@bleedingdev/modern-js-app-tools-extensions 3.9.0-ultramodern.12 → 3.9.0-ultramodern.14

package/dist/esm/cloudflare-builder.mjs

@@ -1,16 +1,55 @@
 import node_fs from "node:fs";
-import { createRequire } from "node:module";
+import { createRequire, isBuiltin } from "node:module";
 import node_path from "node:path";
 import { SERVICE_WORKER_ENVIRONMENT_NAME } from "@modern-js/builder";
 import { isProd } from "@modern-js/utils";
 import { provider } from "std-env";
-import { CLOUDFLARE_WORKER_NODE_BUILTINS } from "./cloudflare-output-contract.mjs";
+import { CLOUDFLARE_ROUTE_DATA_HANDLER_EXPORT, CLOUDFLARE_WORKER_NODE_BUILTINS, CLOUDFLARE_WORKER_PLATFORM_MODULES, getCloudflareWorkerRouteDataEntryName } from "./cloudflare-output-contract.mjs";
 import { getTemplatePath } from "./read-template.mjs";
 const moduleRequire = createRequire(import.meta.url);
 const BFF_EFFECT_WORKER_ENTRY_NAME = '__modern_bff_effect';
 const BFF_EFFECT_WORKER_RUNTIME_QUERY = 'modern-bff-runtime';
+const SERVER_LOADER_COMBINED_FILE = 'server-loader-combined.js';
+const ROUTE_SERVER_LOADERS_FILE = 'route-server-loaders.js';
+const WORKER_ROUTE_DATA_FILE = 'cloudflare-worker-route-data.js';
+const WORKER_ROUTE_DATA_TEMPLATE = 'cloudflare-worker-route-data.mjs';
+const DATA_LOADER_CLIENT_TRANSFORM = /plugin-data-loader[\\/](?:.+[\\/])?loader\.[cm]?js$/u;
 const MF_SSR_DATA_FETCH_RUNTIME_PLUGIN = '@module-federation/modern-js-v3/ssr-inject-data-fetch-function-plugin';
 const MF_SSR_DEV_RUNTIME_PLUGIN = '@module-federation/modern-js-v3/ssr-dev-plugin';
+const WORKER_DEPENDENCY_CONDITIONS = [
+    [
+        'esm',
+        'import'
+    ],
+    [
+        'wasm',
+        'import'
+    ],
+    [
+        'loaderImport',
+        'import'
+    ],
+    [
+        'worker',
+        'import'
+    ],
+    [
+        'commonjs',
+        'require'
+    ],
+    [
+        'amd',
+        'require'
+    ],
+    [
+        'loader',
+        'require'
+    ],
+    [
+        'unknown',
+        'require'
+    ]
+];
 const JS_OR_TS_EXTENSIONS = new Set([
     '.js',
     '.jsx',
@@ -70,19 +109,154 @@ const resolvePackageFile = (packageName, filePath, paths)=>{
 const setAliasIfPresent = (alias, name, value)=>{
     if (value) alias.set(name, value);
 };
-const getCloudflareWorkerNodeExternals = ()=>Object.fromEntries(CLOUDFLARE_WORKER_NODE_BUILTINS.flatMap((builtin)=>{
-        const nodeBuiltin = `node:${builtin}`;
+const getCloudflareWorkerNodeExternals = ()=>Object.fromEntries([
+        ...CLOUDFLARE_WORKER_NODE_BUILTINS.flatMap((builtin)=>{
+            const nodeBuiltin = `node:${builtin}`;
+            const external = `module-import ${nodeBuiltin}`;
+            return isBuiltin(builtin) ? [
+                [
+                    builtin,
+                    external
+                ],
+                [
+                    nodeBuiltin,
+                    external
+                ]
+            ] : [
+                [
+                    nodeBuiltin,
+                    external
+                ]
+            ];
+        }),
+        ...CLOUDFLARE_WORKER_PLATFORM_MODULES.map((platformModule)=>[
+                platformModule,
+                `module-import ${platformModule}`
+            ])
+    ]);
+const getPackageNameFromRequest = (request)=>{
+    if (request.startsWith('.') || request.startsWith('/') || request.includes(':') || node_path.isAbsolute(request)) return;
+    const segments = request.split('/');
+    return request.startsWith('@') ? segments.length > 1 ? `${segments[0]}/${segments[1]}` : void 0 : segments[0];
+};
+const isRedirectedByAliasField = (manifest, aliasFields, request)=>aliasFields.some((field)=>{
+        let value = manifest;
+        for (const key of 'string' == typeof field ? [
+            field
+        ] : field)value = value && 'object' == typeof value ? value[key] : void 0;
+        return 'object' == typeof value && null !== value && Object.hasOwn(value, request);
+    });
+const findOwningPackageManifest = (directory, cache)=>{
