@bleedingdev/modern-js-app-tools 3.5.0-ultramodern.10 → 3.5.0-ultramodern.101

package/dist/esm-node/plugins/deploy/platforms/cloudflare/wrangler-config.mjs

@@ -0,0 +1,151 @@
+import "node:module";
+import node_path from "node:path";
+import { ASSETS_BINDING, COMPATIBILITY_DATE_PATTERN, DEFAULT_COMPATIBILITY_DATE, PUBLIC_ASSETS_DIRECTORY, REQUIRED_COMPATIBILITY_FLAGS, WORKER_ENTRY } from "./constants.mjs";
+import { isJsonRecord, normalizeRelativePath } from "./utils.mjs";
+const getCompatibilityDate = (modernConfig)=>{
+    const configuredDate = modernConfig.deploy?.worker?.compatibilityDate?.trim();
+    const compatibilityDate = configuredDate || DEFAULT_COMPATIBILITY_DATE;
+    if (!COMPATIBILITY_DATE_PATTERN.test(compatibilityDate)) throw new Error(`deploy.worker.compatibilityDate must use YYYY-MM-DD, received ${JSON.stringify(compatibilityDate)}.`);
+    return compatibilityDate;
+};
+const getWorkerName = (appDirectory)=>{
+    const basename = node_path.basename(appDirectory);
+    return basename.replace(/[^a-zA-Z0-9-_]/g, '-') || 'modern-cloudflare-worker';
+};
+const getConfiguredWorkerName = (appDirectory, modernConfig)=>{
+    const configuredName = modernConfig.deploy?.worker?.name?.trim();
+    return configuredName || getWorkerName(appDirectory);
+};
+const getConfiguredWrangler = (modernConfig)=>{
+    const wrangler = modernConfig.deploy?.worker?.wrangler;
+    if (void 0 === wrangler) return {};
+    if (!isJsonRecord(wrangler)) throw new Error('deploy.worker.wrangler must be a JSON object.');
+    return wrangler;
+};
+const createWranglerCompatibilityFlags = (configuredFlags)=>{
+    if (void 0 === configuredFlags) return [
+        ...REQUIRED_COMPATIBILITY_FLAGS
+    ];
+    if (!Array.isArray(configuredFlags) || configuredFlags.some((flag)=>'string' != typeof flag)) throw new Error('deploy.worker.wrangler.compatibility_flags must be an array of strings.');
+    return [
+        ...new Set([
+            ...configuredFlags,
+            ...REQUIRED_COMPATIBILITY_FLAGS
+        ])
+    ];
+};
+const createWranglerAssetsConfig = (configuredAssets)=>{
+    if (void 0 !== configuredAssets && !isJsonRecord(configuredAssets)) throw new Error('deploy.worker.wrangler.assets must be an object.');
+    return {
+        ...isJsonRecord(configuredAssets) ? configuredAssets : {},
+        directory: `./${PUBLIC_ASSETS_DIRECTORY}`,
+        binding: ASSETS_BINDING,
+        run_worker_first: true
+    };
+};
+const assertNonEmptyString = (value, label)=>{
+    if ('string' != typeof value || 0 === value.trim().length) throw new Error(`${label} must be a non-empty string.`);
+    return value.trim();
+};
+const normalizeD1Database = (database, index)=>{
+    const binding = assertNonEmptyString(database.binding, `deploy.worker.d1Databases[${index}].binding`);
+    const databaseName = assertNonEmptyString(database.databaseName, `deploy.worker.d1Databases[${index}].databaseName`);
+    const databaseId = assertNonEmptyString(database.databaseId, `deploy.worker.d1Databases[${index}].databaseId`);
+    const migrationsDir = void 0 === database.migrationsDir ? void 0 : normalizeRelativePath(database.migrationsDir, `deploy.worker.d1Databases[${index}].migrationsDir`, 'app root');
+    const previewDatabaseId = void 0 === database.previewDatabaseId ? void 0 : assertNonEmptyString(database.previewDatabaseId, `deploy.worker.d1Databases[${index}].previewDatabaseId`);
+    return {
+        binding,
+        database_name: databaseName,
+        database_id: databaseId,
+        ...void 0 === migrationsDir ? {} : {
+            migrations_dir: migrationsDir
+        },
+        ...void 0 === previewDatabaseId ? {} : {
+            preview_database_id: previewDatabaseId
+        },
+        ...void 0 === database.remote ? {} : {
+            remote: database.remote
+        }
+    };
+};
+const createWranglerD1Databases = (modernConfig, configuredWranglerD1)=>{
+    const d1Databases = modernConfig.deploy?.worker?.d1Databases;
+    if (void 0 === d1Databases) return configuredWranglerD1;
+    if (void 0 !== configuredWranglerD1) throw new Error('Use deploy.worker.d1Databases or deploy.worker.wrangler.d1_databases, not both.');
+    if (!Array.isArray(d1Databases)) throw new Error('deploy.worker.d1Databases must be an array.');
