@bleedingdev/modern-js-create 3.2.0-ultramodern.119 → 3.2.0-ultramodern.120

package/README.md

@@ -89,14 +89,28 @@ Cloudflare Worker output. The shell consumes vertical UI through Module
 Federation manifests and vertical APIs through generated Effect clients
 exported by the vertical packages.
 
-Route metadata is route-owned. Each app writes
-`src/routes/ultramodern-route-metadata` and passes
-`ultramodernLocalisedUrls` into `@modern-js/plugin-i18n`. Locale JSON is served
-from `/locales/{{lng}}/{{ns}}.json`; Czech and English routes are generated
-from the route owner, not from shell rewrites. Routes default to
-`privateByDefault: true` and `publicnessDefault: private-app-screen`; generated
-public files use only explicit `public && indexable` route metadata, so private
-app screens publish only a disallowing `robots.txt` by default.
+Route metadata is route-owned and colocated in
+`src/routes/**/route.meta.ts`. The scaffold regenerates
+`src/routes/ultramodern-route-metadata.ts` as a compatibility manifest for
+Modern.js config, i18n, public head, and public surface contracts; authors
+should not hand-maintain it. Locale JSON is served from
+`/locales/{{lng}}/{{ns}}.json`; Czech and English routes are generated from the
+route owner, not from shell rewrites.
+
+Routes default to `privateByDefault: true` and
+`publicnessDefault: private-app-screen`. Public web artifacts are build/deploy
+outputs generated by `scripts/generate-public-surface-assets.mjs` into
+`dist/public` and `.output/public`, not source files under `config/public`.
+Generated public files use only explicit `public && indexable` route metadata,
+so private app screens publish only a disallowing `robots.txt` by default.
+
+Dynamic public routes can expand sitemap entries through route-owned,
+Node-safe ESM providers, normally `route.sitemap.mjs` beside the route
+metadata. The public-surface generator discovers those providers for dynamic
+public routes and still honors explicit `routes.publicSurface.contentSources`
+entries in the generated compatibility manifest. Providers may export
+`entries`, `entries()`, or a default entries/loader returning sitemap entries;
+draft entries and `indexable: false` entries are omitted.
 
 CSS federation is explicit:
 
@@ -109,6 +123,28 @@ CSS federation is explicit:
 - Duplicate base styles are forbidden; SSR first paint depends on shared token
   CSS plus Modern/Rspack-emitted app CSS.
 
+## Public URL Environment Variables
+
+Generated apps no longer bake absolute `http://localhost:<port>` URLs into
+asset configuration. Two environment variables now have distinct roles in
+controlling where assets are served from and where SEO output links point.
+
+| Variable | Role | Feeds |
+| --- | --- | --- |
+| `ULTRAMODERN_PUBLIC_URL_<APP_ID>` | Per-app deployment and asset origin | `output.assetPrefix`, Module Federation remote URLs |
+| `MODERN_PUBLIC_SITE_URL` | Site-wide public origin for SEO output | Canonical, hreflang, sitemap `<loc>`, robots `Sitemap:` |
+
+Asset URLs use this precedence: `ULTRAMODERN_PUBLIC_URL_<APP_ID>` →
+`MODERN_PUBLIC_SITE_URL` → inferred workers.dev URL → origin-relative `/`.
+SEO and site origin prefer: `MODERN_PUBLIC_SITE_URL` →
+`ULTRAMODERN_PUBLIC_URL_<APP_ID>` → inferred workers.dev → `http://localhost:<port>`.
+
+Without public URLs configured, asset paths are origin-relative (`/`), and the
+dev server uses `dev.assetPrefix: '/'` — so apps work through tunnels and
+reverse proxies (ngrok, cloudflared) without triggering Chrome's Local Network
+Access prompt or mixed-content errors. Shell-only workspaces can set just
+`MODERN_PUBLIC_SITE_URL` for SEO output.
+
 ## Cloudflare And Zephyr Proof
 
 Each generated workspace app has:
@@ -120,9 +156,12 @@ Each generated workspace app has:
 - `zephyr-rspack-plugin` wired through the generated Modern.js Rspack bridge.
 
 Deploy first, then pass each deployed app's generated public URL env key into
-the proof step. Shell-only workspaces only need the shell URL; added verticals
-use the same `ULTRAMODERN_PUBLIC_URL_<APP_ID>` pattern with hyphens converted
-to underscores and uppercased:
+the proof step. The proof script reads the generated contract and checks the
+Cloudflare Worker surface, including public-route sitemap/robots consistency,
+preview noindex behavior, unknown-route status, asset headers, byte budgets,
+and public sourcemap exposure. Shell-only workspaces only need the shell URL;
+added verticals use the same `ULTRAMODERN_PUBLIC_URL_<APP_ID>` pattern with
+hyphens converted to underscores and uppercased:
 
 ```bash
 pnpm cloudflare:deploy