@bleedingdev/modern-js-create 3.2.0-ultramodern.4 → 3.2.0-ultramodern.40

package/template-workspace/scripts/validate-ultramodern-workspace.mjs.handlebars

@@ -1,76 +1,219 @@
+import { execFileSync } from 'node:child_process';
 import fs from 'node:fs';
 import path from 'node:path';
 
 const root = process.cwd();
 const packageScope = '{{packageScope}}';
-const tanstackVersion = '1.170.1';
+const tanstackVersion = '1.170.8';
+const tailwindEnabled = '{{tailwindEnabled}}' === 'true';
+const tailwindVersion = '^4.3.0';
+const tailwindPostcssVersion = '^4.3.0';
+const expectedPnpmVersion = '{{pnpmVersion}}';
+const rstackAgentSkillsCommit = '61c948b42512e223bad44b83af4080eba48b2677';
+const moduleFederationAgentSkillsCommit = '07bb5b6c43ad457609e00c081b72d4c42508ec76';
 const modernPackages = [
   '@modern-js/app-tools',
   '@modern-js/plugin-bff',
+  '@modern-js/plugin-i18n',
   '@modern-js/plugin-tanstack',
   '@modern-js/runtime',
 ];
+const baselineAgentSkills = [
+  'rsbuild-best-practices',
+  'rspack-best-practices',
+  'rspack-tracing',
+  'rsdoctor-analysis',
+  'rslib-best-practices',
+  'rslib-modern-package',
+  'rstest-best-practices',
+];
+const moduleFederationAgentSkills = ['mf'];
+const privateAgentSkills = ['plan-graph', 'dag', 'subagent-graph', 'helm', 'debugger-mode'];
+const fullStackVerticals = [
+  {
+    id: 'remote-commerce',
+    domain: 'commerce',
+    stem: 'recommendations',
+    group: 'recommendations',
+    path: 'apps/remotes/remote-commerce',
+    mfName: 'remoteCommerce',
+    apiPrefix: '/commerce-api',
+  },
+  {
+    id: 'remote-identity',
+    domain: 'identity',
+    stem: 'identity',
+    group: 'identity',
+    path: 'apps/remotes/remote-identity',
+    mfName: 'remoteIdentity',
+    apiPrefix: '/identity-api',
+  },
+];
+const designSystemRemotePath = 'apps/remotes/remote-design-system';
 
-function readText(relativePath) {
-  return fs.readFileSync(path.join(root, relativePath), 'utf-8');
-}
-
-function readJson(relativePath) {
-  return JSON.parse(readText(relativePath));
-}
-
-function assert(condition, message) {
+const readText = (relativePath) => fs.readFileSync(path.join(root, relativePath), 'utf-8');
+const readJson = (relativePath) => JSON.parse(readText(relativePath));
+const activePnpmVersion = execFileSync('pnpm', ['--version'], {
+  cwd: root,
+  encoding: 'utf-8',
+  stdio: ['ignore', 'pipe', 'pipe'],
+}).trim();
+const readPnpmConfig = (key) => {
+  const env = { ...process.env };
+  for (const envKey of Object.keys(env)) {
+    if (/^(?:npm|pnpm)_config_/i.test(envKey)) {
+      delete env[envKey];
+    }
+  }
+  const output = execFileSync('pnpm', ['config', 'get', key, '--json'], {
+    cwd: root,
+    env,
+    encoding: 'utf-8',
+    stdio: ['ignore', 'pipe', 'pipe'],
+  }).trim();
+  return output ? JSON.parse(output) : undefined;
+};
+const assert = (condition, message) => {
   if (!condition) {
     throw new Error(message);
   }
-}
-
-function assertExists(relativePath) {
+};
+const assertExists = (relativePath) => {
   assert(fs.existsSync(path.join(root, relativePath)), `Missing ${relativePath}`);
-}
+};
+const assertNotExists = (relativePath) => {
+  assert(!fs.existsSync(path.join(root, relativePath)), `Unexpected ${relativePath}`);
+};
+
+assert(
+  activePnpmVersion === expectedPnpmVersion,
+  `Generated workspace requires pnpm ${expectedPnpmVersion}; active pnpm is ${activePnpmVersion}. Run mise install, then rerun through mise exec -- pnpm ...`,
+);
 
