@bleedingdev/modern-js-create 3.2.0-ultramodern.11 → 3.2.0-ultramodern.111

package/template/scripts/validate-ultramodern.mjs.handlebars

@@ -1,8 +1,44 @@
+import { execFileSync } from 'node:child_process';
 import fs from 'node:fs';
 import path from 'node:path';
 
 const configPath = path.resolve(process.cwd(), 'modern.config.ts');
 const templateManifestPath = path.resolve(process.cwd(), '.modernjs/mv-template-manifest.json');
+const packageSourcePath = path.resolve(
+  process.cwd(),
+  '.modernjs/ultramodern-package-source.json',
+);
+const readText = (relativePath) =>
+  fs.readFileSync(path.resolve(process.cwd(), relativePath), 'utf-8');
+const readJson = (relativePath) => JSON.parse(readText(relativePath));
+const readPnpmConfig = (key) => {
+  const env = Object.fromEntries(
+    Object.entries(process.env).filter(
+      ([envKey]) => !/^(?:npm|pnpm)_config_/iu.test(envKey),
+    ),
+  );
+  const output = execFileSync('pnpm', ['config', 'get', key, '--json'], {
+    cwd: process.cwd(),
+    encoding: 'utf-8',
+    env,
+    stdio: ['ignore', 'pipe', 'pipe'],
+  }).trim();
+  return output ? JSON.parse(output) : undefined;
+};
+const enableTailwind = {{enableTailwind}};
+const expectedPnpmVersion = '{{pnpmVersion}}';
+const activePnpmVersion = execFileSync('pnpm', ['--version'], {
+  cwd: process.cwd(),
+  encoding: 'utf-8',
+  stdio: ['ignore', 'pipe', 'pipe'],
+}).trim();
+
+if (activePnpmVersion !== expectedPnpmVersion) {
+  console.error(
+    `Generated app requires pnpm ${expectedPnpmVersion}; active pnpm is ${activePnpmVersion}. Run mise install, then rerun pnpm from the activated shell`,
+  );
+  process.exit(1);
+}
 
 if (!fs.existsSync(configPath)) {
   console.error('modern.config.ts not found');
@@ -16,6 +52,11 @@ const requiredTokens = [
   'enableModuleFederationSSR',
   'enableBffRequestId',
   'enableTelemetryExporters',
+  'i18nPlugin(',
+  'localePathRedirect: true',
+  'ULTRAMODERN_SITE_URL',
+  'MODERN_PUBLIC_SITE_URL must be set for production builds',
+  'globalVars',
 ];
 const missing = requiredTokens.filter((token) => !content.includes(token));
 
@@ -32,7 +73,6 @@ if (!fs.existsSync(templateManifestPath)) {
 const templateManifest = JSON.parse(fs.readFileSync(templateManifestPath, 'utf-8'));
 const requiredDeniedPaths = [
   '.git/**',
-  '.github/**',
   '.npmrc',
   '.yarnrc',
   '.env',
@@ -42,15 +82,43 @@ const requiredDeniedPaths = [
 ];
 const requiredPostMaterialization = [
   'ultramodern-contract-check',
-  'dependency-install-with-lifecycle-deny',
+  'agent-skill-postinstall-allowed',
+  'github-workflow-security-enforced',
+  'package-source-retained',
+  'pnpm-11-policy-enforced',
+  'rstest-smoke-tests',
   'template-manifest-retained',
 ];
 const requiredPaths = [
+{{#unless isSubproject}}
   'AGENTS.md',
   '.agents/skills-lock.json',
+  '.codex/hooks.json',
+  '.github/renovate.json',
+  '.github/workflows/ultramodern-gates.yml',
+  'lefthook.yml',
+  'scripts/bootstrap-agent-skills.mjs',
+{{/unless}}
+  '.mise.toml',
+  '.modernjs/ultramodern-package-source.json',
   'oxlint.config.ts',
   'oxfmt.config.ts',
-  'scripts/bootstrap-agent-skills.mjs',
+  'pnpm-workspace.yaml',
+  'rstest.config.mts',
+  'scripts/check-i18n-strings.mjs',
+{{#if enableTailwind}}
+  'postcss.config.mjs',
+  'tailwind.config.ts',
+{{/if}}
+  'config/public/locales/en/translation.json',
+  'config/public/locales/cs/translation.json',
+  'config/favicon.svg',
+  'config/public/assets/ultramodern-logo.svg',
+  'src/modern-app-env.d.ts',
+  'src/routes/index.css',
+  'src/routes/layout.tsx',
+  'src/routes/[lang]/page.tsx',
+  'tests/ultramodern.contract.test.ts',
 ];
 const manifestErrors = [];
 
