@bleedingdev/modern-js-app-tools 3.5.0-ultramodern.3 → 3.5.0-ultramodern.31

package/dist/esm-node/plugins/deploy/platforms/cloudflare/index.mjs

@@ -0,0 +1,79 @@
+import "node:module";
+import node_path from "node:path";
+import { fs } from "@modern-js/utils";
+import { readTemplate } from "../../utils/index.mjs";
+import { createCloudflareOutputPlan } from "../cloudflare-output-plan.mjs";
+import { assertCloudflareOutput } from "../cloudflare-output-verifier.mjs";
+import { copyCloudflareArtifacts, copyCloudflareD1Migrations, copyCloudflarePublicAssets, getCloudflareArtifacts, getCloudflarePublicAssets } from "./artifacts.mjs";
+import { ROUTE_SPEC_FILE, ROUTE_SPEC_OUTPUT, WORKER_BUNDLE_DIRECTORY } from "./constants.mjs";
+import { resolveTopologyDeliveryUnit, resolveWorkerDeliveryUnitStamp } from "./delivery-unit.mjs";
+import { createWorkerManifest, createWorkerModuleLoaders, getPublicAssetExcludes, shouldCopyToPublicAssets, shouldCopyToWorkerBundle } from "./worker-manifest.mjs";
+import { createWranglerConfig } from "./wrangler-config.mjs";
+const CLOUDFLARE_ENTRY_TEMPLATE_FRAGMENTS = [
+    'cloudflare-entry.001-bootstrap-security.mjs',
+    'cloudflare-entry.002-assets-routes.mjs',
+    'cloudflare-entry.003-i18n-locales.mjs',
+    'cloudflare-entry.004-rendering-css.mjs',
+    'cloudflare-entry.005-worker-dispatch.mjs',
+    'cloudflare-entry.006-fetch-handler.mjs'
+];
+const readCloudflareEntryTemplate = async ()=>(await Promise.all(CLOUDFLARE_ENTRY_TEMPLATE_FRAGMENTS.map((fragment)=>readTemplate(fragment)))).join('');
+const createCloudflarePreset = ({ appContext, modernConfig })=>{
+    const { appDirectory, distDirectory } = appContext;
+    const outputDirectory = node_path.join(appDirectory, '.output');
+    const outputPlan = createCloudflareOutputPlan(outputDirectory);
+    const publicDirectory = outputPlan.paths.publicAssets;
+    const workerEntryPath = outputPlan.paths.workerEntry;
+    const workerManifestPath = outputPlan.paths.workerManifest;
+    const routeSpecOutputPath = node_path.join(outputDirectory, ROUTE_SPEC_OUTPUT);
+    const wranglerConfigPath = outputPlan.paths.wranglerConfig;
+    const cloudflareArtifacts = getCloudflareArtifacts(modernConfig);
+    const publicAssetExcludes = getPublicAssetExcludes(appDirectory, modernConfig);
+    return {
+        async prepare () {
+            await fs.remove(outputDirectory);
+        },
+        async writeOutput () {
+            await fs.copy(distDirectory, publicDirectory, {
+                filter: (src)=>shouldCopyToPublicAssets(src, distDirectory, publicAssetExcludes)
+            });
+            await fs.ensureDir(node_path.dirname(workerEntryPath));
+            await fs.ensureDir(node_path.dirname(workerManifestPath));
+            const routeSpecSourcePath = node_path.join(distDirectory, ROUTE_SPEC_FILE);
+            if (await fs.pathExists(routeSpecSourcePath)) await fs.copy(routeSpecSourcePath, routeSpecOutputPath);
+            const workerBundleSourceDirectory = node_path.join(distDirectory, WORKER_BUNDLE_DIRECTORY);
+            const workerBundleOutputDirectory = outputPlan.paths.workerBundle;
+            if (await fs.pathExists(workerBundleSourceDirectory)) {
+                await fs.copy(workerBundleSourceDirectory, workerBundleOutputDirectory, {
+                    filter: (src)=>shouldCopyToWorkerBundle(src, workerBundleSourceDirectory)
+                });
+                await fs.writeJSON(outputPlan.paths.workerPackage, outputPlan.packages.worker);
+            }
+            await copyCloudflareArtifacts(appDirectory, outputDirectory, cloudflareArtifacts);
+            await copyCloudflarePublicAssets(appDirectory, publicDirectory, getCloudflarePublicAssets(modernConfig));
+            await copyCloudflareD1Migrations(appDirectory, outputDirectory, modernConfig);
+            await fs.writeJSON(wranglerConfigPath, createWranglerConfig(appDirectory, modernConfig), {
+                spaces: 2
+            });
+            const deliveryUnitStamp = await resolveWorkerDeliveryUnitStamp(appDirectory);
+            await fs.writeJSON(workerManifestPath, await createWorkerManifest(outputDirectory, modernConfig, appContext, deliveryUnitStamp), {
+                spaces: 2
+            });
+            await fs.writeJSON(outputPlan.paths.outputPackage, outputPlan.packages.output);
+        },
+        async genEntry () {
+            const template = await readCloudflareEntryTemplate();
+            const manifest = await fs.readJSON(workerManifestPath);
+            await fs.writeFile(workerEntryPath, template.replace('p_workerManifest', JSON.stringify(manifest, null, 2)).replace('p_workerModuleLoaders', createWorkerModuleLoaders(manifest)));
+            const topologyDeliveryUnit = await resolveTopologyDeliveryUnit(appDirectory);
+            await assertCloudflareOutput({
+                outputDirectory,
+                importWorker: false,
+                ...topologyDeliveryUnit ? {
+                    deliveryUnit: topologyDeliveryUnit
+                } : {}
+            });
+        }
+    };
+};
+export { createCloudflarePreset };

