@bleedingdev/modern-js-app-tools-extensions 3.9.0-ultramodern.12 → 3.9.0-ultramodern.13

package/dist/esm-node/cloudflare/delivery-unit.mjs

@@ -4,11 +4,11 @@ import { ULTRAMODERN_BUILD_ARTIFACT_PATH, isUltramodernBuildArtifact, nonEmptySt
 import { fs } from "@modern-js/utils";
 import { resolveUltramodernReleaseIdentity } from "../release-identity.mjs";
 import { isRecord } from "./utils.mjs";
-const COMPACT_CONFIG_PATH = '.modernjs/ultramodern.json';
+const TOPOLOGY_PATH = 'topology/reference-topology.json';
 const findWorkspaceRoot = async (appDirectory)=>{
     let current = node_path.resolve(appDirectory);
     for(;;){
-        if (await fs.pathExists(node_path.join(current, COMPACT_CONFIG_PATH))) return current;
+        if (await fs.pathExists(node_path.join(current, TOPOLOGY_PATH))) return current;
         const parent = node_path.dirname(current);
         if (parent === current) return;
         current = parent;
@@ -25,36 +25,25 @@ const stampReleaseIdentity = (identity, workspaceRoot)=>{
         })
     };
 };
-const resolveCompactApp = async (appDirectory)=>{
+const resolveTopologyApp = async (appDirectory)=>{
     const workspaceRoot = await findWorkspaceRoot(appDirectory);
     if (!workspaceRoot) return;
-    let compactConfig;
-    try {
-        compactConfig = await fs.readJSON(node_path.join(workspaceRoot, COMPACT_CONFIG_PATH));
-    } catch  {
-        return {
-            workspaceRoot
-        };
-    }
-    if (!isRecord(compactConfig)) return {
-        workspaceRoot
-    };
-    const topology = isRecord(compactConfig.topology) ? compactConfig.topology : void 0;
-    const apps = Array.isArray(topology?.apps) ? topology.apps : void 0;
-    if (!apps) return {
-        app: compactConfig,
-        workspaceRoot
-    };
+    const topology = await fs.readJSON(node_path.join(workspaceRoot, TOPOLOGY_PATH));
+    if (!isRecord(topology) || !isRecord(topology.shell) || !Array.isArray(topology.verticals) || void 0 !== topology.shells && !Array.isArray(topology.shells)) throw new Error('[cloudflare-delivery-unit] Invalid declared reference topology.');
+    const apps = [
+        topology.shell,
+        ...topology.verticals,
+        ...Array.isArray(topology.shells) ? topology.shells : []
+    ];
     const resolvedAppDirectory = node_path.resolve(appDirectory);
     const app = apps.find((candidate)=>{
         if (!isRecord(candidate)) return false;
         const appPath = nonEmptyString(candidate.path);
         return void 0 !== appPath && node_path.resolve(workspaceRoot, appPath.replace(/^\.\/+/u, '')) === resolvedAppDirectory;
     });
+    if (!isRecord(app)) throw new Error(`[cloudflare-delivery-unit] ${appDirectory} is missing from the declared reference topology.`);
     return {
-        ...isRecord(app) ? {
-            app
-        } : {},
+        app,
         workspaceRoot
     };
 };
@@ -81,10 +70,11 @@ const createDeliveryUnitStamp = (identity, app)=>{
     };
 };
 const resolveTopologyDeliveryUnit = async (appDirectory)=>{
-    const resolved = await resolveCompactApp(appDirectory);
+    const resolved = await resolveTopologyApp(appDirectory);
     if (!resolved?.app) return;
     const identity = toDeliveryUnitIdentity(resolved.app.deliveryUnit);
-    return identity ? createDeliveryUnitStamp(stampReleaseIdentity(identity, resolved.workspaceRoot), resolved.app) : void 0;
+    if (!identity) throw new Error('[cloudflare-delivery-unit] Declared app is missing a valid delivery-unit identity.');
+    return createDeliveryUnitStamp(stampReleaseIdentity(identity, resolved.workspaceRoot), resolved.app);
 };
 const resolveWorkerDeliveryUnitStamp = async (appDirectory)=>{
     const buildArtifactPath = node_path.join(appDirectory, ULTRAMODERN_BUILD_ARTIFACT_PATH);
@@ -95,7 +85,7 @@ const resolveWorkerDeliveryUnitStamp = async (appDirectory)=>{
         identity = toDeliveryUnitIdentity(artifact.deliveryUnit);
     }
     if (!identity) return;
-    const resolved = await resolveCompactApp(appDirectory);
+    const resolved = await resolveTopologyApp(appDirectory);
     if (resolved) identity = stampReleaseIdentity(identity, resolved.workspaceRoot);
     return createDeliveryUnitStamp(identity, resolved?.app);
 };