@@ -61,6 +129,70 @@ for (const requiredPath of requiredPaths) {
   }
 }
 
+if (fs.existsSync(path.resolve(process.cwd(), 'src/routes/page.tsx'))) {
+  console.error('src/routes/page.tsx must move under src/routes/[lang]/page.tsx');
+  process.exit(1);
+}
+
+if (
+  !enableTailwind &&
+  (fs.existsSync(path.resolve(process.cwd(), 'postcss.config.mjs')) ||
+    fs.existsSync(path.resolve(process.cwd(), 'tailwind.config.ts')))
+) {
+  console.error('Tailwind config files must not be written when Tailwind is disabled');
+  process.exit(1);
+}
+
+{{#unless isSubproject}}
+const workflowContent = fs.readFileSync(
+  path.resolve(process.cwd(), '.github/workflows/ultramodern-gates.yml'),
+  'utf-8',
+);
+const renovateConfig = JSON.parse(
+  fs.readFileSync(path.resolve(process.cwd(), '.github/renovate.json'), 'utf-8'),
+);
+for (const requiredSnippet of [
+  'permissions:\n  contents: read',
+  'pull_request:',
+  'persist-credentials: false',
+  'jdx/mise-action',
+  'pnpm install --frozen-lockfile',
+  'pnpm run ultramodern:check',
+  'pnpm run build',
+  'MODERN_PUBLIC_SITE_URL: http://localhost:8080',
+  'timeout-minutes:',
+  'egress-policy: audit',
+]) {
+  if (!workflowContent.includes(requiredSnippet)) {
+    console.error(`Generated workflow must retain ${requiredSnippet.split('\n')[0]}`);
+    process.exit(1);
+  }
+}
+if (workflowContent.includes('pull_request_target')) {
+  console.error('Generated workflow must not use pull_request_target');
+  process.exit(1);
+}
+for (const match of workflowContent.matchAll(/^\s*uses:\s*([^@\s]+)@([^\s#]+)/gmu)) {
+  const [, actionName, actionRef] = match;
+  if (!/^[a-f0-9]{40}$/u.test(actionRef)) {
+    console.error(`Generated workflow must pin ${actionName}@${actionRef} to a commit SHA`);
+    process.exit(1);
+  }
+}
+if (
+  renovateConfig.dependencyDashboard !== true ||
+  renovateConfig.minimumReleaseAge !== '1 day' ||
+  !renovateConfig.extends?.includes('helpers:pinGitHubActionDigests') ||
+  !renovateConfig.packageRules?.some(
+    (rule) =>
+      rule.dependencyDashboardApproval === true && rule.matchUpdateTypes?.includes('major'),
+  )
+) {
+  console.error('Generated Renovate config must retain dashboard, release-age, action pinning, and major-approval policy');
+  process.exit(1);
+}
+{{/unless}}
+
 if (templateManifest.schemaVersion !== 1) {
   manifestErrors.push('schemaVersion');
 }
@@ -90,6 +222,12 @@ for (const deniedPath of requiredDeniedPaths) {
 if (templateManifest.lifecyclePolicy?.denyByDefault !== true) {
   manifestErrors.push('lifecyclePolicy.denyByDefault');
 }
+if (
+  JSON.stringify(templateManifest.lifecyclePolicy?.allowedScripts) !==
+  JSON.stringify(['postinstall'])
+) {
+  manifestErrors.push('lifecyclePolicy.allowedScripts');
+}
 