package/dist/esm-node/plugins/deploy/platforms/cloudflare/security-policies.mjs

@@ -0,0 +1,168 @@
+import "node:module";
+const DEFAULT_SECURITY_HEADERS = {
+    referrerPolicy: 'strict-origin-when-cross-origin',
+    contentTypeOptions: 'nosniff',
+    permissionsPolicy: 'camera=(), geolocation=(), microphone=(), payment=(), usb=()'
+};
+const DEFAULT_CORS_ALLOWED_METHODS = [
+    'GET',
+    'HEAD',
+    'POST',
+    'PUT',
+    'PATCH',
+    'DELETE',
+    'OPTIONS'
+];
+const DEFAULT_CSP_DIRECTIVES = {
+    'base-uri': [
+        "'self'"
+    ],
+    'connect-src': [
+        "'self'",
+        'https:',
+        'http:',
+        'wss:',
+        'ws:'
+    ],
+    'default-src': [
+        "'self'"
+    ],
+    'font-src': [
+        "'self'",
+        'data:',
+        'https:',
+        'http:'
+    ],
+    'form-action': [
+        "'self'"
+    ],
+    'frame-ancestors': [
+        "'self'"
+    ],
+    'img-src': [
+        "'self'",
+        'data:',
+        'blob:',
+        'https:',
+        'http:'
+    ],
+    'manifest-src': [
+        "'self'",
+        'https:',
+        'http:'
+    ],
+    'object-src': [
+        "'none'"
+    ],
+    "script-src": [
+        "'self'",
+        "'unsafe-inline'",
+        "'unsafe-eval'",
+        'https:',
+        'http:',
+        'blob:'
+    ],
+    'style-src': [
+        "'self'",
+        "'unsafe-inline'",
+        'https:',
+        'http:'
+    ],
+    'worker-src': [
+        "'self'",
+        'blob:'
+    ]
+};
+const normalizeDirectiveValues = (value)=>{
+    const values = Array.isArray(value) ? value : [
+        value
+    ];
+    return [
+        ...new Set(values.map((entry)=>entry.trim()).filter(Boolean))
+    ];
+};
+const appendDirectiveValues = (directives, name, values)=>{
+    if (!values?.length) return;
+    directives[name] = normalizeDirectiveValues([
+        ...directives[name] ?? [],
+        ...values
+    ]);
+};
+const createContentSecurityPolicy = (config)=>{
+    const mode = config?.mode ?? 'report-only';
+    if ('off' === mode) return {
+        mode,
+        directives: {},
+        reason: config?.reason
+    };
+    const directives = Object.fromEntries(Object.entries(DEFAULT_CSP_DIRECTIVES).map(([name, values])=>[
+            name,
+            [
+                ...values
+            ]
+        ]));
+    for (const [name, value] of Object.entries(config?.directives ?? {}))if (false === value) delete directives[name];
+    else directives[name] = normalizeDirectiveValues(value);
+    if (config?.frameAncestors === false) delete directives['frame-ancestors'];
+    else if (config?.frameAncestors) directives['frame-ancestors'] = normalizeDirectiveValues(config.frameAncestors);
+    appendDirectiveValues(directives, "script-src", config?.additionalScriptSrc);
+    appendDirectiveValues(directives, 'style-src', config?.additionalStyleSrc);
+    appendDirectiveValues(directives, 'connect-src', config?.additionalConnectSrc);
+    appendDirectiveValues(directives, 'img-src', config?.additionalImgSrc);
+    if (config?.reportUri) directives['report-uri'] = [
+        config.reportUri
+    ];
+    return {
+        mode,
+        directives,
+        reason: config?.reason
+    };
+};
+const createNoindexPolicy = (noindex)=>{
+    if (false === noindex) return {
+        workersDev: false,
+        localhost: false,
+        previewHostnames: []
+    };
+    if (true === noindex || void 0 === noindex) return {
+        workersDev: true,
+        localhost: true,
+        previewHostnames: []
+    };
+    return {
+        workersDev: noindex.workersDev ?? true,
+        localhost: noindex.localhost ?? true,
+        previewHostnames: noindex.previewHostnames ?? [],
+        reason: noindex.reason
+    };
+};
+const createCloudflareWorkerCorsPolicy = (cors)=>({
+        assets: cors?.assets ?? true,
+        allowedOrigins: normalizeDirectiveValues(cors?.allowedOrigins ?? []),
+        allowedMethods: cors?.allowedMethods?.length ? normalizeDirectiveValues(cors.allowedMethods.map((method)=>method.toUpperCase())) : DEFAULT_CORS_ALLOWED_METHODS,
+        allowedHeaders: cors?.allowedHeaders?.length ? normalizeDirectiveValues(cors.allowedHeaders) : [
+            '*'
+        ],
+        reason: cors?.reason
+    });
+const createCloudflareWorkerSecurityPolicy = (modernConfig)=>{
+    const security = modernConfig.deploy?.worker?.security;
+    if (security?.enabled === false) return {
+        enabled: false,
+        cors: createCloudflareWorkerCorsPolicy(security.cors),
+        reason: security.reason
+    };
+    return {
+        enabled: true,
+        headers: {
+            referrerPolicy: security?.headers?.referrerPolicy ?? DEFAULT_SECURITY_HEADERS.referrerPolicy,
+            contentTypeOptions: security?.headers?.contentTypeOptions ?? DEFAULT_SECURITY_HEADERS.contentTypeOptions,
+            permissionsPolicy: security?.headers?.permissionsPolicy ?? DEFAULT_SECURITY_HEADERS.permissionsPolicy
+        },
+        contentSecurityPolicy: createContentSecurityPolicy(security?.contentSecurityPolicy),
+        noindex: createNoindexPolicy(security?.noindex),
+        cors: createCloudflareWorkerCorsPolicy(security?.cors),
+        reason: security?.reason
+    };
+};
+export { DEFAULT_CORS_ALLOWED_METHODS, DEFAULT_CSP_DIRECTIVES, DEFAULT_SECURITY_HEADERS, createCloudflareWorkerCorsPolicy, createCloudflareWorkerSecurityPolicy, createContentSecurityPolicy, createNoindexPolicy };

