@bleedingdev/modern-js-create 3.2.0-ultramodern.103 → 3.2.0-ultramodern.105

package/dist/index.js

@@ -559,29 +559,87 @@ const localeKeys = i18n.init('en', {
     zh: ZH_LOCALE,
     en: EN_LOCALE
 });
+const WORKSPACE_PACKAGE_VERSION = 'workspace:*';
+const BLEEDINGDEV_CREATE_PACKAGE = '@bleedingdev/modern-js-create';
+const BLEEDINGDEV_PACKAGE_SCOPE = 'bleedingdev';
+const BLEEDINGDEV_PACKAGE_NAME_PREFIX = 'modern-js-';
+const BLEEDINGDEV_FRAMEWORK_VERSION_ENV = 'MODERN_CREATE_ULTRAMODERN_FRAMEWORK_VERSION';
+const ULTRAMODERN_SINGLE_APP_MODERN_PACKAGES = [
+    '@modern-js/runtime',
+    '@modern-js/app-tools',
+    '@modern-js/tsconfig',
+    '@modern-js/plugin-i18n',
+    '@modern-js/plugin-tanstack',
+    '@modern-js/plugin-bff',
+    '@modern-js/adapter-rstest'
+];
+const ULTRAMODERN_WORKSPACE_MODERN_PACKAGES = [
+    '@modern-js/app-tools',
+    '@modern-js/plugin-bff',
+    '@modern-js/plugin-i18n',
+    '@modern-js/plugin-tanstack',
+    '@modern-js/runtime'
+];
+function modernPackageVersion(packageSource) {
+    return 'install' === packageSource.strategy ? packageSource.modernPackageVersion : WORKSPACE_PACKAGE_VERSION;
+}
+function modernAliasPackageName(packageName, packageSource) {
+    if (!packageSource.aliasScope) return packageName;
+    const scope = packageSource.aliasScope.replace(/^@/, '');
+    const unscopedName = packageName.split('/').at(-1);
+    return `@${scope}/${packageSource.aliasPackageNamePrefix ?? ''}${unscopedName}`;
+}
+function modernPackageSpecifier(packageName, packageSource) {
+    if ('install' !== packageSource.strategy) return WORKSPACE_PACKAGE_VERSION;
+    if (!packageSource.aliasScope) return packageSource.modernPackageVersion;
+    return `npm:${modernAliasPackageName(packageName, packageSource)}@${packageSource.modernPackageVersion}`;
+}
+function modernPackageAliases(packageNames, packageSource) {
+    if (!packageSource.aliasScope) return;
+    return Object.fromEntries(packageNames.map((packageName)=>[
+            packageName,
+            modernAliasPackageName(packageName, packageSource)
+        ]));
+}
+function createModernPackagesMetadata(packageNames, packageSource, options = {}) {
+    const includeAliases = options.includeAliases ?? Boolean(packageSource.aliasScope);
+    const aliases = includeAliases ? modernPackageAliases(packageNames, packageSource) : void 0;
+    return {
+        packages: [
+            ...packageNames
+        ],
+        specifier: modernPackageVersion(packageSource),
+        ...packageSource.registry ? {
+            registry: packageSource.registry
+        } : {},
+        ...aliases ? {
+            aliases
+        } : {}
+    };
+}
 const ultramodern_workspace_dirname = node_path.dirname(fileURLToPath(import.meta.url));
 const workspaceTemplateDir = node_path.resolve(ultramodern_workspace_dirname, '..', 'template-workspace');
-const TANSTACK_ROUTER_VERSION = '1.170.11';
-const MODULE_FEDERATION_VERSION = '2.5.0';
+const TANSTACK_ROUTER_VERSION = '1.170.15';
+const MODULE_FEDERATION_VERSION = '2.5.1';
 const ZEPHYR_RSPACK_PLUGIN_VERSION = '1.1.1';
 const ZEPHYR_AGENT_VERSION = '1.1.1';
-const WRANGLER_VERSION = '4.95.0';
+const WRANGLER_VERSION = '4.98.0';
 const CLOUDFLARE_COMPATIBILITY_DATE = '2026-06-02';
 const TAILWIND_VERSION = '4.3.0';
 const TAILWIND_POSTCSS_VERSION = '4.3.0';
-const EFFECT_TSGO_VERSION = '0.13.0';
+const POSTCSS_VERSION = '8.5.15';
+const EFFECT_TSGO_VERSION = '0.14.0';
 const TYPESCRIPT_VERSION = '6.0.3';
-const TYPESCRIPT_NATIVE_PREVIEW_VERSION = '7.0.0-dev.20260527.2';
-const OXLINT_VERSION = '1.66.0';
-const OXFMT_VERSION = '0.51.0';
-const ULTRACITE_VERSION = '7.7.0';
+const TYPESCRIPT_NATIVE_PREVIEW_VERSION = '7.0.0-dev.20260606.1';
+const OXLINT_VERSION = '1.68.0';
+const OXFMT_VERSION = '0.53.0';
+const ULTRACITE_VERSION = '7.8.1';
 const LEFTHOOK_VERSION = '^2.1.9';
-const I18NEXT_VERSION = '26.2.0';
-const REACT_VERSION = '^19.2.6';
-const REACT_DOM_VERSION = '^19.2.6';
-const REACT_ROUTER_DOM_VERSION = '7.16.0';
+const I18NEXT_VERSION = '26.3.1';
+const REACT_VERSION = '^19.2.7';
+const REACT_DOM_VERSION = '^19.2.7';
+const REACT_ROUTER_DOM_VERSION = '7.17.0';
 const PNPM_VERSION = '11.5.0';
-const WORKSPACE_PACKAGE_VERSION = 'workspace:*';
 const GENERATED_CONTRACT_PATH = '.modernjs/ultramodern-generated-contract.json';
 const RSTACK_AGENT_SKILLS_COMMIT = '61c948b42512e223bad44b83af4080eba48b2677';
 const MODULE_FEDERATION_AGENT_SKILLS_COMMIT = '07bb5b6c43ad457609e00c081b72d4c42508ec76';
@@ -605,13 +663,6 @@ const privateAgentSkills = [
     'debugger-mode'
 ];
 const effectTsgoTypecheckCommand = "node -e \"const fs = require('node:fs'); const { execFileSync, spawnSync } = require('node:child_process'); const bin = execFileSync('effect-tsgo', ['get-exe-path'], { encoding: 'utf8' }).trim(); if (process.platform !== 'win32') fs.chmodSync(bin, 0o755); const result = spawnSync(bin, ['--noEmit', '-p', 'tsconfig.json'], { stdio: 'inherit' }); process.exit(result.status ?? 1);\"";
-const modernPackageNames = [
-    '@modern-js/app-tools',
-    '@modern-js/plugin-bff',
-    '@modern-js/plugin-i18n',
-    '@modern-js/plugin-tanstack',
-    '@modern-js/runtime'
-];
 function sortJsonValue(value) {
     if (Array.isArray(value)) return value.map(sortJsonValue);
     if (null !== value && 'object' == typeof value) return Object.fromEntries(Object.entries(value).sort(([left], [right])=>left.localeCompare(right)).map(([key, entry])=>[
@@ -620,6 +671,10 @@ function sortJsonValue(value) {
         ]));
     return value;
 }
+const supportedWorkspaceLanguages = [
+    'en',
+    'cs'
+];
 const ULTRAMODERN_WORKSPACE_FLAG = '--ultramodern-workspace';
 const FIRST_VERTICAL_PORT = 4101;
 const TAILWIND_PREFIX_DIGIT_WORDS = [
@@ -914,28 +969,23 @@ function relativeRootFor(packageDir) {
     return normalizePath(node_path.relative(packageDir, '.') || '.');
 }
 function resolvePackageSource(options) {
-    const strategy = options.packageSource?.strategy ?? 'workspace';
-    return {
+    const strategy = options.packageSource?.strategy ?? 'install';
+    if ('workspace' === strategy) return {
         strategy,
-        modernPackageVersion: 'install' === strategy ? options.packageSource?.modernPackageVersion ?? options.modernVersion : WORKSPACE_PACKAGE_VERSION,
+        modernPackageVersion: WORKSPACE_PACKAGE_VERSION,
         registry: options.packageSource?.registry,