+    if (cache.has(directory)) return cache.get(directory);
+    let manifest;
+    const packageJsonPath = node_path.join(directory, 'package.json');
+    if (node_fs.existsSync(packageJsonPath)) try {
+        manifest = JSON.parse(node_fs.readFileSync(packageJsonPath, 'utf-8'));
+    } catch  {
+        manifest = void 0;
+    }
+    else if (node_path.dirname(directory) !== directory) manifest = findOwningPackageManifest(node_path.dirname(directory), cache);
+    cache.set(directory, manifest);
+    return manifest;
+};
+const isPackageInstalled = (packageName, directory, moduleDirectories)=>moduleDirectories.some((moduleDirectory)=>{
+        if (node_path.isAbsolute(moduleDirectory)) return node_fs.existsSync(node_path.join(moduleDirectory, packageName));
+        let current = directory;
+        while(true){
+            if (node_fs.existsSync(node_path.join(current, moduleDirectory, packageName))) return true;
+            const parent = node_path.dirname(current);
+            if (parent === current) return false;
+            current = parent;
+        }
+    });
+const createAbsentOptionalDependencyFilter = (isRedirected = ()=>false, moduleDirectories = [
+    'node_modules'
+], aliasFields = [])=>{
+    const manifests = new Map();
+    return (request, context)=>{
+        const packageName = getPackageNameFromRequest(request);
+        if (!packageName || !context || isRedirected(request)) return false;
+        const manifest = findOwningPackageManifest(context, manifests);
+        if (!manifest) return false;
+        const optional = manifest.peerDependenciesMeta?.[packageName]?.optional === true || Object.hasOwn(manifest.optionalDependencies ?? {}, packageName);
+        return optional && !isRedirectedByAliasField(manifest, aliasFields, request) && !isPackageInstalled(packageName, context, moduleDirectories);
+    };
+};
+const getAliasNames = (alias)=>alias ? Array.isArray(alias) ? alias.map((entry)=>entry.onlyModule ? `${entry.name}$` : entry.name) : Object.keys(alias) : [];
+const getExternalMatchers = (externals)=>{
+    if (Array.isArray(externals)) return externals.flatMap(getExternalMatchers);
+    if ('string' == typeof externals) return [
+        (request)=>request === externals
+    ];
+    if (externals instanceof RegExp) return [
+        (request)=>{
+            externals.lastIndex = 0;
+            return externals.test(request);
+        }
+    ];
+    if (externals && 'object' == typeof externals) {
+        const names = new Set(Object.entries(externals).filter(([, value])=>false !== value).map(([name])=>name));
         return [
-            [
-                builtin,
-                `module-import ${nodeBuiltin}`
-            ],
-            [
-                nodeBuiltin,
-                `module-import ${nodeBuiltin}`
-            ]
+            (request)=>names.has(request)
         ];
-    }));
+    }
+    return [];
+};
+const createRequestRedirectMatcher = (options)=>{
+    const aliasNames = [
+        ...getAliasNames(options.resolve?.alias),
+        ...getAliasNames(options.resolve?.fallback)
+    ];
+    const externalMatchers = getExternalMatchers(options.externals);
+    return (request)=>externalMatchers.some((matches)=>matches(request)) || aliasNames.some((name)=>name.endsWith('$') ? request === name.slice(0, -1) : request === name || request.startsWith(`${name}/`));
+};
+const getFunctionExternals = (externals)=>Array.isArray(externals) ? externals.flatMap(getFunctionExternals) : 'function' == typeof externals ? [
+        externals
+    ] : [];
+const callFunctionExternal = (external, data)=>new Promise((resolve, reject)=>{
+        const returned = external(data, (error, result)=>error ? reject(error) : resolve(result));
+        if (null !== returned && 'object' == typeof returned && 'function' == typeof returned.then) returned.then(resolve, reject);
+        else if (1 === external.length) resolve(returned);
+    });
+const claimsByFunctionExternal = async (externals, data)=>{
+    for (const external of externals)try {
