@let.com/cli 0.0.0-stage → 0.2.0

package/dist/edge/pack.mjs

@@ -0,0 +1,875 @@
+// The Create edge packager (app hosting spec §7.4, slice E2). Runs INSIDE an edge build — in the pinned
+// Node stage of the build pod's rootless BuildKit — after a framework's Cloudflare adapter has built
+// the app. It turns the adapter's output into the Create edge bundle the control plane deploys
+// (`create-edge.json` + `worker/*` + `public/*` [+ `cache/*`], see apps/api/src/apps-hosting/edge/bundle.ts):
+//
+//   1. locate the output — the Worker entry and the static-assets folder — for the adapter that ran
+//      (`resolveOutput`), preferring the wrangler config the Cloudflare Vite plugin / Nitro redirect to
+//      (`.wrangler/deploy/config.json`), else each adapter's documented output paths;
+//   2. bundle the Worker into ES modules with `wrangler deploy --dry-run --outdir` (`bundleCommand`);
+//   3. pack the bundle (`packBundle`): the modules, the static files, and for Next.js the prerendered
+//      incremental-cache entries keyed exactly as OpenNext's R2 cache reads them, plus the small entry
+//      wrapper Create needs for OpenNext on Workers for Platforms (`nextEntryWrapper`).
+//
+// Dependency-free on purpose (node: builtins only): it is copied into the build as it is, and the
+// tests in apps/app-edge/tests import this same file.
+
+import { createHash } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from 'node:fs';
+import { basename, dirname, extname, join, relative, resolve, sep } from 'node:path';
+import { gzipSync } from 'node:zlib';
+
+export const EDGE_MANIFEST_FILE = 'create-edge.json';
+export const DEFAULT_COMPAT_DATE = '2026-09-01';
+/** OpenNext's binding names (@opennextjs/cloudflare 1.20.6 through 1.20.12) and the cache key shape its R2 cache reads. */
+export const NEXT_BINDINGS = { incrementalCache: 'NEXT_INC_CACHE_R2_BUCKET', tagCache: 'NEXT_TAG_CACHE_D1' };
+export const NEXT_CACHE_KEY = /^incremental-cache\/[A-Za-z0-9_.-]{1,128}\/[0-9a-f]{64}\.(cache|fetch)$/;
+const BINDING_NAME = /^[A-Za-z_][A-Za-z0-9_]{0,63}$/;
+const CLASS_NAME = /^[A-Za-z_$][A-Za-z0-9_$]{0,63}$/;
+
+/** A failure an agent can act on: `code` is stable (the control plane's build summary keys on it). */
+export class EdgeBuildError extends Error {
+  constructor(code, message, fix) {
+    super(message);
+    this.code = code;
+    this.fix = fix ?? null;
+  }
+}
+
+const SERVER_FIX = 'Deploy it as a server instead (target "container"): every framework here also runs in a container.';
+
+// ---------------------------------------------------------------------------------------------
+// Reading configs
+// ---------------------------------------------------------------------------------------------
+
+/** JSON with comments and trailing commas (wrangler.jsonc). */
+export function parseJsonc(text) {
+  let out = '';
+  let inString = false;
+  for (let i = 0; i < text.length; i++) {
+    const ch = text[i];
+    if (inString) {
+      out += ch;
+      if (ch === '\\') {
+        out += text[++i] ?? '';
+      } else if (ch === '"') inString = false;
+      continue;
+    }
+    if (ch === '"') {
+      inString = true;
+      out += ch;
+    } else if (ch === '/' && text[i + 1] === '/') {
+      while (i < text.length && text[i] !== '\n') i++;
+      out += '\n';
+    } else if (ch === '/' && text[i + 1] === '*') {
+      i += 2;
+      while (i < text.length && !(text[i] === '*' && text[i + 1] === '/')) i++;
+      i++;
+    } else out += ch;
+  }
+  return JSON.parse(out.replace(/,(\s*[}\]])/g, '$1'));
+}
+
+function readJsonc(path) {
+  return parseJsonc(readFileSync(path, 'utf8'));
+}
+
+/**
+ * The wrangler config an adapter left behind, if any: the redirect file the Cloudflare Vite plugin and
+ * Nitro write (`.wrangler/deploy/config.json` → `{ "configPath": "…" }`, relative to its folder), else
+ * a `wrangler.json`/`wrangler.jsonc` at the root. Paths inside it are relative to its own folder.
+ */
+export function findWranglerConfig(root) {
+  const redirect = join(root, '.wrangler', 'deploy', 'config.json');
+  if (existsSync(redirect)) {
+    const { configPath } = readJsonc(redirect);
+    if (typeof configPath === 'string') {
+      const path = resolve(dirname(redirect), configPath);
+      if (!inside(root, path)) throw new EdgeBuildError('edge_output_invalid', 'The redirected wrangler config points outside the project');
+      if (existsSync(path)) return { path, config: readJsonc(path), redirected: true };
+    }
+  }
+  for (const name of ['wrangler.jsonc', 'wrangler.json']) {
+    const path = join(root, name);
+    if (existsSync(path)) return { path, config: readJsonc(path), redirected: false };
+  }
+  return null;
+}
+
+function inside(root, path) {
+  const rel = relative(resolve(root), resolve(path));
+  return rel === '' || (!rel.startsWith('..') && !rel.startsWith(sep) && !/^[A-Za-z]:/.test(rel));
+}
+
+/**
+ * Bindings the project's own wrangler config declares, mapped onto what a frontend can get: at most
+ * one KV namespace, one R2 bucket and one D1 database of its OWN (their ids/names in the config are
+ * ignored — the control plane provisions the frontend's), and Durable Objects of classes this Worker
+ * exports. Anything that would reach another Worker or an account-wide resource is refused.
