@bleedingdev/modern-js-app-tools-extensions 3.9.0-ultramodern.9 → 3.9.3-ultramodern.1

package/dist/esm/cloudflare-output-verifier/identity.mjs

@@ -1,8 +1,9 @@
-import { DELIVERY_UNIT_IDENTITY_FIELDS, deliveryUnitIdentityFieldValue } from "@modern-js/backend-federation-contracts";
+import { DELIVERY_UNIT_IDENTITY_FIELDS, deliveryUnitIdentityFieldValue, validateRendererIdentity, validateRendererProfile, validateRendererProfileCompatibility } from "@modern-js/backend-federation-contracts";
+import { isRecord } from "../cloudflare/utils.mjs";
 import { addIssue, assertEqual } from "./issues.mjs";
 const verifyDeliveryUnitIdentity = (issues, manifest, manifestPath, declared)=>{
     const stamped = manifest?.deliveryUnit;
-    const hasStamp = Boolean(stamped) && 'object' == typeof stamped;
+    const hasStamp = isRecord(stamped);
     if (declared) {
         if (!hasStamp) return void addIssue(issues, {
             code: 'missing-delivery-unit',
@@ -18,36 +19,124 @@ const verifyDeliveryUnitIdentity = (issues, manifest, manifestPath, declared)=>{
             });
         }
     }
-    if (hasStamp && stamped.surfaces && 'object' == typeof stamped.surfaces) for (const surface of [
-        'ui',
-        'api'
-    ]){
-        const marker = stamped.surfaces[surface];
-        const expected = declared?.surfaces?.[surface];
-        if (declared?.surfaces && !expected) {
-            if (marker) addIssue(issues, {
+    if (hasStamp) {
+        if (!isRecord(stamped.surfaces)) return void addIssue(issues, {
+            code: 'missing-delivery-unit',
+            message: 'Cloudflare worker manifest is missing delivery-unit surface markers.',
+            path: manifestPath
+        });
+        for (const surface of Object.keys(stamped.surfaces))if ('ui' !== surface && 'api' !== surface) addIssue(issues, {
+            code: 'delivery-unit-drift',
+            message: `Cloudflare worker manifest declares an unsupported ${surface} delivery-unit surface.`,
+            path: manifestPath
+        });
+        if (!declared?.surfaces && !Object.hasOwn(stamped.surfaces, 'ui') && !Object.hasOwn(stamped.surfaces, 'api')) return void addIssue(issues, {
+            code: 'missing-delivery-unit',
+            message: 'Cloudflare worker manifest is missing delivery-unit surface markers.',
+            path: manifestPath
+        });
+        for (const surface of [
+            'ui',
+            'api'
+        ]){
+            const marker = stamped.surfaces[surface];
+            const expected = declared?.surfaces?.[surface];
+            if (!expected && !marker) continue;
+            if (declared?.surfaces && !expected) {
+                if (marker) addIssue(issues, {
+                    code: 'delivery-unit-drift',
+                    message: `Cloudflare worker manifest declares an unexpected ${surface} delivery-unit surface for this topology profile.`,
+                    path: manifestPath
+                });
+                continue;
+            }
+            if (!isRecord(marker)) {
+                addIssue(issues, {
+                    code: 'missing-delivery-unit',
+                    message: `Cloudflare worker manifest is missing the ${surface} delivery-unit surface marker.`,
+                    path: manifestPath
+                });
+                continue;
+            }
+            assertEqual(issues, marker.surface, surface, {
                 code: 'delivery-unit-drift',
-                message: `Cloudflare worker manifest declares an unexpected ${surface} delivery-unit surface for this topology profile.`,
+                message: `Cloudflare worker manifest ${surface} surface must declare surface "${surface}".`,
                 path: manifestPath
             });
-            continue;
-        }
-        if (!marker || 'object' != typeof marker) {
-            addIssue(issues, {
-                code: 'missing-delivery-unit',
-                message: `Cloudflare worker manifest is missing the ${surface} delivery-unit surface marker.`,
+            for (const field of DELIVERY_UNIT_IDENTITY_FIELDS){
+                const markerValue = deliveryUnitIdentityFieldValue(marker, field);
+                const stampedValue = deliveryUnitIdentityFieldValue(stamped, field);
