@bleedingdev/modern-js-create 3.2.0-ultramodern.20 → 3.2.0-ultramodern.22

package/template-workspace/scripts/validate-ultramodern-workspace.mjs.handlebars

@@ -1,10 +1,15 @@
+import { execFileSync } from 'node:child_process';
 import fs from 'node:fs';
 import path from 'node:path';
 
 const root = process.cwd();
 const packageScope = '{{packageScope}}';
-const tanstackVersion = '1.170.1';
+const tanstackVersion = '1.170.8';
+const tailwindEnabled = '{{tailwindEnabled}}' === 'true';
+const tailwindVersion = '^4.3.0';
+const tailwindPostcssVersion = '^4.3.0';
 const rstackAgentSkillsCommit = '61c948b42512e223bad44b83af4080eba48b2677';
+const moduleFederationAgentSkillsCommit = '07bb5b6c43ad457609e00c081b72d4c42508ec76';
 const modernPackages = [
   '@modern-js/app-tools',
   '@modern-js/plugin-bff',
@@ -21,10 +26,47 @@ const baselineAgentSkills = [
   'rslib-modern-package',
   'rstest-best-practices',
 ];
+const moduleFederationAgentSkills = ['mf'];
 const privateAgentSkills = ['plan-graph', 'dag', 'subagent-graph', 'helm', 'debugger-mode'];
+const fullStackVerticals = [
+  {
+    id: 'remote-commerce',
+    domain: 'commerce',
+    stem: 'recommendations',
+    group: 'recommendations',
+    path: 'apps/remotes/remote-commerce',
+    mfName: 'remoteCommerce',
+    apiPrefix: '/commerce-api',
+  },
+  {
+    id: 'remote-identity',
+    domain: 'identity',
+    stem: 'identity',
+    group: 'identity',
+    path: 'apps/remotes/remote-identity',
+    mfName: 'remoteIdentity',
+    apiPrefix: '/identity-api',
+  },
+];
+const designSystemRemotePath = 'apps/remotes/remote-design-system';
 
 const readText = (relativePath) => fs.readFileSync(path.join(root, relativePath), 'utf-8');
 const readJson = (relativePath) => JSON.parse(readText(relativePath));
+const readPnpmConfig = (key) => {
+  const env = { ...process.env };
+  for (const envKey of Object.keys(env)) {
+    if (/^(?:npm|pnpm)_config_/i.test(envKey)) {
+      delete env[envKey];
+    }
+  }
+  const output = execFileSync('pnpm', ['config', 'get', key, '--json'], {
+    cwd: root,
+    env,
+    encoding: 'utf-8',
+    stdio: ['ignore', 'pipe', 'pipe'],
+  }).trim();
+  return output ? JSON.parse(output) : undefined;
+};
 const assert = (condition, message) => {
   if (!condition) {
     throw new Error(message);
@@ -33,6 +75,9 @@ const assert = (condition, message) => {
 const assertExists = (relativePath) => {
   assert(fs.existsSync(path.join(root, relativePath)), `Missing ${relativePath}`);
 };
+const assertNotExists = (relativePath) => {
+  assert(!fs.existsSync(path.join(root, relativePath)), `Unexpected ${relativePath}`);
+};
 
 const requiredPaths = [
   'AGENTS.md',
@@ -62,54 +107,76 @@ const requiredPaths = [
   'topology/local-overlays/development.json',
   '.modernjs/ultramodern-workspace-template-manifest.json',
   '.modernjs/ultramodern-package-source.json',
+  '.modernjs/ultramodern-generated-contract.json',
+  'scripts/assert-mf-types.mjs',
   'scripts/bootstrap-agent-skills.mjs',
   'scripts/setup-agent-reference-repos.mjs',
-  'scripts/check-i18n-strings.mjs',
   'apps/shell-super-app/package.json',
-  'apps/shell-super-app/config/public/locales/en/translation.json',
-  'apps/shell-super-app/config/public/locales/cs/translation.json',
   'apps/shell-super-app/modern.config.ts',
   'apps/shell-super-app/module-federation.config.ts',
   'apps/shell-super-app/src/modern-app-env.d.ts',
   'apps/shell-super-app/src/modern.runtime.ts',
+  'apps/shell-super-app/locales/en/translation.json',
+  'apps/shell-super-app/locales/cs/translation.json',
+  'apps/shell-super-app/src/routes/index.css',
   'apps/shell-super-app/src/routes/[lang]/page.tsx',
   'apps/remotes/remote-commerce/package.json',
-  'apps/remotes/remote-commerce/config/public/locales/en/translation.json',
-  'apps/remotes/remote-commerce/config/public/locales/cs/translation.json',
   'apps/remotes/remote-commerce/modern.config.ts',
   'apps/remotes/remote-commerce/module-federation.config.ts',
+  'apps/remotes/remote-commerce/api/effect/index.ts',
+  'apps/remotes/remote-commerce/shared/effect/api.ts',
+  'apps/remotes/remote-commerce/src/effect/recommendations-client.ts',
   'apps/remotes/remote-commerce/src/modern-app-env.d.ts',
   'apps/remotes/remote-commerce/src/modern.runtime.ts',
+  'apps/remotes/remote-commerce/locales/en/translation.json',
+  'apps/remotes/remote-commerce/locales/cs/translation.json',
+  'apps/remotes/remote-commerce/src/routes/index.css',
   'apps/remotes/remote-commerce/src/routes/[lang]/page.tsx',
   'apps/remotes/remote-identity/package.json',
-  'apps/remotes/remote-identity/config/public/locales/en/translation.json',
-  'apps/remotes/remote-identity/config/public/locales/cs/translation.json',
   'apps/remotes/remote-identity/modern.config.ts',
   'apps/remotes/remote-identity/module-federation.config.ts',
+  'apps/remotes/remote-identity/api/effect/index.ts',
+  'apps/remotes/remote-identity/shared/effect/api.ts',
+  'apps/remotes/remote-identity/src/effect/identity-client.ts',
   'apps/remotes/remote-identity/src/modern-app-env.d.ts',
   'apps/remotes/remote-identity/src/modern.runtime.ts',
+  'apps/remotes/remote-identity/locales/en/translation.json',
+  'apps/remotes/remote-identity/locales/cs/translation.json',
+  'apps/remotes/remote-identity/src/routes/index.css',
   'apps/remotes/remote-identity/src/routes/[lang]/page.tsx',
   'apps/remotes/remote-design-system/package.json',
-  'apps/remotes/remote-design-system/config/public/locales/en/translation.json',
-  'apps/remotes/remote-design-system/config/public/locales/cs/translation.json',
   'apps/remotes/remote-design-system/modern.config.ts',
   'apps/remotes/remote-design-system/module-federation.config.ts',
   'apps/remotes/remote-design-system/src/modern-app-env.d.ts',
   'apps/remotes/remote-design-system/src/modern.runtime.ts',
+  'apps/remotes/remote-design-system/locales/en/translation.json',
+  'apps/remotes/remote-design-system/locales/cs/translation.json',
+  'apps/remotes/remote-design-system/src/routes/index.css',
   'apps/remotes/remote-design-system/src/routes/[lang]/page.tsx',
-  'services/service-recommendations-effect/package.json',
-  'services/service-recommendations-effect/modern.config.ts',
-  'services/service-recommendations-effect/api/effect/index.ts',
-  'services/service-recommendations-effect/shared/effect/api.ts',
   'packages/shared-contracts/src/index.ts',
   'packages/shared-design-tokens/src/index.ts',
   'packages/shared-effect-api/src/index.ts',
 ];
 