+ */
+export function bindingsFromConfig(config) {
+  const resources = {};
+  const one = (list, kind, label) => {
+    if (!Array.isArray(list) || list.length === 0) return;
+    if (list.length > 1) throw new EdgeBuildError('edge_bindings_unsupported', `The wrangler config declares ${list.length} ${label} bindings; a frontend gets exactly one ${label} of its own`, `Use one ${label} binding (the frontend’s own), or deploy as a server.`);
+    const name = list[0]?.binding;
+    if (typeof name !== 'string' || !BINDING_NAME.test(name)) throw new EdgeBuildError('edge_bindings_unsupported', `A ${label} binding has an invalid name`);
+    resources[kind] = name;
+  };
+  one(config.kv_namespaces, 'kv', 'KV namespace');
+  one(config.r2_buckets, 'r2', 'R2 bucket');
+  one(config.d1_databases, 'd1', 'D1 database');
+  const durableObjects = [];
+  for (const b of config.durable_objects?.bindings ?? []) {
+    if (b.script_name) throw new EdgeBuildError('edge_bindings_unsupported', `Durable Object binding ${b.name} points at another Worker (${b.script_name}); only classes this Worker exports can be bound`);
+    if (!BINDING_NAME.test(b.name ?? '') || !CLASS_NAME.test(b.class_name ?? '')) throw new EdgeBuildError('edge_bindings_unsupported', 'A Durable Object binding has an invalid name or class name');
+    durableObjects.push({ name: b.name, className: b.class_name });
+  }
+  for (const key of ['services', 'queues', 'hyperdrive', 'vectorize', 'analytics_engine_datasets', 'dispatch_namespaces', 'mtls_certificates', 'workflows']) {
+    const v = config[key];
+    const present = Array.isArray(v) ? v.length > 0 : v && typeof v === 'object' && Object.keys(v).length > 0;
+    if (present) throw new EdgeBuildError('edge_bindings_unsupported', `The wrangler config declares ${key} bindings, which edge frontends on Create do not offer yet`, SERVER_FIX);
+  }
+  return { resources, durableObjects };
+}
+
+// ---------------------------------------------------------------------------------------------
+// Locating the adapter's output
+// ---------------------------------------------------------------------------------------------
+
+const firstExisting = (root, candidates) => candidates.map((c) => join(root, c)).find((p) => existsSync(p)) ?? null;
+
+/**
+ * Where the Worker entry and the static files are, per adapter (§7.4 table). `plan` is the build plan
+ * the control plane derived from the detector: `{ framework, adapter: { name, mode }, outputDir, spa }`.
+ */
+export function resolveOutput(root, plan) {
+  const adapter = plan.adapter?.name;
+  const mode = plan.adapter?.mode;
+  if (mode === 'static') {
+    const dir = plan.outputDir && plan.outputDir !== '.' ? join(root, plan.outputDir) : plan.outputDir === '.' ? root : firstExisting(root, ['dist', 'build', 'out', 'public']);
+    if (!dir || !existsSync(dir) || !statSync(dir).isDirectory()) throw new EdgeBuildError('edge_output_missing', `The build produced no static output folder${plan.outputDir ? ` (${plan.outputDir})` : ''}`, 'Check that the build script writes the site to that folder.');
+    return { main: null, assetsDir: dir, exclude: dir === root ? ['node_modules', '.git', EDGE_MANIFEST_FILE, 'package.json', 'package-lock.json', 'pnpm-lock.yaml', 'yarn.lock', 'create.json'] : [], compatibilityDate: DEFAULT_COMPAT_DATE, compatibilityFlags: [], resources: {}, durableObjects: [], cacheDir: null, wrapper: null };
+  }
+  if (adapter === 'opennext') {
+    const main = join(root, '.open-next', 'worker.js');
+    if (!existsSync(main)) throw new EdgeBuildError('edge_output_missing', 'OpenNext did not produce .open-next/worker.js', 'Look at the build log above for the Next.js or OpenNext error.');
+    const own = findWranglerConfig(root);
+    const fromConfig = own ? bindingsFromConfig(own.config) : { resources: {}, durableObjects: [] };
+    return {
+      main,
+      assetsDir: join(root, '.open-next', 'assets'),
+      exclude: [],
+      compatibilityDate: own?.config.compatibility_date ?? DEFAULT_COMPAT_DATE,
+      compatibilityFlags: unique(['nodejs_compat', 'global_fetch_strictly_public', ...(own?.config.compatibility_flags ?? [])]),
+      // The ISR bindings are the frontend's own R2 bucket and D1 database, whatever the config names.
+      resources: { ...fromConfig.resources, r2: NEXT_BINDINGS.incrementalCache, d1: NEXT_BINDINGS.tagCache },
+      durableObjects: fromConfig.durableObjects.filter((d) => !['DOQueueHandler', 'DOShardedTagCache', 'BucketCachePurge'].includes(d.className)),
+      cacheDir: join(root, '.open-next', 'cache'),
+      wrapper: 'next',
+    };
+  }
+  // Every other Worker adapter: the wrangler config it generated is the source of truth when it
+  // exists (Cloudflare Vite plugin: React Router, Astro 6+; Nitro); otherwise its documented paths.
+  const cfg = findWranglerConfig(root);
+  if (cfg && typeof cfg.config.main === 'string') {
+    const base = dirname(cfg.path);
+    const main = resolve(base, cfg.config.main);
+    const assetsDir = cfg.config.assets?.directory ? resolve(base, cfg.config.assets.directory) : null;
+    if (!inside(root, main) || (assetsDir && !inside(root, assetsDir))) throw new EdgeBuildError('edge_output_invalid', 'The wrangler config points outside the project');
+    if (existsSync(main)) {
+      const b = bindingsFromConfig(cfg.config);
+      return { main, assetsDir: assetsDir && existsSync(assetsDir) ? assetsDir : null, exclude: pagesExcludes(main, assetsDir), compatibilityDate: cfg.config.compatibility_date ?? DEFAULT_COMPAT_DATE, compatibilityFlags: cfg.config.compatibility_flags ?? [], resources: b.resources, durableObjects: b.durableObjects, cacheDir: null, wrapper: null };
+    }
+  }
+  const known = {
+    'astro-cloudflare': { main: ['dist/_worker.js/index.js', 'dist/_worker.js', 'dist/server/entry.mjs'], assets: ['dist/client', 'dist'] },
+    'sveltekit-cloudflare': { main: ['.svelte-kit/cloudflare/_worker.js'], assets: ['.svelte-kit/cloudflare'] },
+    'nitro-cloudflare': { main: ['.output/server/index.mjs'], assets: ['.output/public'] },
+    'cloudflare-vite': { main: ['build/server/index.js', 'dist/server/index.js'], assets: ['build/client', 'dist/client'] },
+  }[adapter];
+  if (!known) throw new EdgeBuildError('edge_adapter_unknown', `No edge adapter is known for ${adapter ?? 'this project'}`, SERVER_FIX);
+  const mainFile = firstExisting(root, known.main);
+  if (!mainFile) throw new EdgeBuildError('edge_output_missing', `The ${adapter} build produced no Worker entry (looked for ${known.main.join(', ')})`, 'Check that the Cloudflare adapter is configured for the app, or deploy as a server.');
+  const main = statSync(mainFile).isDirectory() ? join(mainFile, 'index.js') : mainFile;
+  const assetsDir = firstExisting(root, known.assets);
+  const own = cfg ? bindingsFromConfig(cfg.config) : { resources: {}, durableObjects: [] };
+  return { main, assetsDir, exclude: pagesExcludes(main, assetsDir), compatibilityDate: cfg?.config.compatibility_date ?? DEFAULT_COMPAT_DATE, compatibilityFlags: unique(['nodejs_compat', ...(cfg?.config.compatibility_flags ?? [])]), resources: own.resources, durableObjects: own.durableObjects, cacheDir: null, wrapper: null };
+}
+
+/** Pages-style outputs keep the Worker and routing files inside the assets folder: never serve them. */
+function pagesExcludes(main, assetsDir) {
+  const out = ['_worker.js', '_routes.json', '.assetsignore'];
+  if (assetsDir && inside(assetsDir, main)) out.push(relative(assetsDir, main).split(sep)[0]);
+  return unique(out);
+}
+
+const unique = (xs) => [...new Set(xs)];
+
+// ---------------------------------------------------------------------------------------------
+// Bundling the Worker
+// ---------------------------------------------------------------------------------------------
+
+/**
+ * The wrangler invocation that bundles `main` into ES modules in `outDir` (no upload: --dry-run). A
+ * generated config, so a project's own config cannot add routes, bindings or an account id.
