@bleedingdev/modern-js-create 3.2.0-ultramodern.117 → 3.2.0-ultramodern.119

package/template-workspace/scripts/bootstrap-agent-skills.mjs

@@ -7,6 +7,16 @@ const root = process.cwd();
 const lockPath = path.join(root, '.agents/skills-lock.json');
 const checkOnly = process.argv.includes('--check');
 const force = process.argv.includes('--force');
+const postinstall = process.argv.includes('--postinstall');
+const truthy = value => /^(1|true|yes|on)$/i.test(String(value ?? ''));
+const falsy = value => /^(0|false|no|off)$/i.test(String(value ?? ''));
+const skipRequested =
+  truthy(process.env.ULTRAMODERN_SKIP_AGENT_SKILLS) ||
+  falsy(process.env.ULTRAMODERN_AGENT_SKILLS);
+const cloneTimeoutMs = Number.parseInt(
+  process.env.ULTRAMODERN_AGENT_SKILLS_CLONE_TIMEOUT_MS ?? '60000',
+  10,
+);
 
 const readJson = filePath => JSON.parse(fs.readFileSync(filePath, 'utf-8'));
 
@@ -15,6 +25,7 @@ const run = (command, args, options = {}) =>
     cwd: options.cwd ?? root,
     encoding: 'utf-8',
     stdio: options.stdio ?? ['ignore', 'pipe', 'pipe'],
+    timeout: options.timeout,
   });
 
 const commandExists = command => {
@@ -106,12 +117,14 @@ const removeTree = dir =>
 
 const cloneSource = (source, targetDir) => {
   if (source.commit) {
-    run('git', ['init', targetDir]);
+    run('git', ['init', targetDir], { timeout: 30000 });
     run('git', ['remote', 'add', 'origin', source.repository], {
       cwd: targetDir,
+      timeout: 30000,
     });
     run('git', ['fetch', '--depth', '1', '--quiet', 'origin', source.commit], {
       cwd: targetDir,
+      timeout: cloneTimeoutMs,
     });
     run(
       'git',
@@ -123,32 +136,24 @@ const cloneSource = (source, targetDir) => {
         '--quiet',
         'FETCH_HEAD',
       ],
-      { cwd: targetDir },
+      { cwd: targetDir, timeout: 30000 },
     );
     return;
   }
 
   const repo = source.repository.replace(/^https:\/\/github.com\//u, '');
   try {
-    run('gh', [
-      'repo',
-      'clone',
-      repo,
-      targetDir,
-      '--',
-      '--depth',
-      '1',
-      '--quiet',
-    ]);
+    run(
+      'gh',
+      ['repo', 'clone', repo, targetDir, '--', '--depth', '1', '--quiet'],
+      { timeout: cloneTimeoutMs },
+    );
   } catch {
-    run('git', [
-      'clone',
-      '--depth',
-      '1',
-      '--quiet',
-      source.repository,
-      targetDir,
-    ]);
+    run(
+      'git',
+      ['clone', '--depth', '1', '--quiet', source.repository, targetDir],
+      { timeout: cloneTimeoutMs },
+    );
   }
 };
 
@@ -186,6 +191,17 @@ const requiredSkills = [
     skills.findIndex(candidate => candidate.name === skill.name) === index,
 );
 
+if (skipRequested) {
+  const reason = 'agent skills bootstrap skipped by environment';
+  if (checkOnly) {
+    console.log(reason);
+    process.exit(0);
+  }
+  console.log(reason);
+  installLefthook();
+  process.exit(0);
+}
+
 if (checkOnly) {
   const missingRequired = requiredSkills
     .map(skill => skill.name)
@@ -230,10 +246,8 @@ for (const source of [...requiredCloneSources, ...optionalCloneSources]) {
     try {
       cloneSource(source, tempDir);
     } catch (error) {
-      if (source.install === 'clone-if-authorized') {
-        console.warn(
-          `Skipping ${source.repository}; current developer may not have access.`,
-        );
+      if (source.install === 'clone-if-authorized' || postinstall) {
+        console.warn(`Skipping ${source.repository}; ${error.message}`);
         continue;
       }
       throw error;

