@bleedingdev/modern-js-app-tools 3.5.0-ultramodern.101 → 3.5.0-ultramodern.103

package/dist/esm-node/builder/generator/getBuilderEnvironments.mjs

@@ -10,6 +10,8 @@ import { dirname as __rspack_dirname } from "node:path";
 var __rspack_import_meta_dirname__ = __rspack_dirname(__rspack_fileURLToPath(import.meta.url));
 const BFF_EFFECT_WORKER_ENTRY_NAME = '__modern_bff_effect';
 const BFF_EFFECT_WORKER_RUNTIME_QUERY = 'modern-bff-runtime';
+const MF_SSR_DATA_FETCH_RUNTIME_PLUGIN = '@module-federation/modern-js-v3/ssr-inject-data-fetch-function-plugin';
+const MF_SSR_DEV_RUNTIME_PLUGIN = '@module-federation/modern-js-v3/ssr-dev-plugin';
 const JS_OR_TS_EXTS = [
     '.js',
     '.jsx',
@@ -90,6 +92,64 @@ function getCloudflareWorkerNodeExternals() {
         ];
     }));
 }
+const reserveWorkerChunkName = (baseName, reservedOutputNames)=>{
+    let name = baseName;
+    while(reservedOutputNames.has(normalizeWorkerOutputName(name)))name = `${name}_`;
+    return name;
+};
+const normalizeWorkerOutputName = (name)=>node_path.posix.normalize(name.replace(/\\/gu, '/')).toLowerCase();
+function getCloudflareWorkerRspackConfig(workerEntryNames) {
+    const entryNames = [
+        ...workerEntryNames
+    ];
+    for (const entryName of entryNames){
+        const slashName = entryName.replace(/\\/gu, '/');
+        const normalizedName = node_path.posix.normalize(slashName);
+        if (entryName !== slashName || normalizedName !== slashName || '.' === normalizedName || normalizedName.startsWith('../') || node_path.posix.isAbsolute(normalizedName) || node_path.win32.isAbsolute(slashName) || /^[A-Za-z]:/u.test(slashName)) throw new Error(`Cloudflare worker entry name "${entryName}" must be a canonical relative output path without dot segments or backslashes.`);
+    }
+    const reservedNames = new Set(entryNames.map(normalizeWorkerOutputName));
+    const runtimeName = reserveWorkerChunkName('__modern_worker_runtime', reservedNames);
+    reservedNames.add(normalizeWorkerOutputName(runtimeName));
+    const sharedName = reserveWorkerChunkName('__modern_worker_shared', reservedNames);
+    return {
+        experiments: {
+            outputModule: true
+        },
+        externals: getCloudflareWorkerNodeExternals(),
+        externalsType: 'module-import',
+        module: {
+            parser: {
+                javascript: {
+                    dynamicImportMode: 'eager'
+                }
+            }
+        },
+        optimization: {
+            runtimeChunk: {
+                name: runtimeName
+            },
+            splitChunks: {
+                chunks: 'all',
+                minSize: 0,
+                name: sharedName
+            }
+        }
+    };
+}
+function applyCloudflareWorkerRspackConfig(chain, workerEntryNames) {
+    const config = getCloudflareWorkerRspackConfig(workerEntryNames);
+    chain.experiments(config.experiments);
+    chain.externals(config.externals);
+    chain.externalsType(config.externalsType);
+    chain.module.parser.merge(config.module.parser);
+    chain.optimization.runtimeChunk(config.optimization.runtimeChunk);
+    chain.optimization.splitChunks(config.optimization.splitChunks);
+}
+function applyCloudflareWorkerMfRuntimeBoundary(chain) {
+    chain.plugins.delete('plugin-module-federation');
+    chain.resolve.alias.set(`${MF_SSR_DATA_FETCH_RUNTIME_PLUGIN}$`, getCloudflareWorkerCompatFile('cloudflare-worker-mf-ssr-runtime-plugin.mjs'));
+    chain.resolve.alias.set(`${MF_SSR_DEV_RUNTIME_PLUGIN}$`, getCloudflareWorkerCompatFile('cloudflare-worker-mf-ssr-runtime-plugin.mjs'));
+}
 function getEffectBffEntry(normalizedConfig, appContext) {
     if (!normalizedConfig.bff || 'hono' === normalizedConfig.bff.runtimeFramework) return;
     const configuredEntry = normalizedConfig.bff.effect?.entry;
@@ -248,17 +308,10 @@ function getBuilderEnvironments(normalizedConfig, appContext, tempBuilderConfig)
                 htmlPlugin: false,
                 ...useCloudflareModuleWorker ? {
                     bundlerChain: (chain)=>{
-                        chain.merge({
-                            experiments: {
-                                outputModule: true
-                            },
-                            externals: getCloudflareWorkerNodeExternals(),
-                            externalsType: 'module-import'
-                        });
+                        applyCloudflareWorkerRspackConfig(chain, Object.keys(workerEntries));
                         chain.output.module(true).library({
                             type: 'module'
                         }).publicPath('/').chunkFormat('module').chunkLoading('import').workerChunkLoading('import');
-                        chain.optimization.usedExports(false).providedExports(true).innerGraph(false).sideEffects(false);
                         for (const condition of [
                             'workerd',
                             'worker',
@@ -268,7 +321,7 @@ function getBuilderEnvironments(normalizedConfig, appContext, tempBuilderConfig)
                             'require',
                             'module'
                         ])chain.resolve.conditionNames.add(condition);
-                        chain.plugins.delete('plugin-module-federation');
+                        applyCloudflareWorkerMfRuntimeBoundary(chain);
                         if (tanstackRouterSsrServerFile) {
                             chain.resolve.alias.set('@tanstack/router-core/ssr/server$', tanstackRouterSsrServerFile);
                             chain.resolve.alias.set('@tanstack/router-core/ssr/server', tanstackRouterSsrServerFile);
@@ -309,4 +362,4 @@ function getBuilderEnvironments(normalizedConfig, appContext, tempBuilderConfig)
         builderConfig: tempBuilderConfig
     };
 }
-export { getBuilderEnvironments };
+export { applyCloudflareWorkerMfRuntimeBoundary, applyCloudflareWorkerRspackConfig, getBuilderEnvironments, getCloudflareWorkerRspackConfig };

