@bleedingdev/modern-js-app-tools 3.5.0-ultramodern.30 → 3.5.0-ultramodern.32

package/dist/esm-node/plugins/deploy/platforms/cloudflare/security-policies.mjs

@@ -0,0 +1,168 @@
+import "node:module";
+const DEFAULT_SECURITY_HEADERS = {
+    referrerPolicy: 'strict-origin-when-cross-origin',
+    contentTypeOptions: 'nosniff',
+    permissionsPolicy: 'camera=(), geolocation=(), microphone=(), payment=(), usb=()'
+};
+const DEFAULT_CORS_ALLOWED_METHODS = [
+    'GET',
+    'HEAD',
+    'POST',
+    'PUT',
+    'PATCH',
+    'DELETE',
+    'OPTIONS'
+];
+const DEFAULT_CSP_DIRECTIVES = {
+    'base-uri': [
+        "'self'"
+    ],
+    'connect-src': [
+        "'self'",
+        'https:',
+        'http:',
+        'wss:',
+        'ws:'
+    ],
+    'default-src': [
+        "'self'"
+    ],
+    'font-src': [
+        "'self'",
+        'data:',
+        'https:',
+        'http:'
+    ],
+    'form-action': [
+        "'self'"
+    ],
+    'frame-ancestors': [
+        "'self'"
+    ],
+    'img-src': [
+        "'self'",
+        'data:',
+        'blob:',
+        'https:',
+        'http:'
+    ],
+    'manifest-src': [
+        "'self'",
+        'https:',
+        'http:'
+    ],
+    'object-src': [
+        "'none'"
+    ],
+    "script-src": [
+        "'self'",
+        "'unsafe-inline'",
+        "'unsafe-eval'",
+        'https:',
+        'http:',
+        'blob:'
+    ],
+    'style-src': [
+        "'self'",
+        "'unsafe-inline'",
+        'https:',
+        'http:'
+    ],
+    'worker-src': [
+        "'self'",
+        'blob:'
+    ]
+};
+const normalizeDirectiveValues = (value)=>{
+    const values = Array.isArray(value) ? value : [
+        value
+    ];
+    return [
+        ...new Set(values.map((entry)=>entry.trim()).filter(Boolean))
+    ];
+};
+const appendDirectiveValues = (directives, name, values)=>{
+    if (!values?.length) return;
+    directives[name] = normalizeDirectiveValues([
+        ...directives[name] ?? [],
+        ...values
+    ]);
+};
+const createContentSecurityPolicy = (config)=>{
+    const mode = config?.mode ?? 'report-only';
+    if ('off' === mode) return {
+        mode,
+        directives: {},
+        reason: config?.reason
+    };
+    const directives = Object.fromEntries(Object.entries(DEFAULT_CSP_DIRECTIVES).map(([name, values])=>[
+            name,
+            [
+                ...values
+            ]
+        ]));
+    for (const [name, value] of Object.entries(config?.directives ?? {}))if (false === value) delete directives[name];
+    else directives[name] = normalizeDirectiveValues(value);
+    if (config?.frameAncestors === false) delete directives['frame-ancestors'];
+    else if (config?.frameAncestors) directives['frame-ancestors'] = normalizeDirectiveValues(config.frameAncestors);
+    appendDirectiveValues(directives, "script-src", config?.additionalScriptSrc);
+    appendDirectiveValues(directives, 'style-src', config?.additionalStyleSrc);
+    appendDirectiveValues(directives, 'connect-src', config?.additionalConnectSrc);
+    appendDirectiveValues(directives, 'img-src', config?.additionalImgSrc);
+    if (config?.reportUri) directives['report-uri'] = [
+        config.reportUri
+    ];
+    return {
+        mode,
+        directives,
+        reason: config?.reason
+    };
+};
+const createNoindexPolicy = (noindex)=>{
+    if (false === noindex) return {
+        workersDev: false,
+        localhost: false,
+        previewHostnames: []
+    };
+    if (true === noindex || void 0 === noindex) return {
+        workersDev: true,
+        localhost: true,
+        previewHostnames: []
+    };
+    return {
+        workersDev: noindex.workersDev ?? true,
+        localhost: noindex.localhost ?? true,
+        previewHostnames: noindex.previewHostnames ?? [],
+        reason: noindex.reason
+    };
+};
+const createCloudflareWorkerCorsPolicy = (cors)=>({
+        assets: cors?.assets ?? true,
+        allowedOrigins: normalizeDirectiveValues(cors?.allowedOrigins ?? []),
+        allowedMethods: cors?.allowedMethods?.length ? normalizeDirectiveValues(cors.allowedMethods.map((method)=>method.toUpperCase())) : DEFAULT_CORS_ALLOWED_METHODS,
+        allowedHeaders: cors?.allowedHeaders?.length ? normalizeDirectiveValues(cors.allowedHeaders) : [
+            '*'
+        ],
+        reason: cors?.reason
+    });
+const createCloudflareWorkerSecurityPolicy = (modernConfig)=>{
+    const security = modernConfig.deploy?.worker?.security;
+    if (security?.enabled === false) return {
+        enabled: false,
+        cors: createCloudflareWorkerCorsPolicy(security.cors),
+        reason: security.reason
+    };
+    return {
+        enabled: true,
+        headers: {
+            referrerPolicy: security?.headers?.referrerPolicy ?? DEFAULT_SECURITY_HEADERS.referrerPolicy,
+            contentTypeOptions: security?.headers?.contentTypeOptions ?? DEFAULT_SECURITY_HEADERS.contentTypeOptions,
+            permissionsPolicy: security?.headers?.permissionsPolicy ?? DEFAULT_SECURITY_HEADERS.permissionsPolicy
+        },
+        contentSecurityPolicy: createContentSecurityPolicy(security?.contentSecurityPolicy),
+        noindex: createNoindexPolicy(security?.noindex),
+        cors: createCloudflareWorkerCorsPolicy(security?.cors),
+        reason: security?.reason
+    };
+};
+export { DEFAULT_CORS_ALLOWED_METHODS, DEFAULT_CSP_DIRECTIVES, DEFAULT_SECURITY_HEADERS, createCloudflareWorkerCorsPolicy, createCloudflareWorkerSecurityPolicy, createContentSecurityPolicy, createNoindexPolicy };

