@bleedingdev/modern-js-create 3.4.0-ultramodern.9 → 3.5.0-ultramodern.0

package/templates/workspace-scripts/proof-cloudflare-version.mjs

@@ -1,17 +1,15 @@
 #!/usr/bin/env node
+import crypto from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { validateApp } from './ultramodern-cloudflare-proof.mjs';
 
 const workspaceRoot = path.resolve(
-  path.dirname(fileURLToPath(import.meta.url)),
-  '..',
-);
-const contractPath = path.join(
-  workspaceRoot,
-  '.modernjs/ultramodern-generated-contract.json',
+  process.env.ULTRAMODERN_WORKSPACE_ROOT ??
+    path.join(path.dirname(fileURLToPath(import.meta.url)), '..'),
 );
+const compactConfigPath = path.join(workspaceRoot, '.modernjs/ultramodern.json');
 const defaultOut = path.join(
   workspaceRoot,
   '.codex/reports/cloudflare-version-proof/public-url-proof.json',
@@ -21,6 +19,276 @@ function readJson(filePath) {
   return JSON.parse(fs.readFileSync(filePath, 'utf8'));
 }
 
+function toKebabCase(value) {
+  return String(value)
+    .trim()
+    .replace(/([a-z0-9])([A-Z])/gu, '$1-$2')
+    .replace(/[^a-zA-Z0-9._-]+/gu, '-')
+    .replace(/[._]+/gu, '-')
+    .toLowerCase()
+    .replace(/-+/gu, '-')
+    .replace(/^-+|-+$/gu, '');
+}
+
+function toPascalCase(value) {
+  return toKebabCase(value)
+    .split('-')
+    .filter(Boolean)
+    .map(part => part.charAt(0).toUpperCase() + part.slice(1))
+    .join('');
+}
+
+function toEnvSegment(value) {
+  return toKebabCase(value).replace(/-/gu, '_').toUpperCase();
+}
+
+function normalizeRelativePath(value) {
+  return String(value ?? '').replace(/\\/gu, '/').replace(/^\.\/+/u, '');
+}
+
+function appNamespace(app) {
+  return app.kind === 'shell' ? 'shell' : (app.domain ?? app.id);
+}
+
+function normalizeCompactApp(rawApp) {
+  const id = String(rawApp.id);
+  const kind = rawApp.kind === 'vertical' ? 'vertical' : 'shell';
+  const appPath =
+    typeof rawApp.path === 'string'
+      ? normalizeRelativePath(rawApp.path)
+      : kind === 'shell'
+        ? 'apps/shell-super-app'
+        : `verticals/${toKebabCase(id)}`;
+  const packageSuffix =
+    typeof rawApp.packageSuffix === 'string'
+      ? rawApp.packageSuffix
+      : appPath.split('/').at(-1) ?? id;
+  const domain =
+    typeof rawApp.domain === 'string'
+      ? rawApp.domain
+      : kind === 'vertical'
+        ? packageSuffix
+        : undefined;
+  const moduleFederation =
+    rawApp.moduleFederation && typeof rawApp.moduleFederation === 'object'
+      ? rawApp.moduleFederation
+      : {};
+  const api =
+    rawApp.api && typeof rawApp.api === 'object'
+      ? {
+          stem:
+            typeof rawApp.api.stem === 'string'
+              ? rawApp.api.stem
+              : domain ?? id,
+          prefix:
+            typeof rawApp.api.prefix === 'string'
+              ? rawApp.api.prefix
+              : `/${domain ?? id}-api`,
+        }
+      : undefined;
+
+  return {
+    id,
+    kind,
+    path: appPath,
+    packageSuffix,
+    domain,
+    mfName:
+      typeof moduleFederation.name === 'string'
+        ? moduleFederation.name
+        : kind === 'shell'
+          ? 'shellSuperApp'
+          : `vertical${toPascalCase(domain ?? id)}`,
+    api,
+  };
+}
+
+function createBuildMarker(scope, app) {
+  return crypto
+    .createHash('sha256')
+    .update(`${scope}:${app.packageSuffix}:${app.id}:0.1.0`)
+    .digest('hex')
+    .slice(0, 16);
+}
+
+function createCloudflareSecurity() {
+  return {
+    enabled: true,
+    headers: {
+      referrerPolicy: 'strict-origin-when-cross-origin',
+      contentTypeOptions: 'nosniff',
+      permissionsPolicy:
+        'camera=(), geolocation=(), microphone=(), payment=(), usb=()',
+    },
+    contentSecurityPolicy: {
+      mode: 'report-only',
+      directives: {
+        'base-uri': [`'self'`],
+        'connect-src': [`'self'`, 'https:', 'http:', 'wss:', 'ws:'],
+        'default-src': [`'self'`],
+        'font-src': [`'self'`, 'data:', 'https:', 'http:'],
+        'form-action': [`'self'`],
+        'frame-ancestors': [`'self'`],
+        'img-src': [`'self'`, 'data:', 'blob:', 'https:', 'http:'],
+        'manifest-src': [`'self'`, 'https:', 'http:'],
+        'object-src': [`'none'`],
