@bleedingdev/modern-js-create 3.2.0-ultramodern.120 → 3.2.0-ultramodern.122

package/dist/types/ultramodern-workspace/package-json.d.ts

@@ -0,0 +1,12 @@
+import type { JsonValue, ResolvedPackageSource, WorkspaceApp } from './types';
+export declare const effectTsgoTypecheckCommand = "node -e \"const fs = require('node:fs'); const { execFileSync, spawnSync } = require('node:child_process'); const bin = execFileSync('effect-tsgo', ['get-exe-path'], { encoding: 'utf8' }).trim(); if (process.platform !== 'win32') fs.chmodSync(bin, 0o755); const result = spawnSync(bin, ['--noEmit', '-p', 'tsconfig.json'], { stdio: 'inherit' }); process.exit(result.status ?? 1);\"";
+export declare const effectDiagnostics: string[];
+export declare function appDependencies(scope: string, packageSource: ResolvedPackageSource, app: WorkspaceApp, remotes?: WorkspaceApp[]): Record<string, string>;
+export declare function appDevDependencies(packageSource: ResolvedPackageSource, enableTailwind: boolean): Record<string, string>;
+export declare function createRootPackageJson(scope: string, packageSource: ResolvedPackageSource, remotes?: WorkspaceApp[]): JsonValue;
+export declare function createZephyrDependencies(scope: string, app: WorkspaceApp, remotes?: WorkspaceApp[]): JsonValue;
+export declare function createTsConfigBase(): JsonValue;
+export declare function createPackageTsConfig(packageDir: string, includeApi?: boolean): JsonValue;
+export declare function createAppPackage(scope: string, app: WorkspaceApp, packageSource: ResolvedPackageSource, enableTailwind: boolean, remotes?: WorkspaceApp[]): JsonValue;
+export declare function createSharedPackage(scope: string, id: string, description: string): JsonValue;
+export declare function createSharedContractsIndex(): string;

package/dist/types/ultramodern-workspace/package-source.d.ts

@@ -0,0 +1,2 @@
+import type { ResolvedPackageSource, UltramodernWorkspaceOptions } from './types';
+export declare function resolvePackageSource(options: UltramodernWorkspaceOptions): ResolvedPackageSource;

package/dist/types/ultramodern-workspace/policy.d.ts

@@ -0,0 +1,60 @@
+import type { JsonValue, WorkspaceApp } from './types';
+export declare function createCloudflareProofRoute(app: WorkspaceApp): JsonValue;
+export declare function createCloudflareSecurityContract(): JsonValue;
+export declare const PUBLIC_WEBSITE_POLICY: {
+    qualityGates: {
+        publicRoutes: {
+            requireSitemapWhenPresent: boolean;
+            requireRobotsSitemapConsistency: boolean;
+            requireWebManifestWhenPresent: boolean;
+        };
+        statusCodes: {
+            notFoundRoute: string;
+            unknownRouteStatus: number;
+        };
+        indexing: {
+            previewNoindex: boolean;
+            productionPublicRoutesIndexable: boolean;
+        };
+        assets: {
+            cssPreloadRequired: boolean;
+            cssResponseRequired: boolean;
+            cacheControlRequiredForCss: boolean;
+            sourcemapsPubliclyReferenced: boolean;
+        };
+        budgets: {
+            ssrHtmlMaxBytes: number;
+            mfManifestMaxBytes: number;
+            localeJsonMaxBytes: number;
+            sitemapXmlMaxBytes: number;
+            cssAssetMaxBytes: number;
+        };
+        csp: {
+            finalMode: string;
+            decision: string;
+        };
+    };
+    publicHead: {
+        indexableRobots: string;
+        privateRouteRobots: string;
+    };
+    publicSurface: {
+        defaultProviderFile: string;
+        draftPolicy: string;
+        indexablePolicy: string;
+    };
+};
+export declare function formatTsJsonValue(value: JsonValue, indent: number): string;
+export declare function formatIntegerCodeLiteral(value: number): string;
+export declare function createPublicWebsiteQualityGateContract(): JsonValue;
+export declare function createPublicWebsiteBudgetFallback(budgetName: keyof (typeof PUBLIC_WEBSITE_POLICY)['qualityGates']['budgets']): string;
+export declare function createPublicHeadRobotsPolicy(): {
+    indexableRobots: string;
+    privateRouteRobots: string;
+};
+export declare function createPublicSurfaceContentExpansionPolicy(): {
+    defaultProviderFile: string;
+    draftPolicy: string;
+    indexablePolicy: string;
+};
+export declare function createCloudflareDeployContract(scope: string, app: WorkspaceApp): JsonValue;