package/dist/esm-node/plugins/deploy/platforms/cloudflare/types.mjs

@@ -0,0 +1 @@
+import "node:module";

package/dist/esm-node/plugins/deploy/platforms/cloudflare/utils.mjs

@@ -0,0 +1,13 @@
+import "node:module";
+import node_path from "node:path";
+const isRecord = (value)=>null !== value && 'object' == typeof value && !Array.isArray(value);
+const normalizeRelativePath = (value, label, scope = 'app output', options = {})=>{
+    if ('string' != typeof value) throw new Error(`${label} must be a relative path inside the ${scope}.`);
+    const normalized = value.trim().replace(/\\/g, '/').replace(/^\.\/+/u, '').replace(/\/+$/u, '');
+    const segments = normalized.split('/');
+    const isRootDestination = '.' === normalized;
+    if (!normalized || node_path.isAbsolute(normalized) || !options.allowRoot && isRootDestination || segments.includes('..')) throw new Error(`${label} must be a relative path inside the ${scope}.`);
+    return normalized;
+};
+const isJsonRecord = (value)=>'object' == typeof value && null !== value && !Array.isArray(value);
+export { isJsonRecord, isRecord, normalizeRelativePath };

package/dist/esm-node/plugins/deploy/platforms/cloudflare/worker-manifest.mjs

@@ -0,0 +1,119 @@
+import "node:module";
+import node_path from "node:path";
+import { fs } from "@modern-js/utils";
+import { readRouteSpec } from "./artifacts.mjs";
+import { ASSETS_BINDING, BFF_EFFECT_WORKER_ENTRY, CLOUDFLARE_RUNTIME_TYPE, CLOUDFLARE_WORKER_BUNDLE_FORMAT, DEFAULT_SERVER_ONLY_PUBLIC_ASSET_EXCLUDES, EFFECT_BFF_CLOUDFLARE_IMPORT_GUIDANCE, LOADABLE_STATS_FILE, PUBLIC_ASSETS_DIRECTORY, ROUTE_MANIFEST_FILE, ROUTE_SPEC_FILE, ROUTE_SPEC_OUTPUT, SERVER_BUNDLE_DIRECTORY, WORKER_BUNDLE_DIRECTORY, WORKER_ENTRY } from "./constants.mjs";
+import { createI18nWorkerManifest } from "./i18n-worker.mjs";
+import { createCloudflareWorkerSecurityPolicy } from "./security-policies.mjs";
+import { normalizeRelativePath } from "./utils.mjs";
+import { createWorkerManifestServiceBindings, createWorkerServiceBindings } from "./wrangler-config.mjs";
+const createMissingEffectBffWorkerError = (outputDirectory, worker)=>new Error(`Cloudflare Effect API runtime is configured, but the BFF worker bundle is missing: ${node_path.join(outputDirectory, worker)}. ${EFFECT_BFF_CLOUDFLARE_IMPORT_GUIDANCE}`);
+const createWorkerManifest = async (outputDirectory, modernConfig, appContext, deliveryUnitStamp)=>{
+    const routeSpec = await readRouteSpec(outputDirectory);
+    const routes = await Promise.all(routeSpec.routes.map(async (route)=>{
+        const worker = 'string' == typeof route.worker ? route.worker : void 0;
+        return {
+            urlPath: route.urlPath,
+            entryName: route.entryName,
+            entryPath: route.entryPath,
+            isSSR: Boolean(route.isSSR),
+            worker,
+            workerExists: worker ? await fs.pathExists(node_path.join(outputDirectory, worker)) : false
+        };
+    }));
+    const bffPrefix = modernConfig.bff?.prefix;
+    const primaryBffPrefix = Array.isArray(bffPrefix) ? bffPrefix[0] : bffPrefix;
+    const isEffectApi = Boolean(modernConfig.bff) && modernConfig.bff?.runtimeFramework !== 'hono';
+    const effectApiWorkerExists = await fs.pathExists(node_path.join(outputDirectory, BFF_EFFECT_WORKER_ENTRY));
+    const serviceBindings = createWorkerManifestServiceBindings(createWorkerServiceBindings(modernConfig, void 0));
+    if (isEffectApi && primaryBffPrefix && !effectApiWorkerExists) throw createMissingEffectBffWorkerError(outputDirectory, BFF_EFFECT_WORKER_ENTRY);
+    return {
+        version: 1,
+        runtime: {
+            type: CLOUDFLARE_RUNTIME_TYPE,
+            entry: WORKER_ENTRY,
+            fetchExport: true,
+            nodeListen: false
+        },
+        assets: {
+            binding: ASSETS_BINDING,