package/dist/esm-node/cloudflare/index.mjs

@@ -1,5 +1,6 @@
 import "node:module";
 import node_path from "node:path";
+import { BACKEND_FEDERATION_MANIFEST_FILE, BACKEND_FEDERATION_REMOTE_ENTRY_FILE, ULTRAMODERN_BUILD_ARTIFACT_FILE } from "@modern-js/backend-federation-contracts";
 import { fs } from "@modern-js/utils";
 import { createCloudflareOutputPlan } from "../cloudflare-output-plan.mjs";
 import { assertCloudflareOutput } from "../cloudflare-output-verifier/index.mjs";
@@ -37,7 +38,7 @@ const createCloudflarePreset = ({ api, appContext, modernConfig })=>{
             await fs.remove(outputDirectory);
         },
         async writeOutput () {
-            if (releaseEnvelopeEnabled && await fs.pathExists(node_path.join(distDirectory, MICROVERTICAL_RELEASE_ENVELOPE_PATH))) await emitFrameworkMicroVerticalReleaseEnvelope({
+            if (releaseEnvelopeEnabled) await emitFrameworkMicroVerticalReleaseEnvelope({
                 apiOnly,
                 distDirectory,
                 target: 'cloudflare'
@@ -46,6 +47,11 @@ const createCloudflarePreset = ({ api, appContext, modernConfig })=>{
             await fs.copy(distDirectory, publicDirectory, {
                 filter: (src)=>{
                     const relativePath = node_path.relative(distDirectory, src).replace(/\\/gu, '/');
+                    if (apiOnly && '' !== relativePath && ![
+                        BACKEND_FEDERATION_MANIFEST_FILE,
+                        BACKEND_FEDERATION_REMOTE_ENTRY_FILE,
+                        ULTRAMODERN_BUILD_ARTIFACT_FILE
+                    ].includes(relativePath)) return false;
                     return 'release' !== relativePath && !relativePath.startsWith('release/') && 'public' !== relativePath && !relativePath.startsWith('public/') && shouldCopyToPublicAssets(src, distDirectory, publicAssetExcludes);
                 }
             });

