@bleedingdev/modern-js-create 3.2.0-ultramodern.102 → 3.2.0-ultramodern.104

package/dist/index.js

@@ -559,6 +559,64 @@ const localeKeys = i18n.init('en', {
     zh: ZH_LOCALE,
     en: EN_LOCALE
 });
+const WORKSPACE_PACKAGE_VERSION = 'workspace:*';
+const BLEEDINGDEV_CREATE_PACKAGE = '@bleedingdev/modern-js-create';
+const BLEEDINGDEV_PACKAGE_SCOPE = 'bleedingdev';
+const BLEEDINGDEV_PACKAGE_NAME_PREFIX = 'modern-js-';
+const BLEEDINGDEV_FRAMEWORK_VERSION_ENV = 'MODERN_CREATE_ULTRAMODERN_FRAMEWORK_VERSION';
+const ULTRAMODERN_SINGLE_APP_MODERN_PACKAGES = [
+    '@modern-js/runtime',
+    '@modern-js/app-tools',
+    '@modern-js/tsconfig',
+    '@modern-js/plugin-i18n',
+    '@modern-js/plugin-tanstack',
+    '@modern-js/plugin-bff',
+    '@modern-js/adapter-rstest'
+];
+const ULTRAMODERN_WORKSPACE_MODERN_PACKAGES = [
+    '@modern-js/app-tools',
+    '@modern-js/plugin-bff',
+    '@modern-js/plugin-i18n',
+    '@modern-js/plugin-tanstack',
+    '@modern-js/runtime'
+];
+function modernPackageVersion(packageSource) {
+    return 'install' === packageSource.strategy ? packageSource.modernPackageVersion : WORKSPACE_PACKAGE_VERSION;
+}
+function modernAliasPackageName(packageName, packageSource) {
+    if (!packageSource.aliasScope) return packageName;
+    const scope = packageSource.aliasScope.replace(/^@/, '');
+    const unscopedName = packageName.split('/').at(-1);
+    return `@${scope}/${packageSource.aliasPackageNamePrefix ?? ''}${unscopedName}`;
+}
+function modernPackageSpecifier(packageName, packageSource) {
+    if ('install' !== packageSource.strategy) return WORKSPACE_PACKAGE_VERSION;
+    if (!packageSource.aliasScope) return packageSource.modernPackageVersion;
+    return `npm:${modernAliasPackageName(packageName, packageSource)}@${packageSource.modernPackageVersion}`;
+}
+function modernPackageAliases(packageNames, packageSource) {
+    if (!packageSource.aliasScope) return;
+    return Object.fromEntries(packageNames.map((packageName)=>[
+            packageName,
+            modernAliasPackageName(packageName, packageSource)
+        ]));
+}
+function createModernPackagesMetadata(packageNames, packageSource, options = {}) {
+    const includeAliases = options.includeAliases ?? Boolean(packageSource.aliasScope);
+    const aliases = includeAliases ? modernPackageAliases(packageNames, packageSource) : void 0;
+    return {
+        packages: [
+            ...packageNames
+        ],
+        specifier: modernPackageVersion(packageSource),
+        ...packageSource.registry ? {
+            registry: packageSource.registry
+        } : {},
+        ...aliases ? {
+            aliases
+        } : {}
+    };
+}
 const ultramodern_workspace_dirname = node_path.dirname(fileURLToPath(import.meta.url));
 const workspaceTemplateDir = node_path.resolve(ultramodern_workspace_dirname, '..', 'template-workspace');
 const TANSTACK_ROUTER_VERSION = '1.170.11';
@@ -566,6 +624,7 @@ const MODULE_FEDERATION_VERSION = '2.5.0';
 const ZEPHYR_RSPACK_PLUGIN_VERSION = '1.1.1';
 const ZEPHYR_AGENT_VERSION = '1.1.1';
 const WRANGLER_VERSION = '4.95.0';
+const CLOUDFLARE_COMPATIBILITY_DATE = '2026-06-02';
 const TAILWIND_VERSION = '4.3.0';
 const TAILWIND_POSTCSS_VERSION = '4.3.0';
 const EFFECT_TSGO_VERSION = '0.13.0';
@@ -580,7 +639,6 @@ const REACT_VERSION = '^19.2.6';
 const REACT_DOM_VERSION = '^19.2.6';
 const REACT_ROUTER_DOM_VERSION = '7.16.0';
 const PNPM_VERSION = '11.5.0';
-const WORKSPACE_PACKAGE_VERSION = 'workspace:*';
 const GENERATED_CONTRACT_PATH = '.modernjs/ultramodern-generated-contract.json';
 const RSTACK_AGENT_SKILLS_COMMIT = '61c948b42512e223bad44b83af4080eba48b2677';
 const MODULE_FEDERATION_AGENT_SKILLS_COMMIT = '07bb5b6c43ad457609e00c081b72d4c42508ec76';
@@ -604,13 +662,6 @@ const privateAgentSkills = [
     'debugger-mode'
 ];
 const effectTsgoTypecheckCommand = "node -e \"const fs = require('node:fs'); const { execFileSync, spawnSync } = require('node:child_process'); const bin = execFileSync('effect-tsgo', ['get-exe-path'], { encoding: 'utf8' }).trim(); if (process.platform !== 'win32') fs.chmodSync(bin, 0o755); const result = spawnSync(bin, ['--noEmit', '-p', 'tsconfig.json'], { stdio: 'inherit' }); process.exit(result.status ?? 1);\"";
-const modernPackageNames = [
-    '@modern-js/app-tools',
-    '@modern-js/plugin-bff',
-    '@modern-js/plugin-i18n',
-    '@modern-js/plugin-tanstack',
-    '@modern-js/runtime'
-];
 function sortJsonValue(value) {
     if (Array.isArray(value)) return value.map(sortJsonValue);
     if (null !== value && 'object' == typeof value) return Object.fromEntries(Object.entries(value).sort(([left], [right])=>left.localeCompare(right)).map(([key, entry])=>[
@@ -619,6 +670,10 @@ function sortJsonValue(value) {
         ]));
     return value;
 }
+const supportedWorkspaceLanguages = [
+    'en',
+    'cs'
+];
 const ULTRAMODERN_WORKSPACE_FLAG = '--ultramodern-workspace';
 const FIRST_VERTICAL_PORT = 4101;
 const TAILWIND_PREFIX_DIGIT_WORDS = [
@@ -913,28 +968,23 @@ function relativeRootFor(packageDir) {
     return normalizePath(node_path.relative(packageDir, '.') || '.');
 }
 function resolvePackageSource(options) {
-    const strategy = options.packageSource?.strategy ?? 'workspace';
-    return {
+    const strategy = options.packageSource?.strategy ?? 'install';
+    if ('workspace' === strategy) return {
         strategy,
-        modernPackageVersion: 'install' === strategy ? options.packageSource?.modernPackageVersion ?? options.modernVersion : WORKSPACE_PACKAGE_VERSION,
+        modernPackageVersion: WORKSPACE_PACKAGE_VERSION,
         registry: options.packageSource?.registry,
         aliasScope: options.packageSource?.aliasScope,
         aliasPackageNamePrefix: options.packageSource?.aliasPackageNamePrefix
     };
-}
-function modernPackageVersion(packageSource) {
-    return 'install' === packageSource.strategy ? packageSource.modernPackageVersion : WORKSPACE_PACKAGE_VERSION;
-}
-function modernAliasPackageName(packageName, packageSource) {
-    if (!packageSource.aliasScope) return packageName;
-    const scope = packageSource.aliasScope.replace(/^@/, '');
-    const unscopedName = packageName.split('/').at(-1);
-    return `@${scope}/${packageSource.aliasPackageNamePrefix ?? ''}${unscopedName}`;
-}
-function modernPackageSpecifier(packageName, packageSource) {
-    if ('install' !== packageSource.strategy) return WORKSPACE_PACKAGE_VERSION;
-    if (!packageSource.aliasScope) return packageSource.modernPackageVersion;
-    return `npm:${modernAliasPackageName(packageName, packageSource)}@${packageSource.modernPackageVersion}`;
+    const registry = options.packageSource?.registry;
+    const aliasScope = options.packageSource?.aliasScope ?? (registry ? void 0 : BLEEDINGDEV_PACKAGE_SCOPE);
+    return {
+        strategy,
+        modernPackageVersion: options.packageSource?.modernPackageVersion ?? options.modernVersion,
+        registry,
+        aliasScope,
+        aliasPackageNamePrefix: options.packageSource?.aliasPackageNamePrefix ?? (aliasScope ? BLEEDINGDEV_PACKAGE_NAME_PREFIX : void 0)
+    };
 }
 function appDependencies(scope, packageSource, app, remotes = []) {
     const dependencies = {
@@ -1101,17 +1151,105 @@ function createCloudflareProofRoute(app) {
         } : {}
     };
 }
+function createCloudflareSecurityContract() {
+    return {
+        enabled: true,
+        headers: {
+            referrerPolicy: 'strict-origin-when-cross-origin',
+            contentTypeOptions: 'nosniff',
+            permissionsPolicy: 'camera=(), geolocation=(), microphone=(), payment=(), usb=()'
+        },
+        contentSecurityPolicy: {
+            mode: 'report-only',
+            directives: {
+                'base-uri': [
+                    "'self'"
+                ],
+                'connect-src': [
+                    "'self'",
+                    'https:',
+                    'http:',
+                    'wss:',
+                    'ws:'
+                ],
+                'default-src': [
+                    "'self'"
+                ],
+                'font-src': [
+                    "'self'",
+                    'data:',
+                    'https:',
+                    'http:'
+                ],
+                'form-action': [
+                    "'self'"
+                ],
+                'frame-ancestors': [
+                    "'self'"
+                ],
+                'img-src': [
+                    "'self'",
+                    'data:',
+                    'blob:',
+                    'https:',
+                    'http:'
+                ],
+                'manifest-src': [
+                    "'self'",
+                    'https:',
+                    'http:'
+                ],
+                'object-src': [
+                    "'none'"
+                ],
+                "script-src": [
+                    "'self'",
+                    "'unsafe-inline'",
+                    "'unsafe-eval'",
+                    'https:',
+                    'http:',
+                    'blob:'
+                ],
+                'style-src': [
+                    "'self'",
+                    "'unsafe-inline'",
+                    'https:',
+                    'http:'
+                ],
+                'worker-src': [
+                    "'self'",
+                    'blob:'
+                ]
+            },
+            reason: "Report-only by default so Cloudflare Module Federation SSR can prove remote script, style, and connect compatibility before enforcement."