+if (tailwindEnabled) {
+  requiredPaths.push(
+    'apps/shell-super-app/postcss.config.mjs',
+    'apps/shell-super-app/tailwind.config.ts',
+    'apps/remotes/remote-commerce/postcss.config.mjs',
+    'apps/remotes/remote-commerce/tailwind.config.ts',
+    'apps/remotes/remote-identity/postcss.config.mjs',
+    'apps/remotes/remote-identity/tailwind.config.ts',
+    'apps/remotes/remote-design-system/postcss.config.mjs',
+    'apps/remotes/remote-design-system/tailwind.config.ts',
+  );
+}
+
 for (const requiredPath of requiredPaths) {
   assertExists(requiredPath);
 }
 
+assertNotExists('services/service-recommendations-effect');
+
 for (const appDirectory of [
   'apps/shell-super-app',
   'apps/remotes/remote-commerce',
@@ -126,10 +193,8 @@ const rootPackage = readJson('package.json');
 const packageSource = readJson('.modernjs/ultramodern-package-source.json');
 const skillsLock = readJson('.agents/skills-lock.json');
 const agentReferenceRepos = readJson('.agents/agent-reference-repos.json');
-const pnpmWorkspace = readText('pnpm-workspace.yaml');
 const workflowContent = readText('.github/workflows/ultramodern-workspace-gates.yml');
 const renovateConfig = readJson('.github/renovate.json');
-const deprecatedTanstackRuntime = '@modern-js/runtime/' + 'tanstack-router';
 const expectedModernSpecifier =
   packageSource.strategy === 'install' ? packageSource.modernPackages?.specifier : 'workspace:*';
 