package/dist/esm-node/plugins/deploy/platforms/cloudflare/types.mjs

@@ -0,0 +1 @@
+import "node:module";

package/dist/esm-node/plugins/deploy/platforms/cloudflare/utils.mjs

@@ -0,0 +1,13 @@
+import "node:module";
+import node_path from "node:path";
+const isRecord = (value)=>null !== value && 'object' == typeof value && !Array.isArray(value);
+const normalizeRelativePath = (value, label, scope = 'app output', options = {})=>{
+    if ('string' != typeof value) throw new Error(`${label} must be a relative path inside the ${scope}.`);
+    const normalized = value.trim().replace(/\\/g, '/').replace(/^\.\/+/u, '').replace(/\/+$/u, '');
+    const segments = normalized.split('/');
+    const isRootDestination = '.' === normalized;
+    if (!normalized || node_path.isAbsolute(normalized) || !options.allowRoot && isRootDestination || segments.includes('..')) throw new Error(`${label} must be a relative path inside the ${scope}.`);
+    return normalized;
+};
+const isJsonRecord = (value)=>'object' == typeof value && null !== value && !Array.isArray(value);
+export { isJsonRecord, isRecord, normalizeRelativePath };

package/dist/esm-node/plugins/deploy/platforms/cloudflare/worker-manifest.mjs

@@ -0,0 +1,119 @@
+import "node:module";
+import node_path from "node:path";
+import { fs } from "@modern-js/utils";
+import { readRouteSpec } from "./artifacts.mjs";
+import { ASSETS_BINDING, BFF_EFFECT_WORKER_ENTRY, CLOUDFLARE_RUNTIME_TYPE, CLOUDFLARE_WORKER_BUNDLE_FORMAT, DEFAULT_SERVER_ONLY_PUBLIC_ASSET_EXCLUDES, EFFECT_BFF_CLOUDFLARE_IMPORT_GUIDANCE, LOADABLE_STATS_FILE, PUBLIC_ASSETS_DIRECTORY, ROUTE_MANIFEST_FILE, ROUTE_SPEC_FILE, ROUTE_SPEC_OUTPUT, SERVER_BUNDLE_DIRECTORY, WORKER_BUNDLE_DIRECTORY, WORKER_ENTRY } from "./constants.mjs";
+import { createI18nWorkerManifest } from "./i18n-worker.mjs";
+import { createCloudflareWorkerSecurityPolicy } from "./security-policies.mjs";
+import { normalizeRelativePath } from "./utils.mjs";
+import { createWorkerManifestServiceBindings, createWorkerServiceBindings } from "./wrangler-config.mjs";
+const createMissingEffectBffWorkerError = (outputDirectory, worker)=>new Error(`Cloudflare Effect API runtime is configured, but the BFF worker bundle is missing: ${node_path.join(outputDirectory, worker)}. ${EFFECT_BFF_CLOUDFLARE_IMPORT_GUIDANCE}`);
+const createWorkerManifest = async (outputDirectory, modernConfig, appContext, deliveryUnitStamp)=>{
+    const routeSpec = await readRouteSpec(outputDirectory);
+    const routes = await Promise.all(routeSpec.routes.map(async (route)=>{
+        const worker = 'string' == typeof route.worker ? route.worker : void 0;
+        return {
+            urlPath: route.urlPath,
+            entryName: route.entryName,
+            entryPath: route.entryPath,
+            isSSR: Boolean(route.isSSR),
+            worker,
+            workerExists: worker ? await fs.pathExists(node_path.join(outputDirectory, worker)) : false
+        };
+    }));
+    const bffPrefix = modernConfig.bff?.prefix;
+    const primaryBffPrefix = Array.isArray(bffPrefix) ? bffPrefix[0] : bffPrefix;
+    const isEffectApi = Boolean(modernConfig.bff) && modernConfig.bff?.runtimeFramework !== 'hono';
+    const effectApiWorkerExists = await fs.pathExists(node_path.join(outputDirectory, BFF_EFFECT_WORKER_ENTRY));
+    const serviceBindings = createWorkerManifestServiceBindings(createWorkerServiceBindings(modernConfig, void 0));
+    if (isEffectApi && primaryBffPrefix && !effectApiWorkerExists) throw createMissingEffectBffWorkerError(outputDirectory, BFF_EFFECT_WORKER_ENTRY);
+    return {
+        version: 1,
+        runtime: {
+            type: CLOUDFLARE_RUNTIME_TYPE,
+            entry: WORKER_ENTRY,
+            fetchExport: true,
+            nodeListen: false
+        },
+        assets: {
+            binding: ASSETS_BINDING,