         aliasScope: options.packageSource?.aliasScope,
         aliasPackageNamePrefix: options.packageSource?.aliasPackageNamePrefix
     };
-}
-function modernPackageVersion(packageSource) {
-    return 'install' === packageSource.strategy ? packageSource.modernPackageVersion : WORKSPACE_PACKAGE_VERSION;
-}
-function modernAliasPackageName(packageName, packageSource) {
-    if (!packageSource.aliasScope) return packageName;
-    const scope = packageSource.aliasScope.replace(/^@/, '');
-    const unscopedName = packageName.split('/').at(-1);
-    return `@${scope}/${packageSource.aliasPackageNamePrefix ?? ''}${unscopedName}`;
-}
-function modernPackageSpecifier(packageName, packageSource) {
-    if ('install' !== packageSource.strategy) return WORKSPACE_PACKAGE_VERSION;
-    if (!packageSource.aliasScope) return packageSource.modernPackageVersion;
-    return `npm:${modernAliasPackageName(packageName, packageSource)}@${packageSource.modernPackageVersion}`;
+    const registry = options.packageSource?.registry;
+    const aliasScope = options.packageSource?.aliasScope ?? (registry ? void 0 : BLEEDINGDEV_PACKAGE_SCOPE);
+    return {
+        strategy,
+        modernPackageVersion: options.packageSource?.modernPackageVersion ?? options.modernVersion,
+        registry,
+        aliasScope,
+        aliasPackageNamePrefix: options.packageSource?.aliasPackageNamePrefix ?? (aliasScope ? BLEEDINGDEV_PACKAGE_NAME_PREFIX : void 0)
+    };
 }
 function appDependencies(scope, packageSource, app, remotes = []) {
     const dependencies = {
@@ -968,13 +1018,13 @@ function appDevDependencies(packageSource, enableTailwind) {
         '@effect/tsgo': EFFECT_TSGO_VERSION,
         ...enableTailwind ? {
             '@tailwindcss/postcss': `^${TAILWIND_POSTCSS_VERSION}`,
-            postcss: '^8.5.6',
+            postcss: `^${POSTCSS_VERSION}`,
             tailwindcss: `^${TAILWIND_VERSION}`
         } : {},
         "@typescript/native-preview": TYPESCRIPT_NATIVE_PREVIEW_VERSION,
         '@types/node': '^20',
-        '@types/react': '^19.1.8',
-        '@types/react-dom': '^19.1.6',
+        '@types/react': '^19.2.17',
+        '@types/react-dom': '^19.2.3',
         typescript: TYPESCRIPT_VERSION,
         'zephyr-rspack-plugin': ZEPHYR_RSPACK_PLUGIN_VERSION,
         wrangler: WRANGLER_VERSION
@@ -1420,7 +1470,19 @@ if (
 export default defineConfig(
   presetUltramodern(
     {
-${bffConfig}      html: {
+${bffConfig}      ...(cloudflareDeployEnabled
+        ? {
+            deploy: {
+              worker: {
+                compatibilityDate: '${CLOUDFLARE_COMPATIBILITY_DATE}',
+                name: cloudflareWorkerName,
+                security: ${formatTsJsonValue(sortJsonValue(createCloudflareSecurityContract()), 16)},
+                ssr: true,
+              },
+            },
+          }
+        : {}),
+      html: {
         outputStructure: 'flat',
       },
       output: {
@@ -1457,6 +1519,9 @@ ${bffConfig}      html: {
               '/mf-manifest.json',
               '/mf-stats.json',
               '/remoteEntry.js',
+              '/robots.txt',
+              '/site.webmanifest',
+              '/sitemap.xml',
               '/static',
               '/zephyr-manifest.json',
             ],
@@ -1469,6 +1534,20 @@ ${bffConfig}      html: {
 ${bffPluginEntry}        moduleFederationPlugin(),
         zephyrRspackPlugin(),
       ],
+      server: {
+        port,
+        publicDir: ['./locales', './assets'],
+        ssr: {
+          mode: 'string',
+          moduleFederationAppSSR: true,
+        },
+      },
+      source: {
+        globalVars: {
+          ULTRAMODERN_SITE_URL: siteUrl,
+        },
+        mainEntryName: 'index',
+      },
       tools: {
         autoprefixer: {
           overrideBrowserslist: ['defaults'],
@@ -1485,31 +1564,6 @@ ${bffPluginEntry}        moduleFederationPlugin(),
           ]);
         },
       },
-      ...(cloudflareDeployEnabled
-        ? {
-            deploy: {
-              worker: {
-                compatibilityDate: '${CLOUDFLARE_COMPATIBILITY_DATE}',
-                security: ${formatTsJsonValue(createCloudflareSecurityContract(), 16)},
-                ssr: true,
-              },
-            },
-          }
-        : {}),
-      server: {
-        port,
-        publicDir: ['./locales', './assets'],
-        ssr: {
-          mode: 'string',
-          moduleFederationAppSSR: true,
-        },
-      },
-      source: {
-        globalVars: {
-          ULTRAMODERN_SITE_URL: siteUrl,
-        },
-        mainEntryName: 'index',
-      },
     },
     {
       appId,
@@ -2128,15 +2182,125 @@ function createPostcssConfig() {
 function createTailwindConfig() {
     return `import type { Config } from 'tailwindcss';
 
-export default {
-} satisfies Config;
+export default {} satisfies Config;
 `;
 }
 function createTw(prefix) {
     return (classList)=>classList.split(/\s+/u).filter(Boolean).map((candidate)=>`${prefix}:${candidate.replace(/\[&&\]:/gu, '')}`).join(' ');
 }
-function workspaceAssetsForApp(_app) {
-    return {};
+const publicSurfaceRequiredAssetPaths = [
+    'config/public/robots.txt'
+];
+const publicSurfaceOptionalAssetPaths = [
+    'config/public/sitemap.xml',
+    'config/public/site.webmanifest'
+];
+function normalisePublicPath(pathname) {
+    const normalised = pathname.trim().replaceAll(/\/+/gu, '/').replace(/\/+$/u, '');
+    return normalised.length > 0 && normalised.startsWith('/') ? normalised : `/${normalised}`;
+}
+function createLocalisedPublicPath(pathname, language) {
+    const publicPath = normalisePublicPath(pathname);
+    return '/' === publicPath ? `/${language}` : `/${language}${publicPath}`;
+}
+function isConcretePublicPath(pathname) {
+    return !normalisePublicPath(pathname).split('/').some((segment)=>segment.startsWith(':') || segment.includes('*') || segment.startsWith('['));
+}
+function uniqueSorted(values) {
+    return Array.from(new Set(values)).sort((left, right)=>left.localeCompare(right));
+}
+function createPublicSurfaceRouteEntries(app) {
+    return createPublicRouteMetadata(app).map((route)=>{
+        const localeUrlPaths = Object.fromEntries(supportedWorkspaceLanguages.map((language)=>[
+                language,
+                createLocalisedPublicPath(route.localisedPaths[language], language)
+            ]));
