@bleedingdev/modern-js-app-tools 3.5.0-ultramodern.101 → 3.5.0-ultramodern.103

package/dist/cjs/builder/generator/getBuilderEnvironments.js

@@ -37,7 +37,10 @@ var __webpack_require__ = {};
 var __webpack_exports__ = {};
 __webpack_require__.r(__webpack_exports__);
 __webpack_require__.d(__webpack_exports__, {
-    getBuilderEnvironments: ()=>getBuilderEnvironments
+    applyCloudflareWorkerMfRuntimeBoundary: ()=>applyCloudflareWorkerMfRuntimeBoundary,
+    applyCloudflareWorkerRspackConfig: ()=>applyCloudflareWorkerRspackConfig,
+    getBuilderEnvironments: ()=>getBuilderEnvironments,
+    getCloudflareWorkerRspackConfig: ()=>getCloudflareWorkerRspackConfig
 });
 const external_node_fs_namespaceObject = require("node:fs");
 var external_node_fs_default = /*#__PURE__*/ __webpack_require__.n(external_node_fs_namespaceObject);
@@ -48,6 +51,8 @@ const utils_namespaceObject = require("@modern-js/utils");
 const cloudflare_output_contract_js_namespaceObject = require("../../plugins/deploy/platforms/cloudflare-output-contract.js");
 const BFF_EFFECT_WORKER_ENTRY_NAME = '__modern_bff_effect';
 const BFF_EFFECT_WORKER_RUNTIME_QUERY = 'modern-bff-runtime';
+const MF_SSR_DATA_FETCH_RUNTIME_PLUGIN = '@module-federation/modern-js-v3/ssr-inject-data-fetch-function-plugin';
+const MF_SSR_DEV_RUNTIME_PLUGIN = '@module-federation/modern-js-v3/ssr-dev-plugin';
 const JS_OR_TS_EXTS = [
     '.js',
     '.jsx',
@@ -128,6 +133,64 @@ function getCloudflareWorkerNodeExternals() {
         ];
     }));
 }
+const reserveWorkerChunkName = (baseName, reservedOutputNames)=>{
+    let name = baseName;
+    while(reservedOutputNames.has(normalizeWorkerOutputName(name)))name = `${name}_`;
+    return name;
+};
+const normalizeWorkerOutputName = (name)=>external_node_path_default().posix.normalize(name.replace(/\\/gu, '/')).toLowerCase();
+function getCloudflareWorkerRspackConfig(workerEntryNames) {
+    const entryNames = [
+        ...workerEntryNames
+    ];
+    for (const entryName of entryNames){
+        const slashName = entryName.replace(/\\/gu, '/');
+        const normalizedName = external_node_path_default().posix.normalize(slashName);
+        if (entryName !== slashName || normalizedName !== slashName || '.' === normalizedName || normalizedName.startsWith('../') || external_node_path_default().posix.isAbsolute(normalizedName) || external_node_path_default().win32.isAbsolute(slashName) || /^[A-Za-z]:/u.test(slashName)) throw new Error(`Cloudflare worker entry name "${entryName}" must be a canonical relative output path without dot segments or backslashes.`);
+    }
+    const reservedNames = new Set(entryNames.map(normalizeWorkerOutputName));
+    const runtimeName = reserveWorkerChunkName('__modern_worker_runtime', reservedNames);
+    reservedNames.add(normalizeWorkerOutputName(runtimeName));
+    const sharedName = reserveWorkerChunkName('__modern_worker_shared', reservedNames);
+    return {
+        experiments: {
+            outputModule: true
+        },
+        externals: getCloudflareWorkerNodeExternals(),
+        externalsType: 'module-import',
+        module: {
+            parser: {
+                javascript: {
+                    dynamicImportMode: 'eager'
+                }
+            }
+        },
+        optimization: {
+            runtimeChunk: {
+                name: runtimeName
+            },
+            splitChunks: {
+                chunks: 'all',
+                minSize: 0,
+                name: sharedName
+            }
+        }
+    };
+}
+function applyCloudflareWorkerRspackConfig(chain, workerEntryNames) {
+    const config = getCloudflareWorkerRspackConfig(workerEntryNames);
+    chain.experiments(config.experiments);
+    chain.externals(config.externals);
+    chain.externalsType(config.externalsType);
+    chain.module.parser.merge(config.module.parser);
+    chain.optimization.runtimeChunk(config.optimization.runtimeChunk);
+    chain.optimization.splitChunks(config.optimization.splitChunks);
+}
+function applyCloudflareWorkerMfRuntimeBoundary(chain) {
+    chain.plugins.delete('plugin-module-federation');
+    chain.resolve.alias.set(`${MF_SSR_DATA_FETCH_RUNTIME_PLUGIN}$`, getCloudflareWorkerCompatFile('cloudflare-worker-mf-ssr-runtime-plugin.mjs'));
+    chain.resolve.alias.set(`${MF_SSR_DEV_RUNTIME_PLUGIN}$`, getCloudflareWorkerCompatFile('cloudflare-worker-mf-ssr-runtime-plugin.mjs'));
+}
 function getEffectBffEntry(normalizedConfig, appContext) {
     if (!normalizedConfig.bff || 'hono' === normalizedConfig.bff.runtimeFramework) return;
     const configuredEntry = normalizedConfig.bff.effect?.entry;
@@ -286,17 +349,10 @@ function getBuilderEnvironments(normalizedConfig, appContext, tempBuilderConfig)
                 htmlPlugin: false,
                 ...useCloudflareModuleWorker ? {
                     bundlerChain: (chain)=>{
-                        chain.merge({
-                            experiments: {
-                                outputModule: true
-                            },
-                            externals: getCloudflareWorkerNodeExternals(),
-                            externalsType: 'module-import'
-                        });