+ */
+export function bundleCommand(output, outDir, configPath) {
+  const config = { name: 'create-edge-build', main: output.main, compatibility_date: output.compatibilityDate, compatibility_flags: output.compatibilityFlags, no_bundle: false, workers_dev: false };
+  writeFileSync(configPath, JSON.stringify(config, null, 2));
+  return { command: 'npx', args: ['--no-install', 'wrangler', 'deploy', '--dry-run', '--outdir', outDir, '--config', configPath], env: { WRANGLER_SEND_METRICS: 'false', CI: '1' } };
+}
+
+function walk(dir, rel = '') {
+  const out = [];
+  for (const name of readdirSync(dir).sort()) {
+    const abs = join(dir, name);
+    const r = rel ? `${rel}/${name}` : name;
+    const st = statSync(abs);
+    if (st.isDirectory()) out.push(...walk(abs, r));
+    else if (st.isFile()) out.push({ abs, rel: r, size: st.size });
+  }
+  return out;
+}
+
+/** The bundled modules wrangler wrote: the entry (named after `main`) first, then the rest. */
+export function collectModules(outDir, main) {
+  const files = walk(outDir).filter((f) => /\.(js|mjs|cjs|wasm)$/i.test(f.rel) && !f.rel.endsWith('.map'));
+  if (files.length === 0) throw new EdgeBuildError('edge_output_missing', 'Bundling produced no Worker module');
+  const stem = basename(main).replace(/\.[^.]+$/, '');
+  const entry = files.find((f) => !f.rel.includes('/') && f.rel.replace(/\.[^.]+$/, '') === stem) ?? (files.length === 1 ? files[0] : files.find((f) => !f.rel.includes('/') && /\.m?js$/.test(f.rel)));
+  if (!entry) throw new EdgeBuildError('edge_output_missing', `Bundling produced no entry module for ${basename(main)}`);
+  return [entry, ...files.filter((f) => f !== entry)];
+}
+
+// ---------------------------------------------------------------------------------------------
+// OpenNext specifics
+// ---------------------------------------------------------------------------------------------
+
+/**
+ * OpenNext's `computeCacheKey` (1.20.6 through 1.20.12, overrides/internal.js): `<prefix>/<buildId>/<sha256(key)>.<type>`.
+ */
+export function nextCacheKey(key, buildId, cacheType, prefix = 'incremental-cache') {
+  const hash = createHash('sha256').update(key).digest('hex');
+  return `${prefix}/${buildId}/${hash}.${cacheType}`.replace(/\/+/g, '/');
+}
+
+/**
+ * The prerendered cache entries of an OpenNext build (`.open-next/cache`), as OpenNext's own
+ * `populateCache` reads them: `<buildId>/<route>.cache` → type `cache`, `__fetch/<buildId>/<key>` →
+ * type `fetch`. Returned with the R2 key each is stored under in the frontend's own bucket.
+ */
+export function nextCacheEntries(cacheDir) {
+  if (!cacheDir || !existsSync(cacheDir)) return [];
+  const out = [];
+  for (const f of walk(cacheDir)) {
+    let key;
+    if (f.rel.startsWith('__fetch/')) {
+      const [, buildId, ...parts] = f.rel.split('/');
+      if (!buildId || parts.length === 0) throw new EdgeBuildError('edge_output_invalid', `Unexpected OpenNext cache file ${f.rel}`);
+      key = nextCacheKey(`/${parts.join('/')}`, buildId, 'fetch');
+    } else {
+      if (!f.rel.endsWith('.cache')) continue;
+      const [buildId, ...parts] = f.rel.slice(0, -'.cache'.length).split('/');
+      if (!buildId || parts.length === 0) throw new EdgeBuildError('edge_output_invalid', `Unexpected OpenNext cache file ${f.rel}`);
+      key = nextCacheKey(`/${parts.join('/')}`, buildId, 'cache');
+    }
+    if (!NEXT_CACHE_KEY.test(key)) throw new EdgeBuildError('edge_output_invalid', `OpenNext cache key ${key} has an unexpected shape`);
+    out.push({ key, abs: f.abs, size: f.size });
+  }
+  return out;
+}
+
+/**
+ * The entry module Create puts in front of an OpenNext Worker on Workers for Platforms:
+ *
+ * - `WORKER_SELF_REFERENCE`: OpenNext revalidates ISR pages by requesting them from itself through a
+ *   service binding of that name; a user Worker in a dispatch namespace has none, so the wrapper hands
+ *   it an in-process one (the same handler, a fresh invocation). Paired with OpenNext's memory queue.
+ * - `/_next/image`: local images are optimized through an `ASSETS` binding the dispatch model does not
+ *   give a user Worker (Create serves static files from the dispatch Worker); the wrapper answers with
+ *   a SAME-ORIGIN redirect to the original file, served unoptimized, and 400 for anything that would
+ *   resolve to another origin (security review L1: no open redirect). Since 2026-10-20 the dispatch
+ *   Worker answers `/_next/image` for a static file itself (the original, 200); this redirect remains
+ *   for sources that are not static files and for anonymous deploys.
+ * - every named export (Durable Object classes) is re-exported unchanged.
+ * - `zlib.inflateSync`'s `maxOutputLength` is clamped to workerd's 128 MiB maximum (Next.js 16 asks for
+ *   500 MiB when it reads a PPR postponed state; found by the 2026-10-20 conformance run).