+        if (!Object.values(localeUrlPaths).every(isConcretePublicPath)) return;
+        return {
+            ...route,
+            canonicalUrlPath: localeUrlPaths.en,
+            localeUrlPaths
+        };
+    }).filter((route)=>void 0 !== route).sort((left, right)=>left.canonicalUrlPath.localeCompare(right.canonicalUrlPath) || left.id.localeCompare(right.id));
+}
+function createPublicSurfaceUrlPaths(app) {
+    return uniqueSorted(createPublicSurfaceRouteEntries(app).flatMap((route)=>supportedWorkspaceLanguages.map((language)=>route.localeUrlPaths[language])));
+}
+function createPublicSurfaceOrigin(app) {
+    return `http://localhost:${app.port}`;
+}
+function escapeXmlText(value) {
+    return value.replaceAll('&', '&amp;').replaceAll('<', '&lt;').replaceAll('>', '&gt;');
+}
+function escapeXmlAttribute(value) {
+    return escapeXmlText(value).replaceAll('"', '&quot;');
+}
+function renderRobotsTxt(app) {
+    const urlPaths = createPublicSurfaceUrlPaths(app);
+    const lines = [
+        'User-agent: *'
+    ];
+    if (0 === urlPaths.length) lines.push('Disallow: /');
+    else {
+        for (const urlPath of urlPaths)lines.push(`Allow: ${urlPath}$`);
+        lines.push('Disallow: /');
+        lines.push(`Sitemap: ${createPublicSurfaceOrigin(app)}/sitemap.xml`);
+    }
+    return `${lines.join('\n')}\n`;
+}
+function renderSitemapXml(app) {
+    const origin = createPublicSurfaceOrigin(app);
+    const routes = createPublicSurfaceRouteEntries(app);
+    const lines = [
+        '<?xml version="1.0" encoding="UTF-8"?>',
+        '<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9" xmlns:xhtml="http://www.w3.org/1999/xhtml">'
+    ];
+    for (const route of routes)for (const language of supportedWorkspaceLanguages){
+        lines.push('  <url>');
+        lines.push(`    <loc>${escapeXmlText(`${origin}${route.localeUrlPaths[language]}`)}</loc>`);
+        for (const alternateLanguage of supportedWorkspaceLanguages)lines.push(`    <xhtml:link rel="alternate" hreflang="${alternateLanguage}" href="${escapeXmlAttribute(`${origin}${route.localeUrlPaths[alternateLanguage]}`)}" />`);
+        lines.push(`    <xhtml:link rel="alternate" hreflang="x-default" href="${escapeXmlAttribute(`${origin}${route.localeUrlPaths.en}`)}" />`);
+        lines.push('  </url>');
+    }
+    lines.push('</urlset>');
+    return `${lines.join('\n')}\n`;
+}
+function renderWebManifest(app) {
+    const startUrl = createPublicSurfaceUrlPaths(app)[0];
+    const manifest = {
+        name: app.displayName,
+        short_name: app.displayName,
+        display: 'standalone',
+        background_color: '#ffffff',
+        theme_color: '#133225',
+        lang: 'en',
+        categories: [
+            'business',
+            'productivity'
+        ],
+        icons: [],
+        ...startUrl ? {
+            scope: '/',
+            start_url: startUrl
+        } : {}
+    };
+    return `${JSON.stringify(sortJsonValue(manifest), null, 2)}\n`;
+}
+function createPublicSurfaceAssets(app) {
+    const assets = {
+        'config/public/robots.txt': renderRobotsTxt(app)
+    };
+    if (createPublicSurfaceRouteEntries(app).length > 0) {
+        assets['config/public/sitemap.xml'] = renderSitemapXml(app);
+        assets['config/public/site.webmanifest'] = renderWebManifest(app);
+    }
+    return assets;
+}
+function workspaceAssetsForApp(app) {
+    return createPublicSurfaceAssets(app);
+}
+function rewriteWorkspaceAssetsForApp(workspaceRoot, app) {
+    for (const [relativePath, content] of Object.entries(workspaceAssetsForApp(app)))writeFileReplacing(workspaceRoot, `${app.directory}/${relativePath}`, content);
 }
 function createLocalizedHeadComponent() {
     return `const fallbackLanguage = 'en';
@@ -3534,7 +3698,7 @@ export const ${apiExport} = HttpApi.make('${apiName}').add(
     .add(
       HttpApiEndpoint.get('list', '/effect/${stem}', {
         query: {
-          limit: Schema.optional(Schema.NumberFromString),
+          limit: Schema.optional(Schema.FiniteFromString),
         },
         success: Schema.Struct({
           items: Schema.Array(${schemaExport}),
@@ -4086,19 +4250,10 @@ function createDevelopmentOverlay(remotes = []) {
     };
 }
 function createPackageSourceMetadata(scope, packageSource) {
-    const modernPackages = {
-        packages: modernPackageNames,
-        specifier: modernPackageVersion(packageSource)
-    };
-    if (packageSource.registry) modernPackages.registry = packageSource.registry;
-    if (packageSource.aliasScope) modernPackages.aliases = Object.fromEntries(modernPackageNames.map((packageName)=>[
-            packageName,
-            modernAliasPackageName(packageName, packageSource)
-        ]));
     return {
         schemaVersion: 1,
         strategy: packageSource.strategy,
-        modernPackages,
+        modernPackages: createModernPackagesMetadata(ULTRAMODERN_WORKSPACE_MODERN_PACKAGES, packageSource),
         generatedWorkspacePackages: {
             packages: sharedPackages.map((sharedPackage)=>ultramodern_workspace_packageName(scope, sharedPackage.id)),
             specifier: WORKSPACE_PACKAGE_VERSION
@@ -4348,6 +4503,23 @@ function createStylingContract(scope, app, enableTailwind) {
         federation: createAppCssFederationContract(scope, app)
     };
 }
+function createPublicSurfaceContract(app) {
+    const files = Object.keys(createPublicSurfaceAssets(app)).sort().map((relativePath)=>relativePath.replace(/^config\/public\//u, ''));
+    return {
+        source: 'route-owned-public-routes',
+        metadataExport: './src/routes/ultramodern-route-metadata',
+        staticRoot: 'config/public',
+        privateRoutePolicy: 'omit-from-generated-public-surface',
+        files,
+        omittedByDefault: [
+            'api-catalog.json',
+            'llms.txt',
+            'security.txt'
+        ],
+        publicRoutes: createPublicRouteMetadata(app),
+        concreteUrlPaths: createPublicSurfaceUrlPaths(app)
+    };
+}
 function createAppGeneratedContract(scope, app, apps, enableTailwind) {
     const appWithResolvedRefs = 'shell' === app.kind ? {
         ...app,
@@ -4416,7 +4588,8 @@ function createAppGeneratedContract(scope, app, apps, enableTailwind) {
             privateByDefault: true,
             publicnessDefault: 'private-app-screen',
             generatedRouteMap: true,
-            manualOverrides: []