package/dist/esm-node/cloudflare-builder.mjs

@@ -206,9 +206,9 @@ const prependBundlerChain = (environment, handler)=>{
 };
 const getWorkerEntries = (environment, normalizedConfig, appContext)=>{
     const configuredEntries = environment.source?.entry;
-    if (!configuredEntries) return;
-    const entries = rewriteWorkerEntries(configuredEntries);
     const effectApiEntry = getEffectBffEntry(normalizedConfig, appContext);
+    if (!configuredEntries && !effectApiEntry) return;
+    const entries = configuredEntries ? rewriteWorkerEntries(configuredEntries) : {};
     return effectApiEntry ? {
         ...entries,
         [BFF_EFFECT_WORKER_ENTRY_NAME]: [
@@ -288,7 +288,14 @@ const createCloudflareBundlerChain = (appContext, workerEntryNames)=>{
 };
 function getCloudflareBuilderEnvironments({ appContext, environments, normalizedConfig, resolveDeployProvider = resolveStdEnvDeployProvider }) {
     if (!isCloudflareWorkerDeploy(normalizedConfig, resolveDeployProvider)) return environments;
-    const workerEnvironment = environments[SERVICE_WORKER_ENVIRONMENT_NAME];
+    const workerEnvironment = environments[SERVICE_WORKER_ENVIRONMENT_NAME] ?? (appContext.apiOnly ? {
+        output: {
+            target: 'web-worker'
+        },
+        source: {
+            entry: {}
+        }
+    } : void 0);
     if (!workerEnvironment) return environments;
     const workerEntries = getWorkerEntries(workerEnvironment, normalizedConfig, appContext);
     if (!workerEntries) return environments;
@@ -304,6 +311,9 @@ function getCloudflareBuilderEnvironments({ appContext, environments, normalized
             entry: workerEntries
         }
     }, createCloudflareBundlerChain(appContext, Object.keys(workerEntries)));
+    if (appContext.apiOnly) return {
+        [SERVICE_WORKER_ENVIRONMENT_NAME]: cloudflareWorkerEnvironment
+    };
     return {
         ...environments,
         [SERVICE_WORKER_ENVIRONMENT_NAME]: cloudflareWorkerEnvironment

package/dist/esm-node/cloudflare-output-contract.mjs

@@ -26,6 +26,7 @@ const CLOUDFLARE_WORKER_NODE_BUILTINS = [
     'fs/promises',
     'http',
     'http2',
+    'https',
     'inspector',
     'module',
     'net',

package/dist/esm-node/cloudflare-output-verifier/identity.mjs

@@ -25,30 +25,32 @@ const verifyDeliveryUnitIdentity = (issues, manifest, manifestPath, declared)=>{
     ]){
         const marker = stamped.surfaces[surface];
         const expected = declared?.surfaces?.[surface];
-        if (declared?.surfaces && !expected) {
-            if (marker) addIssue(issues, {
-                code: 'delivery-unit-drift',
-                message: `Cloudflare worker manifest declares an unexpected ${surface} delivery-unit surface for this topology profile.`,
-                path: manifestPath
-            });
-            continue;
-        }
-        if (!marker || 'object' != typeof marker) {
-            addIssue(issues, {
-                code: 'missing-delivery-unit',
-                message: `Cloudflare worker manifest is missing the ${surface} delivery-unit surface marker.`,
-                path: manifestPath
-            });
-            continue;
-        }
-        for (const field of DELIVERY_UNIT_IDENTITY_FIELDS){
-            const markerValue = deliveryUnitIdentityFieldValue(marker, field);
-            const stampedValue = deliveryUnitIdentityFieldValue(stamped, field);
-            assertEqual(issues, markerValue, stampedValue, {
-                code: 'delivery-unit-drift',
-                message: `Cloudflare worker manifest ${surface} surface deliveryUnit.${field} must derive from one delivery-unit record (expected ${stampedValue ?? 'undefined'}, received ${markerValue ?? 'undefined'}).`,
-                path: manifestPath
-            });
+        if (expected || marker) {
+            if (declared?.surfaces && !expected) {
+                if (marker) addIssue(issues, {
+                    code: 'delivery-unit-drift',
+                    message: `Cloudflare worker manifest declares an unexpected ${surface} delivery-unit surface for this topology profile.`,
+                    path: manifestPath
+                });
+                continue;
+            }
+            if (!marker || 'object' != typeof marker) {
+                addIssue(issues, {
+                    code: 'missing-delivery-unit',
+                    message: `Cloudflare worker manifest is missing the ${surface} delivery-unit surface marker.`,
+                    path: manifestPath
+                });
+                continue;
+            }
+            for (const field of DELIVERY_UNIT_IDENTITY_FIELDS){
+                const markerValue = deliveryUnitIdentityFieldValue(marker, field);
+                const stampedValue = deliveryUnitIdentityFieldValue(stamped, field);
+                assertEqual(issues, markerValue, stampedValue, {
+                    code: 'delivery-unit-drift',
+                    message: `Cloudflare worker manifest ${surface} surface deliveryUnit.${field} must derive from one delivery-unit record (expected ${stampedValue ?? 'undefined'}, received ${markerValue ?? 'undefined'}).`,
+                    path: manifestPath
+                });
+            }
         }
     }
 };