package/dist/esm-node/plugins/deploy/platforms/cloudflare-output-verifier/index.mjs

@@ -117,7 +117,7 @@ const verifyCloudflareOutput = async (options)=>{
             path: publicPath
         });
     }
-    if (false !== options.importWorker && await pathExists(outputPlan.paths.workerEntry)) await verifyWorkerImport(issues, outputPlan.paths.workerEntry);
+    if (false !== options.importWorker && await pathExists(outputPlan.paths.workerEntry)) await verifyWorkerImport(issues, outputPlan.paths.workerEntry, manifest);
     return {
         ok: 0 === issues.length,
         issues

package/dist/esm-node/plugins/deploy/platforms/cloudflare-output-verifier/worker-bundles.mjs

@@ -2,7 +2,9 @@ import "node:module";
 import promises from "node:fs/promises";
 import node_path from "node:path";
 import { pathToFileURL } from "node:url";
+import { isDeepStrictEqual } from "node:util";
 import { parse } from "@babel/parser";
+import traverse from "@babel/traverse";
 import { CLOUDFLARE_WORKER_BUNDLE_DIRECTORY, CLOUDFLARE_WORKER_NODE_BUILTINS } from "../cloudflare-output-contract.mjs";
 import { addIssue } from "./issues.mjs";
 const getReferencedRouteWorkers = (manifest)=>Array.isArray(manifest?.routeSpec?.routes) ? manifest.routeSpec.routes.map((route)=>'string' == typeof route?.worker && route.worker.length > 0 ? route.worker : void 0).filter((worker)=>'string' == typeof worker) : [];
@@ -46,6 +48,7 @@ const getNodeName = (node)=>{
     if (!isAstNode(node)) return;
     return 'Identifier' === node.type && 'string' == typeof node.name ? node.name : 'StringLiteral' === node.type && 'string' == typeof node.value ? node.value : void 0;
 };
+const getStringLiteralValue = (node)=>isAstNode(node) && 'StringLiteral' === node.type && 'string' == typeof node.value ? node.value : void 0;
 const collectBindingNames = (node, names)=>{
     if (!isAstNode(node)) return;
     const name = getNodeName(node);
@@ -55,7 +58,11 @@ const collectBindingNames = (node, names)=>{
     } else if ('ArrayPattern' === node.type && Array.isArray(node.elements)) for (const element of node.elements)collectBindingNames(element, names);
     else if ('AssignmentPattern' === node.type || 'RestElement' === node.type) collectBindingNames('AssignmentPattern' === node.type ? node.left : node.argument, names);
 };
-const getMemberPropertyName = (node)=>'MemberExpression' === node.type ? getNodeName(node.property) : void 0;
+const getMemberPropertyName = (node)=>{
+    if ('MemberExpression' !== node.type) return;
+    return true === node.computed ? getStringLiteralValue(node.property) : getNodeName(node.property);
+};
+const isAmbientModuleRequire = (node, modulePath)=>isAstNode(node) && 'MemberExpression' === node.type && isAstNode(node.object) && 'Identifier' === node.object.type && 'module' === node.object.name && void 0 === modulePath.scope.getBinding('module') && 'require' === getMemberPropertyName(node);
 const isModuleExports = (node)=>isAstNode(node) && 'MemberExpression' === node.type && isAstNode(node.object) && 'Identifier' === node.object.type && 'module' === node.object.name && 'exports' === getMemberPropertyName(node);
 const collectCommonJsExports = (statement, exports)=>{
     if ('ExpressionStatement' !== statement.type || !isAstNode(statement.expression) || 'AssignmentExpression' !== statement.expression.type) return;
@@ -90,19 +97,31 @@ const collectEsmExports = (statement, exports)=>{
         }
     }
 };
-const visitAst = (node, visitor)=>{
-    visitor(node);
-    for (const [key, value] of Object.entries(node))if ('loc' !== key && 'start' !== key && 'end' !== key && 'leadingComments' !== key && 'trailingComments' !== key && 'innerComments' !== key) {
-        if (isAstNode(value)) visitAst(value, visitor);
-        else if (Array.isArray(value)) {
-            for (const item of value)if (isAstNode(item)) visitAst(item, visitor);
+const getStaticImport = (modulePath)=>{
+    const node = modulePath.node;
+    if (('ImportDeclaration' === node.type || 'ExportNamedDeclaration' === node.type || 'ExportAllDeclaration' === node.type) && isAstNode(node.source)) return getStringLiteralValue(node.source);
+    if ('ImportExpression' === node.type && isAstNode(node.source)) return getStringLiteralValue(node.source);
+    if ('CallExpression' === node.type && Array.isArray(node.arguments) && 1 === node.arguments.length && isAstNode(node.callee) && ('Identifier' === node.callee.type && 'require' === node.callee.name && void 0 === modulePath.scope.getBinding('require') || isAmbientModuleRequire(node.callee, modulePath) || 'Import' === node.callee.type)) return getStringLiteralValue(node.arguments[0]);
+};
+const isAmbientLoaderWrite = (modulePath)=>{
+    let targetPath = modulePath;
+    while(targetPath.parentPath){
+        const parentPath = targetPath.parentPath;
+        if (parentPath.isAssignmentExpression()) return 'left' === targetPath.key;
+        if (parentPath.isUpdateExpression()) return 'argument' === targetPath.key;
+        if (parentPath.isForInStatement() || parentPath.isForOfStatement()) return 'left' === targetPath.key;
+        if (parentPath.isObjectProperty()) {
+            if ('value' !== targetPath.key) return false;
+            targetPath = parentPath;
+            continue;
+        }
+        if (parentPath.isObjectPattern() || parentPath.isArrayPattern() || parentPath.isRestElement() || parentPath.isAssignmentPattern()) {
+            targetPath = parentPath;
+            continue;
         }
+        break;
     }
-};
-const getStaticImport = (node)=>{
-    if (('ImportDeclaration' === node.type || 'ExportNamedDeclaration' === node.type || 'ExportAllDeclaration' === node.type) && isAstNode(node.source)) return getNodeName(node.source);
-    if ('ImportExpression' === node.type && isAstNode(node.source)) return getNodeName(node.source);