+            manualOverrides: [],
+            publicSurface: createPublicSurfaceContract(app)
         },
         moduleFederation: {
             name: app.mfName,
@@ -4908,6 +5081,21 @@ const expectedBuildScript = ${JSON.stringify(expectedBuildScript)};
 const expectedCloudflareBuildScript = ${JSON.stringify(expectedCloudflareBuildScript)};
 const expectedCloudflareDeployScript = ${JSON.stringify(expectedCloudflareDeployScript)};
 const expectedCloudflareSecurity = ${JSON.stringify(expectedCloudflareSecurity, null, 2)};
+const publicSurfaceRequiredAssetPaths = ${JSON.stringify([
+        ...publicSurfaceRequiredAssetPaths
+    ], null, 2)};
+const publicSurfaceOptionalAssetPaths = ${JSON.stringify([
+        ...publicSurfaceOptionalAssetPaths
+    ], null, 2)};
+const expectedModernPackageSpecifier = packageName => {
+  if (packageSource.strategy === 'workspace') {
+    return 'workspace:*';
+  }
+  const aliases = packageSource.modernPackages?.aliases ?? {};
+  const alias = aliases[packageName];
+  const specifier = packageSource.modernPackages?.specifier;
+  return typeof alias === 'string' ? \`npm:\${alias}@\${specifier}\` : specifier;
+};
 
 const readText = relativePath => fs.readFileSync(path.join(root, relativePath), 'utf-8');
 const readJson = relativePath => JSON.parse(readText(relativePath));
@@ -4922,6 +5110,21 @@ const assertExists = relativePath => {
 const assertNotExists = relativePath => {
   assert(!fs.existsSync(path.join(root, relativePath)), \`Unexpected \${relativePath}\`);
 };
+const assertPublicSurfaceAssets = (appPath, publicRoutes) => {
+  const robots = readText(\`\${appPath}/config/public/robots.txt\`);
+  if ((publicRoutes ?? []).length === 0) {
+    assert(robots.includes('Disallow: /'), \`\${appPath} robots.txt must disallow crawling when no public routes exist\`);
+    for (const relativePath of publicSurfaceOptionalAssetPaths) {
+      assertNotExists(\`\${appPath}/\${relativePath}\`);
+    }
+    return;
+  }
+  const sitemap = readText(\`\${appPath}/config/public/sitemap.xml\`);
+  const manifest = readJson(\`\${appPath}/config/public/site.webmanifest\`);
+  assert(!sitemap.includes('<lastmod>'), \`\${appPath} sitemap must omit build-time lastmod values\`);
+  assert(typeof manifest.name === 'string' && manifest.name.length > 0, \`\${appPath} web manifest must include a safe app name\`);
+  assert(typeof manifest.start_url === 'string' && manifest.start_url.startsWith('/'), \`\${appPath} web manifest start_url must be a public route path\`);
+};
 const expectedWorkerName = packageSuffix => \`\${packageScope}-\${packageSuffix}\`.slice(0, 63);
 const expectedChunkLoadingGlobal = mfName =>
   \`__ULTRAMODERN_\${mfName
@@ -4998,6 +5201,9 @@ const requiredPaths = [
   'apps/shell-super-app/src/routes/layout.tsx',
   'apps/shell-super-app/src/routes/ultramodern-route-metadata.ts',
   'apps/shell-super-app/src/routes/[lang]/page.tsx',
+  ...publicSurfaceRequiredAssetPaths.map(
+    relativePath => \`apps/shell-super-app/\${relativePath}\`,
+  ),
   'packages/shared-contracts/src/index.ts',
   'packages/shared-design-tokens/src/index.ts',
   'packages/shared-design-tokens/src/tokens.css',
@@ -5024,6 +5230,9 @@ for (const vertical of fullStackVerticals) {
     \`\${vertical.path}/src/routes/layout.tsx\`,
     \`\${vertical.path}/src/routes/ultramodern-route-metadata.ts\`,
     \`\${vertical.path}/src/routes/[lang]/page.tsx\`,
+    ...publicSurfaceRequiredAssetPaths.map(
+      relativePath => \`\${vertical.path}/\${relativePath}\`,
+    ),
     ...vertical.routePagePaths,
   );
 }
@@ -5058,6 +5267,31 @@ assert(rootPackage.modernjs?.preset === 'presetUltramodern', 'Root must declare
 assert(rootPackage.modernjs?.packageSource?.config === './.modernjs/ultramodern-package-source.json', 'Root must point at package source metadata');
 assert(rootPackage.modernjs?.packageSource?.strategy === packageSource.strategy, 'Root package source strategy must match metadata');
 assert(packageSource.strategy === 'workspace' || packageSource.strategy === 'install', 'Package source strategy must be workspace or install');
+assert(packageSource.strategy === 'install' || packageSource.modernPackages?.specifier === 'workspace:*', 'Workspace package source must be explicitly backed by workspace:*');
+if (packageSource.strategy === 'install') {
+  const installSpecifier = packageSource.modernPackages?.specifier;
+  assert(
+    typeof installSpecifier === 'string' &&
+      /^\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?(?:\\+[0-9A-Za-z.-]+)?$/.test(installSpecifier) &&
+      installSpecifier.includes('ultramodern'),
+    'Install package source must use a semver UltraModern published cohort',
+  );
+  const modernAliases = packageSource.modernPackages?.aliases ?? {};
+  if (Object.keys(modernAliases).length > 0) {
+    for (const modernPackageName of [
+      '@modern-js/app-tools',
+      '@modern-js/plugin-bff',
+      '@modern-js/plugin-i18n',
+      '@modern-js/plugin-tanstack',
+      '@modern-js/runtime',
+    ]) {
+      assert(
+        /^@[^/]+\\/.+/.test(modernAliases[modernPackageName] ?? ''),
+        \`Install package source alias for \${modernPackageName} must be a scoped npm package\`,
+      );
+    }
+  }
+}
 assert(packageSource.generatedWorkspacePackages?.specifier === 'workspace:*', 'Generated workspace packages must keep workspace:* links');
 assert(
   rootPackage.scripts?.build === expectedBuildScript,
@@ -5072,6 +5306,10 @@ assert(rootPackage.scripts?.['cloudflare:proof'] === 'node ./scripts/proof-cloud
 assert(rootPackage.scripts?.['skills:install'] === 'node ./scripts/bootstrap-agent-skills.mjs', 'Root must expose skills:install');
 assert(rootPackage.scripts?.['skills:check'] === 'node ./scripts/bootstrap-agent-skills.mjs --check', 'Root must expose skills:check');
 assert(rootPackage.scripts?.postinstall === "oxfmt . '!repos/**' && node ./scripts/bootstrap-agent-skills.mjs && node ./scripts/setup-agent-reference-repos.mjs", 'Root postinstall must format, bootstrap agent skills, initialize git/hooks, and install reference repositories');
+const agentReferenceRepoSetup = readText('scripts/setup-agent-reference-repos.mjs');
+assert(agentReferenceRepoSetup.includes("['commit', '--no-verify', '-m', message]"), 'Agent reference repo installer commits must skip hooks during postinstall');