@@ -146,38 +211,75 @@ const expectedModernDependency = (packageName) => {
 
 assert(rootPackage.private === true, 'Root package must be private');
 assert(rootPackage.modernjs?.preset === 'presetUltramodern', 'Root must declare presetUltramodern');
-assert(rootPackage.packageManager === 'pnpm@11.1.2', 'Root must pin pnpm 11.1.2');
-assert(rootPackage.engines?.pnpm === '>=11.0.0', 'Root must require pnpm >=11');
-for (const requiredSnippet of [
-  'packages:\n  - apps/*\n  - apps/remotes/*\n  - services/*\n  - packages/*',
-  'minimumReleaseAge: 1440',
-  'minimumReleaseAgeStrict: true',
-  'minimumReleaseAgeIgnoreMissingTime: false',
-  "minimumReleaseAgeExclude:\n  - '@modern-js/*'\n  - '@bleedingdev/*'\n  - '@effect/tsgo'\n  - '@effect/tsgo-*'\n  - '@typescript/native-preview'\n  - '@typescript/native-preview-*'",
-  'trustPolicy: no-downgrade',
-  'trustPolicyIgnoreAfter: 1440',
-  'blockExoticSubdeps: true',
-  'engineStrict: true',
-  'pmOnFail: error',
-  'verifyDepsBeforeRun: error',
-  'strictDepBuilds: true',
-  "allowBuilds:\n  '@swc/core': true\n  core-js: true\n  esbuild: true\n  msgpackr-extract: true\n  simple-git-hooks: true",
-]) {
-  assert(
-    pnpmWorkspace.includes(requiredSnippet),
-    `pnpm-workspace.yaml must retain ${requiredSnippet.split('\n')[0]}`,
-  );
-}
-assert(
-  !pnpmWorkspace.includes('onlyBuiltDependencies'),
-  'pnpm-workspace.yaml must use pnpm 11 allowBuilds instead of onlyBuiltDependencies',
-);
+assert(rootPackage.packageManager === 'pnpm@11.3.0', 'Root must pin pnpm 11.3.0');
+assert(
+  rootPackage.engines?.pnpm === '>=11.3.0 <11.4.0',
+  'Root must require pnpm >=11.3.0 <11.4.0',
+);
+assert(
+  JSON.stringify(readPnpmConfig('packages')) ===
+    JSON.stringify(['apps/*', 'apps/remotes/*', 'services/*', 'packages/*']),
+  'pnpm-workspace.yaml must retain workspace package globs',
+);
+assert(readPnpmConfig('minimumReleaseAge') === 1440, 'pnpm minimumReleaseAge must be 1440');
+assert(readPnpmConfig('minimumReleaseAgeStrict') === true, 'pnpm minimumReleaseAgeStrict must be true');
+assert(
+  readPnpmConfig('minimumReleaseAgeIgnoreMissingTime') === false,
+  'pnpm minimumReleaseAgeIgnoreMissingTime must be false',
+);
+assert(
+  JSON.stringify(readPnpmConfig('minimumReleaseAgeExclude')) ===
+    JSON.stringify([
+      '@modern-js/*',
+      '@bleedingdev/*',
+      '@effect/tsgo',
+      '@effect/tsgo-*',
+      '@typescript/native-preview',
+      '@typescript/native-preview-*',
+      '@cloudflare/*',
+      'miniflare',
+      'workerd',
+      'wrangler',
+    ]),
+  'pnpm minimumReleaseAgeExclude must retain framework and Cloudflare exceptions',
+);
+assert(readPnpmConfig('trustPolicy') === 'no-downgrade', 'pnpm trustPolicy must be no-downgrade');
+assert(readPnpmConfig('trustPolicyIgnoreAfter') === 1440, 'pnpm trustPolicyIgnoreAfter must be 1440');
+assert(readPnpmConfig('blockExoticSubdeps') === true, 'pnpm blockExoticSubdeps must be true');
+assert(readPnpmConfig('engineStrict') === true, 'pnpm engineStrict must be true');
+assert(readPnpmConfig('pmOnFail') === 'error', 'pnpm pmOnFail must be error');
+assert(readPnpmConfig('verifyDepsBeforeRun') === 'error', 'pnpm verifyDepsBeforeRun must be error');
+assert(readPnpmConfig('strictDepBuilds') === true, 'pnpm strictDepBuilds must be true');
+assert(
+  JSON.stringify(readPnpmConfig('peerDependencyRules')) ===
+    JSON.stringify({ allowedVersions: { react: '>=19.0.0', typescript: '>=6.0.0' } }),
+  'pnpm peerDependencyRules must allow React 19 and TypeScript 6+',
+);
+assert(
+  JSON.stringify(readPnpmConfig('overrides')) ===
+    JSON.stringify({ '@tanstack/react-router': '1.170.8', 'node-fetch': '^3.3.2' }),
+  'pnpm overrides must pin generated router and node-fetch policy',
+);
+assert(
+  JSON.stringify(readPnpmConfig('allowBuilds')) ===
+    JSON.stringify({
+      '@swc/core': true,
+      'core-js': true,
+      esbuild: true,
+      'msgpackr-extract': true,
+      sharp: true,
+      'simple-git-hooks': true,
+      workerd: true,
+    }),
+  'pnpm allowBuilds must approve only the generated workspace build dependencies',
+);
+assert(readPnpmConfig('onlyBuiltDependencies') === undefined, 'pnpm onlyBuiltDependencies must not be set');
 for (const requiredSnippet of [
   'permissions:\n  contents: read',
   'pull_request:',
   'persist-credentials: false',
   'pnpm install --frozen-lockfile',
-  'pnpm -r --filter "./apps/**" run build',
+  'pnpm build',
   'MODERN_PUBLIC_SITE_URL: http://localhost:8080',
   'timeout-minutes:',
   'egress-policy: audit',
@@ -236,22 +338,29 @@ assert(
 );
 
 const requiredRootScripts = {
+  build:
+    'pnpm -r --filter "./apps/remotes/**" run build && pnpm --filter "./apps/shell-super-app" run build && pnpm ultramodern:assert-mf-types',
   format: 'oxfmt .',
   'format:check': 'oxfmt --check .',
-  'i18n:check': 'node ./scripts/check-i18n-strings.mjs',
   lint: 'oxlint .',
   'lint:fix': 'oxlint . --fix',
   'agents:refs:check': 'node ./scripts/setup-agent-reference-repos.mjs --check',
   'agents:refs:install': 'node ./scripts/setup-agent-reference-repos.mjs',
-  postinstall: 'node ./scripts/setup-agent-reference-repos.mjs',
+  postinstall:
+    'node ./scripts/setup-agent-reference-repos.mjs && node ./scripts/bootstrap-agent-skills.mjs',
   'skills:check': 'node ./scripts/bootstrap-agent-skills.mjs --check',
   'skills:install': 'node ./scripts/bootstrap-agent-skills.mjs',
   typecheck: `pnpm -r --filter "@${packageScope}/*" typecheck`,
+  'ultramodern:assert-mf-types': 'node ./scripts/assert-mf-types.mjs',
   'ultramodern:check': 'node ./scripts/validate-ultramodern-workspace.mjs',
 };
 for (const [scriptName, scriptCommand] of Object.entries(requiredRootScripts)) {
   assert(rootPackage.scripts?.[scriptName] === scriptCommand, `Root must expose ${scriptName}`);
 }
+assert(
+  Object.keys(rootPackage.scripts ?? {}).every((scriptName) => !scriptName.startsWith('zephyr:')),
+  'Root package must not expose custom zephyr:* lifecycle commands',
+);
 