+        const result = await callFunctionExternal(external, data);
+        if (null != result && false !== result) return true;
+    } catch  {
+        return true;
+    }
+    return false;
+};
+const PLUGIN_NAME = 'AbsentOptionalDependencyPlugin';
+class AbsentOptionalDependencyPlugin {
+    apply(compiler) {
+        const isAbsent = createAbsentOptionalDependencyFilter(createRequestRedirectMatcher(compiler.options), compiler.options.resolve.modules, compiler.options.resolve.aliasFields);
+        const functionExternals = getFunctionExternals(compiler.options.externals);
+        compiler.hooks.normalModuleFactory.tap(PLUGIN_NAME, (factory)=>{
+            factory.hooks.beforeResolve.tapPromise(PLUGIN_NAME, async (data)=>{
+                if (!isAbsent(data.request, data.context)) return;
+                const claimed = await claimsByFunctionExternal(functionExternals, {
+                    context: data.context,
+                    contextInfo: {
+                        issuer: data.contextInfo.issuer,
+                        issuerLayer: data.contextInfo.issuerLayer ?? null
+                    },
+                    getResolve: (options)=>{
+                        const resolver = factory.getResolver('normal', options ?? {});
+                        return (context, request, callback)=>{
+                            if (callback) return void resolver.resolve({}, context, request, {}, callback);
+                            return new Promise((resolve, reject)=>{
+                                resolver.resolve({}, context, request, {}, (error, result)=>error ? reject(error) : resolve(result || void 0));
+                            });
+                        };
+                    },
+                    request: data.request
+                });
+                return claimed ? void 0 : false;
+            });
+        });
+    }
+}
 const normalizeWorkerOutputName = (name)=>node_path.posix.normalize(name.replace(/\\/gu, '/')).toLowerCase();
 const reserveWorkerChunkName = (baseName, reservedOutputNames)=>{
     let name = baseName;
@@ -132,6 +306,9 @@ function applyCloudflareWorkerRspackConfig(chain, workerEntryNames) {
     chain.optimization.runtimeChunk(config.optimization.runtimeChunk);
     chain.optimization.splitChunks(config.optimization.splitChunks);
 }
+function removeCloudflareWorkerDataLoaderClientTransform(chain) {
+    for (const [name, rule] of Object.entries(chain.module.rules.entries() ?? {}))if (rule.uses.values().some((use)=>DATA_LOADER_CLIENT_TRANSFORM.test(String(use.get('loader'))))) chain.module.rules.delete(name);
+}
 function applyCloudflareWorkerMfRuntimeBoundary(chain) {
     const runtimePlugin = getTemplatePath('cloudflare-worker-mf-ssr-runtime-plugin.mjs');
     chain.plugins.delete('plugin-module-federation');
@@ -203,11 +380,40 @@ const prependBundlerChain = (environment, handler)=>{
         }
     };
 };
+const createWorkerRouteDataModule = ()=>[
+        `import { routes } from './${ROUTE_SERVER_LOADERS_FILE}';`,
+        `import { createRouteDataRequestHandler } from ${JSON.stringify(getTemplatePath(WORKER_ROUTE_DATA_TEMPLATE))};`,
+        '',
+        `export const ${CLOUDFLARE_ROUTE_DATA_HANDLER_EXPORT} =`,
+        '  createRouteDataRequestHandler(routes);',
+        ''
+    ].join('\n');
+const getWorkerRouteDataEntries = (appContext)=>{
+    const { entrypoints, internalDirectory } = appContext;
+    if (!entrypoints || !internalDirectory) return {};
+    return Object.fromEntries(entrypoints.flatMap(({ entryName })=>{
+        const entryDirectory = node_path.join(internalDirectory, entryName);
+        if (!node_fs.existsSync(node_path.join(entryDirectory, SERVER_LOADER_COMBINED_FILE)) || !node_fs.existsSync(node_path.join(entryDirectory, ROUTE_SERVER_LOADERS_FILE))) return [];
+        const routeDataFile = node_path.join(entryDirectory, WORKER_ROUTE_DATA_FILE);
+        node_fs.writeFileSync(routeDataFile, createWorkerRouteDataModule());
+        return [
+            [
+                getCloudflareWorkerRouteDataEntryName(entryName),