 const requiredPaths = [
+  'AGENTS.md',
+  '.gitignore',
   'package.json',
   'pnpm-workspace.yaml',
   'tsconfig.base.json',
+  'oxlint.config.ts',
+  'oxfmt.config.ts',
+  '.github/renovate.json',
+  '.github/workflows/ultramodern-workspace-gates.yml',
+  '.agents/skills-lock.json',
+  '.agents/agent-reference-repos.json',
+  '.agents/rstackjs-agent-skills-LICENSE',
+  '.agents/skills/rsbuild-best-practices/SKILL.md',
+  '.agents/skills/rspack-best-practices/SKILL.md',
+  '.agents/skills/rspack-tracing/SKILL.md',
+  '.agents/skills/rspack-tracing/references/tracing-guide.md',
+  '.agents/skills/rspack-tracing/scripts/analyze_trace.js',
+  '.agents/skills/rsdoctor-analysis/SKILL.md',
+  '.agents/skills/rsdoctor-analysis/references/rsdoctor-data-types.md',
+  '.agents/skills/rslib-best-practices/SKILL.md',
+  '.agents/skills/rslib-modern-package/SKILL.md',
+  '.agents/skills/rstest-best-practices/SKILL.md',
   'topology/reference-topology.json',
   'topology/ownership.json',
   'topology/local-overlays/development.json',
   '.modernjs/ultramodern-workspace-template-manifest.json',
   '.modernjs/ultramodern-package-source.json',
+  '.modernjs/ultramodern-generated-contract.json',
+  'scripts/assert-mf-types.mjs',
+  'scripts/bootstrap-agent-skills.mjs',
+  'scripts/setup-agent-reference-repos.mjs',
   'apps/shell-super-app/package.json',
   'apps/shell-super-app/modern.config.ts',
   'apps/shell-super-app/module-federation.config.ts',
+  'apps/shell-super-app/src/modern-app-env.d.ts',
+  'apps/shell-super-app/src/modern.runtime.ts',
+  'apps/shell-super-app/locales/en/translation.json',
+  'apps/shell-super-app/locales/cs/translation.json',
+  'apps/shell-super-app/src/routes/index.css',
+  'apps/shell-super-app/src/routes/layout.tsx',
+  'apps/shell-super-app/src/routes/[lang]/page.tsx',
   'apps/remotes/remote-commerce/package.json',
   'apps/remotes/remote-commerce/modern.config.ts',
   'apps/remotes/remote-commerce/module-federation.config.ts',
+  'apps/remotes/remote-commerce/api/effect/index.ts',
+  'apps/remotes/remote-commerce/shared/effect/api.ts',
+  'apps/remotes/remote-commerce/src/effect/recommendations-client.ts',
+  'apps/remotes/remote-commerce/src/modern-app-env.d.ts',
+  'apps/remotes/remote-commerce/src/modern.runtime.ts',
+  'apps/remotes/remote-commerce/locales/en/translation.json',
+  'apps/remotes/remote-commerce/locales/cs/translation.json',
+  'apps/remotes/remote-commerce/src/routes/index.css',
+  'apps/remotes/remote-commerce/src/routes/layout.tsx',
+  'apps/remotes/remote-commerce/src/routes/[lang]/page.tsx',
   'apps/remotes/remote-identity/package.json',
   'apps/remotes/remote-identity/modern.config.ts',
   'apps/remotes/remote-identity/module-federation.config.ts',
+  'apps/remotes/remote-identity/api/effect/index.ts',
+  'apps/remotes/remote-identity/shared/effect/api.ts',
+  'apps/remotes/remote-identity/src/effect/identity-client.ts',
+  'apps/remotes/remote-identity/src/modern-app-env.d.ts',
+  'apps/remotes/remote-identity/src/modern.runtime.ts',
+  'apps/remotes/remote-identity/locales/en/translation.json',
+  'apps/remotes/remote-identity/locales/cs/translation.json',
+  'apps/remotes/remote-identity/src/routes/index.css',
+  'apps/remotes/remote-identity/src/routes/layout.tsx',
+  'apps/remotes/remote-identity/src/routes/[lang]/page.tsx',
   'apps/remotes/remote-design-system/package.json',
   'apps/remotes/remote-design-system/modern.config.ts',
   'apps/remotes/remote-design-system/module-federation.config.ts',
-  'services/service-recommendations-effect/package.json',
-  'services/service-recommendations-effect/modern.config.ts',
-  'services/service-recommendations-effect/api/effect/index.ts',
-  'services/service-recommendations-effect/shared/effect/api.ts',
+  'apps/remotes/remote-design-system/src/modern-app-env.d.ts',
+  'apps/remotes/remote-design-system/src/modern.runtime.ts',
+  'apps/remotes/remote-design-system/locales/en/translation.json',
+  'apps/remotes/remote-design-system/locales/cs/translation.json',
+  'apps/remotes/remote-design-system/src/routes/index.css',
+  'apps/remotes/remote-design-system/src/routes/layout.tsx',
+  'apps/remotes/remote-design-system/src/routes/[lang]/page.tsx',
   'packages/shared-contracts/src/index.ts',
   'packages/shared-design-tokens/src/index.ts',
   'packages/shared-effect-api/src/index.ts',
 ];
 
+if (tailwindEnabled) {
+  requiredPaths.push(
+    'apps/shell-super-app/postcss.config.mjs',
+    'apps/shell-super-app/tailwind.config.ts',
+    'apps/remotes/remote-commerce/postcss.config.mjs',
+    'apps/remotes/remote-commerce/tailwind.config.ts',
+    'apps/remotes/remote-identity/postcss.config.mjs',
+    'apps/remotes/remote-identity/tailwind.config.ts',
+    'apps/remotes/remote-design-system/postcss.config.mjs',
+    'apps/remotes/remote-design-system/tailwind.config.ts',
+  );
+}
+
 for (const requiredPath of requiredPaths) {
   assertExists(requiredPath);
 }
 
+assertNotExists('services/service-recommendations-effect');
+
+for (const appDirectory of [
+  'apps/shell-super-app',
+  'apps/remotes/remote-commerce',
+  'apps/remotes/remote-identity',
+  'apps/remotes/remote-design-system',
+]) {
+  assert(
+    !fs.existsSync(path.join(root, appDirectory, 'src/routes/page.tsx')),
+    `${appDirectory} must use src/routes/[lang]/page.tsx`,
+  );
+}
+
 const rootPackage = readJson('package.json');
 const packageSource = readJson('.modernjs/ultramodern-package-source.json');
+const skillsLock = readJson('.agents/skills-lock.json');
+const agentReferenceRepos = readJson('.agents/agent-reference-repos.json');
+const workflowContent = readText('.github/workflows/ultramodern-workspace-gates.yml');
+const renovateConfig = readJson('.github/renovate.json');
 const expectedModernSpecifier =
-  packageSource.strategy === 'install'
-    ? packageSource.modernPackages?.specifier
-    : 'workspace:*';
+  packageSource.strategy === 'install' ? packageSource.modernPackages?.specifier : 'workspace:*';
 
-function expectedModernDependency(packageName) {
+const expectedModernDependency = (packageName) => {
   if (packageSource.strategy !== 'install') {
     return 'workspace:*';
   }
@@ -79,13 +222,121 @@ function expectedModernDependency(packageName) {
   return aliasPackageName
     ? `npm:${aliasPackageName}@${expectedModernSpecifier}`
     : expectedModernSpecifier;
-}
+};
 