 for (const dependency of [
   '@effect/tsgo',
@@ -285,6 +394,10 @@ assert(
   agentReferenceRepos.defaultEnabled === true,
   'Agent reference repositories must be enabled by default',
 );
+assert(
+  agentReferenceRepos.strategy === 'git-subtree-squash',
+  'Agent reference repositories must use git subtree squash strategy',
+);
 assert(
   agentReferenceRepos.repositories?.some(
     (repo) =>
@@ -309,6 +422,10 @@ assert(
   ),
   'Agent reference repository setup must expose an opt-out environment variable',
 );
+assert(
+  readText('scripts/setup-agent-reference-repos.mjs').includes('git-subtree-dir'),
+  'Agent reference repository setup must validate git subtree evidence',
+);
 for (const skillName of baselineAgentSkills) {
   assert(
     skillsLock.baseline?.some((skill) => skill.name === skillName),
@@ -323,6 +440,26 @@ for (const skillName of baselineAgentSkills) {
 const privateSource = skillsLock.sources?.find(
   (source) => source.repository === 'https://github.com/TechsioCZ/skills',
 );
+const moduleFederationSource = skillsLock.sources?.find(
+  (source) => source.repository === 'https://github.com/module-federation/agent-skills',
+);
+assert(
+  moduleFederationSource?.install === 'clone' &&
+    moduleFederationSource.commit === moduleFederationAgentSkillsCommit,
+  'Agent skills lock must configure the public Module Federation skill source as a pinned clone',
+);
+for (const skillName of moduleFederationAgentSkills) {
+  assert(
+    skillsLock.baseline?.some((skill) => skill.name === skillName) &&
+      moduleFederationSource.baseline?.some((skill) => skill.name === skillName),
+    `Agent skills lock must require Module Federation skill ${skillName}`,
+  );
+  assert(
+    agentsInstructions.includes(`\`${skillName}\``) &&
+      agentsInstructions.includes('module-federation/agent-skills'),
+    `Root AGENTS.md must document required Module Federation skill ${skillName}`,
+  );
+}
 assert(
   privateSource?.install === 'clone-if-authorized',
   'Agent skills lock must configure TechsioCZ skills as clone-if-authorized',
@@ -338,18 +475,52 @@ const appPackagePaths = [
   'apps/shell-super-app/package.json',
   'apps/remotes/remote-commerce/package.json',
   'apps/remotes/remote-identity/package.json',
-  'apps/remotes/remote-design-system/package.json',
+  `${designSystemRemotePath}/package.json`,
 ];
 