+                [
+                    routeDataFile
+                ]
+            ]
+        ];
+    }));
+};
 const getWorkerEntries = (environment, normalizedConfig, appContext)=>{
     const configuredEntries = environment.source?.entry;
-    if (!configuredEntries) return;
-    const entries = rewriteWorkerEntries(configuredEntries);
     const effectApiEntry = getEffectBffEntry(normalizedConfig, appContext);
+    if (!configuredEntries && !effectApiEntry) return;
+    const entries = configuredEntries ? {
+        ...rewriteWorkerEntries(configuredEntries),
+        ...getWorkerRouteDataEntries(appContext)
+    } : {};
     return effectApiEntry ? {
         ...entries,
         [BFF_EFFECT_WORKER_ENTRY_NAME]: [
@@ -240,6 +446,7 @@ const createCloudflareBundlerChain = (appContext, workerEntryNames)=>{
     ];
     return (chain)=>{
         applyCloudflareWorkerRspackConfig(chain, entryNames);
+        removeCloudflareWorkerDataLoaderClientTransform(chain);
         chain.output.module(true).library({
             type: 'module'
         }).publicPath('/').chunkFormat('module').chunkLoading('import').workerChunkLoading('import');
@@ -248,10 +455,15 @@ const createCloudflareBundlerChain = (appContext, workerEntryNames)=>{
             'worker',
             'webpack',
             isProd() ? 'production' : 'development',
-            'import',
-            'require',
             'module'
         ])chain.resolve.conditionNames.add(condition);
+        for (const [dependencyType, condition] of WORKER_DEPENDENCY_CONDITIONS)chain.resolve.byDependency.set(dependencyType, {
+            conditionNames: [
+                condition,
+                '...'
+            ]
+        });
+        chain.plugin('cloudflare-worker-absent-optional-dependencies').use(AbsentOptionalDependencyPlugin);
         applyCloudflareWorkerMfRuntimeBoundary(chain);
         if (tanstackRouterSsrServerFile) {
             chain.resolve.alias.set('@tanstack/router-core/ssr/server$', tanstackRouterSsrServerFile);
@@ -287,7 +499,14 @@ const createCloudflareBundlerChain = (appContext, workerEntryNames)=>{
 };
 function getCloudflareBuilderEnvironments({ appContext, environments, normalizedConfig, resolveDeployProvider = resolveStdEnvDeployProvider }) {
     if (!isCloudflareWorkerDeploy(normalizedConfig, resolveDeployProvider)) return environments;
-    const workerEnvironment = environments[SERVICE_WORKER_ENVIRONMENT_NAME];
+    const workerEnvironment = environments[SERVICE_WORKER_ENVIRONMENT_NAME] ?? (appContext.apiOnly ? {
+        output: {
+            target: 'web-worker'
+        },
+        source: {
+            entry: {}
+        }
+    } : void 0);
     if (!workerEnvironment) return environments;
     const workerEntries = getWorkerEntries(workerEnvironment, normalizedConfig, appContext);
     if (!workerEntries) return environments;
@@ -303,6 +522,9 @@ function getCloudflareBuilderEnvironments({ appContext, environments, normalized
             entry: workerEntries
         }
     }, createCloudflareBundlerChain(appContext, Object.keys(workerEntries)));
+    if (appContext.apiOnly) return {
+        [SERVICE_WORKER_ENVIRONMENT_NAME]: cloudflareWorkerEnvironment
+    };
     return {
         ...environments,
         [SERVICE_WORKER_ENVIRONMENT_NAME]: cloudflareWorkerEnvironment
@@ -324,4 +546,4 @@ const createCloudflareBuilderPlugin = (resolveDeployProvider = resolveStdEnvDepl
                 }));
         }
     });
-export { applyCloudflareBuilderEnvironments, applyCloudflareWorkerMfRuntimeBoundary, applyCloudflareWorkerRspackConfig, createCloudflareBuilderPlugin, getCloudflareBuilderEnvironments, getCloudflareWorkerRspackConfig };
+export { applyCloudflareBuilderEnvironments, applyCloudflareWorkerMfRuntimeBoundary, applyCloudflareWorkerRspackConfig, claimsByFunctionExternal, createAbsentOptionalDependencyFilter, createCloudflareBuilderPlugin, createRequestRedirectMatcher, getCloudflareBuilderEnvironments, getCloudflareWorkerRspackConfig };

