@bleedingdev/modern-js-create 3.2.0-ultramodern.2 → 3.2.0-ultramodern.21

package/template/scripts/bootstrap-agent-skills.mjs

@@ -0,0 +1,95 @@
+import { execFileSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+const root = process.cwd();
+const lockPath = path.join(root, '.agents/skills-lock.json');
+const checkOnly = process.argv.includes('--check');
+const force = process.argv.includes('--force');
+
+const readJson = (filePath) => JSON.parse(fs.readFileSync(filePath, 'utf-8'));
+
+const run = (command, args, options = {}) =>
+  execFileSync(command, args, {
+    cwd: options.cwd ?? root,
+    encoding: 'utf-8',
+    stdio: options.stdio ?? ['ignore', 'pipe', 'pipe'],
+  });
+
+const cloneSource = (source, targetDir) => {
+  const repo = source.repository.replace(/^https:\/\/github.com\//u, '');
+  try {
+    run('gh', ['repo', 'clone', repo, targetDir, '--', '--depth', '1'], {
+      stdio: 'inherit',
+    });
+  } catch {
+    run('git', ['clone', '--depth', '1', source.repository, targetDir], {
+      stdio: 'inherit',
+    });
+  }
+};
+
+const resolveSkillDir = (sourceRoot, skillName) => {
+  const candidates = [
+    path.join(sourceRoot, skillName),
+    path.join(sourceRoot, 'skills', skillName),
+    path.join(sourceRoot, 'skills', 'engineering', skillName),
+    path.join(sourceRoot, 'skills', 'productivity', skillName),
+  ];
+  return candidates.find((candidate) => fs.existsSync(path.join(candidate, 'SKILL.md')));
+};
+
+if (!fs.existsSync(lockPath)) {
+  console.error('Missing .agents/skills-lock.json');
+  process.exit(1);
+}
+
+const lock = readJson(lockPath);
+const installDir = path.join(root, lock.installDir ?? '.agents/skills');
+const privateSources = (lock.sources ?? []).filter(
+  (source) => source.install === 'clone-if-authorized',
+);
+
+if (checkOnly) {
+  const missing = privateSources.flatMap((source) =>
+    (source.baseline ?? [])
+      .map((skill) => skill.name)
+      .filter((skillName) => !fs.existsSync(path.join(installDir, skillName, 'SKILL.md'))),
+  );
+  if (missing.length > 0) {
+    console.warn(
+      `Private skills not installed: ${missing.join(', ')}. Run pnpm skills:install if you have access.`,
+    );
+  } else {
+    console.log('Agent skills are installed.');
+  }
+  process.exit(0);
+}
+
+fs.mkdirSync(installDir, { recursive: true });
+
+for (const source of privateSources) {
+  const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'ultramodern-skills-'));
+  try {
+    cloneSource(source, tempDir);
+    for (const skill of source.baseline ?? []) {
+      const sourceSkillDir = resolveSkillDir(tempDir, skill.name);
+      if (!sourceSkillDir) {
+        throw new Error(`Skill ${skill.name} not found in ${source.repository}`);
+      }
+      const targetSkillDir = path.join(installDir, skill.name);
+      if (fs.existsSync(targetSkillDir)) {
+        if (!force) {
+          console.log(`Skipping existing ${skill.name}`);
+          continue;
+        }
+        fs.rmSync(targetSkillDir, { force: true, recursive: true });
+      }
+      fs.cpSync(sourceSkillDir, targetSkillDir, { recursive: true });
+      console.log(`Installed ${skill.name}`);
+    }
+  } finally {
+    fs.rmSync(tempDir, { force: true, recursive: true });
+  }
+}