-    if ('CallExpression' === node.type && Array.isArray(node.arguments) && 1 === node.arguments.length && isAstNode(node.callee) && ('Identifier' === node.callee.type && 'require' === node.callee.name || 'Import' === node.callee.type)) return getNodeName(node.arguments[0]);
+    return false;
 };
 const analyzeWorkerModule = (source)=>{
     const ast = parse(source, {
@@ -110,17 +129,49 @@ const analyzeWorkerModule = (source)=>{
     });
     const exports = new Set();
     const imports = new Set();
+    let unsafeCommonJsLoaderUsage = false;
+    let unsafeDynamicImport = false;
     for (const statement of ast.program.body){
         collectEsmExports(statement, exports);
         collectCommonJsExports(statement, exports);
     }
-    visitAst(ast.program, (node)=>{
-        const specifier = getStaticImport(node);
-        if (specifier) imports.add(specifier);
+    traverse(ast, {
+        enter (modulePath) {
+            const node = modulePath.node;
+            if (('ImportExpression' === node.type || 'CallExpression' === node.type && isAstNode(node.callee) && 'Import' === node.callee.type) && void 0 === getStaticImport(modulePath)) unsafeDynamicImport = true;
+            if (modulePath.isReferencedIdentifier({
+                name: 'require'
+            }) && void 0 === modulePath.scope.getBinding('require')) {
+                const parentPath = modulePath.parentPath;
+                const isStaticRequireCall = parentPath?.isCallExpression() && 'callee' === modulePath.key && void 0 !== getStaticImport(parentPath);
+                const isAvailabilityCheck = parentPath?.isUnaryExpression({
+                    operator: 'typeof'
+                });
+                if (!isStaticRequireCall && !isAvailabilityCheck) unsafeCommonJsLoaderUsage = true;
+            }
+            if ('Identifier' === node.type && isAmbientLoaderWrite(modulePath) && ('require' === node.name || 'module' === node.name) && void 0 === modulePath.scope.getBinding(node.name)) unsafeCommonJsLoaderUsage = true;
+            if (modulePath.isReferencedIdentifier({
+                name: 'module'
+            }) && void 0 === modulePath.scope.getBinding('module')) {
+                const parentPath = modulePath.parentPath;
+                const isExportsAccess = null !== parentPath && isModuleExports(parentPath.node);
+                const isStaticModuleRequireCall = null !== parentPath && isAmbientModuleRequire(parentPath.node, parentPath) && parentPath.parentPath?.isCallExpression() === true && 'callee' === parentPath.key && void 0 !== getStaticImport(parentPath.parentPath);
+                if (!isExportsAccess && !isStaticModuleRequireCall) unsafeCommonJsLoaderUsage = true;
+            }
+            if (isAmbientModuleRequire(node, modulePath)) {
+                const parentPath = modulePath.parentPath;
+                const isStaticRequireCall = parentPath?.isCallExpression() && 'callee' === modulePath.key && void 0 !== getStaticImport(parentPath);
+                if (!isStaticRequireCall) unsafeCommonJsLoaderUsage = true;
+            }
+            const specifier = getStaticImport(modulePath);
+            if (void 0 !== specifier) imports.add(specifier);
+        }
     });
     return {
         exports,
-        imports
+        imports,
+        unsafeCommonJsLoaderUsage,
+        unsafeDynamicImport
     };
 };
 const getPackageName = (specifier)=>specifier.startsWith('@') ? specifier.split('/').slice(0, 2).join('/') : specifier.split('/')[0];
@@ -171,7 +222,25 @@ const verifyWorkerModuleClosure = async (issues, entryPath, entrySource, contrac
             return;
         }
         if (isEntry) entryAnalysis = analysis;
+        if (analysis.unsafeCommonJsLoaderUsage) addIssue(issues, {
+            code: 'invalid-worker-bundle',
+            message: 'Cloudflare worker bundles must use exactly one string-literal specifier in ambient CommonJS loader calls and must not pass or alias the loader.',
+            path: modulePath
+        });
+        if (analysis.unsafeDynamicImport) addIssue(issues, {
+            code: 'invalid-worker-bundle',
+            message: 'Cloudflare worker bundles must not contain non-static dynamic module imports.',
+            path: modulePath
+        });
         for (const specifier of analysis.imports){
+            if (0 === specifier.length) {
+                addIssue(issues, {
+                    code: 'invalid-worker-bundle',
+                    message: 'Cloudflare worker bundle module specifiers must not be empty.',
+                    path: modulePath
+                });
+                continue;
+            }
             if (!specifier.startsWith('.') && !node_path.isAbsolute(specifier)) {
                 if (CLOUDFLARE_WORKER_NODE_BUILTIN_SPECIFIERS.has(specifier)) continue;
                 if (specifier.startsWith('node:')) {
@@ -220,14 +289,20 @@ const verifyWorkerBundleReferences = async (issues, worker, source, contract)=>{
         path: worker.path
     });
 };
-const verifyWorkerImport = async (issues, entryPath)=>{
+const verifyWorkerImport = async (issues, entryPath, expectedManifest)=>{
     try {
-        const worker = (await import(`${pathToFileURL(entryPath).href}?t=${Date.now()}`)).default;
+        const workerModule = await import(`${pathToFileURL(entryPath).href}?t=${Date.now()}`);
+        const worker = workerModule.default;
         if (!worker || 'function' != typeof worker.fetch) addIssue(issues, {
             code: 'worker-import-failed',
             message: 'Cloudflare server entry must default-export a Worker with fetch.',
             path: entryPath
         });
+        if (void 0 !== expectedManifest && !isDeepStrictEqual(workerModule.modernWorkerManifest, expectedManifest)) addIssue(issues, {
+            code: 'worker-import-failed',
+            message: 'Cloudflare server entry runtime manifest must exactly match modern-worker-manifest.json.',
+            path: entryPath
+        });
     } catch (error) {
         addIssue(issues, {
             code: 'worker-import-failed',