+            directory: `./${PUBLIC_ASSETS_DIRECTORY}`,
+            runWorkerFirst: true
+        },
+        routeSpec: {
+            file: ROUTE_SPEC_OUTPUT,
+            routes
+        },
+        workerBundles: {
+            directory: WORKER_BUNDLE_DIRECTORY,
+            format: CLOUDFLARE_WORKER_BUNDLE_FORMAT,
+            importableFromModuleWorker: true,
+            requestHandlerExport: 'requestHandler'
+        },
+        resources: {
+            loadableStats: LOADABLE_STATS_FILE,
+            routeManifest: ROUTE_MANIFEST_FILE
+        },
+        security: createCloudflareWorkerSecurityPolicy(modernConfig),
+        ...deliveryUnitStamp ? {
+            deliveryUnit: deliveryUnitStamp
+        } : {},
+        i18n: createI18nWorkerManifest(routeSpec, appContext),
+        bff: isEffectApi && primaryBffPrefix && effectApiWorkerExists ? {
+            runtimeFramework: 'effect',
+            prefix: primaryBffPrefix,
+            worker: BFF_EFFECT_WORKER_ENTRY
+        } : void 0,
+        ...void 0 === serviceBindings ? {} : {
+            serviceBindings
+        }
+    };
+};
+const createWorkerModuleLoaders = (manifest)=>{
+    const imports = new Map();
+    for (const route of manifest.routeSpec.routes)if (route.worker && route.workerExists) {
+        const importPath = `../${String(route.worker).replace(/^\/+/u, '')}`;
+        imports.set(route.worker, `() => import(${JSON.stringify(importPath)})`);
+    }
+    if (manifest.bff?.worker) {
+        const importPath = `../${String(manifest.bff.worker).replace(/^\/+/u, '')}`;
+        imports.set(manifest.bff.worker, `() => import(${JSON.stringify(importPath)})`);
+    }
+    if (0 === imports.size) return '{}';
+    const loaders = [
+        ...imports.entries()
+    ].map(([worker, loader])=>`${JSON.stringify(worker)}: ${loader}`);
+    return `{\n${loaders.join(',\n')}\n}`;
+};
+const getPublicAssetExcludes = (appDirectory, modernConfig)=>[
+        ...DEFAULT_SERVER_ONLY_PUBLIC_ASSET_EXCLUDES.filter((directory)=>{
+            try {
+                return fs.statSync(node_path.join(appDirectory, directory)).isDirectory();
+            } catch  {
+                return false;
+            }
+        }),
+        ...modernConfig.deploy?.worker?.publicAssetExcludes ?? []
+    ].map((entry)=>normalizeRelativePath(entry, 'deploy.worker.publicAssetExcludes'));
+const shouldCopyToPublicAssets = (src, distDirectory, publicAssetExcludes)=>{
+    const relativePath = node_path.relative(distDirectory, src);
+    if (!relativePath) return true;
+    const normalizedRelativePath = relativePath.replace(/\\/g, '/');
+    const [topLevelDirectory] = normalizedRelativePath.split('/');
+    const basename = normalizedRelativePath.split('/').pop() ?? '';
+    return normalizedRelativePath !== ROUTE_SPEC_FILE && topLevelDirectory !== WORKER_BUNDLE_DIRECTORY && topLevelDirectory !== SERVER_BUNDLE_DIRECTORY && '.env' !== basename && !basename.startsWith('.env.') && !publicAssetExcludes.some((exclude)=>normalizedRelativePath === exclude || normalizedRelativePath.startsWith(`${exclude}/`));
+};
+const shouldCopyToWorkerBundle = (src, workerBundleDirectory)=>{
+    const relativePath = node_path.relative(workerBundleDirectory, src);
+    if (!relativePath) return true;
+    const normalizedRelativePath = relativePath.replace(/\\/g, '/');
+    const basename = node_path.basename(normalizedRelativePath);
+    if (basename.startsWith('.') || normalizedRelativePath.includes('/.')) return false;
+    if (fs.statSync(src).isDirectory()) return true;
+    return [
+        '.cjs',
+        '.js',
+        '.mjs'
+    ].includes(node_path.extname(normalizedRelativePath));
+};
+export { createWorkerManifest, createWorkerModuleLoaders, getPublicAssetExcludes, shouldCopyToPublicAssets, shouldCopyToWorkerBundle };