+            directory: `./${PUBLIC_ASSETS_DIRECTORY}`,
+            runWorkerFirst: true
+        },
+        routeSpec: {
+            file: ROUTE_SPEC_OUTPUT,
+            routes
+        },
+        workerBundles: {
+            directory: WORKER_BUNDLE_DIRECTORY,
+            format: CLOUDFLARE_WORKER_BUNDLE_FORMAT,
+            importableFromModuleWorker: true,
+            requestHandlerExport: 'requestHandler'
+        },
+        resources: {
+            loadableStats: LOADABLE_STATS_FILE,
+            routeManifest: ROUTE_MANIFEST_FILE
+        },
+        security: createCloudflareWorkerSecurityPolicy(modernConfig),
+        ...deliveryUnitStamp ? {
+            deliveryUnit: deliveryUnitStamp
+        } : {},
+        i18n: createI18nWorkerManifest(routeSpec, appContext),
+        bff: isEffectApi && primaryBffPrefix && effectApiWorkerExists ? {
+            runtimeFramework: 'effect',
+            prefix: primaryBffPrefix,
+            worker: BFF_EFFECT_WORKER_ENTRY
+        } : void 0,
+        ...void 0 === serviceBindings ? {} : {
+            serviceBindings
+        }
+    };
+};
+const createWorkerModuleLoaders = (manifest)=>{
+    const imports = new Map();
+    for (const route of manifest.routeSpec.routes)if (route.worker && route.workerExists) {
+        const importPath = `../${String(route.worker).replace(/^\/+/u, '')}`;
+        imports.set(route.worker, `() => import(${JSON.stringify(importPath)})`);
+    }
+    if (manifest.bff?.worker) {
+        const importPath = `../${String(manifest.bff.worker).replace(/^\/+/u, '')}`;
+        imports.set(manifest.bff.worker, `() => import(${JSON.stringify(importPath)})`);
+    }
+    if (0 === imports.size) return '{}';
+    const loaders = [
+        ...imports.entries()
+    ].map(([worker, loader])=>`${JSON.stringify(worker)}: ${loader}`);
+    return `{\n${loaders.join(',\n')}\n}`;
+};
+const getPublicAssetExcludes = (appDirectory, modernConfig)=>[
+        ...DEFAULT_SERVER_ONLY_PUBLIC_ASSET_EXCLUDES.filter((directory)=>{
+            try {
+                return fs.statSync(node_path.join(appDirectory, directory)).isDirectory();
+            } catch  {
+                return false;
+            }
+        }),
+        ...modernConfig.deploy?.worker?.publicAssetExcludes ?? []
+    ].map((entry)=>normalizeRelativePath(entry, 'deploy.worker.publicAssetExcludes'));
+const shouldCopyToPublicAssets = (src, distDirectory, publicAssetExcludes)=>{
+    const relativePath = node_path.relative(distDirectory, src);
+    if (!relativePath) return true;
+    const normalizedRelativePath = relativePath.replace(/\\/g, '/');
+    const [topLevelDirectory] = normalizedRelativePath.split('/');
+    const basename = normalizedRelativePath.split('/').pop() ?? '';
+    return normalizedRelativePath !== ROUTE_SPEC_FILE && topLevelDirectory !== WORKER_BUNDLE_DIRECTORY && topLevelDirectory !== SERVER_BUNDLE_DIRECTORY && '.env' !== basename && !basename.startsWith('.env.') && !publicAssetExcludes.some((exclude)=>normalizedRelativePath === exclude || normalizedRelativePath.startsWith(`${exclude}/`));
+};
+const shouldCopyToWorkerBundle = (src, workerBundleDirectory)=>{
+    const relativePath = node_path.relative(workerBundleDirectory, src);
+    if (!relativePath) return true;
+    const normalizedRelativePath = relativePath.replace(/\\/g, '/');
+    const basename = node_path.basename(normalizedRelativePath);
+    if (basename.startsWith('.') || normalizedRelativePath.includes('/.')) return false;
+    if (fs.statSync(src).isDirectory()) return true;
+    return [
+        '.cjs',
+        '.js',
+        '.mjs'
+    ].includes(node_path.extname(normalizedRelativePath));
+};
+export { createWorkerManifest, createWorkerModuleLoaders, getPublicAssetExcludes, shouldCopyToPublicAssets, shouldCopyToWorkerBundle };