package/dist/esm-node/plugins/deploy/platforms/templates/cloudflare-entry.001-bootstrap-security.mjs

@@ -1,5 +1,6 @@
 const ASSETS_BINDING = 'ASSETS';
 const MODERN_WORKER_MANIFEST = p_workerManifest;
+export const modernWorkerManifest = MODERN_WORKER_MANIFEST;
 const WORKER_MODULE_LOADERS = p_workerModuleLoaders;
 const workerModulePromises = new Map();
 const effectBffDispatcherPromises = new Map();

package/dist/esm-node/plugins/deploy/platforms/templates/cloudflare-worker-mf-ssr-runtime-plugin.mjs

@@ -0,0 +1,14 @@
+/**
+ * Workerd cannot initialize Module Federation's Node-oriented SSR data-fetch
+ * runtime. Cloudflare workers do not load native MF remotes, so retain the
+ * runtime-plugin contract without installing its server data-fetch hooks.
+ */
+export const injectDataFetchFunctionPlugin = () => ({
+  name: '@module-federation/inject-data-fetch-function-plugin',
+  setup() {},
+});
+
+export const mfSSRDevPlugin = () => ({
+  name: '@module-federation/modern-js-v3',
+  setup() {},
+});

package/dist/esm-node/ultramodern-release-envelope/framework-output.mjs

@@ -1,43 +1,16 @@
 import "node:module";
+import { createHash } from "node:crypto";
 import promises from "node:fs/promises";
 import node_path from "node:path";
-import { parse } from "@babel/parser";
 import { BACKEND_FEDERATION_MANIFEST_FILE, BACKEND_FEDERATION_REMOTE_ENTRY_FILE, ULTRAMODERN_BUILD_ARTIFACT_FILE, isUltramodernBuildArtifact } from "@modern-js/utils/universal";
 import { canonicalSerializeMicroVerticalReleaseEnvelope, createMicroVerticalReleaseEnvelope, verifyMicroVerticalReleaseEnvelope } from "./index.mjs";
 const MICROVERTICAL_RELEASE_ENVELOPE_PATH = 'release/microvertical-release-envelope.json';
+const MICROVERTICAL_RELEASE_IDENTITY_CARRIERS_PATH = 'release/microvertical-release-identity-carriers.json';
+const MICROVERTICAL_RELEASE_IDENTITY_CARRIERS_KIND = 'ultramodern-release-identity-carriers';
+const MICROVERTICAL_RELEASE_IDENTITY_CARRIERS_SCHEMA_VERSION = 1;
 const COMPILED_MODULE_PATTERN = /\.(?:c|m)?js$/u;
 const EFFECT_BFF_WORKER_PATTERN = /^worker\/__modern_bff_effect\.(?:c|m)?js$/u;
 const isRecord = (value)=>'object' == typeof value && null !== value && !Array.isArray(value);
-const isAstNode = (value)=>isRecord(value) && 'string' == typeof value.type;
-const visitAst = (node, visitor)=>{
-    visitor(node);
-    for (const value of Object.values(node))if (isAstNode(value)) visitAst(value, visitor);
-    else if (Array.isArray(value)) {
-        for (const item of value)if (isAstNode(item)) visitAst(item, visitor);
-    }
-};
-const compiledModuleIdentityValues = (source)=>{
-    const values = new Set();
-    const ast = parse(source, {
-        sourceType: 'unambiguous'
-    });
-    visitAst(ast.program, (node)=>{
-        if ('StringLiteral' === node.type && 'string' == typeof node.value) values.add(node.value);
-        else if ('TemplateElement' === node.type && isRecord(node.value) && 'string' == typeof node.value.cooked) values.add(node.value.cooked);
-    });
-    return values;
-};
-const assertEveryCompiledIdentityCarrier = async (distDirectory, logicalPaths, identity, surface)=>{
-    const compiledLogicalPaths = logicalPaths.filter((pathname)=>COMPILED_MODULE_PATTERN.test(pathname));
-    if (0 === compiledLogicalPaths.length) throw new Error(`[ultramodern-release-envelope] ${surface} has no compiled execution module carrying release identity.`);
-    for (const logicalPath of compiledLogicalPaths){
-        const source = await promises.readFile(node_path.join(distDirectory, logicalPath), {
-            encoding: 'utf8'
-        });
-        const values = compiledModuleIdentityValues(source);
-        if (!values.has(identity.buildMarker) || !values.has(identity.sourceRevision) || !values.has(identity.releaseVersion)) throw new Error(`[ultramodern-release-envelope] ${surface} execution module ${logicalPath} does not carry exact buildMarker ${identity.buildMarker}, sourceRevision ${identity.sourceRevision}, and releaseVersion ${identity.releaseVersion}.`);
-    }
-};
 const flattenStrings = (value)=>'string' == typeof value ? [
         value