 assert(rootPackage.private === true, 'Root package must be private');
 assert(rootPackage.modernjs?.preset === 'presetUltramodern', 'Root must declare presetUltramodern');
+const miseConfig = readText('.mise.toml');
+assert(
+  miseConfig.includes(`pnpm = "${expectedPnpmVersion}"`),
+  `Root must pin pnpm ${expectedPnpmVersion} in .mise.toml`,
+);
+assert(
+  rootPackage.packageManager === `pnpm@${expectedPnpmVersion}`,
+  `Root must pin pnpm ${expectedPnpmVersion}`,
+);
+assert(
+  rootPackage.engines?.pnpm === `>=${expectedPnpmVersion} <11.5.0`,
+  `Root must require pnpm >=${expectedPnpmVersion} <11.5.0`,
+);
+assert(
+  JSON.stringify(readPnpmConfig('packages')) ===
+    JSON.stringify(['apps/*', 'apps/remotes/*', 'services/*', 'packages/*']),
+  'pnpm-workspace.yaml must retain workspace package globs',
+);
+assert(readPnpmConfig('minimumReleaseAge') === 1440, 'pnpm minimumReleaseAge must be 1440');
+assert(readPnpmConfig('minimumReleaseAgeStrict') === true, 'pnpm minimumReleaseAgeStrict must be true');
+assert(
+  readPnpmConfig('minimumReleaseAgeIgnoreMissingTime') === false,
+  'pnpm minimumReleaseAgeIgnoreMissingTime must be false',
+);
+assert(
+  JSON.stringify(readPnpmConfig('minimumReleaseAgeExclude')) ===
+    JSON.stringify([
+      '@modern-js/*',
+      '@bleedingdev/*',
+      '@effect/tsgo',
+      '@effect/tsgo-*',
+      '@typescript/native-preview',
+      '@typescript/native-preview-*',
+      '@cloudflare/*',
+      'miniflare',
+      'workerd',
+      'wrangler',
+    ]),
+  'pnpm minimumReleaseAgeExclude must retain framework and Cloudflare exceptions',
+);
+assert(readPnpmConfig('trustPolicy') === 'no-downgrade', 'pnpm trustPolicy must be no-downgrade');
+assert(readPnpmConfig('trustPolicyIgnoreAfter') === 1440, 'pnpm trustPolicyIgnoreAfter must be 1440');
+assert(readPnpmConfig('blockExoticSubdeps') === true, 'pnpm blockExoticSubdeps must be true');
+assert(readPnpmConfig('engineStrict') === true, 'pnpm engineStrict must be true');
+assert(readPnpmConfig('pmOnFail') === 'error', 'pnpm pmOnFail must be error');
+assert(readPnpmConfig('verifyDepsBeforeRun') === 'error', 'pnpm verifyDepsBeforeRun must be error');
+assert(readPnpmConfig('strictDepBuilds') === true, 'pnpm strictDepBuilds must be true');
+assert(
+  JSON.stringify(readPnpmConfig('peerDependencyRules')) ===
+    JSON.stringify({ allowedVersions: { react: '>=19.0.0', typescript: '>=6.0.0' } }),
+  'pnpm peerDependencyRules must allow React 19 and TypeScript 6+',
+);
+assert(
+  JSON.stringify(readPnpmConfig('overrides')) ===
+    JSON.stringify({ '@tanstack/react-router': '1.170.8', 'node-fetch': '^3.3.2' }),
+  'pnpm overrides must pin generated router and node-fetch policy',
+);
+assert(
+  JSON.stringify(readPnpmConfig('allowBuilds')) ===
+    JSON.stringify({
+      '@swc/core': true,
+      'core-js': true,
+      esbuild: true,
+      'msgpackr-extract': true,
+      sharp: true,
+      'simple-git-hooks': true,
+      workerd: true,
+    }),
+  'pnpm allowBuilds must approve only the generated workspace build dependencies',
+);
+assert(readPnpmConfig('onlyBuiltDependencies') === undefined, 'pnpm onlyBuiltDependencies must not be set');
+for (const requiredSnippet of [
+  'permissions:\n  contents: read',
+  'pull_request:',
+  'persist-credentials: false',
+  'jdx/mise-action',
+  'mise exec -- pnpm install --frozen-lockfile',
+  'mise exec -- pnpm run ultramodern:check',
+  'mise exec -- pnpm build',
+  'MODERN_PUBLIC_SITE_URL: http://localhost:8080',
+  'timeout-minutes:',
+  'egress-policy: audit',
+]) {
+  assert(
+    workflowContent.includes(requiredSnippet),
+    `Generated workspace workflow must retain ${requiredSnippet.split('\n')[0]}`,
+  );
+}
+assert(
+  !workflowContent.includes('pull_request_target'),
+  'Generated workspace workflow must not use pull_request_target',
+);
+for (const match of workflowContent.matchAll(/^\s*uses:\s*([^@\s]+)@([^\s#]+)/gmu)) {
+  const [, actionName, actionRef] = match;
+  assert(
+    /^[a-f0-9]{40}$/u.test(actionRef),
+    `Generated workspace workflow must pin ${actionName}@${actionRef} to a commit SHA`,
+  );
+}
+assert(
+  renovateConfig.dependencyDashboard === true &&
+    renovateConfig.minimumReleaseAge === '1 day' &&
+    renovateConfig.extends?.includes('helpers:pinGitHubActionDigests') &&
+    renovateConfig.packageRules?.some(
+      (rule) =>
+        rule.dependencyDashboardApproval === true && rule.matchUpdateTypes?.includes('major'),
+    ),
+  'Generated workspace Renovate config must retain dashboard, release-age, action pinning, and major-approval policy',
+);
 assert(
-  rootPackage.modernjs?.packageSource?.config ===
-    './.modernjs/ultramodern-package-source.json',
+  rootPackage.modernjs?.packageSource?.config === './.modernjs/ultramodern-package-source.json',
   'Root must point to the UltraModern package source metadata',
 );
 assert(
@@ -101,70 +352,361 @@ assert(
   'Generated shared packages must keep workspace:* links',
 );
 assert(
-  modernPackages.every(packageName =>
+  modernPackages.every((packageName) =>
     packageSource.modernPackages?.packages?.includes(packageName),
   ),
   'Package source metadata must list all Modern runtime/tooling packages',
 );
 assert(
-  expectedModernSpecifier &&
-    packageSource.modernPackages?.specifier === expectedModernSpecifier,
+  expectedModernSpecifier && packageSource.modernPackages?.specifier === expectedModernSpecifier,
