@bleedingdev/modern-js-create 3.2.0-ultramodern.5 → 3.2.0-ultramodern.50

package/dist/types/locale/en.d.ts

@@ -35,6 +35,7 @@ export declare const EN_LOCALE: {
         optionUltramodernPackageSource: string;
         optionUltramodernPackageScope: string;
         optionUltramodernPackageNamePrefix: string;
+        optionMicroVertical: string;
         optionSub: string;
         examples: string;
         example1: string;
@@ -47,6 +48,7 @@ export declare const EN_LOCALE: {
         example8: string;
         example9: string;
         example10: string;
+        example11: string;
         moreInfo: string;
     };
     version: {

package/dist/types/locale/zh.d.ts

@@ -35,6 +35,7 @@ export declare const ZH_LOCALE: {
         optionUltramodernPackageSource: string;
         optionUltramodernPackageScope: string;
         optionUltramodernPackageNamePrefix: string;
+        optionMicroVertical: string;
         optionSub: string;
         examples: string;
         example1: string;
@@ -47,6 +48,7 @@ export declare const ZH_LOCALE: {
         example8: string;
         example9: string;
         example10: string;
+        example11: string;
         moreInfo: string;
     };
     version: {

package/dist/types/ultramodern-workspace.d.ts

@@ -1,8 +1,10 @@
+export type MicroVerticalKind = 'remote' | 'horizontal-remote' | 'service' | 'shared';
 type UltramodernPackageSourceStrategy = 'workspace' | 'install';
 export type UltramodernWorkspaceOptions = {
     targetDir: string;
     packageName: string;
     modernVersion: string;
+    enableTailwind?: boolean;
     packageSource?: {
         strategy?: UltramodernPackageSourceStrategy;
         modernPackageVersion?: string;
@@ -11,10 +13,21 @@ export type UltramodernWorkspaceOptions = {
         aliasPackageNamePrefix?: string;
     };
 };
+export type AddUltramodernMicroVerticalOptions = {
+    workspaceRoot: string;
+    name: string;
+    kind: MicroVerticalKind;
+    modernVersion: string;
+    enableTailwind?: boolean;
+    packageSource?: UltramodernWorkspaceOptions['packageSource'];
+};
 export declare const ULTRAMODERN_WORKSPACE_FLAG = "--ultramodern-workspace";
+export declare function addUltramodernMicroVertical(options: AddUltramodernMicroVerticalOptions): void;
 export declare function generateUltramodernWorkspace(options: UltramodernWorkspaceOptions): void;
 export declare const ultramodernWorkspaceVersions: {
     tanstackRouter: string;
     moduleFederation: string;
+    tailwind: string;
+    tailwindPostcss: string;
 };
 export {};

package/package.json

@@ -21,7 +21,7 @@
   "engines": {
     "node": ">=20"
   },
-  "version": "3.2.0-ultramodern.5",
+  "version": "3.2.0-ultramodern.50",
   "types": "./dist/types/index.d.ts",
   "main": "./dist/index.js",
   "bin": {
@@ -38,10 +38,10 @@
   ],
   "devDependencies": {
     "@rslib/core": "0.21.5",
-    "@types/node": "^25.8.0",
-    "@typescript/native-preview": "7.0.0-dev.20260516.1",
-    "tsx": "^4.22.0",
-    "@modern-js/i18n-utils": "npm:@bleedingdev/modern-js-i18n-utils@3.2.0-ultramodern.5"
+    "@types/node": "^25.9.1",
+    "@typescript/native-preview": "7.0.0-dev.20260527.2",
+    "tsx": "^4.22.3",
+    "@modern-js/i18n-utils": "npm:@bleedingdev/modern-js-i18n-utils@3.2.0-ultramodern.50"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",
@@ -52,5 +52,8 @@
     "build": "rslib build && pnpm -w tsgo:dts \"$PWD\"",
     "dev": "rslib build -w",
     "start": "node ./dist/index.js"
+  },
+  "ultramodern": {
+    "frameworkVersion": "3.2.0-ultramodern.50"
   }
 }