+assert(agentReferenceRepoSetup.includes("commitInstallerChanges('Initialize UltraModern workspace')"), 'Initial agent reference repo commit must use the installer commit helper');
+assert(agentReferenceRepoSetup.includes("commitInstallerChanges('Record agent reference repo manifest')"), 'Agent reference repo manifest commit must use the installer commit helper');
 
 const expectedAppIds = ['shell-super-app', ...fullStackVerticals.map(vertical => vertical.id)];
 const expectedCloudflareCompatibilityDate = '${CLOUDFLARE_COMPATIBILITY_DATE}';
@@ -5091,6 +5329,7 @@ assert(generatedContract.cssFederation?.sharedDesignTokens?.dedupe?.duplicateBas
 assert(generatedContract.cssFederation?.sharedDesignTokens?.ssr?.firstPaintRequired === true, 'Shared design token CSS must be required for SSR first paint');
 
 const shellPackage = readJson('apps/shell-super-app/package.json');
+const shellModernConfig = readText('apps/shell-super-app/modern.config.ts');
 const expectedZephyrDependencies = Object.fromEntries(
   fullStackVerticals.map(vertical => [
     vertical.zephyrAlias,
@@ -5102,6 +5341,11 @@ assert(
     JSON.stringify(expectedZephyrDependencies),
   'Shell Zephyr dependencies must reference every vertical package',
 );
+assert(shellPackage.devDependencies?.['@modern-js/app-tools'] === expectedModernPackageSpecifier('@modern-js/app-tools'), 'Shell app-tools dependency must match package source metadata');
+assert(shellPackage.dependencies?.['@modern-js/plugin-bff'] === expectedModernPackageSpecifier('@modern-js/plugin-bff'), 'Shell plugin-bff dependency must match package source metadata');
+assert(shellPackage.dependencies?.['@modern-js/plugin-i18n'] === expectedModernPackageSpecifier('@modern-js/plugin-i18n'), 'Shell plugin-i18n dependency must match package source metadata');
+assert(shellPackage.dependencies?.['@modern-js/plugin-tanstack'] === expectedModernPackageSpecifier('@modern-js/plugin-tanstack'), 'Shell plugin-tanstack dependency must match package source metadata');
+assert(shellPackage.dependencies?.['@modern-js/runtime'] === expectedModernPackageSpecifier('@modern-js/runtime'), 'Shell runtime dependency must match package source metadata');
 const shellContract = generatedContract.apps?.find(app => app.id === 'shell-super-app');
 assert(shellContract?.deploy?.cloudflare?.workerName === expectedWorkerName('shell-super-app'), 'Shell Cloudflare workerName is incorrect');
 assert(shellContract?.deploy?.cloudflare?.publicUrlEnv === 'ULTRAMODERN_PUBLIC_URL_SHELL_SUPER_APP', 'Shell Cloudflare public URL env is incorrect');
@@ -5109,6 +5353,9 @@ assert(shellContract?.deploy?.cloudflare?.compatibilityDate === expectedCloudfla
 assert(JSON.stringify(shellContract?.deploy?.cloudflare?.compatibilityFlags) === JSON.stringify(expectedCloudflareCompatibilityFlags), 'Shell Cloudflare compatibility flags are incorrect');
 assert(JSON.stringify(shellContract?.deploy?.cloudflare?.security) === JSON.stringify(expectedCloudflareSecurity), 'Shell Cloudflare security contract is incorrect');
 assert(shellContract?.deploy?.worker?.compatibilityDate === expectedCloudflareCompatibilityDate, 'Shell worker compatibilityDate is incorrect');
+assert(shellContract?.deploy?.worker?.name === expectedWorkerName('shell-super-app'), 'Shell worker name is incorrect');
+assert(shellModernConfig.includes("const cloudflareWorkerName = '" + expectedWorkerName('shell-super-app') + "'"), 'Shell modern.config.ts must define the Cloudflare worker name');
+assert(shellModernConfig.includes('name: cloudflareWorkerName'), 'Shell modern.config.ts must wire deploy.worker.name');
 assert(shellContract?.config?.rspack?.output?.uniqueName === 'shellSuperApp', 'Shell Rspack uniqueName is incorrect');
 assert(shellContract?.config?.rspack?.output?.chunkLoadingGlobal === expectedChunkLoadingGlobal('shellSuperApp'), 'Shell Rspack chunkLoadingGlobal is incorrect');
 assert(topology.shell?.cloudflare?.workerName === expectedWorkerName('shell-super-app'), 'Shell topology Cloudflare workerName is incorrect');
@@ -5129,6 +5376,7 @@ assert(
   (shellContract?.routes?.owned ?? []).every(route => route.public === false && route.indexable === false && route.publicSurface === 'private-app-screen'),
   'Shell owned routes must be non-indexable private app screens by default',
 );
+assertPublicSurfaceAssets('apps/shell-super-app', shellContract?.routes?.publicRoutes ?? []);
 assert(
   topology.shell?.verticalRefs?.join(',') === fullStackVerticals.map(vertical => vertical.id).join(','),
   'Topology shell verticalRefs must match generated verticals',
@@ -5139,10 +5387,15 @@ assert(!('effectServices' in topology), 'Default APIs must be vertical-owned, no
 
 for (const vertical of fullStackVerticals) {
   const packageJson = readJson(\`\${vertical.path}/package.json\`);
+  const modernConfig = readText(\`\${vertical.path}/modern.config.ts\`);
   assert(packageJson.name === vertical.packageName, \`\${vertical.id} package name is incorrect\`);
   assert(packageJson.scripts?.['cloudflare:deploy'] === 'ULTRAMODERN_CLOUDFLARE_REQUIRE_PUBLIC_URLS=true pnpm run cloudflare:build && wrangler deploy --config .output/wrangler.json', \`\${vertical.id} must expose cloudflare:deploy\`);
   assert(packageJson.scripts?.['cloudflare:proof']?.includes(\`--app \${vertical.id}\`), \`\${vertical.id} must expose cloudflare:proof\`);
-  assert(packageJson.dependencies?.['@modern-js/plugin-bff'], \`\${vertical.id} must depend on plugin-bff\`);
+  assert(packageJson.devDependencies?.['@modern-js/app-tools'] === expectedModernPackageSpecifier('@modern-js/app-tools'), \`\${vertical.id} app-tools dependency must match package source metadata\`);
+  assert(packageJson.dependencies?.['@modern-js/plugin-bff'] === expectedModernPackageSpecifier('@modern-js/plugin-bff'), \`\${vertical.id} plugin-bff dependency must match package source metadata\`);
+  assert(packageJson.dependencies?.['@modern-js/plugin-i18n'] === expectedModernPackageSpecifier('@modern-js/plugin-i18n'), \`\${vertical.id} plugin-i18n dependency must match package source metadata\`);
+  assert(packageJson.dependencies?.['@modern-js/plugin-tanstack'] === expectedModernPackageSpecifier('@modern-js/plugin-tanstack'), \`\${vertical.id} plugin-tanstack dependency must match package source metadata\`);
+  assert(packageJson.dependencies?.['@modern-js/runtime'] === expectedModernPackageSpecifier('@modern-js/runtime'), \`\${vertical.id} runtime dependency must match package source metadata\`);