package/template/scripts/check-i18n-strings.mjs

@@ -0,0 +1,83 @@
+import fs from 'node:fs';
+import path from 'node:path';
+
+const root = process.cwd();
+const scanRoots = ['src'].map((scanRoot) => path.join(root, scanRoot));
+const ignoredDirectories = new Set(['.modern', '.modernjs', 'dist', 'node_modules']);
+const visibleAttributePattern =
+  /\s(?:aria-label|alt|placeholder|title)=["']([^"']*[A-Za-z][^"']*)["']/gu;
+const jsxTextPattern = />([^<>{}]*[A-Za-z][^<>{}]*)</gu;
+
+const collectFiles = (directory) => {
+  if (!fs.existsSync(directory)) {
+    return [];
+  }
+
+  const files = [];
+  for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+    if (entry.isDirectory()) {
+      if (!ignoredDirectories.has(entry.name)) {
+        files.push(...collectFiles(path.join(directory, entry.name)));
+      }
+      continue;
+    }
+
+    if (entry.isFile() && /\.(jsx|tsx)$/u.test(entry.name) && !entry.name.endsWith('.d.ts')) {
+      files.push(path.join(directory, entry.name));
+    }
+  }
+  return files;
+};
+
+const lineNumberForIndex = (content, index) => content.slice(0, index).split('\n').length;
+const isIgnoredLine = (content, index) => {
+  const lineStart = content.lastIndexOf('\n', index) + 1;
+  const lineEnd = content.indexOf('\n', index);
+  const currentLineEnd = lineEnd === -1 ? content.length : lineEnd;
+  const previousLineStart = content.lastIndexOf('\n', Math.max(0, lineStart - 2)) + 1;
+  const nextLineEnd = content.indexOf('\n', currentLineEnd + 1);
+  const context = content.slice(
+    previousLineStart,
+    nextLineEnd === -1 ? content.length : nextLineEnd,
+  );
+  return /i18n-ignore/u.test(context);
+};
+
+const violations = [];
+for (const filePath of scanRoots.flatMap(collectFiles)) {
+  const content = fs.readFileSync(filePath, 'utf-8');
+  for (const match of content.matchAll(visibleAttributePattern)) {
+    if (!isIgnoredLine(content, match.index ?? 0)) {
+      violations.push({
+        filePath,
+        line: lineNumberForIndex(content, match.index ?? 0),
+        text: match[1].trim(),
+      });
+    }
+  }
+
+  for (const match of content.matchAll(jsxTextPattern)) {
+    const text = match[1].replaceAll(/\s+/gu, ' ').trim();
+    if (text && !isIgnoredLine(content, match.index ?? 0)) {
+      violations.push({
+        filePath,
+        line: lineNumberForIndex(content, match.index ?? 0),
+        text,
+      });
+    }
+  }
+}
+
+if (violations.length > 0) {
+  console.error('Hardcoded user-visible JSX strings found. Move copy to locale JSON files.');
+  for (const violation of violations) {
+    console.error(
+      `${path.relative(root, violation.filePath)}:${violation.line} ${JSON.stringify(
+        violation.text,
+      )}`,
+    );
+  }
+  process.exit(1);
+}
+
+console.log('No hardcoded user-visible JSX strings found.');

package/template/scripts/validate-ultramodern.mjs.handlebars

@@ -2,30 +2,35 @@ import fs from 'node:fs';
 import path from 'node:path';
 
 const configPath = path.resolve(process.cwd(), 'modern.config.ts');
-const templateManifestPath = path.resolve(
+const templateManifestPath = path.resolve(process.cwd(), '.modernjs/mv-template-manifest.json');
+const packageSourcePath = path.resolve(
   process.cwd(),
-  '.modernjs/mv-template-manifest.json',
+  '.modernjs/ultramodern-package-source.json',
 );
+const isSubproject = {{isSubproject}};
 
 if (!fs.existsSync(configPath)) {
   console.error('modern.config.ts not found');
   process.exit(1);
 }
 
-const content = fs.readFileSync(configPath, 'utf8');
+const content = fs.readFileSync(configPath, 'utf-8');
 const requiredTokens = [
   'presetUltramodern(',
   'appTools()',
   'enableModuleFederationSSR',
   'enableBffRequestId',
   'enableTelemetryExporters',
+  'i18nPlugin(',
+  'localePathRedirect: true',
+  'ULTRAMODERN_SITE_URL',
+  'MODERN_PUBLIC_SITE_URL must be set for production builds',
+  'globalVars',
 ];
-const missing = requiredTokens.filter(token => !content.includes(token));
+const missing = requiredTokens.filter((token) => !content.includes(token));
 
 if (missing.length > 0) {
-  console.error(
-    `Ultramodern contract check failed. Missing tokens: ${missing.join(', ')}`,
-  );
+  console.error(`Ultramodern contract check failed. Missing tokens: ${missing.join(', ')}`);
   process.exit(1);
 }
 