+    return d1Databases.map(normalizeD1Database);
+};
+const normalizeServiceBinding = (service, index)=>{
+    const binding = assertNonEmptyString(service.binding, `deploy.worker.services[${index}].binding`);
+    const serviceName = assertNonEmptyString(service.service, `deploy.worker.services[${index}].service`);
+    const prefix = void 0 === service.prefix ? void 0 : assertNonEmptyString(service.prefix, `deploy.worker.services[${index}].prefix`);
+    if (void 0 !== service.fragments && !Array.isArray(service.fragments)) throw new Error(`deploy.worker.services[${index}].fragments must be an array.`);
+    const fragments = void 0 === service.fragments ? void 0 : service.fragments.map((fragment, fragmentIndex)=>({
+            remote: assertNonEmptyString(fragment.remote, `deploy.worker.services[${index}].fragments[${fragmentIndex}].remote`),
+            expose: assertNonEmptyString(fragment.expose, `deploy.worker.services[${index}].fragments[${fragmentIndex}].expose`),
+            boundaryId: assertNonEmptyString(fragment.boundaryId, `deploy.worker.services[${index}].fragments[${fragmentIndex}].boundaryId`),
+            path: assertNonEmptyString(fragment.path, `deploy.worker.services[${index}].fragments[${fragmentIndex}].path`)
+        }));
+    return {
+        binding,
+        service: serviceName,
+        ...void 0 === prefix ? {} : {
+            prefix
+        },
+        ...void 0 === fragments ? {} : {
+            fragments
+        }
+    };
+};
+const createWorkerServiceBindings = (modernConfig, configuredWranglerServices)=>{
+    const services = modernConfig.deploy?.worker?.services;
+    if (void 0 === services) return configuredWranglerServices;
+    if (void 0 !== configuredWranglerServices) throw new Error('Use deploy.worker.services or deploy.worker.wrangler.services, not both.');
+    if (!Array.isArray(services)) throw new Error('deploy.worker.services must be an array.');
+    return services.map(normalizeServiceBinding);
+};
+const createWranglerServices = (serviceBindings)=>{
+    if (!Array.isArray(serviceBindings)) return serviceBindings;
+    if (!serviceBindings.every(isJsonRecord)) return serviceBindings;
+    return serviceBindings.map((service)=>{
+        const { prefix, fragments, ...wranglerService } = service;
+        return wranglerService;
+    });
+};
+const createWorkerManifestServiceBindings = (serviceBindings)=>{
+    if (!Array.isArray(serviceBindings)) return;
+    const manifestBindings = serviceBindings.filter((service)=>isJsonRecord(service) && 'string' == typeof service.binding && 'string' == typeof service.service && ('string' == typeof service.prefix || Array.isArray(service.fragments) && service.fragments.length > 0)).map((service)=>({
+            binding: service.binding,
+            service: service.service,
+            interface: 'fetch',
+            ...void 0 === service.prefix ? {} : {
+                prefix: service.prefix
+            },
+            ...void 0 === service.fragments ? {} : {
+                fragments: service.fragments
+            }
+        }));
+    return manifestBindings.length > 0 ? manifestBindings : void 0;
+};
+const createWranglerConfig = (appDirectory, modernConfig)=>{
+    const wrangler = getConfiguredWrangler(modernConfig);
+    const d1Databases = createWranglerD1Databases(modernConfig, wrangler.d1_databases);
+    const serviceBindings = createWorkerServiceBindings(modernConfig, wrangler.services);
+    const wranglerServices = createWranglerServices(serviceBindings);
+    return {
+        $schema: 'node_modules/wrangler/config-schema.json',
+        name: getConfiguredWorkerName(appDirectory, modernConfig),
+        compatibility_date: getCompatibilityDate(modernConfig),
+        ...wrangler,
+        main: WORKER_ENTRY,
+        compatibility_flags: createWranglerCompatibilityFlags(wrangler.compatibility_flags),
+        assets: createWranglerAssetsConfig(wrangler.assets),
+        ...void 0 === d1Databases ? {} : {
+            d1_databases: d1Databases
+        },
+        ...void 0 === wranglerServices ? {} : {
+            services: wranglerServices
+        }
+    };
+};
+export { createWorkerManifestServiceBindings, createWorkerServiceBindings, createWranglerConfig };

