@bleedingdev/modern-js-create 3.2.0-ultramodern.103 → 3.2.0-ultramodern.104

package/README.md

@@ -42,7 +42,8 @@ domains to delete. It generates:
 - `packages/shared-*` placeholders for shared contracts, tokens, and API
   support.
 - `.modernjs/ultramodern-generated-contract.json` with MF, Effect, i18n,
-  federated CSS, Cloudflare, and Zephyr dependency metadata.
+  federated CSS, Cloudflare, route publicness, generated public-surface, and
+  Zephyr dependency metadata.
 
 Validate the generated workspace before making application changes:
 
@@ -146,11 +147,16 @@ client, `localisedUrls`, locale JSON, CSS layer, and Cloudflare Worker output.
 The shell consumes vertical UI through MF manifests and vertical APIs through
 generated Effect clients exported by the vertical packages.
 
-Route localization is route-owned. Each app writes
+Route metadata is route-owned. Each app writes
 `src/routes/ultramodern-route-metadata` and passes
 `ultramodernLocalisedUrls` into `@modern-js/plugin-i18n`. Locale JSON is served
 from `/locales/{{lng}}/{{ns}}.json`; Czech and English routes are generated from
-the route owner, not from shell rewrites.
+the route owner, not from shell rewrites. Routes default to
+`privateByDefault: true` and `publicnessDefault: private-app-screen`; generated
+public files use only explicit `public && indexable` route metadata, so private
+app screens publish only a disallowing `robots.txt` by default. Sitemap,
+manifest, `llms.txt`, API catalog, JSON-LD, and broad web profile/certification
+output stay omitted unless a safe public input exists.
 
 CSS federation is explicit:
 

package/dist/index.js

@@ -559,6 +559,64 @@ const localeKeys = i18n.init('en', {
     zh: ZH_LOCALE,
     en: EN_LOCALE
 });
+const WORKSPACE_PACKAGE_VERSION = 'workspace:*';
+const BLEEDINGDEV_CREATE_PACKAGE = '@bleedingdev/modern-js-create';
+const BLEEDINGDEV_PACKAGE_SCOPE = 'bleedingdev';
+const BLEEDINGDEV_PACKAGE_NAME_PREFIX = 'modern-js-';
+const BLEEDINGDEV_FRAMEWORK_VERSION_ENV = 'MODERN_CREATE_ULTRAMODERN_FRAMEWORK_VERSION';
+const ULTRAMODERN_SINGLE_APP_MODERN_PACKAGES = [
+    '@modern-js/runtime',
+    '@modern-js/app-tools',
+    '@modern-js/tsconfig',
+    '@modern-js/plugin-i18n',
+    '@modern-js/plugin-tanstack',
+    '@modern-js/plugin-bff',
+    '@modern-js/adapter-rstest'
+];
+const ULTRAMODERN_WORKSPACE_MODERN_PACKAGES = [
+    '@modern-js/app-tools',
+    '@modern-js/plugin-bff',
+    '@modern-js/plugin-i18n',
+    '@modern-js/plugin-tanstack',
+    '@modern-js/runtime'
+];
+function modernPackageVersion(packageSource) {
+    return 'install' === packageSource.strategy ? packageSource.modernPackageVersion : WORKSPACE_PACKAGE_VERSION;
+}
+function modernAliasPackageName(packageName, packageSource) {
+    if (!packageSource.aliasScope) return packageName;
+    const scope = packageSource.aliasScope.replace(/^@/, '');
+    const unscopedName = packageName.split('/').at(-1);
+    return `@${scope}/${packageSource.aliasPackageNamePrefix ?? ''}${unscopedName}`;
+}
+function modernPackageSpecifier(packageName, packageSource) {
+    if ('install' !== packageSource.strategy) return WORKSPACE_PACKAGE_VERSION;
+    if (!packageSource.aliasScope) return packageSource.modernPackageVersion;
+    return `npm:${modernAliasPackageName(packageName, packageSource)}@${packageSource.modernPackageVersion}`;
+}
+function modernPackageAliases(packageNames, packageSource) {
+    if (!packageSource.aliasScope) return;
+    return Object.fromEntries(packageNames.map((packageName)=>[
+            packageName,
+            modernAliasPackageName(packageName, packageSource)
+        ]));
+}
+function createModernPackagesMetadata(packageNames, packageSource, options = {}) {
+    const includeAliases = options.includeAliases ?? Boolean(packageSource.aliasScope);
+    const aliases = includeAliases ? modernPackageAliases(packageNames, packageSource) : void 0;
+    return {
+        packages: [
+            ...packageNames
+        ],
+        specifier: modernPackageVersion(packageSource),
+        ...packageSource.registry ? {
+            registry: packageSource.registry
+        } : {},
+        ...aliases ? {
+            aliases
+        } : {}
+    };
+}
 const ultramodern_workspace_dirname = node_path.dirname(fileURLToPath(import.meta.url));
 const workspaceTemplateDir = node_path.resolve(ultramodern_workspace_dirname, '..', 'template-workspace');
 const TANSTACK_ROUTER_VERSION = '1.170.11';
@@ -581,7 +639,6 @@ const REACT_VERSION = '^19.2.6';
 const REACT_DOM_VERSION = '^19.2.6';
 const REACT_ROUTER_DOM_VERSION = '7.16.0';
 const PNPM_VERSION = '11.5.0';
-const WORKSPACE_PACKAGE_VERSION = 'workspace:*';
 const GENERATED_CONTRACT_PATH = '.modernjs/ultramodern-generated-contract.json';
 const RSTACK_AGENT_SKILLS_COMMIT = '61c948b42512e223bad44b83af4080eba48b2677';
 const MODULE_FEDERATION_AGENT_SKILLS_COMMIT = '07bb5b6c43ad457609e00c081b72d4c42508ec76';
@@ -605,13 +662,6 @@ const privateAgentSkills = [
     'debugger-mode'
 ];
 const effectTsgoTypecheckCommand = "node -e \"const fs = require('node:fs'); const { execFileSync, spawnSync } = require('node:child_process'); const bin = execFileSync('effect-tsgo', ['get-exe-path'], { encoding: 'utf8' }).trim(); if (process.platform !== 'win32') fs.chmodSync(bin, 0o755); const result = spawnSync(bin, ['--noEmit', '-p', 'tsconfig.json'], { stdio: 'inherit' }); process.exit(result.status ?? 1);\"";
-const modernPackageNames = [
-    '@modern-js/app-tools',
-    '@modern-js/plugin-bff',
-    '@modern-js/plugin-i18n',
-    '@modern-js/plugin-tanstack',
-    '@modern-js/runtime'
-];
 function sortJsonValue(value) {
     if (Array.isArray(value)) return value.map(sortJsonValue);
     if (null !== value && 'object' == typeof value) return Object.fromEntries(Object.entries(value).sort(([left], [right])=>left.localeCompare(right)).map(([key, entry])=>[
@@ -620,6 +670,10 @@ function sortJsonValue(value) {
         ]));
     return value;
 }
+const supportedWorkspaceLanguages = [
+    'en',
+    'cs'
+];
 const ULTRAMODERN_WORKSPACE_FLAG = '--ultramodern-workspace';
 const FIRST_VERTICAL_PORT = 4101;
 const TAILWIND_PREFIX_DIGIT_WORDS = [
@@ -914,28 +968,23 @@ function relativeRootFor(packageDir) {
     return normalizePath(node_path.relative(packageDir, '.') || '.');
 }
 function resolvePackageSource(options) {
-    const strategy = options.packageSource?.strategy ?? 'workspace';
-    return {
+    const strategy = options.packageSource?.strategy ?? 'install';
+    if ('workspace' === strategy) return {
         strategy,
-        modernPackageVersion: 'install' === strategy ? options.packageSource?.modernPackageVersion ?? options.modernVersion : WORKSPACE_PACKAGE_VERSION,
+        modernPackageVersion: WORKSPACE_PACKAGE_VERSION,
         registry: options.packageSource?.registry,
         aliasScope: options.packageSource?.aliasScope,
         aliasPackageNamePrefix: options.packageSource?.aliasPackageNamePrefix
     };
-}
-function modernPackageVersion(packageSource) {
-    return 'install' === packageSource.strategy ? packageSource.modernPackageVersion : WORKSPACE_PACKAGE_VERSION;
-}
-function modernAliasPackageName(packageName, packageSource) {
-    if (!packageSource.aliasScope) return packageName;
-    const scope = packageSource.aliasScope.replace(/^@/, '');
-    const unscopedName = packageName.split('/').at(-1);
-    return `@${scope}/${packageSource.aliasPackageNamePrefix ?? ''}${unscopedName}`;
-}
-function modernPackageSpecifier(packageName, packageSource) {
-    if ('install' !== packageSource.strategy) return WORKSPACE_PACKAGE_VERSION;
-    if (!packageSource.aliasScope) return packageSource.modernPackageVersion;
-    return `npm:${modernAliasPackageName(packageName, packageSource)}@${packageSource.modernPackageVersion}`;
+    const registry = options.packageSource?.registry;
+    const aliasScope = options.packageSource?.aliasScope ?? (registry ? void 0 : BLEEDINGDEV_PACKAGE_SCOPE);
+    return {
+        strategy,
+        modernPackageVersion: options.packageSource?.modernPackageVersion ?? options.modernVersion,
+        registry,
+        aliasScope,
+        aliasPackageNamePrefix: options.packageSource?.aliasPackageNamePrefix ?? (aliasScope ? BLEEDINGDEV_PACKAGE_NAME_PREFIX : void 0)
+    };
 }
 function appDependencies(scope, packageSource, app, remotes = []) {
     const dependencies = {
@@ -1420,7 +1469,19 @@ if (
 export default defineConfig(
   presetUltramodern(
     {
-${bffConfig}      html: {
+${bffConfig}      ...(cloudflareDeployEnabled
+        ? {
+            deploy: {
+              worker: {
+                compatibilityDate: '${CLOUDFLARE_COMPATIBILITY_DATE}',
+                name: cloudflareWorkerName,
+                security: ${formatTsJsonValue(sortJsonValue(createCloudflareSecurityContract()), 16)},
+                ssr: true,
+              },
+            },
+          }
+        : {}),
+      html: {
         outputStructure: 'flat',
       },
       output: {
@@ -1457,6 +1518,9 @@ ${bffConfig}      html: {
               '/mf-manifest.json',
               '/mf-stats.json',
               '/remoteEntry.js',
+              '/robots.txt',
+              '/site.webmanifest',
+              '/sitemap.xml',
               '/static',
               '/zephyr-manifest.json',
             ],
@@ -1469,6 +1533,20 @@ ${bffConfig}      html: {
 ${bffPluginEntry}        moduleFederationPlugin(),
         zephyrRspackPlugin(),
       ],
+      server: {
+        port,
+        publicDir: ['./locales', './assets'],
+        ssr: {
+          mode: 'string',
+          moduleFederationAppSSR: true,
+        },
+      },
+      source: {
+        globalVars: {
+          ULTRAMODERN_SITE_URL: siteUrl,
+        },
+        mainEntryName: 'index',
+      },
       tools: {
         autoprefixer: {
           overrideBrowserslist: ['defaults'],
@@ -1485,31 +1563,6 @@ ${bffPluginEntry}        moduleFederationPlugin(),
           ]);
         },
       },
-      ...(cloudflareDeployEnabled
-        ? {
-            deploy: {
-              worker: {
-                compatibilityDate: '${CLOUDFLARE_COMPATIBILITY_DATE}',
-                security: ${formatTsJsonValue(createCloudflareSecurityContract(), 16)},
-                ssr: true,
-              },
-            },
-          }
-        : {}),
-      server: {
-        port,
-        publicDir: ['./locales', './assets'],
-        ssr: {
-          mode: 'string',
-          moduleFederationAppSSR: true,
-        },
-      },
-      source: {
-        globalVars: {
-          ULTRAMODERN_SITE_URL: siteUrl,
-        },
-        mainEntryName: 'index',
-      },
     },
     {
       appId,
@@ -2128,15 +2181,125 @@ function createPostcssConfig() {
 function createTailwindConfig() {
     return `import type { Config } from 'tailwindcss';
 