package/dist/esm/cloudflare-output-contract.mjs

@@ -10,27 +10,49 @@ const CLOUDFLARE_RUNTIME_TYPE = 'cloudflare-module-worker';
 const CLOUDFLARE_OUTPUT_PACKAGE_TYPE = 'module';
 const CLOUDFLARE_WORKER_PACKAGE_TYPE = 'commonjs';
 const CLOUDFLARE_WORKER_BUNDLE_FORMAT = 'commonjs';
+const CLOUDFLARE_ROUTE_DATA_HANDLER_EXPORT = 'handleRouteDataRequest';
+const getCloudflareWorkerRouteDataEntryName = (entryName)=>`${entryName}-server-loaders`;
 const CLOUDFLARE_WORKER_NODE_BUILTINS = [
+    '_http_agent',
+    '_http_client',
+    '_http_common',
+    '_http_incoming',
+    '_http_outgoing',
+    '_http_server',
+    '_tls_common',
+    '_tls_wrap',
     'assert',
     'assert/strict',
     'async_hooks',
     'buffer',
     'child_process',
+    'cluster',
+    'console',
+    'constants',
     'crypto',
     'dgram',
+    'diagnostics_channel',
     'dns',
+    'dns/promises',
     'domain',
     'events',
     'fs',
     'fs/promises',
     'http',
     'http2',
+    'https',
     'inspector',
+    'inspector/promises',
     'module',
     'net',
     'os',
     'path',
+    'path/posix',
+    'path/win32',
+    'perf_hooks',
     'process',
+    'punycode',
+    'querystring',
     'readline',
     'readline/promises',
     'repl',
@@ -40,6 +62,8 @@ const CLOUDFLARE_WORKER_NODE_BUILTINS = [
     'stream/promises',
     'stream/web',
     'string_decoder',
+    'sys',
+    'test',
     'timers',
     'timers/promises',
     'tls',
@@ -61,4 +85,4 @@ const CLOUDFLARE_REQUIRED_COMPATIBILITY_FLAGS = [
     'nodejs_compat',
     'global_fetch_strictly_public'
 ];
-export { CLOUDFLARE_ASSETS_BINDING, CLOUDFLARE_OUTPUT_PACKAGE_FILE, CLOUDFLARE_OUTPUT_PACKAGE_TYPE, CLOUDFLARE_PUBLIC_ASSETS_DIRECTORY, CLOUDFLARE_REQUIRED_COMPATIBILITY_FLAGS, CLOUDFLARE_RUNTIME_TYPE, CLOUDFLARE_WORKER_BUNDLE_DIRECTORY, CLOUDFLARE_WORKER_BUNDLE_FORMAT, CLOUDFLARE_WORKER_ENTRY, CLOUDFLARE_WORKER_MANIFEST, CLOUDFLARE_WORKER_NODE_BUILTINS, CLOUDFLARE_WORKER_PACKAGE_FILE, CLOUDFLARE_WORKER_PACKAGE_TYPE, CLOUDFLARE_WORKER_PLATFORM_MODULES, CLOUDFLARE_WRANGLER_CONFIG_FILE };
+export { CLOUDFLARE_ASSETS_BINDING, CLOUDFLARE_OUTPUT_PACKAGE_FILE, CLOUDFLARE_OUTPUT_PACKAGE_TYPE, CLOUDFLARE_PUBLIC_ASSETS_DIRECTORY, CLOUDFLARE_REQUIRED_COMPATIBILITY_FLAGS, CLOUDFLARE_ROUTE_DATA_HANDLER_EXPORT, CLOUDFLARE_RUNTIME_TYPE, CLOUDFLARE_WORKER_BUNDLE_DIRECTORY, CLOUDFLARE_WORKER_BUNDLE_FORMAT, CLOUDFLARE_WORKER_ENTRY, CLOUDFLARE_WORKER_MANIFEST, CLOUDFLARE_WORKER_NODE_BUILTINS, CLOUDFLARE_WORKER_PACKAGE_FILE, CLOUDFLARE_WORKER_PACKAGE_TYPE, CLOUDFLARE_WORKER_PLATFORM_MODULES, CLOUDFLARE_WRANGLER_CONFIG_FILE, getCloudflareWorkerRouteDataEntryName };