+        'script-src': [
+          `'self'`,
+          `'unsafe-inline'`,
+          `'unsafe-eval'`,
+          'https:',
+          'http:',
+          'blob:',
+        ],
+        'style-src': [`'self'`, `'unsafe-inline'`, 'https:', 'http:'],
+        'worker-src': [`'self'`, 'blob:'],
+      },
+      reason:
+        'Report-only by default so Cloudflare Module Federation SSR can prove remote script, style, and connect compatibility before enforcement.',
+    },
+    noindex: {
+      workersDev: true,
+      localhost: true,
+      previewHostnames: [],
+    },
+  };
+}
+
+function createQualityGates() {
+  return {
+    publicRoutes: {
+      requireSitemapWhenPresent: true,
+      requireRobotsSitemapConsistency: true,
+      requireWebManifestWhenPresent: true,
+    },
+    statusCodes: {
+      notFoundRoute: '/__ultramodern-smoke-missing/nope',
+      unknownRouteStatus: 404,
+    },
+    indexing: {
+      previewNoindex: true,
+      productionPublicRoutesIndexable: true,
+    },
+    assets: {
+      cssPreloadRequired: true,
+      cssResponseRequired: true,
+      cacheControlRequiredForCss: true,
+      sourcemapsPubliclyReferenced: false,
+    },
+    budgets: {
+      ssrHtmlMaxBytes: 250_000,
+      mfManifestMaxBytes: 500_000,
+      localeJsonMaxBytes: 100_000,
+      sitemapXmlMaxBytes: 500_000,
+      cssAssetMaxBytes: 750_000,
+    },
+    csp: {
+      finalMode: 'report-only-dogfood',
+      decision:
+        'Report-only remains the generated final mode until public smoke proof records MF SSR script/style/connect compatibility for the deployed surface.',
+    },
+  };
+}
+
+function createPublicHead() {
+  return {
+    alternates: {
+      hreflang: ['en', 'cs'],
+      xDefault: 'en',
+    },
+  };
+}
+
+function createPublicSurface() {
+  return {
+    publicRoutes: [],
+    routeEntries: [],
+    contentSources: [],
+    concreteUrlPaths: [],
+  };
+}
+
+function createCloudflareRoutes(app) {
+  return {
+    ssr: '/en',
+    mfManifest: '/mf-manifest.json',
+    locale: `/locales/en/${appNamespace(app)}.json`,
+    ...(app.api
+      ? {
+          apiReadiness: `${app.api.prefix}/${app.api.stem}/readiness`,
+        }
+      : {}),
+  };
+}
+
+function createContractApp(config, app) {
+  const packageScope =
+    typeof config.workspace?.packageScope === 'string'
+      ? config.workspace.packageScope
+      : path.basename(workspaceRoot);
+  const compatibilityDate =
+    typeof config.deploy?.worker?.compatibilityDate === 'string'
+      ? config.deploy.worker.compatibilityDate
+      : '2026-06-02';
+
+  return {
+    id: app.id,
+    deploy: {
+      cloudflare: {
+        workerName: `${toKebabCase(packageScope)}-${app.packageSuffix}`.slice(
+          0,
+          63,
+        ),
+        publicUrlEnv: `ULTRAMODERN_PUBLIC_URL_${toEnvSegment(app.id)}`,
+        compatibilityDate,
+        compatibilityFlags: ['nodejs_compat', 'global_fetch_strictly_public'],
+        routes: createCloudflareRoutes(app),
+        security: createCloudflareSecurity(),
+        qualityGates: createQualityGates(),
+      },
+    },
+    i18n: {
+      namespace: appNamespace(app),
+    },
+    marker: {
+      appId: app.id,
+      build: createBuildMarker(packageScope, app),
+    },
+    routes: {
+      publicHead: createPublicHead(),
+      publicSurface: createPublicSurface(),
+    },
+    styling: {
+      federation: {
+        rootSelector: `[data-app-id="${app.id}"]`,
+      },
+    },
+  };
+}
+
+function synthesizeContractFromCompactConfig(config) {
+  const apps = Array.isArray(config.topology?.apps)
+    ? config.topology.apps.map(normalizeCompactApp)
+    : [];
+
+  return {
+    sourcePath: compactConfigPath,
+    apps: apps.map(app => createContractApp(config, app)),
+  };
+}
+
+function readGeneratedContractView() {
+  if (fs.existsSync(compactConfigPath)) {
+    return synthesizeContractFromCompactConfig(readJson(compactConfigPath));
+  }
+  throw new Error(
+    `Missing UltraModern config. Expected ${path.relative(
+      workspaceRoot,
+      compactConfigPath,
+    )}.`,
+  );
+}
+
 function parseArgs(argv) {
   const parsed = {
     appId: undefined,
@@ -50,7 +318,7 @@ function parseArgs(argv) {
 
