@bleedingdev/modern-js-create 3.2.0-ultramodern.59 → 3.2.0-ultramodern.60

package/template-workspace/scripts/validate-ultramodern-workspace.mjs.handlebars

@@ -1,935 +0,0 @@
-import { execFileSync } from 'node:child_process';
-import fs from 'node:fs';
-import path from 'node:path';
-
-const root = process.cwd();
-const packageScope = '{{packageScope}}';
-const tanstackVersion = '1.170.8';
-const tailwindEnabled = '{{tailwindEnabled}}' === 'true';
-const tailwindVersion = '^4.3.0';
-const tailwindPostcssVersion = '^4.3.0';
-const expectedPnpmVersion = '{{pnpmVersion}}';
-const rstackAgentSkillsCommit = '61c948b42512e223bad44b83af4080eba48b2677';
-const moduleFederationAgentSkillsCommit = '07bb5b6c43ad457609e00c081b72d4c42508ec76';
-const modernPackages = [
-  '@modern-js/app-tools',
-  '@modern-js/plugin-bff',
-  '@modern-js/plugin-i18n',
-  '@modern-js/plugin-tanstack',
-  '@modern-js/runtime',
-];
-const baselineAgentSkills = [
-  'rsbuild-best-practices',
-  'rspack-best-practices',
-  'rspack-tracing',
-  'rsdoctor-analysis',
-  'rslib-best-practices',
-  'rslib-modern-package',
-  'rstest-best-practices',
-];
-const moduleFederationAgentSkills = ['mf'];
-const privateAgentSkills = ['plan-graph', 'dag', 'subagent-graph', 'helm', 'debugger-mode'];
-const fullStackVerticals = [
-  {
-    id: 'commerce',
-    domain: 'commerce',
-    stem: 'recommendations',
-    group: 'recommendations',
-    path: 'verticals/commerce',
-    mfName: 'verticalCommerce',
-    apiPrefix: '/commerce-api',
-  },
-  {
-    id: 'identity',
-    domain: 'identity',
-    stem: 'identity',
-    group: 'identity',
-    path: 'verticals/identity',
-    mfName: 'verticalIdentity',
-    apiPrefix: '/identity-api',
-  },
-];
-const designSystemRemotePath = 'verticals/design-system';
-
-const readText = (relativePath) => fs.readFileSync(path.join(root, relativePath), 'utf-8');
-const readJson = (relativePath) => JSON.parse(readText(relativePath));
-const activePnpmVersion = execFileSync('pnpm', ['--version'], {
-  cwd: root,
-  encoding: 'utf-8',
-  stdio: ['ignore', 'pipe', 'pipe'],
-}).trim();
-const readPnpmConfig = (key) => {
-  const env = { ...process.env };
-  for (const envKey of Object.keys(env)) {
-    if (/^(?:npm|pnpm)_config_/i.test(envKey)) {
-      delete env[envKey];
-    }
-  }
-  const output = execFileSync('pnpm', ['config', 'get', key, '--json'], {
-    cwd: root,
-    env,
-    encoding: 'utf-8',
-    stdio: ['ignore', 'pipe', 'pipe'],
-  }).trim();
-  return output ? JSON.parse(output) : undefined;
-};
-const assert = (condition, message) => {
-  if (!condition) {
-    throw new Error(message);
-  }
-};
-const assertExists = (relativePath) => {
-  assert(fs.existsSync(path.join(root, relativePath)), `Missing ${relativePath}`);
-};
-const assertNotExists = (relativePath) => {
-  assert(!fs.existsSync(path.join(root, relativePath)), `Unexpected ${relativePath}`);
-};
-
-assert(
-  activePnpmVersion === expectedPnpmVersion,
-  `Generated workspace requires pnpm ${expectedPnpmVersion}; active pnpm is ${activePnpmVersion}. Run mise install, then rerun pnpm from the activated shell`,
-);
-
-const requiredPaths = [
-  'AGENTS.md',
-  '.gitignore',
-  'package.json',
-  'pnpm-workspace.yaml',
-  'tsconfig.base.json',
-  'oxlint.config.ts',
-  'oxfmt.config.ts',
-  'lefthook.yml',
-  '.codex/hooks.json',
-  '.github/renovate.json',
-  '.github/workflows/ultramodern-workspace-gates.yml',
-  '.agents/skills-lock.json',
-  '.agents/agent-reference-repos.json',
-  '.agents/rstackjs-agent-skills-LICENSE',
-  '.agents/skills/rsbuild-best-practices/SKILL.md',
-  '.agents/skills/rspack-best-practices/SKILL.md',
-  '.agents/skills/rspack-tracing/SKILL.md',
-  '.agents/skills/rspack-tracing/references/tracing-guide.md',
-  '.agents/skills/rspack-tracing/scripts/analyze_trace.js',
-  '.agents/skills/rsdoctor-analysis/SKILL.md',
-  '.agents/skills/rsdoctor-analysis/references/rsdoctor-data-types.md',
-  '.agents/skills/rslib-best-practices/SKILL.md',
-  '.agents/skills/rslib-modern-package/SKILL.md',
-  '.agents/skills/rstest-best-practices/SKILL.md',
-  'topology/reference-topology.json',
-  'topology/ownership.json',
-  'topology/local-overlays/development.json',
-  '.modernjs/ultramodern-workspace-template-manifest.json',
-  '.modernjs/ultramodern-package-source.json',
-  '.modernjs/ultramodern-generated-contract.json',
-  'scripts/assert-mf-types.mjs',
-  'scripts/bootstrap-agent-skills.mjs',
-  'scripts/setup-agent-reference-repos.mjs',
-  'apps/shell-super-app/package.json',
-  'apps/shell-super-app/modern.config.ts',
-  'apps/shell-super-app/module-federation.config.ts',
-  'apps/shell-super-app/src/modern-app-env.d.ts',
-  'apps/shell-super-app/src/modern.runtime.ts',
-  'apps/shell-super-app/locales/en/translation.json',