package/dist/esm-node/plugins/deploy/platforms/cloudflare-output-contract.mjs

@@ -0,0 +1,32 @@
+import "node:module";
+const CLOUDFLARE_WORKER_ENTRY = 'server/index.mjs';
+const CLOUDFLARE_WORKER_MANIFEST = 'server/modern-worker-manifest.json';
+const CLOUDFLARE_WRANGLER_CONFIG_FILE = 'wrangler.json';
+const CLOUDFLARE_OUTPUT_PACKAGE_FILE = 'package.json';
+const CLOUDFLARE_WORKER_PACKAGE_FILE = 'worker/package.json';
+const CLOUDFLARE_ASSETS_BINDING = 'ASSETS';
+const CLOUDFLARE_PUBLIC_ASSETS_DIRECTORY = 'public';
+const CLOUDFLARE_WORKER_BUNDLE_DIRECTORY = 'worker';
+const CLOUDFLARE_RUNTIME_TYPE = 'cloudflare-module-worker';
+const CLOUDFLARE_OUTPUT_PACKAGE_TYPE = 'module';
+const CLOUDFLARE_WORKER_PACKAGE_TYPE = 'commonjs';
+const CLOUDFLARE_WORKER_BUNDLE_FORMAT = 'commonjs';
+const CLOUDFLARE_WORKER_NODE_BUILTINS = [
+    'async_hooks',
+    'buffer',
+    'crypto',
+    'events',
+    'fs/promises',
+    'module',
+    'path',
+    'process',
+    'stream',
+    'string_decoder',
+    'url',
+    'util'
+];
+const CLOUDFLARE_REQUIRED_COMPATIBILITY_FLAGS = [
+    'nodejs_compat',
+    'global_fetch_strictly_public'
+];
+export { CLOUDFLARE_ASSETS_BINDING, CLOUDFLARE_OUTPUT_PACKAGE_FILE, CLOUDFLARE_OUTPUT_PACKAGE_TYPE, CLOUDFLARE_PUBLIC_ASSETS_DIRECTORY, CLOUDFLARE_REQUIRED_COMPATIBILITY_FLAGS, CLOUDFLARE_RUNTIME_TYPE, CLOUDFLARE_WORKER_BUNDLE_DIRECTORY, CLOUDFLARE_WORKER_BUNDLE_FORMAT, CLOUDFLARE_WORKER_ENTRY, CLOUDFLARE_WORKER_MANIFEST, CLOUDFLARE_WORKER_NODE_BUILTINS, CLOUDFLARE_WORKER_PACKAGE_FILE, CLOUDFLARE_WORKER_PACKAGE_TYPE, CLOUDFLARE_WRANGLER_CONFIG_FILE };

