@bleedingdev/modern-js-app-tools-extensions 3.9.0-ultramodern.2 → 3.9.0-ultramodern.21

package/src/cloudflare-output-contract.ts

@@ -10,19 +10,89 @@ export const CLOUDFLARE_RUNTIME_TYPE = 'cloudflare-module-worker';
 export const CLOUDFLARE_OUTPUT_PACKAGE_TYPE = 'module';
 export const CLOUDFLARE_WORKER_PACKAGE_TYPE = 'commonjs';
 export const CLOUDFLARE_WORKER_BUNDLE_FORMAT = 'commonjs';
+// Each SSR entry with route data loaders gets a worker bundle that answers
+// `?__loader=` route data requests through this export.
+export const CLOUDFLARE_ROUTE_DATA_HANDLER_EXPORT = 'handleRouteDataRequest';
+export const getCloudflareWorkerRouteDataEntryName = (entryName: string) =>
+  `${entryName}-server-loaders`;
+// Every Node.js built-in that workerd resolves for the default 2026-06-02
+// nodejs_compat target (tests/cloudflare-worker-node-builtins.test.ts probes
+// workerd against Node's own `builtinModules`). Names are listed without the
+// `node:` scheme; bare-name imports are only valid where Node itself accepts
+// them (`isBuiltin`), so prefix-only modules such as `sqlite` and `test` are
+// externalized solely as `node:sqlite` and `node:test`. Some modules are
+// runtime-provided stubs whose unsupported operations throw. Earlier
+// compatibility dates are rejected when the Wrangler config is generated.
 export const CLOUDFLARE_WORKER_NODE_BUILTINS = [
+  '_http_agent',
+  '_http_client',
+  '_http_common',
+  '_http_incoming',
+  '_http_outgoing',
+  '_http_server',
+  '_tls_common',
+  '_tls_wrap',
+  'assert',
+  'assert/strict',
   'async_hooks',
   'buffer',
+  'child_process',
+  'cluster',
+  'console',
+  'constants',
   'crypto',
+  'dgram',
+  'diagnostics_channel',
+  'dns',
+  'dns/promises',
+  'domain',
   'events',
+  'fs',
   'fs/promises',
+  'http',
+  'http2',
+  'https',
+  'inspector',
+  'inspector/promises',
   'module',
+  'net',
+  'os',
   'path',
+  'path/posix',
+  'path/win32',
+  'perf_hooks',
   'process',
+  'punycode',
+  'querystring',
+  'readline',
+  'readline/promises',
+  'repl',
+  'sqlite',
   'stream',
+  'stream/consumers',
+  'stream/promises',
+  'stream/web',
   'string_decoder',
+  'sys',
+  'test',
+  'timers',
+  'timers/promises',
+  'tls',
+  'trace_events',
+  'tty',
   'url',
   'util',
+  'util/types',
+  'v8',
+  'vm',
+  'wasi',
+  'worker_threads',
+  'zlib',
+] as const;
+// Platform imports available with the default 2026-06-02 nodejs_compat target.
+// Import availability does not imply support for every Node API operation.
+export const CLOUDFLARE_WORKER_PLATFORM_MODULES = [
+  'cloudflare:sockets',
 ] as const;
 export const CLOUDFLARE_REQUIRED_COMPATIBILITY_FLAGS = [
   'nodejs_compat',

package/src/cloudflare-output-verifier/identity.ts

@@ -2,7 +2,7 @@ import {
   DELIVERY_UNIT_IDENTITY_FIELDS,
   type DeliveryUnitIdentity,
   deliveryUnitIdentityFieldValue,
-} from '@modern-js/utils/universal';
+} from '@modern-js/backend-federation-contracts';
 import type { CloudflareOutputVerifierIssue, JsonObject } from './issues';
 import { addIssue, assertEqual } from './issues';
 
@@ -51,6 +51,10 @@ export const verifyDeliveryUnitIdentity = (
       const marker = stamped.surfaces[surface];
       const expected = declared?.surfaces?.[surface];
 
+      if (!expected && !marker) {
+        continue;
+      }
+
       if (declared?.surfaces && !expected) {
         if (marker) {
           addIssue(issues, {

package/src/cloudflare-output-verifier/index.ts

@@ -174,6 +174,26 @@ export const verifyCloudflareOutput = async (
   }
 
   if (wrangler) {
+    if (
+      typeof wrangler.name !== 'string' ||
+      wrangler.name.trim().length === 0
+    ) {
+      addIssue(issues, {
+        code: 'invalid-wrangler',
+        message: 'wrangler.json name must be a non-empty worker name.',
+        path: wranglerPath,
+      });
+    }
+    if (
+      typeof wrangler.compatibility_date !== 'string' ||
+      !/^\d{4}-\d{2}-\d{2}$/u.test(wrangler.compatibility_date)
+    ) {
+      addIssue(issues, {
+        code: 'invalid-wrangler',
+        message: 'wrangler.json compatibility_date must use YYYY-MM-DD.',
+        path: wranglerPath,
+      });
+    }
     assertEqual(issues, wrangler.main, outputPlan.wrangler.main, {
       code: 'invalid-wrangler',
       message: `wrangler.json main must be ${outputPlan.wrangler.main}.`,