-  'apps/shell-super-app/locales/cs/translation.json',
-  'apps/shell-super-app/src/routes/index.css',
-  'apps/shell-super-app/src/routes/layout.tsx',
-  'apps/shell-super-app/src/routes/[lang]/page.tsx',
-  'verticals/commerce/package.json',
-  'verticals/commerce/modern.config.ts',
-  'verticals/commerce/module-federation.config.ts',
-  'verticals/commerce/api/effect/index.ts',
-  'verticals/commerce/shared/effect/api.ts',
-  'verticals/commerce/src/effect/recommendations-client.ts',
-  'verticals/commerce/src/modern-app-env.d.ts',
-  'verticals/commerce/src/modern.runtime.ts',
-  'verticals/commerce/locales/en/translation.json',
-  'verticals/commerce/locales/cs/translation.json',
-  'verticals/commerce/src/routes/index.css',
-  'verticals/commerce/src/routes/layout.tsx',
-  'verticals/commerce/src/routes/[lang]/page.tsx',
-  'verticals/identity/package.json',
-  'verticals/identity/modern.config.ts',
-  'verticals/identity/module-federation.config.ts',
-  'verticals/identity/api/effect/index.ts',
-  'verticals/identity/shared/effect/api.ts',
-  'verticals/identity/src/effect/identity-client.ts',
-  'verticals/identity/src/modern-app-env.d.ts',
-  'verticals/identity/src/modern.runtime.ts',
-  'verticals/identity/locales/en/translation.json',
-  'verticals/identity/locales/cs/translation.json',
-  'verticals/identity/src/routes/index.css',
-  'verticals/identity/src/routes/layout.tsx',
-  'verticals/identity/src/routes/[lang]/page.tsx',
-  'verticals/design-system/package.json',
-  'verticals/design-system/modern.config.ts',
-  'verticals/design-system/module-federation.config.ts',
-  'verticals/design-system/src/modern-app-env.d.ts',
-  'verticals/design-system/src/modern.runtime.ts',
-  'verticals/design-system/locales/en/translation.json',
-  'verticals/design-system/locales/cs/translation.json',
-  'verticals/design-system/src/routes/index.css',
-  'verticals/design-system/src/routes/layout.tsx',
-  'verticals/design-system/src/routes/[lang]/page.tsx',
-  'packages/shared-contracts/src/index.ts',
-  'packages/shared-design-tokens/src/index.ts',
-  'packages/shared-effect-api/src/index.ts',
-];
-
-if (tailwindEnabled) {
-  requiredPaths.push(
-    'apps/shell-super-app/postcss.config.mjs',
-    'apps/shell-super-app/tailwind.config.ts',
-    'verticals/commerce/postcss.config.mjs',
-    'verticals/commerce/tailwind.config.ts',
-    'verticals/identity/postcss.config.mjs',
-    'verticals/identity/tailwind.config.ts',
-    'verticals/design-system/postcss.config.mjs',
-    'verticals/design-system/tailwind.config.ts',
-  );
-}
-
-for (const requiredPath of requiredPaths) {
-  assertExists(requiredPath);
-}
-
-assertNotExists('services/service-recommendations-effect');
-
-for (const appDirectory of [
-  'apps/shell-super-app',
-  'verticals/commerce',
-  'verticals/identity',
-  'verticals/design-system',
-]) {
-  assert(
-    !fs.existsSync(path.join(root, appDirectory, 'src/routes/page.tsx')),
-    `${appDirectory} must use src/routes/[lang]/page.tsx`,
-  );
-}
-
-const rootPackage = readJson('package.json');
-const packageSource = readJson('.modernjs/ultramodern-package-source.json');
-const skillsLock = readJson('.agents/skills-lock.json');
-const agentReferenceRepos = readJson('.agents/agent-reference-repos.json');
-const workflowContent = readText('.github/workflows/ultramodern-workspace-gates.yml');
-const renovateConfig = readJson('.github/renovate.json');
-const expectedModernSpecifier =
-  packageSource.strategy === 'install' ? packageSource.modernPackages?.specifier : 'workspace:*';
-
-const expectedModernDependency = (packageName) => {
-  if (packageSource.strategy !== 'install') {
-    return 'workspace:*';
-  }
-
-  const aliasPackageName = packageSource.modernPackages?.aliases?.[packageName];
-  return aliasPackageName
-    ? `npm:${aliasPackageName}@${expectedModernSpecifier}`
-    : expectedModernSpecifier;
-};
-
-assert(rootPackage.private === true, 'Root package must be private');
-assert(rootPackage.modernjs?.preset === 'presetUltramodern', 'Root must declare presetUltramodern');
-const miseConfig = readText('.mise.toml');
-assert(
-  miseConfig.includes(`pnpm = "${expectedPnpmVersion}"`),
-  `Root must pin pnpm ${expectedPnpmVersion} in .mise.toml`,
-);
-assert(
-  rootPackage.packageManager === `pnpm@${expectedPnpmVersion}`,
-  `Root must pin pnpm ${expectedPnpmVersion}`,
-);
-assert(
-  rootPackage.engines?.pnpm === `>=${expectedPnpmVersion} <11.6.0`,
-  `Root must require pnpm >=${expectedPnpmVersion} <11.6.0`,
-);
-assert(
-  JSON.stringify(readPnpmConfig('packages')) ===
-    JSON.stringify(['apps/*', 'verticals/*', 'packages/*']),
-  'pnpm-workspace.yaml must retain workspace package globs',
-);