   'Package source metadata must provide a Modern package specifier',
 );
+
+const requiredRootScripts = {
+  build:
+    'pnpm -r --filter "./apps/remotes/**" run build && pnpm --filter "./apps/shell-super-app" run build && pnpm ultramodern:assert-mf-types',
+  format: 'oxfmt .',
+  'format:check': 'oxfmt --check .',
+  lint: 'oxlint .',
+  'lint:fix': 'oxlint . --fix',
+  'agents:refs:check': 'node ./scripts/setup-agent-reference-repos.mjs --check',
+  'agents:refs:install': 'node ./scripts/setup-agent-reference-repos.mjs',
+  postinstall:
+    'node ./scripts/setup-agent-reference-repos.mjs && node ./scripts/bootstrap-agent-skills.mjs',
+  'skills:check': 'node ./scripts/bootstrap-agent-skills.mjs --check',
+  'skills:install': 'node ./scripts/bootstrap-agent-skills.mjs',
+  typecheck: `pnpm -r --filter "@${packageScope}/*" typecheck`,
+  'ultramodern:assert-mf-types': 'node ./scripts/assert-mf-types.mjs',
+  'ultramodern:check': 'node ./scripts/validate-ultramodern-workspace.mjs',
+};
+for (const [scriptName, scriptCommand] of Object.entries(requiredRootScripts)) {
+  assert(rootPackage.scripts?.[scriptName] === scriptCommand, `Root must expose ${scriptName}`);
+}
+assert(
+  Object.keys(rootPackage.scripts ?? {}).every((scriptName) => !scriptName.startsWith('zephyr:')),
+  'Root package must not expose custom zephyr:* lifecycle commands',
+);
+
+for (const dependency of [
+  '@effect/tsgo',
+  '@typescript/native-preview',
+  'oxfmt',
+  'oxlint',
+  'ultracite',
+]) {
+  assert(rootPackage.devDependencies?.[dependency], `Root must depend on ${dependency}`);
+}
+
+const agentsInstructions = readText('AGENTS.md');
+assert(
+  agentsInstructions.includes('UltraModern Agent Contract') &&
+    agentsInstructions.includes('Required Skill Baseline'),
+  'Root AGENTS.md must document the UltraModern agent contract',
+);
+assert(
+  skillsLock.source?.repository === 'https://github.com/rstackjs/agent-skills',
+  'Agent skills lock must retain the Rstack skill source repository',
+);
+assert(
+  skillsLock.source?.commit === rstackAgentSkillsCommit,
+  'Agent skills lock must pin the expected Rstack skill commit',
+);
+assert(
+  skillsLock.installDir === '.agents/skills',
+  'Agent skills lock must use .agents/skills as installDir',
+);
+assert(
+  agentReferenceRepos.defaultEnabled === true,
+  'Agent reference repositories must be enabled by default',
+);
+assert(
+  agentReferenceRepos.strategy === 'git-subtree-squash',
+  'Agent reference repositories must use git subtree squash strategy',
+);
+assert(
+  agentReferenceRepos.repositories?.some(
+    (repo) =>
+      repo.id === 'effect' &&
+      repo.url === 'https://github.com/Effect-TS/effect.git' &&
+      repo.path === 'repos/effect',
+  ),
+  'Agent reference repositories must include Effect',
+);
+assert(
+  agentReferenceRepos.repositories?.some(
+    (repo) =>
+      repo.id === 'ultramodern-js' &&
+      repo.url === 'https://github.com/BleedingDev/ultramodern.js.git' &&
+      repo.path === 'repos/ultramodern.js',
+  ),
+  'Agent reference repositories must include UltraModern.js',
+);
 assert(
-  rootPackage.scripts?.['ultramodern:check'] ===
-    'node ./scripts/validate-ultramodern-workspace.mjs',
-  'Root must expose the ultramodern:check script',
+  readText('scripts/setup-agent-reference-repos.mjs').includes(
+    'ULTRAMODERN_SKIP_AGENT_REPOS',
+  ),
+  'Agent reference repository setup must expose an opt-out environment variable',
+);
+assert(
+  readText('scripts/setup-agent-reference-repos.mjs').includes('git-subtree-dir'),
+  'Agent reference repository setup must validate git subtree evidence',
+);
+for (const skillName of baselineAgentSkills) {
+  assert(
+    skillsLock.baseline?.some((skill) => skill.name === skillName),
+    `Agent skills lock must include ${skillName}`,
+  );
+  assert(
+    readText(`.agents/skills/${skillName}/SKILL.md`).includes(`name: ${skillName}`),
+    `${skillName} must contain matching skill metadata`,
+  );
+}
+
+const privateSource = skillsLock.sources?.find(
+  (source) => source.repository === 'https://github.com/TechsioCZ/skills',
+);
+const moduleFederationSource = skillsLock.sources?.find(
+  (source) => source.repository === 'https://github.com/module-federation/agent-skills',
+);
+assert(
+  moduleFederationSource?.install === 'clone' &&
+    moduleFederationSource.commit === moduleFederationAgentSkillsCommit,
+  'Agent skills lock must configure the public Module Federation skill source as a pinned clone',
 );
+for (const skillName of moduleFederationAgentSkills) {
+  assert(
+    skillsLock.baseline?.some((skill) => skill.name === skillName) &&
+      moduleFederationSource.baseline?.some((skill) => skill.name === skillName),
+    `Agent skills lock must require Module Federation skill ${skillName}`,
+  );
+  assert(
+    agentsInstructions.includes(`\`${skillName}\``) &&
+      agentsInstructions.includes('module-federation/agent-skills'),
+    `Root AGENTS.md must document required Module Federation skill ${skillName}`,
+  );
+}
+assert(
+  privateSource?.install === 'clone-if-authorized',
+  'Agent skills lock must configure TechsioCZ skills as clone-if-authorized',
+);
+for (const skillName of privateAgentSkills) {
+  assert(
+    privateSource.baseline?.some((skill) => skill.name === skillName),
+    `Agent skills lock must allowlist private skill ${skillName}`,
+  );
+}
 
