@bleedingdev/modern-js-create 3.4.0-ultramodern.17 → 3.4.0-ultramodern.19

package/dist/cjs/ultramodern-workspace/module-federation.cjs

@@ -69,6 +69,12 @@ function createAppModernConfig(scope, app) {
       },
 ` : '';
     const bffPluginEntry = (0, external_descriptors_cjs_namespaceObject.appHasEffectApi)(app) ? '        bffPlugin(),\n' : '';
+    const defaultAssetPrefixSource = 'shell' === app.kind ? "const defaultAssetPrefix = '/';" : `const remoteAssetOrigin =
+  configuredCloudflareUrl ||
+  inferredCloudflareUrl ||
+  (cloudflareDeployEnabled ? '/' : \`http://localhost:\${port}\`);
+const defaultRemoteAssetPrefix = \`\${remoteAssetOrigin.replace(/\\/+$/u, '')}/\`;
+const defaultAssetPrefix = defaultRemoteAssetPrefix;`;
     return `// @effect-diagnostics processEnv:off
 import {
   appTools,
@@ -131,12 +137,12 @@ const siteUrl =
   configuredCloudflareUrl ||
   inferredCloudflareUrl ||
   \`http://localhost:\${port}\`;
-// Asset loading is intentionally independent from the canonical site URL and
-// deployment public URL. Without an explicit asset prefix, assets stay
-// origin-relative so self-hosted apps, tunnels, and reverse proxies never leak
-// localhost URLs into production HTML.
+${defaultAssetPrefixSource}
+// Asset loading is intentionally independent from the canonical site URL.
+// Module Federation remotes must publish an absolute publicPath so browsers
+// load remoteEntry.js and exposed chunks from the remote origin, not the host.
 const assetPrefix =
-  configuredModernAssetPrefix || configuredUltramodernAssetPrefix || '/';
+  configuredModernAssetPrefix || configuredUltramodernAssetPrefix || defaultAssetPrefix;
 
 if (
   cloudflareDeployEnabled &&

package/dist/cjs/ultramodern-workspace/package-json.cjs

@@ -141,7 +141,8 @@ function appDependencies(scope, packageSource, app, remotes = [], bridge) {
         [(0, external_naming_cjs_namespaceObject.packageName)(scope, 'shared-design-tokens')]: external_ultramodern_package_source_cjs_namespaceObject.WORKSPACE_PACKAGE_VERSION,
         react: external_versions_cjs_namespaceObject.REACT_VERSION,
         'react-dom': external_versions_cjs_namespaceObject.REACT_DOM_VERSION,
-        'react-router': external_versions_cjs_namespaceObject.REACT_ROUTER_VERSION
+        'react-router': external_versions_cjs_namespaceObject.REACT_ROUTER_VERSION,
+        'react-router-dom': external_versions_cjs_namespaceObject.REACT_ROUTER_VERSION
     };
     for (const dependency of bridge?.dependencies ?? [])dependencies[dependency] = external_ultramodern_package_source_cjs_namespaceObject.WORKSPACE_PACKAGE_VERSION;
     if ('shell' === app.kind) {

package/dist/cjs/ultramodern-workspace/policy.cjs

@@ -148,7 +148,7 @@ const PUBLIC_WEBSITE_POLICY = {
             requireWebManifestWhenPresent: true
         },
         statusCodes: {
-            notFoundRoute: '/__ultramodern-smoke-missing',
+            notFoundRoute: '/__ultramodern-smoke-missing/nope',
             unknownRouteStatus: 404
         },
         indexing: {

package/dist/esm/ultramodern-workspace/module-federation.js

@@ -18,6 +18,12 @@ function createAppModernConfig(scope, app) {
       },
 ` : '';
     const bffPluginEntry = appHasEffectApi(app) ? '        bffPlugin(),\n' : '';
+    const defaultAssetPrefixSource = 'shell' === app.kind ? "const defaultAssetPrefix = '/';" : `const remoteAssetOrigin =
+  configuredCloudflareUrl ||
+  inferredCloudflareUrl ||
+  (cloudflareDeployEnabled ? '/' : \`http://localhost:\${port}\`);
+const defaultRemoteAssetPrefix = \`\${remoteAssetOrigin.replace(/\\/+$/u, '')}/\`;
+const defaultAssetPrefix = defaultRemoteAssetPrefix;`;
     return `// @effect-diagnostics processEnv:off
 import {
   appTools,
@@ -80,12 +86,12 @@ const siteUrl =
   configuredCloudflareUrl ||
   inferredCloudflareUrl ||
   \`http://localhost:\${port}\`;
-// Asset loading is intentionally independent from the canonical site URL and
-// deployment public URL. Without an explicit asset prefix, assets stay
-// origin-relative so self-hosted apps, tunnels, and reverse proxies never leak
-// localhost URLs into production HTML.
+${defaultAssetPrefixSource}
+// Asset loading is intentionally independent from the canonical site URL.
+// Module Federation remotes must publish an absolute publicPath so browsers
+// load remoteEntry.js and exposed chunks from the remote origin, not the host.
 const assetPrefix =
-  configuredModernAssetPrefix || configuredUltramodernAssetPrefix || '/';
+  configuredModernAssetPrefix || configuredUltramodernAssetPrefix || defaultAssetPrefix;
 