package/dist/esm-node/plugins/deploy/platforms/cloudflare/wrangler-config.mjs

@@ -0,0 +1,136 @@
+import "node:module";
+import node_path from "node:path";
+import { ASSETS_BINDING, COMPATIBILITY_DATE_PATTERN, DEFAULT_COMPATIBILITY_DATE, PUBLIC_ASSETS_DIRECTORY, REQUIRED_COMPATIBILITY_FLAGS, WORKER_ENTRY } from "./constants.mjs";
+import { isJsonRecord, normalizeRelativePath } from "./utils.mjs";
+const getCompatibilityDate = (modernConfig)=>{
+    const configuredDate = modernConfig.deploy?.worker?.compatibilityDate?.trim();
+    const compatibilityDate = configuredDate || DEFAULT_COMPATIBILITY_DATE;
+    if (!COMPATIBILITY_DATE_PATTERN.test(compatibilityDate)) throw new Error(`deploy.worker.compatibilityDate must use YYYY-MM-DD, received ${JSON.stringify(compatibilityDate)}.`);
+    return compatibilityDate;
+};
+const getWorkerName = (appDirectory)=>{
+    const basename = node_path.basename(appDirectory);
+    return basename.replace(/[^a-zA-Z0-9-_]/g, '-') || 'modern-cloudflare-worker';
+};
+const getConfiguredWorkerName = (appDirectory, modernConfig)=>{
+    const configuredName = modernConfig.deploy?.worker?.name?.trim();
+    return configuredName || getWorkerName(appDirectory);
+};
+const getConfiguredWrangler = (modernConfig)=>{
+    const wrangler = modernConfig.deploy?.worker?.wrangler;
+    if (void 0 === wrangler) return {};
+    if (!isJsonRecord(wrangler)) throw new Error('deploy.worker.wrangler must be a JSON object.');
+    return wrangler;
+};
+const createWranglerCompatibilityFlags = (configuredFlags)=>{
+    if (void 0 === configuredFlags) return [
+        ...REQUIRED_COMPATIBILITY_FLAGS
+    ];
+    if (!Array.isArray(configuredFlags) || configuredFlags.some((flag)=>'string' != typeof flag)) throw new Error('deploy.worker.wrangler.compatibility_flags must be an array of strings.');
+    return [
+        ...new Set([
+            ...configuredFlags,
+            ...REQUIRED_COMPATIBILITY_FLAGS
+        ])
+    ];
+};
+const createWranglerAssetsConfig = (configuredAssets)=>{
+    if (void 0 !== configuredAssets && !isJsonRecord(configuredAssets)) throw new Error('deploy.worker.wrangler.assets must be an object.');
+    return {
+        ...isJsonRecord(configuredAssets) ? configuredAssets : {},
+        directory: `./${PUBLIC_ASSETS_DIRECTORY}`,
+        binding: ASSETS_BINDING,
+        run_worker_first: true
+    };
+};
+const assertNonEmptyString = (value, label)=>{
+    if ('string' != typeof value || 0 === value.trim().length) throw new Error(`${label} must be a non-empty string.`);
+    return value.trim();
+};
+const normalizeD1Database = (database, index)=>{
+    const binding = assertNonEmptyString(database.binding, `deploy.worker.d1Databases[${index}].binding`);
+    const databaseName = assertNonEmptyString(database.databaseName, `deploy.worker.d1Databases[${index}].databaseName`);
+    const databaseId = assertNonEmptyString(database.databaseId, `deploy.worker.d1Databases[${index}].databaseId`);
+    const migrationsDir = void 0 === database.migrationsDir ? void 0 : normalizeRelativePath(database.migrationsDir, `deploy.worker.d1Databases[${index}].migrationsDir`, 'app root');
+    const previewDatabaseId = void 0 === database.previewDatabaseId ? void 0 : assertNonEmptyString(database.previewDatabaseId, `deploy.worker.d1Databases[${index}].previewDatabaseId`);
+    return {
+        binding,
+        database_name: databaseName,
+        database_id: databaseId,
+        ...void 0 === migrationsDir ? {} : {
+            migrations_dir: migrationsDir
+        },
+        ...void 0 === previewDatabaseId ? {} : {
+            preview_database_id: previewDatabaseId
