@bleedingdev/modern-js-app-tools 3.5.0-ultramodern.27 → 3.5.0-ultramodern.29

package/dist/esm-node/plugins/deploy/platforms/cloudflare-output-verifier.mjs

@@ -0,0 +1,348 @@
+import "node:module";
+import promises from "node:fs/promises";
+import node_path from "node:path";
+import { pathToFileURL } from "node:url";
+import { CLOUDFLARE_ASSETS_BINDING, CLOUDFLARE_PUBLIC_ASSETS_DIRECTORY, CLOUDFLARE_RUNTIME_TYPE, CLOUDFLARE_WORKER_BUNDLE_DIRECTORY, CLOUDFLARE_WORKER_ENTRY } from "./cloudflare-output-contract.mjs";
+import { createCloudflareOutputPlan } from "./cloudflare-output-plan.mjs";
+const SOURCE_SCAN_FILE_PATTERN = /\.(?:[cm]?[jt]s|json)$/u;
+const SOURCE_SCAN_IGNORED_DIRECTORY_NAMES = new Set([
+    '.codex',
+    '.fastcontext',
+    '.git',
+    '.mf',
+    '.modernjs',
+    '.output',
+    'coverage',
+    'dist',
+    'dist-cloudflare',
+    'node_modules',
+    'repos',
+    'topology'
+]);
+const FORBIDDEN_MUTATION_PATTERNS = [
+    {
+        code: 'forbidden-mutation-pattern',
+        message: "Generated Cloudflare server worker output must not be rewritten by app scripts.",
+        pattern: /\.output\/server\/index\.mjs/u
+    },
+    {
+        code: 'forbidden-mutation-pattern',
+        message: "Generated Cloudflare server worker output must not be rewritten by app scripts.",
+        pattern: /path\.join\(\s*['"`]\.output['"`]\s*,\s*['"`]server['"`]\s*,\s*['"`]index\.mjs['"`]\s*\)/u
+    },
+    {
+        code: 'forbidden-mutation-pattern',
+        message: "Generated Cloudflare BFF worker bundles must not be rewritten by app scripts.",
+        pattern: /\.output\/worker\/[^'"`]*\.(?:mjs|cjs|js)/u
+    },
+    {
+        code: 'forbidden-mutation-pattern',
+        message: "Generated Cloudflare BFF worker bundles must not be rewritten by app scripts.",
+        pattern: /path\.join\(\s*['"`]\.output['"`]\s*,\s*['"`]worker['"`]\s*,\s*['"`][^'"`]+\.(?:mjs|cjs|js)['"`]\s*\)/u
+    },
+    {
+        code: 'forbidden-mutation-pattern',
+        message: "Drizzle entityKind worker bundle markers must be fixed in the framework toolchain, not post-build scripts.",
+        pattern: /replaceAll\(\s*['"`];entityKind(?:,entityKind)?;/u
+    },
+    {
+        code: 'forbidden-mutation-pattern',
+        message: "Effect BFF Cloudflare dispatch must not depend on duck-typed runtime helper probing in app scripts.",
+        pattern: /(?:typeof\s+[^;\n]*dispatchEffectBffRequest|['"`]dispatchEffectBffRequest['"`]\s+in\s+|\.dispatchEffectBffRequest\b)/u
+    },
+    {
+        code: 'forbidden-mutation-pattern',
+        message: "Effect BFF Cloudflare dispatch must not branch on handler.length in app scripts.",
+        pattern: /\bhandler\s*\.\s*length\b/u
+    }
+];
+const pathExists = async (filePath)=>{
+    try {
+        await promises.access(filePath);
+        return true;
+    } catch  {
+        return false;
+    }
+};
+const readJson = async (filePath)=>JSON.parse(await promises.readFile(filePath, 'utf-8'));
+const addIssue = (issues, issue)=>{
+    issues.push(issue);
+};
+const assertEqual = (issues, actual, expected, issue)=>{
+    if (actual !== expected) addIssue(issues, issue);
+};
+const assertFlag = (issues, flags, flag, issue)=>{
+    if (!Array.isArray(flags) || !flags.includes(flag)) addIssue(issues, issue);
+};
+const getReferencedRouteWorkers = (manifest)=>Array.isArray(manifest?.routeSpec?.routes) ? manifest.routeSpec.routes.map((route)=>'string' == typeof route?.worker && route.worker.length > 0 ? route.worker : void 0).filter((worker)=>'string' == typeof worker) : [];
+const getEffectBffWorker = (manifest)=>manifest?.bff?.runtimeFramework === 'effect' && 'string' == typeof manifest.bff.worker ? manifest.bff.worker : void 0;
+const getWorkerBundleReferences = (manifest)=>{
+    const effectBffWorker = getEffectBffWorker(manifest);
+    return [
+        ...effectBffWorker ? [
+            {
+                kind: 'effect-bff',
+                reference: effectBffWorker
+            }
+        ] : [],
+        ...getReferencedRouteWorkers(manifest).map((reference)=>({
+                kind: 'route',
+                reference
+            }))
+    ];
+};
+const resolveWorkerBundleReference = (issues, outputDirectory, reference, manifestPath)=>{