-assert(readPnpmConfig('minimumReleaseAge') === 0, 'pnpm minimumReleaseAge must be 0');
-assert(readPnpmConfig('minimumReleaseAgeStrict') === undefined, 'pnpm minimumReleaseAgeStrict must stay unset');
-assert(
-  readPnpmConfig('minimumReleaseAgeIgnoreMissingTime') === undefined,
-  'pnpm minimumReleaseAgeIgnoreMissingTime must stay unset',
-);
-assert(
-  readPnpmConfig('minimumReleaseAgeExclude') === undefined,
-  'pnpm minimumReleaseAgeExclude must stay unset',
-);
-assert(readPnpmConfig('trustPolicy') === undefined, 'pnpm trustPolicy must stay unset');
-assert(readPnpmConfig('trustPolicyIgnoreAfter') === undefined, 'pnpm trustPolicyIgnoreAfter must stay unset');
-assert(readPnpmConfig('blockExoticSubdeps') === true, 'pnpm blockExoticSubdeps must be true');
-assert(readPnpmConfig('engineStrict') === true, 'pnpm engineStrict must be true');
-assert(readPnpmConfig('pmOnFail') === 'error', 'pnpm pmOnFail must be error');
-assert(readPnpmConfig('verifyDepsBeforeRun') === 'error', 'pnpm verifyDepsBeforeRun must be error');
-assert(readPnpmConfig('strictDepBuilds') === true, 'pnpm strictDepBuilds must be true');
-assert(
-  JSON.stringify(readPnpmConfig('peerDependencyRules')) ===
-    JSON.stringify({ allowedVersions: { react: '>=19.0.0', typescript: '>=6.0.0' } }),
-  'pnpm peerDependencyRules must allow React 19 and TypeScript 6+',
-);
-assert(
-  JSON.stringify(readPnpmConfig('overrides')) ===
-    JSON.stringify({ '@tanstack/react-router': '1.170.8', 'node-fetch': '^3.3.2' }),
-  'pnpm overrides must pin generated router and node-fetch policy',
-);
-assert(
-  JSON.stringify(readPnpmConfig('allowBuilds')) ===
-    JSON.stringify({
-      '@swc/core': true,
-      'core-js': true,
-      esbuild: true,
-      lefthook: true,
-      'msgpackr-extract': true,
-      sharp: true,
-      workerd: true,
-    }),
-  'pnpm allowBuilds must approve only the generated workspace build dependencies',
-);
-assert(readPnpmConfig('onlyBuiltDependencies') === undefined, 'pnpm onlyBuiltDependencies must not be set');
-for (const requiredSnippet of [
-  'permissions:\n  contents: read',
-  'pull_request:',
-  'persist-credentials: false',
-  'jdx/mise-action',
-  'pnpm install --frozen-lockfile',
-  'pnpm run ultramodern:check',
-  'pnpm build',
-  'MODERN_PUBLIC_SITE_URL: http://localhost:8080',
-  'timeout-minutes:',
-  'egress-policy: audit',
-]) {
-  assert(
-    workflowContent.includes(requiredSnippet),
-    `Generated workspace workflow must retain ${requiredSnippet.split('\n')[0]}`,
-  );
-}
-assert(
-  !workflowContent.includes('pull_request_target'),
-  'Generated workspace workflow must not use pull_request_target',
-);
-for (const match of workflowContent.matchAll(/^\s*uses:\s*([^@\s]+)@([^\s#]+)/gmu)) {
-  const [, actionName, actionRef] = match;
-  assert(
-    /^[a-f0-9]{40}$/u.test(actionRef),
-    `Generated workspace workflow must pin ${actionName}@${actionRef} to a commit SHA`,
-  );
-}
-assert(
-  renovateConfig.dependencyDashboard === true &&
-    renovateConfig.minimumReleaseAge === '1 day' &&
-    renovateConfig.extends?.includes('helpers:pinGitHubActionDigests') &&
-    renovateConfig.packageRules?.some(
-      (rule) =>
-        rule.dependencyDashboardApproval === true && rule.matchUpdateTypes?.includes('major'),
-    ),
-  'Generated workspace Renovate config must retain dashboard, release-age, action pinning, and major-approval policy',
-);
-assert(
-  rootPackage.modernjs?.packageSource?.config === './.modernjs/ultramodern-package-source.json',
-  'Root must point to the UltraModern package source metadata',
-);
-assert(
-  rootPackage.modernjs?.packageSource?.strategy === packageSource.strategy,
-  'Root package source strategy must match the UltraModern package source metadata',
-);
-assert(
-  packageSource.strategy === 'workspace' || packageSource.strategy === 'install',
-  'Package source strategy must be workspace or install',
-);
-assert(
-  packageSource.generatedWorkspacePackages?.specifier === 'workspace:*',
-  'Generated shared packages must keep workspace:* links',
-);
-assert(
-  modernPackages.every((packageName) =>
-    packageSource.modernPackages?.packages?.includes(packageName),
-  ),
-  'Package source metadata must list all Modern runtime/tooling packages',
-);
-assert(
-  expectedModernSpecifier && packageSource.modernPackages?.specifier === expectedModernSpecifier,
-  'Package source metadata must provide a Modern package specifier',
-);
-
-const requiredRootScripts = {
-  build:
-    'pnpm -r --filter "./verticals/**" run build && pnpm --filter "./apps/shell-super-app" run build && pnpm ultramodern:assert-mf-types',
-  format: 'oxfmt .',
-  'format:check': 'oxfmt --check .',
-  lint: 'oxlint .',
-  'lint:fix': 'oxlint . --fix',
-  'agents:refs:check': 'node ./scripts/setup-agent-reference-repos.mjs --check',