 for (const token of requiredPostMaterialization) {
   if (!templateManifest.validation?.postMaterializationValidation?.includes(token)) {
@@ -107,21 +245,121 @@ if (manifestErrors.length > 0) {
 const packageJson = JSON.parse(
   fs.readFileSync(path.resolve(process.cwd(), 'package.json'), 'utf-8'),
 );
+const packageSource = JSON.parse(fs.readFileSync(packageSourcePath, 'utf-8'));
+const routePage = readText('src/routes/[lang]/page.tsx');
+const routeCss = readText('src/routes/index.css');
+const modernConfig = readText('modern.config.ts');
+const enLocale = readJson('config/public/locales/en/translation.json');
+const csLocale = readJson('config/public/locales/cs/translation.json');
 const unresolvedTemplateMarker = String.fromCodePoint(123, 123);
 if (JSON.stringify(packageJson).includes(unresolvedTemplateMarker)) {
   console.error('package.json contains unresolved template markers');
   process.exit(1);
 }
+if (JSON.stringify(packageSource).includes(unresolvedTemplateMarker)) {
+  console.error('package source metadata contains unresolved template markers');
+  process.exit(1);
+}
+
+for (const [fileName, text] of [
+  ['src/routes/[lang]/page.tsx', routePage],
+  ['src/routes/index.css', routeCss],
+  ['modern.config.ts', modernConfig],
+]) {
+  if (text.includes('lf3-static.bytednsdoc.com')) {
+    console.error(`${fileName} must not depend on remote starter assets`);
+    process.exit(1);
+  }
+}
+
+for (const requiredSnippet of [
+  '<Helmet',
+  'htmlAttributes={{',
+  'dir: languageDirections[currentLanguage]',
+  'lang: currentLanguage',
+  '<title>{pageTitle}</title>',
+  '<meta name="description" content={pageDescription} />',
+  '<main id="starter-main" className="starter-main">',
+  '<h1 id="starter-heading" className="title">',
+  'src="/assets/ultramodern-logo.svg"',
+  'height={96}',
+  'width={96}',
+  '<span aria-hidden="true" className="arrow-right" />',
+]) {
+  if (!routePage.includes(requiredSnippet)) {
+    console.error(`Generated route page must retain starter correctness snippet: ${requiredSnippet}`);
+    process.exit(1);
+  }
+}
+
+for (const forbiddenSnippet of ['src="https://', '<div className="title">']) {
+  if (routePage.includes(forbiddenSnippet)) {
+    console.error(`Generated route page must not contain ${forbiddenSnippet}`);
+    process.exit(1);
+  }
+}
+
+for (const requiredSnippet of [
+  'width=device-width, initial-scale=1.0, viewport-fit=cover',
+  "title: 'UltraModern.js Starter'",
+]) {
+  if (!modernConfig.includes(requiredSnippet)) {
+    console.error(`modern.config.ts must retain ${requiredSnippet}`);
+    process.exit(1);
+  }
+}
+if (modernConfig.includes('user-scalable=no') || modernConfig.includes('maximum-scale')) {
+  console.error('modern.config.ts must not disable user zoom');
+  process.exit(1);
+}
+
+for (const requiredSnippet of [
+  'min-block-size: 100dvh',
+  'grid-template-columns: repeat(auto-fit, minmax(min(100%, 17rem), 1fr))',
+  ':focus-visible',
+  '@media (prefers-reduced-motion: reduce)',
+  '.skip-link',
+]) {
+  if (!routeCss.includes(requiredSnippet)) {
+    console.error(`Starter CSS must retain ${requiredSnippet}`);
+    process.exit(1);
+  }
+}
+if (routeCss.includes('width: 1100px') || /\.card:focus(?!-visible)/u.test(routeCss)) {
+  console.error('Starter CSS must not reintroduce fixed grid width or focus transform styling');
+  process.exit(1);
+}
+
+for (const [localeName, locale] of [
+  ['en', enLocale],
+  ['cs', csLocale],
+]) {
+  if (
+    typeof locale.home?.meta?.title !== 'string' ||
+    typeof locale.home?.meta?.description !== 'string' ||
+    typeof locale.home?.skipLink !== 'string'
+  ) {
+    console.error(`${localeName} locale must include starter metadata and skip-link copy`);
+    process.exit(1);
+  }
+}
+{{#unless isSubproject}}
 const skillsLock = JSON.parse(
   fs.readFileSync(path.resolve(process.cwd(), '.agents/skills-lock.json'), 'utf-8'),
 );
+{{/unless}}
 const requiredScripts = {
   format: 'oxfmt .',
   'format:check': 'oxfmt --check .',
+  'i18n:check': 'node ./scripts/check-i18n-strings.mjs',
   lint: 'oxlint .',
   'lint:fix': 'oxlint . --fix',
+{{#unless isSubproject}}
+  postinstall: 'oxfmt . && node ./scripts/bootstrap-agent-skills.mjs',
   'skills:check': 'node ./scripts/bootstrap-agent-skills.mjs --check',
   'skills:install': 'node ./scripts/bootstrap-agent-skills.mjs',
+{{/unless}}
+  test: 'rstest run',
 };
 