+    const workerRoot = node_path.resolve(outputDirectory, CLOUDFLARE_WORKER_BUNDLE_DIRECTORY);
+    const workerPath = node_path.resolve(outputDirectory, reference.reference);
+    const relativeToWorkerRoot = node_path.relative(workerRoot, workerPath);
+    if (node_path.isAbsolute(reference.reference) || relativeToWorkerRoot.startsWith('..') || node_path.isAbsolute(relativeToWorkerRoot)) {
+        addIssue(issues, {
+            code: 'invalid-manifest',
+            message: 'Cloudflare output manifest worker bundle references must stay under worker/.',
+            path: manifestPath
+        });
+        return null;
+    }
+    return {
+        ...reference,
+        path: workerPath
+    };
+};
+const missingWorkerBundleMessage = (reference)=>'effect-bff' === reference.kind ? 'Cloudflare Effect BFF manifest points to a missing worker bundle.' : 'Cloudflare route worker manifest points to a missing worker bundle.';
+const DELIVERY_UNIT_IDENTITY_FIELDS = [
+    'unitId',
+    'buildMarker',
+    'sourceRevision'
+];
+const verifyDeliveryUnitIdentity = (issues, manifest, manifestPath, declared)=>{
+    const stamped = manifest?.deliveryUnit;
+    const hasStamp = Boolean(stamped) && 'object' == typeof stamped;
+    if (declared) {
+        if (!hasStamp) return void addIssue(issues, {
+            code: 'missing-delivery-unit',
+            message: `Cloudflare worker manifest is missing the delivery-unit identity declared by the workspace topology (expected unitId ${declared.unitId}, buildMarker ${declared.buildMarker}).`,
+            path: manifestPath
+        });
+        for (const field of DELIVERY_UNIT_IDENTITY_FIELDS)assertEqual(issues, stamped[field], declared[field], {
+            code: 'delivery-unit-drift',
+            message: `Cloudflare worker manifest deliveryUnit.${field} must match the topology delivery-unit record (expected ${declared[field]}, received ${stamped[field] ?? 'undefined'}).`,
+            path: manifestPath
+        });
+    }
+    if (hasStamp && stamped.surfaces && 'object' == typeof stamped.surfaces) for (const surface of [
+        'ui',
+        'api'
+    ]){
+        const marker = stamped.surfaces[surface];
+        if (!marker || 'object' != typeof marker) {
+            addIssue(issues, {
+                code: 'missing-delivery-unit',
+                message: `Cloudflare worker manifest is missing the ${surface} delivery-unit surface marker.`,
+                path: manifestPath
+            });
+            continue;
+        }
+        for (const field of DELIVERY_UNIT_IDENTITY_FIELDS)assertEqual(issues, marker[field], stamped[field], {
+            code: 'delivery-unit-drift',
+            message: `Cloudflare worker manifest ${surface} surface deliveryUnit.${field} must derive from one delivery-unit record (expected ${stamped[field] ?? 'undefined'}, received ${marker[field] ?? 'undefined'}).`,
+            path: manifestPath
+        });
+    }
+};
+const verifyManifestShape = (issues, manifest, manifestPath)=>{
+    assertEqual(issues, manifest.runtime?.type, CLOUDFLARE_RUNTIME_TYPE, {
+        code: 'invalid-manifest',
+        message: 'Cloudflare output manifest runtime.type must be cloudflare-module-worker.',
+        path: manifestPath
+    });
+    assertEqual(issues, manifest.runtime?.entry, CLOUDFLARE_WORKER_ENTRY, {
+        code: 'invalid-manifest',
+        message: `Cloudflare output manifest runtime.entry must be ${CLOUDFLARE_WORKER_ENTRY}.`,
+        path: manifestPath
+    });
+    assertEqual(issues, manifest.runtime?.fetchExport, true, {
+        code: 'invalid-manifest',
+        message: 'Cloudflare output manifest runtime.fetchExport must be true.',
+        path: manifestPath
+    });
+    assertEqual(issues, manifest.runtime?.nodeListen, false, {
+        code: 'invalid-manifest',
+        message: 'Cloudflare output manifest runtime.nodeListen must be false.',
+        path: manifestPath
+    });
+    assertEqual(issues, manifest.assets?.binding, CLOUDFLARE_ASSETS_BINDING, {
+        code: 'invalid-manifest',
+        message: 'Cloudflare output manifest assets.binding must be ASSETS.',
+        path: manifestPath
+    });
+    assertEqual(issues, manifest.assets?.directory, `./${CLOUDFLARE_PUBLIC_ASSETS_DIRECTORY}`, {