+                        applyCloudflareWorkerRspackConfig(chain, Object.keys(workerEntries));
                         chain.output.module(true).library({
                             type: 'module'
                         }).publicPath('/').chunkFormat('module').chunkLoading('import').workerChunkLoading('import');
-                        chain.optimization.usedExports(false).providedExports(true).innerGraph(false).sideEffects(false);
                         for (const condition of [
                             'workerd',
                             'worker',
@@ -306,7 +362,7 @@ function getBuilderEnvironments(normalizedConfig, appContext, tempBuilderConfig)
                             'require',
                             'module'
                         ])chain.resolve.conditionNames.add(condition);
-                        chain.plugins.delete('plugin-module-federation');
+                        applyCloudflareWorkerMfRuntimeBoundary(chain);
                         if (tanstackRouterSsrServerFile) {
                             chain.resolve.alias.set('@tanstack/router-core/ssr/server$', tanstackRouterSsrServerFile);
                             chain.resolve.alias.set('@tanstack/router-core/ssr/server', tanstackRouterSsrServerFile);
@@ -347,9 +403,15 @@ function getBuilderEnvironments(normalizedConfig, appContext, tempBuilderConfig)
         builderConfig: tempBuilderConfig
     };
 }
+exports.applyCloudflareWorkerMfRuntimeBoundary = __webpack_exports__.applyCloudflareWorkerMfRuntimeBoundary;
+exports.applyCloudflareWorkerRspackConfig = __webpack_exports__.applyCloudflareWorkerRspackConfig;
 exports.getBuilderEnvironments = __webpack_exports__.getBuilderEnvironments;
+exports.getCloudflareWorkerRspackConfig = __webpack_exports__.getCloudflareWorkerRspackConfig;
 for(var __rspack_i in __webpack_exports__)if (-1 === [
-    "getBuilderEnvironments"
+    "applyCloudflareWorkerMfRuntimeBoundary",
+    "applyCloudflareWorkerRspackConfig",
+    "getBuilderEnvironments",
+    "getCloudflareWorkerRspackConfig"
 ].indexOf(__rspack_i)) exports[__rspack_i] = __webpack_exports__[__rspack_i];
 Object.defineProperty(exports, '__esModule', {
     value: true

package/dist/cjs/plugins/deploy/platforms/cloudflare-output-verifier/index.js

@@ -162,7 +162,7 @@ const verifyCloudflareOutput = async (options)=>{
             path: publicPath
         });
     }
-    if (false !== options.importWorker && await pathExists(outputPlan.paths.workerEntry)) await (0, external_worker_bundles_js_namespaceObject.verifyWorkerImport)(issues, outputPlan.paths.workerEntry);
+    if (false !== options.importWorker && await pathExists(outputPlan.paths.workerEntry)) await (0, external_worker_bundles_js_namespaceObject.verifyWorkerImport)(issues, outputPlan.paths.workerEntry, manifest);
     return {
         ok: 0 === issues.length,
         issues

package/dist/cjs/plugins/deploy/platforms/cloudflare-output-verifier/worker-bundles.js

@@ -49,7 +49,10 @@ var promises_default = /*#__PURE__*/ __webpack_require__.n(promises_namespaceObj
 const external_node_path_namespaceObject = require("node:path");
 var external_node_path_default = /*#__PURE__*/ __webpack_require__.n(external_node_path_namespaceObject);
 const external_node_url_namespaceObject = require("node:url");
+const external_node_util_namespaceObject = require("node:util");
 const parser_namespaceObject = require("@babel/parser");
+const traverse_namespaceObject = require("@babel/traverse");
+var traverse_default = /*#__PURE__*/ __webpack_require__.n(traverse_namespaceObject);
 const external_cloudflare_output_contract_js_namespaceObject = require("../cloudflare-output-contract.js");
 const external_issues_js_namespaceObject = require("./issues.js");
 const getReferencedRouteWorkers = (manifest)=>Array.isArray(manifest?.routeSpec?.routes) ? manifest.routeSpec.routes.map((route)=>'string' == typeof route?.worker && route.worker.length > 0 ? route.worker : void 0).filter((worker)=>'string' == typeof worker) : [];
@@ -93,6 +96,7 @@ const getNodeName = (node)=>{
     if (!isAstNode(node)) return;
     return 'Identifier' === node.type && 'string' == typeof node.name ? node.name : 'StringLiteral' === node.type && 'string' == typeof node.value ? node.value : void 0;
 };
+const getStringLiteralValue = (node)=>isAstNode(node) && 'StringLiteral' === node.type && 'string' == typeof node.value ? node.value : void 0;
 const collectBindingNames = (node, names)=>{
     if (!isAstNode(node)) return;
     const name = getNodeName(node);
@@ -102,7 +106,11 @@ const collectBindingNames = (node, names)=>{
     } else if ('ArrayPattern' === node.type && Array.isArray(node.elements)) for (const element of node.elements)collectBindingNames(element, names);
     else if ('AssignmentPattern' === node.type || 'RestElement' === node.type) collectBindingNames('AssignmentPattern' === node.type ? node.left : node.argument, names);
 };
-const getMemberPropertyName = (node)=>'MemberExpression' === node.type ? getNodeName(node.property) : void 0;
+const getMemberPropertyName = (node)=>{
+    if ('MemberExpression' !== node.type) return;
+    return true === node.computed ? getStringLiteralValue(node.property) : getNodeName(node.property);
+};