+ */
+export function nextEntryWrapper(innerModule) {
+  const spec = `./${innerModule}`;
+  return `// Generated by Create's edge build (slice E2). See infra/app-cluster/builds/image/edge/pack.mjs.
+import * as inner from ${JSON.stringify(spec)};
+import letZlib from "node:zlib";
+export * from ${JSON.stringify(spec)};
+const worker = inner.default;
+// workerd's node:zlib refuses maxOutputLength above 128 MiB; Next.js asks for 500 MiB when it inflates a
+// partial-prerendering postponed state, so every PPR request lost its resume data cache ("Failed to
+// parse postponed state", RangeError). The same zip-bomb guard, at the largest size workerd allows.
+const letInflateSync = letZlib.inflateSync;
+try {
+  letZlib.inflateSync = (buffer, options) => letInflateSync(buffer, options && options.maxOutputLength > 134217728 ? { ...options, maxOutputLength: 134217728 } : options);
+} catch {}
+function envWithSelf(env, ctx) {
+  const scoped = Object.assign({}, env);
+  scoped.WORKER_SELF_REFERENCE = { fetch: (input, init) => worker.fetch(new Request(input, init), scoped, ctx) };
+  return scoped;
+}
+export default {
+  ...worker,
+  async fetch(request, env, ctx) {
+    const url = new URL(request.url);
+    if (url.pathname === '/_next/image') {
+      // Only ever a same-origin redirect: the source is resolved the way the browser will resolve it
+      // (\\ is /, tabs and newlines are dropped), and anything that lands elsewhere is refused.
+      const src = url.searchParams.get('url');
+      let target = null;
+      try {
+        target = src && src.startsWith('/') ? new URL(src, url) : null;
+      } catch {
+        target = null;
+      }
+      if (!target || target.origin !== url.origin) return new Response('Bad image URL', { status: 400 });
+      return Response.redirect(target.toString(), 307);
+    }
+    return worker.fetch(request, envWithSelf(env, ctx), ctx);
+  },
+};
+`;
+}
+
+/**
+ * Next.js Cache Components on workerd: the stage timers.
+ *
+ * Next.js renders a Cache Components prerender in stages (`runInSequentialTasks`): one `setTimeout(…, 0)`
+ * per stage, all scheduled at once by `createAtomicTimerGroup` so that Node.js runs them back to back in
+ * one timers phase. Work a stage starts with `setImmediate` (React schedules its rendering that way) is
+ * run before the next stage by Next's "fast setImmediate" scheduler, which captures immediates until
+ * "all nextTicks and microtasks spawned from the current task are done" — it waits with
+ * `queueMicrotask(() => process.nextTick(…))`, which in Node.js runs after the microtask queue drains.
+ * In workerd `process.nextTick` is a plain microtask, so the scheduler stops capturing while the stage's
+ * promise chain (a `'use cache'` entry read from the resume data cache, then React's ping) is still
+ * running; React's next `setImmediate` becomes a native workerd immediate, which runs only after the
+ * stage timers that are already due. When a page is regenerated at request time (after `revalidateTag`
+ * on a prerendered page or a PPR shell) the last stage then aborts the final prerender before the page
+ * segment is written, the shell length promise in the payload never resolves, Next's segment collection
+ * waits on it for ever, and workerd cancels the request as hung (502; the isolate's next request to that
+ * page hangs too). Found by the 2026-10-21 conformance run (finding 4); the build-time prerender and
+ * `next start` are unaffected (Node.js).
+ *
+ * The fix: the edge build points the timer call inside Next's own `createAtomicTimerGroup` (found by its
+ * invariant message, in every copy of the server runtime in the bundle) at `__letStageTimeout`, which
+ * runs one group's timers in the same order, and before each next stage yields to the event loop until
+ * the native immediates scheduled so far have run (at least one turn, at most `NEXT_STAGE_MAX_HOPS`):
+ * what Next's scheduler does in Node.js. `clearTimeout` on such a timer still cancels it.
+ */
+export const NEXT_STAGE_TIMER_ANCHOR = 'Cannot schedule more timers into a group that already executed';
+export const NEXT_STAGE_MAX_HOPS = 64;
+export const NEXT_STAGE_TIMERS_PRELUDE = `// Added by Let.com's edge build (pack.mjs, NEXT_STAGE_TIMERS_PRELUDE): Next.js stage timers on workerd.
+(() => {
+  if (globalThis.__letStageTimeout) return;
+  const maxHops = ${NEXT_STAGE_MAX_HOPS};
+  const realSetTimeout = globalThis.setTimeout.bind(globalThis);
+  const realClearTimeout = globalThis.clearTimeout.bind(globalThis);
+  // Native immediates not yet run (Next's scheduler wraps this setImmediate, so it sees what Next does).
+  const realSetImmediate = globalThis.setImmediate;
+  const realClearImmediate = globalThis.clearImmediate;
+  const pending = new Map();
+  if (typeof realSetImmediate === 'function' && typeof realClearImmediate === 'function') {
+    const countedSetImmediate = function (callback, ...args) {
+      if (typeof callback !== 'function') return realSetImmediate.call(globalThis, callback, ...args);
+      const state = { done: false };
+      const handle = realSetImmediate.call(globalThis, function (...a) {
+        if (!state.done) { state.done = true; pending.delete(handle); }
+        return callback.apply(this, a);
+      }, ...args);
+      pending.set(handle, state);
+      return handle;
+    };
+    const custom = Symbol.for('nodejs.util.promisify.custom');
+    if (realSetImmediate[custom]) countedSetImmediate[custom] = realSetImmediate[custom];
+    globalThis.setImmediate = countedSetImmediate;
+    globalThis.clearImmediate = function (handle) {
+      const state = pending.get(handle);
+      if (state) { state.done = true; pending.delete(handle); }
+      return realClearImmediate.call(globalThis, handle);
+    };
+  }
+  class LetStageTimer {
+    constructor(callback, args) { this.callback = callback; this.args = args; this.cancelled = false; }
+  }
+  let open = null;
+  const runNext = (chain) => {
+    const timer = chain.timers.shift();
+    if (!timer) return;
+    try {
+      if (!timer.cancelled) { timer.cancelled = true; timer.callback(...timer.args); }
+    } finally {
+      if (chain.timers.length > 0) hop(chain, 1);
+    }
+  };
+  const hop = (chain, n) => realSetTimeout(() => (pending.size > 0 && n < maxHops ? hop(chain, n + 1) : runNext(chain)), 0);
+  globalThis.__letStageTimeout = (callback, delay, ...args) => {
+    const timer = new LetStageTimer(callback, args);
+    // The timers one group schedules in one synchronous run form one chain.