+        code: 'invalid-manifest',
+        message: 'Cloudflare output manifest assets.directory must be ./public.',
+        path: manifestPath
+    });
+    assertEqual(issues, manifest.assets?.runWorkerFirst, true, {
+        code: 'invalid-manifest',
+        message: 'Cloudflare output manifest assets.runWorkerFirst must be true.',
+        path: manifestPath
+    });
+};
+const walkFiles = async (root)=>{
+    if (!await pathExists(root)) return [];
+    const entries = await promises.readdir(root, {
+        withFileTypes: true
+    });
+    const files = [];
+    for (const entry of entries){
+        if (SOURCE_SCAN_IGNORED_DIRECTORY_NAMES.has(entry.name)) continue;
+        const entryPath = node_path.join(root, entry.name);
+        if (entry.isDirectory()) {
+            files.push(...await walkFiles(entryPath));
+            continue;
+        }
+        if (SOURCE_SCAN_FILE_PATTERN.test(entry.name)) files.push(entryPath);
+    }
+    return files;
+};
+const verifyCloudflareOutputMutationPolicy = async (options)=>{
+    const issues = [];
+    const files = (await Promise.all(options.scanRoots.map((scanRoot)=>walkFiles(node_path.resolve(scanRoot))))).flat();
+    for (const file of files){
+        const source = await promises.readFile(file, 'utf-8');
+        for (const forbidden of FORBIDDEN_MUTATION_PATTERNS)if (forbidden.pattern.test(source)) addIssue(issues, {
+            code: forbidden.code,
+            message: forbidden.message,
+            path: file
+        });
+    }
+    return {
+        ok: 0 === issues.length,
+        issues
+    };
+};
+const verifyWorkerImport = async (issues, entryPath)=>{
+    try {
+        const worker = (await import(`${pathToFileURL(entryPath).href}?t=${Date.now()}`)).default;
+        if (!worker || 'function' != typeof worker.fetch) addIssue(issues, {
+            code: 'worker-import-failed',
+            message: 'Cloudflare server entry must default-export a Worker with fetch.',
+            path: entryPath
+        });
+    } catch (error) {
+        addIssue(issues, {
+            code: 'worker-import-failed',
+            message: `Cloudflare server entry could not be imported: ${error instanceof Error ? error.message : String(error)}`,
+            path: entryPath
+        });
+    }
+};
+const verifyCloudflareOutput = async (options)=>{
+    const outputDirectory = node_path.resolve(options.outputDirectory);
+    const issues = [];
+    const outputPlan = createCloudflareOutputPlan(outputDirectory);
+    for (const relativePath of outputPlan.requiredFiles){
+        const filePath = node_path.join(outputDirectory, relativePath);
+        if (!await pathExists(filePath)) addIssue(issues, {
+            code: 'missing-file',
+            message: `Cloudflare output is missing ${relativePath}.`,
+            path: filePath
+        });
+    }
+    const manifestPath = outputPlan.paths.workerManifest;
+    const wranglerPath = outputPlan.paths.wranglerConfig;
+    const packagePath = outputPlan.paths.outputPackage;
+    const workerPackagePath = outputPlan.paths.workerPackage;
+    const manifest = await pathExists(manifestPath) ? await readJson(manifestPath) : void 0;
+    const wrangler = await pathExists(wranglerPath) ? await readJson(wranglerPath) : void 0;
+    const outputPackage = await pathExists(packagePath) ? await readJson(packagePath) : void 0;
+    const workerPackage = await pathExists(workerPackagePath) ? await readJson(workerPackagePath) : void 0;
+    if (manifest) {
+        verifyManifestShape(issues, manifest, manifestPath);
+        verifyDeliveryUnitIdentity(issues, manifest, manifestPath, options.deliveryUnit);
+        const workerReferences = getWorkerBundleReferences(manifest);
+        if (workerReferences.length > 0 && !await pathExists(workerPackagePath)) addIssue(issues, {
+            code: 'missing-file',
+            message: 'Cloudflare output is missing worker/package.json for referenced worker bundles.',
+            path: workerPackagePath
+        });
+        if (manifest.bff?.runtimeFramework === 'effect' && !getEffectBffWorker(manifest)) addIssue(issues, {
+            code: 'missing-worker-bundle',
+            message: 'Cloudflare Effect BFF manifest points to a missing worker bundle.'