package/dist/types/ultramodern-workspace/public-surface.d.ts

@@ -0,0 +1,37 @@
+import type { JsonValue, PublicRouteMetadata, PublicSurfaceSitemapFields, SupportedWorkspaceLanguage, WorkspaceApp } from './types';
+export declare const publicSurfaceManagedSourceAssetPaths: readonly ['config/public/robots.txt', 'config/public/sitemap.xml', 'config/public/site.webmanifest'];
+export declare const publicSurfaceBaseOutputFiles: readonly ['robots.txt'];
+export declare const publicSurfacePublicRouteOutputFiles: readonly ['sitemap.xml', 'site.webmanifest'];
+export type PublicSurfaceRouteEntry = PublicRouteMetadata & {
+    canonicalUrlPath: string;
+    localeUrlPaths: Record<SupportedWorkspaceLanguage, string>;
+} & PublicSurfaceSitemapFields;
+export declare function createLocalisedPublicPath(pathname: string, language: SupportedWorkspaceLanguage): string;
+export declare function uniqueSorted(values: string[]): string[];
+export declare function createPublicSurfaceRouteEntries(app: WorkspaceApp): PublicSurfaceRouteEntry[];
+export declare function createPublicSurfaceUrlPaths(app: WorkspaceApp): string[];
+export declare function createPublicSurfaceOutputFiles(app: WorkspaceApp): string[];
+export type PublicSurfaceGenerationTarget = 'dist' | 'cloudflare';
+export declare function createPublicSurfaceGenerationCommand(app: WorkspaceApp, target: PublicSurfaceGenerationTarget, requirePublicOrigin?: boolean): string;
+/**
+ * Tombstone sweep: generated apps never ship hand-authored source assets under
+ * config/public, so reruns over an existing workspace remove any that crept
+ * in. The same path list feeds the generated validate script's assertions.
+ */
+export declare function rewriteWorkspaceAssetsForApp(workspaceRoot: string, app: WorkspaceApp): void;
+export declare function createPublicSurfaceContract(app: WorkspaceApp): JsonValue;
+export declare function createPublicHeadContract(): JsonValue;
+export type PublicWebGeneratedFile = {
+    path: string;
+    content: string;
+};
+export type PublicWebAppArtifacts = {
+    jsonLdHelperFile: PublicWebGeneratedFile;
+    routeMetadataFile: PublicWebGeneratedFile;
+    routeHeadFile: PublicWebGeneratedFile;
+    routeMetaFiles: PublicWebGeneratedFile[];
+    routeAliasFiles: PublicWebGeneratedFile[];
+    publicHead: JsonValue;
+    publicSurface: JsonValue;
+};
+export declare function createPublicWebAppArtifacts(app: WorkspaceApp): PublicWebAppArtifacts;