 function printHelp() {
   process.stdout.write(`Usage:
-  node scripts/proof-cloudflare-version.mjs [--app workspace] [--out evidence.json] [--require-public-urls]
+  node scripts/proof-cloudflare-version.mts [--app workspace] [--out evidence.json] [--require-public-urls]
 
 Set each app's public URL using the contract env key, for example:
   ULTRAMODERN_PUBLIC_URL_WORKSPACE=https://workspace.example.workers.dev
@@ -70,7 +338,7 @@ async function main(argv = process.argv.slice(2)) {
     return 0;
   }
 
-  const contract = readJson(contractPath);
+  const contract = readGeneratedContractView();
   const apps = args.appId
     ? contract.apps.filter(app => app.id === args.appId)
     : contract.apps;
@@ -101,7 +369,7 @@ async function main(argv = process.argv.slice(2)) {
     schemaVersion: 1,
     generatedAt: new Date().toISOString(),
     status: results.length > 0 ? 'pass' : 'skipped',
-    contractPath,
+    contractPath: contract.sourcePath ?? compactConfigPath,
     results,
     skipped,
   };

package/templates/workspace-scripts/ultramodern-cloudflare-proof.mjs

@@ -6,6 +6,20 @@ function normalizeUrlWithTrailingSlash(url) {
   return url.endsWith('/') ? url : `${url}/`;
 }
 
