@bleedingdev/modern-js-app-tools-extensions 3.9.3-ultramodern.1 → 3.9.3-ultramodern.11

package/src/cloudflare-output-verifier/mutation-policy.ts

@@ -19,7 +19,8 @@ export interface VerifyCloudflareOutputMutationPolicyOptions {
   excludePaths?: string[];
 }
 
-const SOURCE_SCAN_FILE_PATTERN = /\.(?:[cm]?[jt]s|json)$/u;
+const SOURCE_SCAN_FILE_PATTERN = /\.(?:[cm]?[jt]sx?)$/u;
+const DECLARATION_FILE_PATTERN = /\.d\.[cm]?ts$/u;
 const SOURCE_SCAN_IGNORED_DIRECTORY_NAMES = new Set([
   '.codex',
   '.fastcontext',
@@ -115,7 +116,11 @@ export const walkFiles = async (root: string): Promise<string[]> => {
       continue;
     }
 
-    if (SOURCE_SCAN_FILE_PATTERN.test(entry.name)) {
+    if (
+      entry.name === 'package.json' ||
+      (SOURCE_SCAN_FILE_PATTERN.test(entry.name) &&
+        !DECLARATION_FILE_PATTERN.test(entry.name))
+    ) {
       files.push(entryPath);
     }
   }
@@ -151,8 +156,38 @@ export const verifyCloudflareOutputMutationPolicy = async (
       }
       throw error;
     }
+    let executableSources = [source];
+    if (path.basename(file) === 'package.json') {
+      try {
+        const manifest: unknown = JSON.parse(source);
+        if (!isRecord(manifest)) {
+          throw new TypeError('Package metadata must be an object.');
+        }
+        const scripts = Object.hasOwn(manifest, 'scripts')
+          ? manifest.scripts
+          : {};
+        if (!isRecord(scripts)) {
+          throw new TypeError('Package scripts must be an object.');
+        }
+        const commands = Object.values(scripts);
+        if (
+          !commands.every((value): value is string => typeof value === 'string')
+        ) {
+          throw new TypeError('Package scripts must contain only strings.');
+        }
+        executableSources = commands;
+      } catch {
+        addIssue(issues, {
+          code: 'invalid-package',
+          message:
+            'Cannot verify executable package lifecycle scripts: invalid package metadata.',
+          path: file,
+        });
+        continue;
+      }
+    }
     for (const forbidden of FORBIDDEN_MUTATION_PATTERNS) {
-      if (forbidden.pattern.test(source)) {
+      if (executableSources.some(value => forbidden.pattern.test(value))) {
         addIssue(issues, {
           code: forbidden.code,
           message: forbidden.message,
@@ -167,3 +202,6 @@ export const verifyCloudflareOutputMutationPolicy = async (
     issues,
   };
 };
+
+const isRecord = (value: unknown): value is Record<string, unknown> =>
+  value !== null && typeof value === 'object' && !Array.isArray(value);

package/src/config.ts

@@ -247,6 +247,10 @@ export interface CloudflareWorkerDeployConfig {
    * `env[binding].fetch(request)`.
    */
   services?: CloudflareWorkerServiceBindingConfig[];
+  /** Native Worker context profiles, registered before federated exposes load. */
+  federation?: {
+    contextProfiles?: readonly string[];
+  };
   /**
    * First-class Workers VPC service bindings to private origins reached
    * through a Cloudflare Tunnel. Modern.js writes these to `wrangler.json`

package/src/native-type-checker.ts

@@ -1,18 +1,19 @@
-import { execFile } from 'node:child_process';
+import { execFile, execFileSync } from 'node:child_process';
 import { randomUUID } from 'node:crypto';
 import {
   existsSync,
   readFileSync,
   realpathSync,
-  statSync,
   unlinkSync,
   writeFileSync,
 } from 'node:fs';
+import { createRequire } from 'node:module';
 import path from 'node:path';
 import { promisify } from 'node:util';
 import { refreshTsgoCheckerConfig } from '@modern-js/builder';
 import type { Rspack, RspackChain } from '@rsbuild/core';
 import { type ParseError, parse, printParseErrorCode } from 'jsonc-parser';
+import { resolveEffectTsgoCompiler } from './build-config/build-environment';
 
 const execute = promisify(execFile);
 const name = 'UltramodernNativeTypeChecker';
@@ -20,44 +21,63 @@ const name = 'UltramodernNativeTypeChecker';
 export interface NativeTypeCheckerCommand {
   executable: string;
   args: readonly string[];
+  /** The selected package's native config API. tsrs has no --showConfig CLI. */
+  configApi?: string;
 }
 