+const isAmbientModuleRequire = (node, modulePath)=>isAstNode(node) && 'MemberExpression' === node.type && isAstNode(node.object) && 'Identifier' === node.object.type && 'module' === node.object.name && void 0 === modulePath.scope.getBinding('module') && 'require' === getMemberPropertyName(node);
 const isModuleExports = (node)=>isAstNode(node) && 'MemberExpression' === node.type && isAstNode(node.object) && 'Identifier' === node.object.type && 'module' === node.object.name && 'exports' === getMemberPropertyName(node);
 const collectCommonJsExports = (statement, exports1)=>{
     if ('ExpressionStatement' !== statement.type || !isAstNode(statement.expression) || 'AssignmentExpression' !== statement.expression.type) return;
@@ -137,19 +145,31 @@ const collectEsmExports = (statement, exports1)=>{
         }
     }
 };
-const visitAst = (node, visitor)=>{
-    visitor(node);
-    for (const [key, value] of Object.entries(node))if ('loc' !== key && 'start' !== key && 'end' !== key && 'leadingComments' !== key && 'trailingComments' !== key && 'innerComments' !== key) {
-        if (isAstNode(value)) visitAst(value, visitor);
-        else if (Array.isArray(value)) {
-            for (const item of value)if (isAstNode(item)) visitAst(item, visitor);
+const getStaticImport = (modulePath)=>{
+    const node = modulePath.node;
+    if (('ImportDeclaration' === node.type || 'ExportNamedDeclaration' === node.type || 'ExportAllDeclaration' === node.type) && isAstNode(node.source)) return getStringLiteralValue(node.source);
+    if ('ImportExpression' === node.type && isAstNode(node.source)) return getStringLiteralValue(node.source);
+    if ('CallExpression' === node.type && Array.isArray(node.arguments) && 1 === node.arguments.length && isAstNode(node.callee) && ('Identifier' === node.callee.type && 'require' === node.callee.name && void 0 === modulePath.scope.getBinding('require') || isAmbientModuleRequire(node.callee, modulePath) || 'Import' === node.callee.type)) return getStringLiteralValue(node.arguments[0]);
+};
+const isAmbientLoaderWrite = (modulePath)=>{
+    let targetPath = modulePath;
+    while(targetPath.parentPath){
+        const parentPath = targetPath.parentPath;
+        if (parentPath.isAssignmentExpression()) return 'left' === targetPath.key;
+        if (parentPath.isUpdateExpression()) return 'argument' === targetPath.key;
+        if (parentPath.isForInStatement() || parentPath.isForOfStatement()) return 'left' === targetPath.key;
+        if (parentPath.isObjectProperty()) {
+            if ('value' !== targetPath.key) return false;
+            targetPath = parentPath;
+            continue;
+        }
+        if (parentPath.isObjectPattern() || parentPath.isArrayPattern() || parentPath.isRestElement() || parentPath.isAssignmentPattern()) {
+            targetPath = parentPath;
+            continue;
         }
+        break;
     }
-};
-const getStaticImport = (node)=>{
-    if (('ImportDeclaration' === node.type || 'ExportNamedDeclaration' === node.type || 'ExportAllDeclaration' === node.type) && isAstNode(node.source)) return getNodeName(node.source);
-    if ('ImportExpression' === node.type && isAstNode(node.source)) return getNodeName(node.source);
-    if ('CallExpression' === node.type && Array.isArray(node.arguments) && 1 === node.arguments.length && isAstNode(node.callee) && ('Identifier' === node.callee.type && 'require' === node.callee.name || 'Import' === node.callee.type)) return getNodeName(node.arguments[0]);
+    return false;
 };
 const analyzeWorkerModule = (source)=>{
     const ast = (0, parser_namespaceObject.parse)(source, {
@@ -157,17 +177,49 @@ const analyzeWorkerModule = (source)=>{
     });
     const exports1 = new Set();
     const imports = new Set();
+    let unsafeCommonJsLoaderUsage = false;
+    let unsafeDynamicImport = false;
     for (const statement of ast.program.body){
         collectEsmExports(statement, exports1);
         collectCommonJsExports(statement, exports1);
     }
-    visitAst(ast.program, (node)=>{
-        const specifier = getStaticImport(node);
-        if (specifier) imports.add(specifier);
+    traverse_default()(ast, {
+        enter (modulePath) {
+            const node = modulePath.node;
+            if (('ImportExpression' === node.type || 'CallExpression' === node.type && isAstNode(node.callee) && 'Import' === node.callee.type) && void 0 === getStaticImport(modulePath)) unsafeDynamicImport = true;
+            if (modulePath.isReferencedIdentifier({
+                name: 'require'
+            }) && void 0 === modulePath.scope.getBinding('require')) {
+                const parentPath = modulePath.parentPath;
+                const isStaticRequireCall = parentPath?.isCallExpression() && 'callee' === modulePath.key && void 0 !== getStaticImport(parentPath);
+                const isAvailabilityCheck = parentPath?.isUnaryExpression({
+                    operator: 'typeof'
+                });
+                if (!isStaticRequireCall && !isAvailabilityCheck) unsafeCommonJsLoaderUsage = true;
+            }
+            if ('Identifier' === node.type && isAmbientLoaderWrite(modulePath) && ('require' === node.name || 'module' === node.name) && void 0 === modulePath.scope.getBinding(node.name)) unsafeCommonJsLoaderUsage = true;