+        });
+        for (const workerReference of workerReferences){
+            const resolvedWorker = resolveWorkerBundleReference(issues, outputDirectory, workerReference, manifestPath);
+            if (!resolvedWorker) continue;
+            const workerExists = await pathExists(resolvedWorker.path);
+            if (!workerExists) addIssue(issues, {
+                code: 'missing-worker-bundle',
+                message: missingWorkerBundleMessage(workerReference),
+                path: resolvedWorker.path
+            });
+            if (workerExists && 'effect-bff' === resolvedWorker.kind) {
+                const workerSource = await promises.readFile(resolvedWorker.path, 'utf-8');
+                if (workerSource.includes(';entityKind;') || workerSource.includes(';entityKind,entityKind;')) addIssue(issues, {
+                    code: 'invalid-worker-bundle',
+                    message: 'Cloudflare Effect BFF worker bundle contains invalid Drizzle entityKind marker references.',
+                    path: resolvedWorker.path
+                });
+            }
+        }
+    }
+    if (wrangler) {
+        assertEqual(issues, wrangler.main, outputPlan.wrangler.main, {
+            code: 'invalid-wrangler',
+            message: `wrangler.json main must be ${outputPlan.wrangler.main}.`,
+            path: wranglerPath
+        });
+        assertEqual(issues, wrangler.assets?.binding, outputPlan.wrangler.assets.binding, {
+            code: 'invalid-wrangler',
+            message: 'wrangler.json assets.binding must be ASSETS.',
+            path: wranglerPath
+        });
+        assertEqual(issues, wrangler.assets?.directory, outputPlan.wrangler.assets.directory, {
+            code: 'invalid-wrangler',
+            message: 'wrangler.json assets.directory must be ./public.',
+            path: wranglerPath
+        });
+        assertEqual(issues, wrangler.assets?.run_worker_first, outputPlan.wrangler.assets.run_worker_first, {
+            code: 'invalid-wrangler',
+            message: 'wrangler.json assets.run_worker_first must be true.',
+            path: wranglerPath
+        });
+        for (const flag of outputPlan.wrangler.requiredCompatibilityFlags)assertFlag(issues, wrangler.compatibility_flags, flag, {
+            code: 'invalid-wrangler',
+            message: `wrangler.json compatibility_flags must include ${flag}.`,
+            path: wranglerPath
+        });
+    }
+    if (outputPackage) assertEqual(issues, outputPackage.type, outputPlan.packages.output.type, {
+        code: 'invalid-package',
+        message: '.output/package.json must declare type module.',
+        path: packagePath
+    });
+    if (workerPackage) assertEqual(issues, workerPackage.type, outputPlan.packages.worker.type, {
+        code: 'invalid-package',
+        message: '.output/worker/package.json must declare type commonjs.',
+        path: workerPackagePath
+    });
+    for (const leakedPath of outputPlan.publicLeakDirectories){
+        const publicPath = node_path.join(outputPlan.paths.publicAssets, leakedPath);
+        if (await pathExists(publicPath)) addIssue(issues, {
+            code: 'public-output-leak',
+            message: `Framework-owned ${leakedPath} output leaked into public assets.`,
+            path: publicPath
+        });
+    }
+    if (false !== options.importWorker && await pathExists(outputPlan.paths.workerEntry)) await verifyWorkerImport(issues, outputPlan.paths.workerEntry);
+    return {
+        ok: 0 === issues.length,
+        issues
+    };
+};
+const assertCloudflareOutput = async (options)=>{
+    const result = await verifyCloudflareOutput(options);
+    if (!result.ok) throw new Error([
+        'Cloudflare output verification failed:',
+        ...result.issues.map((issue)=>`- ${issue.code}: ${issue.message}${issue.path ? ` (${issue.path})` : ''}`)
+    ].join('\n'));
+};
+export { assertCloudflareOutput, verifyCloudflareOutput, verifyCloudflareOutputMutationPolicy };

package/dist/esm-node/plugins/deploy/platforms/cloudflare.mjs

@@ -2,17 +2,19 @@ import "node:module";
 import node_path from "node:path";
 import { fs } from "@modern-js/utils";
 import { readTemplate } from "../utils/index.mjs";
-const WORKER_ENTRY = 'server/index.mjs';