package/src/cloudflare-output-verifier/manifest.ts

@@ -61,6 +61,83 @@ export const verifyManifestShape = (
       path: manifestPath,
     });
   }
+  const security = manifest.security;
+  if (
+    !security ||
+    typeof security !== 'object' ||
+    typeof security.enabled !== 'boolean'
+  ) {
+    addIssue(issues, {
+      code: 'invalid-manifest',
+      message: 'Cloudflare output manifest security.enabled must be a boolean.',
+      path: manifestPath,
+    });
+  } else {
+    const cors = security.cors;
+    if (
+      !cors ||
+      typeof cors !== 'object' ||
+      typeof cors.assets !== 'boolean' ||
+      !Array.isArray(cors.allowedOrigins) ||
+      !Array.isArray(cors.allowedMethods) ||
+      !Array.isArray(cors.allowedHeaders)
+    ) {
+      addIssue(issues, {
+        code: 'invalid-manifest',
+        message: 'Cloudflare output manifest security.cors is incomplete.',
+        path: manifestPath,
+      });
+    }
+    if (security.enabled) {
+      const headers = security.headers;
+      const csp = security.contentSecurityPolicy;
+      const noindex = security.noindex;
+      if (
+        !headers ||
+        typeof headers !== 'object' ||
+        !['string', 'boolean'].includes(typeof headers.referrerPolicy) ||
+        !['string', 'boolean'].includes(typeof headers.contentTypeOptions) ||
+        !['string', 'boolean'].includes(typeof headers.permissionsPolicy)
+      ) {
+        addIssue(issues, {
+          code: 'invalid-manifest',
+          message: 'Cloudflare output manifest security.headers is incomplete.',
+          path: manifestPath,
+        });
+      }
+      if (
+        !csp ||
+        !['off', 'report-only', 'enforce'].includes(csp.mode) ||
+        !csp.directives ||
+        typeof csp.directives !== 'object' ||
+        Array.isArray(csp.directives) ||
+        Object.values(csp.directives).some(
+          value =>
+            !Array.isArray(value) ||
+            value.some(entry => typeof entry !== 'string'),
+        )
+      ) {
+        addIssue(issues, {
+          code: 'invalid-manifest',
+          message:
+            'Cloudflare output manifest security.contentSecurityPolicy is invalid.',
+          path: manifestPath,
+        });
+      }
+      if (
+        !noindex ||
+        typeof noindex.workersDev !== 'boolean' ||
+        typeof noindex.localhost !== 'boolean' ||
+        !Array.isArray(noindex.previewHostnames)
+      ) {
+        addIssue(issues, {
+          code: 'invalid-manifest',
+          message: 'Cloudflare output manifest security.noindex is incomplete.',
+          path: manifestPath,
+        });
+      }
+    }
+  }
   if (manifest.bff?.runtimeFramework === 'effect') {
     assertEqual(
       issues,

package/src/cloudflare-output-verifier/mutation-policy.ts

@@ -140,7 +140,17 @@ export const verifyCloudflareOutputMutationPolicy = async (
     if (excludedFiles.has(file)) {
       continue;
     }
-    const source = await fs.readFile(file, 'utf-8');
+    let source: string;
+    try {
+      source = await fs.readFile(file, 'utf-8');
+    } catch (error) {
+      // Concurrent sibling builds delete transient files (for example tsgo
+      // resolved configs) between the walk and the read.
+      if ((error as NodeJS.ErrnoException).code === 'ENOENT') {
+        continue;
+      }
+      throw error;
+    }
     for (const forbidden of FORBIDDEN_MUTATION_PATTERNS) {
       if (forbidden.pattern.test(source)) {
         addIssue(issues, {

package/src/cloudflare-output-verifier/worker-bundles.ts

@@ -5,15 +5,17 @@ import { isDeepStrictEqual } from 'node:util';
 import { parse } from '@babel/parser';
 import traverse, { type NodePath } from '@babel/traverse';
 import {
+  CLOUDFLARE_ROUTE_DATA_HANDLER_EXPORT,
   CLOUDFLARE_WORKER_BUNDLE_DIRECTORY,
   CLOUDFLARE_WORKER_NODE_BUILTINS,
+  CLOUDFLARE_WORKER_PLATFORM_MODULES,
 } from '../cloudflare-output-contract';
 import type { CloudflareOutputVerifierIssue, JsonObject } from './issues';
 import { addIssue } from './issues';
 
 interface WorkerBundleReference {
   dispatcherExport?: string;
-  kind: 'effect-bff' | 'route';
+  kind: 'effect-bff' | 'route' | 'route-data';
   reference: string;
 }
 
@@ -21,12 +23,15 @@ interface ResolvedWorkerBundleReference extends WorkerBundleReference {
   path: string;
 }
 