package/dist/esm-node/plugins/deploy/platforms/cloudflare-output-plan.mjs

@@ -0,0 +1,46 @@
+import "node:module";
+import node_path from "node:path";
+import { CLOUDFLARE_ASSETS_BINDING, CLOUDFLARE_OUTPUT_PACKAGE_FILE, CLOUDFLARE_OUTPUT_PACKAGE_TYPE, CLOUDFLARE_PUBLIC_ASSETS_DIRECTORY, CLOUDFLARE_REQUIRED_COMPATIBILITY_FLAGS, CLOUDFLARE_WORKER_BUNDLE_DIRECTORY, CLOUDFLARE_WORKER_ENTRY, CLOUDFLARE_WORKER_MANIFEST, CLOUDFLARE_WORKER_PACKAGE_FILE, CLOUDFLARE_WORKER_PACKAGE_TYPE, CLOUDFLARE_WRANGLER_CONFIG_FILE } from "./cloudflare-output-contract.mjs";
+const resolveOutput = (outputDirectory, relativePath)=>node_path.join(outputDirectory, relativePath);
+function createCloudflareOutputPlan(outputDirectory) {
+    return {
+        outputDirectory,
+        requiredFiles: [
+            CLOUDFLARE_WORKER_ENTRY,
+            CLOUDFLARE_WORKER_MANIFEST,
+            CLOUDFLARE_WRANGLER_CONFIG_FILE,
+            CLOUDFLARE_OUTPUT_PACKAGE_FILE
+        ],
+        publicLeakDirectories: [
+            'server',
+            CLOUDFLARE_WORKER_BUNDLE_DIRECTORY
+        ],
+        paths: {
+            workerEntry: resolveOutput(outputDirectory, CLOUDFLARE_WORKER_ENTRY),
+            workerManifest: resolveOutput(outputDirectory, CLOUDFLARE_WORKER_MANIFEST),
+            wranglerConfig: resolveOutput(outputDirectory, CLOUDFLARE_WRANGLER_CONFIG_FILE),
+            outputPackage: resolveOutput(outputDirectory, CLOUDFLARE_OUTPUT_PACKAGE_FILE),
+            workerPackage: resolveOutput(outputDirectory, CLOUDFLARE_WORKER_PACKAGE_FILE),
+            publicAssets: resolveOutput(outputDirectory, CLOUDFLARE_PUBLIC_ASSETS_DIRECTORY),
+            workerBundle: resolveOutput(outputDirectory, CLOUDFLARE_WORKER_BUNDLE_DIRECTORY)
+        },
+        packages: {
+            output: {
+                type: CLOUDFLARE_OUTPUT_PACKAGE_TYPE
+            },
+            worker: {
+                type: CLOUDFLARE_WORKER_PACKAGE_TYPE
+            }
+        },
+        wrangler: {
+            main: CLOUDFLARE_WORKER_ENTRY,
+            assets: {
+                binding: CLOUDFLARE_ASSETS_BINDING,
+                directory: `./${CLOUDFLARE_PUBLIC_ASSETS_DIRECTORY}`,
+                run_worker_first: true
+            },
+            requiredCompatibilityFlags: CLOUDFLARE_REQUIRED_COMPATIBILITY_FLAGS
+        }
+    };
+}
+export { createCloudflareOutputPlan };

package/dist/esm-node/plugins/deploy/platforms/cloudflare-output-verifier/identity.mjs

@@ -0,0 +1,46 @@
+import "node:module";
+import { DELIVERY_UNIT_IDENTITY_FIELDS, deliveryUnitIdentityFieldValue } from "@modern-js/utils/universal";
+import { addIssue, assertEqual } from "./issues.mjs";
+const verifyDeliveryUnitIdentity = (issues, manifest, manifestPath, declared)=>{
+    const stamped = manifest?.deliveryUnit;
+    const hasStamp = Boolean(stamped) && 'object' == typeof stamped;
+    if (declared) {
+        if (!hasStamp) return void addIssue(issues, {
+            code: 'missing-delivery-unit',
+            message: `Cloudflare worker manifest is missing the delivery-unit identity declared by the workspace topology (expected unitId ${declared.unitId}, buildMarker ${declared.buildMarker}).`,
+            path: manifestPath
+        });
+        for (const field of DELIVERY_UNIT_IDENTITY_FIELDS){
+            const stampedValue = deliveryUnitIdentityFieldValue(stamped, field);
+            assertEqual(issues, stampedValue, declared[field], {
+                code: 'delivery-unit-drift',
+                message: `Cloudflare worker manifest deliveryUnit.${field} must match the topology delivery-unit record (expected ${declared[field]}, received ${stampedValue ?? 'undefined'}).`,
+                path: manifestPath
+            });
+        }
+    }
+    if (hasStamp && stamped.surfaces && 'object' == typeof stamped.surfaces) for (const surface of [
+        'ui',
+        'api'
+    ]){
+        const marker = stamped.surfaces[surface];
+        if (!marker || 'object' != typeof marker) {
+            addIssue(issues, {
+                code: 'missing-delivery-unit',
+                message: `Cloudflare worker manifest is missing the ${surface} delivery-unit surface marker.`,
+                path: manifestPath
+            });
+            continue;
+        }
+        for (const field of DELIVERY_UNIT_IDENTITY_FIELDS){
+            const markerValue = deliveryUnitIdentityFieldValue(marker, field);
+            const stampedValue = deliveryUnitIdentityFieldValue(stamped, field);
+            assertEqual(issues, markerValue, stampedValue, {
+                code: 'delivery-unit-drift',
+                message: `Cloudflare worker manifest ${surface} surface deliveryUnit.${field} must derive from one delivery-unit record (expected ${stampedValue ?? 'undefined'}, received ${markerValue ?? 'undefined'}).`,
+                path: manifestPath
+            });
+        }
+    }
+};
+export { verifyDeliveryUnitIdentity };

