@bleedingdev/modern-js-create 3.4.0-ultramodern.2 → 3.4.0-ultramodern.20

package/templates/workspace-scripts/validate-ultramodern-workspace.mjs.handlebars

@@ -1,4 +1,5 @@
 import { execFileSync } from 'node:child_process';
+import crypto from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
 
@@ -14,6 +15,21 @@ const expectedCloudflareBuildScript = {{expectedCloudflareBuildScriptJson}};
 const expectedCloudflareDeployScript = {{expectedCloudflareDeployScriptJson}};
 const expectedCloudflareSecurity = {{expectedCloudflareSecurityJson}};
 const publicSurfaceManagedSourceAssetPaths = {{publicSurfaceManagedSourceAssetPathsJson}};
+const compactConfigPath = '.modernjs/ultramodern.json';
+const retiredMetadataPaths = [
+  '.modernjs/ultramodern-generated-contract.json',
+  '.modernjs/ultramodern-package-source.json',
+  '.modernjs/ultramodern-workspace-template-manifest.json',
+];
+const modernPackageCohort = [
+  '@modern-js/create',
+  '@modern-js/code-tools',
+  '@modern-js/app-tools',
+  '@modern-js/plugin-bff',
+  '@modern-js/plugin-i18n',
+  '@modern-js/plugin-tanstack',
+  '@modern-js/runtime',
+];
 const expectedModernPackageSpecifier = packageName => {
   if (packageSource.strategy === 'workspace') {
     return 'workspace:*';
@@ -70,6 +86,688 @@ const assertArray = (value, contract, fixArea) => {
 };
 const findById = (entries, id) =>
   Array.isArray(entries) ? entries.find(entry => entry?.id === id) : undefined;
+const generatedContractLabel = compactConfigPath;
+const toKebabCase = value =>
+  String(value)
+    .trim()
+    .replace(/([a-z0-9])([A-Z])/gu, '$1-$2')
+    .replace(/[^a-zA-Z0-9._-]+/gu, '-')
+    .replace(/[._]+/gu, '-')
+    .toLowerCase()
+    .replace(/-+/gu, '-')
+    .replace(/^-+|-+$/gu, '');
+const toPascalCase = value =>
+  toKebabCase(value)
+    .split('-')
+    .filter(Boolean)
+    .map(part => part.charAt(0).toUpperCase() + part.slice(1))
+    .join('');
+const toCamelCase = value => {
+  const pascal = toPascalCase(value);
+  return `${pascal.charAt(0).toLowerCase()}${pascal.slice(1)}`;
+};
+const toEnvSegment = value => toKebabCase(value).replace(/-/gu, '_').toUpperCase();
+const packageNameFor = (scope, suffix) => `@${scope}/${suffix}`;
+const normalizeRelativePath = value =>
+  String(value ?? '').replace(/\\/gu, '/').replace(/^\.\/+/u, '');
+const appNamespace = app => (app.kind === 'shell' ? 'shell' : (app.domain ?? app.id));
+const tailwindPrefixDigitWords = [
+  'zero',
+  'one',
+  'two',
+  'three',
+  'four',
+  'five',
+  'six',
+  'seven',
+  'eight',
+  'nine',
+];
+const tailwindPrefixFor = app =>
+  app.kind === 'shell'
+    ? 'shell'
+    : String(app.domain ?? app.id)
+        .toLowerCase()
+        .replace(/[^a-z0-9]/gu, '')
+        .replace(/[0-9]/gu, digit => tailwindPrefixDigitWords[Number(digit)]);
+const buildMarkerFor = app =>
+  crypto
+    .createHash('sha256')
+    .update(`${packageScope}:${app.packageSuffix}:${app.id}:0.1.0`)
+    .digest('hex')
+    .slice(0, 16);
+const normalizeCompactApp = rawApp => {
+  const id = String(rawApp.id);
+  const kind = rawApp.kind === 'vertical' ? 'vertical' : 'shell';
+  const appPath =
+    typeof rawApp.path === 'string'
+      ? normalizeRelativePath(rawApp.path)
+      : kind === 'shell'
+        ? 'apps/shell-super-app'
+        : `verticals/${toKebabCase(id)}`;
+  const packageSuffix =
+    typeof rawApp.packageSuffix === 'string'
+      ? rawApp.packageSuffix
+      : appPath.split('/').at(-1) ?? id;
+  const domain =
+    typeof rawApp.domain === 'string'
+      ? rawApp.domain
+      : kind === 'vertical'
+        ? packageSuffix
+        : undefined;
+  const moduleFederation =
+    rawApp.moduleFederation && typeof rawApp.moduleFederation === 'object'
+      ? rawApp.moduleFederation
+      : {};
+  const effectApi =
+    rawApp.effectApi && typeof rawApp.effectApi === 'object'
+      ? {
+          stem:
+            typeof rawApp.effectApi.stem === 'string'
+              ? rawApp.effectApi.stem
+              : domain ?? id,
+          prefix:
+            typeof rawApp.effectApi.prefix === 'string'
+              ? rawApp.effectApi.prefix
+              : `/${domain ?? id}-api`,
+          consumedBy: Array.isArray(rawApp.effectApi.consumedBy)
+            ? rawApp.effectApi.consumedBy.filter(
+                consumer => typeof consumer === 'string',
+              )
+            : ['shell-super-app', id],
+        }
+      : undefined;
+
+  return {
+    id,
+    kind,
+    path: appPath,
+    package: typeof rawApp.package === 'string' ? rawApp.package : undefined,
+    packageSuffix,
+    domain,
+    port:
+      typeof rawApp.port === 'number'
+        ? rawApp.port
+        : kind === 'shell'
+          ? 3020
+          : 3030,
+    portEnv:
+      typeof rawApp.portEnv === 'string'
+        ? rawApp.portEnv
+        : kind === 'shell'
+          ? 'SHELL_SUPER_APP_PORT'
+          : `VERTICAL_${toEnvSegment(domain ?? id)}_PORT`,
+    mfName:
+      typeof moduleFederation.name === 'string'
+        ? moduleFederation.name
+        : kind === 'shell'
+          ? 'shellSuperApp'
+          : `vertical${toPascalCase(domain ?? id)}`,
+    exposes: Array.isArray(moduleFederation.exposes)
+      ? moduleFederation.exposes.filter(expose => typeof expose === 'string')
+      : [],
+    moduleFederationSsr: moduleFederation.ssr !== false,
+    verticalRefs: Array.isArray(moduleFederation.verticalRefs)
+      ? moduleFederation.verticalRefs.filter(ref => typeof ref === 'string')
+      : [],
+    effectApi,
+  };
+};
+const compactAppsFromConfig = config =>
+  Array.isArray(config.topology?.apps)
+    ? config.topology.apps.map(normalizeCompactApp)
+    : [];
+const remoteDependencyAliasFor = app => toCamelCase(app.domain ?? app.id.replace(/^remote-/u, ''));
+const remoteContractsFor = (app, apps) =>
+  (app.verticalRefs ?? [])
+    .map(ref => apps.find(candidate => candidate.id === ref))
+    .filter(Boolean)
+    .map(remote => ({
+      id: remote.id,
+      alias: remoteDependencyAliasFor(remote),
+      name: remote.mfName,
+      manifestEnv: `VERTICAL_${toEnvSegment(remote.domain ?? remote.id)}_MF_MANIFEST`,
+      manifestUrl: `http://localhost:${remote.port}/mf-manifest.json`,
+    }));
+const createRouteOwnedEntries = app => {
+  const namespace = appNamespace(app);
+  const base = {
+    descriptionKey: `${namespace}.seo.description`,
+    mfBoundaryId: app.mfName,
+    namespace,
+    ownerAppId: app.id,
+    public: false,
+    indexable: false,
+    publicSurface: 'private-app-screen',
+  };
+
+  return [
+    {
+      ...base,
+      canonicalPath: '/',
+      id: app.kind === 'shell' ? 'shell-home' : `${app.id}-home`,
+      localisedPaths: {
+        cs: '/',
+        en: '/',
+      },
+      titleKey: app.kind === 'shell' ? 'shell.title' : `${namespace}.title`,
+    },
+  ];
+};
+const createPublicRoutes = app =>
+  createRouteOwnedEntries(app)
+    .filter(route => route.public && route.indexable)
+    .map(route => ({
+      canonicalPath: route.canonicalPath,
+      id: route.id,
+      localisedPaths: route.localisedPaths,
+      namespace: route.namespace,
+      ownerAppId: route.ownerAppId,
+      descriptionKey: route.descriptionKey,
+      titleKey: route.titleKey,
+    }));
+const createLocalisedUrls = app =>
+  Object.fromEntries(
+    createRouteOwnedEntries(app).flatMap(route => {
+      if (route.canonicalPath === '/') {
+        return [];
+      }
+      return Array.from(
+        new Set([route.canonicalPath, ...Object.values(route.localisedPaths)]),
+      ).map(pathname => [pathname, route.localisedPaths]);
+    }),
+  );
+const createPublicSurface = app => {
+  const publicRoutes = createPublicRoutes(app);