-const getReferencedRouteWorkers = (manifest: JsonObject) =>
+const getReferencedRouteWorkers = (
+  manifest: JsonObject,
+  field: 'routeDataWorker' | 'worker',
+) =>
   Array.isArray(manifest?.routeSpec?.routes)
     ? manifest.routeSpec.routes
         .map((route: any) =>
-          typeof route?.worker === 'string' && route.worker.length > 0
-            ? route.worker
+          typeof route?.[field] === 'string' && route[field].length > 0
+            ? route[field]
             : undefined,
         )
         .filter(
@@ -57,10 +62,19 @@ export const getWorkerBundleReferences = (
           },
         ]
       : []),
-    ...getReferencedRouteWorkers(manifest).map((reference: string) => ({
-      kind: 'route' as const,
-      reference,
-    })),
+    ...getReferencedRouteWorkers(manifest, 'worker').map(
+      (reference: string) => ({
+        kind: 'route' as const,
+        reference,
+      }),
+    ),
+    ...getReferencedRouteWorkers(manifest, 'routeDataWorker').map(
+      (reference: string) => ({
+        dispatcherExport: CLOUDFLARE_ROUTE_DATA_HANDLER_EXPORT,
+        kind: 'route-data' as const,
+        reference,
+      }),
+    ),
   ];
 };
 
@@ -100,7 +114,9 @@ export const resolveWorkerBundleReference = (
 export const missingWorkerBundleMessage = (reference: WorkerBundleReference) =>
   reference.kind === 'effect-bff'
     ? 'Cloudflare Effect BFF manifest points to a missing worker bundle.'
-    : 'Cloudflare route worker manifest points to a missing worker bundle.';
+    : reference.kind === 'route-data'
+      ? 'Cloudflare route data worker manifest points to a missing worker bundle.'
+      : 'Cloudflare route worker manifest points to a missing worker bundle.';
 
 interface AstNode {
   type: string;
@@ -436,9 +452,10 @@ const getPackageName = (specifier: string) =>
     ? specifier.split('/').slice(0, 2).join('/')
     : specifier.split('/')[0];
 
-const CLOUDFLARE_WORKER_NODE_BUILTIN_SPECIFIERS = new Set(
-  CLOUDFLARE_WORKER_NODE_BUILTINS.map(builtin => `node:${builtin}`),
-);
+const CLOUDFLARE_WORKER_NODE_BUILTIN_SPECIFIERS = new Set([
+  ...CLOUDFLARE_WORKER_NODE_BUILTINS.map(builtin => `node:${builtin}`),
+  ...CLOUDFLARE_WORKER_PLATFORM_MODULES,
+]);
 
 const isInsideDirectory = (directory: string, filePath: string) => {
   const relative = path.relative(directory, filePath);
@@ -609,14 +626,15 @@ export const verifyWorkerBundleReferences = async (
     contract,
   );
   if (
-    worker.kind === 'effect-bff' &&
     typeof worker.dispatcherExport === 'string' &&
     !entryAnalysis?.exports.has(worker.dispatcherExport)
   ) {
     addIssue(issues, {
       code: 'invalid-worker-bundle',
       message:
-        'Cloudflare Effect BFF worker bundle must expose its manifest dispatcherExport.',
+        worker.kind === 'route-data'
+          ? `Cloudflare route data worker bundle must expose ${worker.dispatcherExport}.`
+          : 'Cloudflare Effect BFF worker bundle must expose its manifest dispatcherExport.',
       path: worker.path,
     });
   }

package/src/config.ts

@@ -1,9 +1,11 @@
-export type DeployTarget =
-  | 'node'
-  | 'vercel'
-  | 'netlify'
-  | 'ghPages'
-  | 'cloudflare';
+export type { ResolveEffectTsgoCompilerOptions } from './build-config/public';
+export {
+  getBuildConfigEnvironment,
+  resolveEffectTsgoCompiler,
+} from './build-config/public';
+export { createRemoteManifestUrl } from './build-config/remote-address';
+export type { DeployTarget } from './deploy-output/target';
+export { resolveDeployTarget } from './deploy-output/target';
 
 export type CloudflareWorkerSecurityCspMode = 'enforce' | 'report-only' | 'off';
 
@@ -39,6 +41,18 @@ export interface CloudflareWorkerPublicAssetConfig {
   to: string;
 }
 
+export interface NodePublicAssetConfig {
+  /**
+   * Source file or directory, relative to the app root, to copy into the
+   * Node deploy output's public directory.
+   */
+  from: string;
+  /**
+   * Destination path relative to `.output/public`.
+   */
+  to: string;
+}
+
 export interface CloudflareWorkerD1DatabaseConfig {
   /**
    * Worker binding name, for example `DB`.
@@ -194,3 +208,17 @@ export interface CloudflareDeployConfig {
     publicAssetExcludes?: string[];
   };
 }
+
+export interface NodeDeployConfig {
+  node?: {
+    /**
+     * Additional app-root files or directories to stage under
+     * `.output/public` when `modern deploy` targets Node, the counterpart of
+     * `deploy.worker.publicAssets`. The Node server does not route these
+     * files; serve them from the app, for example from an API handler.
+     * Release envelopes record them as declared public assets, so API-only
+     * units may ship them.
+     */
+    publicAssets?: NodePublicAssetConfig[];
+  };
+}