@@ -34,12 +39,9 @@ if (!fs.existsSync(templateManifestPath)) {
   process.exit(1);
 }
 
-const templateManifest = JSON.parse(
-  fs.readFileSync(templateManifestPath, 'utf8'),
-);
+const templateManifest = JSON.parse(fs.readFileSync(templateManifestPath, 'utf-8'));
 const requiredDeniedPaths = [
   '.git/**',
-  '.github/**',
   '.npmrc',
   '.yarnrc',
   '.env',
@@ -50,10 +52,120 @@ const requiredDeniedPaths = [
 const requiredPostMaterialization = [
   'ultramodern-contract-check',
   'dependency-install-with-lifecycle-deny',
+  'github-workflow-security-enforced',
+  'package-source-retained',
+  'pnpm-11-policy-enforced',
+  'rstest-smoke-tests',
   'template-manifest-retained',
 ];
+const requiredPaths = [
+{{#unless isSubproject}}
+  'AGENTS.md',
+  '.agents/skills-lock.json',
+  '.github/renovate.json',
+  '.github/workflows/ultramodern-gates.yml',
+  'oxlint.config.ts',
+  'oxfmt.config.ts',
+  'scripts/bootstrap-agent-skills.mjs',
+{{/unless}}
+  '.modernjs/ultramodern-package-source.json',
+  'pnpm-workspace.yaml',
+  'rstest.config.mts',
+  'scripts/check-i18n-strings.mjs',
+  'config/public/locales/en/translation.json',
+  'config/public/locales/cs/translation.json',
+  'src/modern-app-env.d.ts',
+  'src/routes/[lang]/page.tsx',
+  'tests/ultramodern.contract.test.ts',
+];
 const manifestErrors = [];
 
+for (const requiredPath of requiredPaths) {
+  if (!fs.existsSync(path.resolve(process.cwd(), requiredPath))) {
+    console.error(`${requiredPath} not found`);
+    process.exit(1);
+  }
+}
+
+if (fs.existsSync(path.resolve(process.cwd(), 'src/routes/page.tsx'))) {
+  console.error('src/routes/page.tsx must move under src/routes/[lang]/page.tsx');
+  process.exit(1);
+}
+
+{{#unless isSubproject}}
+const workflowContent = fs.readFileSync(
+  path.resolve(process.cwd(), '.github/workflows/ultramodern-gates.yml'),
+  'utf-8',
+);
+const renovateConfig = JSON.parse(
+  fs.readFileSync(path.resolve(process.cwd(), '.github/renovate.json'), 'utf-8'),
+);
+for (const requiredSnippet of [
+  'permissions:\n  contents: read',
+  'pull_request:',
+  'persist-credentials: false',
+  'pnpm install --frozen-lockfile',
+  'MODERN_PUBLIC_SITE_URL: http://localhost:8080',
+  'timeout-minutes:',
+  'egress-policy: audit',
+]) {
+  if (!workflowContent.includes(requiredSnippet)) {
+    console.error(`Generated workflow must retain ${requiredSnippet.split('\n')[0]}`);
+    process.exit(1);
+  }
+}
+if (workflowContent.includes('pull_request_target')) {
+  console.error('Generated workflow must not use pull_request_target');
+  process.exit(1);
+}
+for (const match of workflowContent.matchAll(/^\s*uses:\s*([^@\s]+)@([^\s#]+)/gmu)) {
+  const [, actionName, actionRef] = match;
+  if (!/^[a-f0-9]{40}$/u.test(actionRef)) {
+    console.error(`Generated workflow must pin ${actionName}@${actionRef} to a commit SHA`);
+    process.exit(1);
+  }
+}
+if (
+  renovateConfig.dependencyDashboard !== true ||
+  renovateConfig.minimumReleaseAge !== '1 day' ||
+  !renovateConfig.extends?.includes('helpers:pinGitHubActionDigests') ||
+  !renovateConfig.packageRules?.some(
+    (rule) =>
+      rule.dependencyDashboardApproval === true && rule.matchUpdateTypes?.includes('major'),
+  )
+) {
+  console.error('Generated Renovate config must retain dashboard, release-age, action pinning, and major-approval policy');
+  process.exit(1);
+}
+{{/unless}}
+
+const pageContent = fs.readFileSync(
+  path.resolve(process.cwd(), 'src/routes/[lang]/page.tsx'),
+  'utf-8',
+);
+for (const token of [
+  'rel="canonical"',
+  'rel="alternate"',
+  'hrefLang="x-default"',
+  'localizedPath(',
+  '<a',
+{{#if isTanstackRouter}}
+  "@modern-js/plugin-tanstack/runtime",
+{{/if}}
+]) {
+  if (!pageContent.includes(token)) {
+    console.error(`Localized route is missing ${token}`);
+    process.exit(1);
+  }
+}
+{{#if isTanstackRouter}}
+const deprecatedTanstackRuntime = '@modern-js/runtime/' + 'tanstack-router';
+if (pageContent.includes(deprecatedTanstackRuntime)) {
+  console.error('Localized route must import TanStack runtime from @modern-js/plugin-tanstack/runtime');
+  process.exit(1);
+}
+{{/if}}
+
 if (templateManifest.schemaVersion !== 1) {
   manifestErrors.push('schemaVersion');
 }
@@ -65,10 +177,10 @@ if (templateManifest.source?.type !== 'builtin') {
 if (
   !Array.isArray(templateManifest.integrity?.checksums) ||
   !templateManifest.integrity.checksums.some(
-    checksum =>
+    (checksum) =>
       checksum.algorithm === 'sha256' &&
       checksum.scope === 'source-tree' &&
-      /^[0-9a-f]{64}$/.test(checksum.value),
+      /^[0-9a-f]{64}$/u.test(checksum.value),
   )
 ) {
   manifestErrors.push('integrity.checksums[source-tree]');
@@ -92,11 +204,233 @@ for (const token of requiredPostMaterialization) {
 