package/dist/esm-node/cloudflare-output-verifier/index.mjs

@@ -73,6 +73,16 @@ const verifyCloudflareOutput = async (options)=>{
         }
     }
     if (wrangler) {
+        if ('string' != typeof wrangler.name || 0 === wrangler.name.trim().length) addIssue(issues, {
+            code: 'invalid-wrangler',
+            message: 'wrangler.json name must be a non-empty worker name.',
+            path: wranglerPath
+        });
+        if ('string' != typeof wrangler.compatibility_date || !/^\d{4}-\d{2}-\d{2}$/u.test(wrangler.compatibility_date)) addIssue(issues, {
+            code: 'invalid-wrangler',
+            message: 'wrangler.json compatibility_date must use YYYY-MM-DD.',
+            path: wranglerPath
+        });
         assertEqual(issues, wrangler.main, outputPlan.wrangler.main, {
             code: 'invalid-wrangler',
             message: `wrangler.json main must be ${outputPlan.wrangler.main}.`,

package/dist/esm-node/cloudflare-output-verifier/manifest.mjs

@@ -43,6 +43,52 @@ const verifyManifestShape = (issues, manifest, manifestPath)=>{
         message: 'Cloudflare output manifest routeSpec.routes must be array.',
         path: manifestPath
     });
+    const security = manifest.security;
+    if (security && 'object' == typeof security && 'boolean' == typeof security.enabled) {
+        const cors = security.cors;
+        if (!cors || 'object' != typeof cors || 'boolean' != typeof cors.assets || !Array.isArray(cors.allowedOrigins) || !Array.isArray(cors.allowedMethods) || !Array.isArray(cors.allowedHeaders)) addIssue(issues, {
+            code: 'invalid-manifest',
+            message: 'Cloudflare output manifest security.cors is incomplete.',
+            path: manifestPath
+        });
+        if (security.enabled) {
+            const headers = security.headers;
+            const csp = security.contentSecurityPolicy;
+            const noindex = security.noindex;
+            if (!headers || 'object' != typeof headers || ![
+                'string',
+                'boolean'
+            ].includes(typeof headers.referrerPolicy) || ![
+                'string',
+                'boolean'
+            ].includes(typeof headers.contentTypeOptions) || ![
+                'string',
+                'boolean'
+            ].includes(typeof headers.permissionsPolicy)) addIssue(issues, {
+                code: 'invalid-manifest',
+                message: 'Cloudflare output manifest security.headers is incomplete.',
+                path: manifestPath
+            });
+            if (!csp || ![
+                'off',
+                'report-only',
+                'enforce'
+            ].includes(csp.mode) || !csp.directives || 'object' != typeof csp.directives || Array.isArray(csp.directives) || Object.values(csp.directives).some((value)=>!Array.isArray(value) || value.some((entry)=>'string' != typeof entry))) addIssue(issues, {
+                code: 'invalid-manifest',
+                message: 'Cloudflare output manifest security.contentSecurityPolicy is invalid.',
+                path: manifestPath
+            });
+            if (!noindex || 'boolean' != typeof noindex.workersDev || 'boolean' != typeof noindex.localhost || !Array.isArray(noindex.previewHostnames)) addIssue(issues, {
+                code: 'invalid-manifest',
+                message: 'Cloudflare output manifest security.noindex is incomplete.',
+                path: manifestPath
+            });
+        }
+    } else addIssue(issues, {
+        code: 'invalid-manifest',
+        message: 'Cloudflare output manifest security.enabled must be a boolean.',
+        path: manifestPath
+    });
     if (manifest.bff?.runtimeFramework === 'effect') assertEqual(issues, manifest.bff.dispatcherExport, BFF_EFFECT_WORKER_DISPATCHER_EXPORT, {
         code: 'invalid-manifest',
         message: `Cloudflare Effect BFF manifest dispatcherExport must be ${BFF_EFFECT_WORKER_DISPATCHER_EXPORT}.`,