 const appPackagePaths = [
   'apps/shell-super-app/package.json',
   'apps/remotes/remote-commerce/package.json',
   'apps/remotes/remote-identity/package.json',
-  'apps/remotes/remote-design-system/package.json',
+  `${designSystemRemotePath}/package.json`,
 ];
 
+const expectedZephyrDependencies = {
+  commerce: `@${packageScope}/remote-commerce@workspace:*`,
+  identity: `@${packageScope}/remote-identity@workspace:*`,
+  designSystem: `@${packageScope}/remote-design-system@workspace:*`,
+};
+
 for (const packagePath of appPackagePaths) {
   const packageJson = readJson(packagePath);
+  const isRemote = packagePath.includes('/remotes/');
+  const fullStackVertical = fullStackVerticals.find(
+    (vertical) => `${vertical.path}/package.json` === packagePath,
+  );
+  assert(packageJson.scripts?.dev === 'modern dev', `${packagePath} must use vanilla modern dev`);
+  assert(
+    packageJson.scripts?.build ===
+      (isRemote
+        ? 'modern build && node ../../../scripts/assert-mf-types.mjs'
+        : 'modern build'),
+    `${packagePath} must enforce Module Federation DTS on remote builds`,
+  );
+  assert(packageJson.scripts?.serve === 'modern serve', `${packagePath} must use vanilla modern serve`);
+  assert(
+    Object.keys(packageJson.scripts ?? {}).every((scriptName) => !scriptName.startsWith('zephyr:')),
+    `${packagePath} must not expose custom zephyr:* lifecycle commands`,
+  );
+  assert(
+    packageJson['zephyr:dependencies'] &&
+      typeof packageJson['zephyr:dependencies'] === 'object' &&
+      !Array.isArray(packageJson['zephyr:dependencies']),
+    `${packagePath} must declare zephyr:dependencies for deterministic Zephyr dependency extraction`,
+  );
+  if (isRemote) {
+    assert(
+      Object.keys(packageJson['zephyr:dependencies']).length === 0,
+      `${packagePath} must declare an empty zephyr:dependencies map until it consumes remotes`,
+    );
+  } else {
+    assert(
+      JSON.stringify(packageJson['zephyr:dependencies']) ===
+        JSON.stringify(expectedZephyrDependencies),
+      `${packagePath} must map shell remote aliases to Zephyr workspace remote package dependencies`,
+    );
+  }
   assert(
     packageJson.dependencies?.['@modern-js/plugin-tanstack'] ===
       expectedModernDependency('@modern-js/plugin-tanstack'),
-    `${packagePath} must depend on @modern-js/plugin-tanstack through ${expectedModernDependency('@modern-js/plugin-tanstack')}`,
+    `${packagePath} must use @modern-js/plugin-tanstack through ${expectedModernDependency(
+      '@modern-js/plugin-tanstack',
+    )}`,
+  );
+  assert(
+    packageJson.dependencies?.['@modern-js/plugin-i18n'] ===
+      expectedModernDependency('@modern-js/plugin-i18n'),
+    `${packagePath} must use @modern-js/plugin-i18n through ${expectedModernDependency(
+      '@modern-js/plugin-i18n',
+    )}`,
   );
   assert(
     packageJson.dependencies?.['@modern-js/runtime'] ===
       expectedModernDependency('@modern-js/runtime'),
-    `${packagePath} must depend on @modern-js/runtime through ${expectedModernDependency('@modern-js/runtime')}`,
+    `${packagePath} must use @modern-js/runtime through ${expectedModernDependency(
+      '@modern-js/runtime',
+    )}`,
   );
   assert(
     packageJson.devDependencies?.['@modern-js/app-tools'] ===
       expectedModernDependency('@modern-js/app-tools'),
-    `${packagePath} must depend on @modern-js/app-tools through ${expectedModernDependency('@modern-js/app-tools')}`,
+    `${packagePath} must use @modern-js/app-tools through ${expectedModernDependency(
+      '@modern-js/app-tools',
+    )}`,
+  );
+  assert(
+    packageJson.devDependencies?.typescript === '6.0.3',
+    `${packagePath} must include TypeScript 6 only as the stable JS TypeScript package for Module Federation DTS generation`,
+  );
+  assert(
+    packageJson.devDependencies?.['@typescript/native-preview'] === '7.0.0-dev.20260527.2',
+    `${packagePath} must include TypeScript 7 native preview for mandatory native typechecking`,
   );
   assert(
-    packageJson.dependencies?.[`@${packageScope}/shared-contracts`] ===
-      'workspace:*',
+    packageJson.devDependencies?.['zephyr-rspack-plugin'] === '1.1.1',
+    `${packagePath} must install the Zephyr Rspack plugin used by the Modern.js bridge`,
+  );
+  assert(
+    packageJson.devDependencies?.['zephyr-modernjs-plugin'] === undefined,
+    `${packagePath} must not install the inactive Zephyr Modern.js wrapper`,
+  );
+  assert(
+    packageJson.dependencies?.[`@${packageScope}/shared-contracts`] === 'workspace:*',
     `${packagePath} must link generated shared contracts through workspace:*`,
   );
   assert(
-    packageJson.dependencies?.[`@${packageScope}/shared-design-tokens`] ===
-      'workspace:*',
+    packageJson.dependencies?.[`@${packageScope}/shared-design-tokens`] === 'workspace:*',
     `${packagePath} must link generated shared design tokens through workspace:*`,
   );
+  assert(
+    packageJson.dependencies?.['node-fetch'] === '^3.3.2',
+    `${packagePath} must satisfy the Module Federation SDK node-fetch peer`,
+  );
   assert(
     packageJson.dependencies?.['@tanstack/react-router'] === tanstackVersion,
     `${packagePath} must use @tanstack/react-router ${tanstackVersion}`,
   );
   assert(
-    packageJson.dependencies?.['@module-federation/modern-js-v3'] === '2.4.0',
+    packageJson.dependencies?.i18next === '26.2.0',
+    `${packagePath} must include i18next for mandatory native Modern.js i18n`,
+  );
+  assert(
+    !packageJson.dependencies?.['react-i18next'],
+    `${packagePath} must use native @modern-js/plugin-i18n hooks instead of react-i18next in the TanStack MF starter`,
+  );
+  assert(
+    packageJson.dependencies?.['@module-federation/modern-js-v3'] === '2.5.0',
     `${packagePath} must include the Module Federation plugin`,
   );
+  if (fullStackVertical) {
+    assert(
+      packageJson.dependencies?.['@modern-js/plugin-bff'] ===
+        expectedModernDependency('@modern-js/plugin-bff'),
+      `${packagePath} must use @modern-js/plugin-bff through ${expectedModernDependency(
+        '@modern-js/plugin-bff',
+      )}`,
+    );
+    assert(
+      packageJson.exports?.['./effect/client'] ===
+        `./src/effect/${fullStackVertical.stem}-client.ts` &&
+        packageJson.exports?.['./shared/effect/api'] === './shared/effect/api.ts',
+      `${packagePath} must expose its vertical-owned Effect client and contract surface`,
+    );
+  }
+  if (packagePath === `${designSystemRemotePath}/package.json`) {
+    assert(
+      !packageJson.dependencies?.['@modern-js/plugin-bff'],
+      'Design-system remote must remain FE-only and must not depend on @modern-js/plugin-bff',
+    );
+    assert(
+      !packageJson.exports?.['./effect/client'] && !packageJson.exports?.['./shared/effect/api'],
+      'Design-system remote must not expose Effect client or contract exports',
+    );
+  }
+  if (tailwindEnabled) {
+    assert(
+      packageJson.devDependencies?.tailwindcss === tailwindVersion,
+      `${packagePath} must include Tailwind CSS ${tailwindVersion}`,
+    );
+    assert(
+      packageJson.devDependencies?.['@tailwindcss/postcss'] === tailwindPostcssVersion,
+      `${packagePath} must include @tailwindcss/postcss ${tailwindPostcssVersion}`,
+    );
+    assert(
+      packageJson.devDependencies?.postcss === '^8.5.6',
+      `${packagePath} must include PostCSS for Tailwind CSS`,
+    );
+  } else {
+    assert(!packageJson.devDependencies?.tailwindcss, `${packagePath} must not include Tailwind CSS`);
+    assert(
+      !packageJson.devDependencies?.['@tailwindcss/postcss'],
+      `${packagePath} must not include @tailwindcss/postcss`,
+    );
+  }
   assert(
     packageJson.modernjs?.preset === 'presetUltramodern',
     `${packagePath} must keep presetUltramodern metadata`,
   );
 }
 