+        },
+        ...void 0 === database.remote ? {} : {
+            remote: database.remote
+        }
+    };
+};
+const createWranglerD1Databases = (modernConfig, configuredWranglerD1)=>{
+    const d1Databases = modernConfig.deploy?.worker?.d1Databases;
+    if (void 0 === d1Databases) return configuredWranglerD1;
+    if (void 0 !== configuredWranglerD1) throw new Error('Use deploy.worker.d1Databases or deploy.worker.wrangler.d1_databases, not both.');
+    if (!Array.isArray(d1Databases)) throw new Error('deploy.worker.d1Databases must be an array.');
+    return d1Databases.map(normalizeD1Database);
+};
+const normalizeServiceBinding = (service, index)=>{
+    const binding = assertNonEmptyString(service.binding, `deploy.worker.services[${index}].binding`);
+    const serviceName = assertNonEmptyString(service.service, `deploy.worker.services[${index}].service`);
+    const prefix = void 0 === service.prefix ? void 0 : assertNonEmptyString(service.prefix, `deploy.worker.services[${index}].prefix`);
+    return {
+        binding,
+        service: serviceName,
+        ...void 0 === prefix ? {} : {
+            prefix
+        }
+    };
+};
+const createWorkerServiceBindings = (modernConfig, configuredWranglerServices)=>{
+    const services = modernConfig.deploy?.worker?.services;
+    if (void 0 === services) return configuredWranglerServices;
+    if (void 0 !== configuredWranglerServices) throw new Error('Use deploy.worker.services or deploy.worker.wrangler.services, not both.');
+    if (!Array.isArray(services)) throw new Error('deploy.worker.services must be an array.');
+    return services.map(normalizeServiceBinding);
+};
+const createWranglerServices = (serviceBindings)=>{
+    if (!Array.isArray(serviceBindings)) return serviceBindings;
+    if (!serviceBindings.every(isJsonRecord)) return serviceBindings;
+    return serviceBindings.map((service)=>{
+        const { prefix, ...wranglerService } = service;
+        return wranglerService;
+    });
+};
+const createWorkerManifestServiceBindings = (serviceBindings)=>{
+    if (!Array.isArray(serviceBindings)) return;
+    const dispatchBindings = serviceBindings.filter((service)=>isJsonRecord(service) && 'string' == typeof service.binding && 'string' == typeof service.service && 'string' == typeof service.prefix).map((service)=>({
+            binding: service.binding,
+            service: service.service,
+            prefix: service.prefix,
+            interface: 'fetch'
+        }));
+    return dispatchBindings.length > 0 ? dispatchBindings : void 0;
+};
+const createWranglerConfig = (appDirectory, modernConfig)=>{
+    const wrangler = getConfiguredWrangler(modernConfig);
+    const d1Databases = createWranglerD1Databases(modernConfig, wrangler.d1_databases);
+    const serviceBindings = createWorkerServiceBindings(modernConfig, wrangler.services);
+    const wranglerServices = createWranglerServices(serviceBindings);
+    return {
+        $schema: 'node_modules/wrangler/config-schema.json',
+        name: getConfiguredWorkerName(appDirectory, modernConfig),
+        compatibility_date: getCompatibilityDate(modernConfig),
+        ...wrangler,
+        main: WORKER_ENTRY,
+        compatibility_flags: createWranglerCompatibilityFlags(wrangler.compatibility_flags),
+        assets: createWranglerAssetsConfig(wrangler.assets),
+        ...void 0 === d1Databases ? {} : {
+            d1_databases: d1Databases
+        },
+        ...void 0 === wranglerServices ? {} : {
+            services: wranglerServices
+        }
+    };
+};
+export { createWorkerManifestServiceBindings, createWorkerServiceBindings, createWranglerConfig };