+        },
+        noindex: {
+            workersDev: true,
+            localhost: true,
+            previewHostnames: []
+        },
+        cookies: {
+            mutateSetCookie: false,
+            reason: 'Generated Cloudflare worker does not own application Set-Cookie headers.'
+        }
+    };
+}
+function formatTsJsonValue(value, indent) {
+    return JSON.stringify(value, null, 2).replaceAll('\n', `\n${' '.repeat(indent)}`);
+}
 function createCloudflareDeployContract(scope, app) {
     return {
         target: 'cloudflare',
         workerName: createCloudflareWorkerName(scope, app),
         publicUrlEnv: createCloudflarePublicUrlEnv(app),
+        compatibilityDate: CLOUDFLARE_COMPATIBILITY_DATE,
         compatibilityFlags: [
             'nodejs_compat',
             'global_fetch_strictly_public'
         ],
         assetsBinding: 'ASSETS',
         routes: createCloudflareProofRoute(app),
+        security: createCloudflareSecurityContract(),
         evidence: {
             proofScript: "scripts/proof-cloudflare-version.mjs",
             reportDefault: '.codex/reports/cloudflare-version-proof/public-url-proof.json'
@@ -1331,7 +1469,19 @@ if (
 export default defineConfig(
   presetUltramodern(
     {
-${bffConfig}      html: {
+${bffConfig}      ...(cloudflareDeployEnabled
+        ? {
+            deploy: {
+              worker: {
+                compatibilityDate: '${CLOUDFLARE_COMPATIBILITY_DATE}',
+                name: cloudflareWorkerName,
+                security: ${formatTsJsonValue(sortJsonValue(createCloudflareSecurityContract()), 16)},
+                ssr: true,
+              },
+            },
+          }
+        : {}),
+      html: {
         outputStructure: 'flat',
       },
       output: {
@@ -1368,6 +1518,9 @@ ${bffConfig}      html: {
               '/mf-manifest.json',
               '/mf-stats.json',
               '/remoteEntry.js',
+              '/robots.txt',
+              '/site.webmanifest',
+              '/sitemap.xml',
               '/static',
               '/zephyr-manifest.json',
             ],
@@ -1380,6 +1533,20 @@ ${bffConfig}      html: {
 ${bffPluginEntry}        moduleFederationPlugin(),
         zephyrRspackPlugin(),
       ],
+      server: {
+        port,
+        publicDir: ['./locales', './assets'],
+        ssr: {
+          mode: 'string',
+          moduleFederationAppSSR: true,
+        },
+      },
+      source: {
+        globalVars: {
+          ULTRAMODERN_SITE_URL: siteUrl,
+        },
+        mainEntryName: 'index',
+      },
       tools: {
         autoprefixer: {
           overrideBrowserslist: ['defaults'],
@@ -1396,29 +1563,6 @@ ${bffPluginEntry}        moduleFederationPlugin(),
           ]);
         },
       },
-      ...(cloudflareDeployEnabled
-        ? {
-            deploy: {
-              worker: {
-                ssr: true,
-              },
-            },
-          }
-        : {}),
-      server: {
-        port,
-        publicDir: ['./locales', './assets'],
-        ssr: {
-          mode: 'string',
-          moduleFederationAppSSR: true,
-        },
-      },
-      source: {
-        globalVars: {
-          ULTRAMODERN_SITE_URL: siteUrl,
-        },
-        mainEntryName: 'index',
-      },
     },
     {
       appId,
@@ -1638,12 +1782,18 @@ ${createModuleFederationRemotesConfig(scope, app, remotes)}${createSharedModuleF
 function appI18nNamespace(app) {
     return 'shell' === app.kind ? 'shell' : app.domain ?? app.id;
 }
+const privateAppRoutePublicness = {
+    indexable: false,
+    public: false,
+    publicSurface: 'private-app-screen'
+};
 function createRouteOwnedI18nPaths(app) {
     const namespace = appI18nNamespace(app);
     const base = {
         mfBoundaryId: app.mfName,
         namespace,
-        ownerAppId: app.id
+        ownerAppId: app.id,
+        ...privateAppRoutePublicness
     };
     if ('shell' === app.kind) return [
         {
@@ -1816,8 +1966,11 @@ function createRouteOwnedI18nPaths(app) {
         }
     ];
 }
-function createLocalisedUrlsMap(app) {
-    return Object.fromEntries(createRouteOwnedI18nPaths(app).flatMap((route)=>{
+function isPublicIndexableRoute(route) {
+    return route.public && route.indexable;
+}
+function createLocalisedUrlsMapFromRoutes(routes) {
+    return Object.fromEntries(routes.flatMap((route)=>{
         if ('/' === route.canonicalPath) return [];
         return Array.from(new Set([
             route.canonicalPath,
@@ -1828,9 +1981,23 @@ function createLocalisedUrlsMap(app) {
             ]);
     }));
 }
+function createLocalisedUrlsMap(app) {
+    return createLocalisedUrlsMapFromRoutes(createRouteOwnedI18nPaths(app));
+}
+function createPublicRouteMetadata(app) {
+    return createRouteOwnedI18nPaths(app).filter(isPublicIndexableRoute).map((route)=>({
+            canonicalPath: route.canonicalPath,
+            id: route.id,
+            localisedPaths: route.localisedPaths,
+            namespace: route.namespace,
+            ownerAppId: route.ownerAppId,
+            titleKey: route.titleKey
+        }));
+}
 function createRouteMetadataModule(app) {
     const routes = sortJsonValue(createRouteOwnedI18nPaths(app));
     const localisedUrls = sortJsonValue(createLocalisedUrlsMap(app));
+    const publicRoutes = sortJsonValue(createPublicRouteMetadata(app));
     const namespace = appI18nNamespace(app);
     return `export const ultramodernRouteNamespace = '${namespace}' as const;
 
@@ -1838,9 +2005,12 @@ export const ultramodernRouteMetadata = ${JSON.stringify(routes, null, 2)} as co
 
 export const ultramodernLocalisedUrls = ${JSON.stringify(localisedUrls, null, 2)} as const;
 
+export const ultramodernPublicRoutes = ${JSON.stringify(publicRoutes, null, 2)} as const;
+
 export const ultramodernRouteConfig = {
   localisedUrls: ultramodernLocalisedUrls,
   namespace: ultramodernRouteNamespace,
+  publicRoutes: ultramodernPublicRoutes,
   routes: ultramodernRouteMetadata,
   source: 'route-owned',
 } as const;
@@ -2011,15 +2181,125 @@ function createPostcssConfig() {
 function createTailwindConfig() {
     return `import type { Config } from 'tailwindcss';
 
-export default {
-} satisfies Config;
+export default {} satisfies Config;
 `;
 }
 function createTw(prefix) {
     return (classList)=>classList.split(/\s+/u).filter(Boolean).map((candidate)=>`${prefix}:${candidate.replace(/\[&&\]:/gu, '')}`).join(' ');
 }
-function workspaceAssetsForApp(_app) {
-    return {};
+const publicSurfaceRequiredAssetPaths = [
+    'config/public/robots.txt'
+];
+const publicSurfaceOptionalAssetPaths = [
+    'config/public/sitemap.xml',
+    'config/public/site.webmanifest'
+];
+function normalisePublicPath(pathname) {
+    const normalised = pathname.trim().replaceAll(/\/+/gu, '/').replace(/\/+$/u, '');
+    return normalised.length > 0 && normalised.startsWith('/') ? normalised : `/${normalised}`;
+}
+function createLocalisedPublicPath(pathname, language) {
+    const publicPath = normalisePublicPath(pathname);
+    return '/' === publicPath ? `/${language}` : `/${language}${publicPath}`;
+}
+function isConcretePublicPath(pathname) {
+    return !normalisePublicPath(pathname).split('/').some((segment)=>segment.startsWith(':') || segment.includes('*') || segment.startsWith('['));