package/template/.agents/skills-lock.json

@@ -1,34 +0,0 @@
-{
-  "schemaVersion": 2,
-  "installDir": ".agents/skills",
-  "sources": [
-    {
-      "id": "techsiocz-private",
-      "visibility": "private",
-      "repository": "https://github.com/TechsioCZ/skills",
-      "install": "clone-if-authorized",
-      "baseline": [
-        {
-          "name": "plan-graph",
-          "reason": "Build and validate DAGs from .plan.md files"
-        },
-        {
-          "name": "dag",
-          "reason": "Inspect current plan frontiers and blocked lanes"
-        },
-        {
-          "name": "subagent-graph",
-          "reason": "Design dependency-aware multi-agent launch graphs"
-        },
-        {
-          "name": "helm",
-          "reason": "Steer already-running multi-agent work"
-        },
-        {
-          "name": "debugger-mode",
-          "reason": "Run hypothesis-driven debugging with runtime evidence"
-        }
-      ]
-    }
-  ]
-}

package/template/.browserslistrc

@@ -1,4 +0,0 @@
-chrome >= 87
-edge >= 88
-firefox >= 78
-safari >= 14

package/template/.codex/hooks.json

@@ -1,16 +0,0 @@
-{
-  "Stop": [
-    {
-      "command": "pnpm format && pnpm lint:fix && pnpm ultramodern:check",
-      "timeout": 600000,
-      "statusMessage": "Running UltraModern quality gates"
-    }
-  ],
-  "SubagentStop": [
-    {
-      "command": "pnpm format && pnpm lint:fix && pnpm ultramodern:check",
-      "timeout": 600000,
-      "statusMessage": "Running UltraModern quality gates"
-    }
-  ]
-}

package/template/.github/renovate.json

@@ -1,53 +0,0 @@
-{
-  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": [
-    "config:recommended",
-    "helpers:pinGitHubActionDigests"
-  ],
-  "dependencyDashboard": true,
-  "minimumReleaseAge": "1 day",
-  "prConcurrentLimit": 5,
-  "prHourlyLimit": 2,
-  "rangeStrategy": "bump",
-  "schedule": [
-    "before 5am on monday"
-  ],
-  "timezone": "Etc/UTC",
-  "packageRules": [
-    {
-      "matchManagers": [
-        "github-actions"
-      ],
-      "groupName": "github-actions",
-      "labels": [
-        "dependencies",
-        "github-actions",
-        "security"
-      ]
-    },
-    {
-      "matchManagers": [
-        "npm"
-      ],
-      "matchUpdateTypes": [
-        "patch",
-        "minor"
-      ],
-      "groupName": "npm minor and patch updates",
-      "labels": [
-        "dependencies",
-        "npm"
-      ]
-    },
-    {
-      "matchUpdateTypes": [
-        "major"
-      ],
-      "dependencyDashboardApproval": true,
-      "labels": [
-        "dependencies",
-        "major"
-      ]
-    }
-  ]
-}

package/template/.github/workflows/ultramodern-gates.yml.handlebars

@@ -1,54 +0,0 @@
-name: Ultramodern Gates
-
-on:
-  push:
-  pull_request:
-
-permissions:
-  contents: read
-
-defaults:
-  run:
-    shell: bash
-
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-
-concurrency:
-  group: ultramodern-gates-${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  ultramodern-gates:
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2
-        with:
-          egress-policy: audit
-
-      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          fetch-depth: 1
-          persist-credentials: false
-
-      - name: Setup Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: 24
-
-      - name: Setup mise
-        uses: jdx/mise-action@5ac50f778e26fac95da98d50503682459e86d566 # v3.2.0
-
-      - name: Install Dependencies
-        run: mise exec -- pnpm install --frozen-lockfile
-
-      - name: Validate Ultramodern Contract
-        run: mise exec -- pnpm run ultramodern:check
-
-      - name: Build
-        env:
-          MODERN_PUBLIC_SITE_URL: http://localhost:8080
-        run: mise exec -- pnpm run build

package/template/.gitignore.handlebars

@@ -1,30 +0,0 @@
-.DS_Store
-
-.pnp
-.pnp.js
-.env.local
-.env.*.local
-.history
-*.log*
-
-node_modules/
-.yarn-integrity
-.pnpm-store/
-*.tsbuildinfo
-.changeset/pre.json
-
-dist/
-coverage/
-release/
-output/
-output_resource/
-log/
-
-.vscode/**/*
-!.vscode/settings.json
-!.vscode/extensions.json
-.idea/
-
-**/*/typings/auto-generated
-
-modern.config.local.*