package/dist/types/ultramodern-workspace/routes.d.ts

@@ -0,0 +1,25 @@
+import type { JsonValue, PublicRouteMetadata, RouteOwnedI18nPath, WorkspaceApp } from './types';
+export declare const privateAppRoutePublicness: {
+    readonly indexable: false;
+    readonly public: false;
+    readonly publicSurface: 'private-app-screen';
+};
+export declare function createRouteOwnedI18nPaths(app: WorkspaceApp): RouteOwnedI18nPath[];
+export declare function isPublicIndexableRoute(route: RouteOwnedI18nPath): boolean;
+export declare function createLocalisedUrlsMapFromRoutes(routes: RouteOwnedI18nPath[]): Record<string, JsonValue>;
+export declare function createLocalisedUrlsMap(app: WorkspaceApp): Record<string, JsonValue>;
+export declare function createPublicRouteMetadataFromRoutes(routes: RouteOwnedI18nPath[]): PublicRouteMetadata[];
+export declare function createPublicRouteMetadata(app: WorkspaceApp): PublicRouteMetadata[];
+export declare function createJsonLdHelperModule(): string;
+export declare function createRouteMetadataModule(app: WorkspaceApp): string;
+export declare function createRouteMetaModule(route: RouteOwnedI18nPath): string;
+export declare function normalisePublicPath(pathname: string): string;
+export declare function splitPublicPathSegments(pathname: string): string[];
+export declare function routePathParamName(segment: string): string | undefined;
+export declare function isDynamicPublicPathSegment(segment: string): boolean;
+export declare function isConcretePublicPath(pathname: string): boolean;
+export declare function routeSegmentToDirectory(segment: string): string;
+export declare function routePathDirectorySegments(routePath: string): string[];
+export declare function createRoutePageFilePath(app: WorkspaceApp, canonicalPath: string): string;
+export declare function createRouteMetaFilePath(app: WorkspaceApp, canonicalPath: string): string;
+export declare function createRouteAliasPage(canonicalPath: string): string;

package/dist/types/ultramodern-workspace/types.d.ts

@@ -0,0 +1,95 @@
+import type { ResolvedUltramodernPackageSource, UltramodernPackageSourceStrategy } from '../ultramodern-package-source';
+export type JsonValue = string | number | boolean | null | JsonValue[] | {
+    [key: string]: JsonValue;
+};
+export type JsonObject = {
+    [key: string]: JsonValue;
+};
+export type RouteJsonLd = JsonObject | JsonObject[];
+export declare function sortJsonValue(value: JsonValue): JsonValue;
+export type WorkspaceApp = {
+    id: string;
+    directory: string;
+    packageSuffix: string;
+    displayName: string;
+    kind: 'shell' | 'vertical';
+    domain?: string;
+    portEnv: string;
+    port: number;
+    mfName: string;
+    exposes?: Record<string, string>;
+    effectApi?: WorkspaceEffectApi;
+    verticalRefs?: string[];
+    ownership: Ownership;
+};
+export type WorkspaceEffectApi = {
+    stem: string;
+    prefix: string;
+    consumedBy: string[];
+};
+export type ResolvedPackageSource = ResolvedUltramodernPackageSource;
+export type Ownership = {
+    team: string;
+    slack: string;
+    pagerDuty: string;
+    runbookRef: string;
+    adrRef: string;
+    blastRadius: {
+        tier: string;
+        references: string[];
+    };
+};
+export declare const supportedWorkspaceLanguages: readonly ['en', 'cs'];
+export type SupportedWorkspaceLanguage = (typeof supportedWorkspaceLanguages)[number];
+export type RoutePublicSurface = 'private-app-screen' | 'generated-public-surface' | 'explicit-public-input';
+export type RouteOwnedI18nPath = {
+    id: string;
+    canonicalPath: string;
+    localisedPaths: Record<SupportedWorkspaceLanguage, string>;
+    titleKey: string;
+    descriptionKey: string;
+    ownerAppId: string;
+    mfBoundaryId: string;
+    namespace: string;
+    public: boolean;
+    indexable: boolean;
+    publicSurface: RoutePublicSurface;
+    jsonLd?: RouteJsonLd;
+};
+export type PublicRouteMetadata = {
+    canonicalPath: string;
+    id: string;
+    localisedPaths: Record<SupportedWorkspaceLanguage, string>;
+    namespace: string;
+    ownerAppId: string;
+    titleKey: string;
+    descriptionKey: string;
+    jsonLd?: RouteJsonLd;
+};
+export type PublicSitemapChangeFrequency = 'always' | 'hourly' | 'daily' | 'weekly' | 'monthly' | 'yearly' | 'never';
+export type PublicSurfaceSitemapFields = {
+    lastModified?: string;
+    changeFrequency?: PublicSitemapChangeFrequency;
+    priority?: number;
+};
+export type UltramodernWorkspaceOptions = {
+    targetDir: string;
+    packageName: string;
+    modernVersion: string;
+    enableTailwind?: boolean;
+    packageSource?: {
+        strategy?: UltramodernPackageSourceStrategy;
+        modernPackageVersion?: string;
+        registry?: string;
+        aliasScope?: string;
+        aliasPackageNamePrefix?: string;
+    };
+};
+export type AddUltramodernVerticalOptions = {
+    workspaceRoot: string;
+    name: string;
+    modernVersion: string;
+    enableTailwind?: boolean;
+    packageSource?: UltramodernWorkspaceOptions['packageSource'];
+};
+export declare function isRecord(value: unknown): value is Record<string, JsonValue>;