-export default {
-} satisfies Config;
+export default {} satisfies Config;
 `;
 }
 function createTw(prefix) {
     return (classList)=>classList.split(/\s+/u).filter(Boolean).map((candidate)=>`${prefix}:${candidate.replace(/\[&&\]:/gu, '')}`).join(' ');
 }
-function workspaceAssetsForApp(_app) {
-    return {};
+const publicSurfaceRequiredAssetPaths = [
+    'config/public/robots.txt'
+];
+const publicSurfaceOptionalAssetPaths = [
+    'config/public/sitemap.xml',
+    'config/public/site.webmanifest'
+];
+function normalisePublicPath(pathname) {
+    const normalised = pathname.trim().replaceAll(/\/+/gu, '/').replace(/\/+$/u, '');
+    return normalised.length > 0 && normalised.startsWith('/') ? normalised : `/${normalised}`;
+}
+function createLocalisedPublicPath(pathname, language) {
+    const publicPath = normalisePublicPath(pathname);
+    return '/' === publicPath ? `/${language}` : `/${language}${publicPath}`;
+}
+function isConcretePublicPath(pathname) {
+    return !normalisePublicPath(pathname).split('/').some((segment)=>segment.startsWith(':') || segment.includes('*') || segment.startsWith('['));
+}
+function uniqueSorted(values) {
+    return Array.from(new Set(values)).sort((left, right)=>left.localeCompare(right));
+}
+function createPublicSurfaceRouteEntries(app) {
+    return createPublicRouteMetadata(app).map((route)=>{
+        const localeUrlPaths = Object.fromEntries(supportedWorkspaceLanguages.map((language)=>[
+                language,
+                createLocalisedPublicPath(route.localisedPaths[language], language)
+            ]));
+        if (!Object.values(localeUrlPaths).every(isConcretePublicPath)) return;
+        return {
+            ...route,
+            canonicalUrlPath: localeUrlPaths.en,
+            localeUrlPaths
+        };
+    }).filter((route)=>void 0 !== route).sort((left, right)=>left.canonicalUrlPath.localeCompare(right.canonicalUrlPath) || left.id.localeCompare(right.id));
+}
+function createPublicSurfaceUrlPaths(app) {
+    return uniqueSorted(createPublicSurfaceRouteEntries(app).flatMap((route)=>supportedWorkspaceLanguages.map((language)=>route.localeUrlPaths[language])));
+}
+function createPublicSurfaceOrigin(app) {
+    return `http://localhost:${app.port}`;
+}
+function escapeXmlText(value) {
+    return value.replaceAll('&', '&amp;').replaceAll('<', '&lt;').replaceAll('>', '&gt;');
+}
+function escapeXmlAttribute(value) {
+    return escapeXmlText(value).replaceAll('"', '&quot;');
+}
+function renderRobotsTxt(app) {
+    const urlPaths = createPublicSurfaceUrlPaths(app);
+    const lines = [
+        'User-agent: *'
+    ];
+    if (0 === urlPaths.length) lines.push('Disallow: /');
+    else {
+        for (const urlPath of urlPaths)lines.push(`Allow: ${urlPath}$`);
+        lines.push('Disallow: /');
+        lines.push(`Sitemap: ${createPublicSurfaceOrigin(app)}/sitemap.xml`);
+    }
+    return `${lines.join('\n')}\n`;
+}
+function renderSitemapXml(app) {
+    const origin = createPublicSurfaceOrigin(app);
+    const routes = createPublicSurfaceRouteEntries(app);
+    const lines = [
+        '<?xml version="1.0" encoding="UTF-8"?>',
+        '<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9" xmlns:xhtml="http://www.w3.org/1999/xhtml">'
+    ];
+    for (const route of routes)for (const language of supportedWorkspaceLanguages){
+        lines.push('  <url>');
+        lines.push(`    <loc>${escapeXmlText(`${origin}${route.localeUrlPaths[language]}`)}</loc>`);
+        for (const alternateLanguage of supportedWorkspaceLanguages)lines.push(`    <xhtml:link rel="alternate" hreflang="${alternateLanguage}" href="${escapeXmlAttribute(`${origin}${route.localeUrlPaths[alternateLanguage]}`)}" />`);
+        lines.push(`    <xhtml:link rel="alternate" hreflang="x-default" href="${escapeXmlAttribute(`${origin}${route.localeUrlPaths.en}`)}" />`);
+        lines.push('  </url>');
+    }
+    lines.push('</urlset>');
+    return `${lines.join('\n')}\n`;
+}
+function renderWebManifest(app) {
+    const startUrl = createPublicSurfaceUrlPaths(app)[0];
+    const manifest = {
+        name: app.displayName,
+        short_name: app.displayName,
+        display: 'standalone',
+        background_color: '#ffffff',
+        theme_color: '#133225',
+        lang: 'en',
+        categories: [
+            'business',
+            'productivity'
+        ],
+        icons: [],
+        ...startUrl ? {
+            scope: '/',
+            start_url: startUrl
+        } : {}
+    };
+    return `${JSON.stringify(sortJsonValue(manifest), null, 2)}\n`;
+}
+function createPublicSurfaceAssets(app) {
+    const assets = {
+        'config/public/robots.txt': renderRobotsTxt(app)
+    };
+    if (createPublicSurfaceRouteEntries(app).length > 0) {
+        assets['config/public/sitemap.xml'] = renderSitemapXml(app);
+        assets['config/public/site.webmanifest'] = renderWebManifest(app);
+    }
+    return assets;
+}
+function workspaceAssetsForApp(app) {
+    return createPublicSurfaceAssets(app);
+}
+function rewriteWorkspaceAssetsForApp(workspaceRoot, app) {
+    for (const [relativePath, content] of Object.entries(workspaceAssetsForApp(app)))writeFileReplacing(workspaceRoot, `${app.directory}/${relativePath}`, content);
 }
 function createLocalizedHeadComponent() {
     return `const fallbackLanguage = 'en';
@@ -4086,19 +4249,10 @@ function createDevelopmentOverlay(remotes = []) {
     };
 }
 function createPackageSourceMetadata(scope, packageSource) {
-    const modernPackages = {
-        packages: modernPackageNames,
-        specifier: modernPackageVersion(packageSource)
-    };
-    if (packageSource.registry) modernPackages.registry = packageSource.registry;
-    if (packageSource.aliasScope) modernPackages.aliases = Object.fromEntries(modernPackageNames.map((packageName)=>[
-            packageName,
-            modernAliasPackageName(packageName, packageSource)
-        ]));
     return {
         schemaVersion: 1,
         strategy: packageSource.strategy,
-        modernPackages,
+        modernPackages: createModernPackagesMetadata(ULTRAMODERN_WORKSPACE_MODERN_PACKAGES, packageSource),
         generatedWorkspacePackages: {
             packages: sharedPackages.map((sharedPackage)=>ultramodern_workspace_packageName(scope, sharedPackage.id)),
             specifier: WORKSPACE_PACKAGE_VERSION
@@ -4348,6 +4502,23 @@ function createStylingContract(scope, app, enableTailwind) {
         federation: createAppCssFederationContract(scope, app)
     };
 }
+function createPublicSurfaceContract(app) {
+    const files = Object.keys(createPublicSurfaceAssets(app)).sort().map((relativePath)=>relativePath.replace(/^config\/public\//u, ''));
+    return {
+        source: 'route-owned-public-routes',
+        metadataExport: './src/routes/ultramodern-route-metadata',
+        staticRoot: 'config/public',
+        privateRoutePolicy: 'omit-from-generated-public-surface',
+        files,
+        omittedByDefault: [
+            'api-catalog.json',
+            'llms.txt',
+            'security.txt'
+        ],
+        publicRoutes: createPublicRouteMetadata(app),
+        concreteUrlPaths: createPublicSurfaceUrlPaths(app)
+    };
+}
 function createAppGeneratedContract(scope, app, apps, enableTailwind) {
     const appWithResolvedRefs = 'shell' === app.kind ? {
         ...app,
@@ -4416,7 +4587,8 @@ function createAppGeneratedContract(scope, app, apps, enableTailwind) {
             privateByDefault: true,
             publicnessDefault: 'private-app-screen',
             generatedRouteMap: true,
-            manualOverrides: []
+            manualOverrides: [],
+            publicSurface: createPublicSurfaceContract(app)
         },
         moduleFederation: {
             name: app.mfName,
@@ -4908,6 +5080,21 @@ const expectedBuildScript = ${JSON.stringify(expectedBuildScript)};
 const expectedCloudflareBuildScript = ${JSON.stringify(expectedCloudflareBuildScript)};
 const expectedCloudflareDeployScript = ${JSON.stringify(expectedCloudflareDeployScript)};
 const expectedCloudflareSecurity = ${JSON.stringify(expectedCloudflareSecurity, null, 2)};
+const publicSurfaceRequiredAssetPaths = ${JSON.stringify([
+        ...publicSurfaceRequiredAssetPaths
+    ], null, 2)};
+const publicSurfaceOptionalAssetPaths = ${JSON.stringify([
+        ...publicSurfaceOptionalAssetPaths
+    ], null, 2)};
+const expectedModernPackageSpecifier = packageName => {
+  if (packageSource.strategy === 'workspace') {
+    return 'workspace:*';
+  }
+  const aliases = packageSource.modernPackages?.aliases ?? {};
+  const alias = aliases[packageName];
+  const specifier = packageSource.modernPackages?.specifier;
+  return typeof alias === 'string' ? \`npm:\${alias}@\${specifier}\` : specifier;
+};
 