package/dist/esm-node/plugins/deploy/platforms/cloudflare/wrangler-config.mjs

@@ -0,0 +1,136 @@
+import "node:module";
+import node_path from "node:path";
+import { ASSETS_BINDING, COMPATIBILITY_DATE_PATTERN, DEFAULT_COMPATIBILITY_DATE, PUBLIC_ASSETS_DIRECTORY, REQUIRED_COMPATIBILITY_FLAGS, WORKER_ENTRY } from "./constants.mjs";
+import { isJsonRecord, normalizeRelativePath } from "./utils.mjs";
+const getCompatibilityDate = (modernConfig)=>{
+    const configuredDate = modernConfig.deploy?.worker?.compatibilityDate?.trim();
+    const compatibilityDate = configuredDate || DEFAULT_COMPATIBILITY_DATE;
+    if (!COMPATIBILITY_DATE_PATTERN.test(compatibilityDate)) throw new Error(`deploy.worker.compatibilityDate must use YYYY-MM-DD, received ${JSON.stringify(compatibilityDate)}.`);
+    return compatibilityDate;
+};
+const getWorkerName = (appDirectory)=>{
+    const basename = node_path.basename(appDirectory);
+    return basename.replace(/[^a-zA-Z0-9-_]/g, '-') || 'modern-cloudflare-worker';
+};
+const getConfiguredWorkerName = (appDirectory, modernConfig)=>{
+    const configuredName = modernConfig.deploy?.worker?.name?.trim();
+    return configuredName || getWorkerName(appDirectory);
+};
+const getConfiguredWrangler = (modernConfig)=>{
+    const wrangler = modernConfig.deploy?.worker?.wrangler;
+    if (void 0 === wrangler) return {};
+    if (!isJsonRecord(wrangler)) throw new Error('deploy.worker.wrangler must be a JSON object.');
+    return wrangler;
+};
+const createWranglerCompatibilityFlags = (configuredFlags)=>{
+    if (void 0 === configuredFlags) return [
+        ...REQUIRED_COMPATIBILITY_FLAGS
+    ];
+    if (!Array.isArray(configuredFlags) || configuredFlags.some((flag)=>'string' != typeof flag)) throw new Error('deploy.worker.wrangler.compatibility_flags must be an array of strings.');
+    return [
+        ...new Set([
+            ...configuredFlags,
+            ...REQUIRED_COMPATIBILITY_FLAGS
+        ])
+    ];
+};
+const createWranglerAssetsConfig = (configuredAssets)=>{
+    if (void 0 !== configuredAssets && !isJsonRecord(configuredAssets)) throw new Error('deploy.worker.wrangler.assets must be an object.');
+    return {
+        ...isJsonRecord(configuredAssets) ? configuredAssets : {},
+        directory: `./${PUBLIC_ASSETS_DIRECTORY}`,
+        binding: ASSETS_BINDING,
+        run_worker_first: true
+    };
+};
+const assertNonEmptyString = (value, label)=>{
+    if ('string' != typeof value || 0 === value.trim().length) throw new Error(`${label} must be a non-empty string.`);
+    return value.trim();
+};
+const normalizeD1Database = (database, index)=>{
+    const binding = assertNonEmptyString(database.binding, `deploy.worker.d1Databases[${index}].binding`);
+    const databaseName = assertNonEmptyString(database.databaseName, `deploy.worker.d1Databases[${index}].databaseName`);
+    const databaseId = assertNonEmptyString(database.databaseId, `deploy.worker.d1Databases[${index}].databaseId`);
+    const migrationsDir = void 0 === database.migrationsDir ? void 0 : normalizeRelativePath(database.migrationsDir, `deploy.worker.d1Databases[${index}].migrationsDir`, 'app root');
+    const previewDatabaseId = void 0 === database.previewDatabaseId ? void 0 : assertNonEmptyString(database.previewDatabaseId, `deploy.worker.d1Databases[${index}].previewDatabaseId`);
+    return {
+        binding,
+        database_name: databaseName,
+        database_id: databaseId,
+        ...void 0 === migrationsDir ? {} : {
+            migrations_dir: migrationsDir
+        },
+        ...void 0 === previewDatabaseId ? {} : {
+            preview_database_id: previewDatabaseId