+                assertEqual(issues, markerValue, stampedValue, {
+                    code: 'delivery-unit-drift',
+                    message: `Cloudflare worker manifest ${surface} surface deliveryUnit.${field} must derive from one delivery-unit record (expected ${stampedValue ?? 'undefined'}, received ${markerValue ?? 'undefined'}).`,
+                    path: manifestPath
+                });
+            }
+            if ('api' === surface) {
+                for (const field of [
+                    'rendererIdentity',
+                    'rendererProfile'
+                ])if (Object.hasOwn(marker, field)) addIssue(issues, {
+                    code: 'delivery-unit-drift',
+                    message: `Cloudflare worker manifest API surface must not declare ${field}.`,
+                    path: manifestPath
+                });
+                continue;
+            }
+            const identity = marker.rendererIdentity;
+            const profile = marker.rendererProfile;
+            const errors = [
+                ...validateRendererIdentity(identity).errors,
+                ...validateRendererProfile(profile).errors
+            ];
+            for (const error of errors)addIssue(issues, {
+                code: 'delivery-unit-drift',
+                message: `Cloudflare worker manifest UI ${error.path} ${error.message}`,
                 path: manifestPath
             });
-            continue;
-        }
-        for (const field of DELIVERY_UNIT_IDENTITY_FIELDS){
-            const markerValue = deliveryUnitIdentityFieldValue(marker, field);
-            const stampedValue = deliveryUnitIdentityFieldValue(stamped, field);
-            assertEqual(issues, markerValue, stampedValue, {
+            if (errors.length || !isRecord(identity) || !isRecord(profile)) continue;
+            assertEqual(issues, identity.buildId, marker.buildMarker, {
+                code: 'delivery-unit-drift',
+                message: 'Cloudflare worker manifest UI rendererIdentity.buildId must match its surface buildMarker.',
+                path: manifestPath
+            });
+            assertEqual(issues, identity.appId, marker.appId, {
+                code: 'delivery-unit-drift',
+                message: 'Cloudflare worker manifest UI rendererIdentity.appId must match its surface appId.',
+                path: manifestPath
+            });
+            assertEqual(issues, marker.appId, stamped.appId, {
+                code: 'delivery-unit-drift',
+                message: 'Cloudflare worker manifest UI surface appId must match its delivery-unit appId.',
+                path: manifestPath
+            });
+            for (const field of [
+                'renderer',
+                'protocolVersion'
+            ])assertEqual(issues, identity[field], profile[field], {
                 code: 'delivery-unit-drift',
-                message: `Cloudflare worker manifest ${surface} surface deliveryUnit.${field} must derive from one delivery-unit record (expected ${stampedValue ?? 'undefined'}, received ${markerValue ?? 'undefined'}).`,
+                message: `Cloudflare worker manifest UI rendererProfile.${field} must match its renderer identity.`,
                 path: manifestPath
             });
+            const expectedUi = declared?.surfaces?.ui;
+            if (expectedUi?.rendererIdentity) {
+                for (const field of [
+                    'renderer',
+                    'appId',
+                    'entryName',
+                    'protocolVersion',
+                    'buildId'
+                ])assertEqual(issues, identity[field], expectedUi.rendererIdentity[field], {
+                    code: 'delivery-unit-drift',
+                    message: `Cloudflare worker manifest UI rendererIdentity.${field} must match the topology renderer identity.`,
+                    path: manifestPath
+                });
+                for (const error of validateRendererProfileCompatibility(expectedUi.rendererProfile, profile).errors)addIssue(issues, {
+                    code: 'delivery-unit-drift',
+                    message: `Cloudflare worker manifest UI ${error.path} ${error.message}`,
+                    path: manifestPath
+                });
+            }
         }
     }
 };