+  return {
+    authoring: 'colocated-route-meta',
+    artifactLifecycle: 'build-and-deploy-output',
+    generatedManifest: './src/routes/ultramodern-route-metadata',
+    source: 'route-owned-public-routes',
+    metadataExport: './src/routes/ultramodern-route-metadata',
+    generator: 'scripts/generate-public-surface-assets.mjs',
+    outputRoot: 'dist/public',
+    cloudflareOutputRoot: '.output/public',
+    privateRoutePolicy: 'omit-from-generated-public-surface',
+    files:
+      publicRoutes.length > 0
+        ? ['robots.txt', 'sitemap.xml', 'site.webmanifest']
+        : ['robots.txt'],
+    omittedByDefault: ['api-catalog.json', 'llms.txt', 'security.txt'],
+    languages: ['en', 'cs'],
+    contentExpansion: {
+      authoring: 'route-owned-esm-provider',
+      defaultProviderFile: 'route.sitemap.mjs',
+      entryExport: 'default-or-entries',
+      paramsSource: 'params-or-localeParams',
+      draftPolicy: 'omit-draft-by-default',
+      indexablePolicy: 'omit-indexable-false',
+      lifecycle: 'executed-during-public-surface-generation',
+    },
+    contentSources: [],
+    publicRoutes,
+    routeEntries: [],
+    concreteUrlPaths: [],
+  };
+};
+const createPublicHead = () => ({
+  authoring: 'colocated-route-meta',
+  generator: './src/routes/ultramodern-route-head',
+  renderer: '@modern-js/runtime/head Helmet',
+  ssr: true,
+  title: {
+    required: true,
+    source: 'route.titleKey',
+  },
+  description: {
+    required: true,
+    source: 'route.descriptionKey',
+  },
+  canonical: {
+    publicIndexableOnly: true,
+    source: 'localized canonical route URL',
+  },
+  alternates: {
+    hreflang: ['en', 'cs'],
+    xDefault: 'en',
+  },
+  openGraph: {
+    publicIndexableOnly: true,
+    required: ['og:title', 'og:description', 'og:url', 'og:type'],
+  },
+  twitter: {
+    publicIndexableOnly: true,
+    required: ['twitter:card', 'twitter:title', 'twitter:description'],
+  },
+  structuredData: {
+    publicIndexableOnly: true,
+    optional: true,
+    source: 'route.jsonLd',
+    inference: false,
+    helperModule: './src/routes/ultramodern-jsonld',
+    helperTypes: [
+      'WebPage',
+      'WebApplication',
+      'SoftwareApplication',
+      'BreadcrumbList',
+      'FAQPage',
+      'Organization',
+    ],
+    sanitizesHtmlOpenBracket: true,
+  },
+  privateRouteRobots: 'noindex, nofollow',
+});
+const createQualityGates = () => ({
+  publicRoutes: {
+    requireSitemapWhenPresent: true,
+    requireRobotsSitemapConsistency: true,
+    requireWebManifestWhenPresent: true,
+  },
+  statusCodes: {
+    notFoundRoute: '/__ultramodern-smoke-missing/nope',
+    unknownRouteStatus: 404,
+  },
+  indexing: {
+    previewNoindex: true,
+    productionPublicRoutesIndexable: true,
+  },
+  assets: {
+    cssPreloadRequired: true,
+    cssResponseRequired: true,
+    cacheControlRequiredForCss: true,
+    sourcemapsPubliclyReferenced: false,
+  },
+  budgets: {
+    ssrHtmlMaxBytes: 250_000,
+    mfManifestMaxBytes: 500_000,
+    localeJsonMaxBytes: 100_000,
+    sitemapXmlMaxBytes: 500_000,
+    cssAssetMaxBytes: 750_000,
+  },
+  csp: {
+    finalMode: 'report-only-dogfood',
+    decision:
+      'Report-only remains the generated final mode until public smoke proof records MF SSR script/style/connect compatibility for the deployed surface.',
+  },
+});
+const createCloudflareRoutes = app => ({
+  ssr: '/en',
+  mfManifest: '/mf-manifest.json',
+  locale: `/locales/en/${appNamespace(app)}.json`,
+  ...(app.effectApi
+    ? {
+        apiReadiness: `${app.effectApi.prefix}/${app.effectApi.stem}/readiness`,
+      }
+    : {}),
+});
+const createCloudflareDeploy = app => ({
+  target: 'cloudflare',
+  workerName: expectedWorkerName(app.packageSuffix),
+  publicUrlEnv: `ULTRAMODERN_PUBLIC_URL_${toEnvSegment(app.id)}`,
+  compatibilityDate: '{{cloudflareCompatibilityDate}}',
+  compatibilityFlags: ['nodejs_compat', 'global_fetch_strictly_public'],
+  assetsBinding: 'ASSETS',
+  routes: createCloudflareRoutes(app),
+  security: expectedCloudflareSecurity,
+  qualityGates: createQualityGates(),
+  evidence: {
+    proofScript: 'scripts/proof-cloudflare-version.mjs',
+    reportDefault:
+      '.codex/reports/cloudflare-version-proof/public-url-proof.json',
+  },
+});
+const createEffectReadiness = app => ({
+  endpoint: `/${app.effectApi.stem}/readiness`,
+  marker: {
+    ui: 'ultramodernUiMarker',
+    api: 'ultramodernApiMarker',
+    skew: 'none',
+  },
+  checks: ['moduleFederation', 'ssr', 'translations', 'api'],
+});
+const createEffectRequestContext = () => ({
+  propagatedHeaders: [
+    'accept-language',
+    'authorization',
+    'traceparent',
+    'x-correlation-id',
+    'x-tenant-id',
+    'x-ultramodern-env',
+    'x-vertical-version-id',
+  ],
+  source: 'shell-to-vertical-api-client',
+});
+const createEffectDomainOperations = app => {
+  const stem = app.effectApi.stem;
+  const group = toCamelCase(stem);
+  const basePath = `/${stem}`;
+  return {
+    workspaceFeed: {
+      client: `list${toPascalCase(stem)}`,
+      method: 'GET',
+      path: basePath,
+      resource: 'workspace-items',
+      owner: app.id,
+    },
+    workspaceDetail: {
+      client: `get${toPascalCase(stem)}`,
+      method: 'GET',
+      path: `${basePath}/:id`,
+      resource: 'workspace-item',
+      owner: app.id,
+    },
+    workspaceCreate: {
+      client: `create${toPascalCase(stem)}`,
+      method: 'POST',
+      path: basePath,
+      resource: group,
+      owner: app.id,
+    },
+  };
+};
+const createEffectOperationContract = app => ({
+  group: toCamelCase(app.effectApi.stem),
+  operations: {
+    readiness: {
+      method: 'GET',
+      path: `/${app.effectApi.stem}/readiness`,
+      source: 'generated-client',
+    },
+  },
+});
+const createAppConfigContract = app => ({
+  preset: 'presetUltramodern',
+  plugins: [
+    'appTools',
+    'tanstackRouterPlugin',
+    'i18nPlugin',
+    ...(app.effectApi ? ['bffPlugin'] : []),
+    'moduleFederationPlugin',
+    'zephyrRspackPlugin',
+  ],
+  dev: {
+    assetPrefix: '/',
+  },
+  output: {
+    assetPrefix: {
+      envFallbackOrder: ['MODERN_ASSET_PREFIX', 'ULTRAMODERN_ASSET_PREFIX'],
+      default: app.kind === 'shell' ? '/' : 'app-public-origin',
+    },
+    disableTsChecker: false,
+  },
+  performance: {
+    readinessDiagnostics: {
+      default: 'enabled',
+      optOut: {
+        env: 'ULTRAMODERN_PERFORMANCE_READINESS_DIAGNOSTICS=false',
+        config: 'scripts/ultramodern-performance-readiness.config.mjs',
+      },
+      failOn: 'framework-invariant',
+    },
+  },
+  rspack: {
+    output: {
+      uniqueName: app.mfName,
+      chunkLoadingGlobal: expectedChunkLoadingGlobal(app.mfName),
+    },
+  },
+  source: {
+    siteUrl: {
+      envFallbackOrder: [
+        'MODERN_PUBLIC_SITE_URL',
+        `ULTRAMODERN_PUBLIC_URL_${toEnvSegment(app.id)}`,
+        'ULTRAMODERN_CLOUDFLARE_WORKERS_DEV_SUBDOMAIN',
+        app.portEnv,
+      ],
+      defaultLocalhostPort: app.port,
+    },
+  },
+});
+const cssDedupe = () => ({
+  strategy: 'shared-token-package-plus-css-content-hash',
+  sharedPackage: packageNameFor(packageScope, 'shared-design-tokens'),
+  sharedLayers: ['ultramodern-shared-tokens'],
+  runtimeLoad: 'once-per-content-hash',
+  duplicateBaseStylesAllowed: false,
+});
+const createStylingContract = app => {
+  const sharedTokenPackage = packageNameFor(packageScope, 'shared-design-tokens');
+  const ownedLayers =
+    app.kind === 'shell'
+      ? ['ultramodern-shell-base', 'ultramodern-shell-overlay']
+      : [`ultramodern-vertical-${app.domain ?? app.id}`];
+
+  return {
+    tailwind: tailwindEnabled,