+        },
+        ...void 0 === database.remote ? {} : {
+            remote: database.remote
+        }
+    };
+};
+const createWranglerD1Databases = (modernConfig, configuredWranglerD1)=>{
+    const d1Databases = modernConfig.deploy?.worker?.d1Databases;
+    if (void 0 === d1Databases) return configuredWranglerD1;
+    if (void 0 !== configuredWranglerD1) throw new Error('Use deploy.worker.d1Databases or deploy.worker.wrangler.d1_databases, not both.');
+    if (!Array.isArray(d1Databases)) throw new Error('deploy.worker.d1Databases must be an array.');
+    return d1Databases.map(normalizeD1Database);
+};
+const normalizeServiceBinding = (service, index)=>{
+    const binding = assertNonEmptyString(service.binding, `deploy.worker.services[${index}].binding`);
+    const serviceName = assertNonEmptyString(service.service, `deploy.worker.services[${index}].service`);
+    const prefix = void 0 === service.prefix ? void 0 : assertNonEmptyString(service.prefix, `deploy.worker.services[${index}].prefix`);
+    return {
+        binding,
+        service: serviceName,
+        ...void 0 === prefix ? {} : {
+            prefix
+        }
+    };
+};
+const createWorkerServiceBindings = (modernConfig, configuredWranglerServices)=>{
+    const services = modernConfig.deploy?.worker?.services;
+    if (void 0 === services) return configuredWranglerServices;
+    if (void 0 !== configuredWranglerServices) throw new Error('Use deploy.worker.services or deploy.worker.wrangler.services, not both.');
+    if (!Array.isArray(services)) throw new Error('deploy.worker.services must be an array.');
+    return services.map(normalizeServiceBinding);
+};
+const createWranglerServices = (serviceBindings)=>{
+    if (!Array.isArray(serviceBindings)) return serviceBindings;
+    if (!serviceBindings.every(isJsonRecord)) return serviceBindings;
+    return serviceBindings.map((service)=>{
+        const { prefix, ...wranglerService } = service;
+        return wranglerService;
+    });
+};
+const createWorkerManifestServiceBindings = (serviceBindings)=>{
+    if (!Array.isArray(serviceBindings)) return;
+    const dispatchBindings = serviceBindings.filter((service)=>isJsonRecord(service) && 'string' == typeof service.binding && 'string' == typeof service.service && 'string' == typeof service.prefix).map((service)=>({
+            binding: service.binding,
+            service: service.service,
+            prefix: service.prefix,
+            interface: 'fetch'
+        }));
+    return dispatchBindings.length > 0 ? dispatchBindings : void 0;
+};
+const createWranglerConfig = (appDirectory, modernConfig)=>{
+    const wrangler = getConfiguredWrangler(modernConfig);
+    const d1Databases = createWranglerD1Databases(modernConfig, wrangler.d1_databases);
+    const serviceBindings = createWorkerServiceBindings(modernConfig, wrangler.services);
+    const wranglerServices = createWranglerServices(serviceBindings);
+    return {
+        $schema: 'node_modules/wrangler/config-schema.json',
+        name: getConfiguredWorkerName(appDirectory, modernConfig),
+        compatibility_date: getCompatibilityDate(modernConfig),
+        ...wrangler,
+        main: WORKER_ENTRY,
+        compatibility_flags: createWranglerCompatibilityFlags(wrangler.compatibility_flags),
+        assets: createWranglerAssetsConfig(wrangler.assets),
+        ...void 0 === d1Databases ? {} : {
+            d1_databases: d1Databases
+        },
+        ...void 0 === wranglerServices ? {} : {
+            services: wranglerServices
+        }
+    };
+};
+export { createWorkerManifestServiceBindings, createWorkerServiceBindings, createWranglerConfig };