+const expectedZephyrDependencies = {
+  commerce: `@${packageScope}/remote-commerce@workspace:*`,
+  identity: `@${packageScope}/remote-identity@workspace:*`,
+  designSystem: `@${packageScope}/remote-design-system@workspace:*`,
+};
+
 for (const packagePath of appPackagePaths) {
   const packageJson = readJson(packagePath);
+  const isRemote = packagePath.includes('/remotes/');
+  const fullStackVertical = fullStackVerticals.find(
+    (vertical) => `${vertical.path}/package.json` === packagePath,
+  );
+  assert(packageJson.scripts?.dev === 'modern dev', `${packagePath} must use vanilla modern dev`);
   assert(
-    packageJson.dependencies?.['@modern-js/plugin-i18n'] ===
-      expectedModernDependency('@modern-js/plugin-i18n'),
-    `${packagePath} must use @modern-js/plugin-i18n through ${expectedModernDependency(
-      '@modern-js/plugin-i18n',
-    )}`,
+    packageJson.scripts?.build ===
+      (isRemote
+        ? 'modern build && node ../../../scripts/assert-mf-types.mjs'
+        : 'modern build'),
+    `${packagePath} must enforce Module Federation DTS on remote builds`,
+  );
+  assert(packageJson.scripts?.serve === 'modern serve', `${packagePath} must use vanilla modern serve`);
+  assert(
+    Object.keys(packageJson.scripts ?? {}).every((scriptName) => !scriptName.startsWith('zephyr:')),
+    `${packagePath} must not expose custom zephyr:* lifecycle commands`,
   );
+  assert(
+    packageJson['zephyr:dependencies'] &&
+      typeof packageJson['zephyr:dependencies'] === 'object' &&
+      !Array.isArray(packageJson['zephyr:dependencies']),
+    `${packagePath} must declare zephyr:dependencies for deterministic Zephyr dependency extraction`,
+  );
+  if (isRemote) {
+    assert(
+      Object.keys(packageJson['zephyr:dependencies']).length === 0,
+      `${packagePath} must declare an empty zephyr:dependencies map until it consumes remotes`,
+    );
+  } else {
+    assert(
+      JSON.stringify(packageJson['zephyr:dependencies']) ===
+        JSON.stringify(expectedZephyrDependencies),
+      `${packagePath} must map shell remote aliases to Zephyr workspace remote package dependencies`,
+    );
+  }
   assert(
     packageJson.dependencies?.['@modern-js/plugin-tanstack'] ===
       expectedModernDependency('@modern-js/plugin-tanstack'),
@@ -357,6 +528,13 @@ for (const packagePath of appPackagePaths) {
       '@modern-js/plugin-tanstack',
     )}`,
   );
+  assert(
+    packageJson.dependencies?.['@modern-js/plugin-i18n'] ===
+      expectedModernDependency('@modern-js/plugin-i18n'),
+    `${packagePath} must use @modern-js/plugin-i18n through ${expectedModernDependency(
+      '@modern-js/plugin-i18n',
+    )}`,
+  );
   assert(
     packageJson.dependencies?.['@modern-js/runtime'] ===
       expectedModernDependency('@modern-js/runtime'),
@@ -371,6 +549,22 @@ for (const packagePath of appPackagePaths) {
       '@modern-js/app-tools',
     )}`,
   );
+  assert(
+    packageJson.devDependencies?.typescript === '6.0.3',
+    `${packagePath} must include TypeScript 6 only as the stable JS TypeScript package for Module Federation DTS generation`,
+  );
+  assert(
+    packageJson.devDependencies?.['@typescript/native-preview'] === '7.0.0-dev.20260526.1',
+    `${packagePath} must include TypeScript 7 native preview for mandatory native typechecking`,
+  );
+  assert(
+    packageJson.devDependencies?.['zephyr-rspack-plugin'] === '1.1.1',
+    `${packagePath} must install the Zephyr Rspack plugin used by the Modern.js bridge`,
+  );
+  assert(
+    packageJson.devDependencies?.['zephyr-modernjs-plugin'] === undefined,
+    `${packagePath} must not install the inactive Zephyr Modern.js wrapper`,
+  );
   assert(
     packageJson.dependencies?.[`@${packageScope}/shared-contracts`] === 'workspace:*',
     `${packagePath} must link generated shared contracts through workspace:*`,
@@ -379,29 +573,131 @@ for (const packagePath of appPackagePaths) {
     packageJson.dependencies?.[`@${packageScope}/shared-design-tokens`] === 'workspace:*',
     `${packagePath} must link generated shared design tokens through workspace:*`,
   );
-  assert(packageJson.dependencies?.i18next === '26.2.0', `${packagePath} must include i18next`);
   assert(
-    packageJson.dependencies?.['react-i18next'] === '17.0.8',
-    `${packagePath} must include react-i18next`,
+    packageJson.dependencies?.['node-fetch'] === '^3.3.2',
+    `${packagePath} must satisfy the Module Federation SDK node-fetch peer`,
   );
   assert(
     packageJson.dependencies?.['@tanstack/react-router'] === tanstackVersion,
     `${packagePath} must use @tanstack/react-router ${tanstackVersion}`,
   );
   assert(
-    packageJson.dependencies?.['@module-federation/modern-js-v3'] === '2.4.0',
-    `${packagePath} must include the Module Federation plugin`,
+    packageJson.dependencies?.i18next === '26.2.0',
+    `${packagePath} must include i18next for mandatory native Modern.js i18n`,
   );
   assert(
-    packageJson.dependencies?.['zephyr-modernjs-plugin'] === '1.1.1',
-    `${packagePath} must include the official Zephyr Modern.js plugin`,
+    !packageJson.dependencies?.['react-i18next'],
+    `${packagePath} must use native @modern-js/plugin-i18n hooks instead of react-i18next in the TanStack MF starter`,
   );
+  assert(
+    packageJson.dependencies?.['@module-federation/modern-js-v3'] === '2.5.0',
+    `${packagePath} must include the Module Federation plugin`,
+  );
+  if (fullStackVertical) {
+    assert(
+      packageJson.dependencies?.['@modern-js/plugin-bff'] ===
+        expectedModernDependency('@modern-js/plugin-bff'),
+      `${packagePath} must use @modern-js/plugin-bff through ${expectedModernDependency(
+        '@modern-js/plugin-bff',
+      )}`,
+    );
+    assert(
+      packageJson.exports?.['./effect/client'] ===
+        `./src/effect/${fullStackVertical.stem}-client.ts` &&
+        packageJson.exports?.['./shared/effect/api'] === './shared/effect/api.ts',
+      `${packagePath} must expose its vertical-owned Effect client and contract surface`,
+    );
+  }
+  if (packagePath === `${designSystemRemotePath}/package.json`) {
+    assert(
+      !packageJson.dependencies?.['@modern-js/plugin-bff'],
+      'Design-system remote must remain FE-only and must not depend on @modern-js/plugin-bff',
+    );
+    assert(
+      !packageJson.exports?.['./effect/client'] && !packageJson.exports?.['./shared/effect/api'],
+      'Design-system remote must not expose Effect client or contract exports',
+    );
+  }
+  if (tailwindEnabled) {
+    assert(
+      packageJson.devDependencies?.tailwindcss === tailwindVersion,
+      `${packagePath} must include Tailwind CSS ${tailwindVersion}`,
+    );
+    assert(
+      packageJson.devDependencies?.['@tailwindcss/postcss'] === tailwindPostcssVersion,
+      `${packagePath} must include @tailwindcss/postcss ${tailwindPostcssVersion}`,
+    );
+    assert(
+      packageJson.devDependencies?.postcss === '^8.5.6',
+      `${packagePath} must include PostCSS for Tailwind CSS`,
+    );
+  } else {
+    assert(!packageJson.devDependencies?.tailwindcss, `${packagePath} must not include Tailwind CSS`);
+    assert(
+      !packageJson.devDependencies?.['@tailwindcss/postcss'],
+      `${packagePath} must not include @tailwindcss/postcss`,
+    );
+  }
   assert(
     packageJson.modernjs?.preset === 'presetUltramodern',
     `${packagePath} must keep presetUltramodern metadata`,
   );
 }
 