package/template/.agents/skills-lock.json

@@ -0,0 +1,34 @@
+{
+  "schemaVersion": 2,
+  "installDir": ".agents/skills",
+  "sources": [
+    {
+      "id": "techsiocz-private",
+      "visibility": "private",
+      "repository": "https://github.com/TechsioCZ/skills",
+      "install": "clone-if-authorized",
+      "baseline": [
+        {
+          "name": "plan-graph",
+          "reason": "Build and validate DAGs from .plan.md files"
+        },
+        {
+          "name": "dag",
+          "reason": "Inspect current plan frontiers and blocked lanes"
+        },
+        {
+          "name": "subagent-graph",
+          "reason": "Design dependency-aware multi-agent launch graphs"
+        },
+        {
+          "name": "helm",
+          "reason": "Steer already-running multi-agent work"
+        },
+        {
+          "name": "debugger-mode",
+          "reason": "Run hypothesis-driven debugging with runtime evidence"
+        }
+      ]
+    }
+  ]
+}

package/template/.github/renovate.json

@@ -0,0 +1,53 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended",
+    "helpers:pinGitHubActionDigests"
+  ],
+  "dependencyDashboard": true,
+  "minimumReleaseAge": "1 day",
+  "prConcurrentLimit": 5,
+  "prHourlyLimit": 2,
+  "rangeStrategy": "bump",
+  "schedule": [
+    "before 5am on monday"
+  ],
+  "timezone": "Etc/UTC",
+  "packageRules": [
+    {
+      "matchManagers": [
+        "github-actions"
+      ],
+      "groupName": "github-actions",
+      "labels": [
+        "dependencies",
+        "github-actions",
+        "security"
+      ]
+    },
+    {
+      "matchManagers": [
+        "npm"
+      ],
+      "matchUpdateTypes": [
+        "patch",
+        "minor"
+      ],
+      "groupName": "npm minor and patch updates",
+      "labels": [
+        "dependencies",
+        "npm"
+      ]
+    },
+    {
+      "matchUpdateTypes": [
+        "major"
+      ],
+      "dependencyDashboardApproval": true,
+      "labels": [
+        "dependencies",
+        "major"
+      ]
+    }
+  ]
+}

package/template/.github/workflows/ultramodern-gates.yml.handlebars

@@ -4,27 +4,51 @@ on:
   push:
   pull_request:
 
+permissions:
+  contents: read
+
+defaults:
+  run:
+    shell: bash
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+concurrency:
+  group: ultramodern-gates-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   ultramodern-gates:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
+      - name: Harden Runner
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2
+        with:
+          egress-policy: audit
 
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 1
+          persist-credentials: false
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: 20
-          cache: pnpm
+          node-version: 24
+
+      - name: Setup mise
+        uses: jdx/mise-action@5ac50f778e26fac95da98d50503682459e86d566 # v3.2.0
 
       - name: Install Dependencies
-        run: pnpm install
+        run: mise exec -- pnpm install --frozen-lockfile
 
       - name: Validate Ultramodern Contract
-        run: pnpm run ultramodern:check
+        run: mise exec -- pnpm run ultramodern:check
 
       - name: Build
-        run: pnpm run build
+        env:
+          MODERN_PUBLIC_SITE_URL: http://localhost:8080
+        run: mise exec -- pnpm run build

package/template/.mise.toml.handlebars

@@ -0,0 +1,2 @@
+[tools]
+pnpm = "{{pnpmVersion}}"

package/template/AGENTS.md

@@ -0,0 +1,27 @@
+# UltraModern Agent Contract
+
+This project is generated for Codex-first UltraModern.js work.
+
+## Quality Gates
+
+- `pnpm lint` runs Oxlint with the Ultracite preset.
+- `pnpm format` runs oxfmt.
+- `pnpm typecheck` runs effect-tsgo as the TypeScript checker.
+- `pnpm i18n:check` rejects hardcoded user-visible JSX text.
+- `mise exec -- pnpm ultramodern:check` verifies the generated contract.
+
+## Internationalization
+
+Runtime i18n is enabled by default. Agents must put user-visible UI copy in `config/public/locales/<lang>/translation.json` and render it through `react-i18next` or `@modern-js/plugin-i18n/runtime`. Do not add hardcoded JSX text, `aria-label`, `title`, `alt`, or `placeholder` strings unless the value is a non-translatable technical token.
+
+Routes are locale-prefixed by default through `localePathRedirect: true`. Keep localized pages under `src/routes/[lang]`, use links for language switching, and preserve canonical plus `hreflang` metadata. Production builds fail unless `MODERN_PUBLIC_SITE_URL` is set, so deployed canonical URLs always use the production origin.
+
+## Private Skills
+
+Private orchestration skills are not vendored into this template. If you are authorized for `TechsioCZ/skills`, run:
+
+```bash
+pnpm skills:install
+```
+
+The installer clones that private repository and copies only the allowlisted skills from `.agents/skills-lock.json`.