package/dist/esm/cloudflare-output-verifier/index.mjs

@@ -72,6 +72,16 @@ const verifyCloudflareOutput = async (options)=>{
         }
     }
     if (wrangler) {
+        if ('string' != typeof wrangler.name || 0 === wrangler.name.trim().length) addIssue(issues, {
+            code: 'invalid-wrangler',
+            message: 'wrangler.json name must be a non-empty worker name.',
+            path: wranglerPath
+        });
+        if ('string' != typeof wrangler.compatibility_date || !/^\d{4}-\d{2}-\d{2}$/u.test(wrangler.compatibility_date)) addIssue(issues, {
+            code: 'invalid-wrangler',
+            message: 'wrangler.json compatibility_date must use YYYY-MM-DD.',
+            path: wranglerPath
+        });
         assertEqual(issues, wrangler.main, outputPlan.wrangler.main, {
             code: 'invalid-wrangler',
             message: `wrangler.json main must be ${outputPlan.wrangler.main}.`,

package/dist/esm/cloudflare-output-verifier/manifest.mjs

@@ -42,6 +42,52 @@ const verifyManifestShape = (issues, manifest, manifestPath)=>{
         message: 'Cloudflare output manifest routeSpec.routes must be array.',
         path: manifestPath
     });
+    const security = manifest.security;
+    if (security && 'object' == typeof security && 'boolean' == typeof security.enabled) {
+        const cors = security.cors;
+        if (!cors || 'object' != typeof cors || 'boolean' != typeof cors.assets || !Array.isArray(cors.allowedOrigins) || !Array.isArray(cors.allowedMethods) || !Array.isArray(cors.allowedHeaders)) addIssue(issues, {
+            code: 'invalid-manifest',
+            message: 'Cloudflare output manifest security.cors is incomplete.',
+            path: manifestPath
+        });
+        if (security.enabled) {
+            const headers = security.headers;
+            const csp = security.contentSecurityPolicy;
+            const noindex = security.noindex;
+            if (!headers || 'object' != typeof headers || ![
+                'string',
+                'boolean'
+            ].includes(typeof headers.referrerPolicy) || ![
+                'string',
+                'boolean'
+            ].includes(typeof headers.contentTypeOptions) || ![
+                'string',
+                'boolean'
+            ].includes(typeof headers.permissionsPolicy)) addIssue(issues, {
+                code: 'invalid-manifest',
+                message: 'Cloudflare output manifest security.headers is incomplete.',
+                path: manifestPath
+            });
+            if (!csp || ![
+                'off',
+                'report-only',
+                'enforce'
+            ].includes(csp.mode) || !csp.directives || 'object' != typeof csp.directives || Array.isArray(csp.directives) || Object.values(csp.directives).some((value)=>!Array.isArray(value) || value.some((entry)=>'string' != typeof entry))) addIssue(issues, {
+                code: 'invalid-manifest',
+                message: 'Cloudflare output manifest security.contentSecurityPolicy is invalid.',
+                path: manifestPath
+            });
+            if (!noindex || 'boolean' != typeof noindex.workersDev || 'boolean' != typeof noindex.localhost || !Array.isArray(noindex.previewHostnames)) addIssue(issues, {
+                code: 'invalid-manifest',
+                message: 'Cloudflare output manifest security.noindex is incomplete.',
+                path: manifestPath
+            });
+        }
+    } else addIssue(issues, {
+        code: 'invalid-manifest',
+        message: 'Cloudflare output manifest security.enabled must be a boolean.',
+        path: manifestPath
+    });
     if (manifest.bff?.runtimeFramework === 'effect') assertEqual(issues, manifest.bff.dispatcherExport, BFF_EFFECT_WORKER_DISPATCHER_EXPORT, {
         code: 'invalid-manifest',
         message: `Cloudflare Effect BFF manifest dispatcherExport must be ${BFF_EFFECT_WORKER_DISPATCHER_EXPORT}.`,

package/dist/esm/cloudflare-output-verifier/mutation-policy.mjs

@@ -84,7 +84,13 @@ const verifyCloudflareOutputMutationPolicy = async (options)=>{
     const files = (await Promise.all(options.scanRoots.map((scanRoot)=>walkFiles(node_path.resolve(scanRoot))))).flat();
     for (const file of files){
         if (excludedFiles.has(file)) continue;
-        const source = await promises.readFile(file, 'utf-8');
+        let source;
+        try {
+            source = await promises.readFile(file, 'utf-8');
+        } catch (error) {
+            if ('ENOENT' === error.code) continue;
+            throw error;
+        }
         for (const forbidden of FORBIDDEN_MUTATION_PATTERNS)if (forbidden.pattern.test(source)) addIssue(issues, {
             code: forbidden.code,
             message: forbidden.message,