-/** Launch the selected stable package through its declared public compiler bin. */
+/** Resolve the Effect-enabled native compiler from the application's origin. */
 export function resolveNativeTypeCheckerCommand(
-  packageJsonPath: string,
+  from: string,
 ): NativeTypeCheckerCommand {
-  const manifestFile = realpathSync(packageJsonPath);
-  const directory = path.dirname(manifestFile);
-  const manifest = JSON.parse(readFileSync(manifestFile, 'utf8')) as {
-    name?: unknown;
-    version?: unknown;
-    bin?: { tsc?: unknown };
-  };
-  if (manifest.name !== 'typescript' || manifest.version !== '7.0.2') {
-    throw new Error(
-      `${name} requires typescript@7.0.2; found ${String(manifest.name)}@${String(manifest.version)} at ${manifestFile}.`,
-    );
-  }
-  const bin = manifest.bin?.tsc;
-  if (typeof bin !== 'string' || !bin || path.isAbsolute(bin)) {
-    throw new Error(`${name} requires the selected package's public tsc bin.`);
-  }
-  const launcher = realpathSync(path.resolve(directory, bin));
-  const relative = path.relative(directory, launcher);
-  if (
-    !relative ||
-    path.isAbsolute(relative) ||
-    relative === '..' ||
-    relative.startsWith(`..${path.sep}`) ||
-    !statSync(launcher).isFile()
-  ) {
-    throw new Error(
-      `${name} public tsc bin must belong to its selected package.`,
-    );
+  const executable = resolveEffectTsgoCompiler({ from });
+  const version = execFileSync(executable, ['--version'], {
+    encoding: 'utf8',
+    env: {
+      ...process.env,
+      TSRS_CHECKER_ASSIGNMENT: process.env.TSRS_CHECKER_ASSIGNMENT || 'go',
+    },
+    timeout: 10_000,
+  });
+  if (version.includes('(tsrs ')) {
+    return {
+      executable,
+      args: [],
+      configApi: createRequire(from).resolve('tsrs/sync'),
+    };
   }
-  return { executable: process.execPath, args: [launcher] };
+  // TypeScript-Go supports --showConfig, including project references. Its
+  // older native config API lacks tsrs's diagnostics and reference fields.
+  return {
+    executable,
+    args: [],
+  };
 }
 