+}
+function uniqueSorted(values) {
+    return Array.from(new Set(values)).sort((left, right)=>left.localeCompare(right));
+}
+function createPublicSurfaceRouteEntries(app) {
+    return createPublicRouteMetadata(app).map((route)=>{
+        const localeUrlPaths = Object.fromEntries(supportedWorkspaceLanguages.map((language)=>[
+                language,
+                createLocalisedPublicPath(route.localisedPaths[language], language)
+            ]));
+        if (!Object.values(localeUrlPaths).every(isConcretePublicPath)) return;
+        return {
+            ...route,
+            canonicalUrlPath: localeUrlPaths.en,
+            localeUrlPaths
+        };
+    }).filter((route)=>void 0 !== route).sort((left, right)=>left.canonicalUrlPath.localeCompare(right.canonicalUrlPath) || left.id.localeCompare(right.id));
+}
+function createPublicSurfaceUrlPaths(app) {
+    return uniqueSorted(createPublicSurfaceRouteEntries(app).flatMap((route)=>supportedWorkspaceLanguages.map((language)=>route.localeUrlPaths[language])));
+}
+function createPublicSurfaceOrigin(app) {
+    return `http://localhost:${app.port}`;
+}
+function escapeXmlText(value) {
+    return value.replaceAll('&', '&amp;').replaceAll('<', '&lt;').replaceAll('>', '&gt;');
+}
+function escapeXmlAttribute(value) {
+    return escapeXmlText(value).replaceAll('"', '&quot;');
+}
+function renderRobotsTxt(app) {
+    const urlPaths = createPublicSurfaceUrlPaths(app);
+    const lines = [
+        'User-agent: *'
+    ];
+    if (0 === urlPaths.length) lines.push('Disallow: /');
+    else {
+        for (const urlPath of urlPaths)lines.push(`Allow: ${urlPath}$`);
+        lines.push('Disallow: /');
+        lines.push(`Sitemap: ${createPublicSurfaceOrigin(app)}/sitemap.xml`);
+    }
+    return `${lines.join('\n')}\n`;
+}
+function renderSitemapXml(app) {
+    const origin = createPublicSurfaceOrigin(app);
+    const routes = createPublicSurfaceRouteEntries(app);
+    const lines = [
+        '<?xml version="1.0" encoding="UTF-8"?>',
+        '<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9" xmlns:xhtml="http://www.w3.org/1999/xhtml">'
+    ];
+    for (const route of routes)for (const language of supportedWorkspaceLanguages){
+        lines.push('  <url>');
+        lines.push(`    <loc>${escapeXmlText(`${origin}${route.localeUrlPaths[language]}`)}</loc>`);
+        for (const alternateLanguage of supportedWorkspaceLanguages)lines.push(`    <xhtml:link rel="alternate" hreflang="${alternateLanguage}" href="${escapeXmlAttribute(`${origin}${route.localeUrlPaths[alternateLanguage]}`)}" />`);
+        lines.push(`    <xhtml:link rel="alternate" hreflang="x-default" href="${escapeXmlAttribute(`${origin}${route.localeUrlPaths.en}`)}" />`);
+        lines.push('  </url>');
+    }
+    lines.push('</urlset>');
+    return `${lines.join('\n')}\n`;
+}
+function renderWebManifest(app) {
+    const startUrl = createPublicSurfaceUrlPaths(app)[0];
+    const manifest = {
+        name: app.displayName,
+        short_name: app.displayName,
+        display: 'standalone',
+        background_color: '#ffffff',
+        theme_color: '#133225',
+        lang: 'en',
+        categories: [
+            'business',
+            'productivity'
+        ],
+        icons: [],
+        ...startUrl ? {
+            scope: '/',
+            start_url: startUrl
+        } : {}
+    };
+    return `${JSON.stringify(sortJsonValue(manifest), null, 2)}\n`;
+}
+function createPublicSurfaceAssets(app) {
+    const assets = {
+        'config/public/robots.txt': renderRobotsTxt(app)
+    };
+    if (createPublicSurfaceRouteEntries(app).length > 0) {
+        assets['config/public/sitemap.xml'] = renderSitemapXml(app);
+        assets['config/public/site.webmanifest'] = renderWebManifest(app);
+    }
+    return assets;
+}
+function workspaceAssetsForApp(app) {
+    return createPublicSurfaceAssets(app);
+}
+function rewriteWorkspaceAssetsForApp(workspaceRoot, app) {
+    for (const [relativePath, content] of Object.entries(workspaceAssetsForApp(app)))writeFileReplacing(workspaceRoot, `${app.directory}/${relativePath}`, content);
 }
 function createLocalizedHeadComponent() {
     return `const fallbackLanguage = 'en';
@@ -3969,19 +4249,10 @@ function createDevelopmentOverlay(remotes = []) {
     };
 }
 function createPackageSourceMetadata(scope, packageSource) {
-    const modernPackages = {
-        packages: modernPackageNames,
-        specifier: modernPackageVersion(packageSource)
-    };
-    if (packageSource.registry) modernPackages.registry = packageSource.registry;
-    if (packageSource.aliasScope) modernPackages.aliases = Object.fromEntries(modernPackageNames.map((packageName)=>[
-            packageName,
-            modernAliasPackageName(packageName, packageSource)
-        ]));
     return {
         schemaVersion: 1,
         strategy: packageSource.strategy,
-        modernPackages,
+        modernPackages: createModernPackagesMetadata(ULTRAMODERN_WORKSPACE_MODERN_PACKAGES, packageSource),
         generatedWorkspacePackages: {
             packages: sharedPackages.map((sharedPackage)=>ultramodern_workspace_packageName(scope, sharedPackage.id)),
             specifier: WORKSPACE_PACKAGE_VERSION
@@ -4231,6 +4502,23 @@ function createStylingContract(scope, app, enableTailwind) {
         federation: createAppCssFederationContract(scope, app)
     };
 }
+function createPublicSurfaceContract(app) {
+    const files = Object.keys(createPublicSurfaceAssets(app)).sort().map((relativePath)=>relativePath.replace(/^config\/public\//u, ''));
+    return {
+        source: 'route-owned-public-routes',
+        metadataExport: './src/routes/ultramodern-route-metadata',
+        staticRoot: 'config/public',
+        privateRoutePolicy: 'omit-from-generated-public-surface',
+        files,
+        omittedByDefault: [
+            'api-catalog.json',
+            'llms.txt',
+            'security.txt'
+        ],
+        publicRoutes: createPublicRouteMetadata(app),
+        concreteUrlPaths: createPublicSurfaceUrlPaths(app)
+    };
+}
 function createAppGeneratedContract(scope, app, apps, enableTailwind) {
     const appWithResolvedRefs = 'shell' === app.kind ? {
         ...app,
@@ -4248,7 +4536,9 @@ function createAppGeneratedContract(scope, app, apps, enableTailwind) {
             target: 'cloudflare',
             cloudflare: createCloudflareDeployContract(scope, app),
             worker: {
+                compatibilityDate: CLOUDFLARE_COMPATIBILITY_DATE,
                 name: createCloudflareWorkerName(scope, app),
+                security: createCloudflareSecurityContract(),
                 ssr: true
             },
             output: {
@@ -4293,8 +4583,12 @@ function createAppGeneratedContract(scope, app, apps, enableTailwind) {
             metadataExport: './src/routes/ultramodern-route-metadata',
             localisedUrls: createLocalisedUrlsMap(app),
             owned: createRouteOwnedI18nPaths(app),
+            publicRoutes: createPublicRouteMetadata(app),
+            privateByDefault: true,
+            publicnessDefault: 'private-app-screen',
             generatedRouteMap: true,
-            manualOverrides: []
+            manualOverrides: [],