+for (const federationConfigPath of [
+  'apps/shell-super-app/module-federation.config.ts',
+  'apps/remotes/remote-commerce/module-federation.config.ts',
+  'apps/remotes/remote-identity/module-federation.config.ts',
+  'apps/remotes/remote-design-system/module-federation.config.ts',
+]) {
+  const federationConfig = readText(federationConfigPath);
+  assert(
+    federationConfig.includes('compilerInstance:') &&
+      federationConfig.includes("'--package typescript -- tsc'") &&
+      federationConfig.includes('displayErrorInTerminal: true') &&
+      !federationConfig.includes('dts: false'),
+    `${federationConfigPath} must keep strict Module Federation DTS enabled`,
+  );
+}
+
+for (const appDirectory of [
+  'apps/shell-super-app',
+  'apps/remotes/remote-commerce',
+  'apps/remotes/remote-identity',
+  'apps/remotes/remote-design-system',
+]) {
+  if (tailwindEnabled) {
+    assertExists(`${appDirectory}/postcss.config.mjs`);
+    assertExists(`${appDirectory}/tailwind.config.ts`);
+  }
+  if (!tailwindEnabled) {
+    assert(
+      !fs.existsSync(path.join(root, appDirectory, 'postcss.config.mjs')),
+      `${appDirectory} must not write PostCSS config when Tailwind is disabled`,
+    );
+    assert(
+      !fs.existsSync(path.join(root, appDirectory, 'tailwind.config.ts')),
+      `${appDirectory} must not write Tailwind config when Tailwind is disabled`,
+    );
+  }
+}
+
 for (const configPath of [
   'apps/shell-super-app/modern.config.ts',
   'apps/remotes/remote-commerce/modern.config.ts',
@@ -173,90 +715,177 @@ for (const configPath of [
 ]) {
   const config = readText(configPath);
   assert(config.includes('presetUltramodern('), `${configPath} must use presetUltramodern`);
+  assert(config.includes('ULTRAMODERN_SITE_URL'), `${configPath} must expose site URL metadata`);
+  assert(
+    config.includes('MODERN_PUBLIC_SITE_URL must be set for production builds'),
+    `${configPath} must require MODERN_PUBLIC_SITE_URL for production builds`,
+  );
   assert(config.includes('tanstackRouterPlugin()'), `${configPath} must enable plugin-tanstack`);
-  assert(config.includes('moduleFederationPlugin()'), `${configPath} must enable Module Federation`);
+  assert(config.includes('i18nPlugin('), `${configPath} must enable native Modern.js i18n`);
+  assert(
+    config.includes('reactI18next: false'),
+    `${configPath} must use the native Modern.js i18n provider without optional react-i18next probing`,
+  );
+  assert(
+    config.includes("publicDir: './locales'"),
+    `${configPath} must expose app-owned locale JSON through Modern.js publicDir`,
+  );
+  assert(
+    config.includes('moduleFederationPlugin()'),
+    `${configPath} must enable Module Federation`,
+  );
+  assert(
+    config.includes("mode: 'stream'") &&
+      config.includes('moduleFederationAppSSR: true'),
+    `${configPath} must use streaming Module Federation SSR`,
+  );
+  assert(
+    config.includes("html: './'"),
+    `${configPath} must keep Modern.js output.distPath.html compatible with Zephyr`,
+  );
+  assert(
+    config.includes("outputStructure: 'flat'"),
+    `${configPath} must keep Modern.js HTML output flat for Zephyr`,
+  );
+  assert(
+    config.includes("mainEntryName: 'index'"),
+    `${configPath} must keep Modern.js source.mainEntryName compatible with Zephyr`,
+  );
 }
 