+// Use the real native parser, not a handwritten tsconfig/extends interpreter.
+// Running the client in a child also applies assignment to its native API
+// process without changing the build/dev server's environment.
+const inspectNativeConfig = `
+  import { pathToFileURL } from 'node:url';
+  const [modulePath, compiler, configFile] = process.argv.slice(1);
+  const { API, formatDiagnostics } = await import(pathToFileURL(modulePath).href);
+  const api = new API({ tsserverPath: compiler });
+  try {
+    const config = api.parseConfigFile(configFile);
+    if (config.errors.length) {
+      process.stdout.write(formatDiagnostics(config.errors, api));
+      process.exitCode = 1;
+    } else {
+      process.stdout.write(JSON.stringify({
+        compilerOptions: config.options,
+        files: config.fileNames,
+        references: config.projectReferences,
+      }));
+    }
+  } finally {
+    api.close();
+  }
+`;
+
 interface TypeCheckerConfig {
   compilerOptions?: Record<string, unknown>;
   references?: Array<{ path: string }>;
@@ -230,25 +250,51 @@ export class UltramodernNativeTypeChecker {
   private async run(args: string[]): Promise<string> {
     try {
       const selected = this.options.compiler();
-      const command =
+      const command: NativeTypeCheckerCommand =
         typeof selected === 'string'
           ? { executable: selected, args: [] }
           : selected;
+      const inspect = args[0] === '--showConfig' && command.configApi;
       const result = await execute(
-        command.executable,
-        [...command.args, ...args],
+        inspect ? process.execPath : command.executable,
+        inspect
+          ? [
+              '--input-type=module',
+              '--eval',
+              inspectNativeConfig,
+              command.configApi!,
+              command.executable,
+              args[args.indexOf('--project') + 1],
+            ]
+          : [...command.args, ...args],
         {
           cwd: path.dirname(this.options.configFile),
+          // Apply to every command, including explicit paths and TSRS_BINARY.
+          // Keep caller selection; do not change the dev server's environment.
+          env: {
+            ...process.env,
+            TSRS_CHECKER_ASSIGNMENT:
+              process.env.TSRS_CHECKER_ASSIGNMENT || 'go',
+          },
           maxBuffer: 16 * 1024 * 1024,
+          ...(inspect ? { timeout: 10_000 } : {}),
         },
       );
       return result.stdout;
     } catch (cause) {
-      const output = cause as { stdout?: string; stderr?: string };
+      const output = cause as {
+        stdout?: string;
+        stderr?: string;
+        code?: number | string;
+        signal?: NodeJS.Signals;
+      };
       const diagnostics = `${output.stdout ?? ''}${output.stderr ?? ''}`;
-      throw new Error(
-        `${name} failed:\n${diagnostics || (cause instanceof Error ? cause.message : String(cause))}${missingJsxRuntimeHint(diagnostics)}`,
-        { cause },
+      throw Object.assign(
+        new Error(
+          `${name} failed:\n${diagnostics || (cause instanceof Error ? cause.message : String(cause))}${missingJsxRuntimeHint(diagnostics)}`,
+          { cause },
+        ),
+        { code: output.code, signal: output.signal },
       );
     }
   }
@@ -333,9 +379,7 @@ export class UltramodernNativeTypeChecker {
           }
         } catch (cause) {
           compilation.errors.push(
-            new Error(cause instanceof Error ? cause.message : String(cause), {
-              cause,
-            }),
+            cause instanceof Error ? cause : new Error(String(cause)),
           );
         }
       });

package/src/release-identity.ts

@@ -51,8 +51,7 @@ export const createUltramodernReleaseBuildMarker = ({
     .update(
       `${BUILD_MARKER_NAMESPACE}:${unitId}:${generationBuildMarker}:${sourceRevision}`,
     )
-    .digest('hex')
-    .slice(0, 16);
+    .digest('hex');
 
 export const resolveUltramodernSourceRevision = (
   workspaceRoot = process.cwd(),
@@ -119,6 +118,16 @@ export const resolveUltramodernSourceRevision = (
   return revision;
 };
 
+/**
+ * The one release identity of a delivery unit, resolvable before its build.
+ *
+ * For a clean source revision the build marker is a 64-hex digest of the unit
+ * id, its generation marker and the revision. API bundles carry it, and a UI
+ * unit's renderer adopts it as its `buildId`, so contracts, release plans and
+ * Worker names derived from it before the build match the built
+ * `ultramodern-build.json`, `renderer-build.json`, chunk banners and envelope.
+ * A dirty or non-Git checkout yields the non-promotable `workspace` identity.
+ */
 export const resolveUltramodernReleaseIdentity = ({
   generationBuildMarker,
   sourceRevision: configuredSourceRevision,

package/src/renderer-build-identity.ts

@@ -25,7 +25,18 @@ export interface RendererBuildIdentityOptions {
   mode: 'development' | 'production';
   /** Delivery-unit app id; defaults to the application package name. */
   appId?: string;
-  /** Externally authenticated source revision (delivery unit or CI). */
+  /**
+   * The declared delivery unit's release identity, resolved before the build
+   * by `resolveUltramodernReleaseIdentity`. A promotable production build
+   * adopts its buildMarker as the buildId, so consumers that resolve the unit
+   * identity before compiling see the marker the built artifacts carry.
+   */
+  deliveryUnit?: {
+    readonly unitId: string;
+    readonly buildMarker: string;
+    readonly sourceRevision: string;
+  };
+  /** Externally authenticated source revision (CI) for an undeclared app. */
   sourceRevision?: string;
   /** Actual final entry ownership, supplied by the selected renderer composition. */
   routerBindings: RendererRouterBindings;
@@ -49,6 +60,8 @@ const LOCKFILES = [
   'bun.lockb',
 ];
 