+            if (modulePath.isReferencedIdentifier({
+                name: 'module'
+            }) && void 0 === modulePath.scope.getBinding('module')) {
+                const parentPath = modulePath.parentPath;
+                const isExportsAccess = null !== parentPath && isModuleExports(parentPath.node);
+                const isStaticModuleRequireCall = null !== parentPath && isAmbientModuleRequire(parentPath.node, parentPath) && parentPath.parentPath?.isCallExpression() === true && 'callee' === parentPath.key && void 0 !== getStaticImport(parentPath.parentPath);
+                if (!isExportsAccess && !isStaticModuleRequireCall) unsafeCommonJsLoaderUsage = true;
+            }
+            if (isAmbientModuleRequire(node, modulePath)) {
+                const parentPath = modulePath.parentPath;
+                const isStaticRequireCall = parentPath?.isCallExpression() && 'callee' === modulePath.key && void 0 !== getStaticImport(parentPath);
+                if (!isStaticRequireCall) unsafeCommonJsLoaderUsage = true;
+            }
+            const specifier = getStaticImport(modulePath);
+            if (void 0 !== specifier) imports.add(specifier);
+        }
     });
     return {
         exports: exports1,
-        imports
+        imports,
+        unsafeCommonJsLoaderUsage,
+        unsafeDynamicImport
     };
 };
 const getPackageName = (specifier)=>specifier.startsWith('@') ? specifier.split('/').slice(0, 2).join('/') : specifier.split('/')[0];
@@ -218,7 +270,25 @@ const verifyWorkerModuleClosure = async (issues, entryPath, entrySource, contrac
             return;
         }
         if (isEntry) entryAnalysis = analysis;
+        if (analysis.unsafeCommonJsLoaderUsage) (0, external_issues_js_namespaceObject.addIssue)(issues, {
+            code: 'invalid-worker-bundle',
+            message: 'Cloudflare worker bundles must use exactly one string-literal specifier in ambient CommonJS loader calls and must not pass or alias the loader.',
+            path: modulePath
+        });
+        if (analysis.unsafeDynamicImport) (0, external_issues_js_namespaceObject.addIssue)(issues, {
+            code: 'invalid-worker-bundle',
+            message: 'Cloudflare worker bundles must not contain non-static dynamic module imports.',
+            path: modulePath
+        });
         for (const specifier of analysis.imports){
+            if (0 === specifier.length) {
+                (0, external_issues_js_namespaceObject.addIssue)(issues, {
+                    code: 'invalid-worker-bundle',
+                    message: 'Cloudflare worker bundle module specifiers must not be empty.',
+                    path: modulePath
+                });
+                continue;
+            }
             if (!specifier.startsWith('.') && !external_node_path_default().isAbsolute(specifier)) {
                 if (CLOUDFLARE_WORKER_NODE_BUILTIN_SPECIFIERS.has(specifier)) continue;
                 if (specifier.startsWith('node:')) {
@@ -267,14 +337,20 @@ const verifyWorkerBundleReferences = async (issues, worker, source, contract)=>{
         path: worker.path
     });
 };
-const verifyWorkerImport = async (issues, entryPath)=>{
+const verifyWorkerImport = async (issues, entryPath, expectedManifest)=>{
     try {
-        const worker = (await import(`${(0, external_node_url_namespaceObject.pathToFileURL)(entryPath).href}?t=${Date.now()}`)).default;
+        const workerModule = await import(`${(0, external_node_url_namespaceObject.pathToFileURL)(entryPath).href}?t=${Date.now()}`);
+        const worker = workerModule.default;
         if (!worker || 'function' != typeof worker.fetch) (0, external_issues_js_namespaceObject.addIssue)(issues, {
             code: 'worker-import-failed',
             message: 'Cloudflare server entry must default-export a Worker with fetch.',
             path: entryPath
         });
+        if (void 0 !== expectedManifest && !(0, external_node_util_namespaceObject.isDeepStrictEqual)(workerModule.modernWorkerManifest, expectedManifest)) (0, external_issues_js_namespaceObject.addIssue)(issues, {
+            code: 'worker-import-failed',
+            message: 'Cloudflare server entry runtime manifest must exactly match modern-worker-manifest.json.',
+            path: entryPath
+        });
     } catch (error) {
         (0, external_issues_js_namespaceObject.addIssue)(issues, {
             code: 'worker-import-failed',

package/dist/cjs/plugins/deploy/platforms/templates/cloudflare-entry.001-bootstrap-security.mjs

@@ -1,5 +1,6 @@
 const ASSETS_BINDING = 'ASSETS';
 const MODERN_WORKER_MANIFEST = p_workerManifest;
+export const modernWorkerManifest = MODERN_WORKER_MANIFEST;
 const WORKER_MODULE_LOADERS = p_workerModuleLoaders;
 const workerModulePromises = new Map();
 const effectBffDispatcherPromises = new Map();

package/dist/cjs/plugins/deploy/platforms/templates/cloudflare-worker-mf-ssr-runtime-plugin.mjs

@@ -0,0 +1,14 @@
+/**
+ * Workerd cannot initialize Module Federation's Node-oriented SSR data-fetch
+ * runtime. Cloudflare workers do not load native MF remotes, so retain the
+ * runtime-plugin contract without installing its server data-fetch hooks.