package/dist/esm/cloudflare-output-verifier/worker-bundles.mjs

@@ -4,9 +4,9 @@ import { pathToFileURL } from "node:url";
 import { isDeepStrictEqual } from "node:util";
 import { parse } from "@babel/parser";
 import traverse from "@babel/traverse";
-import { CLOUDFLARE_WORKER_BUNDLE_DIRECTORY, CLOUDFLARE_WORKER_NODE_BUILTINS, CLOUDFLARE_WORKER_PLATFORM_MODULES } from "../cloudflare-output-contract.mjs";
+import { CLOUDFLARE_ROUTE_DATA_HANDLER_EXPORT, CLOUDFLARE_WORKER_BUNDLE_DIRECTORY, CLOUDFLARE_WORKER_NODE_BUILTINS, CLOUDFLARE_WORKER_PLATFORM_MODULES } from "../cloudflare-output-contract.mjs";
 import { addIssue } from "./issues.mjs";
-const getReferencedRouteWorkers = (manifest)=>Array.isArray(manifest?.routeSpec?.routes) ? manifest.routeSpec.routes.map((route)=>'string' == typeof route?.worker && route.worker.length > 0 ? route.worker : void 0).filter((worker)=>'string' == typeof worker) : [];
+const getReferencedRouteWorkers = (manifest, field)=>Array.isArray(manifest?.routeSpec?.routes) ? manifest.routeSpec.routes.map((route)=>'string' == typeof route?.[field] && route[field].length > 0 ? route[field] : void 0).filter((worker)=>'string' == typeof worker) : [];
 const getEffectBffWorker = (manifest)=>manifest?.bff?.runtimeFramework === 'effect' && 'string' == typeof manifest.bff.worker ? manifest.bff.worker : void 0;
 const getWorkerBundleReferences = (manifest)=>{
     const effectBffWorker = getEffectBffWorker(manifest);
@@ -18,9 +18,14 @@ const getWorkerBundleReferences = (manifest)=>{
                 reference: effectBffWorker
             }
         ] : [],
-        ...getReferencedRouteWorkers(manifest).map((reference)=>({
+        ...getReferencedRouteWorkers(manifest, 'worker').map((reference)=>({
                 kind: 'route',
                 reference
+            })),
+        ...getReferencedRouteWorkers(manifest, 'routeDataWorker').map((reference)=>({
+                dispatcherExport: CLOUDFLARE_ROUTE_DATA_HANDLER_EXPORT,
+                kind: 'route-data',
+                reference
             }))
     ];
 };
@@ -41,7 +46,7 @@ const resolveWorkerBundleReference = (issues, outputDirectory, reference, manife
         path: workerPath
     };
 };
-const missingWorkerBundleMessage = (reference)=>'effect-bff' === reference.kind ? 'Cloudflare Effect BFF manifest points to a missing worker bundle.' : 'Cloudflare route worker manifest points to a missing worker bundle.';
+const missingWorkerBundleMessage = (reference)=>'effect-bff' === reference.kind ? 'Cloudflare Effect BFF manifest points to a missing worker bundle.' : 'route-data' === reference.kind ? 'Cloudflare route data worker manifest points to a missing worker bundle.' : 'Cloudflare route worker manifest points to a missing worker bundle.';
 const isAstNode = (value)=>null !== value && 'object' == typeof value && 'type' in value && 'string' == typeof value.type;
 const getNodeName = (node)=>{
     if (!isAstNode(node)) return;
@@ -285,9 +290,9 @@ const verifyWorkerModuleClosure = async (issues, entryPath, entrySource, contrac
 };
 const verifyWorkerBundleReferences = async (issues, worker, source, contract)=>{
     const entryAnalysis = await verifyWorkerModuleClosure(issues, worker.path, source, contract);
-    if ('effect-bff' === worker.kind && 'string' == typeof worker.dispatcherExport && !entryAnalysis?.exports.has(worker.dispatcherExport)) addIssue(issues, {
+    if ('string' == typeof worker.dispatcherExport && !entryAnalysis?.exports.has(worker.dispatcherExport)) addIssue(issues, {
         code: 'invalid-worker-bundle',
-        message: 'Cloudflare Effect BFF worker bundle must expose its manifest dispatcherExport.',
+        message: 'route-data' === worker.kind ? `Cloudflare route data worker bundle must expose ${worker.dispatcherExport}.` : 'Cloudflare Effect BFF worker bundle must expose its manifest dispatcherExport.',
         path: worker.path
     });
 };