package/dist/types/ultramodern-workspace/versions.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Every version pin and skill-repo commit hash baked into generated
+ * UltraModern workspaces lives here. Values must stay in lockstep with the
+ * checked-in templates under templates/ and template-workspace/.
+ */
+export declare const TANSTACK_ROUTER_VERSION = "1.170.15";
+export declare const MODULE_FEDERATION_VERSION = "2.5.1";
+export declare const ZEPHYR_RSPACK_PLUGIN_VERSION = "1.1.1";
+export declare const ZEPHYR_AGENT_VERSION = "1.1.1";
+export declare const WRANGLER_VERSION = "4.99.0";
+export declare const CLOUDFLARE_COMPATIBILITY_DATE = "2026-06-02";
+export declare const TAILWIND_VERSION = "4.3.0";
+export declare const TAILWIND_POSTCSS_VERSION = "4.3.0";
+export declare const POSTCSS_VERSION = "8.5.15";
+export declare const EFFECT_TSGO_VERSION = "0.14.3";
+export declare const TYPESCRIPT_VERSION = "6.0.3";
+export declare const TYPESCRIPT_NATIVE_PREVIEW_VERSION = "7.0.0-dev.20260610.1";
+export declare const OXLINT_VERSION = "1.69.0";
+export declare const OXFMT_VERSION = "0.54.0";
+export declare const ULTRACITE_VERSION = "7.8.3";
+export declare const LEFTHOOK_VERSION = "^2.1.9";
+export declare const I18NEXT_VERSION = "26.3.1";
+export declare const NODE_FETCH_VERSION = "^3.3.2";
+export declare const REACT_VERSION = "^19.2.7";
+export declare const REACT_DOM_VERSION = "^19.2.7";
+export declare const REACT_ROUTER_DOM_VERSION = "7.17.0";
+export declare const TYPES_REACT_VERSION = "^19.2.17";
+export declare const TYPES_REACT_DOM_VERSION = "^19.2.3";
+export declare const NODE_VERSION = "26.3.0";
+export declare const PNPM_VERSION = "11.5.3";
+export declare const RSTACK_AGENT_SKILLS_COMMIT = "61c948b42512e223bad44b83af4080eba48b2677";
+export declare const MODULE_FEDERATION_AGENT_SKILLS_COMMIT = "07bb5b6c43ad457609e00c081b72d4c42508ec76";
+export declare const ultramodernWorkspaceVersions: {
+    tanstackRouter: string;
+    moduleFederation: string;
+    tailwind: string;
+    tailwindPostcss: string;
+};