 const shellMf = readText('apps/shell-super-app/module-federation.config.ts');
 assert(shellMf.includes("name: 'shellSuperApp'"), 'Shell MF config must name the shell');
-assert(shellMf.includes('remoteCommerce@http://localhost:3021/mf-manifest.json'), 'Shell must reference commerce remote');
-assert(shellMf.includes('remoteIdentity@http://localhost:3022/mf-manifest.json'), 'Shell must reference identity remote');
-assert(shellMf.includes('remoteDesignSystem@http://localhost:3023/mf-manifest.json'), 'Shell must reference design-system remote');
-
-const commerceMf = readText('apps/remotes/remote-commerce/module-federation.config.ts');
-assert(commerceMf.includes("name: 'remoteCommerce'"), 'Commerce remote MF name is missing');
-assert(commerceMf.includes('"./Widget"'), 'Commerce remote must expose a widget');
-
-const designMf = readText('apps/remotes/remote-design-system/module-federation.config.ts');
-assert(designMf.includes("name: 'remoteDesignSystem'"), 'Design-system remote MF name is missing');
-assert(designMf.includes('"./Button"'), 'Design-system remote must expose Button');
-assert(designMf.includes('"./tokens"'), 'Design-system remote must expose tokens');
-
-const servicePackage = readJson('services/service-recommendations-effect/package.json');
 assert(
-  servicePackage.dependencies?.['@modern-js/runtime'] ===
-    expectedModernDependency('@modern-js/runtime'),
-  `Effect service must use @modern-js/runtime through ${expectedModernDependency('@modern-js/runtime')}`,
+  shellMf.includes("'react-dom/client'"),
+  'Shell MF config must share react-dom/client explicitly',
+);
+assert(
+  shellMf.includes('remoteCommerce@http://localhost:3021/mf-manifest.json'),
+  'Shell must reference commerce remote',
+);
+assert(
+  shellMf.includes('remoteIdentity@http://localhost:3022/mf-manifest.json'),
+  'Shell must reference identity remote',
 );
 assert(
-  servicePackage.devDependencies?.['@modern-js/app-tools'] ===
-    expectedModernDependency('@modern-js/app-tools'),
-  `Effect service must use @modern-js/app-tools through ${expectedModernDependency('@modern-js/app-tools')}`,
+  shellMf.includes('remoteDesignSystem@http://localhost:3023/mf-manifest.json'),
+  'Shell must reference design-system remote',
 );
+
+const shellPackage = readJson('apps/shell-super-app/package.json');
 assert(
-  servicePackage.devDependencies?.['@modern-js/plugin-bff'] ===
+  shellPackage.dependencies?.['@modern-js/plugin-bff'] ===
     expectedModernDependency('@modern-js/plugin-bff'),
-  `Effect service must use @modern-js/plugin-bff through ${expectedModernDependency('@modern-js/plugin-bff')}`,
+  `Shell must use @modern-js/plugin-bff through ${expectedModernDependency(
+    '@modern-js/plugin-bff',
+  )}`,
 );
 assert(
-  servicePackage.dependencies?.[`@${packageScope}/shared-effect-api`] ===
-    'workspace:*',
-  'Effect service must link generated shared Effect API through workspace:*',
+  !shellPackage.dependencies?.[`@${packageScope}/shared-effect-api`],
+  'Shell must not depend on shared-effect-api for default vertical-owned APIs',
 );
 
-const serviceConfig = readText('services/service-recommendations-effect/modern.config.ts');
-assert(serviceConfig.includes("runtimeFramework: 'effect'"), 'Effect service must use Effect runtime');
-assert(serviceConfig.includes('bffPlugin()'), 'Effect service must enable bffPlugin');
+const generatedContract = readJson('.modernjs/ultramodern-generated-contract.json');
+assert(
+  generatedContract.profile === 'cloudflare-ssr-mf-effect-v1',
+  'Generated contract must select the Cloudflare SSR MF Effect profile',
+);
+assert(
+  generatedContract.packageManager?.manager === 'pnpm' &&
+    generatedContract.packageManager?.version === expectedPnpmVersion &&
+    generatedContract.packageManager?.toolchain === 'mise',
+  'Generated contract must declare the pnpm 11/mise toolchain policy',
+);
 
-const serviceEntry = readText('services/service-recommendations-effect/api/effect/index.ts');
-assert(serviceEntry.includes('defineEffectBff'), 'Effect service must expose defineEffectBff placeholder');
-assert(serviceEntry.includes('recommendationsEffectApi'), 'Effect service must use shared recommendations API');
+for (const vertical of fullStackVerticals) {
+  const contractEntry = generatedContract.apps?.find((app) => app.id === vertical.id);
+  assert(
+    contractEntry?.deploy?.target === 'cloudflare' &&
+      contractEntry?.deploy?.worker?.ssr === true &&
+      contractEntry?.deploy?.output?.flat === true &&
+      contractEntry?.deploy?.output?.htmlDistPath === './' &&
+      contractEntry?.ssr?.mode === 'stream' &&
+      contractEntry?.ssr?.moduleFederationAppSSR === true &&
+      contractEntry?.i18n?.plugin === '@modern-js/plugin-i18n' &&
+      contractEntry?.i18n?.languages?.includes('en') &&
+      contractEntry?.i18n?.languages?.includes('cs') &&
+      contractEntry?.moduleFederation?.name === vertical.mfName &&
+      contractEntry?.moduleFederation?.exposes?.includes('./Widget') &&
+      contractEntry?.moduleFederation?.exposes?.includes('./Route') &&
+      contractEntry?.moduleFederation?.browserSafeExposesOnly === true &&
+      contractEntry?.effect?.runtime === 'effect' &&
+      contractEntry?.effect?.import === '@modern-js/plugin-bff/effect-edge' &&
+      contractEntry?.effect?.prefix === vertical.apiPrefix &&
+      contractEntry?.effect?.workerEntry === 'worker/__modern_bff_effect.js' &&
+      contractEntry?.marker?.appId === vertical.id &&
+      contractEntry?.marker?.deployProfile === 'cloudflare-ssr-mf-effect-v1' &&
+      contractEntry?.marker?.uiSurface === 'ui' &&
+      contractEntry?.marker?.apiSurface === 'effect-bff',
+    `${vertical.id} generated contract must describe Cloudflare SSR, MF, i18n, Effect BFF, and marker metadata`,
+  );
+}
 