 if (manifestErrors.length > 0) {
   console.error(
-    `Ultramodern template manifest check failed. Invalid fields: ${manifestErrors.join(
-      ', ',
-    )}`,
+    `Ultramodern template manifest check failed. Invalid fields: ${manifestErrors.join(', ')}`,
   );
   process.exit(1);
 }
 
+const packageJson = JSON.parse(
+  fs.readFileSync(path.resolve(process.cwd(), 'package.json'), 'utf-8'),
+);
+const pnpmWorkspace = fs.readFileSync(
+  path.resolve(process.cwd(), 'pnpm-workspace.yaml'),
+  'utf-8',
+);
+const packageSource = JSON.parse(fs.readFileSync(packageSourcePath, 'utf-8'));
+const unresolvedTemplateMarker = String.fromCodePoint(123, 123);
+if (JSON.stringify(packageJson).includes(unresolvedTemplateMarker)) {
+  console.error('package.json contains unresolved template markers');
+  process.exit(1);
+}
+if (JSON.stringify(packageSource).includes(unresolvedTemplateMarker)) {
+  console.error('package source metadata contains unresolved template markers');
+  process.exit(1);
+}
+{{#unless isSubproject}}
+const skillsLock = JSON.parse(
+  fs.readFileSync(path.resolve(process.cwd(), '.agents/skills-lock.json'), 'utf-8'),
+);
+{{/unless}}
+const requiredScripts = {
+  'i18n:check': 'node ./scripts/check-i18n-strings.mjs',
+  test: 'rstest run',
+{{#unless isSubproject}}
+  format: 'oxfmt .',
+  'format:check': 'oxfmt --check .',
+  lint: 'oxlint .',
+  'lint:fix': 'oxlint . --fix',
+  'skills:check': 'node ./scripts/bootstrap-agent-skills.mjs --check',
+  'skills:install': 'node ./scripts/bootstrap-agent-skills.mjs',
+{{/unless}}
+};
+
+for (const [scriptName, scriptCommand] of Object.entries(requiredScripts)) {
+  if (packageJson.scripts?.[scriptName] !== scriptCommand) {
+    console.error(`Missing or invalid package script: ${scriptName}`);
+    process.exit(1);
+  }
+}
+
+if (
+  !packageJson.scripts?.typecheck?.includes('effect-tsgo') ||
+  !packageJson.scripts.typecheck.includes('get-exe-path')
+) {
+  console.error('typecheck must use effect-tsgo as the TypeScript checker');
+  process.exit(1);
+}
+
+if (!packageJson.scripts?.['ultramodern:check']?.includes('pnpm test')) {
+  console.error('ultramodern:check must run the generated Rstest suite');
+  process.exit(1);
+}
+
+if (packageJson.private !== true) {
+  console.error('Generated app package must be private by default');
+  process.exit(1);
+}
+
+if (packageJson.packageManager !== 'pnpm@11.1.2') {
+  console.error('Generated app package must pin pnpm@11.1.2');
+  process.exit(1);
+}
+
+if (packageJson.engines?.pnpm !== '>=11.0.0') {
+  console.error('Generated app package must require pnpm >=11.0.0');
+  process.exit(1);
+}
+
+if (packageJson.pnpm !== undefined) {
+  console.error('Generated app must keep pnpm policy in pnpm-workspace.yaml, not package.json');
+  process.exit(1);
+}
+
+for (const requiredSnippet of [
+  'minimumReleaseAge: 1440',