+ */
+export const injectDataFetchFunctionPlugin = () => ({
+  name: '@module-federation/inject-data-fetch-function-plugin',
+  setup() {},
+});
+
+export const mfSSRDevPlugin = () => ({
+  name: '@module-federation/modern-js-v3',
+  setup() {},
+});

package/dist/cjs/ultramodern-release-envelope/framework-output.js

@@ -38,6 +38,7 @@ var __webpack_exports__ = {};
 __webpack_require__.r(__webpack_exports__);
 __webpack_require__.d(__webpack_exports__, {
     MICROVERTICAL_RELEASE_ENVELOPE_PATH: ()=>MICROVERTICAL_RELEASE_ENVELOPE_PATH,
+    MICROVERTICAL_RELEASE_IDENTITY_CARRIERS_PATH: ()=>MICROVERTICAL_RELEASE_IDENTITY_CARRIERS_PATH,
     emitCloudflareStagedReleaseEnvelope: ()=>emitCloudflareStagedReleaseEnvelope,
     emitFrameworkMicroVerticalReleaseEnvelope: ()=>emitFrameworkMicroVerticalReleaseEnvelope,
     emitNodeStagedReleaseEnvelope: ()=>emitNodeStagedReleaseEnvelope,
@@ -47,47 +48,20 @@ __webpack_require__.d(__webpack_exports__, {
     verifyCloudflareReleaseEnvelopeStaging: ()=>verifyCloudflareReleaseEnvelopeStaging,
     verifyNodeReleaseEnvelopeStaging: ()=>verifyNodeReleaseEnvelopeStaging
 });
+const external_node_crypto_namespaceObject = require("node:crypto");
 const promises_namespaceObject = require("node:fs/promises");
 var promises_default = /*#__PURE__*/ __webpack_require__.n(promises_namespaceObject);
 const external_node_path_namespaceObject = require("node:path");
 var external_node_path_default = /*#__PURE__*/ __webpack_require__.n(external_node_path_namespaceObject);
-const parser_namespaceObject = require("@babel/parser");
 const universal_namespaceObject = require("@modern-js/utils/universal");
 const external_index_js_namespaceObject = require("./index.js");
 const MICROVERTICAL_RELEASE_ENVELOPE_PATH = 'release/microvertical-release-envelope.json';
+const MICROVERTICAL_RELEASE_IDENTITY_CARRIERS_PATH = 'release/microvertical-release-identity-carriers.json';
+const MICROVERTICAL_RELEASE_IDENTITY_CARRIERS_KIND = 'ultramodern-release-identity-carriers';
+const MICROVERTICAL_RELEASE_IDENTITY_CARRIERS_SCHEMA_VERSION = 1;
 const COMPILED_MODULE_PATTERN = /\.(?:c|m)?js$/u;
 const EFFECT_BFF_WORKER_PATTERN = /^worker\/__modern_bff_effect\.(?:c|m)?js$/u;
 const isRecord = (value)=>'object' == typeof value && null !== value && !Array.isArray(value);
-const isAstNode = (value)=>isRecord(value) && 'string' == typeof value.type;
-const visitAst = (node, visitor)=>{
-    visitor(node);
-    for (const value of Object.values(node))if (isAstNode(value)) visitAst(value, visitor);
-    else if (Array.isArray(value)) {
-        for (const item of value)if (isAstNode(item)) visitAst(item, visitor);
-    }
-};
-const compiledModuleIdentityValues = (source)=>{
-    const values = new Set();
-    const ast = (0, parser_namespaceObject.parse)(source, {
-        sourceType: 'unambiguous'
-    });
-    visitAst(ast.program, (node)=>{
-        if ('StringLiteral' === node.type && 'string' == typeof node.value) values.add(node.value);
-        else if ('TemplateElement' === node.type && isRecord(node.value) && 'string' == typeof node.value.cooked) values.add(node.value.cooked);
-    });
-    return values;
-};
-const assertEveryCompiledIdentityCarrier = async (distDirectory, logicalPaths, identity, surface)=>{
-    const compiledLogicalPaths = logicalPaths.filter((pathname)=>COMPILED_MODULE_PATTERN.test(pathname));
-    if (0 === compiledLogicalPaths.length) throw new Error(`[ultramodern-release-envelope] ${surface} has no compiled execution module carrying release identity.`);
-    for (const logicalPath of compiledLogicalPaths){
-        const source = await promises_default().readFile(external_node_path_default().join(distDirectory, logicalPath), {
-            encoding: 'utf8'
-        });
-        const values = compiledModuleIdentityValues(source);
-        if (!values.has(identity.buildMarker) || !values.has(identity.sourceRevision) || !values.has(identity.releaseVersion)) throw new Error(`[ultramodern-release-envelope] ${surface} execution module ${logicalPath} does not carry exact buildMarker ${identity.buildMarker}, sourceRevision ${identity.sourceRevision}, and releaseVersion ${identity.releaseVersion}.`);
-    }
-};
 const flattenStrings = (value)=>'string' == typeof value ? [
         value
     ] : Array.isArray(value) ? value.flatMap(flattenStrings) : [];