package/dist/esm/cloudflare-output-verifier/identity.mjs

@@ -24,30 +24,32 @@ const verifyDeliveryUnitIdentity = (issues, manifest, manifestPath, declared)=>{
     ]){
         const marker = stamped.surfaces[surface];
         const expected = declared?.surfaces?.[surface];
-        if (declared?.surfaces && !expected) {
-            if (marker) addIssue(issues, {
-                code: 'delivery-unit-drift',
-                message: `Cloudflare worker manifest declares an unexpected ${surface} delivery-unit surface for this topology profile.`,
-                path: manifestPath
-            });
-            continue;
-        }
-        if (!marker || 'object' != typeof marker) {
-            addIssue(issues, {
-                code: 'missing-delivery-unit',
-                message: `Cloudflare worker manifest is missing the ${surface} delivery-unit surface marker.`,
-                path: manifestPath
-            });
-            continue;
-        }
-        for (const field of DELIVERY_UNIT_IDENTITY_FIELDS){
-            const markerValue = deliveryUnitIdentityFieldValue(marker, field);
-            const stampedValue = deliveryUnitIdentityFieldValue(stamped, field);
-            assertEqual(issues, markerValue, stampedValue, {
-                code: 'delivery-unit-drift',
-                message: `Cloudflare worker manifest ${surface} surface deliveryUnit.${field} must derive from one delivery-unit record (expected ${stampedValue ?? 'undefined'}, received ${markerValue ?? 'undefined'}).`,
-                path: manifestPath
-            });
+        if (expected || marker) {
+            if (declared?.surfaces && !expected) {
+                if (marker) addIssue(issues, {
+                    code: 'delivery-unit-drift',
+                    message: `Cloudflare worker manifest declares an unexpected ${surface} delivery-unit surface for this topology profile.`,
+                    path: manifestPath
+                });
+                continue;
+            }
+            if (!marker || 'object' != typeof marker) {
+                addIssue(issues, {
+                    code: 'missing-delivery-unit',
+                    message: `Cloudflare worker manifest is missing the ${surface} delivery-unit surface marker.`,
+                    path: manifestPath
+                });
+                continue;
+            }
+            for (const field of DELIVERY_UNIT_IDENTITY_FIELDS){
+                const markerValue = deliveryUnitIdentityFieldValue(marker, field);
+                const stampedValue = deliveryUnitIdentityFieldValue(stamped, field);
+                assertEqual(issues, markerValue, stampedValue, {
+                    code: 'delivery-unit-drift',
+                    message: `Cloudflare worker manifest ${surface} surface deliveryUnit.${field} must derive from one delivery-unit record (expected ${stampedValue ?? 'undefined'}, received ${markerValue ?? 'undefined'}).`,
+                    path: manifestPath
+                });
+            }
         }
     }
 };

package/dist/esm/cloudflare-output-verifier/index.mjs

@@ -72,6 +72,16 @@ const verifyCloudflareOutput = async (options)=>{
         }
     }
     if (wrangler) {
+        if ('string' != typeof wrangler.name || 0 === wrangler.name.trim().length) addIssue(issues, {
+            code: 'invalid-wrangler',
+            message: 'wrangler.json name must be a non-empty worker name.',
+            path: wranglerPath
+        });
+        if ('string' != typeof wrangler.compatibility_date || !/^\d{4}-\d{2}-\d{2}$/u.test(wrangler.compatibility_date)) addIssue(issues, {
+            code: 'invalid-wrangler',
+            message: 'wrangler.json compatibility_date must use YYYY-MM-DD.',
+            path: wranglerPath
+        });
         assertEqual(issues, wrangler.main, outputPlan.wrangler.main, {
             code: 'invalid-wrangler',
             message: `wrangler.json main must be ${outputPlan.wrangler.main}.`,

package/dist/esm/cloudflare-output-verifier/manifest.mjs

@@ -42,6 +42,52 @@ const verifyManifestShape = (issues, manifest, manifestPath)=>{
         message: 'Cloudflare output manifest routeSpec.routes must be array.',
         path: manifestPath
     });
+    const security = manifest.security;
+    if (security && 'object' == typeof security && 'boolean' == typeof security.enabled) {
+        const cors = security.cors;
+        if (!cors || 'object' != typeof cors || 'boolean' != typeof cors.assets || !Array.isArray(cors.allowedOrigins) || !Array.isArray(cors.allowedMethods) || !Array.isArray(cors.allowedHeaders)) addIssue(issues, {
+            code: 'invalid-manifest',
+            message: 'Cloudflare output manifest security.cors is incomplete.',
+            path: manifestPath
+        });
+        if (security.enabled) {
+            const headers = security.headers;
+            const csp = security.contentSecurityPolicy;
+            const noindex = security.noindex;
+            if (!headers || 'object' != typeof headers || ![
+                'string',
+                'boolean'
+            ].includes(typeof headers.referrerPolicy) || ![
+                'string',
+                'boolean'
+            ].includes(typeof headers.contentTypeOptions) || ![
+                'string',
+                'boolean'
+            ].includes(typeof headers.permissionsPolicy)) addIssue(issues, {
+                code: 'invalid-manifest',
+                message: 'Cloudflare output manifest security.headers is incomplete.',
+                path: manifestPath
+            });
+            if (!csp || ![
+                'off',
+                'report-only',
+                'enforce'
+            ].includes(csp.mode) || !csp.directives || 'object' != typeof csp.directives || Array.isArray(csp.directives) || Object.values(csp.directives).some((value)=>!Array.isArray(value) || value.some((entry)=>'string' != typeof entry))) addIssue(issues, {
+                code: 'invalid-manifest',
+                message: 'Cloudflare output manifest security.contentSecurityPolicy is invalid.',
+                path: manifestPath
+            });
+            if (!noindex || 'boolean' != typeof noindex.workersDev || 'boolean' != typeof noindex.localhost || !Array.isArray(noindex.previewHostnames)) addIssue(issues, {
+                code: 'invalid-manifest',
+                message: 'Cloudflare output manifest security.noindex is incomplete.',
+                path: manifestPath
+            });
+        }
+    } else addIssue(issues, {
+        code: 'invalid-manifest',
+        message: 'Cloudflare output manifest security.enabled must be a boolean.',
+        path: manifestPath
+    });
     if (manifest.bff?.runtimeFramework === 'effect') assertEqual(issues, manifest.bff.dispatcherExport, BFF_EFFECT_WORKER_DISPATCHER_EXPORT, {
         code: 'invalid-manifest',
         message: `Cloudflare Effect BFF manifest dispatcherExport must be ${BFF_EFFECT_WORKER_DISPATCHER_EXPORT}.`,