+  'minimumReleaseAgeStrict: true',
+  'minimumReleaseAgeIgnoreMissingTime: false',
+  "minimumReleaseAgeExclude:\n  - '@modern-js/*'\n  - '@bleedingdev/*'\n  - '@effect/tsgo'\n  - '@effect/tsgo-*'\n  - '@typescript/native-preview'\n  - '@typescript/native-preview-*'",
+  'trustPolicy: no-downgrade',
+  'trustPolicyIgnoreAfter: 1440',
+  'blockExoticSubdeps: true',
+  'engineStrict: true',
+  'pmOnFail: error',
+  'verifyDepsBeforeRun: error',
+  'strictDepBuilds: true',
+  "allowBuilds:\n  '@swc/core': true\n  core-js: true\n  esbuild: true\n  msgpackr-extract: true\n  simple-git-hooks: true",
+]) {
+  if (!pnpmWorkspace.includes(requiredSnippet)) {
+    console.error(`pnpm-workspace.yaml must retain ${requiredSnippet.split('\n')[0]}`);
+    process.exit(1);
+  }
+}
+
+if (pnpmWorkspace.includes('onlyBuiltDependencies')) {
+  console.error('pnpm-workspace.yaml must use pnpm 11 allowBuilds instead of onlyBuiltDependencies');
+  process.exit(1);
+}
+
+if (packageJson.modernjs?.preset !== 'presetUltramodern') {
+  console.error('package.json must declare presetUltramodern metadata');
+  process.exit(1);
+}
+
+if (
+  packageJson.modernjs?.packageSource?.config !== './.modernjs/ultramodern-package-source.json'
+) {
+  console.error('package.json must retain package source metadata location');
+  process.exit(1);
+}
+
+if (packageSource.schemaVersion !== 1) {
+  console.error('Package source metadata must use schemaVersion 1');
+  process.exit(1);
+}
+
+if (packageSource.preset !== 'presetUltramodern') {
+  console.error('Package source metadata must declare presetUltramodern');
+  process.exit(1);
+}
+
+if (packageSource.strategy !== 'workspace' && packageSource.strategy !== 'install') {
+  console.error('Package source strategy must be workspace or install');
+  process.exit(1);
+}
+
+const expectedModernPackages = [
+  '@modern-js/runtime',
+  '@modern-js/app-tools',
+  '@modern-js/tsconfig',
+  '@modern-js/plugin-i18n',
+  '@modern-js/plugin-tanstack',
+  '@modern-js/plugin-bff',
+  '@modern-js/adapter-rstest',
+];
+
+for (const packageName of expectedModernPackages) {
+  if (!packageSource.modernPackages?.packages?.includes(packageName)) {
+    console.error(`Package source metadata must include ${packageName}`);
+    process.exit(1);
+  }
+}
+
+const expectedModernSpecifier = packageSource.modernPackages?.specifier;
+if (typeof expectedModernSpecifier !== 'string' || expectedModernSpecifier.length === 0) {
+  console.error('Package source metadata must provide a Modern package specifier');
+  process.exit(1);
+}
+
+const expectedModernDependency = (packageName) => {
+  const alias = packageSource.modernPackages?.aliases?.[packageName];
+  return typeof alias === 'string'
+    ? `npm:${alias}@${expectedModernSpecifier}`
+    : expectedModernSpecifier;
+};
+
+for (const packageName of [
+  '@modern-js/runtime',