+function resolveModuleFederationPublicPath(publicPath, manifestUrl) {
+  if (typeof publicPath !== 'string' || publicPath.trim().length === 0) {
+    return undefined;
+  }
+
+  try {
+    return normalizeUrlWithTrailingSlash(
+      new URL(publicPath.trim(), manifestUrl).toString(),
+    );
+  } catch {
+    return undefined;
+  }
+}
+
 async function fetchText(url) {
   const response = await fetch(url);
   return {
@@ -464,7 +478,8 @@ async function validateSsrHead(evidence, app, publicUrl, ssrRoute, ssr) {
 async function validateNotFound(evidence, app, publicUrl) {
   const qualityGates = app.deploy?.cloudflare?.qualityGates ?? {};
   const notFoundRoute =
-    qualityGates.statusCodes?.notFoundRoute ?? '/__ultramodern-smoke-missing';
+    qualityGates.statusCodes?.notFoundRoute ??
+    '/__ultramodern-smoke-missing/nope';
   const expectedStatus = qualityGates.statusCodes?.unknownRouteStatus ?? 404;
   const response = await fetchText(joinUrl(publicUrl, notFoundRoute));
   evidence.assertions.push({
@@ -721,7 +736,8 @@ async function validateModuleFederationManifestEvidence(evidence, app, publicUrl
   const budgets = qualityGates.budgets ?? {};
 
   const manifestRoute = routes.mfManifest ?? '/mf-manifest.json';
-  const manifest = await fetchText(joinUrl(publicUrl, manifestRoute));
+  const manifestUrl = joinUrl(publicUrl, manifestRoute);
+  const manifest = await fetchText(manifestUrl);
   const manifestJson = parseMaybeJson(manifest.body);
   evidence.assertions.push({
     type: 'mf-manifest',
@@ -754,17 +770,26 @@ async function validateModuleFederationManifestEvidence(evidence, app, publicUrl
     manifest.accessControlAllowOrigin === '*',
     `${app.id} MF manifest is missing Cloudflare CORS headers`,
   );
-  const expectedPublicPath = normalizeUrlWithTrailingSlash(publicUrl);
+  const expectedPublicPath = normalizeUrlWithTrailingSlash(
+    new URL('.', manifestUrl).toString(),
+  );
   const manifestPublicPath = manifestJson?.metaData?.publicPath;
+  const resolvedPublicPath = resolveModuleFederationPublicPath(
+    manifestPublicPath,
+    manifestUrl,
+  );
   evidence.assertions.push({
     type: 'mf-manifest-public-path',
     expected: expectedPublicPath,
     actual: manifestPublicPath,
-    status: manifestPublicPath === expectedPublicPath ? 'pass' : 'fail',
+    resolved: resolvedPublicPath,
+    status: resolvedPublicPath === expectedPublicPath ? 'pass' : 'fail',
   });
   assert(
-    manifestPublicPath === expectedPublicPath,
-    `${app.id} MF manifest publicPath must resolve remote assets from ${expectedPublicPath}`,
+    resolvedPublicPath === expectedPublicPath,
+    `${app.id} MF manifest publicPath must resolve remote assets from ${expectedPublicPath}; got ${String(
+      manifestPublicPath,
+    )}`,
   );
 }
 
@@ -815,13 +840,13 @@ async function validateI18nEvidence(evidence, app, publicUrl, routes) {
 }
 
 async function validateReadinessEvidence(evidence, app, publicUrl, routes) {
-  if (routes.effectReadiness) {
-    const readiness = await fetchText(joinUrl(publicUrl, routes.effectReadiness));
+  if (routes.apiReadiness) {
+    const readiness = await fetchText(joinUrl(publicUrl, routes.apiReadiness));
     const readinessJson = parseMaybeJson(readiness.body);
     const apiMarker = markerFromJson(readinessJson);
     evidence.assertions.push({
       type: 'api-marker',
-      route: routes.effectReadiness,
+      route: routes.apiReadiness,
       expected: app.marker?.build,
       actual: apiMarker,
       status: readiness.ok && apiMarker === app.marker?.build ? 'pass' : 'fail',
@@ -848,4 +873,4 @@ async function validateApp(app, publicUrl) {
   return evidence;
 }
 