package/dist/esm-node/plugins/deploy/platforms/cloudflare-output-verifier/index.mjs

@@ -0,0 +1,134 @@
+import "node:module";
+import promises from "node:fs/promises";
+import node_path from "node:path";
+import { createCloudflareOutputPlan } from "../cloudflare-output-plan.mjs";
+import { verifyDeliveryUnitIdentity } from "./identity.mjs";
+import { addIssue, assertEqual, assertFlag } from "./issues.mjs";
+import { verifyManifestShape } from "./manifest.mjs";
+import { getEffectBffWorker, getWorkerBundleReferences, missingWorkerBundleMessage, resolveWorkerBundleReference, verifyWorkerBundleReferences, verifyWorkerImport } from "./worker-bundles.mjs";
+const pathExists = async (filePath)=>{
+    try {
+        await promises.access(filePath);
+        return true;
+    } catch  {
+        return false;
+    }
+};
+const readJson = async (filePath)=>JSON.parse(await promises.readFile(filePath, 'utf-8'));
+const verifyCloudflareOutput = async (options)=>{
+    const outputDirectory = node_path.resolve(options.outputDirectory);
+    const issues = [];
+    const outputPlan = createCloudflareOutputPlan(outputDirectory);
+    for (const relativePath of outputPlan.requiredFiles){
+        const filePath = node_path.join(outputDirectory, relativePath);
+        if (!await pathExists(filePath)) addIssue(issues, {
+            code: 'missing-file',
+            message: `Cloudflare output is missing ${relativePath}.`,
+            path: filePath
+        });
+    }
+    const manifestPath = outputPlan.paths.workerManifest;
+    const wranglerPath = outputPlan.paths.wranglerConfig;
+    const packagePath = outputPlan.paths.outputPackage;
+    const workerPackagePath = outputPlan.paths.workerPackage;
+    const manifest = await pathExists(manifestPath) ? await readJson(manifestPath) : void 0;
+    const wrangler = await pathExists(wranglerPath) ? await readJson(wranglerPath) : void 0;
+    const outputPackage = await pathExists(packagePath) ? await readJson(packagePath) : void 0;
+    const workerPackage = await pathExists(workerPackagePath) ? await readJson(workerPackagePath) : void 0;
+    if (manifest) {
+        verifyManifestShape(issues, manifest, manifestPath);
+        verifyDeliveryUnitIdentity(issues, manifest, manifestPath, options.deliveryUnit);
+        const workerReferences = getWorkerBundleReferences(manifest);
+        const providedWorkerPackages = new Set(workerPackage?.dependencies && 'object' == typeof workerPackage.dependencies ? Object.keys(workerPackage.dependencies) : []);
+        if (workerReferences.length > 0 && !await pathExists(workerPackagePath)) addIssue(issues, {
+            code: 'missing-file',
+            message: 'Cloudflare output is missing worker/package.json for referenced worker bundles.',
+            path: workerPackagePath
+        });
+        if (manifest.bff?.runtimeFramework === 'effect' && !getEffectBffWorker(manifest)) addIssue(issues, {
+            code: 'missing-worker-bundle',
+            message: 'Cloudflare Effect BFF manifest points to a missing worker bundle.'
+        });
+        for (const workerReference of workerReferences){
+            const resolvedWorker = resolveWorkerBundleReference(issues, outputDirectory, workerReference, manifestPath);
+            if (!resolvedWorker) continue;
+            const workerExists = await pathExists(resolvedWorker.path);
+            if (!workerExists) addIssue(issues, {
+                code: 'missing-worker-bundle',
+                message: missingWorkerBundleMessage(workerReference),
+                path: resolvedWorker.path
+            });
+            if (workerExists) {
+                const workerSource = await promises.readFile(resolvedWorker.path, 'utf-8');