+    federation: {
+      owner: {
+        id: app.id,
+        package: app.package ?? packageNameFor(packageScope, app.packageSuffix),
+      },
+      role: app.kind === 'shell' ? 'shell-base-overlay' : 'vertical-css',
+      rootSelector: `[data-app-id="${app.id}"]`,
+      classPrefix: `${tailwindPrefixFor(app)}:`,
+      layers: {
+        shared: ['ultramodern-shared-tokens'],
+        owned: ownedLayers,
+      },
+      entrypoints: {
+        layoutImport: 'src/routes/layout.tsx',
+        css: ['src/routes/index.css'],
+        ...(app.kind === 'shell'
+          ? {}
+          : { federationEntry: 'src/federation-entry.tsx' }),
+      },
+      assets: {
+        shared: [`${sharedTokenPackage}/tokens.css`],
+        owned: ['src/routes/index.css'],
+      },
+      dedupe: cssDedupe(),
+      ssr: {
+        cloudflare: true,
+        firstPaintRequired: true,
+        verticalCss:
+          app.kind === 'shell'
+            ? 'host-preloads-shell-and-shared-css'
+            : 'federated-manifest-owned-css',
+      },
+    },
+  };
+};
+const createAppContract = (app, apps) => ({
+  id: app.id,
+  package: app.package ?? packageNameFor(packageScope, app.packageSuffix),
+  path: app.path,
+  kind: app.kind,
+  config: createAppConfigContract(app),
+  styling: createStylingContract(app),
+  deploy: {
+    target: 'cloudflare',
+    cloudflare: createCloudflareDeploy(app),
+    worker: {
+      compatibilityDate: '{{cloudflareCompatibilityDate}}',
+      name: expectedWorkerName(app.packageSuffix),
+      security: expectedCloudflareSecurity,
+      ssr: true,
+    },
+  },
+  ssr: app.moduleFederationSsr
+    ? {
+        mode: 'string',
+        moduleFederationAppSSR: true,
+      }
+    : undefined,
+  i18n: {
+    languages: ['en', 'cs'],
+    namespace: appNamespace(app),
+    localisedUrls: createLocalisedUrls(app),
+  },
+  routes: {
+    source: 'route-owned',
+    metadataAuthoring: 'colocated-route-meta',
+    generatedManifest: true,
+    metadataExport: './src/routes/ultramodern-route-metadata',
+    localisedUrls: createLocalisedUrls(app),
+    owned: createRouteOwnedEntries(app),
+    publicRoutes: createPublicRoutes(app),
+    privateByDefault: true,
+    publicnessDefault: 'private-app-screen',
+    publicHead: createPublicHead(),
+    publicSurface: createPublicSurface(app),
+  },
+  moduleFederation: {
+    name: app.mfName,
+    ...(app.verticalRefs?.length
+      ? {
+          verticalRefs: app.verticalRefs,
+          remotes: remoteContractsFor(app, apps),
+        }
+      : {}),
+    exposes: app.exposes,
+    dts: {
+      compilerInstance: 'tsgo',
+      displayErrorInTerminal: true,
+      tsConfigPath: './tsconfig.mf-types.json',
+    },
+    browserSafeExposesOnly: true,
+  },
+  marker: {
+    appId: app.id,
+    packageName: app.package ?? packageNameFor(packageScope, app.packageSuffix),
+    version: '0.1.0',
+    build: buildMarkerFor(app),
+    deployProfile: 'cloudflare-ssr-mf-effect-v1',
+    uiSurface: 'ui',
+    ...(app.effectApi ? { apiSurface: 'api' } : {}),
+  },
+  ...(app.effectApi
+    ? {
+        api: {
+          runtime: 'effect',
+          import: '@modern-js/plugin-bff/effect-edge',
+          prefix: app.effectApi.prefix,
+          openapi: '/openapi.json',
+          strictEffectApproach: true,
+          workerEntry: 'worker/__modern_bff_effect.js',
+          contract: './api',
+          client: './api/client',
+          readiness: createEffectReadiness(app),
+          requestContext: createEffectRequestContext(),
+          domainOperations: createEffectDomainOperations(app),
+          ...createEffectOperationContract(app),
+        },
+      }
+    : {}),
+});
+const createCssFederationContract = () => ({
+  sharedDesignTokens: {
+    owner: {
+      id: 'shared-design-tokens',
+      package: packageNameFor(packageScope, 'shared-design-tokens'),
+    },
+    role: 'shared-design-tokens',
+    rootSelector: ':root',
+    classPrefix: '--um-',
+    layers: {
+      owned: ['ultramodern-shared-tokens'],
+    },
+    entrypoints: {
+      css: ['packages/shared-design-tokens/src/tokens.css'],
+    },
+    assets: {
+      exports: ['./tokens.css'],
+    },
+    dedupe: cssDedupe(),
+    ssr: {
+      firstPaintRequired: true,
+    },
+  },
+});
+const createPerformanceReadinessContract = () => ({
+  default: 'enabled',
+  mode: 'diagnostic',
+  scope: 'ultramodern-generated-and-framework-owned',
+  report: {
+    script: 'scripts/ultramodern-performance-readiness.mjs',
+    config: 'scripts/ultramodern-performance-readiness.config.mjs',
+    deterministic: true,
+  },
+  optOut: {
+    env: 'ULTRAMODERN_PERFORMANCE_READINESS_DIAGNOSTICS=false',
+  },
+  signals: [
+    'bfcache',
+    'core-web-vitals-rum',
+    'duplicate-prefetch-warmup',
+    'cache-policy-sanity',
+    'save-data-behavior',
+    'cloudflare-ssr-cache-hints',
+  ].map(id => ({ id })),
+});
+const createModernPackageAliases = packageSourceConfig => {
+  if (typeof packageSourceConfig?.aliasScope !== 'string') {
+    return undefined;
+  }
+  const scope = packageSourceConfig.aliasScope.replace(/^@/u, '');
+  const prefix =
+    typeof packageSourceConfig.aliasPackageNamePrefix === 'string'
+      ? packageSourceConfig.aliasPackageNamePrefix
+      : '';
+  return Object.fromEntries(
+    modernPackageCohort.map(packageName => [
+      packageName,
+      `@${scope}/${prefix}${packageName.split('/').at(-1)}`,
+    ]),
+  );
+};
+const synthesizePackageSourceFromCompact = config => {
+  const source = config.packageSource ?? {};
+  const strategy = source.strategy === 'install' ? 'install' : 'workspace';
+  const specifier =
+    strategy === 'install' && typeof source.modernPackageVersion === 'string'
+      ? source.modernPackageVersion
+      : 'workspace:*';
+  const aliases = createModernPackageAliases(source);
+  return {
+    schemaVersion: 1,
+    strategy,
+    modernPackages: {
+      packages: modernPackageCohort,
+      specifier,
+      ...(typeof source.registry === 'string'
+        ? { registry: source.registry }
+        : {}),
+      ...(aliases ? { aliases } : {}),
+    },
+    generatedWorkspacePackages: {
+      packages: [
+        packageNameFor(packageScope, 'shared-contracts'),
+        packageNameFor(packageScope, 'shared-design-tokens'),
+      ],
+      specifier: 'workspace:*',
+    },
+  };
+};
+const synthesizeGeneratedContractFromCompact = config => {
+  const apps = compactAppsFromConfig(config);
+  return {
+    schemaVersion: 1,
+    profile: config.profile ?? 'cloudflare-ssr-mf-effect-v1',
+    node: {
+      version: config.workspace?.node?.version ?? expectedNodeVersion,
+      engineRange: '>=26',
+    },
+    performanceReadiness: createPerformanceReadinessContract(),
+    cssFederation: createCssFederationContract(),
+    apps: apps.map(app => createAppContract(app, apps)),
+  };
+};
+const readPackageSourceView = config => {
+  return synthesizePackageSourceFromCompact(config);
+};
+const readGeneratedContractView = config => {
+  return synthesizeGeneratedContractFromCompact(config);
+};
 const expectedManifestUrl = vertical =>
   `http://localhost:${vertical.port}/mf-manifest.json`;
 const expectedApiUrl = vertical =>
@@ -92,11 +790,12 @@ const expectedRemoteSubsetsForRefs = refs =>
 const requiredMicroVerticalPaths = vertical => [
   `${vertical.path}/package.json`,
   `${vertical.path}/tsconfig.json`,
+  `${vertical.path}/tsconfig.mf-types.json`,
   `${vertical.path}/modern.config.ts`,
   `${vertical.path}/module-federation.config.ts`,
-  `${vertical.path}/api/effect/index.ts`,
-  `${vertical.path}/shared/effect/api.ts`,
-  `${vertical.path}/src/effect/${vertical.stem}-client.ts`,