 if (
   cloudflareDeployEnabled &&

package/dist/esm/ultramodern-workspace/package-json.js

@@ -95,7 +95,8 @@ function appDependencies(scope, packageSource, app, remotes = [], bridge) {
         [packageName(scope, 'shared-design-tokens')]: WORKSPACE_PACKAGE_VERSION,
         react: REACT_VERSION,
         'react-dom': REACT_DOM_VERSION,
-        'react-router': REACT_ROUTER_VERSION
+        'react-router': REACT_ROUTER_VERSION,
+        'react-router-dom': REACT_ROUTER_VERSION
     };
     for (const dependency of bridge?.dependencies ?? [])dependencies[dependency] = WORKSPACE_PACKAGE_VERSION;
     if ('shell' === app.kind) {

package/dist/esm/ultramodern-workspace/policy.js

@@ -107,7 +107,7 @@ const PUBLIC_WEBSITE_POLICY = {
             requireWebManifestWhenPresent: true
         },
         statusCodes: {
-            notFoundRoute: '/__ultramodern-smoke-missing',
+            notFoundRoute: '/__ultramodern-smoke-missing/nope',
             unknownRouteStatus: 404
         },
         indexing: {

package/dist/esm-node/ultramodern-workspace/module-federation.js

@@ -19,6 +19,12 @@ function createAppModernConfig(scope, app) {
       },
 ` : '';
     const bffPluginEntry = appHasEffectApi(app) ? '        bffPlugin(),\n' : '';
+    const defaultAssetPrefixSource = 'shell' === app.kind ? "const defaultAssetPrefix = '/';" : `const remoteAssetOrigin =
+  configuredCloudflareUrl ||
+  inferredCloudflareUrl ||
+  (cloudflareDeployEnabled ? '/' : \`http://localhost:\${port}\`);
+const defaultRemoteAssetPrefix = \`\${remoteAssetOrigin.replace(/\\/+$/u, '')}/\`;
+const defaultAssetPrefix = defaultRemoteAssetPrefix;`;
     return `// @effect-diagnostics processEnv:off
 import {
   appTools,
@@ -81,12 +87,12 @@ const siteUrl =
   configuredCloudflareUrl ||
   inferredCloudflareUrl ||
   \`http://localhost:\${port}\`;
-// Asset loading is intentionally independent from the canonical site URL and
-// deployment public URL. Without an explicit asset prefix, assets stay
-// origin-relative so self-hosted apps, tunnels, and reverse proxies never leak
-// localhost URLs into production HTML.
+${defaultAssetPrefixSource}
+// Asset loading is intentionally independent from the canonical site URL.
+// Module Federation remotes must publish an absolute publicPath so browsers
+// load remoteEntry.js and exposed chunks from the remote origin, not the host.
 const assetPrefix =
-  configuredModernAssetPrefix || configuredUltramodernAssetPrefix || '/';
+  configuredModernAssetPrefix || configuredUltramodernAssetPrefix || defaultAssetPrefix;
 
 if (
   cloudflareDeployEnabled &&

package/dist/esm-node/ultramodern-workspace/package-json.js

@@ -96,7 +96,8 @@ function appDependencies(scope, packageSource, app, remotes = [], bridge) {
         [packageName(scope, 'shared-design-tokens')]: WORKSPACE_PACKAGE_VERSION,
         react: REACT_VERSION,
         'react-dom': REACT_DOM_VERSION,
-        'react-router': REACT_ROUTER_VERSION
+        'react-router': REACT_ROUTER_VERSION,
+        'react-router-dom': REACT_ROUTER_VERSION
     };
     for (const dependency of bridge?.dependencies ?? [])dependencies[dependency] = WORKSPACE_PACKAGE_VERSION;
     if ('shell' === app.kind) {

package/dist/esm-node/ultramodern-workspace/policy.js

@@ -108,7 +108,7 @@ const PUBLIC_WEBSITE_POLICY = {
             requireWebManifestWhenPresent: true
         },
         statusCodes: {
-            notFoundRoute: '/__ultramodern-smoke-missing',
+            notFoundRoute: '/__ultramodern-smoke-missing/nope',
             unknownRouteStatus: 404
         },
         indexing: {