   assert(packageJson.exports?.['./effect/client'] === \`./src/effect/\${vertical.stem}-client.ts\`, \`\${vertical.id} must export its Effect client\`);
   assert(packageJson.exports?.['./shared/effect/api'] === './shared/effect/api.ts', \`\${vertical.id} must export its Effect API contract\`);
   const expectedVerticalZephyrDependencies = Object.fromEntries(
@@ -5168,6 +5421,9 @@ for (const vertical of fullStackVerticals) {
   assert(JSON.stringify(contractEntry?.deploy?.cloudflare?.compatibilityFlags) === JSON.stringify(expectedCloudflareCompatibilityFlags), \`\${vertical.id} Cloudflare compatibility flags are incorrect\`);
   assert(JSON.stringify(contractEntry?.deploy?.cloudflare?.security) === JSON.stringify(expectedCloudflareSecurity), \`\${vertical.id} Cloudflare security contract is incorrect\`);
   assert(contractEntry?.deploy?.worker?.compatibilityDate === expectedCloudflareCompatibilityDate, \`\${vertical.id} worker compatibilityDate is incorrect\`);
+  assert(contractEntry?.deploy?.worker?.name === expectedWorkerName(vertical.id), \`\${vertical.id} worker name is incorrect\`);
+  assert(modernConfig.includes("const cloudflareWorkerName = '" + expectedWorkerName(vertical.id) + "'"), \`\${vertical.id} modern.config.ts must define the Cloudflare worker name\`);
+  assert(modernConfig.includes('name: cloudflareWorkerName'), \`\${vertical.id} modern.config.ts must wire deploy.worker.name\`);
   assert(contractEntry?.deploy?.cloudflare?.routes?.effectReadiness === \`\${vertical.apiPrefix}/effect/\${vertical.stem}/readiness\`, \`\${vertical.id} Cloudflare proof readiness route is incorrect\`);
   assert(contractEntry?.config?.rspack?.output?.uniqueName === vertical.mfName, \`\${vertical.id} Rspack uniqueName is incorrect\`);
   assert(contractEntry?.config?.rspack?.output?.chunkLoadingGlobal === expectedChunkLoadingGlobal(vertical.mfName), \`\${vertical.id} Rspack chunkLoadingGlobal is incorrect\`);
@@ -5201,6 +5457,7 @@ for (const vertical of fullStackVerticals) {
     (contractEntry?.routes?.owned ?? []).every(route => route.public === false && route.indexable === false && route.publicSurface === 'private-app-screen'),
     \`\${vertical.id} owned routes must be non-indexable private app screens by default\`,
   );
+  assertPublicSurfaceAssets(vertical.path, contractEntry?.routes?.publicRoutes ?? []);
   assert(contractEntry?.styling?.federation?.owner?.id === vertical.id, \`\${vertical.id} CSS federation owner is missing\`);
   assert(contractEntry?.styling?.federation?.role === 'vertical-css', \`\${vertical.id} must own only vertical CSS\`);
   assert(contractEntry?.styling?.federation?.rootSelector === \`[data-app-id="\${vertical.id}"]\`, \`\${vertical.id} CSS root selector is incorrect\`);
@@ -5859,6 +6116,7 @@ function rewriteShellAppFiles(workspaceRoot, scope, packageSource, enableTailwin
     writeJsonFile(node_path.join(workspaceRoot, `${shellApp.directory}/package.json`), createAppPackage(scope, shellHost, packageSource, enableTailwind, remotes));
     writeFileReplacing(workspaceRoot, `${shellApp.directory}/src/modern-app-env.d.ts`, createAppEnvDts(shellHost, remotes));
     writeFileReplacing(workspaceRoot, `${shellApp.directory}/src/routes/ultramodern-route-metadata.ts`, createRouteMetadataModule(shellHost));
+    rewriteWorkspaceAssetsForApp(workspaceRoot, shellHost);
     writeFileReplacing(workspaceRoot, `${shellApp.directory}/src/modern.runtime.ts`, createAppRuntimeConfig(shellHost, scope, remotes));
     writeJsonFile(node_path.join(workspaceRoot, `${shellApp.directory}/locales/en/translation.json`), createAppPublicLocaleMessages(shellHost, 'en', remotes));
     writeJsonFile(node_path.join(workspaceRoot, `${shellApp.directory}/locales/en/${appI18nNamespace(shellHost)}.json`), createAppPublicLocaleMessages(shellHost, 'en', remotes));
@@ -6066,10 +6324,24 @@ const sha1Pattern = /^[0-9a-f]{40}$/;
 const sha256Pattern = /^[0-9a-f]{64}$/;
 const templateIdPattern = /^[a-z0-9][a-z0-9._-]*$/;
 const packageNamePattern = /^(?:@[a-z0-9._-]+\/)?[a-z0-9._-]+$/;
-const src_TANSTACK_ROUTER_VERSION = '1.170.11';
+const src_TANSTACK_ROUTER_VERSION = '1.170.15';
 const src_TAILWIND_VERSION = '4.3.0';
 const src_TAILWIND_POSTCSS_VERSION = '4.3.0';
 const src_PNPM_VERSION = '11.5.0';
+const src_I18NEXT_VERSION = '26.3.1';
+const src_REACT_VERSION = '^19.2.7';
+const src_REACT_DOM_VERSION = '^19.2.7';
+const REACT_I18NEXT_VERSION = '17.0.8';
+const src_EFFECT_TSGO_VERSION = '0.14.0';
+const src_TYPESCRIPT_NATIVE_PREVIEW_VERSION = '7.0.0-dev.20260606.1';
+const HAPPY_DOM_VERSION = '^20.10.1';
+const RSTEST_CORE_VERSION = '0.10.3';
+const src_OXFMT_VERSION = '0.53.0';
+const src_OXLINT_VERSION = '1.68.0';
+const src_POSTCSS_VERSION = '^8.5.15';
+const src_ULTRACITE_VERSION = '7.8.1';
+const TYPES_REACT_VERSION = '^19.2.17';
+const TYPES_REACT_DOM_VERSION = '^19.2.3';
 const requiredDeniedPaths = [
     '.git/**',
     '.npmrc',
@@ -6427,7 +6699,7 @@ function readCreatePackageJson() {
     return JSON.parse(node_fs.readFileSync(createPackageJson, 'utf-8'));
 }
 function isBleedingDevCreatePackage(createPackage) {
-    return '@bleedingdev/modern-js-create' === createPackage.name;
+    return createPackage.name === BLEEDINGDEV_CREATE_PACKAGE;
 }
 function getBleedingDevFrameworkVersion(createPackage, fallbackVersion) {
     const frameworkVersion = createPackage.ultramodern?.frameworkVersion;
@@ -6534,71 +6806,109 @@ function detectUltramodernPackageSource(args, defaultPackageVersion, createPacka
         console.error('--ultramodern-package-source must be "workspace" or "install"');
         process.exit(1);
     }
+    const packageSourceStrategy = strategy;
+    const explicitRegistry = getOptionValue(args, [
+        '--ultramodern-package-registry'
+    ]);
+    const aliasScope = getOptionValue(args, [
+        '--ultramodern-package-scope'
+    ]) ?? (bleedingDevDefaults && 'install' === packageSourceStrategy && !explicitRegistry ? BLEEDINGDEV_PACKAGE_SCOPE : void 0);
     return {
-        strategy,
+        strategy: packageSourceStrategy,
         modernPackageVersion: getOptionValue(args, [
             '--ultramodern-package-version'
         ]) ?? defaultPackageVersion,
-        registry: getOptionValue(args, [
-            '--ultramodern-package-registry'
-        ]),
-        aliasScope: getOptionValue(args, [
-            '--ultramodern-package-scope'