+  `${vertical.path}/api/index.ts`,
+  `${vertical.path}/shared/api.ts`,
+  `${vertical.path}/src/api/${vertical.stem}-client.ts`,
   `${vertical.path}/src/modern-app-env.d.ts`,
   `${vertical.path}/src/modern.runtime.ts`,
   `${vertical.path}/src/federation-entry.tsx`,
@@ -172,11 +871,11 @@ const assertMicroVerticalContractGraph = ({
   assertObject(
     overlay.apis,
     'topology/local-overlays/development.json apis',
-    'restore generated local Effect API overlays',
+    'restore generated local API overlays',
   );
   assertArray(
     generatedContract.apps,
-    '.modernjs/ultramodern-generated-contract.json apps',
+    `${generatedContractLabel} apps`,
     'regenerate the generated contract from the workspace topology',
   );
 
@@ -201,26 +900,26 @@ const assertMicroVerticalContractGraph = ({
   assertSameJson(
     generatedContract.apps.map(app => app?.id),
     expectedAppIds,
-    '.modernjs/ultramodern-generated-contract.json apps',
+    `${generatedContractLabel} apps`,
     'regenerate the generated contract after topology changes',
   );
 
   const shellContract = findById(generatedContract.apps, 'shell-super-app');
   assertObject(
     shellContract,
-    '.modernjs/ultramodern-generated-contract.json apps.shell-super-app',
+    `${generatedContractLabel} apps.shell-super-app`,
     'regenerate the generated shell contract entry',
   );
   assertSameJson(
     shellContract.moduleFederation?.verticalRefs ?? [],
     expectedVerticalIds,
-    '.modernjs/ultramodern-generated-contract.json shell moduleFederation.verticalRefs',
+    `${generatedContractLabel} shell moduleFederation.verticalRefs`,
     'regenerate the generated shell Module Federation contract',
   );
   assertSameJson(
     (shellContract.moduleFederation?.remotes ?? []).map(remoteContractSubset),
     expectedShellRemotes,
-    '.modernjs/ultramodern-generated-contract.json shell moduleFederation.remotes',
+    `${generatedContractLabel} shell moduleFederation.remotes`,
     'regenerate the generated shell Module Federation contract',
   );
   assertSameJson(
@@ -229,7 +928,7 @@ const assertMicroVerticalContractGraph = ({
       mode: 'string',
       moduleFederationAppSSR: true,
     },
-    '.modernjs/ultramodern-generated-contract.json shell SSR contract',
+    `${generatedContractLabel} shell SSR contract`,
     'restore generated string SSR Module Federation settings',
   );
 
@@ -265,9 +964,9 @@ const assertMicroVerticalContractGraph = ({
             remoteContractSubset,
           ),
         },
-        effect: {
-          prefix: topologyEntry.api?.effect?.bff?.prefix,
-          serverEntry: topologyEntry.api?.effect?.serverEntry,
+        api: {
+          prefix: topologyEntry.api?.bff?.prefix,
+          serverEntry: topologyEntry.api?.serverEntry,
         },
       },
       {
@@ -281,9 +980,9 @@ const assertMicroVerticalContractGraph = ({
           verticalRefs: expectedRefs,
           remotes: expectedRemoteSubsetsForRefs(expectedRefs),
         },
-        effect: {
+        api: {
           prefix: vertical.apiPrefix,
-          serverEntry: `${vertical.path}/api/effect/index.ts`,
+          serverEntry: `${vertical.path}/api/index.ts`,
         },
       },
       `topology/reference-topology.json verticals.${vertical.id}`,
@@ -324,14 +1023,14 @@ const assertMicroVerticalContractGraph = ({
       overlay.apis[vertical.id],
       expectedApiUrl(vertical),
       `topology/local-overlays/development.json apis.${vertical.id}`,
-      'restore generated local Effect API overlay',
+      'restore generated local API overlay',
     );
 
     assertSameJson(
       shellPackage.dependencies?.[vertical.packageName],
       'workspace:*',
       `apps/shell-super-app/package.json dependencies.${vertical.packageName}`,
-      'restore shell dependency for the MicroVertical Effect API consumer',
+      'restore shell dependency for the MicroVertical API consumer',
     );
     assertSameJson(
       shellPackage['zephyr:dependencies']?.[vertical.zephyrAlias],
@@ -342,7 +1041,7 @@ const assertMicroVerticalContractGraph = ({
 
     assertObject(
       contractEntry,
-      `.modernjs/ultramodern-generated-contract.json apps.${vertical.id}`,
+      `${generatedContractLabel} apps.${vertical.id}`,
       'regenerate the generated MicroVertical contract entry',
     );
     assertSameJson(
@@ -358,10 +1057,10 @@ const assertMicroVerticalContractGraph = ({
             remoteContractSubset,
           ),
         },
-        effect: {
-          prefix: contractEntry.effect?.prefix,
-          contract: contractEntry.effect?.contract,
-          client: contractEntry.effect?.client,
+        api: {
+          prefix: contractEntry.api?.prefix,
+          contract: contractEntry.api?.contract,
+          client: contractEntry.api?.client,
         },
         ssr: contractEntry.ssr,
       },
@@ -375,21 +1074,141 @@ const assertMicroVerticalContractGraph = ({
           verticalRefs: expectedRefs,
           remotes: expectedRemoteSubsetsForRefs(expectedRefs),
         },
-        effect: {
+        api: {
           prefix: vertical.apiPrefix,
-          contract: './shared/effect/api',
-          client: './effect/client',
+          contract: './api',
+          client: './api/client',
         },
         ssr: {
           mode: 'string',
           moduleFederationAppSSR: true,
         },
       },
-      `.modernjs/ultramodern-generated-contract.json apps.${vertical.id}`,
+      `${generatedContractLabel} apps.${vertical.id}`,
       'regenerate the generated MicroVertical contract entry',
     );
   }
 };
+const toPosixPath = value => value.split(path.sep).join('/');
+const referenceFrom = (fromPath, toPath) => ({
+  path: toPosixPath(path.relative(fromPath, toPath)),
+});
+const sharedPackagePaths = [
+  'packages/shared-contracts',
+  'packages/shared-design-tokens',
+];
+const tsgoCacheKey = packagePath => packagePath.replace(/[^a-zA-Z0-9._-]+/gu, '__');
+const assertProjectReferenceEmitConfig = (tsConfig, packagePath) => {
+  const compilerOptions = tsConfig.compilerOptions ?? {};
+  const relativeRoot = toPosixPath(path.relative(packagePath, '.')) || '.';
+  assert(compilerOptions.composite === true, `${packagePath} must stay a composite TS-Go project`);
+  assert(compilerOptions.declaration === true, `${packagePath} must emit declarations for TS-Go build mode`);
+  assert(compilerOptions.declarationMap === false, `${packagePath} must not emit declaration maps during checks`);
+  assert(compilerOptions.emitDeclarationOnly === true, `${packagePath} must only emit declarations during checks`);
+  assert(compilerOptions.noEmit === false, `${packagePath} must override root noEmit for TS-Go build mode`);
+  assert(
+    compilerOptions.outDir === `${relativeRoot}/node_modules/.cache/tsgo/declarations/${tsgoCacheKey(packagePath)}`,
+    `${packagePath} must emit TS-Go declarations into the generated cache`,
+  );
+  assert(
+    compilerOptions.tsBuildInfoFile === `${relativeRoot}/node_modules/.cache/tsgo/${tsgoCacheKey(packagePath)}.tsbuildinfo`,
+    `${packagePath} must keep TS-Go build info in the generated cache`,
+  );
+};
+const assertTsConfigReferenceGraph = () => {
+  const rootTsConfig = readJson('tsconfig.json');
+  const shellTsConfig = readJson('apps/shell-super-app/tsconfig.json');
+  const shellMfTypesTsConfig = readJson(
+    'apps/shell-super-app/tsconfig.mf-types.json',
+  );
+  const expectedRootReferences = [
+    ...sharedPackagePaths,
+    'apps/shell-super-app',
+    ...fullStackVerticals.map(vertical => vertical.path),
+  ].map(referencePath => ({ path: referencePath }));
+  const expectedShellReferences = [