     ] : Array.isArray(value) ? value.flatMap(flattenStrings) : [];
@@ -180,6 +153,49 @@ const releaseArtifact = (logicalPath, runtime)=>({
         logicalPath,
         runtime
     });
+const writeReleaseIdentityCarrierMetadata = async (artifactRoot, identity, carrierPaths)=>{
+    const surfacesByPath = new Map();
+    for (const [surface, logicalPaths] of Object.entries(carrierPaths)){
+        if (0 === logicalPaths.length) throw new Error(`[ultramodern-release-envelope] ${surface} has no declared release-identity carrier artifact.`);
+        for (const logicalPath of logicalPaths){
+            const surfaces = surfacesByPath.get(logicalPath) ?? new Set();
+            surfaces.add(surface);
+            surfacesByPath.set(logicalPath, surfaces);
+        }
+    }
+    const carriers = await Promise.all([
+        ...surfacesByPath
+    ].sort(([left], [right])=>left.localeCompare(right)).map(async ([logicalPath, surfaces])=>{
+        const bytes = await promises.readFile(node_path.join(artifactRoot, logicalPath));
+        return {
+            logicalPath,
+            byteLength: bytes.byteLength,
+            sha256: createHash('sha256').update(bytes).digest('hex'),
+            surfaces: [
+                ...surfaces
+            ].sort((left, right)=>left.localeCompare(right))
+        };
+    }));
+    const releaseEnvelopePath = await resolveSafeReleaseEnvelopePath({
+        artifactRoot,
+        createDirectory: true
+    });
+    if (!releaseEnvelopePath) throw new Error('[ultramodern-release-envelope] could not resolve private release metadata directory.');
+    const metadataPath = node_path.join(node_path.dirname(releaseEnvelopePath), node_path.basename(MICROVERTICAL_RELEASE_IDENTITY_CARRIERS_PATH));
+    try {
+        const metadataStat = await promises.lstat(metadataPath);
+        if (metadataStat.isSymbolicLink() || !metadataStat.isFile()) throw new Error('[ultramodern-release-envelope] release identity carrier metadata must be a real file inside artifactRoot.');
+    } catch (error) {
+        if (!isMissingPathError(error)) throw error;
+    }
+    await promises.writeFile(metadataPath, `${JSON.stringify({
+        schemaVersion: MICROVERTICAL_RELEASE_IDENTITY_CARRIERS_SCHEMA_VERSION,
+        kind: MICROVERTICAL_RELEASE_IDENTITY_CARRIERS_KIND,
+        identity,
+        carriers
+    }, null, 2)}\n`);
+    return releaseArtifact(MICROVERTICAL_RELEASE_IDENTITY_CARRIERS_PATH, 'release-identity-metadata');
+};
 const createReleaseArtifactInputs = async (distDirectory, identity, target)=>{
     const files = await collectFiles(distDirectory);
     if ('node' === target && files.some((logicalPath)=>EFFECT_BFF_WORKER_PATTERN.test(logicalPath))) throw new Error('[ultramodern-release-envelope] Node target conflicts with a Cloudflare Effect API/BFF worker artifact; resolve the canonical deploy target instead of emitting a Node envelope for Cloudflare output.');
@@ -203,13 +219,7 @@ const createReleaseArtifactInputs = async (distDirectory, identity, target)=>{
     const clientExecutionPaths = await manifestReferencedClientModules(distDirectory, files);
     if (0 === clientExecutionPaths.length) throw new Error('[ultramodern-release-envelope] UI/client manifest references no compiled execution module.');
     const ssrExecutionPaths = await routeReferencedSsrModules(distDirectory, files, target);
-    await assertEveryCompiledIdentityCarrier(distDirectory, clientExecutionPaths, identity, 'manifest-referenced UI/client');
-    await assertEveryCompiledIdentityCarrier(distDirectory, ssrExecutionPaths, identity, 'node' === target ? 'route-referenced Node SSR' : 'route-referenced Cloudflare SSR');
-    await assertEveryCompiledIdentityCarrier(distDirectory, ssrPaths, identity, 'node' === target ? 'compiled Node SSR closure' : 'compiled Cloudflare SSR/workerd closure');
-    await assertEveryCompiledIdentityCarrier(distDirectory, 'node' === target ? nodeApiEntryPaths : apiBackendPaths, identity, 'node' === target ? 'Node API/backend' : 'Cloudflare API/backend');
-    await assertEveryCompiledIdentityCarrier(distDirectory, [
-        BACKEND_FEDERATION_REMOTE_ENTRY_FILE
-    ], identity, 'backend Module Federation container');