package/dist/esm-node/cloudflare-output-verifier/mutation-policy.mjs

@@ -85,7 +85,13 @@ const verifyCloudflareOutputMutationPolicy = async (options)=>{
     const files = (await Promise.all(options.scanRoots.map((scanRoot)=>walkFiles(node_path.resolve(scanRoot))))).flat();
     for (const file of files){
         if (excludedFiles.has(file)) continue;
-        const source = await promises.readFile(file, 'utf-8');
+        let source;
+        try {
+            source = await promises.readFile(file, 'utf-8');
+        } catch (error) {
+            if ('ENOENT' === error.code) continue;
+            throw error;
+        }
         for (const forbidden of FORBIDDEN_MUTATION_PATTERNS)if (forbidden.pattern.test(source)) addIssue(issues, {
             code: forbidden.code,
             message: forbidden.message,

package/dist/esm-node/deploy-output/npmAliases.mjs

@@ -5,6 +5,10 @@ const dependencyKeys = [
     'dependencies',
     'optionalDependencies'
 ];
+const rootDependencyKeys = [
+    ...dependencyKeys,
+    'devDependencies'
+];
 const exactVersionPattern = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/u;
 async function readPackageJson(filePath) {
     return JSON.parse(await promises.readFile(filePath, 'utf8'));
@@ -20,14 +24,34 @@ function parseNpmAlias(aliasName, specifier) {
         targetVersion: target.slice(versionSeparator + 1)
     };
 }
-function aliasesFromPackageJson(packageJson) {
+function aliasesFromPackageJson(packageJson, keys = dependencyKeys) {
     const aliases = [];
-    for (const dependencyKey of dependencyKeys)for (const [aliasName, specifier] of Object.entries(packageJson[dependencyKey] ?? {})){
+    for (const dependencyKey of keys)for (const [aliasName, specifier] of Object.entries(packageJson[dependencyKey] ?? {})){
         const alias = parseNpmAlias(aliasName, specifier);
         if (alias) aliases.push(alias);
     }
     return aliases;
 }
+async function catalogAliasesFromInstalledPackages(appDirectory, packageJson) {
+    const aliases = [];
+    for (const dependencyKey of rootDependencyKeys)for (const [aliasName, specifier] of Object.entries(packageJson[dependencyKey] ?? {})){
+        if (!specifier.startsWith('catalog:')) continue;
+        let installedPackage;
+        try {
+            installedPackage = await readPackageJson(node_path.join(appDirectory, 'node_modules', aliasName, 'package.json'));
+        } catch (error) {
+            if ('ENOENT' === error.code) continue;
+            throw error;
+        }
+        if (!installedPackage.name || !installedPackage.version) throw new Error(`Installed catalog package ${aliasName} has no identity`);
+        if (installedPackage.name !== aliasName) aliases.push({
+            aliasName,
+            targetName: installedPackage.name,
+            targetVersion: installedPackage.version
+        });
+    }
+    return aliases;
+}
 async function collectPackageRecords(nodeModulesDirectory) {
     const records = [];
     const visitedNodeModules = new Set();
@@ -149,7 +173,8 @@ async function preserveNpmAliases({ appDirectory, outputDirectory, implicitAlias
     const records = await collectPackageRecords(node_path.join(outputDirectory, 'node_modules'));
     const appPackageJson = await readPackageJson(node_path.join(appDirectory, 'package.json'));
     const rootAliases = [
-        ...aliasesFromPackageJson(appPackageJson),
+        ...aliasesFromPackageJson(appPackageJson, rootDependencyKeys),
+        ...await catalogAliasesFromInstalledPackages(appDirectory, appPackageJson),
         ...implicitAliases
     ].filter((alias)=>alias.aliasName !== alias.targetName);
     const emittedRootAliases = [];