+    ...sharedPackagePaths,
+    ...fullStackVerticals.map(vertical => vertical.path),
+  ].map(referencePath =>
+    referenceFrom('apps/shell-super-app', referencePath),
+  );
+
+  assertSameJson(
+    rootTsConfig.files,
+    [],
+    'tsconfig.json files',
+    'restore the generated root project-reference tsconfig',
+  );
+  assertSameJson(
+    rootTsConfig.references ?? [],
+    expectedRootReferences,
+    'tsconfig.json references',
+    'restore the generated root project-reference graph',
+  );
+  assertSameJson(
+    shellTsConfig.references ?? [],
+    expectedShellReferences,
+    'apps/shell-super-app/tsconfig.json references',
+    'restore the generated shell project-reference graph',
+  );
+  assertProjectReferenceEmitConfig(
+    shellTsConfig,
+    'apps/shell-super-app',
+  );
+  assertSameJson(
+    shellMfTypesTsConfig,
+    {
+      extends: './tsconfig.json',
+      include: ['src/modern-app-env.d.ts'],
+    },
+    'apps/shell-super-app/tsconfig.mf-types.json',
+    'restore the generated shell Module Federation DTS boundary',
+  );
+  for (const sharedPackagePath of sharedPackagePaths) {
+    assertProjectReferenceEmitConfig(
+      readJson(`${sharedPackagePath}/tsconfig.json`),
+      sharedPackagePath,
+    );
+  }
+
+  for (const vertical of fullStackVerticals) {
+    const verticalTsConfig = readJson(`${vertical.path}/tsconfig.json`);
+    const verticalMfTypesTsConfig = readJson(
+      `${vertical.path}/tsconfig.mf-types.json`,
+    );
+    const expectedVerticalReferences = [
+      ...sharedPackagePaths,
+      ...(vertical.verticalRefs ?? [])
+        .map(verticalRef =>
+          fullStackVerticals.find(candidate => candidate.id === verticalRef),
+        )
+        .filter(Boolean)
+        .map(referencedVertical => referencedVertical.path),
+    ].map(referencePath => referenceFrom(vertical.path, referencePath));
+    assertSameJson(
+      verticalTsConfig.references ?? [],
+      expectedVerticalReferences,
+      `${vertical.path}/tsconfig.json references`,
+      'restore the generated MicroVertical project-reference graph',
+    );
+    assertProjectReferenceEmitConfig(verticalTsConfig, vertical.path);
+    assertSameJson(
+      verticalMfTypesTsConfig,
+      {
+        extends: './tsconfig.json',
+        include: [
+          'src/federation-entry.tsx',
+          ...vertical.componentPaths.map(componentPath =>
+            componentPath.replace(`${vertical.path}/`, ''),
+          ),
+          'src/modern-app-env.d.ts',
+        ],
+      },
+      `${vertical.path}/tsconfig.mf-types.json`,
+      'restore the generated MicroVertical Module Federation DTS boundary',
+    );
+  }
+};
 const packageJsonFiles = startDir => {
   const files = [];
   const queue = [startDir];
@@ -649,17 +1468,15 @@ const requiredPaths = [
   'oxfmt.config.ts',
   '.github/renovate.json',
   '.github/workflows/ultramodern-workspace-gates.yml',
-  '.agents/skills-lock.json',
   '.agents/agent-reference-repos.json',
-  '.agents/rstackjs-agent-skills-LICENSE',
+  '.codex/skills-lock.json',
+  '.codex/rstackjs-agent-skills-LICENSE',
   'topology/reference-topology.json',
   'topology/ownership.json',
   'topology/local-overlays/development.json',
-  '.modernjs/ultramodern-workspace-template-manifest.json',
-  '.modernjs/ultramodern-package-source.json',
-  '.modernjs/ultramodern-generated-contract.json',
   'scripts/assert-mf-types.mjs',
   'scripts/bootstrap-agent-skills.mjs',
+  'scripts/check-ultramodern-api-boundaries.mjs',
   'scripts/check-ultramodern-i18n-boundaries.mjs',
   'scripts/generate-public-surface-assets.mjs',
   'scripts/proof-cloudflare-version.mjs',
@@ -667,13 +1484,15 @@ const requiredPaths = [
   'scripts/ultramodern-performance-readiness.config.mjs',
   'scripts/ultramodern-performance-readiness.mjs',
   'scripts/ultramodern-typecheck.mjs',
+  'scripts/validate-ultramodern-workspace.mjs',
   'apps/shell-super-app/package.json',
   'apps/shell-super-app/tsconfig.json',
+  'apps/shell-super-app/tsconfig.mf-types.json',
   'apps/shell-super-app/modern.config.ts',
   'apps/shell-super-app/module-federation.config.ts',
   'apps/shell-super-app/src/modern-app-env.d.ts',
   'apps/shell-super-app/src/modern.runtime.ts',
-  'apps/shell-super-app/src/effect/vertical-clients.ts',
+  'apps/shell-super-app/src/api/vertical-clients.ts',
   'apps/shell-super-app/locales/en/translation.json',
   `apps/shell-super-app/locales/en/${shellNamespace}.json`,
   'apps/shell-super-app/locales/cs/translation.json',
@@ -708,6 +1527,8 @@ if (tailwindEnabled) {
   );
 }
 
+requiredPaths.push(compactConfigPath);
+
 for (const vertical of fullStackVerticals) {
   requiredMicroVerticalPaths(vertical).forEach(
     assertRequiredVerticalFile(vertical),
@@ -719,9 +1540,15 @@ for (const requiredPath of requiredPaths) {
 for (const oldRemotePath of oldRemotePaths) {
   assertNotExists(oldRemotePath);
 }
+for (const retiredMetadataPath of retiredMetadataPaths) {
+  assertNotExists(retiredMetadataPath);
+}
 const rootPackage = readJson('package.json');
-const packageSource = readJson('.modernjs/ultramodern-package-source.json');
-const generatedContract = readJson('.modernjs/ultramodern-generated-contract.json');
+const ultramodernConfig = readJson(compactConfigPath);
+const bridgeConfig =
+  ultramodernConfig?.bridge?.enabled === true ? ultramodernConfig.bridge : undefined;
+const packageSource = readPackageSourceView(ultramodernConfig);
+const generatedContract = readGeneratedContractView(ultramodernConfig);
 const topology = readJson('topology/reference-topology.json');
 const ownership = readJson('topology/ownership.json');
 const overlay = readJson('topology/local-overlays/development.json');
@@ -734,6 +1561,7 @@ assertMicroVerticalContractGraph({
   overlay,
   shellPackage,
 });
+assertTsConfigReferenceGraph();
 
 assert(rootPackage.private === true, 'Root package must be private');
 assert(typeof rootPackage.packageManager === 'string', 'Root must declare packageManager');
@@ -759,7 +1587,10 @@ assert(
 );
 assert(!workflowText.includes('FORCE_JAVASCRIPT_ACTIONS_TO_NODE24'), 'CI workflow must not carry the legacy Node 24 override');
 assert(rootPackage.modernjs?.preset === 'presetUltramodern', 'Root must declare presetUltramodern');
-assert(rootPackage.modernjs?.packageSource?.config === './.modernjs/ultramodern-package-source.json', 'Root must point at package source metadata');
+assert(
+  rootPackage.modernjs?.packageSource?.config === './.modernjs/ultramodern.json',
+  'Root must point at compact UltraModern config',
+);
 assert(rootPackage.modernjs?.packageSource?.strategy === packageSource.strategy, 'Root package source strategy must match metadata');
 assert(packageSource.strategy === 'workspace' || packageSource.strategy === 'install', 'Package source strategy must be workspace or install');
 assert(packageSource.strategy === 'install' || packageSource.modernPackages?.specifier === 'workspace:*', 'Workspace package source must be explicitly backed by workspace:*');
@@ -807,22 +1638,61 @@ assert(
 );
 assert(rootPackage.scripts?.['cloudflare:build'] === expectedCloudflareBuildScript, 'Root cloudflare:build script is incorrect');
 assert(!('ultramodern:check' in (rootPackage.scripts ?? {})), 'Root must not expose ultramodern:check');
-assert(rootPackage.scripts?.typecheck === 'node ./scripts/ultramodern-typecheck.mjs --build tsconfig.json', 'Root typecheck must run TS-Go build mode across project references');
+if (bridgeConfig) {
+  assert(
+    rootPackage.scripts?.typecheck ===
+      'pnpm -r --filter "./apps/*" --filter "./verticals/*" --filter "./packages/*" run typecheck',