-  'agents:refs:install': 'node ./scripts/setup-agent-reference-repos.mjs',
-  postinstall:
-    'node ./scripts/bootstrap-agent-skills.mjs && (git rev-parse --is-inside-work-tree >/dev/null 2>&1 && lefthook install || true) && node ./scripts/setup-agent-reference-repos.mjs',
-  'skills:check': 'node ./scripts/bootstrap-agent-skills.mjs --check',
-  'skills:install': 'node ./scripts/bootstrap-agent-skills.mjs',
-  typecheck: `pnpm -r --filter "@${packageScope}/*" typecheck`,
-  'ultramodern:assert-mf-types': 'node ./scripts/assert-mf-types.mjs',
-  'ultramodern:check': 'node ./scripts/validate-ultramodern-workspace.mjs',
-};
-for (const [scriptName, scriptCommand] of Object.entries(requiredRootScripts)) {
-  assert(rootPackage.scripts?.[scriptName] === scriptCommand, `Root must expose ${scriptName}`);
-}
-assert(
-  Object.keys(rootPackage.scripts ?? {}).every((scriptName) => !scriptName.startsWith('zephyr:')),
-  'Root package must not expose custom zephyr:* lifecycle commands',
-);
-
-for (const dependency of [
-  '@effect/tsgo',
-  '@typescript/native-preview',
-  'lefthook',
-  'oxfmt',
-  'oxlint',
-  'ultracite',
-]) {
-  assert(rootPackage.devDependencies?.[dependency], `Root must depend on ${dependency}`);
-}
-
-const agentsInstructions = readText('AGENTS.md');
-assert(
-  agentsInstructions.includes('UltraModern Agent Contract') &&
-    agentsInstructions.includes('Required Skill Baseline'),
-  'Root AGENTS.md must document the UltraModern agent contract',
-);
-assert(
-  skillsLock.source?.repository === 'https://github.com/rstackjs/agent-skills',
-  'Agent skills lock must retain the Rstack skill source repository',
-);
-assert(
-  skillsLock.source?.commit === rstackAgentSkillsCommit,
-  'Agent skills lock must pin the expected Rstack skill commit',
-);
-assert(
-  skillsLock.installDir === '.agents/skills',
-  'Agent skills lock must use .agents/skills as installDir',
-);
-assert(
-  agentReferenceRepos.defaultEnabled === true,
-  'Agent reference repositories must be enabled by default',
-);
-assert(
-  agentReferenceRepos.strategy === 'git-subtree-squash',
-  'Agent reference repositories must use git subtree squash strategy',
-);
-assert(
-  agentReferenceRepos.repositories?.some(
-    (repo) =>
-      repo.id === 'effect' &&
-      repo.url === 'https://github.com/Effect-TS/effect.git' &&
-      repo.path === 'repos/effect',
-  ),
-  'Agent reference repositories must include Effect',
-);
-assert(
-  agentReferenceRepos.repositories?.some(
-    (repo) =>
-      repo.id === 'ultramodern-js' &&
-      repo.url === 'https://github.com/BleedingDev/ultramodern.js.git' &&
-      repo.path === 'repos/ultramodern.js',
-  ),
-  'Agent reference repositories must include UltraModern.js',
-);
-assert(
-  readText('scripts/setup-agent-reference-repos.mjs').includes(
-    'ULTRAMODERN_SKIP_AGENT_REPOS',
-  ),
-  'Agent reference repository setup must expose an opt-out environment variable',
-);
-assert(
-  readText('scripts/setup-agent-reference-repos.mjs').includes('git-subtree-dir'),
-  'Agent reference repository setup must validate git subtree evidence',
-);
-for (const skillName of baselineAgentSkills) {
-  assert(
-    skillsLock.baseline?.some((skill) => skill.name === skillName),
-    `Agent skills lock must include ${skillName}`,
-  );
-  assert(
-    readText(`.agents/skills/${skillName}/SKILL.md`).includes(`name: ${skillName}`),
-    `${skillName} must contain matching skill metadata`,
-  );
-}
-
-const privateSource = skillsLock.sources?.find(
-  (source) => source.repository === 'https://github.com/TechsioCZ/skills',
-);
-const moduleFederationSource = skillsLock.sources?.find(
-  (source) => source.repository === 'https://github.com/module-federation/agent-skills',
-);
-assert(
-  moduleFederationSource?.install === 'clone' &&
-    moduleFederationSource.commit === moduleFederationAgentSkillsCommit,
-  'Agent skills lock must configure the public Module Federation skill source as a pinned clone',
-);
-for (const skillName of moduleFederationAgentSkills) {
-  assert(
-    skillsLock.baseline?.some((skill) => skill.name === skillName) &&
-      moduleFederationSource.baseline?.some((skill) => skill.name === skillName),
-    `Agent skills lock must require Module Federation skill ${skillName}`,
-  );
-  assert(
-    agentsInstructions.includes(`\`${skillName}\``) &&
-      agentsInstructions.includes('module-federation/agent-skills'),
-    `Root AGENTS.md must document required Module Federation skill ${skillName}`,
-  );
-}
-assert(
-  privateSource?.install === 'clone-if-authorized',
-  'Agent skills lock must configure TechsioCZ skills as clone-if-authorized',
-);
-for (const skillName of privateAgentSkills) {
-  assert(