+for (const federationConfigPath of [
+  'apps/shell-super-app/module-federation.config.ts',
+  'apps/remotes/remote-commerce/module-federation.config.ts',
+  'apps/remotes/remote-identity/module-federation.config.ts',
+  'apps/remotes/remote-design-system/module-federation.config.ts',
+]) {
+  const federationConfig = readText(federationConfigPath);
+  assert(
+    federationConfig.includes('compilerInstance:') &&
+      federationConfig.includes("'--package typescript -- tsc'") &&
+      federationConfig.includes('displayErrorInTerminal: true') &&
+      !federationConfig.includes('dts: false'),
+    `${federationConfigPath} must keep strict Module Federation DTS enabled`,
+  );
+}
+
+for (const appDirectory of [
+  'apps/shell-super-app',
+  'apps/remotes/remote-commerce',
+  'apps/remotes/remote-identity',
+  'apps/remotes/remote-design-system',
+]) {
+  const css = readText(`${appDirectory}/src/routes/index.css`);
+  if (tailwindEnabled) {
+    assert(
+      css.includes("@import 'tailwindcss';"),
+      `${appDirectory} must import Tailwind CSS by default`,
+    );
+    const postcssConfig = readText(`${appDirectory}/postcss.config.mjs`);
+    assert(
+      postcssConfig.includes("'@tailwindcss/postcss'"),
+      `${appDirectory} must configure the Tailwind CSS PostCSS plugin`,
+    );
+    const tailwindConfig = readText(`${appDirectory}/tailwind.config.ts`);
+    assert(
+      tailwindConfig.includes("content: ['./src/**/*.{js,jsx,ts,tsx}']"),
+      `${appDirectory} must scan app source files for Tailwind CSS classes`,
+    );
+  } else {
+    assert(
+      !css.includes("@import 'tailwindcss';"),
+      `${appDirectory} must omit Tailwind CSS import when Tailwind is disabled`,
+    );
+    assert(
+      !fs.existsSync(path.join(root, appDirectory, 'postcss.config.mjs')),
+      `${appDirectory} must not write PostCSS config when Tailwind is disabled`,
+    );
+    assert(
+      !fs.existsSync(path.join(root, appDirectory, 'tailwind.config.ts')),
+      `${appDirectory} must not write Tailwind config when Tailwind is disabled`,
+    );
+  }
+}
+
 for (const configPath of [
   'apps/shell-super-app/modern.config.ts',
   'apps/remotes/remote-commerce/modern.config.ts',
@@ -410,26 +706,29 @@ for (const configPath of [
 ]) {
   const config = readText(configPath);
   assert(config.includes('presetUltramodern('), `${configPath} must use presetUltramodern`);
-  assert(config.includes('i18nPlugin('), `${configPath} must enable plugin-i18n`);
-  assert(config.includes('localePathRedirect: true'), `${configPath} must prefix localized URLs`);
   assert(config.includes('ULTRAMODERN_SITE_URL'), `${configPath} must expose site URL metadata`);
   assert(
     config.includes('MODERN_PUBLIC_SITE_URL must be set for production builds'),
     `${configPath} must require MODERN_PUBLIC_SITE_URL for production builds`,
   );
   assert(config.includes('tanstackRouterPlugin()'), `${configPath} must enable plugin-tanstack`);
+  assert(config.includes('i18nPlugin('), `${configPath} must enable native Modern.js i18n`);
   assert(
-    config.includes('moduleFederationPlugin()'),
-    `${configPath} must enable Module Federation`,
+    config.includes('reactI18next: false'),
+    `${configPath} must use the native Modern.js i18n provider without optional react-i18next probing`,
+  );
+  assert(
+    config.includes("publicDir: './locales'"),
+    `${configPath} must expose app-owned locale JSON through Modern.js publicDir`,
   );
   assert(
-    config.includes("from 'zephyr-modernjs-plugin'"),
-    `${configPath} must import the official Zephyr Modern.js plugin`,
+    config.includes('moduleFederationPlugin()'),
+    `${configPath} must enable Module Federation`,
   );
-  assert(config.includes('withZephyr()'), `${configPath} must enable Zephyr through plugins`);
   assert(
-    config.includes("bundler: 'rspack'"),
-    `${configPath} must keep appTools on the rspack bundler for Zephyr`,
+    config.includes("mode: 'stream'") &&
+      config.includes('moduleFederationAppSSR: true'),
+    `${configPath} must use streaming Module Federation SSR`,
   );
   assert(
     config.includes("html: './'"),
@@ -456,18 +755,15 @@ for (const routePath of [
   assert(route.includes('rel="alternate"'), `${routePath} must emit alternate locale metadata`);
   assert(route.includes('hrefLang="x-default"'), `${routePath} must emit x-default metadata`);
   assert(route.includes('localizedPath('), `${routePath} must build localized URLs`);
-  assert(
-    route.includes('@modern-js/plugin-tanstack/runtime'),
-    `${routePath} must import TanStack runtime from @modern-js/plugin-tanstack/runtime`,
-  );
-  assert(
-    !route.includes(deprecatedTanstackRuntime),
-    `${routePath} must not import deprecated TanStack runtime path`,
-  );
+  assert(route.includes("import '../index.css';"), `${routePath} must import route CSS`);
 }
 