package/template/.mise.toml.handlebars

@@ -1,2 +0,0 @@
-[tools]
-pnpm = "{{pnpmVersion}}"

package/template/.nvmrc

@@ -1,2 +0,0 @@
-lts/jod
-

package/template/AGENTS.md

@@ -1,23 +0,0 @@
-# UltraModern Agent Contract
-
-This project is generated for Codex-first UltraModern.js work.
-
-## Quality Gates
-
-- `pnpm lint` runs Oxlint with the Ultracite preset.
-- `pnpm format` runs oxfmt.
-- `pnpm typecheck` runs effect-tsgo as the TypeScript checker.
-- `pnpm i18n:check` rejects hardcoded user-visible JSX text.
-- `pnpm ultramodern:check` verifies the generated contract.
-- Generated Codex stop hooks and subagent-stop hooks run `pnpm format && pnpm lint:fix && pnpm ultramodern:check`.
-- `postinstall` formats the generated tree, installs private orchestration skills when available, initializes a Git repository when needed, and installs `lefthook`. Generated `lefthook.yml` runs `pnpm format && pnpm lint:fix && pnpm ultramodern:check` on pre-commit; pre-push runs `pnpm ultramodern:check`.
-
-## Internationalization
-
-Runtime i18n is enabled by default. Agents must put user-visible UI copy in `config/public/locales/<lang>/translation.json` and render it through `react-i18next` or `@modern-js/plugin-i18n/runtime`. Do not add hardcoded JSX text, `aria-label`, `title`, `alt`, or `placeholder` strings unless the value is a non-translatable technical token.
-
-Routes are locale-prefixed by default through `localePathRedirect: true`. Keep localized pages under `src/routes/[lang]`, use links for language switching, and preserve canonical plus `hreflang` metadata. Production builds fail unless `MODERN_PUBLIC_SITE_URL` is set, so deployed canonical URLs always use the production origin.
-
-## Private Skills
-
-Private orchestration skills are installed automatically during `pnpm install` when the current developer is authorized for `TechsioCZ/skills`. The installer clones that private repository and copies only the allowlisted skills from `.agents/skills-lock.json`; unauthorized developers get a warning and can continue with the public contract.