package/dist/esm-node/plugins/deploy/platforms/cloudflare-output-verifier/identity.mjs

@@ -0,0 +1,46 @@
+import "node:module";
+import { DELIVERY_UNIT_IDENTITY_FIELDS, deliveryUnitIdentityFieldValue } from "@modern-js/utils/universal";
+import { addIssue, assertEqual } from "./issues.mjs";
+const verifyDeliveryUnitIdentity = (issues, manifest, manifestPath, declared)=>{
+    const stamped = manifest?.deliveryUnit;
+    const hasStamp = Boolean(stamped) && 'object' == typeof stamped;
+    if (declared) {
+        if (!hasStamp) return void addIssue(issues, {
+            code: 'missing-delivery-unit',
+            message: `Cloudflare worker manifest is missing the delivery-unit identity declared by the workspace topology (expected unitId ${declared.unitId}, buildMarker ${declared.buildMarker}).`,
+            path: manifestPath
+        });
+        for (const field of DELIVERY_UNIT_IDENTITY_FIELDS){
+            const stampedValue = deliveryUnitIdentityFieldValue(stamped, field);
+            assertEqual(issues, stampedValue, declared[field], {
+                code: 'delivery-unit-drift',
+                message: `Cloudflare worker manifest deliveryUnit.${field} must match the topology delivery-unit record (expected ${declared[field]}, received ${stampedValue ?? 'undefined'}).`,
+                path: manifestPath
+            });
+        }
+    }
+    if (hasStamp && stamped.surfaces && 'object' == typeof stamped.surfaces) for (const surface of [
+        'ui',
+        'api'
+    ]){
+        const marker = stamped.surfaces[surface];
+        if (!marker || 'object' != typeof marker) {
+            addIssue(issues, {
+                code: 'missing-delivery-unit',
+                message: `Cloudflare worker manifest is missing the ${surface} delivery-unit surface marker.`,
+                path: manifestPath
+            });
+            continue;
+        }
+        for (const field of DELIVERY_UNIT_IDENTITY_FIELDS){
+            const markerValue = deliveryUnitIdentityFieldValue(marker, field);
+            const stampedValue = deliveryUnitIdentityFieldValue(stamped, field);
+            assertEqual(issues, markerValue, stampedValue, {
+                code: 'delivery-unit-drift',
+                message: `Cloudflare worker manifest ${surface} surface deliveryUnit.${field} must derive from one delivery-unit record (expected ${stampedValue ?? 'undefined'}, received ${markerValue ?? 'undefined'}).`,
+                path: manifestPath
+            });
+        }
+    }
+};
+export { verifyDeliveryUnitIdentity };