package/template/README.md

@@ -1,11 +1,26 @@
 # UltraModern.js 3.0 Starter
 
+This generated workspace is the Tractor reference SuperApp. It is built around
+one shell and three full-stack Micro Verticals:
+
+| Package | Boundary |
+| --- | --- |
+| `apps/shell-super-app` | Module Federation host, route assembly, topology selection, shell fallback policy |
+| `apps/remotes/remote-explore` | Explore routes, MF exposes, locale JSON, CSS layer, and `/explore-api/effect/explore/*` |
+| `apps/remotes/remote-decide` | Decide routes, MF exposes, locale JSON, CSS layer, and `/decide-api/effect/decide/*` |
+| `apps/remotes/remote-checkout` | Checkout routes, MF exposes, locale JSON, CSS layer, and `/checkout-api/effect/checkout/*` |
+
+Each vertical is a one-package ownership boundary. Its UI, Effect BFF contract,
+generated client, `localisedUrls`, dynamic locale JSON, CSS, MF manifest, and
+Cloudflare Worker output must move together for version-switching proof.
+
 ## Setup
 
 Install the dependencies:
 
 ```bash
-pnpm install
+mise install
+mise exec -- pnpm install
 ```
 
 ## Get Started
@@ -13,19 +28,27 @@ pnpm install
 Start the dev server:
 
 ```bash
-pnpm dev
+mise exec -- pnpm dev
 ```
 
 Build the app for production:
 
 ```bash
-pnpm build
+mise exec -- pnpm build
 ```
 
 Validate the generated Ultramodern preset contract locally:
 
 ```bash
-pnpm run ultramodern:check
+mise exec -- pnpm run ultramodern:check
+```
+
+Run the normal local gates before treating the scaffold as adoption-ready:
+
+```bash
+mise exec -- pnpm run check
+mise exec -- pnpm run build
+mise exec -- pnpm run cloudflare:build
 ```
 
 The generated preset defaults are opt-out. Disable specific contracts via env vars:
@@ -36,20 +59,25 @@ MODERN_BASELINE_ENABLE_BFF_REQUEST_ID=false
 MODERN_BASELINE_ENABLE_TELEMETRY_EXPORTERS=false
 ```
 
-The generated starter also includes `.github/workflows/ultramodern-gates.yml`.
-That workflow runs `pnpm run ultramodern:check` and `pnpm run build` on every
-push and pull request so the `presetUltramodern(...)` contract stays explicit.
+The generated starter also includes `.github/workflows/ultramodern-gates.yml`
+and `.github/renovate.json`. The workflow runs
+`mise exec -- pnpm run ultramodern:check` and `mise exec -- pnpm run build` on
+every push and pull request with read-only permissions, commit-pinned actions,
+frozen installs, and StepSecurity audit-mode runner hardening. Renovate is
+configured for dependency dashboard review, one-day release age, grouped
+updates, action digest pinning, and manual approval for major upgrades.
 
 ## Micro Vertical Workspaces
 
-Inside a Micro Vertical workspace, generate shell, remote, and service packages
-with `--sub` so the workspace root owns package-manager and CI policy:
+Inside a Micro Vertical workspace, add packages from the workspace root with
+the UltraModern add flow. It derives paths, package names, ports, Module
+Federation names, topology entries, overlays, ownership, and root dev scripts:
 