-    privateSource.baseline?.some((skill) => skill.name === skillName),
-    `Agent skills lock must pin private skill ${skillName}`,
-  );
-}
-
-const appPackagePaths = [
-  'apps/shell-super-app/package.json',
-  'verticals/commerce/package.json',
-  'verticals/identity/package.json',
-  `${designSystemRemotePath}/package.json`,
-];
-
-const expectedZephyrDependencies = {
-  commerce: `@${packageScope}/commerce@workspace:*`,
-  identity: `@${packageScope}/identity@workspace:*`,
-  designSystem: `@${packageScope}/design-system@workspace:*`,
-};
-
-for (const packagePath of appPackagePaths) {
-  const packageJson = readJson(packagePath);
-  const isRemote = packagePath.includes('/verticals/');
-  const fullStackVertical = fullStackVerticals.find(
-    (vertical) => `${vertical.path}/package.json` === packagePath,
-  );
-  assert(packageJson.scripts?.dev === 'modern dev', `${packagePath} must use vanilla modern dev`);
-  assert(
-    packageJson.scripts?.build ===
-      (isRemote
-        ? 'modern build && node ../../../scripts/assert-mf-types.mjs'
-        : 'modern build'),
-    `${packagePath} must enforce Module Federation DTS on federated builds`,
-  );
-  assert(packageJson.scripts?.serve === 'modern serve', `${packagePath} must use vanilla modern serve`);
-  assert(
-    Object.keys(packageJson.scripts ?? {}).every((scriptName) => !scriptName.startsWith('zephyr:')),
-    `${packagePath} must not expose custom zephyr:* lifecycle commands`,
-  );
-  assert(
-    packageJson['zephyr:dependencies'] &&
-      typeof packageJson['zephyr:dependencies'] === 'object' &&
-      !Array.isArray(packageJson['zephyr:dependencies']),
-    `${packagePath} must declare zephyr:dependencies for deterministic Zephyr dependency extraction`,
-  );
-  if (isRemote) {
-    assert(
-      Object.keys(packageJson['zephyr:dependencies']).length === 0,
-      `${packagePath} must declare an empty zephyr:dependencies map until it consumes verticals`,
-    );
-  } else {
-    assert(
-      JSON.stringify(packageJson['zephyr:dependencies']) ===
-        JSON.stringify(expectedZephyrDependencies),
-      `${packagePath} must map shell vertical aliases to Zephyr workspace vertical package dependencies`,
-    );
-  }
-  assert(
-    packageJson.dependencies?.['@modern-js/plugin-tanstack'] ===
-      expectedModernDependency('@modern-js/plugin-tanstack'),
-    `${packagePath} must use @modern-js/plugin-tanstack through ${expectedModernDependency(
-      '@modern-js/plugin-tanstack',
-    )}`,
-  );
-  assert(
-    packageJson.dependencies?.['@modern-js/plugin-i18n'] ===
-      expectedModernDependency('@modern-js/plugin-i18n'),
-    `${packagePath} must use @modern-js/plugin-i18n through ${expectedModernDependency(
-      '@modern-js/plugin-i18n',
-    )}`,
-  );
-  assert(
-    packageJson.dependencies?.['@modern-js/runtime'] ===
-      expectedModernDependency('@modern-js/runtime'),
-    `${packagePath} must use @modern-js/runtime through ${expectedModernDependency(
-      '@modern-js/runtime',
-    )}`,
-  );
-  assert(
-    packageJson.devDependencies?.['@modern-js/app-tools'] ===
-      expectedModernDependency('@modern-js/app-tools'),
-    `${packagePath} must use @modern-js/app-tools through ${expectedModernDependency(
-      '@modern-js/app-tools',
-    )}`,
-  );
-  assert(
-    packageJson.devDependencies?.typescript === '6.0.3',
-    `${packagePath} must include TypeScript 6 only as the stable JS TypeScript package for Module Federation DTS generation`,
-  );
-  assert(
-    packageJson.devDependencies?.['@typescript/native-preview'] === '7.0.0-dev.20260527.2',
-    `${packagePath} must include TypeScript 7 native preview for mandatory native typechecking`,
-  );
-  assert(
-    packageJson.devDependencies?.['zephyr-rspack-plugin'] === '1.1.1',
-    `${packagePath} must install the Zephyr Rspack plugin used by the Modern.js bridge`,
-  );
-  assert(
-    packageJson.devDependencies?.['zephyr-modernjs-plugin'] === undefined,
-    `${packagePath} must not install the inactive Zephyr Modern.js wrapper`,
-  );
-  assert(
-    packageJson.dependencies?.[`@${packageScope}/shared-contracts`] === 'workspace:*',
-    `${packagePath} must link generated shared contracts through workspace:*`,
-  );
-  assert(
-    packageJson.dependencies?.[`@${packageScope}/shared-design-tokens`] === 'workspace:*',
-    `${packagePath} must link generated shared design tokens through workspace:*`,
-  );
-  assert(
-    packageJson.dependencies?.['node-fetch'] === '^3.3.2',
-    `${packagePath} must satisfy the Module Federation SDK node-fetch peer`,
-  );
-  assert(
-    packageJson.dependencies?.['@tanstack/react-router'] === tanstackVersion,
-    `${packagePath} must use @tanstack/react-router ${tanstackVersion}`,
-  );
-  assert(