+    if (open === null) {
+      const chain = (open = { timers: [] });
+      queueMicrotask(() => { if (open === chain) open = null; });
+      realSetTimeout(() => runNext(chain), delay ?? 0);
+    }
+    open.timers.push(timer);
+    return timer;
+  };
+  globalThis.clearTimeout = (id) => (id instanceof LetStageTimer ? void (id.cancelled = true) : realClearTimeout(id));
+})();
+`;
+
+/**
+ * Points Next.js's stage timers at `__letStageTimeout` in one bundled Worker module (see above).
+ * Returns the new text (with the prelude when anything changed), how many timer groups it found and how
+ * many it changed; a group it cannot change is left alone and counted.
+ */
+export function patchNextStageTimers(text) {
+  // Already adjusted (a second pass): nothing to do.
+  if (text.includes('__letStageTimeout')) {
+    const anchors = text.split(NEXT_STAGE_TIMER_ANCHOR).length - 1;
+    return { text, anchors, patched: anchors };
+  }
+  let anchors = 0;
+  let patched = 0;
+  let out = '';
+  let from = 0;
+  for (let at = text.indexOf(NEXT_STAGE_TIMER_ANCHOR); at >= 0; at = text.indexOf(NEXT_STAGE_TIMER_ANCHOR, at + 1)) {
+    anchors += 1;
+    // The group's own setTimeout follows its invariant check within a few hundred characters.
+    const window = text.slice(at, at + 600);
+    const m = /([^\w$.])setTimeout\(/.exec(window);
+    if (!m) continue;
+    const pos = at + m.index + m[1].length;
+    out += text.slice(from, pos) + '(globalThis.__letStageTimeout ?? setTimeout)(';
+    from = pos + 'setTimeout('.length;
+    patched += 1;
+  }
+  if (patched === 0) return { text, anchors, patched };
+  return { text: NEXT_STAGE_TIMERS_PRELUDE + out + text.slice(from), anchors, patched };
+}
+
+/** Whether the Next.js build has Cache Components on (`.next/required-server-files.json`). */
+export function nextCacheComponentsEnabled(root) {
+  const p = join(root, '.next', 'required-server-files.json');
+  if (!existsSync(p)) return false;
+  try {
+    const config = JSON.parse(readFileSync(p, 'utf8')).config ?? {};
+    return Boolean(config.cacheComponents || config.experimental?.cacheComponents || config.experimental?.ppr || config.experimental?.dynamicIO);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * After bundling an OpenNext Worker: `patchNextStageTimers` on every bundled module. With Cache
+ * Components on, a timer group left unchanged would hang regenerated pages, so the build stops instead.
+ */
+export function applyNextStageTimers(workerDir, cacheComponents) {
+  let anchors = 0;
+  let patched = 0;
+  for (const f of walk(workerDir)) {
+    if (!/\.(js|mjs|cjs)$/.test(f.rel)) continue;
+    const text = readFileSync(f.abs, 'utf8');
+    if (!text.includes(NEXT_STAGE_TIMER_ANCHOR)) continue;
+    const r = patchNextStageTimers(text);
+    anchors += r.anchors;
+    patched += r.patched;
+    if (r.patched > 0) writeFileSync(f.abs, r.text);
+  }
+  if (cacheComponents && patched < anchors) {
+    throw new EdgeBuildError(
+      'edge_next_stage_timers',
+      `This Next.js version's Cache Components stage timers have a shape the edge build does not recognise (${anchors - patched} of ${anchors} not adjusted); regenerated pages would hang on the edge runtime`,
+      'Deploy it as a server (target "container"), or use a Next.js version the edge build supports (see the Next.js conformance page).',
+    );
+  }
+  return { anchors, patched };
+}
+
+/** The open-next.config.ts Create writes when a project has none: R2 cache, D1 tag cache, memory queue. */
+export const NEXT_OPEN_NEXT_CONFIG = `// Written by Create's edge build (slice E2): the frontend's own R2 bucket holds the incremental cache,
+// its own D1 database the tag cache; revalidation runs in-process (see pack.mjs, nextEntryWrapper).
+import { defineCloudflareConfig } from "@opennextjs/cloudflare";
+import r2IncrementalCache from "@opennextjs/cloudflare/overrides/incremental-cache/r2-incremental-cache";
+import d1NextTagCache from "@opennextjs/cloudflare/overrides/tag-cache/d1-next-tag-cache";
+import memoryQueue from "@opennextjs/cloudflare/overrides/queue/memory-queue";
+
+export default defineCloudflareConfig({
+  incrementalCache: r2IncrementalCache,
+  tagCache: d1NextTagCache,
+  queue: memoryQueue,
+});
+`;
+
+/** `>=15.5.28 <16 || >=16.4.1`-style ranges (what OpenNext declares for next), for a plain x.y.z version. */
+export function satisfiesSimpleRange(version, range) {
+  const parse = (v) => (/^(\d+)\.(\d+)\.(\d+)/.exec(v) ?? []).slice(1, 4).map(Number);
+  const cmp = (a, b) => a[0] - b[0] || a[1] - b[1] || a[2] - b[2];
+  const v = parse(version);
+  if (v.length !== 3) return true;
+  return range.split('||').some((part) =>
+    part.trim().split(/\s+/).filter(Boolean).every((c) => {
+      const m = /^(>=|<=|>|<|=)?v?(\d+(?:\.\d+){0,2})/.exec(c);
+      if (!m) return true;
+      const t = m[2].split('.').map(Number);
+      while (t.length < 3) t.push(0);
+      const d = cmp(v, t);
+      return m[1] === '>=' ? d >= 0 : m[1] === '<=' ? d <= 0 : m[1] === '>' ? d > 0 : m[1] === '<' ? d < 0 : d === 0;
+    }),
+  );
+}
+
+/** The folders whose files carry Next.js route segment config (`runtime`). */
+const NEXT_ROUTE_DIRS = ['app', 'src/app', 'pages', 'src/pages'];
+const NEXT_ROUTE_FILE = /\.(js|jsx|mjs|ts|tsx|mts)$/;
+/** App Router segment config: `export const runtime = 'edge'` (or the older 'experimental-edge'). */
+const APP_EDGE_RUNTIME = /^(\s*export\s+const\s+runtime\s*(?::\s*[A-Za-z]+\s*)?=\s*)(['"`])(?:experimental-)?edge\2/gm;
+/** Pages Router: `export const config = { runtime: 'edge' }` (pages use 'experimental-edge'). */
+const PAGES_EDGE_RUNTIME = /(\bruntime\s*:\s*)(['"`])(?:experimental-)?edge\2/g;
+
+/**
+ * Where `export const config = { … }` sits in a Pages Router file: the object literal's braces, found by
+ * depth (strings skipped), or null. Linear, and only the first such export counts.