 ```bash
-npx @modern-js/create apps/shell --router tanstack --tailwind --workspace --sub
-npx @modern-js/create apps/remotes/catalog --router tanstack --tailwind --workspace --sub
-npx @modern-js/create apps/remotes/design-system --router tanstack --tailwind --workspace --sub
-npx @modern-js/create services/catalog-api --bff-runtime effect --workspace --sub
+mise exec -- pnpm dlx @modern-js/create catalog --microvertical remote
+mise exec -- pnpm dlx @modern-js/create design-system --microvertical horizontal-remote
+mise exec -- pnpm dlx @modern-js/create catalog-api --microvertical service
+mise exec -- pnpm dlx @modern-js/create catalog-contracts --microvertical shared
 ```
 
 The canonical topology is documented in
@@ -59,6 +87,12 @@ route subtrees and degraded UI, service packages own Effect or explicit Hono
 contracts, and shared packages are limited to tokens, primitives, generated
 clients, or domain-neutral utilities.
 
+Use a new vertical only when the feature needs its own route subtree owner,
+independent rollout, rollback, Cloudflare/Zephyr evidence, or incident routing.
+Keep code inside an existing vertical when it shares the same product owner,
+fallback behavior, release train, and Effect contract. Do not use a shared
+package for feature composites or workflow state.
+
 If the design system needs independent deployment, keep it as a horizontal
 Module Federation remote with the same topology, trust, SSR compatibility, and
 fallback rules as the vertical remotes. Do not add a second preset or a
@@ -68,10 +102,77 @@ The public opinionated entrypoint is `presetUltramodern(...)`. It is the default
 UltraModern.js SuperApp surface for Effect, TanStack, SSR, BFF, and Micro
 Verticals.
 
+## Module Federation And Effect Ownership
+
+The shell consumes vertical UI through MF manifests and consumes vertical data
+through generated Effect clients exported by the remote packages:
+
+- Explore exposes header, footer, recommendations, store picker, and route UI.
+- Decide exposes product page and route UI, and may consume Explore or Checkout
+  remotes through declared `remoteRefs`.
+- Checkout exposes cart, checkout, thanks, mini-cart, add-to-cart, and route UI.
+
+The shell owns orchestration and fallback policy. A vertical owns its route-local
+loader/action behavior, degraded UI, `api/effect/index.ts`, shared Effect API
+contract, generated client, and readiness endpoint. Hono remains a compatibility
+lane only when explicitly scaffolded outside the default Tractor workspace.
+
+## I18n And CSS Ownership
+
+Route localization is owned by the package that owns the route. Each app emits
+`src/routes/ultramodern-route-metadata` and passes
+`ultramodernLocalisedUrls` to `@modern-js/plugin-i18n`. Dynamic JSON resources
+are served from `/locales/{{lng}}/{{ns}}.json`; shell rewrites must not replace
+remote-owned localized URL maps.
+
+CSS federation is recorded in `.modernjs/ultramodern-generated-contract.json`:
+
+- `packages/shared-design-tokens` owns `ultramodern-shared-tokens` and exports
+  `./tokens.css`.
+- The shell owns shell base and overlay CSS under its app root marker.
+- Each remote owns one vertical CSS layer and one remote app root marker.
+- Tailwind CSS v4 is app-local through `@tailwindcss/postcss`.
+- Duplicate base styles are forbidden. SSR first paint requires shared tokens
+  and Modern/Rspack-emitted app CSS.
+
+## Cloudflare And Zephyr Evidence
+
+Build all Cloudflare Worker artifacts:
+
+```bash
+MODERN_PUBLIC_SITE_URL=https://shell-super-app.example.test mise exec -- pnpm run cloudflare:build
+```
+
+Validate local or deployed Cloudflare output with the repo harness:
+
+```bash
+node scripts/ultramodern-cloudflare-ssr-validation/validate-cloudflare-ssr.js \
+  --root-dir apps/remotes/remote-checkout \
+  --bff /checkout-api/effect/checkout/readiness \
+  --expect-en "Checkout Remote" \
+  --match-build-marker \
+  --out .codex/reports/cloudflare-ssr/remote-checkout-local.json
+```
+
+After deploying public Workers, run the generated public URL proof:
+
+```bash
+ULTRAMODERN_PUBLIC_URL_SHELL_SUPER_APP=https://shell-super-app.example.workers.dev \
+ULTRAMODERN_PUBLIC_URL_REMOTE_EXPLORE=https://remote-explore.example.workers.dev \
+ULTRAMODERN_PUBLIC_URL_REMOTE_DECIDE=https://remote-decide.example.workers.dev \
+ULTRAMODERN_PUBLIC_URL_REMOTE_CHECKOUT=https://remote-checkout.example.workers.dev \
+mise exec -- pnpm run cloudflare:proof -- --require-public-urls
+```
+
+Zephyr upload and live switching proof are opt-in evidence workflows. The
+workspace records `zephyr:dependencies` and wires `zephyr-rspack-plugin`, but
+live proof still requires public manifest, runtime, and API URLs plus Zephyr
+credentials. Without those values, only dry-run Zephyr evidence can be claimed.
+
 Preview the production build locally:
 