+    if (0 === ssrExecutionPaths.length) throw new Error(`[ultramodern-release-envelope] route manifest references no emitted ${'node' === target ? 'Node' : 'Cloudflare'} SSR execution module.`);
     const runtimeByPath = new Map();
     const add = (paths, runtime)=>{
         for (const logicalPath of paths){
@@ -245,8 +255,25 @@ const createReleaseArtifactInputs = async (distDirectory, identity, target)=>{
     const artifacts = [
         ...runtimeByPath
     ].map(([logicalPath, runtime])=>releaseArtifact(logicalPath, runtime)).sort((left, right)=>left.logicalPath.localeCompare(right.logicalPath));
+    const identityCarrierMetadata = await writeReleaseIdentityCarrierMetadata(distDirectory, identity, {
+        apiBackend: apiBackendPaths,
+        backendFederation: [
+            BACKEND_FEDERATION_MANIFEST_FILE,
+            BACKEND_FEDERATION_REMOTE_ENTRY_FILE
+        ],
+        ssr: [
+            ...new Set([
+                ...ssrExecutionPaths,
+                ...ssrPaths
+            ])
+        ],
+        uiClient: uiClientPaths.filter((logicalPath)=>COMPILED_MODULE_PATTERN.test(logicalPath))
+    });
     return {
-        artifacts,
+        artifacts: [
+            ...artifacts,
+            identityCarrierMetadata
+        ].sort((left, right)=>left.logicalPath.localeCompare(right.logicalPath)),
         surfaces
     };
 };
@@ -368,13 +395,7 @@ const createNodeStagedReleaseArtifactInputs = async (outputDirectory, identity)=
     ])if (0 === paths.length) throw new Error(`[ultramodern-release-envelope] final Node staging has no ${surface} artifacts.`);
     const clientExecutionPaths = await manifestReferencedClientModules(outputDirectory, files);
     const ssrExecutionPaths = await routeReferencedSsrModules(outputDirectory, files, 'node');
-    await assertEveryCompiledIdentityCarrier(outputDirectory, clientExecutionPaths, identity, 'final manifest-referenced Node UI/client');
-    await assertEveryCompiledIdentityCarrier(outputDirectory, ssrExecutionPaths, identity, 'final route-referenced Node SSR');
-    await assertEveryCompiledIdentityCarrier(outputDirectory, ssrPaths.filter((logicalPath)=>'index.js' !== logicalPath), identity, 'final compiled Node SSR closure');
-    await assertEveryCompiledIdentityCarrier(outputDirectory, apiBackendPaths.filter((logicalPath)=>logicalPath.startsWith('api/')), identity, 'final Node API/backend');
-    await assertEveryCompiledIdentityCarrier(outputDirectory, [
-        BACKEND_FEDERATION_REMOTE_ENTRY_FILE
-    ], identity, 'final Node backend Module Federation container');
+    if (0 === clientExecutionPaths.length || 0 === ssrExecutionPaths.length) throw new Error('[ultramodern-release-envelope] final Node manifests must reference emitted UI/client and SSR execution modules.');
     const runtimeByPath = new Map(files.filter((logicalPath)=>!backendFederationPaths.has(logicalPath)).map((logicalPath)=>[
             logicalPath,
             'nodejs-deployment'
@@ -384,10 +405,27 @@ const createNodeStagedReleaseArtifactInputs = async (outputDirectory, identity)=
     for (const logicalPath of apiBackendPaths)runtimeByPath.set(logicalPath, 'nodejs');
     runtimeByPath.set(BACKEND_FEDERATION_MANIFEST_FILE, 'module-federation-manifest');
     runtimeByPath.set(BACKEND_FEDERATION_REMOTE_ENTRY_FILE, 'nodejs');
+    const identityCarrierMetadata = await writeReleaseIdentityCarrierMetadata(outputDirectory, identity, {
+        apiBackend: apiBackendPaths,
+        backendFederation: [
+            BACKEND_FEDERATION_MANIFEST_FILE,
+            BACKEND_FEDERATION_REMOTE_ENTRY_FILE
+        ],
+        ssr: [
+            ...new Set([
+                ...ssrExecutionPaths,
+                ...ssrPaths.filter((logicalPath)=>'index.js' !== logicalPath)
+            ])
+        ],
+        uiClient: uiClientPaths.filter((logicalPath)=>COMPILED_MODULE_PATTERN.test(logicalPath))
+    });
     return {
         artifacts: [
-            ...runtimeByPath
-        ].map(([logicalPath, runtime])=>releaseArtifact(logicalPath, runtime)).sort((left, right)=>left.logicalPath.localeCompare(right.logicalPath)),