+ */
+function pagesConfigObject(text) {
+  const head = /export\s+const\s+config\s*(?::\s*[A-Za-z_$][\w$.<>, ]*)?=\s*\{/.exec(text);
+  if (!head) return null;
+  const start = head.index + head[0].length;
+  let depth = 1;
+  let quote = null;
+  for (let i = start; i < text.length; i++) {
+    const ch = text[i];
+    if (quote) {
+      if (ch === '\\') i += 1;
+      else if (ch === quote) quote = null;
+      continue;
+    }
+    if (ch === '"' || ch === "'" || ch === '`') quote = ch;
+    else if (ch === '{') depth += 1;
+    else if (ch === '}' && --depth === 0) return { start, end: i };
+  }
+  return null;
+}
+
+/** A Pages Router API route's default export, which the adapter below takes over. */
+const DEFAULT_EXPORT = /^export\s+default\s+/m;
+
+/**
+ * Appended to a Pages Router API route that was written for the Edge runtime: the Node.js API route
+ * signature `(req, res)` wraps the route's own `(request: NextRequest, ctx) => Response` handler — the
+ * request becomes a NextRequest (raw body: the body parser is turned off on the exported config), the Response (headers, every
+ * Set-Cookie, a streamed body) is written back to `res`. `@vercel/og` image routes are the usual case.
+ */
+export const PAGES_EDGE_API_ADAPTER = `
+// Added by Let.com's edge build: this Edge-runtime API route runs on the Node.js runtime in the same Worker.
+import { NextRequest as __LetNextRequest } from 'next/server';
+// The raw body for the Request (Next.js reads config.api.bodyParser at request time).
+Reflect.set(config, 'api', Object.assign({}, Reflect.get(config, 'api'), { bodyParser: false }));
+export default async function __letEdgeApiRoute(req, res) {
+  const headers = new Headers();
+  for (const [k, v] of Object.entries(req.headers)) if (v !== undefined) headers.set(k, Array.isArray(v) ? v.join(', ') : String(v));
+  const proto = String(req.headers['x-forwarded-proto'] ?? 'https').split(',')[0].trim();
+  const url = new URL(req.url ?? '/', proto + '://' + (req.headers.host ?? 'localhost'));
+  const method = req.method ?? 'GET';
+  let body;
+  if (method !== 'GET' && method !== 'HEAD') {
+    const chunks = [];
+    for await (const chunk of req) chunks.push(typeof chunk === 'string' ? new TextEncoder().encode(chunk) : chunk);
+    body = chunks.length ? new Blob(chunks) : undefined;
+  }
+  const pending = [];
+  const response = await __letEdgeHandler(new __LetNextRequest(url, { method, headers, body }), { waitUntil: (p) => pending.push(Promise.resolve(p).catch(() => {})) });
+  res.statusCode = response.status;
+  if (response.statusText) res.statusMessage = response.statusText;
+  const cookies = typeof response.headers.getSetCookie === 'function' ? response.headers.getSetCookie() : [];
+  response.headers.forEach((value, key) => { if (key !== 'set-cookie') res.setHeader(key, value); });
+  if (cookies.length) res.setHeader('set-cookie', cookies);
+  if (response.body && method !== 'HEAD') {
+    for await (const chunk of response.body) res.write(chunk);
+  }
+  res.end();
+  await Promise.all(pending);
+}
+`;
+
+/**
+ * Before `next build` (an OpenNext app): routes and pages that ask for the Edge runtime are built for
+ * the Node.js runtime instead. OpenNext for Cloudflare bundles only Next's Node.js server into the
+ * Worker ("the edge runtime is not supported", @opennextjs/cloudflare bundle-server.js); an Edge-runtime
+ * route is compiled into `.next/server/edge/` where that server cannot load it, and answered 500 at
+ * request time (`Cannot read properties of undefined (reading 'default')`, observed 2026-10-03 and again
+ * with 1.20.12 on 2026-10-20). On Workers the Node.js runtime runs in the same V8 isolate at the same
+ * locations, and the Edge runtime's APIs are a subset of it, so the route behaves the same.
+ *
+ * App Router routes and pages, and Pages Router pages, keep their code (only the runtime changes). A
+ * Pages Router API route also changes signature with the runtime, so its default export is wrapped
+ * (`PAGES_EDGE_API_ADAPTER`); one whose default export is not `export default …` is left on the Edge
+ * runtime, and `assertNoEdgeFunctions` then refuses the build with the file named.
+ *
+ * Only the build's own copy of the source is changed. Returns the files changed (relative paths).
+ */
+export function nextEdgeRuntimeToNode(root) {
+  const changed = [];
+  for (const dir of NEXT_ROUTE_DIRS) {
+    const abs = join(root, dir);
+    if (!existsSync(abs) || !statSync(abs).isDirectory()) continue;
+    const pages = dir.endsWith('pages');
+    for (const f of walk(abs)) {
+      if (!NEXT_ROUTE_FILE.test(f.rel) || f.size > 2 * 1024 * 1024) continue;
+      const text = readFileSync(f.abs, 'utf8');
+      if (!text.includes('edge')) continue;
+      let next = text.replace(APP_EDGE_RUNTIME, (_m, head, q) => `${head}${q}nodejs${q}`);
+      const config = pages ? pagesConfigObject(next) : null;
+      if (config && new RegExp(PAGES_EDGE_RUNTIME.source).test(next.slice(config.start, config.end))) {
+        // Only the config object's own `runtime` changes (a handler may well return { runtime: 'edge' }).
+        const inConfig = (replacement) => next.slice(0, config.start) + next.slice(config.start, config.end).replace(new RegExp(PAGES_EDGE_RUNTIME.source), replacement) + next.slice(config.end);
+        if (f.rel.startsWith('api/')) {
+          // An API route: the handler signature changes with the runtime, so the adapter takes over.
+          if (DEFAULT_EXPORT.test(next)) {
+            next = inConfig((_m, head, q) => `${head}${q}nodejs${q}`);
+            next = `${next.replace(DEFAULT_EXPORT, 'const __letEdgeHandler = ')}\n;${PAGES_EDGE_API_ADAPTER}`;
+            // The adapter is plain JavaScript: a TypeScript route is not type-checked again (build copy only).