package/dist/esm-node/plugins/deploy/platforms/cloudflare-output-verifier/index.mjs

@@ -0,0 +1,130 @@
+import "node:module";
+import promises from "node:fs/promises";
+import node_path from "node:path";
+import { createCloudflareOutputPlan } from "../cloudflare-output-plan.mjs";
+import { verifyDeliveryUnitIdentity } from "./identity.mjs";
+import { addIssue, assertEqual, assertFlag } from "./issues.mjs";
+import { verifyManifestShape } from "./manifest.mjs";
+import { getEffectBffWorker, getWorkerBundleReferences, missingWorkerBundleMessage, resolveWorkerBundleReference, verifyWorkerBundleReferences, verifyWorkerImport } from "./worker-bundles.mjs";
+const pathExists = async (filePath)=>{
+    try {
+        await promises.access(filePath);
+        return true;
+    } catch  {
+        return false;
+    }
+};
+const readJson = async (filePath)=>JSON.parse(await promises.readFile(filePath, 'utf-8'));
+const verifyCloudflareOutput = async (options)=>{
+    const outputDirectory = node_path.resolve(options.outputDirectory);
+    const issues = [];
+    const outputPlan = createCloudflareOutputPlan(outputDirectory);
+    for (const relativePath of outputPlan.requiredFiles){
+        const filePath = node_path.join(outputDirectory, relativePath);
+        if (!await pathExists(filePath)) addIssue(issues, {
+            code: 'missing-file',
+            message: `Cloudflare output is missing ${relativePath}.`,
+            path: filePath
+        });
+    }
+    const manifestPath = outputPlan.paths.workerManifest;
+    const wranglerPath = outputPlan.paths.wranglerConfig;
+    const packagePath = outputPlan.paths.outputPackage;
+    const workerPackagePath = outputPlan.paths.workerPackage;
+    const manifest = await pathExists(manifestPath) ? await readJson(manifestPath) : void 0;
+    const wrangler = await pathExists(wranglerPath) ? await readJson(wranglerPath) : void 0;
+    const outputPackage = await pathExists(packagePath) ? await readJson(packagePath) : void 0;
+    const workerPackage = await pathExists(workerPackagePath) ? await readJson(workerPackagePath) : void 0;
+    if (manifest) {
+        verifyManifestShape(issues, manifest, manifestPath);
+        verifyDeliveryUnitIdentity(issues, manifest, manifestPath, options.deliveryUnit);
+        const workerReferences = getWorkerBundleReferences(manifest);
+        if (workerReferences.length > 0 && !await pathExists(workerPackagePath)) addIssue(issues, {
+            code: 'missing-file',
+            message: 'Cloudflare output is missing worker/package.json for referenced worker bundles.',
+            path: workerPackagePath
+        });
+        if (manifest.bff?.runtimeFramework === 'effect' && !getEffectBffWorker(manifest)) addIssue(issues, {
+            code: 'missing-worker-bundle',
+            message: 'Cloudflare Effect BFF manifest points to a missing worker bundle.'
+        });
+        for (const workerReference of workerReferences){
+            const resolvedWorker = resolveWorkerBundleReference(issues, outputDirectory, workerReference, manifestPath);
+            if (!resolvedWorker) continue;
+            const workerExists = await pathExists(resolvedWorker.path);
+            if (!workerExists) addIssue(issues, {
+                code: 'missing-worker-bundle',
+                message: missingWorkerBundleMessage(workerReference),
+                path: resolvedWorker.path
+            });
+            if (workerExists) {
+                const workerSource = await promises.readFile(resolvedWorker.path, 'utf-8');
+                verifyWorkerBundleReferences(issues, resolvedWorker, workerSource);
+                if ('effect-bff' === resolvedWorker.kind && (workerSource.includes(';entityKind;') || workerSource.includes(';entityKind,entityKind;'))) addIssue(issues, {