+    'Bridge root typecheck must check generated package boundaries without building parent implementation sources',
+  );
+  assert(Array.isArray(bridgeConfig.workspacePackages), 'Bridge config must record workspace package patterns');
+  for (const workspacePackage of bridgeConfig.workspacePackages) {
+    assert(
+      rootPackage.workspaces?.includes(workspacePackage.pattern),
+      `Root workspaces must include bridge package pattern ${workspacePackage.pattern}`,
+    );
+    assert(
+      readText('pnpm-workspace.yaml').includes(`  - ${workspacePackage.pattern}`),
+      `pnpm-workspace.yaml must include bridge package pattern ${workspacePackage.pattern}`,
+    );
+  }
+  for (const gate of bridgeConfig.gates ?? []) {
+    const expectedGateScript = `${gate.cwd ? `cd ${gate.cwd} && ` : ''}${gate.command}`;
+    assert(
+      rootPackage.scripts?.[`bridge:${gate.name}`] === expectedGateScript,
+      `Bridge gate script bridge:${gate.name} is incorrect`,
+    );
+  }
+  assert(rootPackage.scripts?.['bridge:check'], 'Bridge workspaces must expose bridge:check');
+} else {
+  assert(rootPackage.scripts?.typecheck === 'node ./scripts/ultramodern-typecheck.mjs --build tsconfig.json', 'Root typecheck must run TS-Go build mode across project references');
+}
 assert(rootPackage.scripts?.['contract:check'] === 'node ./scripts/validate-ultramodern-workspace.mjs', 'Root must expose contract:check');
+assert(rootPackage.scripts?.['api:check'] === 'node ./scripts/check-ultramodern-api-boundaries.mjs', 'Root must expose api:check');
 assert(rootPackage.scripts?.['i18n:boundaries'] === 'node ./scripts/check-ultramodern-i18n-boundaries.mjs', 'Root must expose i18n:boundaries');
 assert(rootPackage.scripts?.['performance:readiness'] === 'node ./scripts/ultramodern-performance-readiness.mjs', 'Root must expose default-on performance readiness diagnostics');
-assert(rootPackage.scripts?.check?.endsWith('&& pnpm performance:readiness'), 'Root check must run default-on performance readiness diagnostics');
+assert(
+  bridgeConfig
+    ? rootPackage.scripts?.check?.includes('pnpm api:check') &&
+        rootPackage.scripts.check.endsWith('&& pnpm performance:readiness && pnpm bridge:check')
+    : rootPackage.scripts?.check?.includes('pnpm api:check') &&
+        rootPackage.scripts.check.endsWith('&& pnpm performance:readiness'),
+  'Root check must run default-on performance readiness diagnostics and bridge gates when configured',
+);
 const performanceReadinessConfig = readText('scripts/ultramodern-performance-readiness.config.mjs');
-const performanceReadinessScript = readText('scripts/ultramodern-performance-readiness.mjs');
+const assertToolWrapper = (scriptPath, command) => {
+  const source = readText(scriptPath);
+  assert(source.includes('modern-js-create'), `${scriptPath} must delegate to modern-js-create`);
+  assert(source.includes('ULTRAMODERN_CREATE_BIN'), `${scriptPath} must support local create-bin overrides for generated-workspace tests`);
+  assert(source.includes("'ultramodern'") || source.includes('"ultramodern"'), `${scriptPath} must dispatch through the UltraModern tool surface`);
+  assert(source.includes(command), `${scriptPath} must dispatch ${command}`);
+};
 assert(performanceReadinessConfig.includes('UltramodernPerformanceReadinessDiagnosticsConfig'), 'Performance readiness config must carry the typed opt-out surface');
 assert(performanceReadinessConfig.includes('enabled: true'), 'Performance readiness diagnostics must be default-on');
 assert(performanceReadinessConfig.includes("failOn: 'framework-invariant'"), 'Performance readiness diagnostics must only fail framework invariants by default');
-assert(performanceReadinessScript.includes("ULTRAMODERN_PERFORMANCE_READINESS_DIAGNOSTICS"), 'Performance readiness script must support env opt-out');
-assert(performanceReadinessScript.includes('ultramodern-performance-readiness-diagnostics-v1'), 'Performance readiness script must emit the deterministic report profile');
+assertToolWrapper('scripts/validate-ultramodern-workspace.mjs', 'validate');
+assertToolWrapper('scripts/ultramodern-performance-readiness.mjs', 'performance-readiness');
 const i18nBoundaryScript = readText('scripts/check-ultramodern-i18n-boundaries.mjs');
-const ultramodernTypecheckScript = readText('scripts/ultramodern-typecheck.mjs');
-assert(ultramodernTypecheckScript.includes("'--checkers'") && ultramodernTypecheckScript.includes("'--builders'"), 'Root typecheck script must drive TS-Go checker and builder parallelism');
-assert(ultramodernTypecheckScript.includes('effect-tsgo') && ultramodernTypecheckScript.includes('get-exe-path'), 'Root typecheck script must resolve the @effect/tsgo native-preview binary');
+assertToolWrapper('scripts/ultramodern-typecheck.mjs', 'typecheck');
 assert(
   i18nBoundaryScript.includes("from '@modern-js/code-tools'") &&
     i18nBoundaryScript.includes('runWorkspaceSourceCheck'),
@@ -833,10 +1703,13 @@ assert(rootPackage.scripts?.['cloudflare:deploy'] === expectedCloudflareDeploySc
 assert(rootPackage.scripts?.['cloudflare:proof'] === 'node ./scripts/proof-cloudflare-version.mjs --out .codex/reports/cloudflare-version-proof/public-url-proof.json', 'Root must expose cloudflare:proof');
 assert(rootPackage.scripts?.['skills:install'] === 'node ./scripts/bootstrap-agent-skills.mjs', 'Root must expose skills:install');
 assert(rootPackage.scripts?.['skills:check'] === 'node ./scripts/bootstrap-agent-skills.mjs --check', 'Root must expose skills:check');
-assert(rootPackage.scripts?.postinstall === "oxfmt . '!repos/**' && node ./scripts/bootstrap-agent-skills.mjs --postinstall", 'Root postinstall must only format and run the clone-free skills bootstrap; repository clones are explicit opt-in steps');
+assert(rootPackage.scripts?.postinstall === "oxfmt . '!repos/**' && node ./scripts/bootstrap-agent-skills.mjs --postinstall", 'Root postinstall must format, run the default-on Codex skills bootstrap, and leave reference repository installs explicit');
 assert(rootPackage.scripts?.['agents:refs:install'] === 'node ./scripts/setup-agent-reference-repos.mjs', 'Root must expose agents:refs:install as the explicit reference repo installer');
 const agentSkillsBootstrap = readText('scripts/bootstrap-agent-skills.mjs');
-assert(agentSkillsBootstrap.includes('never installs system packages'), 'Agent skills bootstrap must declare the no-system-install policy');
+assertToolWrapper('scripts/assert-mf-types.mjs', 'mf-types');
+assertToolWrapper('scripts/generate-public-surface-assets.mjs', 'public-surface');
+assertToolWrapper('scripts/proof-cloudflare-version.mjs', 'cloudflare-proof');
+assertToolWrapper('scripts/bootstrap-agent-skills.mjs', 'skills');
 assert(!agentSkillsBootstrap.includes("run('brew'") && !agentSkillsBootstrap.includes('runShell('), 'Agent skills bootstrap must never invoke system package managers');
 const agentReferenceRepoSetup = readText('scripts/setup-agent-reference-repos.mjs');
 assert(agentReferenceRepoSetup.includes("['commit', '--no-verify', '-m', message]"), 'Agent reference repo installer commits must skip hooks during postinstall');
@@ -875,6 +1748,7 @@ assert(generatedContract.performanceReadiness?.optOut?.env === 'ULTRAMODERN_PERF
 assert(JSON.stringify(generatedContract.performanceReadiness?.signals?.map(signal => signal.id)) === JSON.stringify(expectedPerformanceReadinessSignals), 'Performance readiness signal ids are incorrect');
 
 const shellModernConfig = readText('apps/shell-super-app/modern.config.ts');
+const shellModuleFederationConfig = readText('apps/shell-super-app/module-federation.config.ts');
 const shellRouteHead = readText('apps/shell-super-app/src/routes/ultramodern-route-head.tsx');