+                await verifyWorkerBundleReferences(issues, resolvedWorker, workerSource, {
+                    providedPackages: providedWorkerPackages,
+                    workerRoot: outputPlan.paths.workerBundle
+                });
+                if ('effect-bff' === resolvedWorker.kind && (workerSource.includes(';entityKind;') || workerSource.includes(';entityKind,entityKind;'))) addIssue(issues, {
+                    code: 'invalid-worker-bundle',
+                    message: 'Cloudflare Effect BFF worker bundle contains invalid Drizzle entityKind marker references.',
+                    path: resolvedWorker.path
+                });
+            }
+        }
+    }
+    if (wrangler) {
+        assertEqual(issues, wrangler.main, outputPlan.wrangler.main, {
+            code: 'invalid-wrangler',
+            message: `wrangler.json main must be ${outputPlan.wrangler.main}.`,
+            path: wranglerPath
+        });
+        assertEqual(issues, wrangler.assets?.binding, outputPlan.wrangler.assets.binding, {
+            code: 'invalid-wrangler',
+            message: 'wrangler.json assets.binding must be ASSETS.',
+            path: wranglerPath
+        });
+        assertEqual(issues, wrangler.assets?.directory, outputPlan.wrangler.assets.directory, {
+            code: 'invalid-wrangler',
+            message: 'wrangler.json assets.directory must be ./public.',
+            path: wranglerPath
+        });
+        assertEqual(issues, wrangler.assets?.run_worker_first, outputPlan.wrangler.assets.run_worker_first, {
+            code: 'invalid-wrangler',
+            message: 'wrangler.json assets.run_worker_first must be true.',
+            path: wranglerPath
+        });
+        for (const flag of outputPlan.wrangler.requiredCompatibilityFlags)assertFlag(issues, wrangler.compatibility_flags, flag, {
+            code: 'invalid-wrangler',
+            message: `wrangler.json compatibility_flags must include ${flag}.`,
+            path: wranglerPath
+        });
+    }
+    if (outputPackage) assertEqual(issues, outputPackage.type, outputPlan.packages.output.type, {
+        code: 'invalid-package',
+        message: '.output/package.json must declare type module.',
+        path: packagePath
+    });
+    if (workerPackage) assertEqual(issues, workerPackage.type, outputPlan.packages.worker.type, {
+        code: 'invalid-package',
+        message: '.output/worker/package.json must declare type commonjs.',
+        path: workerPackagePath
+    });
+    for (const leakedPath of outputPlan.publicLeakDirectories){
+        const publicPath = node_path.join(outputPlan.paths.publicAssets, leakedPath);
+        if (await pathExists(publicPath)) addIssue(issues, {
+            code: 'public-output-leak',
+            message: `Framework-owned ${leakedPath} output leaked into public assets.`,
+            path: publicPath
+        });
+    }
+    if (false !== options.importWorker && await pathExists(outputPlan.paths.workerEntry)) await verifyWorkerImport(issues, outputPlan.paths.workerEntry);
+    return {
+        ok: 0 === issues.length,
+        issues
+    };
+};
+const assertCloudflareOutput = async (options)=>{
+    const result = await verifyCloudflareOutput(options);
+    if (!result.ok) throw new Error([
+        'Cloudflare output verification failed:',
+        ...result.issues.map((issue)=>`- ${issue.code}: ${issue.message}${issue.path ? ` (${issue.path})` : ''}`)
+    ].join('\n'));
+};
+export { verifyCloudflareOutputMutationPolicy } from "./mutation-policy.mjs";
+export { assertCloudflareOutput, verifyCloudflareOutput };

package/dist/esm-node/plugins/deploy/platforms/cloudflare-output-verifier/issues.mjs