-export { validateApp };
+export { resolveModuleFederationPublicPath, validateApp };

package/templates/workspace-scripts/ultramodern-performance-readiness.mjs

@@ -6,6 +6,7 @@ const root = process.cwd();
 const defaultReportPath =
   '.codex/reports/performance-readiness/ultramodern-performance-readiness.json';
 const configPath = 'scripts/ultramodern-performance-readiness.config.mjs';
+const compactConfigPath = '.modernjs/ultramodern.json';
 const optOutEnv = 'ULTRAMODERN_PERFORMANCE_READINESS_DIAGNOSTICS';
 const signalIds = [
   'bfcache',
@@ -60,6 +61,168 @@ const createSignal = (id, status, evidence) => ({
 
 const unique = values => new Set(values).size === values.length;
 
+const toKebabCase = value =>
+  String(value)
+    .trim()
+    .replace(/([a-z0-9])([A-Z])/gu, '$1-$2')
+    .replace(/[^a-zA-Z0-9._-]+/gu, '-')
+    .replace(/[._]+/gu, '-')
+    .toLowerCase()
+    .replace(/-+/gu, '-')
+    .replace(/^-+|-+$/gu, '');
+
+const toPascalCase = value =>
+  toKebabCase(value)
+    .split('-')
+    .filter(Boolean)
+    .map(part => part.charAt(0).toUpperCase() + part.slice(1))
+    .join('');
+
+const normalizeRelativePath = value =>
+  String(value ?? '').replace(/\\/gu, '/').replace(/^\.\/+/u, '');
+
+const appNamespace = app => (app.kind === 'shell' ? 'shell' : (app.domain ?? app.id));
+
+const normalizeCompactApp = rawApp => {
+  const id = String(rawApp.id);
+  const kind = rawApp.kind === 'vertical' ? 'vertical' : 'shell';
+  const appPath =
+    typeof rawApp.path === 'string'
+      ? normalizeRelativePath(rawApp.path)
+      : kind === 'shell'
+        ? 'apps/shell-super-app'
+        : `verticals/${toKebabCase(id)}`;
+  const packageSuffix =
+    typeof rawApp.packageSuffix === 'string'
+      ? rawApp.packageSuffix
+      : appPath.split('/').at(-1) ?? id;
+  const domain =
+    typeof rawApp.domain === 'string'
+      ? rawApp.domain
+      : kind === 'vertical'
+        ? packageSuffix
+        : undefined;
+  const moduleFederation =
+    rawApp.moduleFederation && typeof rawApp.moduleFederation === 'object'
+      ? rawApp.moduleFederation
+      : {};
+
+  return {
+    id,
+    kind,
+    path: appPath,
+    packageSuffix,
+    domain,
+    port:
+      typeof rawApp.port === 'number'
+        ? rawApp.port
+        : kind === 'shell'
+          ? 3020
+          : 3030,
+    mfName:
+      typeof moduleFederation.name === 'string'
+        ? moduleFederation.name
+        : kind === 'shell'
+          ? 'shellSuperApp'
+          : `vertical${toPascalCase(domain ?? id)}`,
+    moduleFederation: {
+      remotes: [],
+      verticalRefs: Array.isArray(moduleFederation.verticalRefs)
+        ? moduleFederation.verticalRefs.filter(ref => typeof ref === 'string')
+        : [],
+    },
+  };
+};
+
+const createRemoteContracts = (app, apps) =>
+  (app.moduleFederation?.verticalRefs ?? [])
+    .map(ref => apps.find(candidate => candidate.id === ref))
+    .filter(Boolean)
+    .map(remote => ({
+      id: remote.id,
+      name: remote.mfName,
+      manifestUrl: `http://localhost:${remote.port ?? 3030}/mf-manifest.json`,
+    }));
+
+const createPerformanceReadinessContract = () => ({
+  schemaVersion: 1,
+  default: 'enabled',
+  mode: 'diagnostic',
+  scope: 'ultramodern-generated-and-framework-owned',
+  report: {
+    script: 'scripts/ultramodern-performance-readiness.mts',