 const shellRouteMetadata = readText('apps/shell-super-app/src/routes/ultramodern-route-metadata.ts');
 assert(shellRouteMetadata.includes('@generated by @modern-js/create'), 'Shell route metadata compatibility manifest must be marked generated');
@@ -909,8 +1783,9 @@ assert(shellModernConfig.includes('name: cloudflareWorkerName'), 'Shell modern.c
 assert(shellModernConfig.includes('const assetPrefix ='), 'Shell modern.config.ts must derive a dedicated asset prefix');
 assert(shellModernConfig.includes("const configuredUltramodernAssetPrefix = envValue('ULTRAMODERN_ASSET_PREFIX')"), 'Shell asset prefix must support ULTRAMODERN_ASSET_PREFIX');
 assert(shellModernConfig.includes("const configuredModernAssetPrefix = envValue('MODERN_ASSET_PREFIX')"), 'Shell asset prefix must support MODERN_ASSET_PREFIX');
+assert(shellModernConfig.includes("const defaultAssetPrefix = '/'"), 'Shell asset prefix must default to origin-relative assets');
 const shellAssetPrefixExpression = extractAssetPrefixExpression(shellModernConfig);
-assert(shellAssetPrefixExpression.includes("configuredModernAssetPrefix || configuredUltramodernAssetPrefix || '/'"), 'Shell asset prefix fallback order is incorrect');
+assert(shellAssetPrefixExpression.includes("configuredModernAssetPrefix || configuredUltramodernAssetPrefix || defaultAssetPrefix"), 'Shell asset prefix fallback order is incorrect');
 assert(!shellAssetPrefixExpression.includes('configuredSiteUrl') && !shellAssetPrefixExpression.includes('MODERN_PUBLIC_SITE_URL'), 'Shell asset prefix must not fall back to MODERN_PUBLIC_SITE_URL');
 assert(!shellAssetPrefixExpression.includes('configuredCloudflareUrl') && !shellAssetPrefixExpression.includes('ULTRAMODERN_PUBLIC_URL_SHELL_SUPER_APP'), 'Shell asset prefix must not fall back to the per-app public URL');
 assert(!shellAssetPrefixExpression.includes('inferredCloudflareUrl') && !shellAssetPrefixExpression.includes('ULTRAMODERN_CLOUDFLARE_WORKERS_DEV_SUBDOMAIN'), 'Shell asset prefix must not infer workers.dev URLs');
@@ -926,6 +1801,9 @@ assert(shellContract?.config?.performance?.readinessDiagnostics?.optOut?.env ===
 assert(JSON.stringify(shellContract?.config?.source?.siteUrl?.envFallbackOrder) === JSON.stringify(['MODERN_PUBLIC_SITE_URL', 'ULTRAMODERN_PUBLIC_URL_SHELL_SUPER_APP', 'ULTRAMODERN_CLOUDFLARE_WORKERS_DEV_SUBDOMAIN', 'SHELL_SUPER_APP_PORT']), 'Shell site URL env fallback order is incorrect');
 assert(shellContract?.config?.rspack?.output?.uniqueName === 'shellSuperApp', 'Shell Rspack uniqueName is incorrect');
 assert(shellContract?.config?.rspack?.output?.chunkLoadingGlobal === expectedChunkLoadingGlobal('shellSuperApp'), 'Shell Rspack chunkLoadingGlobal is incorrect');
+assert(shellContract?.moduleFederation?.dts?.compilerInstance === 'tsgo', 'Shell must keep mandatory DTS compiler');
+assert(shellContract?.moduleFederation?.dts?.tsConfigPath === './tsconfig.mf-types.json', 'Shell must keep dedicated Module Federation DTS tsconfig');
+assert(shellModuleFederationConfig.includes("tsConfigPath: './tsconfig.mf-types.json'"), 'Shell Module Federation config must use the dedicated DTS tsconfig');
 assert(topology.shell?.cloudflare?.workerName === expectedWorkerName('shell-super-app'), 'Shell topology Cloudflare workerName is incorrect');
 assert(shellContract?.styling?.federation?.owner?.id === 'shell-super-app', 'Shell CSS federation owner is missing');
 assert(shellContract?.styling?.federation?.role === 'shell-base-overlay', 'Shell must own base and overlay CSS');
@@ -960,6 +1838,7 @@ assert(!('effectServices' in topology), 'Default APIs must be vertical-owned, no
 for (const vertical of fullStackVerticals) {
   const packageJson = readJson(`${vertical.path}/package.json`);
   const modernConfig = readText(`${vertical.path}/modern.config.ts`);
+  const moduleFederationConfig = readText(`${vertical.path}/module-federation.config.ts`);
   const routeHead = readText(`${vertical.path}/src/routes/ultramodern-route-head.tsx`);
   const routeMetadata = readText(`${vertical.path}/src/routes/ultramodern-route-metadata.ts`);
   assert(routeMetadata.includes('@generated by @modern-js/create'), `${vertical.id} route metadata compatibility manifest must be marked generated`);
@@ -972,8 +1851,8 @@ for (const vertical of fullStackVerticals) {
   assert(packageJson.dependencies?.['@modern-js/plugin-i18n'] === expectedModernPackageSpecifier('@modern-js/plugin-i18n'), `${vertical.id} plugin-i18n dependency must match package source metadata`);
   assert(packageJson.dependencies?.['@modern-js/plugin-tanstack'] === expectedModernPackageSpecifier('@modern-js/plugin-tanstack'), `${vertical.id} plugin-tanstack dependency must match package source metadata`);
   assert(packageJson.dependencies?.['@modern-js/runtime'] === expectedModernPackageSpecifier('@modern-js/runtime'), `${vertical.id} runtime dependency must match package source metadata`);
-  assert(packageJson.exports?.['./effect/client'] === `./src/effect/${vertical.stem}-client.ts`, `${vertical.id} must export its Effect client`);
-  assert(packageJson.exports?.['./shared/effect/api'] === './shared/effect/api.ts', `${vertical.id} must export its Effect API contract`);
+  assert(packageJson.exports?.['./api/client'] === `./src/api/${vertical.stem}-client.ts`, `${vertical.id} must export its API client`);
+  assert(packageJson.exports?.['./api'] === './shared/api.ts', `${vertical.id} must export its API contract`);
   const expectedVerticalZephyrDependencies = Object.fromEntries(
     fullStackVerticals
       .filter(candidate => vertical.verticalRefs.includes(candidate.id))
@@ -1004,38 +1883,44 @@ for (const vertical of fullStackVerticals) {
   assert(modernConfig.includes('const assetPrefix ='), `${vertical.id} modern.config.ts must derive a dedicated asset prefix`);
   assert(modernConfig.includes("const configuredUltramodernAssetPrefix = envValue('ULTRAMODERN_ASSET_PREFIX')"), `${vertical.id} asset prefix must support ULTRAMODERN_ASSET_PREFIX`);
   assert(modernConfig.includes("const configuredModernAssetPrefix = envValue('MODERN_ASSET_PREFIX')"), `${vertical.id} asset prefix must support MODERN_ASSET_PREFIX`);
+  assert(modernConfig.includes('const defaultRemoteAssetPrefix'), `${vertical.id} asset prefix must derive the remote asset origin`);
+  assert(modernConfig.includes('const defaultAssetPrefix = defaultRemoteAssetPrefix'), `${vertical.id} asset prefix must default to its own remote origin`);
   const verticalAssetPrefixExpression = extractAssetPrefixExpression(modernConfig);
-  assert(verticalAssetPrefixExpression.includes("configuredModernAssetPrefix || configuredUltramodernAssetPrefix || '/'"), `${vertical.id} asset prefix fallback order is incorrect`);
+  assert(verticalAssetPrefixExpression.includes("configuredModernAssetPrefix || configuredUltramodernAssetPrefix || defaultAssetPrefix"), `${vertical.id} asset prefix fallback order is incorrect`);
   assert(!verticalAssetPrefixExpression.includes('configuredSiteUrl') && !verticalAssetPrefixExpression.includes('MODERN_PUBLIC_SITE_URL'), `${vertical.id} asset prefix must not fall back to MODERN_PUBLIC_SITE_URL`);
-  assert(!verticalAssetPrefixExpression.includes('configuredCloudflareUrl') && !verticalAssetPrefixExpression.includes(`ULTRAMODERN_PUBLIC_URL_${vertical.id.replace(/-/g, '_').toUpperCase()}`), `${vertical.id} asset prefix must not fall back to the per-app public URL`);
-  assert(!verticalAssetPrefixExpression.includes('inferredCloudflareUrl') && !verticalAssetPrefixExpression.includes('ULTRAMODERN_CLOUDFLARE_WORKERS_DEV_SUBDOMAIN'), `${vertical.id} asset prefix must not infer workers.dev URLs`);