 const readText = relativePath => fs.readFileSync(path.join(root, relativePath), 'utf-8');
 const readJson = relativePath => JSON.parse(readText(relativePath));
@@ -4922,6 +5109,21 @@ const assertExists = relativePath => {
 const assertNotExists = relativePath => {
   assert(!fs.existsSync(path.join(root, relativePath)), \`Unexpected \${relativePath}\`);
 };
+const assertPublicSurfaceAssets = (appPath, publicRoutes) => {
+  const robots = readText(\`\${appPath}/config/public/robots.txt\`);
+  if ((publicRoutes ?? []).length === 0) {
+    assert(robots.includes('Disallow: /'), \`\${appPath} robots.txt must disallow crawling when no public routes exist\`);
+    for (const relativePath of publicSurfaceOptionalAssetPaths) {
+      assertNotExists(\`\${appPath}/\${relativePath}\`);
+    }
+    return;
+  }
+  const sitemap = readText(\`\${appPath}/config/public/sitemap.xml\`);
+  const manifest = readJson(\`\${appPath}/config/public/site.webmanifest\`);
+  assert(!sitemap.includes('<lastmod>'), \`\${appPath} sitemap must omit build-time lastmod values\`);
+  assert(typeof manifest.name === 'string' && manifest.name.length > 0, \`\${appPath} web manifest must include a safe app name\`);
+  assert(typeof manifest.start_url === 'string' && manifest.start_url.startsWith('/'), \`\${appPath} web manifest start_url must be a public route path\`);
+};
 const expectedWorkerName = packageSuffix => \`\${packageScope}-\${packageSuffix}\`.slice(0, 63);
 const expectedChunkLoadingGlobal = mfName =>
   \`__ULTRAMODERN_\${mfName
@@ -4998,6 +5200,9 @@ const requiredPaths = [
   'apps/shell-super-app/src/routes/layout.tsx',
   'apps/shell-super-app/src/routes/ultramodern-route-metadata.ts',
   'apps/shell-super-app/src/routes/[lang]/page.tsx',
+  ...publicSurfaceRequiredAssetPaths.map(
+    relativePath => \`apps/shell-super-app/\${relativePath}\`,
+  ),
   'packages/shared-contracts/src/index.ts',
   'packages/shared-design-tokens/src/index.ts',
   'packages/shared-design-tokens/src/tokens.css',
@@ -5024,6 +5229,9 @@ for (const vertical of fullStackVerticals) {
     \`\${vertical.path}/src/routes/layout.tsx\`,
     \`\${vertical.path}/src/routes/ultramodern-route-metadata.ts\`,
     \`\${vertical.path}/src/routes/[lang]/page.tsx\`,
+    ...publicSurfaceRequiredAssetPaths.map(
+      relativePath => \`\${vertical.path}/\${relativePath}\`,
+    ),
     ...vertical.routePagePaths,
   );
 }
@@ -5058,6 +5266,31 @@ assert(rootPackage.modernjs?.preset === 'presetUltramodern', 'Root must declare
 assert(rootPackage.modernjs?.packageSource?.config === './.modernjs/ultramodern-package-source.json', 'Root must point at package source metadata');
 assert(rootPackage.modernjs?.packageSource?.strategy === packageSource.strategy, 'Root package source strategy must match metadata');
 assert(packageSource.strategy === 'workspace' || packageSource.strategy === 'install', 'Package source strategy must be workspace or install');
+assert(packageSource.strategy === 'install' || packageSource.modernPackages?.specifier === 'workspace:*', 'Workspace package source must be explicitly backed by workspace:*');
+if (packageSource.strategy === 'install') {
+  const installSpecifier = packageSource.modernPackages?.specifier;
+  assert(
+    typeof installSpecifier === 'string' &&
+      /^\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?(?:\\+[0-9A-Za-z.-]+)?$/.test(installSpecifier) &&
+      installSpecifier.includes('ultramodern'),
+    'Install package source must use a semver UltraModern published cohort',
+  );
+  const modernAliases = packageSource.modernPackages?.aliases ?? {};
+  if (Object.keys(modernAliases).length > 0) {
+    for (const modernPackageName of [
+      '@modern-js/app-tools',
+      '@modern-js/plugin-bff',
+      '@modern-js/plugin-i18n',
+      '@modern-js/plugin-tanstack',
+      '@modern-js/runtime',
+    ]) {
+      assert(
+        /^@[^/]+\\/.+/.test(modernAliases[modernPackageName] ?? ''),
+        \`Install package source alias for \${modernPackageName} must be a scoped npm package\`,
+      );
+    }
+  }
+}
 assert(packageSource.generatedWorkspacePackages?.specifier === 'workspace:*', 'Generated workspace packages must keep workspace:* links');
 assert(
   rootPackage.scripts?.build === expectedBuildScript,
@@ -5091,6 +5324,7 @@ assert(generatedContract.cssFederation?.sharedDesignTokens?.dedupe?.duplicateBas
 assert(generatedContract.cssFederation?.sharedDesignTokens?.ssr?.firstPaintRequired === true, 'Shared design token CSS must be required for SSR first paint');
 