@@ -230,6 +204,49 @@ const releaseArtifact = (logicalPath, runtime)=>({
         logicalPath,
         runtime
     });
+const writeReleaseIdentityCarrierMetadata = async (artifactRoot, identity, carrierPaths)=>{
+    const surfacesByPath = new Map();
+    for (const [surface, logicalPaths] of Object.entries(carrierPaths)){
+        if (0 === logicalPaths.length) throw new Error(`[ultramodern-release-envelope] ${surface} has no declared release-identity carrier artifact.`);
+        for (const logicalPath of logicalPaths){
+            const surfaces = surfacesByPath.get(logicalPath) ?? new Set();
+            surfaces.add(surface);
+            surfacesByPath.set(logicalPath, surfaces);
+        }
+    }
+    const carriers = await Promise.all([
+        ...surfacesByPath
+    ].sort(([left], [right])=>left.localeCompare(right)).map(async ([logicalPath, surfaces])=>{
+        const bytes = await promises_default().readFile(external_node_path_default().join(artifactRoot, logicalPath));
+        return {
+            logicalPath,
+            byteLength: bytes.byteLength,
+            sha256: (0, external_node_crypto_namespaceObject.createHash)('sha256').update(bytes).digest('hex'),
+            surfaces: [
+                ...surfaces
+            ].sort((left, right)=>left.localeCompare(right))
+        };
+    }));
+    const releaseEnvelopePath = await resolveSafeReleaseEnvelopePath({
+        artifactRoot,
+        createDirectory: true
+    });
+    if (!releaseEnvelopePath) throw new Error('[ultramodern-release-envelope] could not resolve private release metadata directory.');
+    const metadataPath = external_node_path_default().join(external_node_path_default().dirname(releaseEnvelopePath), external_node_path_default().basename(MICROVERTICAL_RELEASE_IDENTITY_CARRIERS_PATH));
+    try {
+        const metadataStat = await promises_default().lstat(metadataPath);
+        if (metadataStat.isSymbolicLink() || !metadataStat.isFile()) throw new Error('[ultramodern-release-envelope] release identity carrier metadata must be a real file inside artifactRoot.');
+    } catch (error) {
+        if (!isMissingPathError(error)) throw error;
+    }
+    await promises_default().writeFile(metadataPath, `${JSON.stringify({
+        schemaVersion: MICROVERTICAL_RELEASE_IDENTITY_CARRIERS_SCHEMA_VERSION,
+        kind: MICROVERTICAL_RELEASE_IDENTITY_CARRIERS_KIND,
+        identity,
+        carriers
+    }, null, 2)}\n`);
+    return releaseArtifact(MICROVERTICAL_RELEASE_IDENTITY_CARRIERS_PATH, 'release-identity-metadata');
+};
 const createReleaseArtifactInputs = async (distDirectory, identity, target)=>{
     const files = await collectFiles(distDirectory);
     if ('node' === target && files.some((logicalPath)=>EFFECT_BFF_WORKER_PATTERN.test(logicalPath))) throw new Error('[ultramodern-release-envelope] Node target conflicts with a Cloudflare Effect API/BFF worker artifact; resolve the canonical deploy target instead of emitting a Node envelope for Cloudflare output.');
@@ -253,13 +270,7 @@ const createReleaseArtifactInputs = async (distDirectory, identity, target)=>{
     const clientExecutionPaths = await manifestReferencedClientModules(distDirectory, files);
     if (0 === clientExecutionPaths.length) throw new Error('[ultramodern-release-envelope] UI/client manifest references no compiled execution module.');
     const ssrExecutionPaths = await routeReferencedSsrModules(distDirectory, files, target);
-    await assertEveryCompiledIdentityCarrier(distDirectory, clientExecutionPaths, identity, 'manifest-referenced UI/client');
-    await assertEveryCompiledIdentityCarrier(distDirectory, ssrExecutionPaths, identity, 'node' === target ? 'route-referenced Node SSR' : 'route-referenced Cloudflare SSR');
-    await assertEveryCompiledIdentityCarrier(distDirectory, ssrPaths, identity, 'node' === target ? 'compiled Node SSR closure' : 'compiled Cloudflare SSR/workerd closure');
-    await assertEveryCompiledIdentityCarrier(distDirectory, 'node' === target ? nodeApiEntryPaths : apiBackendPaths, identity, 'node' === target ? 'Node API/backend' : 'Cloudflare API/backend');
-    await assertEveryCompiledIdentityCarrier(distDirectory, [
-        universal_namespaceObject.BACKEND_FEDERATION_REMOTE_ENTRY_FILE
-    ], identity, 'backend Module Federation container');