 for (const [scriptName, scriptCommand] of Object.entries(requiredScripts)) {
@@ -131,6 +369,15 @@ for (const [scriptName, scriptCommand] of Object.entries(requiredScripts)) {
   }
 }
 
+const i18nCheckScript = readText('scripts/check-i18n-strings.mjs');
+if (
+  !i18nCheckScript.includes("from '@modern-js/code-tools'") ||
+  !i18nCheckScript.includes('runSingleAppI18nCheck')
+) {
+  console.error('i18n:check must call @modern-js/code-tools');
+  process.exit(1);
+}
+
 if (
   !packageJson.scripts?.typecheck?.includes('effect-tsgo') ||
   !packageJson.scripts.typecheck.includes('get-exe-path')
@@ -139,12 +386,235 @@ if (
   process.exit(1);
 }
 
+const expectedUltramodernCheck =
+  'pnpm format:check && pnpm lint && pnpm typecheck && pnpm i18n:check && pnpm test{{#unless isSubproject}} && pnpm skills:check{{/unless}} && node ./scripts/validate-ultramodern.mjs';
+if (packageJson.scripts?.['ultramodern:check'] !== expectedUltramodernCheck) {
+  console.error('ultramodern:check must run format, lint, typecheck, i18n, tests, and contract validation');
+  process.exit(1);
+}
+
+if (packageJson.private !== true) {
+  console.error('Generated app package must be private by default');
+  process.exit(1);
+}
+
+const miseConfig = fs.readFileSync(path.resolve(process.cwd(), '.mise.toml'), 'utf-8');
+if (!miseConfig.includes(`pnpm = "${expectedPnpmVersion}"`)) {
+  console.error(`Generated app must pin pnpm ${expectedPnpmVersion} in .mise.toml`);
+  process.exit(1);
+}
+
+if (packageJson.packageManager !== `pnpm@${expectedPnpmVersion}`) {
+  console.error(`Generated app package must pin pnpm@${expectedPnpmVersion}`);
+  process.exit(1);
+}
+
+if (packageJson.engines?.pnpm !== `>=${expectedPnpmVersion} <11.6.0`) {
+  console.error(`Generated app package must require pnpm >=${expectedPnpmVersion} <11.6.0`);
+  process.exit(1);
+}
+
+if (packageJson.pnpm !== undefined) {
+  console.error('Generated app must keep pnpm policy in pnpm-workspace.yaml, not package.json');
+  process.exit(1);
+}
+
+if (readPnpmConfig('minimumReleaseAge') !== 1440) {
+  console.error('pnpm minimumReleaseAge must be 1440');
+  process.exit(1);
+}
+if (readPnpmConfig('minimumReleaseAgeStrict') !== true) {
+  console.error('pnpm minimumReleaseAgeStrict must be true');
+  process.exit(1);
+}
+if (readPnpmConfig('minimumReleaseAgeIgnoreMissingTime') !== false) {
+  console.error('pnpm minimumReleaseAgeIgnoreMissingTime must be false');
+  process.exit(1);
+}
+const expectedMinimumReleaseAgeExcludes = [
+  '@bleedingdev/modern-js-*',
+  '@tanstack/react-router',
+  '@tanstack/router-core',
+  '@typescript/native-preview',
+  '@typescript/native-preview-*',
+  '@types/react',
+];
+if (
+  JSON.stringify(readPnpmConfig('minimumReleaseAgeExclude')) !==
+  JSON.stringify(expectedMinimumReleaseAgeExcludes)
+) {
+  console.error('pnpm minimumReleaseAgeExclude must allow only approved latest-lane package cohorts');
+  process.exit(1);
+}
+if (readPnpmConfig('trustPolicy') !== 'no-downgrade') {
+  console.error('pnpm trustPolicy must be no-downgrade');
+  process.exit(1);
+}
+for (const [key, expected] of [
+  ['trustPolicyIgnoreAfter', 1440],
+  ['blockExoticSubdeps', true],
+  ['engineStrict', true],
+  ['pmOnFail', 'error'],
+  ['verifyDepsBeforeRun', 'error'],
+  ['strictDepBuilds', true],
+]) {
+  if (readPnpmConfig(key) !== expected) {
+    console.error(`pnpm ${key} must be ${String(expected)}`);
+    process.exit(1);
+  }
+}
+if (
+  JSON.stringify(readPnpmConfig('allowBuilds')) !==
+  JSON.stringify({
+    '@swc/core': true,
+    'core-js': true,
+    esbuild: true,
+    lefthook: true,
+    'msgpackr-extract': true,
+    sharp: true,
+    workerd: true,
+  })
+) {
+  console.error('pnpm allowBuilds must approve only the generated app build dependencies');
+  process.exit(1);
+}
+if (
+  JSON.stringify(readPnpmConfig('onlyBuiltDependencies')) !==
+  JSON.stringify(['@swc/core', 'core-js', 'esbuild', 'lefthook', 'msgpackr-extract', 'sharp', 'workerd'])
+) {
+  console.error('pnpm onlyBuiltDependencies must approve only the generated app build dependencies');
+  process.exit(1);
+}
+
+if (packageJson.modernjs?.preset !== 'presetUltramodern') {
+  console.error('package.json must declare presetUltramodern metadata');
+  process.exit(1);
+}
+
+if (