package/dist/esm-node/plugins/deploy/platforms/cloudflare-output-contract.mjs

@@ -0,0 +1,18 @@
+import "node:module";
+const CLOUDFLARE_WORKER_ENTRY = 'server/index.mjs';
+const CLOUDFLARE_WORKER_MANIFEST = 'server/modern-worker-manifest.json';
+const CLOUDFLARE_WRANGLER_CONFIG_FILE = 'wrangler.json';
+const CLOUDFLARE_OUTPUT_PACKAGE_FILE = 'package.json';
+const CLOUDFLARE_WORKER_PACKAGE_FILE = 'worker/package.json';
+const CLOUDFLARE_ASSETS_BINDING = 'ASSETS';
+const CLOUDFLARE_PUBLIC_ASSETS_DIRECTORY = 'public';
+const CLOUDFLARE_WORKER_BUNDLE_DIRECTORY = 'worker';
+const CLOUDFLARE_RUNTIME_TYPE = 'cloudflare-module-worker';
+const CLOUDFLARE_OUTPUT_PACKAGE_TYPE = 'module';
+const CLOUDFLARE_WORKER_PACKAGE_TYPE = 'commonjs';
+const CLOUDFLARE_WORKER_BUNDLE_FORMAT = 'commonjs';
+const CLOUDFLARE_REQUIRED_COMPATIBILITY_FLAGS = [
+    'nodejs_compat',
+    'global_fetch_strictly_public'
+];
+export { CLOUDFLARE_ASSETS_BINDING, CLOUDFLARE_OUTPUT_PACKAGE_FILE, CLOUDFLARE_OUTPUT_PACKAGE_TYPE, CLOUDFLARE_PUBLIC_ASSETS_DIRECTORY, CLOUDFLARE_REQUIRED_COMPATIBILITY_FLAGS, CLOUDFLARE_RUNTIME_TYPE, CLOUDFLARE_WORKER_BUNDLE_DIRECTORY, CLOUDFLARE_WORKER_BUNDLE_FORMAT, CLOUDFLARE_WORKER_ENTRY, CLOUDFLARE_WORKER_MANIFEST, CLOUDFLARE_WORKER_PACKAGE_FILE, CLOUDFLARE_WORKER_PACKAGE_TYPE, CLOUDFLARE_WRANGLER_CONFIG_FILE };