package/dist/esm/cloudflare-output-verifier/mutation-policy.mjs

@@ -84,7 +84,13 @@ const verifyCloudflareOutputMutationPolicy = async (options)=>{
     const files = (await Promise.all(options.scanRoots.map((scanRoot)=>walkFiles(node_path.resolve(scanRoot))))).flat();
     for (const file of files){
         if (excludedFiles.has(file)) continue;
-        const source = await promises.readFile(file, 'utf-8');
+        let source;
+        try {
+            source = await promises.readFile(file, 'utf-8');
+        } catch (error) {
+            if ('ENOENT' === error.code) continue;
+            throw error;
+        }
         for (const forbidden of FORBIDDEN_MUTATION_PATTERNS)if (forbidden.pattern.test(source)) addIssue(issues, {
             code: forbidden.code,
             message: forbidden.message,

package/dist/esm/cloudflare-output-verifier/worker-bundles.mjs

@@ -4,9 +4,9 @@ import { pathToFileURL } from "node:url";
 import { isDeepStrictEqual } from "node:util";
 import { parse } from "@babel/parser";
 import traverse from "@babel/traverse";
-import { CLOUDFLARE_WORKER_BUNDLE_DIRECTORY, CLOUDFLARE_WORKER_NODE_BUILTINS, CLOUDFLARE_WORKER_PLATFORM_MODULES } from "../cloudflare-output-contract.mjs";
+import { CLOUDFLARE_ROUTE_DATA_HANDLER_EXPORT, CLOUDFLARE_WORKER_BUNDLE_DIRECTORY, CLOUDFLARE_WORKER_NODE_BUILTINS, CLOUDFLARE_WORKER_PLATFORM_MODULES } from "../cloudflare-output-contract.mjs";
 import { addIssue } from "./issues.mjs";
-const getReferencedRouteWorkers = (manifest)=>Array.isArray(manifest?.routeSpec?.routes) ? manifest.routeSpec.routes.map((route)=>'string' == typeof route?.worker && route.worker.length > 0 ? route.worker : void 0).filter((worker)=>'string' == typeof worker) : [];
+const getReferencedRouteWorkers = (manifest, field)=>Array.isArray(manifest?.routeSpec?.routes) ? manifest.routeSpec.routes.map((route)=>'string' == typeof route?.[field] && route[field].length > 0 ? route[field] : void 0).filter((worker)=>'string' == typeof worker) : [];
 const getEffectBffWorker = (manifest)=>manifest?.bff?.runtimeFramework === 'effect' && 'string' == typeof manifest.bff.worker ? manifest.bff.worker : void 0;
 const getWorkerBundleReferences = (manifest)=>{
     const effectBffWorker = getEffectBffWorker(manifest);
@@ -18,9 +18,14 @@ const getWorkerBundleReferences = (manifest)=>{
                 reference: effectBffWorker
             }
         ] : [],
-        ...getReferencedRouteWorkers(manifest).map((reference)=>({
+        ...getReferencedRouteWorkers(manifest, 'worker').map((reference)=>({
                 kind: 'route',
                 reference
+            })),
+        ...getReferencedRouteWorkers(manifest, 'routeDataWorker').map((reference)=>({
+                dispatcherExport: CLOUDFLARE_ROUTE_DATA_HANDLER_EXPORT,
+                kind: 'route-data',
+                reference
             }))
     ];
 };
@@ -41,7 +46,7 @@ const resolveWorkerBundleReference = (issues, outputDirectory, reference, manife
         path: workerPath
     };
 };
-const missingWorkerBundleMessage = (reference)=>'effect-bff' === reference.kind ? 'Cloudflare Effect BFF manifest points to a missing worker bundle.' : 'Cloudflare route worker manifest points to a missing worker bundle.';
+const missingWorkerBundleMessage = (reference)=>'effect-bff' === reference.kind ? 'Cloudflare Effect BFF manifest points to a missing worker bundle.' : 'route-data' === reference.kind ? 'Cloudflare route data worker manifest points to a missing worker bundle.' : 'Cloudflare route worker manifest points to a missing worker bundle.';
 const isAstNode = (value)=>null !== value && 'object' == typeof value && 'type' in value && 'string' == typeof value.type;
 const getNodeName = (node)=>{
     if (!isAstNode(node)) return;
@@ -285,9 +290,9 @@ const verifyWorkerModuleClosure = async (issues, entryPath, entrySource, contrac
 };
 const verifyWorkerBundleReferences = async (issues, worker, source, contract)=>{
     const entryAnalysis = await verifyWorkerModuleClosure(issues, worker.path, source, contract);
-    if ('effect-bff' === worker.kind && 'string' == typeof worker.dispatcherExport && !entryAnalysis?.exports.has(worker.dispatcherExport)) addIssue(issues, {
+    if ('string' == typeof worker.dispatcherExport && !entryAnalysis?.exports.has(worker.dispatcherExport)) addIssue(issues, {
         code: 'invalid-worker-bundle',
-        message: 'Cloudflare Effect BFF worker bundle must expose its manifest dispatcherExport.',
+        message: 'route-data' === worker.kind ? `Cloudflare route data worker bundle must expose ${worker.dispatcherExport}.` : 'Cloudflare Effect BFF worker bundle must expose its manifest dispatcherExport.',
         path: worker.path
     });
 };