+            ...[
+                ...runtimeByPath
+            ].map(([logicalPath, runtime])=>releaseArtifact(logicalPath, runtime)),
+            identityCarrierMetadata
+        ].sort((left, right)=>left.logicalPath.localeCompare(right.logicalPath)),
         surfaces: {
             uiClient: [
                 ...uiClientPaths
@@ -461,13 +499,7 @@ const createCloudflareStagedReleaseArtifactInputs = async (outputDirectory, iden
     ])if (!files.includes(logicalPath)) throw new Error(`[ultramodern-release-envelope] final Cloudflare staging is missing ${logicalPath}.`);
     const clientExecutionPaths = await manifestReferencedClientModules(outputDirectory, files, 'public/mf-manifest.json');
     const ssrExecutionPaths = await routeReferencedSsrModules(outputDirectory, files, 'cloudflare', 'server/route.json');
-    await assertEveryCompiledIdentityCarrier(outputDirectory, clientExecutionPaths, identity, 'final manifest-referenced Cloudflare UI/client');
-    await assertEveryCompiledIdentityCarrier(outputDirectory, ssrExecutionPaths, identity, 'final route-referenced Cloudflare SSR');
-    await assertEveryCompiledIdentityCarrier(outputDirectory, ssrPaths.filter((logicalPath)=>logicalPath.startsWith('worker/')), identity, 'final compiled Cloudflare SSR/workerd closure');
-    await assertEveryCompiledIdentityCarrier(outputDirectory, apiBackendPaths, identity, 'final Cloudflare API/backend');
-    await assertEveryCompiledIdentityCarrier(outputDirectory, [
-        backendContainerPath
-    ], identity, 'final Cloudflare backend Module Federation container');
+    if (0 === clientExecutionPaths.length || 0 === ssrExecutionPaths.length) throw new Error('[ultramodern-release-envelope] final Cloudflare manifests must reference emitted UI/client and SSR execution modules.');
     const runtimeByPath = new Map();
     for (const logicalPath of files)runtimeByPath.set(logicalPath, 'cloudflare-deployment');
     const add = (paths, runtime)=>{
@@ -482,10 +514,27 @@ const createCloudflareStagedReleaseArtifactInputs = async (outputDirectory, iden
     add([
         backendContainerPath
     ], 'commonjs-module');
+    const identityCarrierMetadata = await writeReleaseIdentityCarrierMetadata(outputDirectory, identity, {
+        apiBackend: apiBackendPaths,
+        backendFederation: [
+            backendManifestPath,
+            backendContainerPath
+        ],
+        ssr: [
+            ...new Set([
+                ...ssrExecutionPaths,
+                ...ssrPaths.filter((logicalPath)=>logicalPath.startsWith('worker/'))
+            ])
+        ],
+        uiClient: uiClientPaths.filter((logicalPath)=>COMPILED_MODULE_PATTERN.test(logicalPath))
+    });
     return {
         artifacts: [
-            ...runtimeByPath
-        ].map(([logicalPath, runtime])=>releaseArtifact(logicalPath, runtime)).sort((left, right)=>left.logicalPath.localeCompare(right.logicalPath)),
+            ...[
+                ...runtimeByPath
+            ].map(([logicalPath, runtime])=>releaseArtifact(logicalPath, runtime)),
+            identityCarrierMetadata
+        ].sort((left, right)=>left.logicalPath.localeCompare(right.logicalPath)),
         surfaces: {
             uiClient: [
                 ...uiClientPaths
@@ -522,4 +571,4 @@ const verifyCloudflareReleaseEnvelopeStaging = async (outputDirectory)=>readFram
         expectedTarget: 'cloudflare',
         required: true
     });
-export { MICROVERTICAL_RELEASE_ENVELOPE_PATH, emitCloudflareStagedReleaseEnvelope, emitFrameworkMicroVerticalReleaseEnvelope, emitNodeStagedReleaseEnvelope, readFrameworkMicroVerticalReleaseEnvelope, stageCloudflareReleaseEnvelope, verifyBuildOutputReleaseEnvelope, verifyCloudflareReleaseEnvelopeStaging, verifyNodeReleaseEnvelopeStaging };
+export { MICROVERTICAL_RELEASE_ENVELOPE_PATH, MICROVERTICAL_RELEASE_IDENTITY_CARRIERS_PATH, emitCloudflareStagedReleaseEnvelope, emitFrameworkMicroVerticalReleaseEnvelope, emitNodeStagedReleaseEnvelope, readFrameworkMicroVerticalReleaseEnvelope, stageCloudflareReleaseEnvelope, verifyBuildOutputReleaseEnvelope, verifyCloudflareReleaseEnvelopeStaging, verifyNodeReleaseEnvelopeStaging };