-    packageJson.dependencies?.i18next === '26.2.0',
-    `${packagePath} must include i18next for mandatory native Modern.js i18n`,
-  );
-  assert(
-    !packageJson.dependencies?.['react-i18next'],
-    `${packagePath} must use native @modern-js/plugin-i18n hooks instead of react-i18next in the TanStack MF starter`,
-  );
-  assert(
-    packageJson.dependencies?.['@module-federation/modern-js-v3'] === '2.5.0',
-    `${packagePath} must include the Module Federation plugin`,
-  );
-  if (fullStackVertical) {
-    assert(
-      packageJson.dependencies?.['@modern-js/plugin-bff'] ===
-        expectedModernDependency('@modern-js/plugin-bff'),
-      `${packagePath} must use @modern-js/plugin-bff through ${expectedModernDependency(
-        '@modern-js/plugin-bff',
-      )}`,
-    );
-    assert(
-      packageJson.exports?.['./effect/client'] ===
-        `./src/effect/${fullStackVertical.stem}-client.ts` &&
-        packageJson.exports?.['./shared/effect/api'] === './shared/effect/api.ts',
-      `${packagePath} must expose its vertical-owned Effect client and contract surface`,
-    );
-  }
-  if (packagePath === `${designSystemRemotePath}/package.json`) {
-    assert(
-      !packageJson.dependencies?.['@modern-js/plugin-bff'],
-      'Design-system vertical must remain FE-only and must not depend on @modern-js/plugin-bff',
-    );
-    assert(
-      !packageJson.exports?.['./effect/client'] && !packageJson.exports?.['./shared/effect/api'],
-      'Design-system vertical must not expose Effect client or contract exports',
-    );
-  }
-  if (tailwindEnabled) {
-    assert(
-      packageJson.devDependencies?.tailwindcss === tailwindVersion,
-      `${packagePath} must include Tailwind CSS ${tailwindVersion}`,
-    );
-    assert(
-      packageJson.devDependencies?.['@tailwindcss/postcss'] === tailwindPostcssVersion,
-      `${packagePath} must include @tailwindcss/postcss ${tailwindPostcssVersion}`,
-    );
-    assert(
-      packageJson.devDependencies?.postcss === '^8.5.6',
-      `${packagePath} must include PostCSS for Tailwind CSS`,
-    );
-  } else {
-    assert(!packageJson.devDependencies?.tailwindcss, `${packagePath} must not include Tailwind CSS`);
-    assert(
-      !packageJson.devDependencies?.['@tailwindcss/postcss'],
-      `${packagePath} must not include @tailwindcss/postcss`,
-    );
-  }
-  assert(
-    packageJson.modernjs?.preset === 'presetUltramodern',
-    `${packagePath} must keep presetUltramodern metadata`,
-  );
-}
-
-for (const federationConfigPath of [
-  'apps/shell-super-app/module-federation.config.ts',
-  'verticals/commerce/module-federation.config.ts',
-  'verticals/identity/module-federation.config.ts',
-  'verticals/design-system/module-federation.config.ts',
-]) {
-  const federationConfig = readText(federationConfigPath);
-  assert(
-    federationConfig.includes('compilerInstance:') &&
-      federationConfig.includes("'--package typescript -- tsc'") &&
-      federationConfig.includes('displayErrorInTerminal: true') &&
-      !federationConfig.includes('dts: false'),
-    `${federationConfigPath} must keep strict Module Federation DTS enabled`,
-  );
-}
-
-for (const appDirectory of [
-  'apps/shell-super-app',
-  'verticals/commerce',
-  'verticals/identity',
-  'verticals/design-system',
-]) {
-  if (tailwindEnabled) {
-    assertExists(`${appDirectory}/postcss.config.mjs`);
-    assertExists(`${appDirectory}/tailwind.config.ts`);
-  }
-  if (!tailwindEnabled) {
-    assert(
-      !fs.existsSync(path.join(root, appDirectory, 'postcss.config.mjs')),
-      `${appDirectory} must not write PostCSS config when Tailwind is disabled`,
-    );
-    assert(
-      !fs.existsSync(path.join(root, appDirectory, 'tailwind.config.ts')),
-      `${appDirectory} must not write Tailwind config when Tailwind is disabled`,
-    );
-  }
-}
-
-for (const configPath of [
-  'apps/shell-super-app/modern.config.ts',
-  'verticals/commerce/modern.config.ts',
-  'verticals/identity/modern.config.ts',
-  'verticals/design-system/modern.config.ts',
-]) {
-  const config = readText(configPath);
-  assert(config.includes('presetUltramodern('), `${configPath} must use presetUltramodern`);
-  assert(config.includes('ULTRAMODERN_SITE_URL'), `${configPath} must expose site URL metadata`);
-  assert(
-    config.includes('MODERN_PUBLIC_SITE_URL must be set for production builds'),
-    `${configPath} must require MODERN_PUBLIC_SITE_URL for production builds`,
-  );
-  assert(config.includes('tanstackRouterPlugin()'), `${configPath} must enable plugin-tanstack`);
-  assert(config.includes('i18nPlugin('), `${configPath} must enable native Modern.js i18n`);
-  assert(
-    config.includes('reactI18next: false'),
-    `${configPath} must use the native Modern.js i18n provider without optional react-i18next probing`,