package/dist/esm/config.mjs

@@ -1 +1,3 @@
-export { getBuildConfigEnvironment, resolveEffectTsgoCompiler, withBuildConfigEnvironment } from "./build-config/public.mjs";
+export { getBuildConfigEnvironment, resolveEffectTsgoCompiler } from "./build-config/public.mjs";
+export { createRemoteManifestUrl } from "./build-config/remote-address.mjs";
+export { resolveDeployTarget } from "./deploy-output/target.mjs";

package/dist/esm/deploy-output/npmAliases.mjs

@@ -4,6 +4,10 @@ const dependencyKeys = [
     'dependencies',
     'optionalDependencies'
 ];
+const rootDependencyKeys = [
+    ...dependencyKeys,
+    'devDependencies'
+];
 const exactVersionPattern = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/u;
 async function readPackageJson(filePath) {
     return JSON.parse(await promises.readFile(filePath, 'utf8'));
@@ -19,14 +23,87 @@ function parseNpmAlias(aliasName, specifier) {
         targetVersion: target.slice(versionSeparator + 1)
     };
 }
-function aliasesFromPackageJson(packageJson) {
+function aliasesFromPackageJson(packageJson, keys = dependencyKeys) {
     const aliases = [];
-    for (const dependencyKey of dependencyKeys)for (const [aliasName, specifier] of Object.entries(packageJson[dependencyKey] ?? {})){
+    for (const dependencyKey of keys)for (const [aliasName, specifier] of Object.entries(packageJson[dependencyKey] ?? {})){
         const alias = parseNpmAlias(aliasName, specifier);
         if (alias) aliases.push(alias);
     }
     return aliases;
 }
+async function catalogAliasesFromInstalledPackages(appDirectory, packageJson) {
+    const aliases = [];
+    for (const dependencyKey of rootDependencyKeys)for (const [aliasName, specifier] of Object.entries(packageJson[dependencyKey] ?? {})){
+        if (!specifier.startsWith('catalog:')) continue;
+        let installedPackage;
+        try {
+            installedPackage = await readPackageJson(node_path.join(appDirectory, 'node_modules', aliasName, 'package.json'));
+        } catch (error) {
+            if ('ENOENT' === error.code) continue;
+            throw error;
+        }
+        if (!installedPackage.name || !installedPackage.version) throw new Error(`Installed catalog package ${aliasName} has no identity`);
+        if (installedPackage.name !== aliasName) aliases.push({
+            aliasName,
+            targetName: installedPackage.name,
+            targetVersion: installedPackage.version
+        });
+    }
+    return aliases;
+}
+async function installedAliasesByOwner(appDirectory, emittedOwners) {
+    const aliasesByOwner = new Map();
+    let rootAliases = [];
+    const visited = new Set();
+    const rootFile = await promises.realpath(node_path.join(appDirectory, 'package.json'));
+    const pending = [
+        rootFile
+    ];
+    while(pending.length){
+        const file = await promises.realpath(pending.pop());
+        if (visited.has(file)) continue;
+        visited.add(file);
+        const owner = await readPackageJson(file);
+        const aliases = [];
+        const keys = file === rootFile ? rootDependencyKeys : dependencyKeys;
+        for (const key of keys)for (const name of Object.keys(owner[key] ?? {})){
+            let directory = node_path.dirname(file);
+            while(true){
+                const packageFile = node_path.join(directory, 'node_modules', name, 'package.json');
+                let target;
+                try {
+                    target = await readPackageJson(packageFile);
+                } catch (error) {
+                    if ('ENOENT' !== error.code) throw error;
+                    const parent = node_path.dirname(directory);
+                    if (parent === directory) break;
+                    directory = parent;
+                    continue;
+                }
+                if (!target.name || !target.version) throw new Error(`Installed package ${name} has no identity`);
+                pending.push(packageFile);
+                if (target.name !== name) aliases.push({
+                    aliasName: name,
+                    targetName: target.name,
+                    targetVersion: target.version
+                });
+                break;
+            }
+        }
+        if (file === rootFile) rootAliases = aliases;
+        const identity = `${owner.name}@${owner.version}`;
+        if (emittedOwners.has(identity)) {
+            const existing = aliasesByOwner.get(identity);
+            const normalized = (items)=>items.map((item)=>`${item.aliasName}=${aliasSpecifier(item)}`).sort().join('\n');
+            if (existing && normalized(existing) !== normalized(aliases)) throw new Error(`Cannot preserve npm aliases for ${identity}: installed contexts resolve different dependency identities`);
+            aliasesByOwner.set(identity, aliases);
+        }
+    }
+    return {
+        aliasesByOwner,
+        rootAliases
+    };
+}
 async function collectPackageRecords(nodeModulesDirectory) {
     const records = [];
     const visitedNodeModules = new Set();
@@ -147,8 +224,11 @@ async function readPackageIdentity(entryPath) {
 async function preserveNpmAliases({ appDirectory, outputDirectory, implicitAliases = [] }) {
     const records = await collectPackageRecords(node_path.join(outputDirectory, 'node_modules'));
     const appPackageJson = await readPackageJson(node_path.join(appDirectory, 'package.json'));
+    const installedAliases = await installedAliasesByOwner(appDirectory, new Set(records.map(({ packageJson })=>`${packageJson.name}@${packageJson.version}`)));
     const rootAliases = [
-        ...aliasesFromPackageJson(appPackageJson),
+        ...aliasesFromPackageJson(appPackageJson, rootDependencyKeys),
+        ...installedAliases.rootAliases,
+        ...await catalogAliasesFromInstalledPackages(appDirectory, appPackageJson),
         ...implicitAliases
     ].filter((alias)=>alias.aliasName !== alias.targetName);
     const emittedRootAliases = [];
@@ -161,9 +241,15 @@ async function preserveNpmAliases({ appDirectory, outputDirectory, implicitAlias
         await ensureAliasLink(outputDirectory, alias, target);
         emittedRootAliases.push(alias);
     }
-    for (const record of records)for (const alias of aliasesFromPackageJson(record.packageJson).filter((candidate)=>candidate.aliasName !== candidate.targetName)){
-        const target = await resolveAliasTarget(record.directory, alias, outputDirectory);
-        if (target) await ensureAliasLink(record.directory, alias, target);
+    for (const record of records){
+        const ownerAliases = [
+            ...aliasesFromPackageJson(record.packageJson),
+            ...installedAliases.aliasesByOwner.get(`${record.packageJson.name}@${record.packageJson.version}`) ?? []
+        ];
+        for (const alias of ownerAliases.filter((candidate)=>candidate.aliasName !== candidate.targetName)){
+            const target = await resolveAliasTarget(record.directory, alias, outputDirectory);
+            if (target) await ensureAliasLink(record.directory, alias, target);
+        }
     }
     const outputPackageJsonPath = node_path.join(outputDirectory, 'package.json');
     const outputPackageJson = await readPackageJson(outputPackageJsonPath);