-const serviceApi = readText('services/service-recommendations-effect/shared/effect/api.ts');
-assert(serviceApi.includes('HttpApi.make'), 'Effect shared API placeholder must define HttpApi');
+const designMf = readText('apps/remotes/remote-design-system/module-federation.config.ts');
+assert(designMf.includes("name: 'remoteDesignSystem'"), 'Design-system remote MF name is missing');
+assert(
+  designMf.includes("'react-dom/client'"),
+  'Design-system remote MF config must share react-dom/client explicitly',
+);
+assert(designMf.includes("'./Button'"), 'Design-system remote must expose Button');
+assert(designMf.includes("'./tokens'"), 'Design-system remote must expose tokens');
+const sharedEffectApi = readText('packages/shared-effect-api/src/index.ts');
+assert(
+  !sharedEffectApi.includes('recommendationsEffectApi') &&
+    !sharedEffectApi.includes('commerceEffectApi') &&
+    !sharedEffectApi.includes('identityEffectApi'),
+  'Shared Effect API package must not own default vertical API contracts',
+);
 
 const topology = readJson('topology/reference-topology.json');
 assert(topology.preset === 'presetUltramodern', 'Topology must reference presetUltramodern');
 assert(topology.shell?.id === 'shell-super-app', 'Topology shell id is incorrect');
 assert(topology.shell?.remoteRefs?.length === 3, 'Topology shell must reference three remotes');
 assert(topology.remotes?.length === 3, 'Topology must contain three remotes');
+for (const vertical of fullStackVerticals) {
+  const topologyEntry = topology.remotes.find((remote) => remote.id === vertical.id);
+  assert(topologyEntry?.kind === 'vertical', `${vertical.id} must be a vertical topology entry`);
+  assert(
+    topologyEntry?.moduleFederation?.manifestUrl?.includes('/mf-manifest.json') &&
+      topologyEntry?.api?.effect?.runtime === 'effect' &&
+      topologyEntry?.api?.effect?.bff?.prefix === vertical.apiPrefix &&
+      topologyEntry?.api?.effect?.bff?.openapi === '/openapi.json' &&
+      topologyEntry?.api?.effect?.contract?.export === './shared/effect/api' &&
+      topologyEntry?.api?.effect?.client?.export === './effect/client' &&
+      topologyEntry?.api?.effect?.serverEntry === `${vertical.path}/api/effect/index.ts`,
+    `${vertical.id} topology entry must include both Module Federation and Effect API metadata`,
+  );
+}
 assert(
   topology.remotes.some(
-    remote =>
-      remote.id === 'remote-design-system' &&
-      remote.kind === 'horizontal-design-system',
+    (remote) => remote.id === 'remote-design-system' && remote.kind === 'horizontal-design-system',
   ),
   'Topology must contain the horizontal design-system remote',
 );
-assert(topology.effectServices?.[0]?.runtime === 'effect', 'Topology must contain an Effect service');
+assert(
+  (topology.effectServices ?? []).length === 0,
+  'Default vertical-owned APIs must not be generated as topology.effectServices',
+);
 assert(topology.sharedPackages?.length === 3, 'Topology must contain shared package placeholders');
 
 const ownership = readJson('topology/ownership.json');
 assert(
   ownership.owners?.some(
-    owner =>
-      owner.id === 'remote-commerce' &&
-      owner.ownership?.team === 'commerce-experience',
+    (owner) => owner.id === 'remote-commerce' && owner.ownership?.team === 'commerce-experience',
   ),
   'Ownership metadata must retain commerce owner',
 );
 assert(
-  ownership.owners?.some(
-    owner =>
-      owner.id === 'service-recommendations-effect' &&
-      owner.package === `@${packageScope}/service-recommendations-effect`,
+  !ownership.owners?.some(
+    (owner) =>
+      owner.id === 'service-recommendations-effect' ||
+      owner.path === 'services/service-recommendations-effect',
   ),
-  'Ownership metadata must retain Effect service owner',
+  'Ownership metadata must not retain the old default recommendations service owner',
 );
 
 const manifest = readJson('.modernjs/ultramodern-workspace-template-manifest.json');
@@ -269,8 +898,47 @@ assert(
   'Template manifest must retain the generated package source strategy',
 );
 assert(
-  manifest.validation?.expectedCommands?.includes('pnpm run ultramodern:check'),
+  manifest.agentSkills?.source?.commit === rstackAgentSkillsCommit,
+  'Template manifest must retain the Rstack agent skills commit',
+);
+assert(
+  baselineAgentSkills.every((skillName) => manifest.agentSkills?.baseline?.includes(skillName)),
+  'Template manifest must list every baseline agent skill',
+);
+assert(
+  manifest.agentSkills?.moduleFederationSource?.repository ===
+    'https://github.com/module-federation/agent-skills' &&
+    manifest.agentSkills?.moduleFederationSource?.commit ===
+      moduleFederationAgentSkillsCommit,
+  'Template manifest must retain the Module Federation agent skill source',
+);
+assert(
+  moduleFederationAgentSkills.every((skillName) =>
+    manifest.agentSkills?.moduleFederationSource?.baseline?.includes(skillName),
+  ),
+  'Template manifest must list every Module Federation agent skill entry',
+);
+assert(
+  manifest.agentSkills?.privateSource?.repository === 'https://github.com/TechsioCZ/skills',
+  'Template manifest must retain the private TechsioCZ skill source',
+);
+assert(
+  privateAgentSkills.every((skillName) =>
+    manifest.agentSkills?.privateSource?.baseline?.includes(skillName),
+  ),
+  'Template manifest must list every private agent skill allowlist entry',
+);
+assert(
+  manifest.validation?.expectedCommands?.includes('mise exec -- pnpm run ultramodern:check'),
   'Template manifest must document the validation command',
 );
+assert(
+  manifest.validation?.postMaterializationValidation?.includes('pnpm-11-policy-enforced'),
+  'Template manifest must document pnpm 11 policy validation',
+);
+assert(
+  manifest.validation?.postMaterializationValidation?.includes('github-workflow-security-enforced'),
+  'Template manifest must document generated workflow security validation',
+);
 
 console.log('UltraModern workspace scaffold validated');