+            publicSurface: createPublicSurfaceContract(app)
         },
         moduleFederation: {
             name: app.mfName,
@@ -4770,6 +5064,7 @@ function createWorkspaceValidationScript(scope, enableTailwind, remotes = []) {
     const expectedBuildScript = remotes.length > 0 ? 'ULTRAMODERN_ZEPHYR=false pnpm -r --filter "./verticals/*" run build && ULTRAMODERN_ZEPHYR=false pnpm --filter "./apps/shell-super-app" run build && pnpm ultramodern:assert-mf-types' : 'ULTRAMODERN_ZEPHYR=false pnpm --filter "./apps/shell-super-app" run build && pnpm ultramodern:assert-mf-types';
     const expectedCloudflareBuildScript = remotes.length > 0 ? 'pnpm -r --filter "./verticals/*" run cloudflare:build && pnpm --filter "./apps/shell-super-app" run cloudflare:build && pnpm ultramodern:assert-mf-types' : 'pnpm --filter "./apps/shell-super-app" run cloudflare:build && pnpm ultramodern:assert-mf-types';
     const expectedCloudflareDeployScript = remotes.length > 0 ? 'pnpm -r --filter "./verticals/*" run cloudflare:deploy && pnpm --filter "./apps/shell-super-app" run cloudflare:deploy' : 'pnpm --filter "./apps/shell-super-app" run cloudflare:deploy';
+    const expectedCloudflareSecurity = createCloudflareSecurityContract();
     return `import { execFileSync } from 'node:child_process';
 import fs from 'node:fs';
 import path from 'node:path';
@@ -4784,6 +5079,22 @@ const oldRemotePaths = ${JSON.stringify(oldRemotePaths, null, 2)};
 const expectedBuildScript = ${JSON.stringify(expectedBuildScript)};
 const expectedCloudflareBuildScript = ${JSON.stringify(expectedCloudflareBuildScript)};
 const expectedCloudflareDeployScript = ${JSON.stringify(expectedCloudflareDeployScript)};
+const expectedCloudflareSecurity = ${JSON.stringify(expectedCloudflareSecurity, null, 2)};
+const publicSurfaceRequiredAssetPaths = ${JSON.stringify([
+        ...publicSurfaceRequiredAssetPaths
+    ], null, 2)};
+const publicSurfaceOptionalAssetPaths = ${JSON.stringify([
+        ...publicSurfaceOptionalAssetPaths
+    ], null, 2)};
+const expectedModernPackageSpecifier = packageName => {
+  if (packageSource.strategy === 'workspace') {
+    return 'workspace:*';
+  }
+  const aliases = packageSource.modernPackages?.aliases ?? {};
+  const alias = aliases[packageName];
+  const specifier = packageSource.modernPackages?.specifier;
+  return typeof alias === 'string' ? \`npm:\${alias}@\${specifier}\` : specifier;
+};
 
 const readText = relativePath => fs.readFileSync(path.join(root, relativePath), 'utf-8');
 const readJson = relativePath => JSON.parse(readText(relativePath));
@@ -4798,6 +5109,21 @@ const assertExists = relativePath => {
 const assertNotExists = relativePath => {
   assert(!fs.existsSync(path.join(root, relativePath)), \`Unexpected \${relativePath}\`);
 };
+const assertPublicSurfaceAssets = (appPath, publicRoutes) => {
+  const robots = readText(\`\${appPath}/config/public/robots.txt\`);
+  if ((publicRoutes ?? []).length === 0) {
+    assert(robots.includes('Disallow: /'), \`\${appPath} robots.txt must disallow crawling when no public routes exist\`);
+    for (const relativePath of publicSurfaceOptionalAssetPaths) {
+      assertNotExists(\`\${appPath}/\${relativePath}\`);
+    }
+    return;
+  }
+  const sitemap = readText(\`\${appPath}/config/public/sitemap.xml\`);
+  const manifest = readJson(\`\${appPath}/config/public/site.webmanifest\`);
+  assert(!sitemap.includes('<lastmod>'), \`\${appPath} sitemap must omit build-time lastmod values\`);
+  assert(typeof manifest.name === 'string' && manifest.name.length > 0, \`\${appPath} web manifest must include a safe app name\`);
+  assert(typeof manifest.start_url === 'string' && manifest.start_url.startsWith('/'), \`\${appPath} web manifest start_url must be a public route path\`);
+};
 const expectedWorkerName = packageSuffix => \`\${packageScope}-\${packageSuffix}\`.slice(0, 63);
 const expectedChunkLoadingGlobal = mfName =>
   \`__ULTRAMODERN_\${mfName
@@ -4874,6 +5200,9 @@ const requiredPaths = [
   'apps/shell-super-app/src/routes/layout.tsx',
   'apps/shell-super-app/src/routes/ultramodern-route-metadata.ts',
   'apps/shell-super-app/src/routes/[lang]/page.tsx',
+  ...publicSurfaceRequiredAssetPaths.map(
+    relativePath => \`apps/shell-super-app/\${relativePath}\`,
+  ),
   'packages/shared-contracts/src/index.ts',
   'packages/shared-design-tokens/src/index.ts',
   'packages/shared-design-tokens/src/tokens.css',
@@ -4900,6 +5229,9 @@ for (const vertical of fullStackVerticals) {
     \`\${vertical.path}/src/routes/layout.tsx\`,
     \`\${vertical.path}/src/routes/ultramodern-route-metadata.ts\`,
     \`\${vertical.path}/src/routes/[lang]/page.tsx\`,
+    ...publicSurfaceRequiredAssetPaths.map(
+      relativePath => \`\${vertical.path}/\${relativePath}\`,
+    ),
     ...vertical.routePagePaths,
   );
 }
@@ -4934,6 +5266,31 @@ assert(rootPackage.modernjs?.preset === 'presetUltramodern', 'Root must declare
 assert(rootPackage.modernjs?.packageSource?.config === './.modernjs/ultramodern-package-source.json', 'Root must point at package source metadata');
 assert(rootPackage.modernjs?.packageSource?.strategy === packageSource.strategy, 'Root package source strategy must match metadata');
 assert(packageSource.strategy === 'workspace' || packageSource.strategy === 'install', 'Package source strategy must be workspace or install');
+assert(packageSource.strategy === 'install' || packageSource.modernPackages?.specifier === 'workspace:*', 'Workspace package source must be explicitly backed by workspace:*');
+if (packageSource.strategy === 'install') {
+  const installSpecifier = packageSource.modernPackages?.specifier;
+  assert(
+    typeof installSpecifier === 'string' &&
+      /^\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?(?:\\+[0-9A-Za-z.-]+)?$/.test(installSpecifier) &&
+      installSpecifier.includes('ultramodern'),
+    'Install package source must use a semver UltraModern published cohort',
+  );
+  const modernAliases = packageSource.modernPackages?.aliases ?? {};
+  if (Object.keys(modernAliases).length > 0) {
+    for (const modernPackageName of [
+      '@modern-js/app-tools',
+      '@modern-js/plugin-bff',
+      '@modern-js/plugin-i18n',
+      '@modern-js/plugin-tanstack',
+      '@modern-js/runtime',
+    ]) {
+      assert(
+        /^@[^/]+\\/.+/.test(modernAliases[modernPackageName] ?? ''),
+        \`Install package source alias for \${modernPackageName} must be a scoped npm package\`,
+      );
+    }
+  }
+}
 assert(packageSource.generatedWorkspacePackages?.specifier === 'workspace:*', 'Generated workspace packages must keep workspace:* links');
 assert(
   rootPackage.scripts?.build === expectedBuildScript,
@@ -4950,6 +5307,7 @@ assert(rootPackage.scripts?.['skills:check'] === 'node ./scripts/bootstrap-agent
 assert(rootPackage.scripts?.postinstall === "oxfmt . '!repos/**' && node ./scripts/bootstrap-agent-skills.mjs && node ./scripts/setup-agent-reference-repos.mjs", 'Root postinstall must format, bootstrap agent skills, initialize git/hooks, and install reference repositories');
 
 const expectedAppIds = ['shell-super-app', ...fullStackVerticals.map(vertical => vertical.id)];
+const expectedCloudflareCompatibilityDate = '${CLOUDFLARE_COMPATIBILITY_DATE}';