+            if (/\.(ts|tsx|mts)$/.test(f.rel)) next = `// @ts-nocheck\n${next}`;
+          }
+        } else {
+          next = inConfig((_m, head, q) => `${head}${q}nodejs${q}`);
+        }
+      }
+      if (next !== text) {
+        writeFileSync(f.abs, next);
+        changed.push(`${dir}/${f.rel}`);
+      }
+    }
+  }
+  return changed.sort();
+}
+
+/**
+ * After `next build`: what Next's own manifests say about the server code (the same files OpenNext reads).
+ *
+ * - `nodeMiddleware`: Node.js middleware (Next 15.2+ `runtime: 'nodejs'`) or Next 16's `proxy`. OpenNext
+ *   1.20.3+ bundles it into the Worker (experimental upstream; Let.com's conformance suite runs it:
+ *   docs/apps/nextjs-compatibility.md).
+ * - `edgeFunctions`: pages and routes still compiled for the Edge runtime (none after
+ *   `nextEdgeRuntimeToNode`, unless a route declares it in a form that function does not rewrite).
+ */
+export function nextBuildFindings(root) {
+  const dotNext = join(root, '.next', 'server');
+  const read = (name) => {
+    const p = join(dotNext, name);
+    return existsSync(p) ? JSON.parse(readFileSync(p, 'utf8')) : null;
+  };
+  const manifest = read('middleware-manifest.json');
+  const edgeMiddleware = manifest?.middleware?.['/'];
+  const node = read('functions-config-manifest.json')?.functions?.['/_middleware'];
+  const edgeFunctions = Object.values(manifest?.functions ?? {})
+    .map((fn) => (fn && typeof fn.page === 'string' ? fn.page : null))
+    .filter(Boolean)
+    .sort();
+  return { nodeMiddleware: Boolean(!edgeMiddleware && node), edgeFunctions };
+}
+
+/** An Edge-runtime route left after the rewrite would answer 500 on every request: refuse the build instead. */
+export function assertNoEdgeFunctions(root) {
+  const { edgeFunctions } = nextBuildFindings(root);
+  if (edgeFunctions.length > 0) {
+    throw new EdgeBuildError(
+      'edge_runtime_route',
+      `${edgeFunctions.join(', ')} ${edgeFunctions.length === 1 ? 'is' : 'are'} still built for the Edge runtime, which the Worker cannot load`,
+      "Remove the Edge runtime setting from those files (the Node.js runtime runs on Let.com's edge, in the same Worker), or deploy it as a server (target \"container\").",
+    );
+  }
+}
+
+// ---------------------------------------------------------------------------------------------
+// Packing
+// ---------------------------------------------------------------------------------------------
+
+const enc = new TextEncoder();
+
+function tarHeader(name, size, type = '0') {
+  const h = Buffer.alloc(512, 0);
+  h.write(name, 0, 100, 'utf8');
+  h.write('0000644\0', 100, 'ascii');
+  h.write('0000000\0', 108, 'ascii');
+  h.write('0000000\0', 116, 'ascii');
+  h.write(`${size.toString(8).padStart(11, '0')}\0`, 124, 'ascii');
+  h.write('00000000000\0', 136, 'ascii');
+  h.write('        ', 148, 'ascii');
+  h.write(type, 156, 'ascii');
+  h.write('ustar\0', 257, 'ascii');
+  h.write('00', 263, 'ascii');
+  let sum = 0;
+  for (const b of h) sum += b;
+  h.write(`${sum.toString(8).padStart(6, '0')}\0 `, 148, 'ascii');
+  return h;
+}
+
+const padTo512 = (n) => Buffer.alloc((512 - (n % 512)) % 512, 0);
+
+/** A deterministic ustar archive of regular files (PAX `path` records for long names), gzipped. */
+export function tarGz(entries) {
+  const parts = [];
+  for (const { path, data } of entries) {
+    const body = Buffer.from(data);
+    if (Buffer.byteLength(path) > 100) {
+      const rec = (len) => `${len} path=${path}\n`;
+      let len = Buffer.byteLength(rec(0));
+      while (Buffer.byteLength(rec(len)) !== len) len = Buffer.byteLength(rec(len));
+      const pax = Buffer.from(rec(len), 'utf8');
+      parts.push(tarHeader('PaxHeader', pax.length, 'x'), pax, padTo512(pax.length));
+      parts.push(tarHeader(path.slice(-100).replace(/^\/+/, ''), body.length), body, padTo512(body.length));
+    } else {
+      parts.push(tarHeader(path, body.length), body, padTo512(body.length));
+    }
+  }
+  parts.push(Buffer.alloc(1024, 0));
+  return gzipSync(Buffer.concat(parts), { level: 9 });
+}
+
+/**
+ * Build the Create edge bundle from a located output and bundled modules.
+ *
+ * @param {object} input
+ * @param {object} input.output     resolveOutput(...)
+ * @param {Array}  input.modules    collectModules(...) (empty for static)
+ * @param {object} input.plan       { framework, spa, notFound?, maxScriptBytes }
+ * @returns {{ tarball: Buffer, sha256: string, manifest: object, stats: object }}
+ */
+/**
+ * E5: the image sources a Next.js app declared (`images.remotePatterns` / `images.domains` in
+ * next.config), as `next build` recorded them in `.next/required-server-files.json`. Copied raw and
+ * capped; the CONTROL PLANE validates them (https only, no ports/IPs/internal names) — a build is
+ * never trusted to widen anything.
+ */
+export function nextImagesConfig(root) {
+  const file = join(root, '.next', 'required-server-files.json');
+  if (!existsSync(file)) return null;
+  let images;
+  try {
+    images = JSON.parse(readFileSync(file, 'utf8'))?.config?.images;
+  } catch {
+    return null;
+  }
+  if (!images || typeof images !== 'object') return null;
+  const remotePatterns = (Array.isArray(images.remotePatterns) ? images.remotePatterns : [])
+    .filter((p) => typeof p === 'string' || (p && typeof p === 'object' && typeof p.hostname === 'string'))
+    .slice(0, 100)
+    .map((p) => (typeof p === 'string' ? p.slice(0, 300) : { protocol: typeof p.protocol === 'string' ? p.protocol.slice(0, 10) : undefined, hostname: p.hostname.slice(0, 300), port: typeof p.port === 'string' ? p.port.slice(0, 10) : undefined, pathname: typeof p.pathname === 'string' ? p.pathname.slice(0, 300) : undefined }));
+  const domains = (Array.isArray(images.domains) ? images.domains : []).filter((d) => typeof d === 'string').slice(0, 100).map((d) => d.slice(0, 300));
+  const qualities = Array.isArray(images.qualities) ? images.qualities.filter((q) => typeof q === 'number').slice(0, 20) : null;
+  if (!remotePatterns.length && !domains.length && !qualities) return null;
+  return { remotePatterns, domains, ...(qualities ? { qualities } : {}) };
+}
+
+/**
+ * The `headers()` rules of next.config, as `next build` recorded them (`.next/routes-manifest.json`),
+ * in the routing-rules shape (`source`, `headers`, `has`, `missing`: the same path-to-regexp dialect).