package/dist/esm-node/plugins/deploy/platforms/cloudflare-output-plan.mjs

@@ -0,0 +1,46 @@
+import "node:module";
+import node_path from "node:path";
+import { CLOUDFLARE_ASSETS_BINDING, CLOUDFLARE_OUTPUT_PACKAGE_FILE, CLOUDFLARE_OUTPUT_PACKAGE_TYPE, CLOUDFLARE_PUBLIC_ASSETS_DIRECTORY, CLOUDFLARE_REQUIRED_COMPATIBILITY_FLAGS, CLOUDFLARE_WORKER_BUNDLE_DIRECTORY, CLOUDFLARE_WORKER_ENTRY, CLOUDFLARE_WORKER_MANIFEST, CLOUDFLARE_WORKER_PACKAGE_FILE, CLOUDFLARE_WORKER_PACKAGE_TYPE, CLOUDFLARE_WRANGLER_CONFIG_FILE } from "./cloudflare-output-contract.mjs";
+const resolveOutput = (outputDirectory, relativePath)=>node_path.join(outputDirectory, relativePath);
+function createCloudflareOutputPlan(outputDirectory) {
+    return {
+        outputDirectory,
+        requiredFiles: [
+            CLOUDFLARE_WORKER_ENTRY,
+            CLOUDFLARE_WORKER_MANIFEST,
+            CLOUDFLARE_WRANGLER_CONFIG_FILE,
+            CLOUDFLARE_OUTPUT_PACKAGE_FILE
+        ],
+        publicLeakDirectories: [
+            'server',
+            CLOUDFLARE_WORKER_BUNDLE_DIRECTORY
+        ],
+        paths: {
+            workerEntry: resolveOutput(outputDirectory, CLOUDFLARE_WORKER_ENTRY),
+            workerManifest: resolveOutput(outputDirectory, CLOUDFLARE_WORKER_MANIFEST),
+            wranglerConfig: resolveOutput(outputDirectory, CLOUDFLARE_WRANGLER_CONFIG_FILE),
+            outputPackage: resolveOutput(outputDirectory, CLOUDFLARE_OUTPUT_PACKAGE_FILE),
+            workerPackage: resolveOutput(outputDirectory, CLOUDFLARE_WORKER_PACKAGE_FILE),
+            publicAssets: resolveOutput(outputDirectory, CLOUDFLARE_PUBLIC_ASSETS_DIRECTORY),
+            workerBundle: resolveOutput(outputDirectory, CLOUDFLARE_WORKER_BUNDLE_DIRECTORY)
+        },
+        packages: {
+            output: {
+                type: CLOUDFLARE_OUTPUT_PACKAGE_TYPE
+            },
+            worker: {
+                type: CLOUDFLARE_WORKER_PACKAGE_TYPE
+            }
+        },
+        wrangler: {
+            main: CLOUDFLARE_WORKER_ENTRY,
+            assets: {
+                binding: CLOUDFLARE_ASSETS_BINDING,
+                directory: `./${CLOUDFLARE_PUBLIC_ASSETS_DIRECTORY}`,
+                run_worker_first: true
+            },
+            requiredCompatibilityFlags: CLOUDFLARE_REQUIRED_COMPATIBILITY_FLAGS
+        }
+    };
+}
+export { createCloudflareOutputPlan };

package/dist/esm-node/plugins/deploy/platforms/cloudflare-output-verifier/identity.mjs

@@ -0,0 +1,46 @@
+import "node:module";
+import { DELIVERY_UNIT_IDENTITY_FIELDS, deliveryUnitIdentityFieldValue } from "@modern-js/utils/universal";
+import { addIssue, assertEqual } from "./issues.mjs";
+const verifyDeliveryUnitIdentity = (issues, manifest, manifestPath, declared)=>{
+    const stamped = manifest?.deliveryUnit;
+    const hasStamp = Boolean(stamped) && 'object' == typeof stamped;
+    if (declared) {
+        if (!hasStamp) return void addIssue(issues, {
+            code: 'missing-delivery-unit',
+            message: `Cloudflare worker manifest is missing the delivery-unit identity declared by the workspace topology (expected unitId ${declared.unitId}, buildMarker ${declared.buildMarker}).`,
+            path: manifestPath
+        });
+        for (const field of DELIVERY_UNIT_IDENTITY_FIELDS){
+            const stampedValue = deliveryUnitIdentityFieldValue(stamped, field);
+            assertEqual(issues, stampedValue, declared[field], {
+                code: 'delivery-unit-drift',
+                message: `Cloudflare worker manifest deliveryUnit.${field} must match the topology delivery-unit record (expected ${declared[field]}, received ${stampedValue ?? 'undefined'}).`,
+                path: manifestPath
+            });
+        }
+    }
+    if (hasStamp && stamped.surfaces && 'object' == typeof stamped.surfaces) for (const surface of [
+        'ui',
+        'api'
+    ]){
+        const marker = stamped.surfaces[surface];
+        if (!marker || 'object' != typeof marker) {
+            addIssue(issues, {
+                code: 'missing-delivery-unit',
+                message: `Cloudflare worker manifest is missing the ${surface} delivery-unit surface marker.`,
+                path: manifestPath
+            });
+            continue;
+        }
+        for (const field of DELIVERY_UNIT_IDENTITY_FIELDS){
+            const markerValue = deliveryUnitIdentityFieldValue(marker, field);
+            const stampedValue = deliveryUnitIdentityFieldValue(stamped, field);
+            assertEqual(issues, markerValue, stampedValue, {
+                code: 'delivery-unit-drift',
+                message: `Cloudflare worker manifest ${surface} surface deliveryUnit.${field} must derive from one delivery-unit record (expected ${stampedValue ?? 'undefined'}, received ${markerValue ?? 'undefined'}).`,
+                path: manifestPath
+            });
+        }
+    }
+};
+export { verifyDeliveryUnitIdentity };