+    if (0 === ssrExecutionPaths.length) throw new Error(`[ultramodern-release-envelope] route manifest references no emitted ${'node' === target ? 'Node' : 'Cloudflare'} SSR execution module.`);
     const runtimeByPath = new Map();
     const add = (paths, runtime)=>{
         for (const logicalPath of paths){
@@ -295,8 +306,25 @@ const createReleaseArtifactInputs = async (distDirectory, identity, target)=>{
     const artifacts = [
         ...runtimeByPath
     ].map(([logicalPath, runtime])=>releaseArtifact(logicalPath, runtime)).sort((left, right)=>left.logicalPath.localeCompare(right.logicalPath));
+    const identityCarrierMetadata = await writeReleaseIdentityCarrierMetadata(distDirectory, identity, {
+        apiBackend: apiBackendPaths,
+        backendFederation: [
+            universal_namespaceObject.BACKEND_FEDERATION_MANIFEST_FILE,
+            universal_namespaceObject.BACKEND_FEDERATION_REMOTE_ENTRY_FILE
+        ],
+        ssr: [
+            ...new Set([
+                ...ssrExecutionPaths,
+                ...ssrPaths
+            ])
+        ],
+        uiClient: uiClientPaths.filter((logicalPath)=>COMPILED_MODULE_PATTERN.test(logicalPath))
+    });
     return {
-        artifacts,
+        artifacts: [
+            ...artifacts,
+            identityCarrierMetadata
+        ].sort((left, right)=>left.logicalPath.localeCompare(right.logicalPath)),
         surfaces
     };
 };
@@ -418,13 +446,7 @@ const createNodeStagedReleaseArtifactInputs = async (outputDirectory, identity)=
     ])if (0 === paths.length) throw new Error(`[ultramodern-release-envelope] final Node staging has no ${surface} artifacts.`);
     const clientExecutionPaths = await manifestReferencedClientModules(outputDirectory, files);
     const ssrExecutionPaths = await routeReferencedSsrModules(outputDirectory, files, 'node');
-    await assertEveryCompiledIdentityCarrier(outputDirectory, clientExecutionPaths, identity, 'final manifest-referenced Node UI/client');
-    await assertEveryCompiledIdentityCarrier(outputDirectory, ssrExecutionPaths, identity, 'final route-referenced Node SSR');
-    await assertEveryCompiledIdentityCarrier(outputDirectory, ssrPaths.filter((logicalPath)=>'index.js' !== logicalPath), identity, 'final compiled Node SSR closure');
-    await assertEveryCompiledIdentityCarrier(outputDirectory, apiBackendPaths.filter((logicalPath)=>logicalPath.startsWith('api/')), identity, 'final Node API/backend');
-    await assertEveryCompiledIdentityCarrier(outputDirectory, [
-        universal_namespaceObject.BACKEND_FEDERATION_REMOTE_ENTRY_FILE
-    ], identity, 'final Node backend Module Federation container');
+    if (0 === clientExecutionPaths.length || 0 === ssrExecutionPaths.length) throw new Error('[ultramodern-release-envelope] final Node manifests must reference emitted UI/client and SSR execution modules.');
     const runtimeByPath = new Map(files.filter((logicalPath)=>!backendFederationPaths.has(logicalPath)).map((logicalPath)=>[
             logicalPath,
             'nodejs-deployment'
@@ -434,10 +456,27 @@ const createNodeStagedReleaseArtifactInputs = async (outputDirectory, identity)=
     for (const logicalPath of apiBackendPaths)runtimeByPath.set(logicalPath, 'nodejs');
     runtimeByPath.set(universal_namespaceObject.BACKEND_FEDERATION_MANIFEST_FILE, 'module-federation-manifest');
     runtimeByPath.set(universal_namespaceObject.BACKEND_FEDERATION_REMOTE_ENTRY_FILE, 'nodejs');
+    const identityCarrierMetadata = await writeReleaseIdentityCarrierMetadata(outputDirectory, identity, {
+        apiBackend: apiBackendPaths,
+        backendFederation: [
+            universal_namespaceObject.BACKEND_FEDERATION_MANIFEST_FILE,
+            universal_namespaceObject.BACKEND_FEDERATION_REMOTE_ENTRY_FILE
+        ],
+        ssr: [
+            ...new Set([
+                ...ssrExecutionPaths,
+                ...ssrPaths.filter((logicalPath)=>'index.js' !== logicalPath)
+            ])
+        ],
+        uiClient: uiClientPaths.filter((logicalPath)=>COMPILED_MODULE_PATTERN.test(logicalPath))
+    });
     return {
         artifacts: [
-            ...runtimeByPath
-        ].map(([logicalPath, runtime])=>releaseArtifact(logicalPath, runtime)).sort((left, right)=>left.logicalPath.localeCompare(right.logicalPath)),
+            ...[
+                ...runtimeByPath