+  assert(modernConfig.includes(`envValue('ULTRAMODERN_PUBLIC_URL_${vertical.id.replace(/-/g, '_').toUpperCase()}')`), `${vertical.id} asset prefix must read its per-app public URL`);
+  assert(modernConfig.includes('inferredCloudflareUrl'), `${vertical.id} asset prefix must support workers.dev origin inference`);
   assert(modernConfig.includes("assetPrefix: '/'"), `${vertical.id} modern.config.ts must keep dev assets origin-relative`);
   assert(modernConfig.includes('assetPrefix,'), `${vertical.id} modern.config.ts must wire output.assetPrefix to the derived asset prefix`);
   assert(contractEntry?.config?.dev?.assetPrefix === '/', `${vertical.id} dev asset prefix must stay origin-relative`);
-  assert(contractEntry?.config?.output?.assetPrefix?.default === '/', `${vertical.id} asset prefix must default to origin-relative paths`);
+  assert(contractEntry?.config?.output?.assetPrefix?.default === 'app-public-origin', `${vertical.id} asset prefix must default to its app public origin`);
   assert(JSON.stringify(contractEntry?.config?.output?.assetPrefix?.envFallbackOrder) === JSON.stringify(['MODERN_ASSET_PREFIX', 'ULTRAMODERN_ASSET_PREFIX']), `${vertical.id} asset prefix env fallback order is incorrect`);
   assert(contractEntry?.config?.output?.disableTsChecker === false, `${vertical.id} must keep the framework TypeScript checker enabled`);
   assert(contractEntry?.config?.performance?.readinessDiagnostics?.default === 'enabled', `${vertical.id} performance readiness diagnostics must be default-on`);
   assert(contractEntry?.config?.performance?.readinessDiagnostics?.failOn === 'framework-invariant', `${vertical.id} performance readiness diagnostics must only fail framework invariants by default`);
   assert(contractEntry?.config?.performance?.readinessDiagnostics?.optOut?.config === 'scripts/ultramodern-performance-readiness.config.mjs', `${vertical.id} performance readiness opt-out config is incorrect`);
-  assert(contractEntry?.deploy?.cloudflare?.routes?.effectReadiness === `${vertical.apiPrefix}/effect/${vertical.stem}/readiness`, `${vertical.id} Cloudflare proof readiness route is incorrect`);
+  assert(contractEntry?.deploy?.cloudflare?.routes?.apiReadiness === `${vertical.apiPrefix}/${vertical.stem}/readiness`, `${vertical.id} Cloudflare proof readiness route is incorrect`);
   assert(contractEntry?.config?.rspack?.output?.uniqueName === vertical.mfName, `${vertical.id} Rspack uniqueName is incorrect`);
   assert(contractEntry?.config?.rspack?.output?.chunkLoadingGlobal === expectedChunkLoadingGlobal(vertical.mfName), `${vertical.id} Rspack chunkLoadingGlobal is incorrect`);
   assert(contractEntry?.moduleFederation?.name === vertical.mfName, `${vertical.id} MF name is incorrect`);
   assert(JSON.stringify(contractEntry?.moduleFederation?.exposes) === JSON.stringify(vertical.exposes), `${vertical.id} MF exposes are incorrect`);
   assert(contractEntry?.moduleFederation?.dts?.compilerInstance === 'tsgo', `${vertical.id} must keep mandatory DTS compiler`);
+  assert(contractEntry?.moduleFederation?.dts?.tsConfigPath === './tsconfig.mf-types.json', `${vertical.id} must keep dedicated Module Federation DTS tsconfig`);
+  assert(moduleFederationConfig.includes("tsConfigPath: './tsconfig.mf-types.json'"), `${vertical.id} Module Federation config must use the dedicated DTS tsconfig`);
   assert(JSON.stringify(contractEntry?.moduleFederation?.verticalRefs ?? []) === JSON.stringify(vertical.verticalRefs), `${vertical.id} MF verticalRefs are incorrect`);
   assert(
     JSON.stringify((contractEntry?.moduleFederation?.remotes ?? []).map(remote => remote.id)) ===
       JSON.stringify(vertical.verticalRefs),
     `${vertical.id} MF consumed verticals are incorrect`,
   );
-  assert(contractEntry?.effect?.prefix === vertical.apiPrefix, `${vertical.id} Effect API prefix is incorrect`);
-  assert(contractEntry?.effect?.group === vertical.group, `${vertical.id} Effect group is incorrect`);
-  assert(contractEntry?.effect?.readiness?.endpoint === `/effect/${vertical.stem}/readiness`, `${vertical.id} readiness endpoint is incorrect`);
-  assert(contractEntry?.effect?.operations?.readiness?.path === `/effect/${vertical.stem}/readiness`, `${vertical.id} readiness operation is missing`);
-  assert(contractEntry?.effect?.requestContext?.propagatedHeaders?.includes('traceparent'), `${vertical.id} trace context propagation is missing`);
-  assert(Object.keys(contractEntry?.effect?.domainOperations ?? {}).length >= 3, `${vertical.id} domain operations are missing`);
+  assert(contractEntry?.api?.prefix === vertical.apiPrefix, `${vertical.id} API prefix is incorrect`);
+  assert(contractEntry?.api?.group === vertical.group, `${vertical.id} API group is incorrect`);
+  assert(contractEntry?.api?.runtime === 'effect', `${vertical.id} API runtime must be Effect`);
+  assert(contractEntry?.api?.strictEffectApproach === true, `${vertical.id} strictEffectApproach must be enabled`);
+  assert(contractEntry?.api?.readiness?.endpoint === `/${vertical.stem}/readiness`, `${vertical.id} readiness endpoint is incorrect`);
+  assert(contractEntry?.api?.operations?.readiness?.path === `/${vertical.stem}/readiness`, `${vertical.id} readiness operation is missing`);
+  assert(contractEntry?.api?.requestContext?.propagatedHeaders?.includes('traceparent'), `${vertical.id} trace context propagation is missing`);
+  assert(Object.keys(contractEntry?.api?.domainOperations ?? {}).length >= 3, `${vertical.id} domain operations are missing`);
   assert(contractEntry?.i18n?.languages?.includes('en') && contractEntry?.i18n?.languages?.includes('cs'), `${vertical.id} must declare i18n languages`);
   assert(contractEntry?.i18n?.namespace === vertical.namespace, `${vertical.id} i18n namespace is incorrect`);
   assert(
@@ -1074,10 +1959,11 @@ for (const vertical of fullStackVerticals) {
   assert(topologyEntry?.moduleFederation?.name === vertical.mfName, `${vertical.id} topology MF name is incorrect`);
   assert(JSON.stringify(topologyEntry?.moduleFederation?.exposes) === JSON.stringify(vertical.exposes), `${vertical.id} topology exposes are incorrect`);
   assert(JSON.stringify(topologyEntry?.moduleFederation?.verticalRefs ?? []) === JSON.stringify(vertical.verticalRefs), `${vertical.id} topology verticalRefs are incorrect`);
-  assert(topologyEntry?.api?.effect?.bff?.prefix === vertical.apiPrefix, `${vertical.id} topology API prefix is incorrect`);
-  assert(topologyEntry?.api?.effect?.serverEntry === `${vertical.path}/api/effect/index.ts`, `${vertical.id} topology server entry is incorrect`);
-  assert(topologyEntry?.api?.effect?.readiness?.endpoint === `/effect/${vertical.stem}/readiness`, `${vertical.id} topology readiness endpoint is incorrect`);
-  assert(Object.keys(topologyEntry?.api?.effect?.domainOperations ?? {}).length >= 3, `${vertical.id} topology domain operations are missing`);
+  assert(topologyEntry?.api?.bff?.prefix === vertical.apiPrefix, `${vertical.id} topology API prefix is incorrect`);
+  assert(topologyEntry?.api?.bff?.strictEffectApproach === true, `${vertical.id} topology strictEffectApproach is incorrect`);
+  assert(topologyEntry?.api?.serverEntry === `${vertical.path}/api/index.ts`, `${vertical.id} topology server entry is incorrect`);
+  assert(topologyEntry?.api?.readiness?.endpoint === `/${vertical.stem}/readiness`, `${vertical.id} topology readiness endpoint is incorrect`);
+  assert(Object.keys(topologyEntry?.api?.domainOperations ?? {}).length >= 3, `${vertical.id} topology domain operations are missing`);
 
   assert(ownership.owners?.some(owner => owner.id === vertical.id && owner.path === vertical.path), `${vertical.id} ownership entry is missing`);
   assert(overlay.ports?.[vertical.id], `${vertical.id} development port is missing`);