@@ -0,0 +1,11 @@
+import "node:module";
+const addIssue = (issues, issue)=>{
+    issues.push(issue);
+};
+const assertEqual = (issues, actual, expected, issue)=>{
+    if (actual !== expected) addIssue(issues, issue);
+};
+const assertFlag = (issues, flags, flag, issue)=>{
+    if (!Array.isArray(flags) || !flags.includes(flag)) addIssue(issues, issue);
+};
+export { addIssue, assertEqual, assertFlag };

package/dist/esm-node/plugins/deploy/platforms/cloudflare-output-verifier/manifest.mjs

@@ -0,0 +1,52 @@
+import "node:module";
+import { BFF_EFFECT_WORKER_DISPATCHER_EXPORT } from "../cloudflare/constants.mjs";
+import { CLOUDFLARE_ASSETS_BINDING, CLOUDFLARE_PUBLIC_ASSETS_DIRECTORY, CLOUDFLARE_RUNTIME_TYPE, CLOUDFLARE_WORKER_ENTRY } from "../cloudflare-output-contract.mjs";
+import { addIssue, assertEqual } from "./issues.mjs";
+const verifyManifestShape = (issues, manifest, manifestPath)=>{
+    assertEqual(issues, manifest.runtime?.type, CLOUDFLARE_RUNTIME_TYPE, {
+        code: 'invalid-manifest',
+        message: 'Cloudflare output manifest runtime.type must be cloudflare-module-worker.',
+        path: manifestPath
+    });
+    assertEqual(issues, manifest.runtime?.entry, CLOUDFLARE_WORKER_ENTRY, {
+        code: 'invalid-manifest',
+        message: `Cloudflare output manifest runtime.entry must be ${CLOUDFLARE_WORKER_ENTRY}.`,
+        path: manifestPath
+    });
+    assertEqual(issues, manifest.runtime?.fetchExport, true, {
+        code: 'invalid-manifest',
+        message: 'Cloudflare output manifest runtime.fetchExport must be true.',
+        path: manifestPath
+    });
+    assertEqual(issues, manifest.runtime?.nodeListen, false, {
+        code: 'invalid-manifest',
+        message: 'Cloudflare output manifest runtime.nodeListen must be false.',
+        path: manifestPath
+    });
+    assertEqual(issues, manifest.assets?.binding, CLOUDFLARE_ASSETS_BINDING, {
+        code: 'invalid-manifest',
+        message: 'Cloudflare output manifest assets.binding must be ASSETS.',
+        path: manifestPath
+    });
+    assertEqual(issues, manifest.assets?.directory, `./${CLOUDFLARE_PUBLIC_ASSETS_DIRECTORY}`, {
+        code: 'invalid-manifest',
+        message: 'Cloudflare output manifest assets.directory must be ./public.',
+        path: manifestPath
+    });
+    assertEqual(issues, manifest.assets?.runWorkerFirst, true, {
+        code: 'invalid-manifest',
+        message: 'Cloudflare output manifest assets.runWorkerFirst must be true.',
+        path: manifestPath
+    });
+    if (!Array.isArray(manifest.routeSpec?.routes)) addIssue(issues, {
+        code: 'invalid-manifest',
+        message: 'Cloudflare output manifest routeSpec.routes must be array.',
+        path: manifestPath
+    });
+    if (manifest.bff?.runtimeFramework === 'effect') assertEqual(issues, manifest.bff.dispatcherExport, BFF_EFFECT_WORKER_DISPATCHER_EXPORT, {
+        code: 'invalid-manifest',
+        message: `Cloudflare Effect BFF manifest dispatcherExport must be ${BFF_EFFECT_WORKER_DISPATCHER_EXPORT}.`,
+        path: manifestPath
+    });
+};
+export { verifyManifestShape };

package/dist/esm-node/plugins/deploy/platforms/cloudflare-output-verifier/mutation-policy.mjs