package/dist/types/ultramodern-workspace/workspace-scripts.d.ts

@@ -0,0 +1,10 @@
+import type { WorkspaceApp } from './types';
+export declare function createAssertMfTypesScript(remotes?: WorkspaceApp[]): string;
+export declare function createWorkspaceValidationScript(scope: string, enableTailwind: boolean, remotes?: WorkspaceApp[]): string;
+export declare function createWorkspaceI18nBoundaryValidationScript(): string;
+export declare function createPublicSurfaceAssetsScript(): string;
+export declare function createCloudflareProofHelperScript(): string;
+export declare function createCloudflareVersionProofScript(): string;
+export declare function createPerformanceReadinessConfigScript(): string;
+export declare function createPerformanceReadinessScript(): string;
+export declare function writeGeneratedWorkspaceScripts(targetDir: string, scope: string, enableTailwind: boolean, remotes?: WorkspaceApp[]): void;

package/dist/types/ultramodern-workspace/write-workspace.d.ts

@@ -0,0 +1,4 @@
+import type { ResolvedPackageSource, UltramodernWorkspaceOptions, WorkspaceApp } from './types';
+export declare function writeApp(targetDir: string, scope: string, app: WorkspaceApp, packageSource: ResolvedPackageSource, enableTailwind: boolean, remotes?: WorkspaceApp[]): void;
+export declare function writeSharedPackages(targetDir: string, scope: string): void;
+export declare function generateUltramodernWorkspace(options: UltramodernWorkspaceOptions): void;

package/package.json

@@ -21,7 +21,7 @@
   "engines": {
     "node": ">=20"
   },
-  "version": "3.2.0-ultramodern.120",
+  "version": "3.2.0-ultramodern.122",
   "types": "./dist/types/index.d.ts",
   "main": "./dist/esm-node/index.js",
   "bin": {
@@ -47,11 +47,12 @@
   },
   "files": [
     "template-workspace",
+    "templates",
     "dist",
     "bin"
   ],
   "dependencies": {
-    "@modern-js/i18n-utils": "npm:@bleedingdev/modern-js-i18n-utils@3.2.0-ultramodern.120"
+    "@modern-js/i18n-utils": "npm:@bleedingdev/modern-js-i18n-utils@3.2.0-ultramodern.122"
   },
   "devDependencies": {
     "@rslib/core": "0.22.0",
@@ -72,6 +73,6 @@
     "test": "rm -rf dist && rslib build -c rslibconfig.mts && rstest --passWithNoTests"
   },
   "ultramodern": {
-    "frameworkVersion": "3.2.0-ultramodern.120"
+    "frameworkVersion": "3.2.0-ultramodern.122"
   }
 }

package/template-workspace/.github/workflows/ultramodern-workspace-gates.yml.handlebars

@@ -11,9 +11,6 @@ defaults:
   run:
     shell: bash
 
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-
 concurrency:
   group: ultramodern-workspace-gates-${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -56,7 +53,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: 24
+          node-version: "{{nodeVersion}}"
 
       - name: Setup mise
         uses: jdx/mise-action@5ac50f778e26fac95da98d50503682459e86d566 # v3.2.0

package/template-workspace/.mise.toml.handlebars

@@ -1,2 +1,3 @@
 [tools]
+node = "{{nodeVersion}}"
 pnpm = "{{pnpmVersion}}"

package/template-workspace/{AGENTS.md → AGENTS.md.handlebars}

@@ -6,6 +6,10 @@ instructions, not optional reading.
 