+  packageJson.modernjs?.packageSource?.config !== './.modernjs/ultramodern-package-source.json'
+) {
+  console.error('package.json must retain package source metadata location');
+  process.exit(1);
+}
+
+if (packageJson.modernjs?.packageSource?.strategy !== packageSource.strategy) {
+  console.error('package.json package source strategy must match package source metadata');
+  process.exit(1);
+}
+
+if (packageSource.schemaVersion !== 1) {
+  console.error('Package source metadata must use schemaVersion 1');
+  process.exit(1);
+}
+
+if (packageSource.preset !== 'presetUltramodern') {
+  console.error('Package source metadata must declare presetUltramodern');
+  process.exit(1);
+}
+
+if (packageSource.strategy !== 'workspace' && packageSource.strategy !== 'install') {
+  console.error('Package source strategy must be workspace or install');
+  process.exit(1);
+}
+
+const declaredModernPackages = packageSource.modernPackages?.packages;
+if (!Array.isArray(declaredModernPackages) || declaredModernPackages.length === 0) {
+  console.error('Package source metadata must declare the generated Modern package cohort');
+  process.exit(1);
+}
+
+const invalidModernPackages = declaredModernPackages.filter(
+  (packageName) => typeof packageName !== 'string' || !packageName.startsWith('@modern-js/'),
+);
+if (invalidModernPackages.length > 0) {
+  console.error(`Package source metadata contains invalid Modern packages: ${invalidModernPackages.join(', ')}`);
+  process.exit(1);
+}
+
+const packageJsonModernDependencies = [
+  ...new Set(
+    ['dependencies', 'devDependencies']
+      .flatMap((section) => Object.keys(packageJson[section] ?? {}))
+      .filter((packageName) => packageName.startsWith('@modern-js/')),
+  ),
+];
+const missingMetadataPackages = packageJsonModernDependencies.filter(
+  (packageName) => !declaredModernPackages.includes(packageName),
+);
+if (missingMetadataPackages.length > 0) {
+  console.error(`Package source metadata must include package.json Modern dependencies: ${missingMetadataPackages.join(', ')}`);
+  process.exit(1);
+}
+
+const expectedModernSpecifier = packageSource.modernPackages?.specifier;
+if (typeof expectedModernSpecifier !== 'string' || expectedModernSpecifier.length === 0) {
+  console.error('Package source metadata must provide a Modern package specifier');
+  process.exit(1);
+}
+if (
+  packageSource.strategy === 'install' &&
+  expectedModernSpecifier !== templateManifest.template?.version
+) {
+  console.error(
+    `Package source Modern specifier ${expectedModernSpecifier} must match template version ${templateManifest.template?.version}`,
+  );
+  process.exit(1);
+}
+
+const expectedModernDependency = (packageName) => {
+  const alias = packageSource.modernPackages?.aliases?.[packageName];
+  return typeof alias === 'string'
+    ? `npm:${alias}@${expectedModernSpecifier}`
+    : expectedModernSpecifier;
+};
+
+for (const section of ['dependencies', 'devDependencies']) {
+  for (const packageName of declaredModernPackages) {
+    if (
+      packageJson[section]?.[packageName] &&
+      packageJson[section][packageName] !== expectedModernDependency(packageName)
+    ) {
+      console.error(`${section}.${packageName} must match package source metadata`);
+      process.exit(1);
+    }
+  }
+}
+
+if (
+  packageJson.devDependencies?.['@modern-js/create'] !==
+  expectedModernDependency('@modern-js/create')
+) {
+  console.error('devDependencies.@modern-js/create must match package source metadata');
+  process.exit(1);
+}
+
+for (const dependency of ['@modern-js/plugin-i18n', 'i18next', 'react-i18next']) {
+  if (!packageJson.dependencies?.[dependency]) {
+    console.error(`Missing dependency: ${dependency}`);
+    process.exit(1);
+  }
+}
+
 for (const dependency of [
   '@effect/tsgo',
+  '@modern-js/adapter-rstest',
+  '@modern-js/code-tools',
+  '@modern-js/create',
+  '@rstest/core',
   '@typescript/native-preview',
+  'happy-dom',
+{{#if enableTailwind}}
+  '@tailwindcss/postcss',
+  'postcss',
+  'tailwindcss',
+{{/if}}
   'oxlint',
   'oxfmt',
   'ultracite',
+{{#unless isSubproject}}
+  'lefthook',
+{{/unless}}
 ]) {
   if (!packageJson.devDependencies?.[dependency]) {
     console.error(`Missing devDependency: ${dependency}`);
@@ -152,6 +622,27 @@ for (const dependency of [
   }
 }
 