-        ]) ?? (bleedingDevDefaults && 'install' === strategy ? 'bleedingdev' : void 0),
+        registry: explicitRegistry,
+        aliasScope,
         aliasPackageNamePrefix: getOptionValue(args, [
             '--ultramodern-package-name-prefix'
-        ]) ?? 'modern-js-'
+        ]) ?? (aliasScope ? BLEEDINGDEV_PACKAGE_NAME_PREFIX : void 0)
     };
 }
-function src_modernAliasPackageName(packageName, packageSource) {
-    if (!packageSource.aliasScope) return packageName;
-    const scope = packageSource.aliasScope.replace(/^@/, '');
-    const unscopedName = packageName.split('/').at(-1);
-    return `@${scope}/${packageSource.aliasPackageNamePrefix ?? ''}${unscopedName}`;
+function hasExplicitUltramodernPackageSource(args, value) {
+    const configuredValue = getOptionValue(args, [
+        '--ultramodern-package-source'
+    ]);
+    return value ? configuredValue === value : void 0 !== configuredValue;
 }
-function singleAppModernPackageSpecifier(packageName, packageSource, useWorkspaceProtocol) {
-    if (useWorkspaceProtocol) return 'workspace:*';
-    if ('install' !== packageSource.strategy || !packageSource.aliasScope) return packageSource.modernPackageVersion;
-    return `npm:${src_modernAliasPackageName(packageName, packageSource)}@${packageSource.modernPackageVersion}`;
+function readBleedingDevFrameworkVersionFromRegistry() {
+    const envVersion = process.env[BLEEDINGDEV_FRAMEWORK_VERSION_ENV]?.trim();
+    if (envVersion) {
+        if (!semverPattern.test(envVersion)) {
+            console.error(`${BLEEDINGDEV_FRAMEWORK_VERSION_ENV} must be a valid semver version`);
+            process.exit(1);
+        }
+        return envVersion;
+    }
+    try {
+        const rawVersion = runSetupCommand('npm', [
+            'view',
+            `${BLEEDINGDEV_CREATE_PACKAGE}@latest`,
+            'ultramodern.frameworkVersion',
+            '--json'
+        ]).trim();
+        const version = JSON.parse(rawVersion);
+        if ('string' == typeof version && semverPattern.test(version)) return version;
+    } catch  {}
+    console.error([
+        `Could not resolve ${BLEEDINGDEV_CREATE_PACKAGE}@latest ultramodern.frameworkVersion.`,
+        'Pass --workspace to use local workspace protocol dependencies,',
+        'or pass --ultramodern-package-version with the exact BleedingDev framework cohort.'
+    ].join(' '));
+    process.exit(1);
 }
-const singleAppModernPackages = [
-    '@modern-js/runtime',
-    '@modern-js/app-tools',
-    '@modern-js/tsconfig',
-    '@modern-js/plugin-i18n',
-    '@modern-js/plugin-tanstack',
-    '@modern-js/plugin-bff',
-    '@modern-js/adapter-rstest'
-];
-function createSingleAppPackageSourceEvidence(packageSource, useWorkspaceProtocol) {
-    const strategy = useWorkspaceProtocol ? 'workspace' : 'install';
-    const specifier = useWorkspaceProtocol ? 'workspace:*' : packageSource.modernPackageVersion;
-    const aliases = 'install' === strategy && packageSource.aliasScope ? Object.fromEntries(singleAppModernPackages.map((packageName)=>[
-            packageName,
-            src_modernAliasPackageName(packageName, packageSource)
-        ])) : void 0;
+function resolveInstallBackedPackageSource(args, createPackage, packageSource) {
+    const explicitVersion = getOptionValue(args, [
+        '--ultramodern-package-version'
+    ]);
+    const explicitRegistry = getOptionValue(args, [
+        '--ultramodern-package-registry'
+    ]);
+    const aliasScope = getOptionValue(args, [
+        '--ultramodern-package-scope'
+    ]) ?? packageSource.aliasScope ?? (explicitRegistry ? void 0 : BLEEDINGDEV_PACKAGE_SCOPE);
+    return {
+        ...packageSource,
+        strategy: 'install',
+        modernPackageVersion: explicitVersion ?? (isBleedingDevCreatePackage(createPackage) ? packageSource.modernPackageVersion : readBleedingDevFrameworkVersionFromRegistry()),
+        aliasScope,
+        aliasPackageNamePrefix: getOptionValue(args, [
+            '--ultramodern-package-name-prefix'
+        ]) ?? packageSource.aliasPackageNamePrefix ?? (aliasScope ? BLEEDINGDEV_PACKAGE_NAME_PREFIX : void 0)
+    };
+}
+function resolveSingleAppPackageSource(args, createPackage, packageSource, useWorkspaceProtocol) {
+    if (useWorkspaceProtocol) return {
+        ...packageSource,
+        strategy: 'workspace',
+        modernPackageVersion: WORKSPACE_PACKAGE_VERSION
+    };
+    return resolveInstallBackedPackageSource(args, createPackage, packageSource);
+}
+function resolveWorkspacePackageSource(args, createPackage, packageSource) {
+    if (hasExplicitUltramodernPackageSource(args, 'workspace')) return {
+        ...packageSource,
+        strategy: 'workspace',
+        modernPackageVersion: WORKSPACE_PACKAGE_VERSION
+    };
+    return resolveInstallBackedPackageSource(args, createPackage, packageSource);
+}
+function createSingleAppPackageSourceEvidence(packageSource) {
     return {
         schemaVersion: 1,
         preset: 'presetUltramodern',
-        strategy,
-        modernPackages: {
-            specifier,
-            packages: singleAppModernPackages,
-            ...packageSource.registry ? {
-                registry: packageSource.registry
-            } : {},
-            ...aliases ? {
-                aliases
-            } : {}
-        }
+        strategy: packageSource.strategy,
+        modernPackages: createModernPackagesMetadata(ULTRAMODERN_SINGLE_APP_MODERN_PACKAGES, packageSource, {
+            includeAliases: 'install' === packageSource.strategy
+        })
     };
 }
-function writeSingleAppPackageSourceEvidence(targetDir, packageSource, useWorkspaceProtocol) {
+function writeSingleAppPackageSourceEvidence(targetDir, packageSource) {
     const evidencePath = node_path.join(targetDir, '.modernjs', 'ultramodern-package-source.json');
     node_fs.mkdirSync(node_path.dirname(evidencePath), {
         recursive: true
     });
-    node_fs.writeFileSync(evidencePath, `${JSON.stringify(createSingleAppPackageSourceEvidence(packageSource, useWorkspaceProtocol), null, 2)}\n`);
+    node_fs.writeFileSync(evidencePath, `${JSON.stringify(createSingleAppPackageSourceEvidence(packageSource), null, 2)}\n`);
 }
 function runSetupCommand(command, args, options = {}) {
     return execFileSync(command, args, {
@@ -6803,12 +7113,13 @@ async function main() {
     }
     const generateWorkspace = detectUltramodernWorkspaceFlag();