 const shellPackage = readJson('apps/shell-super-app/package.json');
+const shellModernConfig = readText('apps/shell-super-app/modern.config.ts');
 const expectedZephyrDependencies = Object.fromEntries(
   fullStackVerticals.map(vertical => [
     vertical.zephyrAlias,
@@ -5102,6 +5336,11 @@ assert(
     JSON.stringify(expectedZephyrDependencies),
   'Shell Zephyr dependencies must reference every vertical package',
 );
+assert(shellPackage.devDependencies?.['@modern-js/app-tools'] === expectedModernPackageSpecifier('@modern-js/app-tools'), 'Shell app-tools dependency must match package source metadata');
+assert(shellPackage.dependencies?.['@modern-js/plugin-bff'] === expectedModernPackageSpecifier('@modern-js/plugin-bff'), 'Shell plugin-bff dependency must match package source metadata');
+assert(shellPackage.dependencies?.['@modern-js/plugin-i18n'] === expectedModernPackageSpecifier('@modern-js/plugin-i18n'), 'Shell plugin-i18n dependency must match package source metadata');
+assert(shellPackage.dependencies?.['@modern-js/plugin-tanstack'] === expectedModernPackageSpecifier('@modern-js/plugin-tanstack'), 'Shell plugin-tanstack dependency must match package source metadata');
+assert(shellPackage.dependencies?.['@modern-js/runtime'] === expectedModernPackageSpecifier('@modern-js/runtime'), 'Shell runtime dependency must match package source metadata');
 const shellContract = generatedContract.apps?.find(app => app.id === 'shell-super-app');
 assert(shellContract?.deploy?.cloudflare?.workerName === expectedWorkerName('shell-super-app'), 'Shell Cloudflare workerName is incorrect');
 assert(shellContract?.deploy?.cloudflare?.publicUrlEnv === 'ULTRAMODERN_PUBLIC_URL_SHELL_SUPER_APP', 'Shell Cloudflare public URL env is incorrect');
@@ -5109,6 +5348,9 @@ assert(shellContract?.deploy?.cloudflare?.compatibilityDate === expectedCloudfla
 assert(JSON.stringify(shellContract?.deploy?.cloudflare?.compatibilityFlags) === JSON.stringify(expectedCloudflareCompatibilityFlags), 'Shell Cloudflare compatibility flags are incorrect');
 assert(JSON.stringify(shellContract?.deploy?.cloudflare?.security) === JSON.stringify(expectedCloudflareSecurity), 'Shell Cloudflare security contract is incorrect');
 assert(shellContract?.deploy?.worker?.compatibilityDate === expectedCloudflareCompatibilityDate, 'Shell worker compatibilityDate is incorrect');
+assert(shellContract?.deploy?.worker?.name === expectedWorkerName('shell-super-app'), 'Shell worker name is incorrect');
+assert(shellModernConfig.includes("const cloudflareWorkerName = '" + expectedWorkerName('shell-super-app') + "'"), 'Shell modern.config.ts must define the Cloudflare worker name');
+assert(shellModernConfig.includes('name: cloudflareWorkerName'), 'Shell modern.config.ts must wire deploy.worker.name');
 assert(shellContract?.config?.rspack?.output?.uniqueName === 'shellSuperApp', 'Shell Rspack uniqueName is incorrect');
 assert(shellContract?.config?.rspack?.output?.chunkLoadingGlobal === expectedChunkLoadingGlobal('shellSuperApp'), 'Shell Rspack chunkLoadingGlobal is incorrect');
 assert(topology.shell?.cloudflare?.workerName === expectedWorkerName('shell-super-app'), 'Shell topology Cloudflare workerName is incorrect');
@@ -5129,6 +5371,7 @@ assert(
   (shellContract?.routes?.owned ?? []).every(route => route.public === false && route.indexable === false && route.publicSurface === 'private-app-screen'),
   'Shell owned routes must be non-indexable private app screens by default',
 );
+assertPublicSurfaceAssets('apps/shell-super-app', shellContract?.routes?.publicRoutes ?? []);
 assert(
   topology.shell?.verticalRefs?.join(',') === fullStackVerticals.map(vertical => vertical.id).join(','),
   'Topology shell verticalRefs must match generated verticals',
@@ -5139,10 +5382,15 @@ assert(!('effectServices' in topology), 'Default APIs must be vertical-owned, no
 