-const WORKER_MANIFEST = 'server/modern-worker-manifest.json';
-const WRANGLER_CONFIG_FILE = 'wrangler.json';
-const OUTPUT_PACKAGE_FILE = 'package.json';
-const ASSETS_BINDING = 'ASSETS';
+import { CLOUDFLARE_ASSETS_BINDING, CLOUDFLARE_OUTPUT_PACKAGE_FILE, CLOUDFLARE_PUBLIC_ASSETS_DIRECTORY, CLOUDFLARE_REQUIRED_COMPATIBILITY_FLAGS, CLOUDFLARE_RUNTIME_TYPE, CLOUDFLARE_WORKER_BUNDLE_DIRECTORY, CLOUDFLARE_WORKER_BUNDLE_FORMAT, CLOUDFLARE_WORKER_ENTRY, CLOUDFLARE_WRANGLER_CONFIG_FILE } from "./cloudflare-output-contract.mjs";
+import { createCloudflareOutputPlan } from "./cloudflare-output-plan.mjs";
+import { assertCloudflareOutput } from "./cloudflare-output-verifier.mjs";
+const WORKER_ENTRY = CLOUDFLARE_WORKER_ENTRY;
+const WRANGLER_CONFIG_FILE = CLOUDFLARE_WRANGLER_CONFIG_FILE;
+const OUTPUT_PACKAGE_FILE = CLOUDFLARE_OUTPUT_PACKAGE_FILE;
+const ASSETS_BINDING = CLOUDFLARE_ASSETS_BINDING;
 const ROUTE_SPEC_FILE = 'route.json';
 const ROUTE_SPEC_OUTPUT = `server/${ROUTE_SPEC_FILE}`;
 const LOADABLE_STATS_FILE = 'loadable-stats.json';
 const ROUTE_MANIFEST_FILE = 'routes-manifest.json';
-const PUBLIC_ASSETS_DIRECTORY = 'public';
-const WORKER_BUNDLE_DIRECTORY = 'worker';
+const PUBLIC_ASSETS_DIRECTORY = CLOUDFLARE_PUBLIC_ASSETS_DIRECTORY;
+const WORKER_BUNDLE_DIRECTORY = CLOUDFLARE_WORKER_BUNDLE_DIRECTORY;
 const SERVER_BUNDLE_DIRECTORY = 'bundles';
 const SERVER_OUTPUT_DIRECTORY = 'server';
 const DEFAULT_SERVER_ONLY_PUBLIC_ASSET_EXCLUDES = [
@@ -23,10 +25,7 @@ const BFF_EFFECT_WORKER_ENTRY = `${WORKER_BUNDLE_DIRECTORY}/__modern_bff_effect.
 const EFFECT_BFF_CLOUDFLARE_IMPORT_GUIDANCE = 'Ensure the Effect API entry exists at api/index.ts or bff.effect.entry, and import Cloudflare edge handlers from @modern-js/plugin-bff/effect-edge instead of lambda/Hono server helpers.';
 const DEFAULT_COMPATIBILITY_DATE = '2026-06-02';
 const COMPATIBILITY_DATE_PATTERN = /^\d{4}-\d{2}-\d{2}$/u;
-const REQUIRED_COMPATIBILITY_FLAGS = [
-    'nodejs_compat',
-    'global_fetch_strictly_public'
-];
+const REQUIRED_COMPATIBILITY_FLAGS = CLOUDFLARE_REQUIRED_COMPATIBILITY_FLAGS;
 const RESERVED_ARTIFACT_DESTINATION_FILES = new Set([
     WRANGLER_CONFIG_FILE,
     OUTPUT_PACKAGE_FILE
@@ -220,11 +219,12 @@ const getConfiguredWorkerName = (appDirectory, modernConfig)=>{
     const configuredName = modernConfig.deploy?.worker?.name?.trim();
     return configuredName || getWorkerName(appDirectory);
 };
-const normalizeRelativePath = (value, label, scope = 'app output')=>{
+const normalizeRelativePath = (value, label, scope = 'app output', options = {})=>{
     if ('string' != typeof value) throw new Error(`${label} must be a relative path inside the ${scope}.`);
     const normalized = value.trim().replace(/\\/g, '/').replace(/^\.\/+/u, '').replace(/\/+$/u, '');
     const segments = normalized.split('/');
-    if (!normalized || node_path.isAbsolute(normalized) || '.' === normalized || segments.includes('..')) throw new Error(`${label} must be a relative path inside the ${scope}.`);
+    const isRootDestination = '.' === normalized;
+    if (!normalized || node_path.isAbsolute(normalized) || !options.allowRoot && isRootDestination || segments.includes('..')) throw new Error(`${label} must be a relative path inside the ${scope}.`);
     return normalized;
 };
 const normalizeDirectiveValues = (value)=>{
@@ -379,9 +379,48 @@ const createWranglerD1Databases = (modernConfig, configuredWranglerD1)=>{
     if (!Array.isArray(d1Databases)) throw new Error('deploy.worker.d1Databases must be an array.');
     return d1Databases.map(normalizeD1Database);
 };
+const normalizeServiceBinding = (service, index)=>{
+    const binding = assertNonEmptyString(service.binding, `deploy.worker.services[${index}].binding`);
+    const serviceName = assertNonEmptyString(service.service, `deploy.worker.services[${index}].service`);
+    const prefix = void 0 === service.prefix ? void 0 : assertNonEmptyString(service.prefix, `deploy.worker.services[${index}].prefix`);
+    return {
+        binding,
+        service: serviceName,
+        ...void 0 === prefix ? {} : {
+            prefix
+        }
+    };
+};
+const createWorkerServiceBindings = (modernConfig, configuredWranglerServices)=>{