package/dist/esm/deploy-output/plugin.mjs

@@ -1,14 +1,15 @@
 import { createRequire } from "node:module";
 import node_path from "node:path";
 import { preserveNpmAliases, readPackageIdentity } from "./npmAliases.mjs";
-import { resolveDeployTarget as external_target_mjs_resolveDeployTarget } from "./target.mjs";
-const createDeployOutputAliasesPlugin = ({ resolveDeployTarget = external_target_mjs_resolveDeployTarget } = {})=>({
+import { NODE_PUBLIC_ASSET_SCOPE, normalizeDeclaredPublicAssets, stageDeclaredPublicAssets } from "./public-assets.mjs";
+import { getDeployingTarget } from "./target.mjs";
+const createDeployOutputAliasesPlugin = ()=>({
         name: '@modern-js/deploy-output-aliases',
         setup (api) {
             api.onAfterDeploy(async ()=>{
-                const { appDirectory, metaName } = api.getAppContext();
-                const config = api.getNormalizedConfig();
-                if ('modern-js' !== metaName && !config.deploy?.target && !process.env.MODERNJS_DEPLOY || 'node' !== resolveDeployTarget(config)) return;
+                const appContext = api.getAppContext();
+                if ('node' !== getDeployingTarget(appContext)) return;
+                const { appDirectory } = appContext;
                 const entry = createRequire(__filename).resolve('@modern-js/prod-server');
                 const identity = await readPackageIdentity(entry);
                 await preserveNpmAliases({
@@ -25,4 +26,21 @@ const createDeployOutputAliasesPlugin = ({ resolveDeployTarget = external_target
             });
         }
     });
-export { createDeployOutputAliasesPlugin };
+const createDeployOutputPublicAssetsPlugin = ()=>({
+        name: '@modern-js/deploy-output-public-assets',
+        setup (api) {
+            api.onAfterDeploy(async ()=>{
+                const appContext = api.getAppContext();
+                if ('node' !== getDeployingTarget(appContext)) return;
+                const { appDirectory } = appContext;
+                const config = api.getNormalizedConfig();
+                await stageDeclaredPublicAssets({
+                    appDirectory,
+                    outputDirectory: node_path.join(appDirectory, '.output'),
+                    assets: normalizeDeclaredPublicAssets(config.deploy?.node?.publicAssets, NODE_PUBLIC_ASSET_SCOPE),
+                    scope: NODE_PUBLIC_ASSET_SCOPE
+                });
+            });
+        }
+    });
+export { createDeployOutputAliasesPlugin, createDeployOutputPublicAssetsPlugin };