+{{#if enableTailwind}}
+if (
+  packageJson.devDependencies?.tailwindcss !== '^4.3.0' ||
+  packageJson.devDependencies?.['@tailwindcss/postcss'] !== '^4.3.0'
+) {
+  console.error('Tailwind CSS dependencies must use the UltraModern default baseline');
+  process.exit(1);
+}
+{{/if}}
+{{#unless enableTailwind}}
+if (
+  packageJson.devDependencies?.tailwindcss ||
+  packageJson.devDependencies?.['@tailwindcss/postcss'] ||
+  packageJson.devDependencies?.postcss
+) {
+  console.error('Tailwind CSS dependencies must be absent when Tailwind is disabled');
+  process.exit(1);
+}
+{{/unless}}
+
+{{#unless isSubproject}}
 const privateSource = skillsLock.sources?.find(
   (source) => source.repository === 'https://github.com/TechsioCZ/skills',
 );
@@ -162,5 +653,6 @@ for (const skillName of ['plan-graph', 'dag', 'subagent-graph', 'helm', 'debugge
     process.exit(1);
   }
 }
+{{/unless}}
 
 console.log('Ultramodern contract check passed.');

package/template/src/modern-app-env.d.ts

@@ -1 +1,3 @@
 /// <reference types='@modern-js/app-tools/types' />
+
+declare const ULTRAMODERN_SITE_URL: string;

package/template/src/modern.runtime.ts.handlebars

@@ -1,7 +1,23 @@
 import { defineRuntimeConfig } from '@modern-js/runtime';
+import { createInstance } from 'i18next';
+
+const i18nInstance = createInstance();
 
 export default defineRuntimeConfig({
+  i18n: {
+    i18nInstance,
+    initOptions: {
+      defaultNS: 'translation',
+      fallbackLng: 'en',
+      interpolation: {
+        escapeValue: false,
+      },
+      ns: ['translation'],
+      supportedLngs: ['en', 'cs'],
+    },
+  },
 {{#if isTanstackRouter}}  router: {
     framework: 'tanstack',
-  },{{/if}}
+  },
+{{/if~}}
 });