+    const services = modernConfig.deploy?.worker?.services;
+    if (void 0 === services) return configuredWranglerServices;
+    if (void 0 !== configuredWranglerServices) throw new Error('Use deploy.worker.services or deploy.worker.wrangler.services, not both.');
+    if (!Array.isArray(services)) throw new Error('deploy.worker.services must be an array.');
+    return services.map(normalizeServiceBinding);
+};
+const createWranglerServices = (serviceBindings)=>{
+    if (!Array.isArray(serviceBindings)) return serviceBindings;
+    if (!serviceBindings.every(isJsonRecord)) return serviceBindings;
+    return serviceBindings.map((service)=>{
+        const { prefix, ...wranglerService } = service;
+        return wranglerService;
+    });
+};
+const createWorkerManifestServiceBindings = (serviceBindings)=>{
+    if (!Array.isArray(serviceBindings)) return;
+    const dispatchBindings = serviceBindings.filter((service)=>isJsonRecord(service) && 'string' == typeof service.binding && 'string' == typeof service.service && 'string' == typeof service.prefix).map((service)=>({
+            binding: service.binding,
+            service: service.service,
+            prefix: service.prefix,
+            interface: 'fetch'
+        }));
+    return dispatchBindings.length > 0 ? dispatchBindings : void 0;
+};
 const createWranglerConfig = (appDirectory, modernConfig)=>{
     const wrangler = getConfiguredWrangler(modernConfig);
     const d1Databases = createWranglerD1Databases(modernConfig, wrangler.d1_databases);
+    const serviceBindings = createWorkerServiceBindings(modernConfig, wrangler.services);
+    const wranglerServices = createWranglerServices(serviceBindings);
     return {
         $schema: 'node_modules/wrangler/config-schema.json',
         name: getConfiguredWorkerName(appDirectory, modernConfig),
@@ -392,6 +431,9 @@ const createWranglerConfig = (appDirectory, modernConfig)=>{
         assets: createWranglerAssetsConfig(wrangler.assets),
         ...void 0 === d1Databases ? {} : {
             d1_databases: d1Databases
+        },
+        ...void 0 === wranglerServices ? {} : {
+            services: wranglerServices
         }
     };
 };
@@ -410,7 +452,9 @@ const normalizeCloudflareArtifact = (artifact, index)=>{
 const getCloudflareArtifacts = (modernConfig)=>(modernConfig.deploy?.worker?.artifacts ?? []).map(normalizeCloudflareArtifact);
 const normalizeCloudflarePublicAsset = (asset, index)=>{
     const from = normalizeRelativePath(asset.from, `deploy.worker.publicAssets[${index}].from`, 'app root');
-    const to = normalizeRelativePath(asset.to, `deploy.worker.publicAssets[${index}].to`, 'Cloudflare public output');
+    const to = normalizeRelativePath(asset.to, `deploy.worker.publicAssets[${index}].to`, 'Cloudflare public output', {
+        allowRoot: true
+    });
     return {
         from,
         to,
@@ -452,8 +496,79 @@ const readRouteSpec = async (outputDirectory)=>{
         routes: Array.isArray(routeSpec.routes) ? routeSpec.routes : []
     };
 };
+const COMPACT_CONFIG_PATH = '.modernjs/ultramodern.json';
+const ULTRAMODERN_BUILD_MODULE = 'shared/ultramodern-build.ts';
+const nonEmptyString = (value)=>'string' == typeof value && value.length > 0 ? value : void 0;
+const toDeliveryUnitIdentity = (value)=>{
+    if (!isRecord(value)) return;
+    const unitId = nonEmptyString(value.unitId);
+    const buildMarker = nonEmptyString(value.buildMarker);
+    const sourceRevision = nonEmptyString(value.sourceRevision);
+    if (!unitId || !buildMarker || !sourceRevision) return;
+    return {
+        unitId,
+        buildMarker,
+        sourceRevision
+    };
+};
+const findWorkspaceRoot = async (appDirectory)=>{
+    let current = node_path.resolve(appDirectory);
+    for(;;){
+        if (await fs.pathExists(node_path.join(current, COMPACT_CONFIG_PATH))) return current;
+        const parent = node_path.dirname(current);
+        if (parent === current) return;
+        current = parent;
+    }
+};
+const resolveTopologyDeliveryUnit = async (appDirectory)=>{
+    const workspaceRoot = await findWorkspaceRoot(appDirectory);
+    if (!workspaceRoot) return;
+    let compactConfig;
+    try {
+        compactConfig = await fs.readJSON(node_path.join(workspaceRoot, COMPACT_CONFIG_PATH));