+                    code: 'invalid-worker-bundle',
+                    message: 'Cloudflare Effect BFF worker bundle contains invalid Drizzle entityKind marker references.',
+                    path: resolvedWorker.path
+                });
+            }
+        }
+    }
+    if (wrangler) {
+        assertEqual(issues, wrangler.main, outputPlan.wrangler.main, {
+            code: 'invalid-wrangler',
+            message: `wrangler.json main must be ${outputPlan.wrangler.main}.`,
+            path: wranglerPath
+        });
+        assertEqual(issues, wrangler.assets?.binding, outputPlan.wrangler.assets.binding, {
+            code: 'invalid-wrangler',
+            message: 'wrangler.json assets.binding must be ASSETS.',
+            path: wranglerPath
+        });
+        assertEqual(issues, wrangler.assets?.directory, outputPlan.wrangler.assets.directory, {
+            code: 'invalid-wrangler',
+            message: 'wrangler.json assets.directory must be ./public.',
+            path: wranglerPath
+        });
+        assertEqual(issues, wrangler.assets?.run_worker_first, outputPlan.wrangler.assets.run_worker_first, {
+            code: 'invalid-wrangler',
+            message: 'wrangler.json assets.run_worker_first must be true.',
+            path: wranglerPath
+        });
+        for (const flag of outputPlan.wrangler.requiredCompatibilityFlags)assertFlag(issues, wrangler.compatibility_flags, flag, {
+            code: 'invalid-wrangler',
+            message: `wrangler.json compatibility_flags must include ${flag}.`,
+            path: wranglerPath
+        });
+    }
+    if (outputPackage) assertEqual(issues, outputPackage.type, outputPlan.packages.output.type, {
+        code: 'invalid-package',
+        message: '.output/package.json must declare type module.',
+        path: packagePath
+    });
+    if (workerPackage) assertEqual(issues, workerPackage.type, outputPlan.packages.worker.type, {
+        code: 'invalid-package',
+        message: '.output/worker/package.json must declare type commonjs.',
+        path: workerPackagePath
+    });
+    for (const leakedPath of outputPlan.publicLeakDirectories){
+        const publicPath = node_path.join(outputPlan.paths.publicAssets, leakedPath);
+        if (await pathExists(publicPath)) addIssue(issues, {
+            code: 'public-output-leak',
+            message: `Framework-owned ${leakedPath} output leaked into public assets.`,
+            path: publicPath
+        });
+    }
+    if (false !== options.importWorker && await pathExists(outputPlan.paths.workerEntry)) await verifyWorkerImport(issues, outputPlan.paths.workerEntry);
+    return {
+        ok: 0 === issues.length,
+        issues
+    };
+};
+const assertCloudflareOutput = async (options)=>{
+    const result = await verifyCloudflareOutput(options);
+    if (!result.ok) throw new Error([
+        'Cloudflare output verification failed:',
+        ...result.issues.map((issue)=>`- ${issue.code}: ${issue.message}${issue.path ? ` (${issue.path})` : ''}`)
+    ].join('\n'));
+};
+export { verifyCloudflareOutputMutationPolicy } from "./mutation-policy.mjs";
+export { assertCloudflareOutput, verifyCloudflareOutput };

package/dist/esm-node/plugins/deploy/platforms/cloudflare-output-verifier/issues.mjs

@@ -0,0 +1,11 @@
+import "node:module";
+const addIssue = (issues, issue)=>{
+    issues.push(issue);
+};
+const assertEqual = (issues, actual, expected, issue)=>{
+    if (actual !== expected) addIssue(issues, issue);
+};
+const assertFlag = (issues, flags, flag, issue)=>{
+    if (!Array.isArray(flags) || !flags.includes(flag)) addIssue(issues, issue);
+};
+export { addIssue, assertEqual, assertFlag };