 ## Quality Gates
 
+Generated workspaces target Node `>=26` and pnpm `{{pnpmVersion}}`. Keep
+`packageManager`, `.mise.toml`, generated validation, and CI aligned to that
+baseline; do not reintroduce Corepack or older pnpm aliases.
+
 - `pnpm lint` runs Oxlint with the Ultracite preset.
 - `pnpm format` runs oxfmt.
 - `pnpm typecheck` runs effect-tsgo as the TypeScript checker.
@@ -15,7 +19,7 @@ instructions, not optional reading.
 - `pnpm check` is a local convenience aggregate for the primitive gates.
 - Generated CI runs primitive gates as separate matrix jobs instead of calling `pnpm check`.
 - Generated Codex stop hooks and subagent-stop hooks run `pnpm format && pnpm lint:fix && pnpm check`.
-- `postinstall` formats the generated tree, initializes Git when needed, prepares agent skills and reference repos, then installs `lefthook`. Generated `lefthook.yml` runs separate format and lint-fix commands on pre-commit; pre-push runs read-only primitive gates in parallel.
+- `postinstall` formats the generated tree and installs `lefthook`. It never clones repositories or installs system packages; agent skill repos and reference repos are explicit opt-in steps (`pnpm skills:install`, `pnpm agents:refs:install`). Generated `lefthook.yml` runs separate format and lint-fix commands on pre-commit; pre-push runs read-only primitive gates in parallel.
 
 ## Localized Routes
 
@@ -25,9 +29,10 @@ starts shell-only; `create <domain> --vertical` adds route-owned metadata,
 localized resources, and Effect BFF surfaces for that domain. Runtime i18n is
 not enabled in the starter because the current React 19 + Module Federation
 streaming SSR stack must render predictably first. Canonical and hreflang URLs
-use `MODERN_PUBLIC_SITE_URL` (falling back to per-app `ULTRAMODERN_PUBLIC_URL_<APP_ID>`),
-while asset URLs prefer the per-app `ULTRAMODERN_PUBLIC_URL_<APP_ID>`. Without
-any configured public URL, builds emit origin-relative asset paths so pages work
+use `MODERN_PUBLIC_SITE_URL` only. JS/CSS/static assets use
+`MODERN_ASSET_PREFIX`, then `ULTRAMODERN_ASSET_PREFIX`, then `/`; do not use
+`MODERN_PUBLIC_SITE_URL` or stale public URL aliases as asset-prefix fallbacks.
+Without an asset prefix, builds emit origin-relative asset paths so pages work
 behind tunnels and reverse proxies.
 
 ## Required Skill Baseline
@@ -43,7 +48,7 @@ Use these skills when the task touches the matching subsystem:
 - `rstest-best-practices`: Rstest configuration, test writing, mocking, snapshots, coverage, and CI test behavior.
 - `mf`: Module Federation docs, Modern.js integration, DTS/type checks, shared dependency checks, runtime errors, and observability troubleshooting.
 
-The public `module-federation/agent-skills` repository is installed during `pnpm install` and `pnpm skills:install`. Postinstall mode skips unavailable clone sources instead of blocking dependency installation; `pnpm skills:install` remains strict for required public skills. Use `ULTRAMODERN_SKIP_AGENT_SKILLS=1` when an install must avoid external skill repositories completely. `pnpm skills:check` fails when the required public `mf` skill is missing unless that skip flag is set.
+The public `module-federation/agent-skills` repository is installed only when you explicitly run `pnpm skills:install` (or set `ULTRAMODERN_AGENT_SKILLS=1` before `pnpm install`). Postinstall never clones repositories. `pnpm skills:install` remains strict for required public skills. `pnpm skills:check` fails when a vendored skill is missing and warns when clone-installed skills such as `mf` have not been fetched yet.
 
 ## Private Skills
 
@@ -57,12 +62,12 @@ The installer copies only the pinned private skills from `.agents/skills-lock.js
 
 ## Agent Reference Repositories
 
-The workspace installs read-only source references under `repos/` by default during `pnpm install` using `git subtree add --squash`. These repositories are reference material for coding agents, not application source:
+The workspace can install read-only source references under `repos/` with the explicit `pnpm agents:refs:install` command using `git subtree add --squash`. These repositories are reference material for coding agents, not application source:
 
 - `repos/effect` from `Effect-TS/effect`.
 - `repos/ultramodern.js` from `BleedingDev/ultramodern.js`.
 