-  );
-  assert(
-    config.includes("publicDir: './locales'"),
-    `${configPath} must expose app-owned locale JSON through Modern.js publicDir`,
-  );
-  assert(
-    config.includes('moduleFederationPlugin()'),
-    `${configPath} must enable Module Federation`,
-  );
-  assert(
-    config.includes("mode: 'stream'") &&
-      config.includes('moduleFederationAppSSR: true'),
-    `${configPath} must use streaming Module Federation SSR`,
-  );
-  assert(
-    config.includes("html: './'"),
-    `${configPath} must keep Modern.js output.distPath.html compatible with Zephyr`,
-  );
-  assert(
-    config.includes("outputStructure: 'flat'"),
-    `${configPath} must keep Modern.js HTML output flat for Zephyr`,
-  );
-  assert(
-    config.includes("mainEntryName: 'index'"),
-    `${configPath} must keep Modern.js source.mainEntryName compatible with Zephyr`,
-  );
-}
-
-const shellMf = readText('apps/shell-super-app/module-federation.config.ts');
-assert(shellMf.includes("name: 'shellSuperApp'"), 'Shell MF config must name the shell');
-assert(
-  shellMf.includes("'react-dom/client'"),
-  'Shell MF config must share react-dom/client explicitly',
-);
-assert(
-  shellMf.includes('verticalCommerce@http://localhost:3021/mf-manifest.json'),
-  'Shell must reference commerce vertical',
-);
-assert(
-  shellMf.includes('verticalIdentity@http://localhost:3022/mf-manifest.json'),
-  'Shell must reference identity vertical',
-);
-assert(
-  shellMf.includes('verticalDesignSystem@http://localhost:3023/mf-manifest.json'),
-  'Shell must reference design-system vertical',
-);
-
-const shellPackage = readJson('apps/shell-super-app/package.json');
-assert(
-  shellPackage.dependencies?.['@modern-js/plugin-bff'] ===
-    expectedModernDependency('@modern-js/plugin-bff'),
-  `Shell must use @modern-js/plugin-bff through ${expectedModernDependency(
-    '@modern-js/plugin-bff',
-  )}`,
-);
-assert(
-  !shellPackage.dependencies?.[`@${packageScope}/shared-effect-api`],
-  'Shell must not depend on shared-effect-api for default vertical-owned APIs',
-);
-
-const generatedContract = readJson('.modernjs/ultramodern-generated-contract.json');
-assert(
-  generatedContract.profile === 'cloudflare-ssr-mf-effect-v1',
-  'Generated contract must select the Cloudflare SSR MF Effect profile',
-);
-assert(
-  generatedContract.packageManager?.manager === 'pnpm' &&
-    generatedContract.packageManager?.version === expectedPnpmVersion &&
-    generatedContract.packageManager?.toolchain === 'mise',
-  'Generated contract must declare the pnpm 11/mise toolchain policy',
-);
-
-for (const vertical of fullStackVerticals) {
-  const contractEntry = generatedContract.apps?.find((app) => app.id === vertical.id);
-  assert(
-    contractEntry?.deploy?.target === 'cloudflare' &&
-      contractEntry?.deploy?.worker?.ssr === true &&
-      contractEntry?.deploy?.output?.flat === true &&
-      contractEntry?.deploy?.output?.htmlDistPath === './' &&
-      contractEntry?.ssr?.mode === 'stream' &&
-      contractEntry?.ssr?.moduleFederationAppSSR === true &&
-      contractEntry?.i18n?.plugin === '@modern-js/plugin-i18n' &&
-      contractEntry?.i18n?.languages?.includes('en') &&
-      contractEntry?.i18n?.languages?.includes('cs') &&
-      contractEntry?.moduleFederation?.name === vertical.mfName &&
-      contractEntry?.moduleFederation?.exposes?.includes('./Widget') &&
-      contractEntry?.moduleFederation?.exposes?.includes('./Route') &&
-      contractEntry?.moduleFederation?.browserSafeExposesOnly === true &&
-      contractEntry?.effect?.runtime === 'effect' &&
-      contractEntry?.effect?.import === '@modern-js/plugin-bff/effect-edge' &&
-      contractEntry?.effect?.prefix === vertical.apiPrefix &&
-      contractEntry?.effect?.workerEntry === 'worker/__modern_bff_effect.js' &&
-      contractEntry?.marker?.appId === vertical.id &&
-      contractEntry?.marker?.deployProfile === 'cloudflare-ssr-mf-effect-v1' &&
-      contractEntry?.marker?.uiSurface === 'ui' &&
-      contractEntry?.marker?.apiSurface === 'effect-bff',
-    `${vertical.id} generated contract must describe Cloudflare SSR, MF, i18n, Effect BFF, and marker metadata`,
-  );
-}
-
-const designMf = readText('verticals/design-system/module-federation.config.ts');
-assert(designMf.includes("name: 'verticalDesignSystem'"), 'Design-system federated MF name is missing');
-assert(
-  designMf.includes("'react-dom/client'"),
-  'Design-system federated MF config must share react-dom/client explicitly',
-);
-assert(designMf.includes("'./Button'"), 'Design-system vertical must expose Button');
-assert(designMf.includes("'./tokens'"), 'Design-system vertical must expose tokens');
-const sharedEffectApi = readText('packages/shared-effect-api/src/index.ts');