 const expectedCloudflareCompatibilityFlags = ['nodejs_compat', 'global_fetch_strictly_public'];
 assert(
   JSON.stringify(generatedContract.apps?.map(app => app.id)) === JSON.stringify(expectedAppIds),
@@ -4966,6 +5324,7 @@ assert(generatedContract.cssFederation?.sharedDesignTokens?.dedupe?.duplicateBas
 assert(generatedContract.cssFederation?.sharedDesignTokens?.ssr?.firstPaintRequired === true, 'Shared design token CSS must be required for SSR first paint');
 
 const shellPackage = readJson('apps/shell-super-app/package.json');
+const shellModernConfig = readText('apps/shell-super-app/modern.config.ts');
 const expectedZephyrDependencies = Object.fromEntries(
   fullStackVerticals.map(vertical => [
     vertical.zephyrAlias,
@@ -4977,10 +5336,21 @@ assert(
     JSON.stringify(expectedZephyrDependencies),
   'Shell Zephyr dependencies must reference every vertical package',
 );
+assert(shellPackage.devDependencies?.['@modern-js/app-tools'] === expectedModernPackageSpecifier('@modern-js/app-tools'), 'Shell app-tools dependency must match package source metadata');
+assert(shellPackage.dependencies?.['@modern-js/plugin-bff'] === expectedModernPackageSpecifier('@modern-js/plugin-bff'), 'Shell plugin-bff dependency must match package source metadata');
+assert(shellPackage.dependencies?.['@modern-js/plugin-i18n'] === expectedModernPackageSpecifier('@modern-js/plugin-i18n'), 'Shell plugin-i18n dependency must match package source metadata');
+assert(shellPackage.dependencies?.['@modern-js/plugin-tanstack'] === expectedModernPackageSpecifier('@modern-js/plugin-tanstack'), 'Shell plugin-tanstack dependency must match package source metadata');
+assert(shellPackage.dependencies?.['@modern-js/runtime'] === expectedModernPackageSpecifier('@modern-js/runtime'), 'Shell runtime dependency must match package source metadata');
 const shellContract = generatedContract.apps?.find(app => app.id === 'shell-super-app');
 assert(shellContract?.deploy?.cloudflare?.workerName === expectedWorkerName('shell-super-app'), 'Shell Cloudflare workerName is incorrect');
 assert(shellContract?.deploy?.cloudflare?.publicUrlEnv === 'ULTRAMODERN_PUBLIC_URL_SHELL_SUPER_APP', 'Shell Cloudflare public URL env is incorrect');
+assert(shellContract?.deploy?.cloudflare?.compatibilityDate === expectedCloudflareCompatibilityDate, 'Shell Cloudflare compatibilityDate is incorrect');
 assert(JSON.stringify(shellContract?.deploy?.cloudflare?.compatibilityFlags) === JSON.stringify(expectedCloudflareCompatibilityFlags), 'Shell Cloudflare compatibility flags are incorrect');
+assert(JSON.stringify(shellContract?.deploy?.cloudflare?.security) === JSON.stringify(expectedCloudflareSecurity), 'Shell Cloudflare security contract is incorrect');
+assert(shellContract?.deploy?.worker?.compatibilityDate === expectedCloudflareCompatibilityDate, 'Shell worker compatibilityDate is incorrect');
+assert(shellContract?.deploy?.worker?.name === expectedWorkerName('shell-super-app'), 'Shell worker name is incorrect');
+assert(shellModernConfig.includes("const cloudflareWorkerName = '" + expectedWorkerName('shell-super-app') + "'"), 'Shell modern.config.ts must define the Cloudflare worker name');
+assert(shellModernConfig.includes('name: cloudflareWorkerName'), 'Shell modern.config.ts must wire deploy.worker.name');
 assert(shellContract?.config?.rspack?.output?.uniqueName === 'shellSuperApp', 'Shell Rspack uniqueName is incorrect');
 assert(shellContract?.config?.rspack?.output?.chunkLoadingGlobal === expectedChunkLoadingGlobal('shellSuperApp'), 'Shell Rspack chunkLoadingGlobal is incorrect');
 assert(topology.shell?.cloudflare?.workerName === expectedWorkerName('shell-super-app'), 'Shell topology Cloudflare workerName is incorrect');
@@ -4994,6 +5364,14 @@ assert(shellContract?.styling?.federation?.entrypoints?.css?.includes('src/route
 assert(shellContract?.styling?.federation?.assets?.shared?.some(asset => asset.endsWith('/shared-design-tokens/tokens.css')), 'Shell must import the shared design token CSS asset');
 assert(shellContract?.styling?.federation?.dedupe?.duplicateBaseStylesAllowed === false, 'Shell CSS contract must forbid duplicated base styles');
 assert(shellContract?.styling?.federation?.ssr?.firstPaintRequired === true, 'Shell CSS must be required for SSR first paint');
+assert(shellContract?.routes?.privateByDefault === true, 'Shell routes must be private by default');
+assert(shellContract?.routes?.publicnessDefault === 'private-app-screen', 'Shell route publicness default is incorrect');
+assert(JSON.stringify(shellContract?.routes?.publicRoutes ?? []) === '[]', 'Shell must not expose generated public routes by default');
+assert(
+  (shellContract?.routes?.owned ?? []).every(route => route.public === false && route.indexable === false && route.publicSurface === 'private-app-screen'),
+  'Shell owned routes must be non-indexable private app screens by default',
+);
+assertPublicSurfaceAssets('apps/shell-super-app', shellContract?.routes?.publicRoutes ?? []);
 assert(
   topology.shell?.verticalRefs?.join(',') === fullStackVerticals.map(vertical => vertical.id).join(','),
   'Topology shell verticalRefs must match generated verticals',
@@ -5004,10 +5382,15 @@ assert(!('effectServices' in topology), 'Default APIs must be vertical-owned, no
 
 for (const vertical of fullStackVerticals) {
   const packageJson = readJson(\`\${vertical.path}/package.json\`);
+  const modernConfig = readText(\`\${vertical.path}/modern.config.ts\`);
   assert(packageJson.name === vertical.packageName, \`\${vertical.id} package name is incorrect\`);
   assert(packageJson.scripts?.['cloudflare:deploy'] === 'ULTRAMODERN_CLOUDFLARE_REQUIRE_PUBLIC_URLS=true pnpm run cloudflare:build && wrangler deploy --config .output/wrangler.json', \`\${vertical.id} must expose cloudflare:deploy\`);
   assert(packageJson.scripts?.['cloudflare:proof']?.includes(\`--app \${vertical.id}\`), \`\${vertical.id} must expose cloudflare:proof\`);
-  assert(packageJson.dependencies?.['@modern-js/plugin-bff'], \`\${vertical.id} must depend on plugin-bff\`);
+  assert(packageJson.devDependencies?.['@modern-js/app-tools'] === expectedModernPackageSpecifier('@modern-js/app-tools'), \`\${vertical.id} app-tools dependency must match package source metadata\`);
+  assert(packageJson.dependencies?.['@modern-js/plugin-bff'] === expectedModernPackageSpecifier('@modern-js/plugin-bff'), \`\${vertical.id} plugin-bff dependency must match package source metadata\`);
+  assert(packageJson.dependencies?.['@modern-js/plugin-i18n'] === expectedModernPackageSpecifier('@modern-js/plugin-i18n'), \`\${vertical.id} plugin-i18n dependency must match package source metadata\`);
+  assert(packageJson.dependencies?.['@modern-js/plugin-tanstack'] === expectedModernPackageSpecifier('@modern-js/plugin-tanstack'), \`\${vertical.id} plugin-tanstack dependency must match package source metadata\`);
+  assert(packageJson.dependencies?.['@modern-js/runtime'] === expectedModernPackageSpecifier('@modern-js/runtime'), \`\${vertical.id} runtime dependency must match package source metadata\`);
   assert(packageJson.exports?.['./effect/client'] === \`./src/effect/\${vertical.stem}-client.ts\`, \`\${vertical.id} must export its Effect client\`);