package/package.json

@@ -21,7 +21,7 @@
   "engines": {
     "node": ">=20"
   },
-  "version": "3.4.0-ultramodern.17",
+  "version": "3.4.0-ultramodern.19",
   "types": "./dist/types/index.d.ts",
   "main": "./dist/esm-node/index.js",
   "bin": {
@@ -77,7 +77,7 @@
     "@modern-js/codesmith": "2.6.9",
     "oxfmt": "0.55.0",
     "ultracite": "7.8.3",
-    "@modern-js/i18n-utils": "npm:@bleedingdev/modern-js-i18n-utils@3.4.0-ultramodern.17"
+    "@modern-js/i18n-utils": "npm:@bleedingdev/modern-js-i18n-utils@3.4.0-ultramodern.19"
   },
   "devDependencies": {
     "@rslib/core": "0.23.0",
@@ -99,6 +99,6 @@
     "test": "rm -rf dist && rslib build -c rslibconfig.mts && rstest --passWithNoTests"
   },
   "ultramodern": {
-    "frameworkVersion": "3.4.0-ultramodern.17"
+    "frameworkVersion": "3.4.0-ultramodern.19"
   }
 }

package/templates/workspace-scripts/proof-cloudflare-version.mjs

@@ -166,7 +166,7 @@ function createQualityGates() {
       requireWebManifestWhenPresent: true,
     },
     statusCodes: {
-      notFoundRoute: '/__ultramodern-smoke-missing',
+      notFoundRoute: '/__ultramodern-smoke-missing/nope',
       unknownRouteStatus: 404,
     },
     indexing: {

package/templates/workspace-scripts/ultramodern-cloudflare-proof.mjs

@@ -478,7 +478,8 @@ async function validateSsrHead(evidence, app, publicUrl, ssrRoute, ssr) {
 async function validateNotFound(evidence, app, publicUrl) {
   const qualityGates = app.deploy?.cloudflare?.qualityGates ?? {};
   const notFoundRoute =
-    qualityGates.statusCodes?.notFoundRoute ?? '/__ultramodern-smoke-missing';
+    qualityGates.statusCodes?.notFoundRoute ??
+    '/__ultramodern-smoke-missing/nope';
   const expectedStatus = qualityGates.statusCodes?.unknownRouteStatus ?? 404;
   const response = await fetchText(joinUrl(publicUrl, notFoundRoute));
   evidence.assertions.push({

package/templates/workspace-scripts/validate-ultramodern-workspace.mjs.handlebars