package/dist/esm/deploy-output/public-assets.mjs

@@ -0,0 +1,82 @@
+import promises from "node:fs/promises";
+import node_path from "node:path";
+import { normalizeRelativePath } from "../cloudflare/utils.mjs";
+const DECLARED_PUBLIC_ASSET_DIRECTORY = 'public';
+const CLOUDFLARE_PUBLIC_ASSET_SCOPE = {
+    label: 'deploy.worker.publicAssets',
+    output: 'Cloudflare public output'
+};
+const NODE_PUBLIC_ASSET_SCOPE = {
+    label: 'deploy.node.publicAssets',
+    output: 'Node public output'
+};
+const normalizeDeclaredPublicAssets = (assets, scope)=>(assets ?? []).map((asset, index)=>({
+            from: normalizeRelativePath(asset?.from, `${scope.label}[${index}].from`, 'app root'),
+            to: normalizeRelativePath(asset?.to, `${scope.label}[${index}].to`, scope.output, {
+                allowRoot: true
+            }),
+            index
+        }));
+const isMissingPathError = (error)=>error instanceof Error && 'code' in error && 'ENOENT' === error.code;
+const pathExists = async (filePath)=>{
+    try {
+        await promises.lstat(filePath);
+        return true;
+    } catch (error) {
+        if (isMissingPathError(error)) return false;
+        throw error;
+    }
+};
+const listDeclaredPublicAssetFiles = async (appDirectory, assets, scope)=>{
+    const files = [];
+    const owners = new Map();
+    const add = (index, logicalPath)=>{
+        const owner = owners.get(logicalPath);
+        if (void 0 !== owner) throw new Error(`${scope.label}[${index}] and ${scope.label}[${owner}] both stage ${JSON.stringify(logicalPath)}.`);
+        owners.set(logicalPath, index);
+        files.push({
+            index,
+            logicalPath
+        });
+    };
+    const visit = async (asset, sourcePath, destination)=>{
+        const stat = await promises.lstat(sourcePath);
+        if (stat.isSymbolicLink()) throw new Error(`${scope.label}[${asset.index}].from must not contain symbolic links: ${node_path.relative(appDirectory, sourcePath).replace(/\\/gu, '/')}`);
+        if (stat.isFile()) {
+            if (destination === DECLARED_PUBLIC_ASSET_DIRECTORY) throw new Error(`${scope.label}[${asset.index}].to must name a file when ${scope.label}[${asset.index}].from is a file.`);
+            add(asset.index, destination);
+            return;
+        }
+        if (!stat.isDirectory()) throw new Error(`${scope.label}[${asset.index}].from must contain only files and directories: ${node_path.relative(appDirectory, sourcePath).replace(/\\/gu, '/')}`);
+        const entries = (await promises.readdir(sourcePath)).sort();
+        for (const entry of entries)await visit(asset, node_path.join(sourcePath, entry), node_path.posix.join(destination, entry));
+    };
+    for (const asset of assets){
+        const sourcePath = node_path.join(appDirectory, asset.from);
+        if (!await pathExists(sourcePath)) throw new Error(`${scope.label}[${asset.index}].from does not exist: ${asset.from}`);
+        await visit(asset, sourcePath, node_path.posix.join(DECLARED_PUBLIC_ASSET_DIRECTORY, asset.to));
+    }
+    return files;
+};
+const resolveAddedDeclaredPublicAssetPaths = async ({ appDirectory, assets, generatedRoot, scope })=>{
+    const added = [];
+    for (const file of (await listDeclaredPublicAssetFiles(appDirectory, assets, scope)))if (!await pathExists(node_path.join(generatedRoot, file.logicalPath))) added.push(file.logicalPath);
+    return added.sort();
+};
+const stageDeclaredPublicAssets = async ({ appDirectory, outputDirectory, assets, scope })=>{
+    const files = await listDeclaredPublicAssetFiles(appDirectory, assets, scope);
+    const added = [];
+    for (const file of files){
+        const asset = assets.find((candidate)=>candidate.index === file.index);
+        const relativePath = node_path.posix.relative(node_path.posix.join(DECLARED_PUBLIC_ASSET_DIRECTORY, asset.to), file.logicalPath);
+        const destination = node_path.join(outputDirectory, file.logicalPath);
+        const replacesGeneratedFile = await pathExists(destination);
+        await promises.mkdir(node_path.dirname(destination), {
+            recursive: true
+        });
+        await promises.copyFile(node_path.join(appDirectory, asset.from, relativePath), destination);
+        if (!replacesGeneratedFile) added.push(file.logicalPath);
+    }
+    return added.sort();
+};
+export { CLOUDFLARE_PUBLIC_ASSET_SCOPE, DECLARED_PUBLIC_ASSET_DIRECTORY, NODE_PUBLIC_ASSET_SCOPE, normalizeDeclaredPublicAssets, resolveAddedDeclaredPublicAssetPaths, stageDeclaredPublicAssets };