package/template/README.md

@@ -1,111 +0,0 @@
-# UltraModern.js 3.0 Starter
-
-This generated app is a simple UltraModern.js starting point. It gives one app
-with localized routes, production URL metadata, optional BFF support, Rstest,
-Oxlint, oxfmt, and a local contract check. You can build a useful product here
-without deleting fake product areas, shell packages, or deployment topology.
-
-## Setup
-
-Install the dependencies:
-
-```bash
-mise install
-pnpm install
-```
-
-## Get Started
-
-Start the dev server:
-
-```bash
-pnpm dev
-```
-
-Build the app for production:
-
-```bash
-MODERN_PUBLIC_SITE_URL=https://example.com pnpm build
-```
-
-Preview the production build locally:
-
-```bash
-pnpm serve
-```
-
-Run the local gates before treating the scaffold as ready:
-
-```bash
-pnpm run ultramodern:check
-MODERN_PUBLIC_SITE_URL=https://example.com pnpm run build
-```
-
-## What You Get
-
-The default app is intentionally monolith-friendly:
-
-| Area | Starting Point |
-| --- | --- |
-| App routes | Locale-prefixed pages under `src/routes/[lang]` |
-| Copy | English and Czech resources in `config/public/locales` |
-| Web defaults | Local favicon/logo assets, localized metadata, semantic starter markup |
-| Styling | App-local CSS, with Tailwind files only when selected |
-| Server logic | Optional BFF entrypoints under `api/` |
-| Tests | Rstest smoke coverage in `tests/` |
-| Agent workflow | Generated `AGENTS.md`, hooks, and local quality gates |
-
-Keep feature code in the app while one team owns the workflow, release train,
-and operational behavior. Add ordinary workspace packages for shared tokens,
-small UI primitives, generated clients, or domain-neutral utilities when that
-keeps the app easier to understand.
-
-## Customize The App
-
-Start with the generated page and replace the placeholder cards with your first
-real routes, actions, and API calls. Put user-visible text in
-`config/public/locales/<lang>/translation.json`, then render it through
-`react-i18next` or `@modern-js/plugin-i18n/runtime`.
-
-The starter keeps favicon and logo assets local in `config/favicon.svg` and
-`config/public/assets/ultramodern-logo.svg`. Replace those files when your app
-has product branding. The localized page title and description live in the same
-translation resources as the visible UI copy.
-
-Tune the preset in `modern.config.ts`. Production builds require
-`MODERN_PUBLIC_SITE_URL` so canonical and `hreflang` URLs use your deployed
-origin. The local fallback is `http://localhost:8080`.
-
-The generated preset defaults are opt-out. Disable specific contracts via env
-vars when your app needs a softer lane:
-
-```bash
-MODERN_BASELINE_ENABLE_MF_SSR=false
-MODERN_BASELINE_ENABLE_BFF_REQUEST_ID=false
-MODERN_BASELINE_ENABLE_TELEMETRY_EXPORTERS=false
-```
-
-## Grow When Needed
-
-Stay in the single app until a boundary has a real owner and operational reason
-to split. A separate package is usually enough when you only need reusable code.
-Consider a larger workspace boundary later when a feature needs independent
-ownership, rollout, rollback, incident routing, or deployment evidence.
-
-The public opinionated entrypoint is `presetUltramodern(...)`. It keeps Effect,
-TanStack, SSR, BFF, i18n, and quality gates available without requiring a
-distributed app layout on day one.
-
-## Generated Automation
-
-The generated starter includes `.github/workflows/ultramodern-gates.yml` and
-`.github/renovate.json` for full app projects. The workflow runs
-`pnpm run ultramodern:check` and `pnpm run build` on every push and pull request
-with read-only permissions, commit-pinned actions, frozen installs, and
-StepSecurity audit-mode runner hardening. Renovate is configured for dependency
-dashboard review, one-day release age, grouped updates, action digest pinning,
-and manual approval for major upgrades.
-
-For more information, see the
-[UltraModern.js guide](https://bleedingdev.github.io/ultramodern.js/guides/get-started/ultramodern.html)
-and the [UltraModern.js documentation](https://bleedingdev.github.io/ultramodern.js/).

package/template/api/effect/index.ts.handlebars

@@ -1,34 +0,0 @@
-{{#if useEffectBff}}import {
-  Effect,
-  HttpApiBuilder,
-  Layer,
-  defineEffectBff,
-} from '@modern-js/plugin-bff/effect-server';
-import type { HttpApi, HttpApiGroup } from '@modern-js/plugin-bff/effect-server';
-import { bffEffectApi } from '../../shared/effect/api.ts';
-
-type ApiGroups<TApi> = TApi extends HttpApi.HttpApi<string, infer TGroups> ? TGroups : never;
-type GreetingsHandlers = HttpApiBuilder.Handlers.FromGroup<
-  HttpApiGroup.WithName<ApiGroups<typeof bffEffectApi>, 'greetings'>
->;
-
-const greetingsLayer = HttpApiBuilder.group(
-  bffEffectApi,
-  'greetings',
-  (handlers: GreetingsHandlers) =>
-    handlers.handle('hello', () =>
-      Effect.succeed({
-        message: 'Hello from Effect HttpApi',
-        runtime: 'effect' as const,
-      }),
-    ),
-);
-
-const layer = HttpApiBuilder.layer(bffEffectApi).pipe(
-  Layer.provide(greetingsLayer),
-);
-
-export default defineEffectBff({
-  api: bffEffectApi,
-  layer,
-});{{/if}}

package/template/api/lambda/hello.ts.handlebars

@@ -1,6 +0,0 @@
-{{#if useHonoBff}}const hello = () => ({
-  message: 'Hello from UltraModern.js BFF ({{bffRuntime}})',
-});
-
-export default hello;
-{{/if}}

package/template/config/favicon.svg

@@ -1,5 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" role="img" aria-label="UltraModern.js">
-  <rect width="64" height="64" rx="12" fill="#111827"/>
-  <path fill="#35d399" d="M14 17h9v21c0 5 3 8 9 8s9-3 9-8V17h9v22c0 11-8 18-18 18s-18-7-18-18V17Z"/>
-  <path fill="#ffffff" d="M28 17h8v25h-8z"/>
-</svg>