 ```bash
-pnpm serve
+mise exec -- pnpm serve
 ```
 
 For more information, see the

package/template/api/effect/index.ts.handlebars

@@ -2,60 +2,22 @@
   Effect,
   HttpApiBuilder,
   Layer,
-  Schema,
-  ServiceMap,
   defineEffectBff,
 } from '@modern-js/plugin-bff/effect-server';
 import { bffEffectApi } from '../../shared/effect/api';
 
-class GreetingUnavailableError extends Schema.TaggedError<GreetingUnavailableError>()(
-  'GreetingUnavailableError',
-  {
-    message: Schema.String,
-  },
-) {}
-
-class GreetingService extends ServiceMap.Service<GreetingService>()('GreetingService', {
-  make: Effect.succeed({
-    hello: Effect.fn('GreetingService.hello')(function* () {
-      if (Date.now() < 0) {
-        return yield* Effect.fail(
-          new GreetingUnavailableError({
-            message: 'Greeting service is unavailable',
-          }),
-        );
-      }
-
-      return {
-        message: 'Hello from Effect HttpApi',
-        runtime: 'effect' as const,
-      };
-    }),
-  }),
-}) {
-  static readonly layer = Layer.effect(this, this.make);
-}
-
-const greetingsLayer = HttpApiBuilder.group(bffEffectApi, 'greetings', handlers =>
+const greetingsLayer = HttpApiBuilder.group(bffEffectApi, 'greetings', (handlers) =>
   handlers.handle('hello', () =>
-    GreetingService.use(service => service.hello()).pipe(
-      Effect.catchTag('GreetingUnavailableError', error =>
-        Effect.succeed({
-          message: error.message,
-          runtime: 'effect' as const,
-        }),
-      ),
-    ),
+    Effect.succeed({
+      message: 'Hello from Effect HttpApi',
+      runtime: 'effect' as const,
+    }),
   ),
 );
 
-const layer = HttpApiBuilder.layer(bffEffectApi).pipe(
-  Layer.provide(greetingsLayer),
-  Layer.provide(GreetingService.layer),
-);
+const layer = HttpApiBuilder.layer(bffEffectApi).pipe(Layer.provide(greetingsLayer));
 
 export default defineEffectBff({
   api: bffEffectApi,
   layer,
-});
-{{/if}}
+});{{/if}}

package/template/config/public/locales/cs/translation.json

@@ -0,0 +1,39 @@
+{
+  "home": {
+    "bff": {
+      "response": "Odpoved Effect HttpApi:"
+    },
+    "cards": {
+      "bff": {
+        "body": "Pouzivej Effect jako hlavni BFF cestu, Hono nech jako explicitni zalozni volbu.",
+        "title": "BFF + Effect"
+      },
+      "config": {
+        "body": "Upravuj vygenerovane vychozi hodnoty v modern.config.ts.",
+        "title": "Konfigurace presetUltramodern"
+      },
+      "gates": {
+        "body": "Starter obsahuje PR workflow pro ultramodern:check a build.",
+        "title": "Ultramodern kontroly"
+      },
+      "guide": {
+        "body": "Projdi si verejny preset pripraveny pro MV, TanStack a Effect.",
+        "title": "UltraModern.js pruvodce"
+      }
+    },
+    "description": {
+      "afterConfig": ", udrzuj",
+      "afterPreset": "profil. Zacni v",
+      "end": "zelene a lad vygenerovany preset jen tam, kde aplikace potrebuje mekci cestu.",
+      "intro": "Tento starter prinasi verejny"
+    },
+    "language": {
+      "cs": "Cestina",
+      "en": "Anglictina",
+      "switcher": "Jazyk"
+    },
+    "logoAlt": "Logo UltraModern.js",
+    "name": "presetUltramodern",
+    "title": "UltraModern.js 3.0"
+  }
+}

package/template/config/public/locales/en/translation.json

@@ -0,0 +1,39 @@
+{
+  "home": {
+    "bff": {
+      "response": "Effect HttpApi response:"
+    },
+    "cards": {
+      "bff": {
+        "body": "Keep Effect as the preferred BFF lane while Hono stays an explicit fallback.",
+        "title": "BFF + Effect"
+      },
+      "config": {
+        "body": "Tune the generated defaults in modern.config.ts.",
+        "title": "Configure presetUltramodern"
+      },
+      "gates": {
+        "body": "The starter includes a PR workflow for ultramodern:check and build.",
+        "title": "Ultramodern Gates"
+      },
+      "guide": {
+        "body": "Review the MV-first, TanStack-ready, Effect-ready public preset.",
+        "title": "UltraModern.js Guide"
+      }
+    },
+    "description": {
+      "afterConfig": ", keep",
+      "afterPreset": "profile. Start in",
+      "end": "green, and tune the generated preset only where your app needs a softer lane.",
+      "intro": "This starter ships the public"
+    },
+    "language": {
+      "cs": "Czech",
+      "en": "English",
+      "switcher": "Language"
+    },
+    "logoAlt": "UltraModern.js Logo",
+    "name": "presetUltramodern",
+    "title": "UltraModern.js 3.0"
+  }
+}