@bleedingdev/modern-js-create 3.2.0-ultramodern.119 → 3.2.0-ultramodern.120

package/package.json

@@ -21,7 +21,7 @@
   "engines": {
     "node": ">=20"
   },
-  "version": "3.2.0-ultramodern.119",
+  "version": "3.2.0-ultramodern.120",
   "types": "./dist/types/index.d.ts",
   "main": "./dist/esm-node/index.js",
   "bin": {
@@ -51,13 +51,13 @@
     "bin"
   ],
   "dependencies": {
-    "@modern-js/i18n-utils": "npm:@bleedingdev/modern-js-i18n-utils@3.2.0-ultramodern.119"
+    "@modern-js/i18n-utils": "npm:@bleedingdev/modern-js-i18n-utils@3.2.0-ultramodern.120"
   },
   "devDependencies": {
-    "@rslib/core": "0.21.5",
-    "@types/node": "^25.9.1",
-    "@typescript/native-preview": "7.0.0-dev.20260606.1",
-    "tsx": "^4.22.3",
+    "@rslib/core": "0.22.0",
+    "@types/node": "^25.9.3",
+    "@typescript/native-preview": "7.0.0-dev.20260610.1",
+    "tsx": "^4.22.4",
     "@scripts/rstest-config": "2.66.0"
   },
   "publishConfig": {
@@ -72,6 +72,6 @@
     "test": "rm -rf dist && rslib build -c rslibconfig.mts && rstest --passWithNoTests"
   },
   "ultramodern": {
-    "frameworkVersion": "3.2.0-ultramodern.119"
+    "frameworkVersion": "3.2.0-ultramodern.120"
   }
 }

package/template-workspace/AGENTS.md

@@ -24,9 +24,11 @@ static language links, and canonical plus `hreflang` metadata. A new workspace
 starts shell-only; `create <domain> --vertical` adds route-owned metadata,
 localized resources, and Effect BFF surfaces for that domain. Runtime i18n is
 not enabled in the starter because the current React 19 + Module Federation
-streaming SSR stack must render predictably first. Production builds fail unless
-`MODERN_PUBLIC_SITE_URL` is set per deployed app, so canonical URLs always use
-the production origin.
+streaming SSR stack must render predictably first. Canonical and hreflang URLs
+use `MODERN_PUBLIC_SITE_URL` (falling back to per-app `ULTRAMODERN_PUBLIC_URL_<APP_ID>`),
+while asset URLs prefer the per-app `ULTRAMODERN_PUBLIC_URL_<APP_ID>`. Without
+any configured public URL, builds emit origin-relative asset paths so pages work
+behind tunnels and reverse proxies.
 
 ## Required Skill Baseline
 

package/template-workspace/README.md.handlebars

@@ -25,12 +25,23 @@ handlers and Effect client/contract modules stay out of browser exposes.
 
 ## Private-First Public Surfaces
 
-Generated app routes are private and non-indexable by default. Private app,
-auth, tenant, dashboard, and internal routes publish no discovery output unless
-route metadata explicitly marks them `public && indexable`. The default scaffold
-therefore emits only a disallowing `robots.txt`; sitemap, web manifest,
-`llms.txt`, API catalog, security.txt, and JSON-LD output stay omitted until a
-safe public route or public docs/help/product surface exists.
+Generated app routes are private and non-indexable by default. Author route
+metadata in colocated `src/routes/**/route.meta.ts` files; the scaffold
+regenerates `src/routes/ultramodern-route-metadata.ts` as a compatibility
+manifest for config, i18n, public head, and public surface contracts. Private
+app, auth, tenant, dashboard, and internal routes publish no discovery output
+unless route metadata explicitly marks them `public && indexable`. The default
+scaffold therefore emits only a disallowing `robots.txt`; sitemap, web
+manifest, `llms.txt`, API catalog, security.txt, and JSON-LD output stay
+omitted until a safe public route or public docs/help/product surface exists.
+
+Public web artifacts are build/deploy outputs generated into `dist/public` and
+`.output/public`, not hand-authored source files under `config/public`. Dynamic
+public routes can expand sitemap entries through route-owned, Node-safe
+`route.sitemap.mjs` providers beside route metadata. The public-surface
+generator discovers those providers for dynamic public routes and still honors
+explicit `routes.publicSurface.contentSources` entries in the generated
+compatibility manifest.
 
 Run the scaffold validator before adding business code and after every
 `--vertical` mutation:
@@ -72,12 +83,37 @@ development. To create a workspace that can install those packages outside the
 monorepo, generate with `--ultramodern-package-source install`; generated shared
 packages still use `workspace:*` because they are part of this workspace.
 
+## Public URL Environment Variables
+
+This workspace's apps no longer bake absolute `http://localhost:<port>` URLs
+into asset configuration. Two environment variables now have distinct roles in
+controlling where assets are served from and where SEO output links point.
+
+| Variable | Role | Feeds |
+| --- | --- | --- |
+| `ULTRAMODERN_PUBLIC_URL_<APP_ID>` | Per-app deployment and asset origin | `output.assetPrefix`, Module Federation remote URLs |
+| `MODERN_PUBLIC_SITE_URL` | Site-wide public origin for SEO output | Canonical, hreflang, sitemap `<loc>`, robots `Sitemap:` |
+
+Asset URLs use this precedence: `ULTRAMODERN_PUBLIC_URL_<APP_ID>` →
+`MODERN_PUBLIC_SITE_URL` → inferred workers.dev URL → origin-relative `/`.
+SEO and site origin prefer: `MODERN_PUBLIC_SITE_URL` →
+`ULTRAMODERN_PUBLIC_URL_<APP_ID>` → inferred workers.dev → `http://localhost:<port>`.
+
+Without public URLs configured, asset paths are origin-relative (`/`), and the
+dev server uses `dev.assetPrefix: '/'` — so apps work through tunnels and
+reverse proxies (ngrok, cloudflared) without triggering Chrome's Local Network
+Access prompt or mixed-content errors. Shell-only workspaces can set just
+`MODERN_PUBLIC_SITE_URL` for SEO output.
+
 ## Cloudflare Proof
 
 Deploy the generated apps, then pass each deployed app's generated public URL
-env key into the proof step. A shell-only workspace only needs the shell URL;
-added verticals use the same `ULTRAMODERN_PUBLIC_URL_<APP_ID>` pattern with
-hyphens converted to underscores and uppercased.
+env key into the proof step. The proof script reads the generated contract and
+checks the live Worker surface, including public-route sitemap/robots
+consistency, preview noindex behavior, unknown-route status, asset headers,
+byte budgets, and public sourcemap exposure. A shell-only workspace only needs
+the shell URL; added verticals use the same `ULTRAMODERN_PUBLIC_URL_<APP_ID>`
+pattern with hyphens converted to underscores and uppercased.
 
 ```bash
 pnpm cloudflare:deploy