 for (const vertical of fullStackVerticals) {
   const packageJson = readJson(\`\${vertical.path}/package.json\`);
+  const modernConfig = readText(\`\${vertical.path}/modern.config.ts\`);
   assert(packageJson.name === vertical.packageName, \`\${vertical.id} package name is incorrect\`);
   assert(packageJson.scripts?.['cloudflare:deploy'] === 'ULTRAMODERN_CLOUDFLARE_REQUIRE_PUBLIC_URLS=true pnpm run cloudflare:build && wrangler deploy --config .output/wrangler.json', \`\${vertical.id} must expose cloudflare:deploy\`);
   assert(packageJson.scripts?.['cloudflare:proof']?.includes(\`--app \${vertical.id}\`), \`\${vertical.id} must expose cloudflare:proof\`);
-  assert(packageJson.dependencies?.['@modern-js/plugin-bff'], \`\${vertical.id} must depend on plugin-bff\`);
+  assert(packageJson.devDependencies?.['@modern-js/app-tools'] === expectedModernPackageSpecifier('@modern-js/app-tools'), \`\${vertical.id} app-tools dependency must match package source metadata\`);
+  assert(packageJson.dependencies?.['@modern-js/plugin-bff'] === expectedModernPackageSpecifier('@modern-js/plugin-bff'), \`\${vertical.id} plugin-bff dependency must match package source metadata\`);
+  assert(packageJson.dependencies?.['@modern-js/plugin-i18n'] === expectedModernPackageSpecifier('@modern-js/plugin-i18n'), \`\${vertical.id} plugin-i18n dependency must match package source metadata\`);
+  assert(packageJson.dependencies?.['@modern-js/plugin-tanstack'] === expectedModernPackageSpecifier('@modern-js/plugin-tanstack'), \`\${vertical.id} plugin-tanstack dependency must match package source metadata\`);
+  assert(packageJson.dependencies?.['@modern-js/runtime'] === expectedModernPackageSpecifier('@modern-js/runtime'), \`\${vertical.id} runtime dependency must match package source metadata\`);
   assert(packageJson.exports?.['./effect/client'] === \`./src/effect/\${vertical.stem}-client.ts\`, \`\${vertical.id} must export its Effect client\`);
   assert(packageJson.exports?.['./shared/effect/api'] === './shared/effect/api.ts', \`\${vertical.id} must export its Effect API contract\`);
   const expectedVerticalZephyrDependencies = Object.fromEntries(
@@ -5168,6 +5416,9 @@ for (const vertical of fullStackVerticals) {
   assert(JSON.stringify(contractEntry?.deploy?.cloudflare?.compatibilityFlags) === JSON.stringify(expectedCloudflareCompatibilityFlags), \`\${vertical.id} Cloudflare compatibility flags are incorrect\`);
   assert(JSON.stringify(contractEntry?.deploy?.cloudflare?.security) === JSON.stringify(expectedCloudflareSecurity), \`\${vertical.id} Cloudflare security contract is incorrect\`);
   assert(contractEntry?.deploy?.worker?.compatibilityDate === expectedCloudflareCompatibilityDate, \`\${vertical.id} worker compatibilityDate is incorrect\`);
+  assert(contractEntry?.deploy?.worker?.name === expectedWorkerName(vertical.id), \`\${vertical.id} worker name is incorrect\`);
+  assert(modernConfig.includes("const cloudflareWorkerName = '" + expectedWorkerName(vertical.id) + "'"), \`\${vertical.id} modern.config.ts must define the Cloudflare worker name\`);
+  assert(modernConfig.includes('name: cloudflareWorkerName'), \`\${vertical.id} modern.config.ts must wire deploy.worker.name\`);
   assert(contractEntry?.deploy?.cloudflare?.routes?.effectReadiness === \`\${vertical.apiPrefix}/effect/\${vertical.stem}/readiness\`, \`\${vertical.id} Cloudflare proof readiness route is incorrect\`);
   assert(contractEntry?.config?.rspack?.output?.uniqueName === vertical.mfName, \`\${vertical.id} Rspack uniqueName is incorrect\`);
   assert(contractEntry?.config?.rspack?.output?.chunkLoadingGlobal === expectedChunkLoadingGlobal(vertical.mfName), \`\${vertical.id} Rspack chunkLoadingGlobal is incorrect\`);
@@ -5201,6 +5452,7 @@ for (const vertical of fullStackVerticals) {
     (contractEntry?.routes?.owned ?? []).every(route => route.public === false && route.indexable === false && route.publicSurface === 'private-app-screen'),
     \`\${vertical.id} owned routes must be non-indexable private app screens by default\`,
   );
+  assertPublicSurfaceAssets(vertical.path, contractEntry?.routes?.publicRoutes ?? []);
   assert(contractEntry?.styling?.federation?.owner?.id === vertical.id, \`\${vertical.id} CSS federation owner is missing\`);
   assert(contractEntry?.styling?.federation?.role === 'vertical-css', \`\${vertical.id} must own only vertical CSS\`);
   assert(contractEntry?.styling?.federation?.rootSelector === \`[data-app-id="\${vertical.id}"]\`, \`\${vertical.id} CSS root selector is incorrect\`);
@@ -5859,6 +6111,7 @@ function rewriteShellAppFiles(workspaceRoot, scope, packageSource, enableTailwin
     writeJsonFile(node_path.join(workspaceRoot, `${shellApp.directory}/package.json`), createAppPackage(scope, shellHost, packageSource, enableTailwind, remotes));
     writeFileReplacing(workspaceRoot, `${shellApp.directory}/src/modern-app-env.d.ts`, createAppEnvDts(shellHost, remotes));
     writeFileReplacing(workspaceRoot, `${shellApp.directory}/src/routes/ultramodern-route-metadata.ts`, createRouteMetadataModule(shellHost));
+    rewriteWorkspaceAssetsForApp(workspaceRoot, shellHost);
     writeFileReplacing(workspaceRoot, `${shellApp.directory}/src/modern.runtime.ts`, createAppRuntimeConfig(shellHost, scope, remotes));
     writeJsonFile(node_path.join(workspaceRoot, `${shellApp.directory}/locales/en/translation.json`), createAppPublicLocaleMessages(shellHost, 'en', remotes));
     writeJsonFile(node_path.join(workspaceRoot, `${shellApp.directory}/locales/en/${appI18nNamespace(shellHost)}.json`), createAppPublicLocaleMessages(shellHost, 'en', remotes));
@@ -6427,7 +6680,7 @@ function readCreatePackageJson() {
     return JSON.parse(node_fs.readFileSync(createPackageJson, 'utf-8'));
 }
 function isBleedingDevCreatePackage(createPackage) {
-    return '@bleedingdev/modern-js-create' === createPackage.name;
+    return createPackage.name === BLEEDINGDEV_CREATE_PACKAGE;
 }
 function getBleedingDevFrameworkVersion(createPackage, fallbackVersion) {
     const frameworkVersion = createPackage.ultramodern?.frameworkVersion;
@@ -6534,71 +6787,109 @@ function detectUltramodernPackageSource(args, defaultPackageVersion, createPacka
         console.error('--ultramodern-package-source must be "workspace" or "install"');
         process.exit(1);
     }
+    const packageSourceStrategy = strategy;
+    const explicitRegistry = getOptionValue(args, [
+        '--ultramodern-package-registry'
+    ]);
+    const aliasScope = getOptionValue(args, [
+        '--ultramodern-package-scope'
+    ]) ?? (bleedingDevDefaults && 'install' === packageSourceStrategy && !explicitRegistry ? BLEEDINGDEV_PACKAGE_SCOPE : void 0);
     return {
-        strategy,
+        strategy: packageSourceStrategy,
         modernPackageVersion: getOptionValue(args, [
             '--ultramodern-package-version'
         ]) ?? defaultPackageVersion,
-        registry: getOptionValue(args, [
-            '--ultramodern-package-registry'
-        ]),
-        aliasScope: getOptionValue(args, [
-            '--ultramodern-package-scope'
-        ]) ?? (bleedingDevDefaults && 'install' === strategy ? 'bleedingdev' : void 0),
+        registry: explicitRegistry,
+        aliasScope,
         aliasPackageNamePrefix: getOptionValue(args, [
             '--ultramodern-package-name-prefix'
-        ]) ?? 'modern-js-'
+        ]) ?? (aliasScope ? BLEEDINGDEV_PACKAGE_NAME_PREFIX : void 0)
     };
 }
-function src_modernAliasPackageName(packageName, packageSource) {
-    if (!packageSource.aliasScope) return packageName;
-    const scope = packageSource.aliasScope.replace(/^@/, '');
-    const unscopedName = packageName.split('/').at(-1);
-    return `@${scope}/${packageSource.aliasPackageNamePrefix ?? ''}${unscopedName}`;
+function hasExplicitUltramodernPackageSource(args, value) {
+    const configuredValue = getOptionValue(args, [
+        '--ultramodern-package-source'
+    ]);
+    return value ? configuredValue === value : void 0 !== configuredValue;
 }
-function singleAppModernPackageSpecifier(packageName, packageSource, useWorkspaceProtocol) {
-    if (useWorkspaceProtocol) return 'workspace:*';
-    if ('install' !== packageSource.strategy || !packageSource.aliasScope) return packageSource.modernPackageVersion;
-    return `npm:${src_modernAliasPackageName(packageName, packageSource)}@${packageSource.modernPackageVersion}`;
+function readBleedingDevFrameworkVersionFromRegistry() {
+    const envVersion = process.env[BLEEDINGDEV_FRAMEWORK_VERSION_ENV]?.trim();
+    if (envVersion) {
+        if (!semverPattern.test(envVersion)) {
+            console.error(`${BLEEDINGDEV_FRAMEWORK_VERSION_ENV} must be a valid semver version`);
+            process.exit(1);
+        }
+        return envVersion;
+    }
+    try {
+        const rawVersion = runSetupCommand('npm', [
+            'view',