 const shellMf = readText('apps/shell-super-app/module-federation.config.ts');
 assert(shellMf.includes("name: 'shellSuperApp'"), 'Shell MF config must name the shell');
+assert(
+  shellMf.includes("'react-dom/client'"),
+  'Shell MF config must share react-dom/client explicitly',
+);
 assert(
   shellMf.includes('remoteCommerce@http://localhost:3021/mf-manifest.json'),
   'Shell must reference commerce remote',
@@ -481,61 +777,74 @@ assert(
   'Shell must reference design-system remote',
 );
 
-const commerceMf = readText('apps/remotes/remote-commerce/module-federation.config.ts');
-assert(commerceMf.includes("name: 'remoteCommerce'"), 'Commerce remote MF name is missing');
-assert(commerceMf.includes("'./Widget'"), 'Commerce remote must expose a widget');
-
-const designMf = readText('apps/remotes/remote-design-system/module-federation.config.ts');
-assert(designMf.includes("name: 'remoteDesignSystem'"), 'Design-system remote MF name is missing');
-assert(designMf.includes("'./Button'"), 'Design-system remote must expose Button');
-assert(designMf.includes("'./tokens'"), 'Design-system remote must expose tokens');
-
-const servicePackage = readJson('services/service-recommendations-effect/package.json');
-assert(
-  servicePackage.dependencies?.['@modern-js/runtime'] ===
-    expectedModernDependency('@modern-js/runtime'),
-  `Effect service must use @modern-js/runtime through ${expectedModernDependency(
-    '@modern-js/runtime',
-  )}`,
-);
-assert(
-  servicePackage.devDependencies?.['@modern-js/app-tools'] ===
-    expectedModernDependency('@modern-js/app-tools'),
-  `Effect service must use @modern-js/app-tools through ${expectedModernDependency(
-    '@modern-js/app-tools',
-  )}`,
-);
+const shellPackage = readJson('apps/shell-super-app/package.json');
 assert(
-  servicePackage.devDependencies?.['@modern-js/plugin-bff'] ===
+  shellPackage.dependencies?.['@modern-js/plugin-bff'] ===
     expectedModernDependency('@modern-js/plugin-bff'),
-  `Effect service must use @modern-js/plugin-bff through ${expectedModernDependency(
+  `Shell must use @modern-js/plugin-bff through ${expectedModernDependency(
     '@modern-js/plugin-bff',
   )}`,
 );
 assert(
-  servicePackage.dependencies?.[`@${packageScope}/shared-effect-api`] === 'workspace:*',
-  'Effect service must link generated shared Effect API through workspace:*',
+  !shellPackage.dependencies?.[`@${packageScope}/shared-effect-api`],
+  'Shell must not depend on shared-effect-api for default vertical-owned APIs',
 );
 
-const serviceConfig = readText('services/service-recommendations-effect/modern.config.ts');
+const generatedContract = readJson('.modernjs/ultramodern-generated-contract.json');
 assert(
-  serviceConfig.includes("runtimeFramework: 'effect'"),
-  'Effect service must use Effect runtime',
+  generatedContract.profile === 'cloudflare-ssr-mf-effect-v1',
+  'Generated contract must select the Cloudflare SSR MF Effect profile',
 );
-assert(serviceConfig.includes('bffPlugin()'), 'Effect service must enable bffPlugin');
-
-const serviceEntry = readText('services/service-recommendations-effect/api/effect/index.ts');
 assert(
-  serviceEntry.includes('defineEffectBff'),
-  'Effect service must expose defineEffectBff placeholder',
+  generatedContract.packageManager?.manager === 'pnpm' &&
+    generatedContract.packageManager?.version === '11.3.0' &&
+    generatedContract.packageManager?.toolchain === 'mise' &&
+    generatedContract.packageManager?.corepack === false,
+  'Generated contract must declare the pnpm 11/mise toolchain policy',
 );
+
+for (const vertical of fullStackVerticals) {
+  const contractEntry = generatedContract.apps?.find((app) => app.id === vertical.id);
+  assert(
+    contractEntry?.deploy?.target === 'cloudflare' &&
+      contractEntry?.deploy?.worker?.ssr === true &&
+      contractEntry?.deploy?.output?.flat === true &&
+      contractEntry?.deploy?.output?.htmlDistPath === './' &&
+      contractEntry?.ssr?.mode === 'stream' &&
+      contractEntry?.ssr?.moduleFederationAppSSR === true &&
+      contractEntry?.i18n?.plugin === '@modern-js/plugin-i18n' &&
+      contractEntry?.i18n?.languages?.includes('en') &&
+      contractEntry?.i18n?.languages?.includes('cs') &&
+      contractEntry?.moduleFederation?.name === vertical.mfName &&
+      contractEntry?.moduleFederation?.exposes?.includes('./Widget') &&
+      contractEntry?.moduleFederation?.exposes?.includes('./Route') &&
+      contractEntry?.moduleFederation?.browserSafeExposesOnly === true &&
+      contractEntry?.effect?.runtime === 'effect' &&
+      contractEntry?.effect?.import === '@modern-js/plugin-bff/effect-edge' &&
+      contractEntry?.effect?.prefix === vertical.apiPrefix &&
+      contractEntry?.effect?.workerEntry === 'worker/__modern_bff_effect.js' &&
+      contractEntry?.marker?.appId === vertical.id &&
+      contractEntry?.marker?.deployProfile === 'cloudflare-ssr-mf-effect-v1' &&
+      contractEntry?.marker?.uiSurface === 'ui' &&
+      contractEntry?.marker?.apiSurface === 'effect-bff',
+    `${vertical.id} generated contract must describe Cloudflare SSR, MF, i18n, Effect BFF, and marker metadata`,
+  );
+}
+
+const designMf = readText('apps/remotes/remote-design-system/module-federation.config.ts');
+assert(designMf.includes("name: 'remoteDesignSystem'"), 'Design-system remote MF name is missing');
 assert(
-  serviceEntry.includes('recommendationsEffectApi'),
-  'Effect service must use shared recommendations API',
+  designMf.includes("'react-dom/client'"),
+  'Design-system remote MF config must share react-dom/client explicitly',
 );
+assert(designMf.includes("'./Button'"), 'Design-system remote must expose Button');
+assert(designMf.includes("'./tokens'"), 'Design-system remote must expose tokens');
+const sharedEffectApi = readText('packages/shared-effect-api/src/index.ts');
 assert(
-  readText('services/service-recommendations-effect/shared/effect/api.ts').includes('HttpApi.make'),
-  'Effect shared API placeholder must define HttpApi',
+  !sharedEffectApi.includes('recommendationsEffectApi') &&
+    !sharedEffectApi.includes('commerceEffectApi') &&
+    !sharedEffectApi.includes('identityEffectApi'),
+  'Shared Effect API package must not own default vertical API contracts',
 );
 