   assert(packageJson.exports?.['./shared/effect/api'] === './shared/effect/api.ts', \`\${vertical.id} must export its Effect API contract\`);
   const expectedVerticalZephyrDependencies = Object.fromEntries(
@@ -5029,7 +5412,13 @@ for (const vertical of fullStackVerticals) {
   assert(contractEntry?.kind === 'vertical', \`\${vertical.id} generated contract kind is incorrect\`);
   assert(contractEntry?.deploy?.cloudflare?.workerName === expectedWorkerName(vertical.id), \`\${vertical.id} Cloudflare workerName is incorrect\`);
   assert(contractEntry?.deploy?.cloudflare?.publicUrlEnv === \`ULTRAMODERN_PUBLIC_URL_\${vertical.id.replace(/-/g, '_').toUpperCase()}\`, \`\${vertical.id} Cloudflare public URL env is incorrect\`);
+  assert(contractEntry?.deploy?.cloudflare?.compatibilityDate === expectedCloudflareCompatibilityDate, \`\${vertical.id} Cloudflare compatibilityDate is incorrect\`);
   assert(JSON.stringify(contractEntry?.deploy?.cloudflare?.compatibilityFlags) === JSON.stringify(expectedCloudflareCompatibilityFlags), \`\${vertical.id} Cloudflare compatibility flags are incorrect\`);
+  assert(JSON.stringify(contractEntry?.deploy?.cloudflare?.security) === JSON.stringify(expectedCloudflareSecurity), \`\${vertical.id} Cloudflare security contract is incorrect\`);
+  assert(contractEntry?.deploy?.worker?.compatibilityDate === expectedCloudflareCompatibilityDate, \`\${vertical.id} worker compatibilityDate is incorrect\`);
+  assert(contractEntry?.deploy?.worker?.name === expectedWorkerName(vertical.id), \`\${vertical.id} worker name is incorrect\`);
+  assert(modernConfig.includes("const cloudflareWorkerName = '" + expectedWorkerName(vertical.id) + "'"), \`\${vertical.id} modern.config.ts must define the Cloudflare worker name\`);
+  assert(modernConfig.includes('name: cloudflareWorkerName'), \`\${vertical.id} modern.config.ts must wire deploy.worker.name\`);
   assert(contractEntry?.deploy?.cloudflare?.routes?.effectReadiness === \`\${vertical.apiPrefix}/effect/\${vertical.stem}/readiness\`, \`\${vertical.id} Cloudflare proof readiness route is incorrect\`);
   assert(contractEntry?.config?.rspack?.output?.uniqueName === vertical.mfName, \`\${vertical.id} Rspack uniqueName is incorrect\`);
   assert(contractEntry?.config?.rspack?.output?.chunkLoadingGlobal === expectedChunkLoadingGlobal(vertical.mfName), \`\${vertical.id} Rspack chunkLoadingGlobal is incorrect\`);
@@ -5056,6 +5445,14 @@ for (const vertical of fullStackVerticals) {
   );
   assert(contractEntry?.routes?.source === 'route-owned', \`\${vertical.id} routes must be route-owned\`);
   assert(contractEntry?.routes?.metadataExport === './src/routes/ultramodern-route-metadata', \`\${vertical.id} route metadata export is incorrect\`);
+  assert(contractEntry?.routes?.privateByDefault === true, \`\${vertical.id} routes must be private by default\`);
+  assert(contractEntry?.routes?.publicnessDefault === 'private-app-screen', \`\${vertical.id} route publicness default is incorrect\`);
+  assert(JSON.stringify(contractEntry?.routes?.publicRoutes ?? []) === '[]', \`\${vertical.id} must not expose generated public routes by default\`);
+  assert(
+    (contractEntry?.routes?.owned ?? []).every(route => route.public === false && route.indexable === false && route.publicSurface === 'private-app-screen'),
+    \`\${vertical.id} owned routes must be non-indexable private app screens by default\`,
+  );
+  assertPublicSurfaceAssets(vertical.path, contractEntry?.routes?.publicRoutes ?? []);
   assert(contractEntry?.styling?.federation?.owner?.id === vertical.id, \`\${vertical.id} CSS federation owner is missing\`);
   assert(contractEntry?.styling?.federation?.role === 'vertical-css', \`\${vertical.id} must own only vertical CSS\`);
   assert(contractEntry?.styling?.federation?.rootSelector === \`[data-app-id="\${vertical.id}"]\`, \`\${vertical.id} CSS root selector is incorrect\`);
@@ -5161,8 +5558,14 @@ async function fetchText(url) {
     ok: response.ok,
     status: response.status,
     accessControlAllowOrigin: response.headers.get('access-control-allow-origin'),
+    contentSecurityPolicy: response.headers.get('content-security-policy'),
+    contentSecurityPolicyReportOnly: response.headers.get('content-security-policy-report-only'),
     contentType: response.headers.get('content-type'),
     link: response.headers.get('link'),
+    permissionsPolicy: response.headers.get('permissions-policy'),
+    referrerPolicy: response.headers.get('referrer-policy'),
+    xContentTypeOptions: response.headers.get('x-content-type-options'),
+    xRobotsTag: response.headers.get('x-robots-tag'),
     body: await response.text(),
   };
 }
@@ -5213,6 +5616,139 @@ function assert(condition, message) {
   }
 }
 
+function matchesPreviewHostname(hostname, pattern) {
+  const normalizedHostname = hostname.toLowerCase();
+  const normalizedPattern = String(pattern || '').toLowerCase();
+
+  if (!normalizedPattern) {
+    return false;
+  }
+
+  if (normalizedPattern.startsWith('*.')) {
+    return normalizedHostname.endsWith(normalizedPattern.slice(1));
+  }
+
+  return normalizedHostname === normalizedPattern;
+}
+
+function shouldNoindexUrl(publicUrl, noindex) {
+  if (!noindex || noindex === false) {
+    return false;
+  }
+
+  const { hostname } = new URL(publicUrl);
+  const normalizedHostname = hostname.toLowerCase();
+
+  if (
+    noindex.localhost !== false &&
+    (normalizedHostname === 'localhost' ||
+      normalizedHostname === '127.0.0.1' ||
+      normalizedHostname === '[::1]')
+  ) {
+    return true;
+  }
+
+  if (
+    noindex.workersDev !== false &&
+    normalizedHostname.endsWith('.workers.dev')
+  ) {
+    return true;
+  }
+
+  return (noindex.previewHostnames || []).some(pattern =>
+    matchesPreviewHostname(normalizedHostname, pattern),
+  );
+}
+
+function assertHeader(evidence, response, expected, options) {
+  if (expected === false || expected === undefined) {
+    return;
+  }
+
+  const actual = response[options.field];
+  evidence.assertions.push({
+    type: 'security-header',
+    header: options.header,
+    route: options.route,
+    expected,
+    actual,
+    status: actual === expected ? 'pass' : 'fail',
+  });
+  assert(actual === expected, \`\${options.appId} \${options.route} is missing \${options.header}\`);
+}
+
+function assertCloudflareSecurity(evidence, app, response, route, publicUrl, options = {}) {
+  const security = app.deploy?.cloudflare?.security;
+
+  if (!security || security.enabled === false) {
+    return;
+  }
+
+  const headers = security.headers || {};
+  assertHeader(evidence, response, headers.referrerPolicy, {
+    appId: app.id,
+    field: 'referrerPolicy',
+    header: 'referrer-policy',
+    route,
+  });
+  assertHeader(evidence, response, headers.contentTypeOptions, {
+    appId: app.id,
+    field: 'xContentTypeOptions',
+    header: 'x-content-type-options',
+    route,
+  });
+  assertHeader(evidence, response, headers.permissionsPolicy, {
+    appId: app.id,
+    field: 'permissionsPolicy',
+    header: 'permissions-policy',
+    route,
+  });
+
+  const csp = security.contentSecurityPolicy;
+  if (options.html && csp?.mode !== 'off') {
+    const header =
+      csp?.mode === 'enforce'
+        ? 'content-security-policy'
+        : 'content-security-policy-report-only';