@@ -0,0 +1,100 @@
+import "node:module";
+import promises from "node:fs/promises";
+import node_path from "node:path";
+import { addIssue } from "./issues.mjs";
+const SOURCE_SCAN_FILE_PATTERN = /\.(?:[cm]?[jt]s|json)$/u;
+const SOURCE_SCAN_IGNORED_DIRECTORY_NAMES = new Set([
+    '.codex',
+    '.fastcontext',
+    '.git',
+    '.mf',
+    '.modernjs',
+    '.output',
+    'coverage',
+    'dist',
+    'dist-cloudflare',
+    'node_modules',
+    'repos',
+    'topology'
+]);
+const FORBIDDEN_MUTATION_PATTERNS = [
+    {
+        code: 'forbidden-mutation-pattern',
+        message: "Generated Cloudflare server worker output must not be rewritten by app scripts.",
+        pattern: /\.output\/server\/index\.mjs/u
+    },
+    {
+        code: 'forbidden-mutation-pattern',
+        message: "Generated Cloudflare server worker output must not be rewritten by app scripts.",
+        pattern: /path\.(?:join|resolve)\(\s*['"`]\.output['"`]\s*,\s*['"`]server['"`]\s*,\s*['"`]index\.mjs['"`]\s*\)/u
+    },
+    {
+        code: 'forbidden-mutation-pattern',
+        message: "Generated Cloudflare BFF worker bundles must not be rewritten by app scripts.",
+        pattern: /\.output\/worker\/[^'"`]*\.(?:mjs|cjs|js)/u
+    },
+    {
+        code: 'forbidden-mutation-pattern',
+        message: "Generated Cloudflare BFF worker bundles must not be rewritten by app scripts.",
+        pattern: /path\.(?:join|resolve)\(\s*['"`]\.output['"`]\s*,\s*['"`]worker['"`]\s*,\s*['"`][^'"`]+\.(?:mjs|cjs|js)['"`]\s*\)/u
+    },
+    {
+        code: 'forbidden-mutation-pattern',
+        message: "Drizzle entityKind worker bundle markers must be fixed in the framework toolchain, not post-build scripts.",
+        pattern: /replaceAll\(\s*['"`];entityKind(?:,entityKind)?;/u
+    },
+    {
+        code: 'forbidden-mutation-pattern',
+        message: "Effect BFF Cloudflare dispatch must not depend on duck-typed runtime helper probing in app scripts.",
+        pattern: /(?:typeof\s+[^;\n]*dispatchEffectBffRequest|['"`]dispatchEffectBffRequest['"`]\s+in\s+|\.dispatchEffectBffRequest\b)/u
+    },
+    {
+        code: 'forbidden-mutation-pattern',
+        message: "Effect BFF Cloudflare dispatch must not branch on handler.length in app scripts.",
+        pattern: /\bhandler\s*\.\s*length\b/u
+    }
+];
+const pathExists = async (filePath)=>{
+    try {
+        await promises.access(filePath);
+        return true;
+    } catch  {
+        return false;
+    }
+};
+const walkFiles = async (root)=>{
+    if (!await pathExists(root)) return [];
+    const entries = await promises.readdir(root, {
+        withFileTypes: true
+    });
+    const files = [];
+    for (const entry of entries){
+        if (SOURCE_SCAN_IGNORED_DIRECTORY_NAMES.has(entry.name)) continue;
+        const entryPath = node_path.join(root, entry.name);
+        if (entry.isDirectory()) {
+            files.push(...await walkFiles(entryPath));
+            continue;
+        }
+        if (SOURCE_SCAN_FILE_PATTERN.test(entry.name)) files.push(entryPath);
+    }
+    return files;
+};
+const verifyCloudflareOutputMutationPolicy = async (options)=>{
+    const issues = [];
+    const excludedFiles = new Set((options.excludePaths ?? []).map((entry)=>node_path.resolve(entry)));
+    const files = (await Promise.all(options.scanRoots.map((scanRoot)=>walkFiles(node_path.resolve(scanRoot))))).flat();
+    for (const file of files){
+        if (excludedFiles.has(file)) continue;
+        const source = await promises.readFile(file, 'utf-8');
+        for (const forbidden of FORBIDDEN_MUTATION_PATTERNS)if (forbidden.pattern.test(source)) addIssue(issues, {
+            code: forbidden.code,
+            message: forbidden.message,
+            path: file
+        });
+    }
+    return {
+        ok: 0 === issues.length,
+        issues
+    };
+};
+export { verifyCloudflareOutputMutationPolicy, walkFiles };