+const RELEASE_BUILD_MARKER_PATTERN = /^[a-f0-9]{64}$/u;
+
 /** Stable per process: one dev session or dirty build keeps one buildId. */
 const processNonce = randomUUID();
 
@@ -132,20 +145,47 @@ export function resolveRendererBuildIdentities(
     throw new Error(
       'Renderer application identity requires a delivery artifact appId or a package name.',
     );
+  const { deliveryUnit } = options;
+  if (
+    deliveryUnit !== undefined &&
+    (typeof deliveryUnit.unitId !== 'string' ||
+      !deliveryUnit.unitId ||
+      deliveryUnit.unitId.trim() !== deliveryUnit.unitId)
+  )
+    throw new Error(
+      'Renderer delivery-unit identity requires a nonempty trimmed unitId.',
+    );
   const profileKey = rendererProfileKey(options.profile);
   const sourceRevision = resolveUltramodernSourceRevision(
     projectRoot,
-    options.sourceRevision,
-  );
-  const buildId = sha256(
-    JSON.stringify([
-      profileKey,
-      lockfileHash(projectRoot),
-      options.mode === 'development' || sourceRevision === 'workspace'
-        ? processNonce
-        : sourceRevision,
-    ]),
+    deliveryUnit ? deliveryUnit.sourceRevision : options.sourceRevision,
   );
+  const promotable =
+    options.mode === 'production' && sourceRevision !== 'workspace';
+  let buildId: string;
+  if (promotable && deliveryUnit) {
+    // One identity per delivery unit, known before compilation.
+    if (
+      deliveryUnit.sourceRevision !== sourceRevision ||
+      !RELEASE_BUILD_MARKER_PATTERN.test(deliveryUnit.buildMarker)
+    )
+      throw new Error(
+        `Renderer delivery unit ${deliveryUnit.unitId} must carry the release identity of source revision ${sourceRevision}.`,
+      );
+    buildId = deliveryUnit.buildMarker;
+  } else {
+    // Undeclared apps and non-promotable builds (development, dirty trees)
+    // keep a per-app id; non-promotable ids are unique per process.
+    buildId = sha256(
+      JSON.stringify([
+        appId,
+        deliveryUnit?.unitId ?? null,
+        profileKey,
+        lockfileHash(projectRoot),
+        promotable ? sourceRevision : processNonce,
+      ]),
+    );
+  }
   const identities = Object.fromEntries(
     entries.map(entryName => [
       entryName,

package/src/templates/cloudflare-entry.005-worker-dispatch.mjs

@@ -306,7 +306,24 @@ async function invokeNativeRouteWorker(route, identity, request, env, ctx) {
   const resources =
     nativeRenderer?.renderer === identity.renderer &&
     Object.hasOwn(nativeRenderer.entries, route.entryName)
-      ? nativeRenderer.entries[route.entryName]
+      ? {
+          ...nativeRenderer.entries[route.entryName],
+          ...(Object.hasOwn(nativeRenderer, 'workerFederation')
+            ? { workerFederation: nativeRenderer.workerFederation }
+            : {}),
+          ...(Object.hasOwn(nativeRenderer, 'workerFederationManifestUrl')
+            ? {
+                workerFederationManifestUrl:
+                  nativeRenderer.workerFederationManifestUrl,
+              }
+            : {}),
+          ...(Object.hasOwn(nativeRenderer, 'workerFederationServices')
+            ? {
+                workerFederationServices:
+                  nativeRenderer.workerFederationServices,
+              }
+            : {}),
+        }
       : undefined;
   // Native renderers have no Flight transport. Reject before the bundle loads.
   if (