-assert(
-  !sharedEffectApi.includes('recommendationsEffectApi') &&
-    !sharedEffectApi.includes('commerceEffectApi') &&
-    !sharedEffectApi.includes('identityEffectApi'),
-  'Shared Effect API package must not own default vertical API contracts',
-);
-
-const topology = readJson('topology/reference-topology.json');
-assert(topology.preset === 'presetUltramodern', 'Topology must reference presetUltramodern');
-assert(topology.shell?.id === 'shell-super-app', 'Topology shell id is incorrect');
-assert(topology.shell?.verticalRefs?.length === 3, 'Topology shell must reference three verticals');
-assert(topology.verticals?.length === 3, 'Topology must contain three verticals');
-for (const vertical of fullStackVerticals) {
-  const topologyEntry = topology.verticals.find((vertical) => vertical.id === vertical.id);
-  assert(topologyEntry?.kind === 'vertical', `${vertical.id} must be a vertical topology entry`);
-  assert(
-    topologyEntry?.moduleFederation?.manifestUrl?.includes('/mf-manifest.json') &&
-      topologyEntry?.api?.effect?.runtime === 'effect' &&
-      topologyEntry?.api?.effect?.bff?.prefix === vertical.apiPrefix &&
-      topologyEntry?.api?.effect?.bff?.openapi === '/openapi.json' &&
-      topologyEntry?.api?.effect?.contract?.export === './shared/effect/api' &&
-      topologyEntry?.api?.effect?.client?.export === './effect/client' &&
-      topologyEntry?.api?.effect?.serverEntry === `${vertical.path}/api/effect/index.ts`,
-    `${vertical.id} topology entry must include both Module Federation and Effect API metadata`,
-  );
-}
-assert(
-  topology.verticals.some(
-    (vertical) => vertical.id === 'design-system' && vertical.kind === 'vertical',
-  ),
-  'Topology must contain the horizontal design-system vertical',
-);
-assert(
-  !('effectServices' in topology),
-  'Topology must not expose effectServices; vertical APIs are owned by vertical packages',
-);
-assert(topology.sharedPackages?.length === 3, 'Topology must contain shared package placeholders');
-
-const ownership = readJson('topology/ownership.json');
-assert(
-  ownership.owners?.some(
-    (owner) => owner.id === 'commerce' && owner.ownership?.team === 'commerce-experience',
-  ),
-  'Ownership metadata must retain commerce owner',
-);
-assert(
-  !ownership.owners?.some(
-    (owner) =>
-      owner.id === 'service-recommendations-effect' ||
-      owner.path === 'services/service-recommendations-effect',
-  ),
-  'Ownership metadata must not retain the old default recommendations service owner',
-);
-
-const manifest = readJson('.modernjs/ultramodern-workspace-template-manifest.json');
-assert(
-  manifest.template?.id === 'modernjs-ultramodern-superapp-workspace',
-  'Template manifest evidence is missing',
-);
-assert(
-  manifest.packageSource?.strategy === packageSource.strategy,
-  'Template manifest must retain the generated package source strategy',
-);
-assert(
-  manifest.agentSkills?.source?.commit === rstackAgentSkillsCommit,
-  'Template manifest must retain the Rstack agent skills commit',
-);
-assert(
-  baselineAgentSkills.every((skillName) => manifest.agentSkills?.baseline?.includes(skillName)),
-  'Template manifest must list every baseline agent skill',
-);
-assert(
-  manifest.agentSkills?.moduleFederationSource?.repository ===
-    'https://github.com/module-federation/agent-skills' &&
-    manifest.agentSkills?.moduleFederationSource?.commit ===
-      moduleFederationAgentSkillsCommit,
-  'Template manifest must retain the Module Federation agent skill source',
-);
-assert(
-  moduleFederationAgentSkills.every((skillName) =>
-    manifest.agentSkills?.moduleFederationSource?.baseline?.includes(skillName),
-  ),
-  'Template manifest must list every Module Federation agent skill entry',
-);
-assert(
-  manifest.agentSkills?.privateSource?.repository === 'https://github.com/TechsioCZ/skills',
-  'Template manifest must retain the private TechsioCZ skill source',
-);
-assert(
-  privateAgentSkills.every((skillName) =>
-    manifest.agentSkills?.privateSource?.baseline?.includes(skillName),
-  ),
-  'Template manifest must list every pinned private agent skill entry',
-);
-assert(
-  manifest.validation?.expectedCommands?.includes('pnpm run ultramodern:check'),
-  'Template manifest must document the validation command',
-);
-assert(
-  manifest.validation?.postMaterializationValidation?.includes('pnpm-11-policy-enforced'),
-  'Template manifest must document pnpm 11 policy validation',
-);
-assert(
-  manifest.validation?.postMaterializationValidation?.includes('github-workflow-security-enforced'),
-  'Template manifest must document generated workflow security validation',
-);
-
-console.log('UltraModern workspace scaffold validated');