+    } catch  {
+        return;
+    }
+    if (!isRecord(compactConfig)) return;
+    const topology = isRecord(compactConfig.topology) ? compactConfig.topology : void 0;
+    const apps = Array.isArray(topology?.apps) ? topology.apps : [];
+    const resolvedAppDirectory = node_path.resolve(appDirectory);
+    for (const app of apps){
+        if (!isRecord(app)) continue;
+        const appPath = nonEmptyString(app.path);
+        if (appPath && node_path.resolve(workspaceRoot, appPath.replace(/^\.\/+/u, '')) === resolvedAppDirectory) return toDeliveryUnitIdentity(app.deliveryUnit);
+    }
+    return toDeliveryUnitIdentity(compactConfig.deliveryUnit);
+};
+const resolveWorkerDeliveryUnitStamp = async (appDirectory)=>{
+    const buildModulePath = node_path.join(appDirectory, ULTRAMODERN_BUILD_MODULE);
+    if (!await fs.pathExists(buildModulePath)) return;
+    const source = await fs.readFile(buildModulePath, 'utf8');
+    const buildMarker = source.match(/\bbuild:\s*['"]([^'"]+)['"]/u)?.[1];
+    const unitId = source.match(/\bunitId:\s*['"]([^'"]+)['"]/u)?.[1];
+    const sourceRevision = source.match(/\bsourceRevision:\s*['"]([^'"]+)['"]/u)?.[1];
+    if (!buildMarker || !unitId || !sourceRevision) return;
+    const identity = {
+        unitId,
+        buildMarker,
+        sourceRevision
+    };
+    return {
+        ...identity,
+        surfaces: {
+            ui: {
+                ...identity,
+                surface: 'ui'
+            },
+            api: {
+                ...identity,
+                surface: 'api'
+            }
+        }
+    };
+};
 const createMissingEffectBffWorkerError = (outputDirectory, worker)=>new Error(`Cloudflare Effect API runtime is configured, but the BFF worker bundle is missing: ${node_path.join(outputDirectory, worker)}. ${EFFECT_BFF_CLOUDFLARE_IMPORT_GUIDANCE}`);
-const createWorkerManifest = async (outputDirectory, modernConfig, appContext)=>{
+const createWorkerManifest = async (outputDirectory, modernConfig, appContext, deliveryUnitStamp)=>{
     const routeSpec = await readRouteSpec(outputDirectory);
     const routes = await Promise.all(routeSpec.routes.map(async (route)=>{
         const worker = 'string' == typeof route.worker ? route.worker : void 0;
@@ -470,11 +585,12 @@ const createWorkerManifest = async (outputDirectory, modernConfig, appContext)=>
     const primaryBffPrefix = Array.isArray(bffPrefix) ? bffPrefix[0] : bffPrefix;
     const isEffectApi = Boolean(modernConfig.bff) && modernConfig.bff?.runtimeFramework !== 'hono';
     const effectApiWorkerExists = await fs.pathExists(node_path.join(outputDirectory, BFF_EFFECT_WORKER_ENTRY));
+    const serviceBindings = createWorkerManifestServiceBindings(createWorkerServiceBindings(modernConfig, void 0));
     if (isEffectApi && primaryBffPrefix && !effectApiWorkerExists) throw createMissingEffectBffWorkerError(outputDirectory, BFF_EFFECT_WORKER_ENTRY);
     return {
         version: 1,
         runtime: {
-            type: 'cloudflare-module-worker',
+            type: CLOUDFLARE_RUNTIME_TYPE,
             entry: WORKER_ENTRY,
             fetchExport: true,
             nodeListen: false
@@ -490,7 +606,7 @@ const createWorkerManifest = async (outputDirectory, modernConfig, appContext)=>
         },
         workerBundles: {
             directory: WORKER_BUNDLE_DIRECTORY,
-            format: 'commonjs',
+            format: CLOUDFLARE_WORKER_BUNDLE_FORMAT,
             importableFromModuleWorker: true,
             requestHandlerExport: 'requestHandler'
         },
@@ -499,12 +615,18 @@ const createWorkerManifest = async (outputDirectory, modernConfig, appContext)=>
             routeManifest: ROUTE_MANIFEST_FILE
         },
         security: createCloudflareWorkerSecurityPolicy(modernConfig),
+        ...deliveryUnitStamp ? {
+            deliveryUnit: deliveryUnitStamp
+        } : {},
         i18n: createI18nWorkerManifest(routeSpec, appContext),
         bff: isEffectApi && primaryBffPrefix && effectApiWorkerExists ? {
             runtimeFramework: 'effect',
             prefix: primaryBffPrefix,
             worker: BFF_EFFECT_WORKER_ENTRY
-        } : void 0
+        } : void 0,
+        ...void 0 === serviceBindings ? {} : {