+            ].map(([logicalPath, runtime])=>releaseArtifact(logicalPath, runtime)),
+            identityCarrierMetadata
+        ].sort((left, right)=>left.logicalPath.localeCompare(right.logicalPath)),
         surfaces: {
             uiClient: [
                 ...uiClientPaths
@@ -511,13 +550,7 @@ const createCloudflareStagedReleaseArtifactInputs = async (outputDirectory, iden
     ])if (!files.includes(logicalPath)) throw new Error(`[ultramodern-release-envelope] final Cloudflare staging is missing ${logicalPath}.`);
     const clientExecutionPaths = await manifestReferencedClientModules(outputDirectory, files, 'public/mf-manifest.json');
     const ssrExecutionPaths = await routeReferencedSsrModules(outputDirectory, files, 'cloudflare', 'server/route.json');
-    await assertEveryCompiledIdentityCarrier(outputDirectory, clientExecutionPaths, identity, 'final manifest-referenced Cloudflare UI/client');
-    await assertEveryCompiledIdentityCarrier(outputDirectory, ssrExecutionPaths, identity, 'final route-referenced Cloudflare SSR');
-    await assertEveryCompiledIdentityCarrier(outputDirectory, ssrPaths.filter((logicalPath)=>logicalPath.startsWith('worker/')), identity, 'final compiled Cloudflare SSR/workerd closure');
-    await assertEveryCompiledIdentityCarrier(outputDirectory, apiBackendPaths, identity, 'final Cloudflare API/backend');
-    await assertEveryCompiledIdentityCarrier(outputDirectory, [
-        backendContainerPath
-    ], identity, 'final Cloudflare backend Module Federation container');
+    if (0 === clientExecutionPaths.length || 0 === ssrExecutionPaths.length) throw new Error('[ultramodern-release-envelope] final Cloudflare manifests must reference emitted UI/client and SSR execution modules.');
     const runtimeByPath = new Map();
     for (const logicalPath of files)runtimeByPath.set(logicalPath, 'cloudflare-deployment');
     const add = (paths, runtime)=>{
@@ -532,10 +565,27 @@ const createCloudflareStagedReleaseArtifactInputs = async (outputDirectory, iden
     add([
         backendContainerPath
     ], 'commonjs-module');
+    const identityCarrierMetadata = await writeReleaseIdentityCarrierMetadata(outputDirectory, identity, {
+        apiBackend: apiBackendPaths,
+        backendFederation: [
+            backendManifestPath,
+            backendContainerPath
+        ],
+        ssr: [
+            ...new Set([
+                ...ssrExecutionPaths,
+                ...ssrPaths.filter((logicalPath)=>logicalPath.startsWith('worker/'))
+            ])
+        ],
+        uiClient: uiClientPaths.filter((logicalPath)=>COMPILED_MODULE_PATTERN.test(logicalPath))
+    });
     return {
         artifacts: [
-            ...runtimeByPath
-        ].map(([logicalPath, runtime])=>releaseArtifact(logicalPath, runtime)).sort((left, right)=>left.logicalPath.localeCompare(right.logicalPath)),
+            ...[
+                ...runtimeByPath
+            ].map(([logicalPath, runtime])=>releaseArtifact(logicalPath, runtime)),
+            identityCarrierMetadata
+        ].sort((left, right)=>left.logicalPath.localeCompare(right.logicalPath)),
         surfaces: {
             uiClient: [
                 ...uiClientPaths
@@ -573,6 +623,7 @@ const verifyCloudflareReleaseEnvelopeStaging = async (outputDirectory)=>readFram
         required: true
     });
 exports.MICROVERTICAL_RELEASE_ENVELOPE_PATH = __webpack_exports__.MICROVERTICAL_RELEASE_ENVELOPE_PATH;
+exports.MICROVERTICAL_RELEASE_IDENTITY_CARRIERS_PATH = __webpack_exports__.MICROVERTICAL_RELEASE_IDENTITY_CARRIERS_PATH;
 exports.emitCloudflareStagedReleaseEnvelope = __webpack_exports__.emitCloudflareStagedReleaseEnvelope;
 exports.emitFrameworkMicroVerticalReleaseEnvelope = __webpack_exports__.emitFrameworkMicroVerticalReleaseEnvelope;
 exports.emitNodeStagedReleaseEnvelope = __webpack_exports__.emitNodeStagedReleaseEnvelope;
@@ -583,6 +634,7 @@ exports.verifyCloudflareReleaseEnvelopeStaging = __webpack_exports__.verifyCloud
 exports.verifyNodeReleaseEnvelopeStaging = __webpack_exports__.verifyNodeReleaseEnvelopeStaging;
 for(var __rspack_i in __webpack_exports__)if (-1 === [
     "MICROVERTICAL_RELEASE_ENVELOPE_PATH",
+    "MICROVERTICAL_RELEASE_IDENTITY_CARRIERS_PATH",
     "emitCloudflareStagedReleaseEnvelope",
     "emitFrameworkMicroVerticalReleaseEnvelope",
     "emitNodeStagedReleaseEnvelope",