 const topology = readJson('topology/reference-topology.json');
@@ -543,6 +852,20 @@ assert(topology.preset === 'presetUltramodern', 'Topology must reference presetU
 assert(topology.shell?.id === 'shell-super-app', 'Topology shell id is incorrect');
 assert(topology.shell?.remoteRefs?.length === 3, 'Topology shell must reference three remotes');
 assert(topology.remotes?.length === 3, 'Topology must contain three remotes');
+for (const vertical of fullStackVerticals) {
+  const topologyEntry = topology.remotes.find((remote) => remote.id === vertical.id);
+  assert(topologyEntry?.kind === 'vertical', `${vertical.id} must be a vertical topology entry`);
+  assert(
+    topologyEntry?.moduleFederation?.manifestUrl?.includes('/mf-manifest.json') &&
+      topologyEntry?.api?.effect?.runtime === 'effect' &&
+      topologyEntry?.api?.effect?.bff?.prefix === vertical.apiPrefix &&
+      topologyEntry?.api?.effect?.bff?.openapi === '/openapi.json' &&
+      topologyEntry?.api?.effect?.contract?.export === './shared/effect/api' &&
+      topologyEntry?.api?.effect?.client?.export === './effect/client' &&
+      topologyEntry?.api?.effect?.serverEntry === `${vertical.path}/api/effect/index.ts`,
+    `${vertical.id} topology entry must include both Module Federation and Effect API metadata`,
+  );
+}
 assert(
   topology.remotes.some(
     (remote) => remote.id === 'remote-design-system' && remote.kind === 'horizontal-design-system',
@@ -550,8 +873,8 @@ assert(
   'Topology must contain the horizontal design-system remote',
 );
 assert(
-  topology.effectServices?.[0]?.runtime === 'effect',
-  'Topology must contain an Effect service',
+  (topology.effectServices ?? []).length === 0,
+  'Default vertical-owned APIs must not be generated as topology.effectServices',
 );
 assert(topology.sharedPackages?.length === 3, 'Topology must contain shared package placeholders');
 
@@ -563,12 +886,12 @@ assert(
   'Ownership metadata must retain commerce owner',
 );
 assert(
-  ownership.owners?.some(
+  !ownership.owners?.some(
     (owner) =>
-      owner.id === 'service-recommendations-effect' &&
-      owner.package === `@${packageScope}/service-recommendations-effect`,
+      owner.id === 'service-recommendations-effect' ||
+      owner.path === 'services/service-recommendations-effect',
   ),
-  'Ownership metadata must retain Effect service owner',
+  'Ownership metadata must not retain the old default recommendations service owner',
 );
 
 const manifest = readJson('.modernjs/ultramodern-workspace-template-manifest.json');
@@ -588,6 +911,19 @@ assert(
   baselineAgentSkills.every((skillName) => manifest.agentSkills?.baseline?.includes(skillName)),
   'Template manifest must list every baseline agent skill',
 );
+assert(
+  manifest.agentSkills?.moduleFederationSource?.repository ===
+    'https://github.com/module-federation/agent-skills' &&
+    manifest.agentSkills?.moduleFederationSource?.commit ===
+      moduleFederationAgentSkillsCommit,
+  'Template manifest must retain the Module Federation agent skill source',
+);
+assert(
+  moduleFederationAgentSkills.every((skillName) =>
+    manifest.agentSkills?.moduleFederationSource?.baseline?.includes(skillName),
+  ),
+  'Template manifest must list every Module Federation agent skill entry',
+);
 assert(
   manifest.agentSkills?.privateSource?.repository === 'https://github.com/TechsioCZ/skills',
   'Template manifest must retain the private TechsioCZ skill source',