package/dist/esm/deploy-output/target.mjs

@@ -1,4 +1,13 @@
-import { provider } from "std-env";
+import { getArgv } from "@modern-js/utils";
+import { provider as external_std_env_provider } from "std-env";
+const DEPLOY_TARGETS = [
+    'node',
+    'vercel',
+    'netlify',
+    'ghPages',
+    'cloudflare'
+];
+const DEPLOY_TARGET_FLAG = '--deploy-target';
 const providerDeployTargets = {
     vercel: 'vercel',
     netlify: 'netlify',
@@ -6,5 +15,43 @@ const providerDeployTargets = {
     cloudflare_pages: 'cloudflare',
     cloudflare_workers: 'cloudflare'
 };
-const resolveDeployTarget = (config, envDeployTarget = process.env.MODERNJS_DEPLOY, detectedProvider = provider)=>config.deploy?.target || envDeployTarget || (detectedProvider ? providerDeployTargets[detectedProvider] : void 0) || 'node';
-export { resolveDeployTarget };
+const readDeployTargetFlag = (argv)=>{
+    for (const [index, arg] of argv.entries()){
+        if (arg === DEPLOY_TARGET_FLAG) {
+            const value = argv[index + 1];
+            if (void 0 === value || value.startsWith('-')) throw new Error(`${DEPLOY_TARGET_FLAG} needs a value.`);
+            return value;
+        }
+        if (arg.startsWith(`${DEPLOY_TARGET_FLAG}=`)) return arg.slice(DEPLOY_TARGET_FLAG.length + 1);
+    }
+};
+const assertDeployTarget = (target, source)=>{
+    if (!DEPLOY_TARGETS.includes(target)) throw new Error(`Unknown deploy target '${target}' from ${source}. Use one of: ${DEPLOY_TARGETS.join(', ')}.`);
+    return target;
+};
+const resolveDeployTarget = ({ argv = getArgv(), configTarget, env = process.env.MODERNJS_DEPLOY, provider = external_std_env_provider } = {})=>{
+    const explicit = [
+        [
+            readDeployTargetFlag(argv),
+            DEPLOY_TARGET_FLAG
+        ],
+        [
+            configTarget,
+            'deploy.target'
+        ],
+        [
+            env,
+            'MODERNJS_DEPLOY'
+        ]
+    ].find(([target])=>target);
+    if (explicit?.[0]) return {
+        target: assertDeployTarget(explicit[0], explicit[1]),
+        explicit: true
+    };
+    return {
+        target: provider && providerDeployTargets[provider] || 'node',
+        explicit: false
+    };
+};
+const getDeployingTarget = ({ deployTarget, metaName })=>deployTarget && ('modern-js' === metaName || deployTarget.explicit) ? deployTarget.target : void 0;
+export { DEPLOY_TARGETS, DEPLOY_TARGET_FLAG, getDeployingTarget, resolveDeployTarget };