+            `${BLEEDINGDEV_CREATE_PACKAGE}@latest`,
+            'ultramodern.frameworkVersion',
+            '--json'
+        ]).trim();
+        const version = JSON.parse(rawVersion);
+        if ('string' == typeof version && semverPattern.test(version)) return version;
+    } catch  {}
+    console.error([
+        `Could not resolve ${BLEEDINGDEV_CREATE_PACKAGE}@latest ultramodern.frameworkVersion.`,
+        'Pass --workspace to use local workspace protocol dependencies,',
+        'or pass --ultramodern-package-version with the exact BleedingDev framework cohort.'
+    ].join(' '));
+    process.exit(1);
 }
-const singleAppModernPackages = [
-    '@modern-js/runtime',
-    '@modern-js/app-tools',
-    '@modern-js/tsconfig',
-    '@modern-js/plugin-i18n',
-    '@modern-js/plugin-tanstack',
-    '@modern-js/plugin-bff',
-    '@modern-js/adapter-rstest'
-];
-function createSingleAppPackageSourceEvidence(packageSource, useWorkspaceProtocol) {
-    const strategy = useWorkspaceProtocol ? 'workspace' : 'install';
-    const specifier = useWorkspaceProtocol ? 'workspace:*' : packageSource.modernPackageVersion;
-    const aliases = 'install' === strategy && packageSource.aliasScope ? Object.fromEntries(singleAppModernPackages.map((packageName)=>[
-            packageName,
-            src_modernAliasPackageName(packageName, packageSource)
-        ])) : void 0;
+function resolveInstallBackedPackageSource(args, createPackage, packageSource) {
+    const explicitVersion = getOptionValue(args, [
+        '--ultramodern-package-version'
+    ]);
+    const explicitRegistry = getOptionValue(args, [
+        '--ultramodern-package-registry'
+    ]);
+    const aliasScope = getOptionValue(args, [
+        '--ultramodern-package-scope'
+    ]) ?? packageSource.aliasScope ?? (explicitRegistry ? void 0 : BLEEDINGDEV_PACKAGE_SCOPE);
+    return {
+        ...packageSource,
+        strategy: 'install',
+        modernPackageVersion: explicitVersion ?? (isBleedingDevCreatePackage(createPackage) ? packageSource.modernPackageVersion : readBleedingDevFrameworkVersionFromRegistry()),
+        aliasScope,
+        aliasPackageNamePrefix: getOptionValue(args, [
+            '--ultramodern-package-name-prefix'
+        ]) ?? packageSource.aliasPackageNamePrefix ?? (aliasScope ? BLEEDINGDEV_PACKAGE_NAME_PREFIX : void 0)
+    };
+}
+function resolveSingleAppPackageSource(args, createPackage, packageSource, useWorkspaceProtocol) {
+    if (useWorkspaceProtocol) return {
+        ...packageSource,
+        strategy: 'workspace',
+        modernPackageVersion: WORKSPACE_PACKAGE_VERSION
+    };
+    return resolveInstallBackedPackageSource(args, createPackage, packageSource);
+}
+function resolveWorkspacePackageSource(args, createPackage, packageSource) {
+    if (hasExplicitUltramodernPackageSource(args, 'workspace')) return {
+        ...packageSource,
+        strategy: 'workspace',
+        modernPackageVersion: WORKSPACE_PACKAGE_VERSION
+    };
+    return resolveInstallBackedPackageSource(args, createPackage, packageSource);
+}
+function createSingleAppPackageSourceEvidence(packageSource) {
     return {
         schemaVersion: 1,
         preset: 'presetUltramodern',
-        strategy,
-        modernPackages: {
-            specifier,
-            packages: singleAppModernPackages,
-            ...packageSource.registry ? {
-                registry: packageSource.registry
-            } : {},
-            ...aliases ? {
-                aliases
-            } : {}
-        }
+        strategy: packageSource.strategy,
+        modernPackages: createModernPackagesMetadata(ULTRAMODERN_SINGLE_APP_MODERN_PACKAGES, packageSource, {
+            includeAliases: 'install' === packageSource.strategy
+        })
     };
 }
-function writeSingleAppPackageSourceEvidence(targetDir, packageSource, useWorkspaceProtocol) {
+function writeSingleAppPackageSourceEvidence(targetDir, packageSource) {
     const evidencePath = node_path.join(targetDir, '.modernjs', 'ultramodern-package-source.json');
     node_fs.mkdirSync(node_path.dirname(evidencePath), {
         recursive: true
     });
-    node_fs.writeFileSync(evidencePath, `${JSON.stringify(createSingleAppPackageSourceEvidence(packageSource, useWorkspaceProtocol), null, 2)}\n`);
+    node_fs.writeFileSync(evidencePath, `${JSON.stringify(createSingleAppPackageSourceEvidence(packageSource), null, 2)}\n`);
 }
 function runSetupCommand(command, args, options = {}) {
     return execFileSync(command, args, {
@@ -6803,12 +7094,13 @@ async function main() {
     }
     const generateWorkspace = detectUltramodernWorkspaceFlag();
     if (generateWorkspace) {
+        const packageSource = resolveWorkspacePackageSource(args, createPackage, detectUltramodernPackageSource(args, ultramodernPackageVersion, createPackage));
         generateUltramodernWorkspace({
             targetDir,
             packageName: generatedPackageName,
             modernVersion: version,
             enableTailwind: detectTailwindFlag(),
-            packageSource: detectUltramodernPackageSource(args, ultramodernPackageVersion, createPackage)
+            packageSource
         });
         initializeGeneratedGitRepository(targetDir);
         const dim = '\x1b[2m\x1b[3m';
@@ -6829,19 +7121,19 @@ async function main() {
     const bffRuntime = detectBffRuntime();
     const enableTailwind = detectTailwindFlag();
     const useWorkspaceProtocol = detectWorkspaceProtocolFlag();
-    const packageSource = detectUltramodernPackageSource(args, ultramodernPackageVersion, createPackage);
-    const templateManifest = createBuiltinTemplateManifest(version);
+    const packageSource = resolveSingleAppPackageSource(args, createPackage, detectUltramodernPackageSource(args, ultramodernPackageVersion, createPackage), useWorkspaceProtocol);
+    const templateManifest = createBuiltinTemplateManifest('install' === packageSource.strategy ? packageSource.modernPackageVersion : version);
     validateTemplateManifest(templateManifest);
     copyTemplate(templateDir, targetDir, {
         packageName: generatedPackageName,
-        version: useWorkspaceProtocol ? 'workspace:*' : packageSource.modernPackageVersion,
-        runtimeVersion: singleAppModernPackageSpecifier('@modern-js/runtime', packageSource, useWorkspaceProtocol),
-        appToolsVersion: singleAppModernPackageSpecifier('@modern-js/app-tools', packageSource, useWorkspaceProtocol),
-        adapterRstestVersion: singleAppModernPackageSpecifier('@modern-js/adapter-rstest', packageSource, useWorkspaceProtocol),
-        tsconfigVersion: singleAppModernPackageSpecifier('@modern-js/tsconfig', packageSource, useWorkspaceProtocol),
-        pluginTanstackVersion: singleAppModernPackageSpecifier('@modern-js/plugin-tanstack', packageSource, useWorkspaceProtocol),
-        pluginBffVersion: singleAppModernPackageSpecifier('@modern-js/plugin-bff', packageSource, useWorkspaceProtocol),
-        pluginI18nVersion: singleAppModernPackageSpecifier('@modern-js/plugin-i18n', packageSource, useWorkspaceProtocol),
+        version: 'workspace' === packageSource.strategy ? WORKSPACE_PACKAGE_VERSION : packageSource.modernPackageVersion,
+        runtimeVersion: modernPackageSpecifier('@modern-js/runtime', packageSource),
+        appToolsVersion: modernPackageSpecifier('@modern-js/app-tools', packageSource),
+        adapterRstestVersion: modernPackageSpecifier('@modern-js/adapter-rstest', packageSource),
+        tsconfigVersion: modernPackageSpecifier('@modern-js/tsconfig', packageSource),
+        pluginTanstackVersion: modernPackageSpecifier('@modern-js/plugin-tanstack', packageSource),
+        pluginBffVersion: modernPackageSpecifier('@modern-js/plugin-bff', packageSource),
+        pluginI18nVersion: modernPackageSpecifier('@modern-js/plugin-i18n', packageSource),
         tanstackRouterVersion: src_TANSTACK_ROUTER_VERSION,
         tailwindVersion: src_TAILWIND_VERSION,
         tailwindPostcssVersion: src_TAILWIND_POSTCSS_VERSION,
@@ -6859,7 +7151,7 @@ async function main() {
         ...packageJson.modernjs ?? {},
         preset: 'presetUltramodern',
         packageSource: {
-            strategy: useWorkspaceProtocol ? 'workspace' : 'install',
+            strategy: packageSource.strategy,
             config: './.modernjs/ultramodern-package-source.json'
         }
     };
@@ -6894,7 +7186,7 @@ async function main() {
     }
     node_fs.writeFileSync(targetPackageJson, `${JSON.stringify(packageJson, null, 2)}\n`);
     writeTemplateManifestEvidence(targetDir, templateManifest);
-    writeSingleAppPackageSourceEvidence(targetDir, packageSource, useWorkspaceProtocol);
+    writeSingleAppPackageSourceEvidence(targetDir, packageSource);
     if (!isSubproject) initializeGeneratedGitRepository(targetDir);
     const dim = '\x1b[2m\x1b[3m';
     const reset = '\x1b[0m';