package/dist/types/builder/generator/getBuilderEnvironments.d.ts

@@ -1,5 +1,34 @@
+import type { ModifyBundlerChainFn } from '@rsbuild/core';
 import type { AppNormalizedConfig } from '../../types';
 import type { AppToolsContext } from '../../types/plugin';
+export declare function getCloudflareWorkerRspackConfig(workerEntryNames: Iterable<string>): {
+    readonly experiments: {
+        readonly outputModule: true;
+    };
+    readonly externals: {
+        [k: string]: string;
+    };
+    readonly externalsType: 'module-import';
+    readonly module: {
+        readonly parser: {
+            readonly javascript: {
+                readonly dynamicImportMode: 'eager';
+            };
+        };
+    };
+    readonly optimization: {
+        readonly runtimeChunk: {
+            readonly name: string;
+        };
+        readonly splitChunks: {
+            readonly chunks: 'all';
+            readonly minSize: 0;
+            readonly name: string;
+        };
+    };
+};
+export declare function applyCloudflareWorkerRspackConfig(chain: Parameters<ModifyBundlerChainFn>[0], workerEntryNames: Iterable<string>): void;
+export declare function applyCloudflareWorkerMfRuntimeBoundary(chain: Parameters<ModifyBundlerChainFn>[0]): void;
 export declare function getBuilderEnvironments(normalizedConfig: AppNormalizedConfig, appContext: AppToolsContext, tempBuilderConfig: Omit<AppNormalizedConfig, 'plugins'>): {
     environments: Record<string, import("@rsbuild/core").EnvironmentConfig>;
     builderConfig: Omit<AppNormalizedConfig, "plugins">;

package/dist/types/plugins/deploy/platforms/cloudflare-output-verifier/worker-bundles.d.ts

@@ -16,5 +16,5 @@ interface WorkerBundleVerificationContract {
     workerRoot: string;
 }
 export declare const verifyWorkerBundleReferences: (issues: CloudflareOutputVerifierIssue[], worker: ResolvedWorkerBundleReference, source: string, contract: WorkerBundleVerificationContract) => Promise<void>;
-export declare const verifyWorkerImport: (issues: CloudflareOutputVerifierIssue[], entryPath: string) => Promise<void>;
+export declare const verifyWorkerImport: (issues: CloudflareOutputVerifierIssue[], entryPath: string, expectedManifest?: JsonObject) => Promise<void>;
 export {};

package/dist/types/plugins/deploy/platforms/templates/cloudflare-entry.001-bootstrap-security.d.mts

@@ -1 +1 @@
-export {};
+export declare const modernWorkerManifest: any;

package/dist/types/plugins/deploy/platforms/templates/cloudflare-worker-mf-ssr-runtime-plugin.d.mts

@@ -0,0 +1,13 @@
+/**
+ * Workerd cannot initialize Module Federation's Node-oriented SSR data-fetch
+ * runtime. Cloudflare workers do not load native MF remotes, so retain the
+ * runtime-plugin contract without installing its server data-fetch hooks.
+ */
+export declare const injectDataFetchFunctionPlugin: () => {
+    name: string;
+    setup(): void;
+};
+export declare const mfSSRDevPlugin: () => {
+    name: string;
+    setup(): void;
+};

package/dist/types/ultramodern-release-envelope/framework-output.d.ts

@@ -1,5 +1,6 @@
 import type { MicroVerticalReleaseArtifact, MicroVerticalReleaseEnvelope, MicroVerticalReleaseTarget } from './types';
 export declare const MICROVERTICAL_RELEASE_ENVELOPE_PATH = "release/microvertical-release-envelope.json";
+export declare const MICROVERTICAL_RELEASE_IDENTITY_CARRIERS_PATH = "release/microvertical-release-identity-carriers.json";
 export declare const emitFrameworkMicroVerticalReleaseEnvelope: ({ apiOnly, distDirectory, target, }: {
     apiOnly: boolean;
     distDirectory: string;