     if (generateWorkspace) {
+        const packageSource = resolveWorkspacePackageSource(args, createPackage, detectUltramodernPackageSource(args, ultramodernPackageVersion, createPackage));
         generateUltramodernWorkspace({
             targetDir,
             packageName: generatedPackageName,
             modernVersion: version,
             enableTailwind: detectTailwindFlag(),
-            packageSource: detectUltramodernPackageSource(args, ultramodernPackageVersion, createPackage)
+            packageSource
         });
         initializeGeneratedGitRepository(targetDir);
         const dim = '\x1b[2m\x1b[3m';
@@ -6829,20 +7140,34 @@ async function main() {
     const bffRuntime = detectBffRuntime();
     const enableTailwind = detectTailwindFlag();
     const useWorkspaceProtocol = detectWorkspaceProtocolFlag();
-    const packageSource = detectUltramodernPackageSource(args, ultramodernPackageVersion, createPackage);
-    const templateManifest = createBuiltinTemplateManifest(version);
+    const packageSource = resolveSingleAppPackageSource(args, createPackage, detectUltramodernPackageSource(args, ultramodernPackageVersion, createPackage), useWorkspaceProtocol);
+    const templateManifest = createBuiltinTemplateManifest('install' === packageSource.strategy ? packageSource.modernPackageVersion : version);
     validateTemplateManifest(templateManifest);
     copyTemplate(templateDir, targetDir, {
         packageName: generatedPackageName,
-        version: useWorkspaceProtocol ? 'workspace:*' : packageSource.modernPackageVersion,
-        runtimeVersion: singleAppModernPackageSpecifier('@modern-js/runtime', packageSource, useWorkspaceProtocol),
-        appToolsVersion: singleAppModernPackageSpecifier('@modern-js/app-tools', packageSource, useWorkspaceProtocol),
-        adapterRstestVersion: singleAppModernPackageSpecifier('@modern-js/adapter-rstest', packageSource, useWorkspaceProtocol),
-        tsconfigVersion: singleAppModernPackageSpecifier('@modern-js/tsconfig', packageSource, useWorkspaceProtocol),
-        pluginTanstackVersion: singleAppModernPackageSpecifier('@modern-js/plugin-tanstack', packageSource, useWorkspaceProtocol),
-        pluginBffVersion: singleAppModernPackageSpecifier('@modern-js/plugin-bff', packageSource, useWorkspaceProtocol),
-        pluginI18nVersion: singleAppModernPackageSpecifier('@modern-js/plugin-i18n', packageSource, useWorkspaceProtocol),
+        version: 'workspace' === packageSource.strategy ? WORKSPACE_PACKAGE_VERSION : packageSource.modernPackageVersion,
+        runtimeVersion: modernPackageSpecifier('@modern-js/runtime', packageSource),
+        appToolsVersion: modernPackageSpecifier('@modern-js/app-tools', packageSource),
+        adapterRstestVersion: modernPackageSpecifier('@modern-js/adapter-rstest', packageSource),
+        tsconfigVersion: modernPackageSpecifier('@modern-js/tsconfig', packageSource),
+        pluginTanstackVersion: modernPackageSpecifier('@modern-js/plugin-tanstack', packageSource),
+        pluginBffVersion: modernPackageSpecifier('@modern-js/plugin-bff', packageSource),
+        pluginI18nVersion: modernPackageSpecifier('@modern-js/plugin-i18n', packageSource),
         tanstackRouterVersion: src_TANSTACK_ROUTER_VERSION,
+        i18nextVersion: src_I18NEXT_VERSION,
+        reactVersion: src_REACT_VERSION,
+        reactDomVersion: src_REACT_DOM_VERSION,
+        reactI18nextVersion: REACT_I18NEXT_VERSION,
+        effectTsgoVersion: src_EFFECT_TSGO_VERSION,
+        typescriptNativePreviewVersion: src_TYPESCRIPT_NATIVE_PREVIEW_VERSION,
+        rstestCoreVersion: RSTEST_CORE_VERSION,
+        happyDomVersion: HAPPY_DOM_VERSION,
+        oxfmtVersion: src_OXFMT_VERSION,
+        oxlintVersion: src_OXLINT_VERSION,
+        postcssVersion: src_POSTCSS_VERSION,
+        ultraciteVersion: src_ULTRACITE_VERSION,
+        typesReactVersion: TYPES_REACT_VERSION,
+        typesReactDomVersion: TYPES_REACT_DOM_VERSION,
         tailwindVersion: src_TAILWIND_VERSION,
         tailwindPostcssVersion: src_TAILWIND_POSTCSS_VERSION,
         pnpmVersion: src_PNPM_VERSION,
@@ -6859,7 +7184,7 @@ async function main() {
         ...packageJson.modernjs ?? {},
         preset: 'presetUltramodern',
         packageSource: {
-            strategy: useWorkspaceProtocol ? 'workspace' : 'install',
+            strategy: packageSource.strategy,
             config: './.modernjs/ultramodern-package-source.json'
         }
     };
@@ -6894,7 +7219,7 @@ async function main() {
     }
     node_fs.writeFileSync(targetPackageJson, `${JSON.stringify(packageJson, null, 2)}\n`);
     writeTemplateManifestEvidence(targetDir, templateManifest);
-    writeSingleAppPackageSourceEvidence(targetDir, packageSource, useWorkspaceProtocol);
+    writeSingleAppPackageSourceEvidence(targetDir, packageSource);
     if (!isSubproject) initializeGeneratedGitRepository(targetDir);
     const dim = '\x1b[2m\x1b[3m';
     const reset = '\x1b[0m';
@@ -6948,6 +7273,20 @@ function copyTemplate(src, dest, options) {
                     pluginBffVersion: options.pluginBffVersion,
                     pluginI18nVersion: options.pluginI18nVersion,
                     tanstackRouterVersion: options.tanstackRouterVersion,
+                    i18nextVersion: options.i18nextVersion,
+                    reactVersion: options.reactVersion,
+                    reactDomVersion: options.reactDomVersion,
+                    reactI18nextVersion: options.reactI18nextVersion,
+                    effectTsgoVersion: options.effectTsgoVersion,
+                    typescriptNativePreviewVersion: options.typescriptNativePreviewVersion,
+                    rstestCoreVersion: options.rstestCoreVersion,
+                    happyDomVersion: options.happyDomVersion,
+                    oxfmtVersion: options.oxfmtVersion,
+                    oxlintVersion: options.oxlintVersion,
+                    postcssVersion: options.postcssVersion,
+                    ultraciteVersion: options.ultraciteVersion,
+                    typesReactVersion: options.typesReactVersion,
+                    typesReactDomVersion: options.typesReactDomVersion,
                     tailwindVersion: options.tailwindVersion,
                     tailwindPostcssVersion: options.tailwindPostcssVersion,
                     pnpmVersion: options.pnpmVersion,