-Agents may read files under `repos/` to understand upstream patterns, APIs, and project conventions. Do not edit files under `repos/`, import from them, or make production code depend on them. To skip this setup, run installs with `ULTRAMODERN_SKIP_AGENT_REPOS=1`.
+Agents may read files under `repos/` to understand upstream patterns, APIs, and project conventions. Do not edit files under `repos/`, import from them, or make production code depend on them. `ULTRAMODERN_SKIP_AGENT_REPOS=1` disables the installer even when invoked explicitly.
 
 ## Project Priorities
 

package/template-workspace/README.md.handlebars

@@ -7,8 +7,8 @@ UltraModern.js 3.0 SuperApp surface and starts with an explicit shell:
 
 - `apps/shell-super-app` owns shell route assembly, Module Federation host
   wiring, shared SSR/i18n runtime setup, and the boundary debugger.
-- `packages/shared-*` provide placeholders for cross-workspace contracts,
-  design tokens, and Effect API sharing.
+- `packages/shared-*` provide placeholders for cross-workspace contracts and
+  design tokens.
 - `verticals/*` is intentionally empty until a real business domain is added.
 
 Add a full-stack MicroVertical when the product needs one:
@@ -34,6 +34,13 @@ unless route metadata explicitly marks them `public && indexable`. The default
 scaffold therefore emits only a disallowing `robots.txt`; sitemap, web
 manifest, `llms.txt`, API catalog, security.txt, and JSON-LD output stay
 omitted until a safe public route or public docs/help/product surface exists.
+Structured data is never inferred automatically. Add `jsonLd` explicitly in
+route metadata for `public && indexable` routes and use
+`src/routes/ultramodern-jsonld.ts` when the route fits the generated `WebPage`,
+`WebApplication`, `SoftwareApplication`, `BreadcrumbList`, `FAQPage`, or
+`Organization` helpers. Private or non-indexable routes emit no JSON-LD even
+when they have localized paths, titles, descriptions, BFF APIs, or Module
+Federation boundaries.
 