+    config: 'scripts/ultramodern-performance-readiness.config.mjs',
+    defaultPath: defaultReportPath,
+    deterministic: true,
+  },
+  signals: signalIds.map(id => ({ id })),
+});
+
+const createContractApp = (config, app, apps) => {
+  const compatibilityDate =
+    typeof config.deploy?.worker?.compatibilityDate === 'string'
+      ? config.deploy.worker.compatibilityDate
+      : '2026-06-02';
+
+  return {
+    id: app.id,
+    path: app.path,
+    config: {
+      plugins: [
+        'appTools',
+        'tanstackRouterPlugin',
+        'i18nPlugin',
+        ...(app.kind === 'vertical' ? ['bffPlugin'] : []),
+        'moduleFederationPlugin',
+        'zephyrRspackPlugin',
+      ],
+    },
+    deploy: {
+      cloudflare: {
+        compatibilityDate,
+        compatibilityFlags: ['nodejs_compat', 'global_fetch_strictly_public'],
+        routes: {
+          ssr: '/en',
+          mfManifest: '/mf-manifest.json',
+          locale: `/locales/en/${appNamespace(app)}.json`,
+        },
+        qualityGates: {
+          assets: {
+            cacheControlRequiredForCss: true,
+          },
+        },
+      },
+    },
+    moduleFederation: {
+      remotes: createRemoteContracts(app, apps),
+    },
+    routes: {
+      localisedUrls: {},
+      publicSurface: {
+        artifactLifecycle: 'build-and-deploy-output',
+      },
+    },
+  };
+};
+
+const readGeneratedContractView = () => {
+  if (exists(compactConfigPath)) {
+    const compactConfig = readJson(compactConfigPath);
+    const apps = Array.isArray(compactConfig.topology?.apps)
+      ? compactConfig.topology.apps.map(normalizeCompactApp)
+      : [];
+    return {
+      sourcePath: compactConfigPath,
+      performanceReadiness: createPerformanceReadinessContract(),
+      apps: apps.map(app => createContractApp(compactConfig, app, apps)),
+    };
+  }
+
+  throw new Error(
+    `Missing UltraModern config. Expected ${compactConfigPath}.`,
+  );
+};
+
 const appGeneratedFiles = app => [
   `${app.path}/modern.config.ts`,
   `${app.path}/module-federation.config.ts`,
@@ -181,14 +344,14 @@ const main = async () => {
     return;
   }
 
-  const contract = readJson('.modernjs/ultramodern-generated-contract.json');
+  const contract = readGeneratedContractView();
   assert(
     contract.performanceReadiness?.default === 'enabled',
     'Generated contract must keep performance readiness diagnostics default-on',
   );
   assert(
     contract.performanceReadiness?.report?.script ===
-      'scripts/ultramodern-performance-readiness.mjs',
+      'scripts/ultramodern-performance-readiness.mts',
     'Generated contract must point at the performance readiness diagnostics script',
   );
   const contractSignalIds =

package/templates/workspace-scripts/ultramodern-typecheck.mjs

@@ -9,11 +9,13 @@ import {
   mkdirSync,
 } from 'node:fs';
 import os from 'node:os';
-import { dirname, join } from 'node:path';
+import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const args = process.argv.slice(2);
-const workspaceRoot = join(dirname(fileURLToPath(import.meta.url)), '..');
+const workspaceRoot = process.env.ULTRAMODERN_WORKSPACE_ROOT
+  ? resolve(process.env.ULTRAMODERN_WORKSPACE_ROOT)
+  : join(dirname(fileURLToPath(import.meta.url)), '..');
 const cpuCount = Math.max(
   1,
   typeof os.availableParallelism === 'function'