/src/cloudflare-output-verifier/mutation-policy.ts

@@ -140,7 +140,17 @@ export const verifyCloudflareOutputMutationPolicy = async (
     if (excludedFiles.has(file)) {
       continue;
     }
-    const source = await fs.readFile(file, 'utf-8');
+    let source: string;
+    try {
+      source = await fs.readFile(file, 'utf-8');
+    } catch (error) {
+      // Concurrent sibling builds delete transient files (for example tsgo
+      // resolved configs) between the walk and the read.
+      if ((error as NodeJS.ErrnoException).code === 'ENOENT') {
+        continue;
+      }
+      throw error;
+    }
     for (const forbidden of FORBIDDEN_MUTATION_PATTERNS) {
       if (forbidden.pattern.test(source)) {
         addIssue(issues, {

package/src/config.ts

@@ -4,6 +4,7 @@ export {
   resolveEffectTsgoCompiler,
   withBuildConfigEnvironment,
 } from './build-config/public';
+export { createRemoteManifestUrl } from './build-config/remote-address';
 
 export type DeployTarget =
   | 'node'

package/src/deploy-output/npmAliases.ts

@@ -5,6 +5,7 @@ type PackageJson = {
   name?: string;
   version?: string;
   dependencies?: Record<string, string>;
+  devDependencies?: Record<string, string>;
   optionalDependencies?: Record<string, string>;
   [key: string]: unknown;
 };
@@ -21,6 +22,7 @@ export type NpmAlias = {
 };
 
 const dependencyKeys = ['dependencies', 'optionalDependencies'] as const;
+const rootDependencyKeys = [...dependencyKeys, 'devDependencies'] as const;
 const exactVersionPattern =
   /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/u;
 
@@ -51,9 +53,12 @@ function parseNpmAlias(
   };
 }
 
-function aliasesFromPackageJson(packageJson: PackageJson): NpmAlias[] {
+function aliasesFromPackageJson(
+  packageJson: PackageJson,
+  keys: readonly (typeof rootDependencyKeys)[number][] = dependencyKeys,
+): NpmAlias[] {
   const aliases: NpmAlias[] = [];
-  for (const dependencyKey of dependencyKeys) {
+  for (const dependencyKey of keys) {
     for (const [aliasName, specifier] of Object.entries(
       packageJson[dependencyKey] ?? {},
     )) {
@@ -66,6 +71,46 @@ function aliasesFromPackageJson(packageJson: PackageJson): NpmAlias[] {
   return aliases;
 }
 
+async function catalogAliasesFromInstalledPackages(
+  appDirectory: string,
+  packageJson: PackageJson,
+): Promise<NpmAlias[]> {
+  const aliases: NpmAlias[] = [];
+  for (const dependencyKey of rootDependencyKeys) {
+    for (const [aliasName, specifier] of Object.entries(
+      packageJson[dependencyKey] ?? {},
+    )) {
+      if (!specifier.startsWith('catalog:')) {
+        continue;
+      }
+      let installedPackage: PackageJson;
+      try {
+        installedPackage = await readPackageJson(
+          path.join(appDirectory, 'node_modules', aliasName, 'package.json'),
+        );
+      } catch (error) {
+        if ((error as NodeJS.ErrnoException).code === 'ENOENT') {
+          continue;
+        }
+        throw error;
+      }
+      if (!installedPackage.name || !installedPackage.version) {
+        throw new Error(
+          `Installed catalog package ${aliasName} has no identity`,
+        );
+      }
+      if (installedPackage.name !== aliasName) {
+        aliases.push({
+          aliasName,
+          targetName: installedPackage.name,
+          targetVersion: installedPackage.version,
+        });
+      }
+    }
+  }
+  return aliases;
+}
+
 async function collectPackageRecords(
   nodeModulesDirectory: string,
 ): Promise<PackageRecord[]> {
@@ -278,7 +323,11 @@ export async function preserveNpmAliases({
     path.join(appDirectory, 'package.json'),
   );
   const rootAliases = [
-    ...aliasesFromPackageJson(appPackageJson),
+    ...aliasesFromPackageJson(appPackageJson, rootDependencyKeys),
+    ...(await catalogAliasesFromInstalledPackages(
+      appDirectory,
+      appPackageJson,
+    )),
     ...implicitAliases,
   ].filter(alias => alias.aliasName !== alias.targetName);