 Public web artifacts are build/deploy outputs generated into `dist/public` and
 `.output/public`, not hand-authored source files under `config/public`. Dynamic
@@ -53,21 +60,24 @@ pnpm check
 pnpm build
 ```
 
+The generated toolchain baseline is Node `>=26` with pnpm `{{pnpmVersion}}`.
+`packageManager`, `.mise.toml`, generated validation, and CI should all agree
+on that baseline; do not reintroduce Corepack or older pnpm aliases.
+
 Generated CI does not call the local aggregate. It runs format, lint,
 typecheck, skills, i18n boundary validation, contract validation, and build as
 separate matrix jobs so failures are isolated and parallelizable.
 
-By default, `pnpm install` also prepares read-only agent reference repositories
-under `repos/` for Effect and UltraModern.js source lookup using squashed git
-subtrees. Disable this setup with
-`ULTRAMODERN_SKIP_AGENT_REPOS=1 pnpm install`, or rerun it
-explicitly with `pnpm agents:refs:install`.
+Read-only agent reference repositories under `repos/` (Effect and
+UltraModern.js source lookup using squashed git subtrees) are an explicit
+opt-in step: run `pnpm agents:refs:install` when you want them. `pnpm install`
+never clones repositories.
 
-Agent skills are prepared during `pnpm install` as a developer convenience.
-External skill repository failures do not block postinstall; strict installation
-is available with `pnpm skills:install`. Use
-`ULTRAMODERN_SKIP_AGENT_SKILLS=1` for a dependency install that avoids external
-skill repositories completely.
+Vendored agent skills ship with the scaffold. Clone-installed skills (such as
+the Module Federation `mf` skill) are fetched only when you explicitly run
+`pnpm skills:install`, or when `ULTRAMODERN_AGENT_SKILLS=1` is set during
+`pnpm install`. `pnpm skills:check` warns about missing clone-installed skills
+without failing the gate.
 
 The topology and ownership metadata are generated under `topology/`. The
 workspace also ships `.github/workflows/ultramodern-workspace-gates.yml` and
@@ -85,25 +95,31 @@ packages still use `workspace:*` because they are part of this workspace.
 
 ## Public URL Environment Variables
 
-This workspace's apps no longer bake absolute `http://localhost:<port>` URLs
-into asset configuration. Two environment variables now have distinct roles in
-controlling where assets are served from and where SEO output links point.
+This workspace's apps must not bake absolute `http://localhost:<port>` URLs
+into asset configuration. Public URL and asset prefix environment variables
+have distinct roles, and stale aliases should not be carried forward when
+regenerating or updating the workspace.
 
 | Variable | Role | Feeds |
 | --- | --- | --- |
-| `ULTRAMODERN_PUBLIC_URL_<APP_ID>` | Per-app deployment and asset origin | `output.assetPrefix`, Module Federation remote URLs |
-| `MODERN_PUBLIC_SITE_URL` | Site-wide public origin for SEO output | Canonical, hreflang, sitemap `<loc>`, robots `Sitemap:` |
-
-Asset URLs use this precedence: `ULTRAMODERN_PUBLIC_URL_<APP_ID>` →
-`MODERN_PUBLIC_SITE_URL` → inferred workers.dev URL → origin-relative `/`.
-SEO and site origin prefer: `MODERN_PUBLIC_SITE_URL` →
-`ULTRAMODERN_PUBLIC_URL_<APP_ID>` → inferred workers.dev → `http://localhost:<port>`.
+| `MODERN_PUBLIC_SITE_URL` | Canonical site origin for public SEO output only | Canonical, hreflang, sitemap `<loc>`, robots `Sitemap:` |
+| `MODERN_ASSET_PREFIX` | Preferred JS/CSS/static asset prefix | Modern/Rspack-emitted asset URLs |
+| `ULTRAMODERN_ASSET_PREFIX` | UltraModern compatibility asset prefix | Modern/Rspack-emitted asset URLs when `MODERN_ASSET_PREFIX` is unset |
+| `ULTRAMODERN_PUBLIC_URL_<APP_ID>` | Per-app deployment/proof URL | Cloudflare proof inputs and Module Federation remote URLs |
+
+Asset URLs use this precedence: `MODERN_ASSET_PREFIX` →
+`ULTRAMODERN_ASSET_PREFIX` → origin-relative `/`. `MODERN_PUBLIC_SITE_URL` is
+canonical/SEO-only and must not be used as an asset-prefix fallback.
+SEO output uses `MODERN_PUBLIC_SITE_URL`; if it is unset, generated local and
+preview outputs remain non-public until deployment proof provides explicit
+public URLs.
 
 Without public URLs configured, asset paths are origin-relative (`/`), and the
 dev server uses `dev.assetPrefix: '/'` — so apps work through tunnels and
 reverse proxies (ngrok, cloudflared) without triggering Chrome's Local Network
-Access prompt or mixed-content errors. Shell-only workspaces can set just
-`MODERN_PUBLIC_SITE_URL` for SEO output.
+Access prompt or mixed-content errors. Shell-only workspaces can set
+`MODERN_PUBLIC_SITE_URL` for SEO output without changing where assets load
+from.
 
 ## Cloudflare Proof
 

package/template-workspace/{pnpm-workspace.yaml → pnpm-workspace.yaml.handlebars}

@@ -27,8 +27,8 @@ peerDependencyRules:
     typescript: '>=6.0.0'
 
 overrides:
-  '@tanstack/react-router': 1.170.15
-  node-fetch: '^3.3.2'
+  '@tanstack/react-router': {{tanstackRouterVersion}}
+  node-fetch: '{{nodeFetchVersion}}'
 
 allowBuilds:
   '@swc/core': true