@@ -353,7 +353,7 @@ const createQualityGates = () => ({
     requireWebManifestWhenPresent: true,
   },
   statusCodes: {
-    notFoundRoute: '/__ultramodern-smoke-missing',
+    notFoundRoute: '/__ultramodern-smoke-missing/nope',
     unknownRouteStatus: 404,
   },
   indexing: {
@@ -480,7 +480,7 @@ const createAppConfigContract = app => ({
   output: {
     assetPrefix: {
       envFallbackOrder: ['MODERN_ASSET_PREFIX', 'ULTRAMODERN_ASSET_PREFIX'],
-      default: '/',
+      default: app.kind === 'shell' ? '/' : 'app-public-origin',
     },
     disableTsChecker: false,
   },
@@ -1790,8 +1790,9 @@ assert(shellModernConfig.includes('name: cloudflareWorkerName'), 'Shell modern.c
 assert(shellModernConfig.includes('const assetPrefix ='), 'Shell modern.config.ts must derive a dedicated asset prefix');
 assert(shellModernConfig.includes("const configuredUltramodernAssetPrefix = envValue('ULTRAMODERN_ASSET_PREFIX')"), 'Shell asset prefix must support ULTRAMODERN_ASSET_PREFIX');
 assert(shellModernConfig.includes("const configuredModernAssetPrefix = envValue('MODERN_ASSET_PREFIX')"), 'Shell asset prefix must support MODERN_ASSET_PREFIX');
+assert(shellModernConfig.includes("const defaultAssetPrefix = '/'"), 'Shell asset prefix must default to origin-relative assets');
 const shellAssetPrefixExpression = extractAssetPrefixExpression(shellModernConfig);
-assert(shellAssetPrefixExpression.includes("configuredModernAssetPrefix || configuredUltramodernAssetPrefix || '/'"), 'Shell asset prefix fallback order is incorrect');
+assert(shellAssetPrefixExpression.includes("configuredModernAssetPrefix || configuredUltramodernAssetPrefix || defaultAssetPrefix"), 'Shell asset prefix fallback order is incorrect');
 assert(!shellAssetPrefixExpression.includes('configuredSiteUrl') && !shellAssetPrefixExpression.includes('MODERN_PUBLIC_SITE_URL'), 'Shell asset prefix must not fall back to MODERN_PUBLIC_SITE_URL');
 assert(!shellAssetPrefixExpression.includes('configuredCloudflareUrl') && !shellAssetPrefixExpression.includes('ULTRAMODERN_PUBLIC_URL_SHELL_SUPER_APP'), 'Shell asset prefix must not fall back to the per-app public URL');
 assert(!shellAssetPrefixExpression.includes('inferredCloudflareUrl') && !shellAssetPrefixExpression.includes('ULTRAMODERN_CLOUDFLARE_WORKERS_DEV_SUBDOMAIN'), 'Shell asset prefix must not infer workers.dev URLs');
@@ -1889,15 +1890,17 @@ for (const vertical of fullStackVerticals) {
   assert(modernConfig.includes('const assetPrefix ='), `${vertical.id} modern.config.ts must derive a dedicated asset prefix`);
   assert(modernConfig.includes("const configuredUltramodernAssetPrefix = envValue('ULTRAMODERN_ASSET_PREFIX')"), `${vertical.id} asset prefix must support ULTRAMODERN_ASSET_PREFIX`);
   assert(modernConfig.includes("const configuredModernAssetPrefix = envValue('MODERN_ASSET_PREFIX')"), `${vertical.id} asset prefix must support MODERN_ASSET_PREFIX`);
+  assert(modernConfig.includes('const defaultRemoteAssetPrefix'), `${vertical.id} asset prefix must derive the remote asset origin`);
+  assert(modernConfig.includes('const defaultAssetPrefix = defaultRemoteAssetPrefix'), `${vertical.id} asset prefix must default to its own remote origin`);
   const verticalAssetPrefixExpression = extractAssetPrefixExpression(modernConfig);
-  assert(verticalAssetPrefixExpression.includes("configuredModernAssetPrefix || configuredUltramodernAssetPrefix || '/'"), `${vertical.id} asset prefix fallback order is incorrect`);
+  assert(verticalAssetPrefixExpression.includes("configuredModernAssetPrefix || configuredUltramodernAssetPrefix || defaultAssetPrefix"), `${vertical.id} asset prefix fallback order is incorrect`);
   assert(!verticalAssetPrefixExpression.includes('configuredSiteUrl') && !verticalAssetPrefixExpression.includes('MODERN_PUBLIC_SITE_URL'), `${vertical.id} asset prefix must not fall back to MODERN_PUBLIC_SITE_URL`);
-  assert(!verticalAssetPrefixExpression.includes('configuredCloudflareUrl') && !verticalAssetPrefixExpression.includes(`ULTRAMODERN_PUBLIC_URL_${vertical.id.replace(/-/g, '_').toUpperCase()}`), `${vertical.id} asset prefix must not fall back to the per-app public URL`);
-  assert(!verticalAssetPrefixExpression.includes('inferredCloudflareUrl') && !verticalAssetPrefixExpression.includes('ULTRAMODERN_CLOUDFLARE_WORKERS_DEV_SUBDOMAIN'), `${vertical.id} asset prefix must not infer workers.dev URLs`);
+  assert(modernConfig.includes(`envValue('ULTRAMODERN_PUBLIC_URL_${vertical.id.replace(/-/g, '_').toUpperCase()}')`), `${vertical.id} asset prefix must read its per-app public URL`);
+  assert(modernConfig.includes('inferredCloudflareUrl'), `${vertical.id} asset prefix must support workers.dev origin inference`);
   assert(modernConfig.includes("assetPrefix: '/'"), `${vertical.id} modern.config.ts must keep dev assets origin-relative`);
   assert(modernConfig.includes('assetPrefix,'), `${vertical.id} modern.config.ts must wire output.assetPrefix to the derived asset prefix`);
   assert(contractEntry?.config?.dev?.assetPrefix === '/', `${vertical.id} dev asset prefix must stay origin-relative`);
-  assert(contractEntry?.config?.output?.assetPrefix?.default === '/', `${vertical.id} asset prefix must default to origin-relative paths`);
+  assert(contractEntry?.config?.output?.assetPrefix?.default === 'app-public-origin', `${vertical.id} asset prefix must default to its app public origin`);
   assert(JSON.stringify(contractEntry?.config?.output?.assetPrefix?.envFallbackOrder) === JSON.stringify(['MODERN_ASSET_PREFIX', 'ULTRAMODERN_ASSET_PREFIX']), `${vertical.id} asset prefix env fallback order is incorrect`);
   assert(contractEntry?.config?.output?.disableTsChecker === false, `${vertical.id} must keep the framework TypeScript checker enabled`);
   assert(contractEntry?.config?.performance?.readinessDiagnostics?.default === 'enabled', `${vertical.id} performance readiness diagnostics must be default-on`);