+ * Next.js applies them inside the Worker to everything it answers; Let.com's dispatch Worker serves
+ * static files (`/_next/static/*`, `public/`) before the Worker, so it applies these to those files too,
+ * as Vercel does. Capped; the CONTROL PLANE validates every rule (a build is never trusted).
+ */
+export function nextStaticHeaders(root) {
+  const file = join(root, '.next', 'routes-manifest.json');
+  if (!existsSync(file)) return [];
+  let headers;
+  try {
+    headers = JSON.parse(readFileSync(file, 'utf8'))?.headers;
+  } catch {
+    return [];
+  }
+  if (!Array.isArray(headers)) return [];
+  const cond = (list) => (Array.isArray(list) ? list.filter((c) => c && typeof c.type === 'string').slice(0, 8).map((c) => ({ type: c.type, ...(typeof c.key === 'string' ? { key: c.key } : {}), ...(typeof c.value === 'string' ? { value: c.value } : {}) })) : []);
+  return headers
+    .filter((h) => h && typeof h.source === 'string' && Array.isArray(h.headers) && h.headers.length > 0 && !h.internal)
+    .slice(0, 256)
+    .map((h) => {
+      const has = cond(h.has);
+      const missing = cond(h.missing);
+      return {
+        source: h.source.slice(0, 1024),
+        headers: h.headers.filter((x) => x && typeof x.key === 'string' && typeof x.value === 'string').slice(0, 32).map((x) => ({ key: x.key.slice(0, 256), value: x.value.slice(0, 4096) })),
+        ...(has.length ? { has } : {}),
+        ...(missing.length ? { missing } : {}),
+      };
+    })
+    .filter((h) => h.headers.length > 0);
+}
+
+export function packBundle({ output, modules, plan, images = null, staticHeaders = null }) {
+  const entries = [];
+  const manifest = { version: 1, assets: 'public', compatibilityDate: output.compatibilityDate, compatibilityFlags: output.compatibilityFlags, spa: false, notFound: null };
+  if (plan.framework) manifest.framework = plan.framework;
+  if (images) manifest.images = images;
+  if (staticHeaders && staticHeaders.length > 0) manifest.headers = staticHeaders;
+  let scriptBytes = 0;
+  if (output.main) {
+    if (modules.length === 0) throw new EdgeBuildError('edge_output_missing', 'The Worker was not bundled');
+    const names = [];
+    for (const m of modules) {
+      const data = readFileSync(m.abs);
+      scriptBytes += data.length;
+      entries.push({ path: `worker/${m.rel}`, data });
+      names.push(`worker/${m.rel}`);
+    }
+    if (output.wrapper === 'next') {
+      const wrapper = enc.encode(nextEntryWrapper(modules[0].rel));
+      scriptBytes += wrapper.length;
+      entries.push({ path: 'worker/create-entry.mjs', data: wrapper });
+      manifest.main = 'worker/create-entry.mjs';
+      manifest.modules = names;
+    } else {
+      manifest.main = names[0];
+      manifest.modules = names.slice(1);
+    }
+    const r = Object.fromEntries(Object.entries(output.resources ?? {}).filter(([, v]) => v));
+    if (Object.keys(r).length > 0) manifest.resources = r;
+    if ((output.durableObjects ?? []).length > 0) manifest.durableObjects = output.durableObjects;
+  } else {
+    manifest.spa = Boolean(plan.spa);
+    if (plan.notFound) manifest.notFound = plan.notFound;
+  }
+  if (plan.maxScriptBytes && scriptBytes > plan.maxScriptBytes) {
+    throw new EdgeBuildError('edge_bundle_too_large', `The Worker is ${(scriptBytes / 1024 / 1024).toFixed(1)} MiB, over the edge limit of ${(plan.maxScriptBytes / 1024 / 1024).toFixed(1)} MiB`, SERVER_FIX);
+  }
+  let assetCount = 0;
+  let assetBytes = 0;
+  if (output.assetsDir && existsSync(output.assetsDir)) {
+    const excluded = new Set(output.exclude ?? []);
+    for (const f of walk(output.assetsDir)) {
+      const top = f.rel.split('/')[0];
+      if (excluded.has(top) || excluded.has(f.rel)) continue;
+      entries.push({ path: `public/${f.rel}`, data: readFileSync(f.abs) });
+      assetCount += 1;
+      assetBytes += f.size;
+    }
+  }
+  if (!manifest.spa && !output.main && entries.some((e) => e.path === 'public/404.html')) manifest.notFound = manifest.notFound ?? '404.html';
+  let cacheCount = 0;
+  if (output.cacheDir) {
+    for (const c of nextCacheEntries(output.cacheDir)) {
+      entries.push({ path: `cache/${c.key}`, data: readFileSync(c.abs) });
+      cacheCount += 1;
+    }
+    if (cacheCount > 0) manifest.cache = { r2: 'cache' };
+  }
+  if (!output.main && assetCount === 0) throw new EdgeBuildError('edge_output_missing', 'The build produced no files to serve');
+  entries.unshift({ path: EDGE_MANIFEST_FILE, data: enc.encode(JSON.stringify(manifest, null, 2)) });
+  const tarball = tarGz(entries);
+  return { tarball, sha256: createHash('sha256').update(tarball).digest('hex'), manifest, stats: { scriptBytes, assetCount, assetBytes, cacheCount, modules: modules.length } };
+}
+
+/** Writes the bundle and a small result file the build pod's shell reads. */
+export function writeBundle(outDir, packed) {
+  mkdirSync(outDir, { recursive: true });
+  writeFileSync(join(outDir, 'bundle.tar.gz'), packed.tarball);
+  writeFileSync(join(outDir, 'result.json'), JSON.stringify({ sha256: packed.sha256, sizeBytes: packed.tarball.length, stats: packed.stats }));
+}
+
+export const _internal = { walk, inside, extname };