+    const actual =
+      csp?.mode === 'enforce'
+        ? response.contentSecurityPolicy
+        : response.contentSecurityPolicyReportOnly;
+    const expectedDirectives = ['script-src', 'style-src', 'connect-src'];
+    const missingDirectives = expectedDirectives.filter(
+      directive => !actual?.includes(directive),
+    );
+
+    evidence.assertions.push({
+      type: 'security-csp',
+      header,
+      route,
+      mode: csp?.mode ?? 'report-only',
+      actual,
+      missingDirectives,
+      status: actual && missingDirectives.length === 0 ? 'pass' : 'fail',
+    });
+    assert(actual, \`\${app.id} \${route} is missing \${header}\`);
+    assert(
+      missingDirectives.length === 0,
+      \`\${app.id} \${route} CSP is missing \${missingDirectives.join(', ')}\`,
+    );
+  }
+
+  if (shouldNoindexUrl(publicUrl, security.noindex)) {
+    evidence.assertions.push({
+      type: 'security-noindex',
+      route,
+      actual: response.xRobotsTag,
+      status: response.xRobotsTag === 'noindex, nofollow' ? 'pass' : 'fail',
+    });
+    assert(
+      response.xRobotsTag === 'noindex, nofollow',
+      \`\${app.id} \${route} is missing noindex X-Robots-Tag\`,
+    );
+  }
+}
+
 async function validateApp(app, publicUrl) {
   const cloudflare = app.deploy?.cloudflare;
   const routes = cloudflare?.routes ?? {};
@@ -5233,6 +5769,9 @@ async function validateApp(app, publicUrl) {
     statusCode: ssr.status,
   });
   assert(ssr.ok, \`\${app.id} SSR route returned HTTP \${ssr.status}\`);
+  assertCloudflareSecurity(evidence, app, ssr, ssrRoute, publicUrl, {
+    html: true,
+  });
 
   const uiMarker = extractUiMarker(ssr.body);
   evidence.assertions.push({
@@ -5286,6 +5825,7 @@ async function validateApp(app, publicUrl) {
     manifest.ok,
     \`\${app.id} MF manifest returned HTTP \${manifest.status}\`,
   );
+  assertCloudflareSecurity(evidence, app, manifest, manifestRoute, publicUrl);
   evidence.assertions.push({
     type: 'mf-manifest-cors',
     route: manifestRoute,
@@ -5325,6 +5865,7 @@ async function validateApp(app, publicUrl) {
     statusCode: locale.status,
   });
   assert(locale.ok, \`\${app.id} locale JSON returned HTTP \${locale.status}\`);
+  assertCloudflareSecurity(evidence, app, locale, localeRoute, publicUrl);
   evidence.assertions.push({
     type: 'i18n-cors',
     route: localeRoute,
@@ -5570,6 +6111,7 @@ function rewriteShellAppFiles(workspaceRoot, scope, packageSource, enableTailwin
     writeJsonFile(node_path.join(workspaceRoot, `${shellApp.directory}/package.json`), createAppPackage(scope, shellHost, packageSource, enableTailwind, remotes));
     writeFileReplacing(workspaceRoot, `${shellApp.directory}/src/modern-app-env.d.ts`, createAppEnvDts(shellHost, remotes));
     writeFileReplacing(workspaceRoot, `${shellApp.directory}/src/routes/ultramodern-route-metadata.ts`, createRouteMetadataModule(shellHost));
+    rewriteWorkspaceAssetsForApp(workspaceRoot, shellHost);
     writeFileReplacing(workspaceRoot, `${shellApp.directory}/src/modern.runtime.ts`, createAppRuntimeConfig(shellHost, scope, remotes));
     writeJsonFile(node_path.join(workspaceRoot, `${shellApp.directory}/locales/en/translation.json`), createAppPublicLocaleMessages(shellHost, 'en', remotes));
     writeJsonFile(node_path.join(workspaceRoot, `${shellApp.directory}/locales/en/${appI18nNamespace(shellHost)}.json`), createAppPublicLocaleMessages(shellHost, 'en', remotes));
@@ -6138,7 +6680,7 @@ function readCreatePackageJson() {
     return JSON.parse(node_fs.readFileSync(createPackageJson, 'utf-8'));
 }
 function isBleedingDevCreatePackage(createPackage) {
-    return '@bleedingdev/modern-js-create' === createPackage.name;
+    return createPackage.name === BLEEDINGDEV_CREATE_PACKAGE;
 }
 function getBleedingDevFrameworkVersion(createPackage, fallbackVersion) {
     const frameworkVersion = createPackage.ultramodern?.frameworkVersion;
@@ -6245,71 +6787,109 @@ function detectUltramodernPackageSource(args, defaultPackageVersion, createPacka
         console.error('--ultramodern-package-source must be "workspace" or "install"');
         process.exit(1);
     }
+    const packageSourceStrategy = strategy;
+    const explicitRegistry = getOptionValue(args, [
+        '--ultramodern-package-registry'
+    ]);
+    const aliasScope = getOptionValue(args, [
+        '--ultramodern-package-scope'
+    ]) ?? (bleedingDevDefaults && 'install' === packageSourceStrategy && !explicitRegistry ? BLEEDINGDEV_PACKAGE_SCOPE : void 0);
     return {
-        strategy,
+        strategy: packageSourceStrategy,
         modernPackageVersion: getOptionValue(args, [
             '--ultramodern-package-version'
         ]) ?? defaultPackageVersion,
-        registry: getOptionValue(args, [
-            '--ultramodern-package-registry'
-        ]),
-        aliasScope: getOptionValue(args, [
-            '--ultramodern-package-scope'
-        ]) ?? (bleedingDevDefaults && 'install' === strategy ? 'bleedingdev' : void 0),
+        registry: explicitRegistry,
+        aliasScope,
         aliasPackageNamePrefix: getOptionValue(args, [
             '--ultramodern-package-name-prefix'
-        ]) ?? 'modern-js-'
+        ]) ?? (aliasScope ? BLEEDINGDEV_PACKAGE_NAME_PREFIX : void 0)
     };
 }
-function src_modernAliasPackageName(packageName, packageSource) {
-    if (!packageSource.aliasScope) return packageName;
-    const scope = packageSource.aliasScope.replace(/^@/, '');
-    const unscopedName = packageName.split('/').at(-1);
-    return `@${scope}/${packageSource.aliasPackageNamePrefix ?? ''}${unscopedName}`;
+function hasExplicitUltramodernPackageSource(args, value) {
+    const configuredValue = getOptionValue(args, [
+        '--ultramodern-package-source'
+    ]);
+    return value ? configuredValue === value : void 0 !== configuredValue;
 }
-function singleAppModernPackageSpecifier(packageName, packageSource, useWorkspaceProtocol) {
-    if (useWorkspaceProtocol) return 'workspace:*';
-    if ('install' !== packageSource.strategy || !packageSource.aliasScope) return packageSource.modernPackageVersion;
-    return `npm:${src_modernAliasPackageName(packageName, packageSource)}@${packageSource.modernPackageVersion}`;
+function readBleedingDevFrameworkVersionFromRegistry() {
+    const envVersion = process.env[BLEEDINGDEV_FRAMEWORK_VERSION_ENV]?.trim();
+    if (envVersion) {
+        if (!semverPattern.test(envVersion)) {
+            console.error(`${BLEEDINGDEV_FRAMEWORK_VERSION_ENV} must be a valid semver version`);
+            process.exit(1);
+        }
+        return envVersion;
+    }
+    try {
+        const rawVersion = runSetupCommand('npm', [
+            'view',
+            `${BLEEDINGDEV_CREATE_PACKAGE}@latest`,
+            'ultramodern.frameworkVersion',
+            '--json'
+        ]).trim();
+        const version = JSON.parse(rawVersion);
+        if ('string' == typeof version && semverPattern.test(version)) return version;
+    } catch  {}
+    console.error([
+        `Could not resolve ${BLEEDINGDEV_CREATE_PACKAGE}@latest ultramodern.frameworkVersion.`,
+        'Pass --workspace to use local workspace protocol dependencies,',
+        'or pass --ultramodern-package-version with the exact BleedingDev framework cohort.'