package/dist/types/ultramodern-package-source.d.ts

@@ -0,0 +1,28 @@
+export declare const WORKSPACE_PACKAGE_VERSION = "workspace:*";
+export declare const BLEEDINGDEV_CREATE_PACKAGE = "@bleedingdev/modern-js-create";
+export declare const BLEEDINGDEV_PACKAGE_SCOPE = "bleedingdev";
+export declare const BLEEDINGDEV_PACKAGE_NAME_PREFIX = "modern-js-";
+export declare const BLEEDINGDEV_FRAMEWORK_VERSION_ENV = "MODERN_CREATE_ULTRAMODERN_FRAMEWORK_VERSION";
+export declare const ULTRAMODERN_SINGLE_APP_MODERN_PACKAGES: readonly ['@modern-js/runtime', '@modern-js/app-tools', '@modern-js/tsconfig', '@modern-js/plugin-i18n', '@modern-js/plugin-tanstack', '@modern-js/plugin-bff', '@modern-js/adapter-rstest'];
+export declare const ULTRAMODERN_WORKSPACE_MODERN_PACKAGES: readonly ['@modern-js/app-tools', '@modern-js/plugin-bff', '@modern-js/plugin-i18n', '@modern-js/plugin-tanstack', '@modern-js/runtime'];
+export type UltramodernPackageSourceStrategy = 'workspace' | 'install';
+export type ResolvedUltramodernPackageSource = {
+    strategy: UltramodernPackageSourceStrategy;
+    modernPackageVersion: string;
+    registry?: string;
+    aliasScope?: string;
+    aliasPackageNamePrefix?: string;
+};
+export type UltramodernModernPackagesMetadata = {
+    packages: string[];
+    specifier: string;
+    registry?: string;
+    aliases?: Record<string, string>;
+};
+export declare function modernPackageVersion(packageSource: ResolvedUltramodernPackageSource): string;
+export declare function modernAliasPackageName(packageName: string, packageSource: ResolvedUltramodernPackageSource): string;
+export declare function modernPackageSpecifier(packageName: string, packageSource: ResolvedUltramodernPackageSource): string;
+export declare function modernPackageAliases(packageNames: readonly string[], packageSource: ResolvedUltramodernPackageSource): Record<string, string> | undefined;
+export declare function createModernPackagesMetadata(packageNames: readonly string[], packageSource: ResolvedUltramodernPackageSource, options?: {
+    includeAliases?: boolean;
+}): UltramodernModernPackagesMetadata;

package/dist/types/ultramodern-workspace.d.ts

@@ -1,4 +1,4 @@
-type UltramodernPackageSourceStrategy = 'workspace' | 'install';
+import { type UltramodernPackageSourceStrategy } from './ultramodern-package-source';
 export type UltramodernWorkspaceOptions = {
     targetDir: string;
     packageName: string;
@@ -28,4 +28,3 @@ export declare const ultramodernWorkspaceVersions: {
     tailwind: string;
     tailwindPostcss: string;
 };
-export {};

package/package.json

@@ -21,7 +21,7 @@
   "engines": {
     "node": ">=20"
   },
-  "version": "3.2.0-ultramodern.103",
+  "version": "3.2.0-ultramodern.104",
   "types": "./dist/types/index.d.ts",
   "main": "./dist/index.js",
   "bin": {
@@ -41,7 +41,7 @@
     "@types/node": "^25.9.1",
     "@typescript/native-preview": "7.0.0-dev.20260527.2",
     "tsx": "^4.22.3",
-    "@modern-js/i18n-utils": "npm:@bleedingdev/modern-js-i18n-utils@3.2.0-ultramodern.103"
+    "@modern-js/i18n-utils": "npm:@bleedingdev/modern-js-i18n-utils@3.2.0-ultramodern.104"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",
@@ -54,6 +54,6 @@
     "start": "node ./dist/index.js"
   },
   "ultramodern": {
-    "frameworkVersion": "3.2.0-ultramodern.103"
+    "frameworkVersion": "3.2.0-ultramodern.104"
   }
 }

package/template/modern.config.ts.handlebars

@@ -39,7 +39,13 @@ export default defineConfig(
 {{/if}}        runtimeFramework: '{{bffRuntime}}',
       },
 
-{{/if}}      plugins: [
+{{/if}}      html: {
+        meta: {
+          viewport: 'width=device-width, initial-scale=1.0, viewport-fit=cover',
+        },
+        title: 'UltraModern.js Starter',
+      },
+      plugins: [
         appTools(),
         i18nPlugin({
           localeDetection: {
@@ -53,12 +59,6 @@ export default defineConfig(
 {{/if}}{{#if enableBff}}
         bffPlugin(),
 {{/if}}      ],
-      html: {
-        title: 'UltraModern.js Starter',
-        meta: {
-          viewport: 'width=device-width, initial-scale=1.0, viewport-fit=cover',
-        },
-      },
       source: {
         globalVars: {
           ULTRAMODERN_SITE_URL: siteUrl,
@@ -70,8 +70,8 @@ export default defineConfig(
       enableBffRequestId,
       enableModuleFederationSSR,
       enableTelemetryExporters,
-      telemetryFailLoudStartup,
       ...(typeof otlpEndpoint === 'string' ? { otlpEndpoint } : {}),
+      telemetryFailLoudStartup,
       ...(typeof victoriaMetricsEndpoint === 'string' ? { victoriaMetricsEndpoint } : {}),
     },
   ),

package/template/scripts/check-i18n-strings.mjs

@@ -7,6 +7,97 @@ const ignoredDirectories = new Set(['.modern', '.modernjs', 'dist', 'node_module
 const visibleAttributePattern =
   /\s(?:aria-label|alt|placeholder|title)=["']([^"']*[A-Za-z][^"']*)["']/gu;
 const jsxTextPattern = />([^<>{}]*[A-Za-z][^<>{}]*)</gu;
+const jsxIntrinsicTags = new Set([
+  'a',
+  'abbr',
+  'address',
+  'area',
+  'article',
+  'aside',
+  'audio',
+  'b',
+  'blockquote',
+  'body',
+  'br',
+  'button',
+  'canvas',
+  'caption',
+  'cite',
+  'code',
+  'col',
+  'colgroup',
+  'data',
+  'datalist',
+  'dd',
+  'del',
+  'details',
+  'dfn',
+  'dialog',
+  'div',
+  'dl',
+  'dt',
+  'em',
+  'fieldset',
+  'figcaption',
+  'figure',
+  'footer',
+  'form',
+  'h1',
+  'h2',
+  'h3',
+  'h4',
+  'h5',
+  'h6',
+  'head',
+  'header',
+  'hr',
+  'html',
+  'i',
+  'iframe',
+  'img',
+  'input',
+  'label',
+  'legend',
+  'li',
+  'link',
+  'main',
+  'mark',
+  'menu',
+  'meta',
+  'meter',
+  'nav',
+  'ol',
+  'option',
+  'p',
+  'picture',
+  'pre',
+  'progress',
+  'q',
+  'script',
+  'section',
+  'select',
+  'small',
+  'source',
+  'span',
+  'strong',
+  'style',
+  'summary',
+  'svg',
+  'table',
+  'tbody',
+  'td',
+  'template',
+  'textarea',
+  'tfoot',
+  'th',
+  'thead',
+  'time',
+  'title',
+  'tr',
+  'u',
+  'ul',
+  'video',
+]);
 