+            serviceBindings
+        }
     };
 };
 const createWorkerModuleLoaders = (manifest)=>{
@@ -556,11 +678,12 @@ const shouldCopyToWorkerBundle = (src, workerBundleDirectory)=>{
 const createCloudflarePreset = ({ appContext, modernConfig })=>{
     const { appDirectory, distDirectory } = appContext;
     const outputDirectory = node_path.join(appDirectory, '.output');
-    const publicDirectory = node_path.join(outputDirectory, PUBLIC_ASSETS_DIRECTORY);
-    const workerEntryPath = node_path.join(outputDirectory, WORKER_ENTRY);
-    const workerManifestPath = node_path.join(outputDirectory, WORKER_MANIFEST);
+    const outputPlan = createCloudflareOutputPlan(outputDirectory);
+    const publicDirectory = outputPlan.paths.publicAssets;
+    const workerEntryPath = outputPlan.paths.workerEntry;
+    const workerManifestPath = outputPlan.paths.workerManifest;
     const routeSpecOutputPath = node_path.join(outputDirectory, ROUTE_SPEC_OUTPUT);
-    const wranglerConfigPath = node_path.join(outputDirectory, WRANGLER_CONFIG_FILE);
+    const wranglerConfigPath = outputPlan.paths.wranglerConfig;
     const cloudflareArtifacts = getCloudflareArtifacts(modernConfig);
     const publicAssetExcludes = getPublicAssetExcludes(appDirectory, modernConfig);
     return {
@@ -576,14 +699,12 @@ const createCloudflarePreset = ({ appContext, modernConfig })=>{
             const routeSpecSourcePath = node_path.join(distDirectory, ROUTE_SPEC_FILE);
             if (await fs.pathExists(routeSpecSourcePath)) await fs.copy(routeSpecSourcePath, routeSpecOutputPath);
             const workerBundleSourceDirectory = node_path.join(distDirectory, WORKER_BUNDLE_DIRECTORY);
-            const workerBundleOutputDirectory = node_path.join(outputDirectory, WORKER_BUNDLE_DIRECTORY);
+            const workerBundleOutputDirectory = outputPlan.paths.workerBundle;
             if (await fs.pathExists(workerBundleSourceDirectory)) {
                 await fs.copy(workerBundleSourceDirectory, workerBundleOutputDirectory, {
                     filter: (src)=>shouldCopyToWorkerBundle(src, workerBundleSourceDirectory)
                 });
-                await fs.writeJSON(node_path.join(workerBundleOutputDirectory, 'package.json'), {
-                    type: 'commonjs'
-                });
+                await fs.writeJSON(outputPlan.paths.workerPackage, outputPlan.packages.worker);
             }
             await copyCloudflareArtifacts(appDirectory, outputDirectory, cloudflareArtifacts);
             await copyCloudflarePublicAssets(appDirectory, publicDirectory, getCloudflarePublicAssets(modernConfig));
@@ -591,17 +712,24 @@ const createCloudflarePreset = ({ appContext, modernConfig })=>{
             await fs.writeJSON(wranglerConfigPath, createWranglerConfig(appDirectory, modernConfig), {
                 spaces: 2
             });
-            await fs.writeJSON(workerManifestPath, await createWorkerManifest(outputDirectory, modernConfig, appContext), {
+            const deliveryUnitStamp = await resolveWorkerDeliveryUnitStamp(appDirectory);
+            await fs.writeJSON(workerManifestPath, await createWorkerManifest(outputDirectory, modernConfig, appContext, deliveryUnitStamp), {
                 spaces: 2
             });
-            await fs.writeJSON(node_path.join(outputDirectory, OUTPUT_PACKAGE_FILE), {
-                type: 'module'
-            });
+            await fs.writeJSON(outputPlan.paths.outputPackage, outputPlan.packages.output);
         },
         async genEntry () {
             const template = await readTemplate('cloudflare-entry.mjs');
             const manifest = await fs.readJSON(workerManifestPath);
             await fs.writeFile(workerEntryPath, template.replace('p_workerManifest', JSON.stringify(manifest, null, 2)).replace('p_workerModuleLoaders', createWorkerModuleLoaders(manifest)));
+            const topologyDeliveryUnit = await resolveTopologyDeliveryUnit(appDirectory);
+            await assertCloudflareOutput({
+                outputDirectory,
+                importWorker: false,
+                ...topologyDeliveryUnit ? {
+                    deliveryUnit: topologyDeliveryUnit
+                } : {}
+            });
         }
     };
 };