package/template/config/public/assets/ultramodern-logo.svg

@@ -1,6 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 160 160" role="img" aria-label="UltraModern.js logo">
-  <rect width="160" height="160" rx="28" fill="#111827"/>
-  <path fill="#35d399" d="M42 36h22v56c0 22 14 34 36 34s36-12 36-34V36h22v57c0 35-24 57-58 57S42 128 42 93V36Z"/>
-  <path fill="#ffffff" d="M76 36h20v74H76z"/>
-  <path fill="#8be8ff" d="M112 36h18v74h-18z"/>
-</svg>

package/template/config/public/locales/cs/translation.json

@@ -1,44 +0,0 @@
-{
-  "home": {
-    "bff": {
-      "response": "Odpoved Effect HttpApi:"
-    },
-    "cards": {
-      "bff": {
-        "body": "Pridej serverovou logiku, kdyz route potrebuje typovana data nebo mutace.",
-        "title": "BFF + Effect"
-      },
-      "config": {
-        "body": "Upravuj vychozi hodnoty v modern.config.ts podle rustu aplikace.",
-        "title": "Konfigurace presetUltramodern"
-      },
-      "gates": {
-        "body": "Pred releasem spust ultramodern:check, testy, typecheck, lint a build.",
-        "title": "Ultramodern kontroly"
-      },
-      "guide": {
-        "body": "Zacni jednou aplikaci a pridej routy, API nebo balicky az kdyz pomuzou.",
-        "title": "UltraModern.js pruvodce"
-      }
-    },
-    "description": {
-      "afterConfig": "podle rustu aplikace a udrzuj",
-      "afterPreset": "profilem. Lad",
-      "end": "zelene pri pridavani rout, API a workspace balicku.",
-      "intro": "Zacni s verejnym"
-    },
-    "language": {
-      "cs": "Cestina",
-      "en": "Anglictina",
-      "switcher": "Jazyk"
-    },
-    "logoAlt": "Logo UltraModern.js",
-    "meta": {
-      "description": "Lokalizovany starter aplikace UltraModern.js se silnymi vychozimi hodnotami pro komplexni produkty.",
-      "title": "UltraModern.js Starter"
-    },
-    "name": "Jednoduchy starter aplikace",
-    "skipLink": "Preskocit na obsah",
-    "title": "UltraModern.js Starter"
-  }
-}

package/template/config/public/locales/en/translation.json

@@ -1,44 +0,0 @@
-{
-  "home": {
-    "bff": {
-      "response": "Effect HttpApi response:"
-    },
-    "cards": {
-      "bff": {
-        "body": "Add server logic when a route needs typed data or mutation handling.",
-        "title": "BFF + Effect"
-      },
-      "config": {
-        "body": "Tune generated defaults in modern.config.ts as the app grows.",
-        "title": "Configure presetUltramodern"
-      },
-      "gates": {
-        "body": "Run ultramodern:check, tests, typecheck, lint, and build before release.",
-        "title": "Ultramodern Gates"
-      },
-      "guide": {
-        "body": "Start with one app, then add routes, APIs, and packages when they help.",
-        "title": "UltraModern.js Guide"
-      }
-    },
-    "description": {
-      "afterConfig": "as the app grows, and keep",
-      "afterPreset": "profile. Tune",
-      "end": "green while you add routes, APIs, and workspace packages.",
-      "intro": "Start from the public"
-    },
-    "language": {
-      "cs": "Czech",
-      "en": "English",
-      "switcher": "Language"
-    },
-    "logoAlt": "UltraModern.js Logo",
-    "meta": {
-      "description": "A localized UltraModern.js app starter with strong defaults for complex products.",
-      "title": "UltraModern.js Starter"
-    },
-    "name": "Simple app starter",
-    "skipLink": "Skip to content",
-    "title": "UltraModern.js Starter"
-  }
-}

package/template/lefthook.yml

@@ -1,10 +0,0 @@
-pre-commit:
-  commands:
-    fix-and-check:
-      run: pnpm format && pnpm lint:fix && pnpm ultramodern:check
-      stage_fixed: true
-
-pre-push:
-  commands:
-    check:
-      run: pnpm ultramodern:check