+  '@modern-js/plugin-i18n',
+  '@modern-js/plugin-tanstack',
+]) {
+  if (
+    packageJson.dependencies?.[packageName] &&
+    packageJson.dependencies[packageName] !== expectedModernDependency(packageName)
+  ) {
+    console.error(`Dependency ${packageName} must match package source metadata`);
+    process.exit(1);
+  }
+}
+
+for (const packageName of [
+  '@modern-js/app-tools',
+  '@modern-js/adapter-rstest',
+  '@modern-js/tsconfig',
+  '@modern-js/plugin-bff',
+]) {
+  if (
+    packageJson.devDependencies?.[packageName] &&
+    packageJson.devDependencies[packageName] !== expectedModernDependency(packageName)
+  ) {
+    console.error(`Dev dependency ${packageName} must match package source metadata`);
+    process.exit(1);
+  }
+}
+
+for (const dependency of ['@modern-js/plugin-i18n', 'i18next', 'react-i18next']) {
+  if (!packageJson.dependencies?.[dependency]) {
+    console.error(`Missing dependency: ${dependency}`);
+    process.exit(1);
+  }
+}
+
+for (const dependency of [
+  '@effect/tsgo',
+  '@modern-js/adapter-rstest',
+  '@rstest/core',
+  '@typescript/native-preview',
+  'happy-dom',
+{{#unless isSubproject}}
+  'oxlint',
+  'oxfmt',
+  'ultracite',
+{{/unless}}
+]) {
+  if (!packageJson.devDependencies?.[dependency]) {
+    console.error(`Missing devDependency: ${dependency}`);
+    process.exit(1);
+  }
+}
+
+{{#unless isSubproject}}
+const privateSource = skillsLock.sources?.find(
+  (source) => source.repository === 'https://github.com/TechsioCZ/skills',
+);
+const privateSkills = new Set(privateSource?.baseline?.map((skill) => skill.name));
+for (const skillName of ['plan-graph', 'dag', 'subagent-graph', 'helm', 'debugger-mode']) {
+  if (!privateSkills.has(skillName)) {
+    console.error(`Missing private skill allowlist entry: ${skillName}`);
+    process.exit(1);
+  }
+}
+{{/unless}}
+
 console.log('Ultramodern contract check passed.');

package/template/shared/effect/api.ts.handlebars

@@ -14,5 +14,4 @@ export const bffEffectApi = HttpApi.make('BffApi').add(
       }),
     }),
   ),
-);
-{{/if}}
+);{{/if}}

package/template/src/modern-app-env.d.ts

@@ -1 +1,3 @@
 /// <reference types='@modern-js/app-tools/types' />
+
+declare const ULTRAMODERN_SITE_URL: string;

package/template/src/modern.runtime.ts.handlebars

@@ -1,9 +1,23 @@
 import { defineRuntimeConfig } from '@modern-js/runtime';
+import { createInstance } from 'i18next';
+
+const i18nInstance = createInstance();
 
 export default defineRuntimeConfig({
-{{#if isTanstackRouter}}
-  router: {
+  i18n: {
+    i18nInstance,
+    initOptions: {
+      defaultNS: 'translation',
+      fallbackLng: 'en',
+      interpolation: {
+        escapeValue: false,
+      },
+      ns: ['translation'],
+      supportedLngs: ['en', 'cs'],
+    },
+  },
+{{#if isTanstackRouter}}  router: {
     framework: 'tanstack',
   },
-{{/if}}
+{{/if~}}
 });