+    ].join(' '));
+    process.exit(1);
 }
-const singleAppModernPackages = [
-    '@modern-js/runtime',
-    '@modern-js/app-tools',
-    '@modern-js/tsconfig',
-    '@modern-js/plugin-i18n',
-    '@modern-js/plugin-tanstack',
-    '@modern-js/plugin-bff',
-    '@modern-js/adapter-rstest'
-];
-function createSingleAppPackageSourceEvidence(packageSource, useWorkspaceProtocol) {
-    const strategy = useWorkspaceProtocol ? 'workspace' : 'install';
-    const specifier = useWorkspaceProtocol ? 'workspace:*' : packageSource.modernPackageVersion;
-    const aliases = 'install' === strategy && packageSource.aliasScope ? Object.fromEntries(singleAppModernPackages.map((packageName)=>[
-            packageName,
-            src_modernAliasPackageName(packageName, packageSource)
-        ])) : void 0;
+function resolveInstallBackedPackageSource(args, createPackage, packageSource) {
+    const explicitVersion = getOptionValue(args, [
+        '--ultramodern-package-version'
+    ]);
+    const explicitRegistry = getOptionValue(args, [
+        '--ultramodern-package-registry'
+    ]);
+    const aliasScope = getOptionValue(args, [
+        '--ultramodern-package-scope'
+    ]) ?? packageSource.aliasScope ?? (explicitRegistry ? void 0 : BLEEDINGDEV_PACKAGE_SCOPE);
+    return {
+        ...packageSource,
+        strategy: 'install',
+        modernPackageVersion: explicitVersion ?? (isBleedingDevCreatePackage(createPackage) ? packageSource.modernPackageVersion : readBleedingDevFrameworkVersionFromRegistry()),
+        aliasScope,
+        aliasPackageNamePrefix: getOptionValue(args, [
+            '--ultramodern-package-name-prefix'
+        ]) ?? packageSource.aliasPackageNamePrefix ?? (aliasScope ? BLEEDINGDEV_PACKAGE_NAME_PREFIX : void 0)
+    };
+}
+function resolveSingleAppPackageSource(args, createPackage, packageSource, useWorkspaceProtocol) {
+    if (useWorkspaceProtocol) return {
+        ...packageSource,
+        strategy: 'workspace',
+        modernPackageVersion: WORKSPACE_PACKAGE_VERSION
+    };
+    return resolveInstallBackedPackageSource(args, createPackage, packageSource);
+}
+function resolveWorkspacePackageSource(args, createPackage, packageSource) {
+    if (hasExplicitUltramodernPackageSource(args, 'workspace')) return {
+        ...packageSource,
+        strategy: 'workspace',
+        modernPackageVersion: WORKSPACE_PACKAGE_VERSION
+    };
+    return resolveInstallBackedPackageSource(args, createPackage, packageSource);
+}
+function createSingleAppPackageSourceEvidence(packageSource) {
     return {
         schemaVersion: 1,
         preset: 'presetUltramodern',
-        strategy,
-        modernPackages: {
-            specifier,
-            packages: singleAppModernPackages,
-            ...packageSource.registry ? {
-                registry: packageSource.registry
-            } : {},
-            ...aliases ? {
-                aliases
-            } : {}
-        }
+        strategy: packageSource.strategy,
+        modernPackages: createModernPackagesMetadata(ULTRAMODERN_SINGLE_APP_MODERN_PACKAGES, packageSource, {
+            includeAliases: 'install' === packageSource.strategy
+        })
     };
 }
-function writeSingleAppPackageSourceEvidence(targetDir, packageSource, useWorkspaceProtocol) {
+function writeSingleAppPackageSourceEvidence(targetDir, packageSource) {
     const evidencePath = node_path.join(targetDir, '.modernjs', 'ultramodern-package-source.json');
     node_fs.mkdirSync(node_path.dirname(evidencePath), {
         recursive: true
     });
-    node_fs.writeFileSync(evidencePath, `${JSON.stringify(createSingleAppPackageSourceEvidence(packageSource, useWorkspaceProtocol), null, 2)}\n`);
+    node_fs.writeFileSync(evidencePath, `${JSON.stringify(createSingleAppPackageSourceEvidence(packageSource), null, 2)}\n`);
 }
 function runSetupCommand(command, args, options = {}) {
     return execFileSync(command, args, {
@@ -6514,12 +7094,13 @@ async function main() {
     }
     const generateWorkspace = detectUltramodernWorkspaceFlag();
     if (generateWorkspace) {
+        const packageSource = resolveWorkspacePackageSource(args, createPackage, detectUltramodernPackageSource(args, ultramodernPackageVersion, createPackage));
         generateUltramodernWorkspace({
             targetDir,
             packageName: generatedPackageName,
             modernVersion: version,
             enableTailwind: detectTailwindFlag(),
-            packageSource: detectUltramodernPackageSource(args, ultramodernPackageVersion, createPackage)
+            packageSource
         });
         initializeGeneratedGitRepository(targetDir);
         const dim = '\x1b[2m\x1b[3m';
@@ -6540,19 +7121,19 @@ async function main() {
     const bffRuntime = detectBffRuntime();
     const enableTailwind = detectTailwindFlag();
     const useWorkspaceProtocol = detectWorkspaceProtocolFlag();
-    const packageSource = detectUltramodernPackageSource(args, ultramodernPackageVersion, createPackage);
-    const templateManifest = createBuiltinTemplateManifest(version);
+    const packageSource = resolveSingleAppPackageSource(args, createPackage, detectUltramodernPackageSource(args, ultramodernPackageVersion, createPackage), useWorkspaceProtocol);
+    const templateManifest = createBuiltinTemplateManifest('install' === packageSource.strategy ? packageSource.modernPackageVersion : version);
     validateTemplateManifest(templateManifest);
     copyTemplate(templateDir, targetDir, {
         packageName: generatedPackageName,
-        version: useWorkspaceProtocol ? 'workspace:*' : packageSource.modernPackageVersion,
-        runtimeVersion: singleAppModernPackageSpecifier('@modern-js/runtime', packageSource, useWorkspaceProtocol),
-        appToolsVersion: singleAppModernPackageSpecifier('@modern-js/app-tools', packageSource, useWorkspaceProtocol),
-        adapterRstestVersion: singleAppModernPackageSpecifier('@modern-js/adapter-rstest', packageSource, useWorkspaceProtocol),
-        tsconfigVersion: singleAppModernPackageSpecifier('@modern-js/tsconfig', packageSource, useWorkspaceProtocol),
-        pluginTanstackVersion: singleAppModernPackageSpecifier('@modern-js/plugin-tanstack', packageSource, useWorkspaceProtocol),
-        pluginBffVersion: singleAppModernPackageSpecifier('@modern-js/plugin-bff', packageSource, useWorkspaceProtocol),
-        pluginI18nVersion: singleAppModernPackageSpecifier('@modern-js/plugin-i18n', packageSource, useWorkspaceProtocol),
+        version: 'workspace' === packageSource.strategy ? WORKSPACE_PACKAGE_VERSION : packageSource.modernPackageVersion,
+        runtimeVersion: modernPackageSpecifier('@modern-js/runtime', packageSource),
+        appToolsVersion: modernPackageSpecifier('@modern-js/app-tools', packageSource),
+        adapterRstestVersion: modernPackageSpecifier('@modern-js/adapter-rstest', packageSource),
+        tsconfigVersion: modernPackageSpecifier('@modern-js/tsconfig', packageSource),
+        pluginTanstackVersion: modernPackageSpecifier('@modern-js/plugin-tanstack', packageSource),
+        pluginBffVersion: modernPackageSpecifier('@modern-js/plugin-bff', packageSource),
+        pluginI18nVersion: modernPackageSpecifier('@modern-js/plugin-i18n', packageSource),
         tanstackRouterVersion: src_TANSTACK_ROUTER_VERSION,
         tailwindVersion: src_TAILWIND_VERSION,
         tailwindPostcssVersion: src_TAILWIND_POSTCSS_VERSION,
@@ -6570,7 +7151,7 @@ async function main() {
         ...packageJson.modernjs ?? {},
         preset: 'presetUltramodern',
         packageSource: {
-            strategy: useWorkspaceProtocol ? 'workspace' : 'install',
+            strategy: packageSource.strategy,
             config: './.modernjs/ultramodern-package-source.json'
         }
     };
@@ -6605,7 +7186,7 @@ async function main() {
     }
     node_fs.writeFileSync(targetPackageJson, `${JSON.stringify(packageJson, null, 2)}\n`);
     writeTemplateManifestEvidence(targetDir, templateManifest);
-    writeSingleAppPackageSourceEvidence(targetDir, packageSource, useWorkspaceProtocol);
+    writeSingleAppPackageSourceEvidence(targetDir, packageSource);
     if (!isSubproject) initializeGeneratedGitRepository(targetDir);
     const dim = '\x1b[2m\x1b[3m';
     const reset = '\x1b[0m';