package/dist/esm/deploy-output/npmAliases.mjs

@@ -4,6 +4,10 @@ const dependencyKeys = [
     'dependencies',
     'optionalDependencies'
 ];
+const rootDependencyKeys = [
+    ...dependencyKeys,
+    'devDependencies'
+];
 const exactVersionPattern = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/u;
 async function readPackageJson(filePath) {
     return JSON.parse(await promises.readFile(filePath, 'utf8'));
@@ -19,14 +23,34 @@ function parseNpmAlias(aliasName, specifier) {
         targetVersion: target.slice(versionSeparator + 1)
     };
 }
-function aliasesFromPackageJson(packageJson) {
+function aliasesFromPackageJson(packageJson, keys = dependencyKeys) {
     const aliases = [];
-    for (const dependencyKey of dependencyKeys)for (const [aliasName, specifier] of Object.entries(packageJson[dependencyKey] ?? {})){
+    for (const dependencyKey of keys)for (const [aliasName, specifier] of Object.entries(packageJson[dependencyKey] ?? {})){
         const alias = parseNpmAlias(aliasName, specifier);
         if (alias) aliases.push(alias);
     }
     return aliases;
 }
+async function catalogAliasesFromInstalledPackages(appDirectory, packageJson) {
+    const aliases = [];
+    for (const dependencyKey of rootDependencyKeys)for (const [aliasName, specifier] of Object.entries(packageJson[dependencyKey] ?? {})){
+        if (!specifier.startsWith('catalog:')) continue;
+        let installedPackage;
+        try {
+            installedPackage = await readPackageJson(node_path.join(appDirectory, 'node_modules', aliasName, 'package.json'));
+        } catch (error) {
+            if ('ENOENT' === error.code) continue;
+            throw error;
+        }
+        if (!installedPackage.name || !installedPackage.version) throw new Error(`Installed catalog package ${aliasName} has no identity`);
+        if (installedPackage.name !== aliasName) aliases.push({
+            aliasName,
+            targetName: installedPackage.name,
+            targetVersion: installedPackage.version
+        });
+    }
+    return aliases;
+}
 async function collectPackageRecords(nodeModulesDirectory) {
     const records = [];
     const visitedNodeModules = new Set();
@@ -148,7 +172,8 @@ async function preserveNpmAliases({ appDirectory, outputDirectory, implicitAlias
     const records = await collectPackageRecords(node_path.join(outputDirectory, 'node_modules'));
     const appPackageJson = await readPackageJson(node_path.join(appDirectory, 'package.json'));
     const rootAliases = [
-        ...aliasesFromPackageJson(appPackageJson),
+        ...aliasesFromPackageJson(appPackageJson, rootDependencyKeys),
+        ...await catalogAliasesFromInstalledPackages(appDirectory, appPackageJson),
         ...implicitAliases
     ].filter((alias)=>alias.aliasName !== alias.targetName);
     const emittedRootAliases = [];