 const collectFiles = (directory) => {
   if (!fs.existsSync(directory)) {
@@ -37,6 +128,24 @@ const isCodeElementText = (content, index) => {
   }
   return /^<code(?:\s|>)/u.test(content.slice(tagStart, index));
 };
+const isJsxTagEnd = (content, index) => {
+  const tagStart = content.lastIndexOf('<', index);
+  if (tagStart === -1 || content.slice(tagStart + 1, index).includes('<')) {
+    return false;
+  }
+  const match = content
+    .slice(tagStart, index + 1)
+    .match(/^<\/?\s*([A-Za-z][\w:.-]*)\b[^<>]*>$/u);
+  if (!match) {
+    return false;
+  }
+  const [, tagName] = match;
+  return (
+    /^[A-Z]/u.test(tagName) ||
+    tagName.includes('-') ||
+    jsxIntrinsicTags.has(tagName)
+  );
+};
 const isIgnoredLine = (content, index) => {
   const lineStart = content.lastIndexOf('\n', index) + 1;
   const lineEnd = content.indexOf('\n', index);
@@ -54,20 +163,23 @@ const violations = [];
 for (const filePath of scanRoots.flatMap(collectFiles)) {
   const content = fs.readFileSync(filePath, 'utf-8');
   for (const match of content.matchAll(visibleAttributePattern)) {
+    const [, visibleText] = match;
     if (!isIgnoredLine(content, match.index ?? 0)) {
       violations.push({
         filePath,
         line: lineNumberForIndex(content, match.index ?? 0),
-        text: match[1].trim(),
+        text: visibleText.trim(),
       });
     }
   }
 
   for (const match of content.matchAll(jsxTextPattern)) {
-    const text = match[1].replaceAll(/\s+/gu, ' ').trim();
+    const [, jsxText] = match;
+    const text = jsxText.replaceAll(/\s+/gu, ' ').trim();
     if (
       text &&
       !isIgnoredLine(content, match.index ?? 0) &&
+      isJsxTagEnd(content, match.index ?? 0) &&
       !isCodeElementText(content, match.index ?? 0)
     ) {
       violations.push({

package/template/scripts/validate-ultramodern.mjs.handlebars

@@ -481,6 +481,11 @@ if (
   process.exit(1);
 }
 
+if (packageJson.modernjs?.packageSource?.strategy !== packageSource.strategy) {
+  console.error('package.json package source strategy must match package source metadata');
+  process.exit(1);
+}
+
 if (packageSource.schemaVersion !== 1) {
   console.error('Package source metadata must use schemaVersion 1');
   process.exit(1);
@@ -496,21 +501,33 @@ if (packageSource.strategy !== 'workspace' && packageSource.strategy !== 'instal
   process.exit(1);
 }
 
-const expectedModernPackages = [
-  '@modern-js/runtime',
-  '@modern-js/app-tools',
-  '@modern-js/tsconfig',
-  '@modern-js/plugin-i18n',
-  '@modern-js/plugin-tanstack',
-  '@modern-js/plugin-bff',
-  '@modern-js/adapter-rstest',
-];
+const declaredModernPackages = packageSource.modernPackages?.packages;
+if (!Array.isArray(declaredModernPackages) || declaredModernPackages.length === 0) {
+  console.error('Package source metadata must declare the generated Modern package cohort');
+  process.exit(1);
+}
 
-for (const packageName of expectedModernPackages) {
-  if (!packageSource.modernPackages?.packages?.includes(packageName)) {
-    console.error(`Package source metadata must include ${packageName}`);
-    process.exit(1);
-  }
+const invalidModernPackages = declaredModernPackages.filter(
+  (packageName) => typeof packageName !== 'string' || !packageName.startsWith('@modern-js/'),
+);
+if (invalidModernPackages.length > 0) {
+  console.error(`Package source metadata contains invalid Modern packages: ${invalidModernPackages.join(', ')}`);
+  process.exit(1);
+}
+
+const packageJsonModernDependencies = [
+  ...new Set(
+    ['dependencies', 'devDependencies']
+      .flatMap((section) => Object.keys(packageJson[section] ?? {}))
+      .filter((packageName) => packageName.startsWith('@modern-js/')),
+  ),
+];
+const missingMetadataPackages = packageJsonModernDependencies.filter(
+  (packageName) => !declaredModernPackages.includes(packageName),
+);
+if (missingMetadataPackages.length > 0) {
+  console.error(`Package source metadata must include package.json Modern dependencies: ${missingMetadataPackages.join(', ')}`);
+  process.exit(1);
 }
 
 const expectedModernSpecifier = packageSource.modernPackages?.specifier;
@@ -535,32 +552,15 @@ const expectedModernDependency = (packageName) => {
     : expectedModernSpecifier;
 };
 
-for (const packageName of [
-  '@modern-js/runtime',
-  '@modern-js/plugin-i18n',
-  '@modern-js/plugin-tanstack',
-]) {
-  if (
-    packageJson.dependencies?.[packageName] &&
-    packageJson.dependencies[packageName] !== expectedModernDependency(packageName)
-  ) {
-    console.error(`Dependency ${packageName} must match package source metadata`);
-    process.exit(1);
-  }
-}
-
-for (const packageName of [
-  '@modern-js/app-tools',
-  '@modern-js/adapter-rstest',
-  '@modern-js/tsconfig',
-  '@modern-js/plugin-bff',
-]) {
-  if (
-    packageJson.devDependencies?.[packageName] &&
-    packageJson.devDependencies[packageName] !== expectedModernDependency(packageName)
-  ) {
-    console.error(`Dev dependency ${packageName} must match package source metadata`);
-    process.exit(1);
+for (const section of ['dependencies', 'devDependencies']) {
+  for (const packageName of declaredModernPackages) {
+    if (
+      packageJson[section]?.[packageName] &&
+      packageJson[section][packageName] !== expectedModernDependency(packageName)
+    ) {
+      console.error(`${section}.${packageName} must match package source metadata`);
+      process.exit(1);
+    }
   }
 }
 

package/template/tests/ultramodern.contract.test.ts.handlebars

@@ -89,6 +89,7 @@ describe('generated UltraModern contract', () => {
       modernjs?: {
         packageSource?: {
           config?: string;
+          strategy?: string;
         };
         preset?: string;
       };
@@ -105,15 +106,20 @@ describe('generated UltraModern contract', () => {
     expect(packageJson.modernjs?.packageSource?.config).toBe(
       './.modernjs/ultramodern-package-source.json',
     );
-    expect(packageSource.strategy).toMatch(/^(workspace|install)$/u);
-    expect(packageSource.modernPackages?.packages).toContain(
-      '@modern-js/runtime',
-    );
-    expect(packageSource.modernPackages?.packages).toContain(
-      '@modern-js/app-tools',
+    expect(packageJson.modernjs?.packageSource?.strategy).toBe(
+      packageSource.strategy,
     );
-    expect(packageSource.modernPackages?.packages).toContain(
-      '@modern-js/adapter-rstest',
+    expect(packageSource.strategy).toMatch(/^(workspace|install)$/u);
+    const generatedModernDependencies = [
+      ...new Set(
+        (['dependencies', 'devDependencies'] as const).flatMap(section =>
+          Object.keys(packageJson[section] ?? {}),
+        ),
+      ),
+    ].filter(packageName => packageName.startsWith('@modern-js/'));
+    expect(packageSource.modernPackages?.packages?.length).toBeGreaterThan(0);
+    expect(packageSource.modernPackages?.packages).toEqual(
+      expect.arrayContaining(generatedModernDependencies),
     );
     expect(packageSource.modernPackages?.specifier).toBeTruthy();
     expect(

package/template-workspace/README.md.handlebars

@@ -19,9 +19,18 @@ pnpm dlx @bleedingdev/modern-js-create payments --vertical
 ```
 
 Each added vertical owns its UI/routes, browser-safe Module Federation exposes,
-localized route metadata, CSS prefix, Effect BFF handlers, local API contract,
-and typed client surface. Server handlers and Effect client/contract modules
-stay out of browser exposes.
+private-first route metadata, localized URLs, public-route opt-ins, CSS prefix,
+Effect BFF handlers, local API contract, and typed client surface. Server
+handlers and Effect client/contract modules stay out of browser exposes.
+
+## Private-First Public Surfaces
+
+Generated app routes are private and non-indexable by default. Private app,
+auth, tenant, dashboard, and internal routes publish no discovery output unless
+route metadata explicitly marks them `public && indexable`. The default scaffold
+therefore emits only a disallowing `robots.txt`; sitemap, web manifest,
+`llms.txt`, API catalog, security.txt, and JSON-LD output stay omitted until a
+safe public route or public docs/help/product surface exists.
 
 Run the scaffold validator before adding business code and after every
 `--vertical` mutation: