@bleedingdev/modern-js-create 3.5.0-ultramodern.1 → 3.5.0-ultramodern.10

package/README.md

@@ -193,8 +193,8 @@ For strict Effect API migrations, update generated package metadata and Modern
 package aliases through the framework command before hand-editing app code:
 
 ```bash
-pnpm dlx @bleedingdev/modern-js-create@3.5.0-ultramodern.1 ultramodern \
-  migrate-strict-effect --version 3.5.0-ultramodern.1
+pnpm dlx @bleedingdev/modern-js-create@3.5.0-ultramodern.10 ultramodern \
+  migrate-strict-effect --version 3.5.0-ultramodern.10
 pnpm api:check
 pnpm contract:check
 pnpm check
@@ -202,16 +202,20 @@ pnpm build
 ```
 
 The command updates `.modernjs/ultramodern.json`, root `modernjs.packageSource`,
-generated Modern package aliases, old direct topology metadata, and the pnpm
+generated Modern package aliases, framework-owned toolchain pins, old direct
+topology metadata, strict Effect pnpm overrides/trust policy, and the pnpm
 lockfile. It does not invent compatibility shims or move business code behind
 your back. If `pnpm api:check` still fails, migrate the source to
 `shared/api.ts`, `api/index.ts`, and `src/api/*-client.ts` and delete
 `api/effect`, `api/lambda`, `shared/effect`, and `src/effect` paths.
 
 Generated strict Effect workspaces pin the compatible Effect cohort through
-`pnpm-workspace.yaml` overrides: `effect@4.0.0-beta.89` and
-`@effect/vitest@4.0.0-beta.89`. Do not override those in app packages; update
-the framework cohort when the runtime moves.
+`pnpm-workspace.yaml` overrides: `effect@4.0.0-beta.91` and
+`@effect/vitest@4.0.0-beta.91`. The generated pnpm policy also excludes the
+known `effect@4.0.0-beta.91` and `@effect/opentelemetry@4.0.0-beta.91`
+versions from the 24-hour minimum-release-age gate and their trusted-publisher
+to provenance transitions from no-downgrade checks. Do not override those in
+app packages; update the framework cohort when the runtime moves.
 
 Use `--ultramodern-package-source=install` for published cohort proof and pin a
 specific release with `--ultramodern-package-version` when CI must prove an

package/dist/cjs/ultramodern-tooling/commands.cjs

@@ -53,6 +53,7 @@ const external_node_url_namespaceObject = require("node:url");
 const external_create_package_root_cjs_namespaceObject = require("../create-package-root.cjs");
 const external_ultramodern_package_source_cjs_namespaceObject = require("../ultramodern-package-source.cjs");
 const mf_validation_cjs_namespaceObject = require("../ultramodern-workspace/mf-validation.cjs");
+const versions_cjs_namespaceObject = require("../ultramodern-workspace/versions.cjs");
 const workspace_scripts_cjs_namespaceObject = require("../ultramodern-workspace/workspace-scripts.cjs");
 const external_config_cjs_namespaceObject = require("./config.cjs");
 const commands_dirname = external_node_path_default().dirname((0, external_node_url_namespaceObject.fileURLToPath)(__rslib_import_meta_url__));
@@ -198,6 +199,78 @@ function updateModernDependencies(packageJson, packageSource) {
     }
     return changed;
 }
+const generatedToolingDependencyPins = new Map([
+    [
+        '@effect/tsgo',
+        versions_cjs_namespaceObject.EFFECT_TSGO_VERSION
+    ],
+    [
+        "@typescript/native-preview",
+        versions_cjs_namespaceObject.TYPESCRIPT_NATIVE_PREVIEW_VERSION
+    ],
+    [
+        'oxfmt',
+        versions_cjs_namespaceObject.OXFMT_VERSION
+    ],
+    [
+        'oxlint',
+        versions_cjs_namespaceObject.OXLINT_VERSION
+    ],
+    [
+        'wrangler',
+        versions_cjs_namespaceObject.WRANGLER_VERSION
+    ],
+    [
+        'zephyr-agent',
+        versions_cjs_namespaceObject.ZEPHYR_AGENT_VERSION
+    ],
+    [
+        'zephyr-rspack-plugin',
+        versions_cjs_namespaceObject.ZEPHYR_RSPACK_PLUGIN_VERSION
+    ]
+]);
+const strictEffectPackageVersionPolicyExclusions = [
+    `effect@${versions_cjs_namespaceObject.EFFECT_VERSION}`,
+    `@effect/opentelemetry@${versions_cjs_namespaceObject.EFFECT_VERSION}`
+];
+function updateGeneratedToolingDependencies(packageJson) {
+    let changed = false;
+    for (const section of [
+        'dependencies',
+        'devDependencies',
+        'peerDependencies',
+        'optionalDependencies'
+    ]){
+        const dependencies = packageJson[section];
+        if (!(!dependencies || 'object' != typeof dependencies || Array.isArray(dependencies))) {
+            for (const [packageName, version] of generatedToolingDependencyPins)if (Object.prototype.hasOwnProperty.call(dependencies, packageName) && dependencies[packageName] !== version) {
+                dependencies[packageName] = version;
+                changed = true;
+            }
+        }
+    }
+    return changed;
+}
+const cloudflareModernDeployCommand = 'ULTRAMODERN_ZEPHYR=false MODERNJS_DEPLOY=cloudflare modern deploy';
+const cloudflareModernDeploySkipBuildCommand = `${cloudflareModernDeployCommand} --skip-build`;
+const cloudflareWranglerDeployCommand = 'wrangler deploy --config .output/wrangler.json';
+const cloudflareWranglerDeployInvalidSkipBuildCommand = `${cloudflareWranglerDeployCommand} --skip-build`;
+function updateGeneratedPackageScripts(packageJson) {
+    const scripts = packageJson.scripts;
+    if (!scripts || 'object' != typeof scripts || Array.isArray(scripts)) return false;
+    let changed = false;
+    const cloudflareBuild = scripts['cloudflare:build'];
+    if ('string' == typeof cloudflareBuild && cloudflareBuild.includes(cloudflareModernDeployCommand) && !cloudflareBuild.includes(cloudflareModernDeploySkipBuildCommand)) {
+        scripts['cloudflare:build'] = cloudflareBuild.replace(cloudflareModernDeployCommand, cloudflareModernDeploySkipBuildCommand);
+        changed = true;
+    }
+    const cloudflareDeploy = scripts['cloudflare:deploy'];
+    if ('string' == typeof cloudflareDeploy && cloudflareDeploy.includes(cloudflareWranglerDeployInvalidSkipBuildCommand)) {
+        scripts['cloudflare:deploy'] = cloudflareDeploy.replace(cloudflareWranglerDeployInvalidSkipBuildCommand, cloudflareWranglerDeployCommand);
+        changed = true;
+    }
+    return changed;
+}
 function normalizeStrictEffectApiMetadata(value) {
     const api = value.api;
     if (!api || 'object' != typeof api || Array.isArray(api)) return false;
@@ -263,6 +336,80 @@ function normalizeStrictEffectApiMetadata(value) {
     }
     return changed;
 }
+function replaceYamlLine(source, pattern, replacement) {
+    const updated = source.replace(pattern, replacement);
+    return {
+        source: updated,
+        changed: updated !== source
+    };
+}
+function ensureYamlListItem(source, key, item) {
+    const itemLine = `  - '${item}'`;
+    const headerPattern = new RegExp(`^${key}:\\n(?:(?:  - .+\\n)*)`, 'mu');
+    const header = source.match(headerPattern);
+    if (header) {
+        if (header[0].split('\n').includes(itemLine)) return {
+            source,
+            changed: false
+        };
+        return {
+            source: source.replace(headerPattern, `${header[0]}${itemLine}\n`),
+            changed: true
+        };
+    }
+    const block = `${key}:\n${itemLine}\n`;
+    const afterTrustPolicyIgnore = source.replace(/^(trustPolicyIgnoreAfter: .+\n)/mu, `$1${block}`);
+    if (afterTrustPolicyIgnore !== source) return {
+        source: afterTrustPolicyIgnore,
+        changed: true
+    };
+    return {
+        source: `${source.trimEnd()}\n${block}`,
+        changed: true
+    };
+}
+function updateGeneratedPnpmWorkspacePolicy(workspaceRoot) {
+    const workspaceFile = external_node_path_default().join(workspaceRoot, 'pnpm-workspace.yaml');
+    if (!external_node_fs_default().existsSync(workspaceFile)) return false;
+    let source = external_node_fs_default().readFileSync(workspaceFile, 'utf-8');
+    let changed = false;
+    const replacements = [
+        [
+            /^ {4}'@effect\/vitest>effect': .+$/mu,
+            `    '@effect/vitest>effect': '${versions_cjs_namespaceObject.EFFECT_VERSION}'`
+        ],
+        [
+            /^ {2}'@effect\/vitest': .+$/mu,
+            `  '@effect/vitest': ${versions_cjs_namespaceObject.EFFECT_VITEST_VERSION}`
+        ],
+        [
+            /^ {2}effect: .+$/mu,
+            `  effect: ${versions_cjs_namespaceObject.EFFECT_VERSION}`
+        ]
+    ];
+    for (const [pattern, replacement] of replacements){
+        const result = replaceYamlLine(source, pattern, replacement);
+        source = result.source;
+        changed = result.changed || changed;
+    }
+    for (const item of strictEffectPackageVersionPolicyExclusions){
+        const packageName = item.slice(0, item.lastIndexOf('@'));
+        const escapedPackageName = packageName.replace(/[.*+?^${}()|[\]\\]/gu, '\\$&');
+        const currentVersion = replaceYamlLine(source, new RegExp(`^ {2}- '${escapedPackageName}@[^']+'$`, 'gmu'), `  - '${item}'`);
+        source = currentVersion.source;
+        changed = currentVersion.changed || changed;
+        for (const policyKey of [
+            'minimumReleaseAgeExclude',
+            'trustPolicyExclude'
+        ]){
+            const policyExclude = ensureYamlListItem(source, policyKey, item);
+            source = policyExclude.source;
+            changed = policyExclude.changed || changed;
+        }
+    }
+    if (changed) external_node_fs_default().writeFileSync(workspaceFile, source, 'utf-8');
+    return changed;
+}
 function updateUltramodernConfig(workspaceRoot, packageSource) {
     const configPath = external_node_path_default().join(workspaceRoot, '.modernjs/ultramodern.json');
     const config = readJsonFile(configPath);
@@ -344,8 +491,9 @@ function runMigrateStrictEffect(args, context) {
   modern-js-create ultramodern migrate-strict-effect --version <version> [--skip-install]
 
 Updates generated UltraModern package-source metadata, Modern package aliases,
-direct Effect API topology metadata, and the pnpm lockfile for strict Effect
-workspaces. Source code still has to pass pnpm api:check and pnpm contract:check.
+framework-owned toolchain pins, direct Effect API topology metadata, strict
+Effect pnpm overrides/trust policy, and the pnpm lockfile. Source code still
+has to pass pnpm api:check and pnpm contract:check.
 `);
         return 0;
     }
@@ -363,9 +511,14 @@ workspaces. Source code still has to pass pnpm api:check and pnpm contract:check
                 config: './.modernjs/ultramodern.json'
             };
         }
-        if (updateModernDependencies(packageJson, packageSource)) writeJsonFile(packageFile, packageJson);
+        const modernDependenciesChanged = updateModernDependencies(packageJson, packageSource);
+        const toolingDependenciesChanged = updateGeneratedToolingDependencies(packageJson);
+        const generatedScriptsChanged = updateGeneratedPackageScripts(packageJson);
+        const changed = modernDependenciesChanged || toolingDependenciesChanged || generatedScriptsChanged;
+        if (changed) writeJsonFile(packageFile, packageJson);
         else if ('package.json' === relativePackageFile) writeJsonFile(packageFile, packageJson);
     }
+    updateGeneratedPnpmWorkspacePolicy(context.workspaceRoot);
     if (!hasFlag(args, '--skip-install')) {
         const status = runPnpmLockfileRefresh(context);
         if (0 !== status) return status;

package/dist/cjs/ultramodern-workspace/package-json.cjs

@@ -417,7 +417,7 @@ function createAppPackage(scope, app, packageSource, enableTailwind, remotes = [
         scripts: {
             dev: 'modern dev',
             build: app.exposes ? `ULTRAMODERN_ZEPHYR=false modern build && ${publicSurfaceBuildCommand} && node ${(0, external_naming_cjs_namespaceObject.relativeRootFor)(app.directory)}/scripts/assert-mf-types.mts` : `ULTRAMODERN_ZEPHYR=false modern build && ${publicSurfaceBuildCommand}`,
-            'cloudflare:build': `ULTRAMODERN_ZEPHYR=false MODERNJS_DEPLOY=cloudflare modern build && ${publicSurfaceCloudflareBuildCommand} && ULTRAMODERN_ZEPHYR=false MODERNJS_DEPLOY=cloudflare modern deploy && ${publicSurfaceCloudflareOutputCommand}`,
+            'cloudflare:build': `ULTRAMODERN_ZEPHYR=false MODERNJS_DEPLOY=cloudflare modern build && ${publicSurfaceCloudflareBuildCommand} && ULTRAMODERN_ZEPHYR=false MODERNJS_DEPLOY=cloudflare modern deploy --skip-build && ${publicSurfaceCloudflareOutputCommand}`,
             'cloudflare:deploy': 'ULTRAMODERN_CLOUDFLARE_REQUIRE_PUBLIC_URLS=true pnpm run cloudflare:build && wrangler deploy --config .output/wrangler.json',
             'cloudflare:preview': 'pnpm run cloudflare:build && wrangler dev --config .output/wrangler.json',
             'cloudflare:proof': `node ${(0, external_naming_cjs_namespaceObject.relativeRootFor)(app.directory)}/scripts/proof-cloudflare-version.mts --app ${app.id}`,

package/dist/cjs/ultramodern-workspace/versions.cjs

@@ -37,14 +37,14 @@ const CLOUDFLARE_COMPATIBILITY_DATE = '2026-06-02';
 const TAILWIND_VERSION = '4.3.1';
 const TAILWIND_POSTCSS_VERSION = '4.3.1';
 const POSTCSS_VERSION = '8.5.15';
-const EFFECT_VERSION = '4.0.0-beta.89';
-const EFFECT_VITEST_VERSION = '4.0.0-beta.89';
+const EFFECT_VERSION = '4.0.0-beta.91';
+const EFFECT_VITEST_VERSION = '4.0.0-beta.91';
 const EFFECT_TSGO_VERSION = '0.14.6';
 const TYPESCRIPT_STABLE_VERSION = '6.0.3';
-const TYPESCRIPT_NATIVE_PREVIEW_VERSION = '7.0.0-dev.20260624.1';
+const TYPESCRIPT_NATIVE_PREVIEW_VERSION = '7.0.0-dev.20260628.1';
 const TYPESCRIPT_VERSION = TYPESCRIPT_STABLE_VERSION;
 const OXLINT_VERSION = '1.71.0';
-const OXFMT_VERSION = '0.55.0';
+const OXFMT_VERSION = '0.56.0';
 const ULTRACITE_VERSION = '7.8.3';
 const LEFTHOOK_VERSION = '^2.1.9';
 const I18NEXT_VERSION = '26.3.1';

package/dist/esm/ultramodern-tooling/commands.js

@@ -6,6 +6,7 @@ import { fileURLToPath } from "node:url";
 import { resolveCreatePackageRoot } from "../create-package-root.js";
 import { BLEEDINGDEV_PACKAGE_NAME_PREFIX, BLEEDINGDEV_PACKAGE_SCOPE, ULTRAMODERN_SINGLE_APP_MODERN_PACKAGES, ULTRAMODERN_WORKSPACE_MODERN_PACKAGES, WORKSPACE_PACKAGE_VERSION, modernPackageSpecifier } from "../ultramodern-package-source.js";
 import { validateModuleFederationTypes } from "../ultramodern-workspace/mf-validation.js";
+import { EFFECT_TSGO_VERSION, EFFECT_VERSION, EFFECT_VITEST_VERSION, OXFMT_VERSION, OXLINT_VERSION, TYPESCRIPT_NATIVE_PREVIEW_VERSION, WRANGLER_VERSION, ZEPHYR_AGENT_VERSION, ZEPHYR_RSPACK_PLUGIN_VERSION } from "../ultramodern-workspace/versions.js";
 import { createWorkspaceValidationScript } from "../ultramodern-workspace/workspace-scripts.js";
 import { readUltramodernConfig, workspaceAppsFromToolingConfig } from "./config.js";
 const commands_dirname = node_path.dirname(fileURLToPath(import.meta.url));
@@ -151,6 +152,78 @@ function updateModernDependencies(packageJson, packageSource) {
     }
     return changed;
 }
+const generatedToolingDependencyPins = new Map([
+    [
+        '@effect/tsgo',
+        EFFECT_TSGO_VERSION
+    ],
+    [
+        "@typescript/native-preview",
+        TYPESCRIPT_NATIVE_PREVIEW_VERSION
+    ],
+    [
+        'oxfmt',
+        OXFMT_VERSION
+    ],
+    [
+        'oxlint',
+        OXLINT_VERSION
+    ],
+    [
+        'wrangler',
+        WRANGLER_VERSION
+    ],
+    [
+        'zephyr-agent',
+        ZEPHYR_AGENT_VERSION
+    ],
+    [
+        'zephyr-rspack-plugin',
+        ZEPHYR_RSPACK_PLUGIN_VERSION
+    ]
+]);
+const strictEffectPackageVersionPolicyExclusions = [
+    `effect@${EFFECT_VERSION}`,
+    `@effect/opentelemetry@${EFFECT_VERSION}`
+];
+function updateGeneratedToolingDependencies(packageJson) {
+    let changed = false;
+    for (const section of [
+        'dependencies',
+        'devDependencies',
+        'peerDependencies',
+        'optionalDependencies'
+    ]){
+        const dependencies = packageJson[section];
+        if (!(!dependencies || 'object' != typeof dependencies || Array.isArray(dependencies))) {
+            for (const [packageName, version] of generatedToolingDependencyPins)if (Object.prototype.hasOwnProperty.call(dependencies, packageName) && dependencies[packageName] !== version) {
+                dependencies[packageName] = version;
+                changed = true;
+            }
+        }
+    }
+    return changed;
+}
+const cloudflareModernDeployCommand = 'ULTRAMODERN_ZEPHYR=false MODERNJS_DEPLOY=cloudflare modern deploy';
+const cloudflareModernDeploySkipBuildCommand = `${cloudflareModernDeployCommand} --skip-build`;
+const cloudflareWranglerDeployCommand = 'wrangler deploy --config .output/wrangler.json';
+const cloudflareWranglerDeployInvalidSkipBuildCommand = `${cloudflareWranglerDeployCommand} --skip-build`;
+function updateGeneratedPackageScripts(packageJson) {
+    const scripts = packageJson.scripts;
+    if (!scripts || 'object' != typeof scripts || Array.isArray(scripts)) return false;
+    let changed = false;
+    const cloudflareBuild = scripts['cloudflare:build'];
+    if ('string' == typeof cloudflareBuild && cloudflareBuild.includes(cloudflareModernDeployCommand) && !cloudflareBuild.includes(cloudflareModernDeploySkipBuildCommand)) {
+        scripts['cloudflare:build'] = cloudflareBuild.replace(cloudflareModernDeployCommand, cloudflareModernDeploySkipBuildCommand);
+        changed = true;
+    }
+    const cloudflareDeploy = scripts['cloudflare:deploy'];
+    if ('string' == typeof cloudflareDeploy && cloudflareDeploy.includes(cloudflareWranglerDeployInvalidSkipBuildCommand)) {
+        scripts['cloudflare:deploy'] = cloudflareDeploy.replace(cloudflareWranglerDeployInvalidSkipBuildCommand, cloudflareWranglerDeployCommand);
+        changed = true;
+    }
+    return changed;
+}
 function normalizeStrictEffectApiMetadata(value) {
     const api = value.api;
     if (!api || 'object' != typeof api || Array.isArray(api)) return false;
@@ -216,6 +289,80 @@ function normalizeStrictEffectApiMetadata(value) {
     }
     return changed;
 }
+function replaceYamlLine(source, pattern, replacement) {
+    const updated = source.replace(pattern, replacement);
+    return {
+        source: updated,
+        changed: updated !== source
+    };
+}
+function ensureYamlListItem(source, key, item) {
+    const itemLine = `  - '${item}'`;
+    const headerPattern = new RegExp(`^${key}:\\n(?:(?:  - .+\\n)*)`, 'mu');
+    const header = source.match(headerPattern);
+    if (header) {
+        if (header[0].split('\n').includes(itemLine)) return {
+            source,
+            changed: false
+        };
+        return {
+            source: source.replace(headerPattern, `${header[0]}${itemLine}\n`),
+            changed: true
+        };
+    }
+    const block = `${key}:\n${itemLine}\n`;
+    const afterTrustPolicyIgnore = source.replace(/^(trustPolicyIgnoreAfter: .+\n)/mu, `$1${block}`);
+    if (afterTrustPolicyIgnore !== source) return {
+        source: afterTrustPolicyIgnore,
+        changed: true
+    };
+    return {
+        source: `${source.trimEnd()}\n${block}`,
+        changed: true
+    };
+}
+function updateGeneratedPnpmWorkspacePolicy(workspaceRoot) {
+    const workspaceFile = node_path.join(workspaceRoot, 'pnpm-workspace.yaml');
+    if (!node_fs.existsSync(workspaceFile)) return false;
+    let source = node_fs.readFileSync(workspaceFile, 'utf-8');
+    let changed = false;
+    const replacements = [
+        [
+            /^ {4}'@effect\/vitest>effect': .+$/mu,
+            `    '@effect/vitest>effect': '${EFFECT_VERSION}'`
+        ],
+        [
+            /^ {2}'@effect\/vitest': .+$/mu,
+            `  '@effect/vitest': ${EFFECT_VITEST_VERSION}`
+        ],
+        [
+            /^ {2}effect: .+$/mu,
+            `  effect: ${EFFECT_VERSION}`
+        ]
+    ];
+    for (const [pattern, replacement] of replacements){
+        const result = replaceYamlLine(source, pattern, replacement);
+        source = result.source;
+        changed = result.changed || changed;
+    }
+    for (const item of strictEffectPackageVersionPolicyExclusions){
+        const packageName = item.slice(0, item.lastIndexOf('@'));
+        const escapedPackageName = packageName.replace(/[.*+?^${}()|[\]\\]/gu, '\\$&');
+        const currentVersion = replaceYamlLine(source, new RegExp(`^ {2}- '${escapedPackageName}@[^']+'$`, 'gmu'), `  - '${item}'`);
+        source = currentVersion.source;
+        changed = currentVersion.changed || changed;
+        for (const policyKey of [
+            'minimumReleaseAgeExclude',
+            'trustPolicyExclude'
+        ]){
+            const policyExclude = ensureYamlListItem(source, policyKey, item);
+            source = policyExclude.source;
+            changed = policyExclude.changed || changed;
+        }
+    }
+    if (changed) node_fs.writeFileSync(workspaceFile, source, 'utf-8');
+    return changed;
+}
 function updateUltramodernConfig(workspaceRoot, packageSource) {
     const configPath = node_path.join(workspaceRoot, '.modernjs/ultramodern.json');
     const config = readJsonFile(configPath);
@@ -297,8 +444,9 @@ function runMigrateStrictEffect(args, context) {
   modern-js-create ultramodern migrate-strict-effect --version <version> [--skip-install]
 
 Updates generated UltraModern package-source metadata, Modern package aliases,
-direct Effect API topology metadata, and the pnpm lockfile for strict Effect
-workspaces. Source code still has to pass pnpm api:check and pnpm contract:check.
+framework-owned toolchain pins, direct Effect API topology metadata, strict
+Effect pnpm overrides/trust policy, and the pnpm lockfile. Source code still
+has to pass pnpm api:check and pnpm contract:check.
 `);
         return 0;
     }
@@ -316,9 +464,14 @@ workspaces. Source code still has to pass pnpm api:check and pnpm contract:check
                 config: './.modernjs/ultramodern.json'
             };
         }
-        if (updateModernDependencies(packageJson, packageSource)) writeJsonFile(packageFile, packageJson);
+        const modernDependenciesChanged = updateModernDependencies(packageJson, packageSource);
+        const toolingDependenciesChanged = updateGeneratedToolingDependencies(packageJson);
+        const generatedScriptsChanged = updateGeneratedPackageScripts(packageJson);
+        const changed = modernDependenciesChanged || toolingDependenciesChanged || generatedScriptsChanged;
+        if (changed) writeJsonFile(packageFile, packageJson);
         else if ('package.json' === relativePackageFile) writeJsonFile(packageFile, packageJson);
     }
+    updateGeneratedPnpmWorkspacePolicy(context.workspaceRoot);
     if (!hasFlag(args, '--skip-install')) {
         const status = runPnpmLockfileRefresh(context);
         if (0 !== status) return status;

package/dist/esm/ultramodern-workspace/package-json.js

@@ -371,7 +371,7 @@ function createAppPackage(scope, app, packageSource, enableTailwind, remotes = [
         scripts: {
             dev: 'modern dev',
             build: app.exposes ? `ULTRAMODERN_ZEPHYR=false modern build && ${publicSurfaceBuildCommand} && node ${relativeRootFor(app.directory)}/scripts/assert-mf-types.mts` : `ULTRAMODERN_ZEPHYR=false modern build && ${publicSurfaceBuildCommand}`,
-            'cloudflare:build': `ULTRAMODERN_ZEPHYR=false MODERNJS_DEPLOY=cloudflare modern build && ${publicSurfaceCloudflareBuildCommand} && ULTRAMODERN_ZEPHYR=false MODERNJS_DEPLOY=cloudflare modern deploy && ${publicSurfaceCloudflareOutputCommand}`,
+            'cloudflare:build': `ULTRAMODERN_ZEPHYR=false MODERNJS_DEPLOY=cloudflare modern build && ${publicSurfaceCloudflareBuildCommand} && ULTRAMODERN_ZEPHYR=false MODERNJS_DEPLOY=cloudflare modern deploy --skip-build && ${publicSurfaceCloudflareOutputCommand}`,
             'cloudflare:deploy': 'ULTRAMODERN_CLOUDFLARE_REQUIRE_PUBLIC_URLS=true pnpm run cloudflare:build && wrangler deploy --config .output/wrangler.json',
             'cloudflare:preview': 'pnpm run cloudflare:build && wrangler dev --config .output/wrangler.json',
             'cloudflare:proof': `node ${relativeRootFor(app.directory)}/scripts/proof-cloudflare-version.mts --app ${app.id}`,

package/dist/esm/ultramodern-workspace/versions.js

@@ -8,14 +8,14 @@ const CLOUDFLARE_COMPATIBILITY_DATE = '2026-06-02';
 const TAILWIND_VERSION = '4.3.1';
 const TAILWIND_POSTCSS_VERSION = '4.3.1';
 const POSTCSS_VERSION = '8.5.15';
-const EFFECT_VERSION = '4.0.0-beta.89';
-const EFFECT_VITEST_VERSION = '4.0.0-beta.89';
+const EFFECT_VERSION = '4.0.0-beta.91';
+const EFFECT_VITEST_VERSION = '4.0.0-beta.91';
 const EFFECT_TSGO_VERSION = '0.14.6';
 const TYPESCRIPT_STABLE_VERSION = '6.0.3';
-const TYPESCRIPT_NATIVE_PREVIEW_VERSION = '7.0.0-dev.20260624.1';
+const TYPESCRIPT_NATIVE_PREVIEW_VERSION = '7.0.0-dev.20260628.1';
 const TYPESCRIPT_VERSION = TYPESCRIPT_STABLE_VERSION;
 const OXLINT_VERSION = '1.71.0';
-const OXFMT_VERSION = '0.55.0';
+const OXFMT_VERSION = '0.56.0';
 const ULTRACITE_VERSION = '7.8.3';
 const LEFTHOOK_VERSION = '^2.1.9';
 const I18NEXT_VERSION = '26.3.1';

package/dist/esm-node/ultramodern-tooling/commands.js

@@ -7,6 +7,7 @@ import { fileURLToPath } from "node:url";
 import { resolveCreatePackageRoot } from "../create-package-root.js";
 import { BLEEDINGDEV_PACKAGE_NAME_PREFIX, BLEEDINGDEV_PACKAGE_SCOPE, ULTRAMODERN_SINGLE_APP_MODERN_PACKAGES, ULTRAMODERN_WORKSPACE_MODERN_PACKAGES, WORKSPACE_PACKAGE_VERSION, modernPackageSpecifier } from "../ultramodern-package-source.js";
 import { validateModuleFederationTypes } from "../ultramodern-workspace/mf-validation.js";
+import { EFFECT_TSGO_VERSION, EFFECT_VERSION, EFFECT_VITEST_VERSION, OXFMT_VERSION, OXLINT_VERSION, TYPESCRIPT_NATIVE_PREVIEW_VERSION, WRANGLER_VERSION, ZEPHYR_AGENT_VERSION, ZEPHYR_RSPACK_PLUGIN_VERSION } from "../ultramodern-workspace/versions.js";
 import { createWorkspaceValidationScript } from "../ultramodern-workspace/workspace-scripts.js";
 import { readUltramodernConfig, workspaceAppsFromToolingConfig } from "./config.js";
 const commands_dirname = node_path.dirname(fileURLToPath(import.meta.url));
@@ -152,6 +153,78 @@ function updateModernDependencies(packageJson, packageSource) {
     }
     return changed;
 }
+const generatedToolingDependencyPins = new Map([
+    [
+        '@effect/tsgo',
+        EFFECT_TSGO_VERSION
+    ],
+    [
+        "@typescript/native-preview",
+        TYPESCRIPT_NATIVE_PREVIEW_VERSION
+    ],
+    [
+        'oxfmt',
+        OXFMT_VERSION
+    ],
+    [
+        'oxlint',
+        OXLINT_VERSION
+    ],
+    [
+        'wrangler',
+        WRANGLER_VERSION
+    ],
+    [
+        'zephyr-agent',
+        ZEPHYR_AGENT_VERSION
+    ],
+    [
+        'zephyr-rspack-plugin',
+        ZEPHYR_RSPACK_PLUGIN_VERSION
+    ]
+]);
+const strictEffectPackageVersionPolicyExclusions = [
+    `effect@${EFFECT_VERSION}`,
+    `@effect/opentelemetry@${EFFECT_VERSION}`
+];
+function updateGeneratedToolingDependencies(packageJson) {
+    let changed = false;
+    for (const section of [
+        'dependencies',
+        'devDependencies',
+        'peerDependencies',
+        'optionalDependencies'
+    ]){
+        const dependencies = packageJson[section];
+        if (!(!dependencies || 'object' != typeof dependencies || Array.isArray(dependencies))) {
+            for (const [packageName, version] of generatedToolingDependencyPins)if (Object.prototype.hasOwnProperty.call(dependencies, packageName) && dependencies[packageName] !== version) {
+                dependencies[packageName] = version;
+                changed = true;
+            }
+        }
+    }
+    return changed;
+}
+const cloudflareModernDeployCommand = 'ULTRAMODERN_ZEPHYR=false MODERNJS_DEPLOY=cloudflare modern deploy';
+const cloudflareModernDeploySkipBuildCommand = `${cloudflareModernDeployCommand} --skip-build`;
+const cloudflareWranglerDeployCommand = 'wrangler deploy --config .output/wrangler.json';
+const cloudflareWranglerDeployInvalidSkipBuildCommand = `${cloudflareWranglerDeployCommand} --skip-build`;
+function updateGeneratedPackageScripts(packageJson) {
+    const scripts = packageJson.scripts;
+    if (!scripts || 'object' != typeof scripts || Array.isArray(scripts)) return false;
+    let changed = false;
+    const cloudflareBuild = scripts['cloudflare:build'];
+    if ('string' == typeof cloudflareBuild && cloudflareBuild.includes(cloudflareModernDeployCommand) && !cloudflareBuild.includes(cloudflareModernDeploySkipBuildCommand)) {
+        scripts['cloudflare:build'] = cloudflareBuild.replace(cloudflareModernDeployCommand, cloudflareModernDeploySkipBuildCommand);
+        changed = true;
+    }
+    const cloudflareDeploy = scripts['cloudflare:deploy'];
+    if ('string' == typeof cloudflareDeploy && cloudflareDeploy.includes(cloudflareWranglerDeployInvalidSkipBuildCommand)) {
+        scripts['cloudflare:deploy'] = cloudflareDeploy.replace(cloudflareWranglerDeployInvalidSkipBuildCommand, cloudflareWranglerDeployCommand);
+        changed = true;
+    }
+    return changed;
+}
 function normalizeStrictEffectApiMetadata(value) {
     const api = value.api;
     if (!api || 'object' != typeof api || Array.isArray(api)) return false;
@@ -217,6 +290,80 @@ function normalizeStrictEffectApiMetadata(value) {
     }
     return changed;
 }
+function replaceYamlLine(source, pattern, replacement) {
+    const updated = source.replace(pattern, replacement);
+    return {
+        source: updated,
+        changed: updated !== source
+    };
+}
+function ensureYamlListItem(source, key, item) {
+    const itemLine = `  - '${item}'`;
+    const headerPattern = new RegExp(`^${key}:\\n(?:(?:  - .+\\n)*)`, 'mu');
+    const header = source.match(headerPattern);
+    if (header) {
+        if (header[0].split('\n').includes(itemLine)) return {
+            source,
+            changed: false
+        };
+        return {
+            source: source.replace(headerPattern, `${header[0]}${itemLine}\n`),
+            changed: true
+        };
+    }
+    const block = `${key}:\n${itemLine}\n`;
+    const afterTrustPolicyIgnore = source.replace(/^(trustPolicyIgnoreAfter: .+\n)/mu, `$1${block}`);
+    if (afterTrustPolicyIgnore !== source) return {
+        source: afterTrustPolicyIgnore,
+        changed: true
+    };
+    return {
+        source: `${source.trimEnd()}\n${block}`,
+        changed: true
+    };
+}
+function updateGeneratedPnpmWorkspacePolicy(workspaceRoot) {
+    const workspaceFile = node_path.join(workspaceRoot, 'pnpm-workspace.yaml');
+    if (!node_fs.existsSync(workspaceFile)) return false;
+    let source = node_fs.readFileSync(workspaceFile, 'utf-8');
+    let changed = false;
+    const replacements = [
+        [
+            /^ {4}'@effect\/vitest>effect': .+$/mu,
+            `    '@effect/vitest>effect': '${EFFECT_VERSION}'`
+        ],
+        [
+            /^ {2}'@effect\/vitest': .+$/mu,
+            `  '@effect/vitest': ${EFFECT_VITEST_VERSION}`
+        ],
+        [
+            /^ {2}effect: .+$/mu,
+            `  effect: ${EFFECT_VERSION}`
+        ]
+    ];
+    for (const [pattern, replacement] of replacements){
+        const result = replaceYamlLine(source, pattern, replacement);
+        source = result.source;
+        changed = result.changed || changed;
+    }
+    for (const item of strictEffectPackageVersionPolicyExclusions){
+        const packageName = item.slice(0, item.lastIndexOf('@'));
+        const escapedPackageName = packageName.replace(/[.*+?^${}()|[\]\\]/gu, '\\$&');
+        const currentVersion = replaceYamlLine(source, new RegExp(`^ {2}- '${escapedPackageName}@[^']+'$`, 'gmu'), `  - '${item}'`);
+        source = currentVersion.source;
+        changed = currentVersion.changed || changed;
+        for (const policyKey of [
+            'minimumReleaseAgeExclude',
+            'trustPolicyExclude'
+        ]){
+            const policyExclude = ensureYamlListItem(source, policyKey, item);
+            source = policyExclude.source;
+            changed = policyExclude.changed || changed;
+        }
+    }
+    if (changed) node_fs.writeFileSync(workspaceFile, source, 'utf-8');
+    return changed;
+}
 function updateUltramodernConfig(workspaceRoot, packageSource) {
     const configPath = node_path.join(workspaceRoot, '.modernjs/ultramodern.json');
     const config = readJsonFile(configPath);
@@ -298,8 +445,9 @@ function runMigrateStrictEffect(args, context) {
   modern-js-create ultramodern migrate-strict-effect --version <version> [--skip-install]
 
 Updates generated UltraModern package-source metadata, Modern package aliases,
-direct Effect API topology metadata, and the pnpm lockfile for strict Effect
-workspaces. Source code still has to pass pnpm api:check and pnpm contract:check.
+framework-owned toolchain pins, direct Effect API topology metadata, strict
+Effect pnpm overrides/trust policy, and the pnpm lockfile. Source code still
+has to pass pnpm api:check and pnpm contract:check.
 `);
         return 0;
     }
@@ -317,9 +465,14 @@ workspaces. Source code still has to pass pnpm api:check and pnpm contract:check
                 config: './.modernjs/ultramodern.json'
             };
         }
-        if (updateModernDependencies(packageJson, packageSource)) writeJsonFile(packageFile, packageJson);
+        const modernDependenciesChanged = updateModernDependencies(packageJson, packageSource);
+        const toolingDependenciesChanged = updateGeneratedToolingDependencies(packageJson);
+        const generatedScriptsChanged = updateGeneratedPackageScripts(packageJson);
+        const changed = modernDependenciesChanged || toolingDependenciesChanged || generatedScriptsChanged;
+        if (changed) writeJsonFile(packageFile, packageJson);
         else if ('package.json' === relativePackageFile) writeJsonFile(packageFile, packageJson);
     }
+    updateGeneratedPnpmWorkspacePolicy(context.workspaceRoot);
     if (!hasFlag(args, '--skip-install')) {
         const status = runPnpmLockfileRefresh(context);
         if (0 !== status) return status;

package/dist/esm-node/ultramodern-workspace/package-json.js

@@ -372,7 +372,7 @@ function createAppPackage(scope, app, packageSource, enableTailwind, remotes = [
         scripts: {
             dev: 'modern dev',
             build: app.exposes ? `ULTRAMODERN_ZEPHYR=false modern build && ${publicSurfaceBuildCommand} && node ${relativeRootFor(app.directory)}/scripts/assert-mf-types.mts` : `ULTRAMODERN_ZEPHYR=false modern build && ${publicSurfaceBuildCommand}`,
-            'cloudflare:build': `ULTRAMODERN_ZEPHYR=false MODERNJS_DEPLOY=cloudflare modern build && ${publicSurfaceCloudflareBuildCommand} && ULTRAMODERN_ZEPHYR=false MODERNJS_DEPLOY=cloudflare modern deploy && ${publicSurfaceCloudflareOutputCommand}`,
+            'cloudflare:build': `ULTRAMODERN_ZEPHYR=false MODERNJS_DEPLOY=cloudflare modern build && ${publicSurfaceCloudflareBuildCommand} && ULTRAMODERN_ZEPHYR=false MODERNJS_DEPLOY=cloudflare modern deploy --skip-build && ${publicSurfaceCloudflareOutputCommand}`,
             'cloudflare:deploy': 'ULTRAMODERN_CLOUDFLARE_REQUIRE_PUBLIC_URLS=true pnpm run cloudflare:build && wrangler deploy --config .output/wrangler.json',
             'cloudflare:preview': 'pnpm run cloudflare:build && wrangler dev --config .output/wrangler.json',
             'cloudflare:proof': `node ${relativeRootFor(app.directory)}/scripts/proof-cloudflare-version.mts --app ${app.id}`,

package/dist/esm-node/ultramodern-workspace/versions.js

@@ -9,14 +9,14 @@ const CLOUDFLARE_COMPATIBILITY_DATE = '2026-06-02';
 const TAILWIND_VERSION = '4.3.1';
 const TAILWIND_POSTCSS_VERSION = '4.3.1';
 const POSTCSS_VERSION = '8.5.15';
-const EFFECT_VERSION = '4.0.0-beta.89';
-const EFFECT_VITEST_VERSION = '4.0.0-beta.89';
+const EFFECT_VERSION = '4.0.0-beta.91';
+const EFFECT_VITEST_VERSION = '4.0.0-beta.91';
 const EFFECT_TSGO_VERSION = '0.14.6';
 const TYPESCRIPT_STABLE_VERSION = '6.0.3';
-const TYPESCRIPT_NATIVE_PREVIEW_VERSION = '7.0.0-dev.20260624.1';
+const TYPESCRIPT_NATIVE_PREVIEW_VERSION = '7.0.0-dev.20260628.1';
 const TYPESCRIPT_VERSION = TYPESCRIPT_STABLE_VERSION;
 const OXLINT_VERSION = '1.71.0';
-const OXFMT_VERSION = '0.55.0';
+const OXFMT_VERSION = '0.56.0';
 const ULTRACITE_VERSION = '7.8.3';
 const LEFTHOOK_VERSION = '^2.1.9';
 const I18NEXT_VERSION = '26.3.1';

package/dist/types/ultramodern-workspace/versions.d.ts

@@ -13,14 +13,14 @@ export declare const CLOUDFLARE_COMPATIBILITY_DATE = "2026-06-02";
 export declare const TAILWIND_VERSION = "4.3.1";
 export declare const TAILWIND_POSTCSS_VERSION = "4.3.1";
 export declare const POSTCSS_VERSION = "8.5.15";
-export declare const EFFECT_VERSION = "4.0.0-beta.89";
-export declare const EFFECT_VITEST_VERSION = "4.0.0-beta.89";
+export declare const EFFECT_VERSION = "4.0.0-beta.91";
+export declare const EFFECT_VITEST_VERSION = "4.0.0-beta.91";
 export declare const EFFECT_TSGO_VERSION = "0.14.6";
 export declare const TYPESCRIPT_STABLE_VERSION = "6.0.3";
-export declare const TYPESCRIPT_NATIVE_PREVIEW_VERSION = "7.0.0-dev.20260624.1";
+export declare const TYPESCRIPT_NATIVE_PREVIEW_VERSION = "7.0.0-dev.20260628.1";
 export declare const TYPESCRIPT_VERSION = "6.0.3";
 export declare const OXLINT_VERSION = "1.71.0";
-export declare const OXFMT_VERSION = "0.55.0";
+export declare const OXFMT_VERSION = "0.56.0";
 export declare const ULTRACITE_VERSION = "7.8.3";
 export declare const LEFTHOOK_VERSION = "^2.1.9";
 export declare const I18NEXT_VERSION = "26.3.1";

package/package.json

@@ -21,7 +21,7 @@
   "engines": {
     "node": ">=20"
   },
-  "version": "3.5.0-ultramodern.1",
+  "version": "3.5.0-ultramodern.10",
   "types": "./dist/types/index.d.ts",
   "main": "./dist/esm-node/index.js",
   "bin": {
@@ -75,14 +75,14 @@
   ],
   "dependencies": {
     "@modern-js/codesmith": "2.6.9",
-    "oxfmt": "0.55.0",
+    "oxfmt": "0.56.0",
     "ultracite": "7.8.3",
-    "@modern-js/i18n-utils": "npm:@bleedingdev/modern-js-i18n-utils@3.5.0-ultramodern.1"
+    "@modern-js/i18n-utils": "npm:@bleedingdev/modern-js-i18n-utils@3.5.0-ultramodern.10"
   },
   "devDependencies": {
-    "@rslib/core": "0.23.0",
+    "@rslib/core": "0.23.1",
     "@types/node": "^26.0.1",
-    "@typescript/native-preview": "7.0.0-dev.20260624.1",
+    "@typescript/native-preview": "7.0.0-dev.20260628.1",
     "tsx": "^4.22.4",
     "typescript": "^6.0.3",
     "@scripts/rstest-config": "2.66.0"
@@ -99,6 +99,6 @@
     "test": "rm -rf dist && rslib build -c rslibconfig.mts && rstest --passWithNoTests"
   },
   "ultramodern": {
-    "frameworkVersion": "3.5.0-ultramodern.1"
+    "frameworkVersion": "3.5.0-ultramodern.10"
   }
 }

package/template-workspace/README.md.handlebars

@@ -169,19 +169,23 @@ in API modules.
 Generated pnpm overrides pin the framework-compatible Effect cohort. Keep
 `effect` and `@effect/vitest` aligned with `pnpm-workspace.yaml`; do not add
 new direct package-level Effect versions unless the whole UltraModern cohort is
-upgraded.
+upgraded. The generated pnpm policy intentionally excludes the matching
+`effect` and `@effect/opentelemetry` cohort versions from the
+minimum-release-age and no-downgrade checks while Effect's beta publishes move
+from trusted-publisher metadata to provenance attestations.
 
 For older generated workspaces, run the framework migration command first:
 
 ```bash
-pnpm dlx @bleedingdev/modern-js-create@3.5.0-ultramodern.1 ultramodern \
-  migrate-strict-effect --version 3.5.0-ultramodern.1
+pnpm dlx @bleedingdev/modern-js-create@3.5.0-ultramodern.10 ultramodern \
+  migrate-strict-effect --version 3.5.0-ultramodern.10
 pnpm api:check
 pnpm contract:check
 ```
 
 The command updates generated package-source metadata, Modern package aliases,
-direct API topology metadata, and the lockfile. Remaining failures are source
+framework-owned toolchain pins, direct API topology metadata, strict Effect pnpm
+overrides/trust policy, and the lockfile. Remaining failures are source
 migration work; fix the owning API files instead of adding compatibility shims.
 
 ## Troubleshooting

package/template-workspace/pnpm-workspace.yaml.handlebars

@@ -8,6 +8,8 @@ minimumReleaseAgeStrict: true
 minimumReleaseAgeIgnoreMissingTime: false
 minimumReleaseAgeExclude:
   - '@bleedingdev/modern-js-*'
+  - 'effect@{{effectVersion}}'
+  - '@effect/opentelemetry@{{effectVersion}}'
   - '@tanstack/react-router'
   - '@tanstack/router-core'
   - 'typescript'
@@ -24,6 +26,9 @@ minimumReleaseAgeExclude:
   - 'ts-checker-rspack-plugin'
 trustPolicy: no-downgrade
 trustPolicyIgnoreAfter: 1440
+trustPolicyExclude:
+  - 'effect@{{effectVersion}}'
+  - '@effect/opentelemetry@{{effectVersion}}'
 blockExoticSubdeps: true
 engineStrict: true
 pmOnFail: error

package/templates/workspace-scripts/validate-ultramodern-workspace.mjs.handlebars

@@ -1349,6 +1349,22 @@ const extractAssetPrefixExpression = modernConfig => {
   assert(match?.groups?.expression, 'modern.config.ts must assign assetPrefix');
   return match.groups.expression;
 };
+const assertBuildCacheBase = (appId, modernConfig) => {
+  assert(
+    modernConfig.includes("const buildCacheTarget = cloudflareDeployEnabled ? 'cloudflare' : 'web';") &&
+      modernConfig.includes('const buildCacheDirectory = `node_modules/.cache/rspack-${appId}-${buildCacheTarget}`;') &&
+      modernConfig.includes('cacheDirectory: buildCacheDirectory,'),
+    `${appId} must provide a per-app/per-target Rspack cache base directory`,
+  );
+};
+const assertCloudflareBuildSkipsDeployRebuild = (appId, packageJson) => {
+  assert(
+    packageJson.scripts?.['cloudflare:build']?.includes(
+      'ULTRAMODERN_ZEPHYR=false MODERNJS_DEPLOY=cloudflare modern deploy --skip-build',
+    ),
+    `${appId} cloudflare:build must deploy with --skip-build after the explicit Cloudflare build`,
+  );
+};
 const stripYamlInlineComment = value => {
   let quote = undefined;
   for (let index = 0; index < value.length; index += 1) {
@@ -1771,6 +1787,9 @@ assert(shellPackage.dependencies?.['@modern-js/plugin-bff'] === expectedModernPa
 assert(shellPackage.dependencies?.['@modern-js/plugin-i18n'] === expectedModernPackageSpecifier('@modern-js/plugin-i18n'), 'Shell plugin-i18n dependency must match package source metadata');
 assert(shellPackage.dependencies?.['@modern-js/plugin-tanstack'] === expectedModernPackageSpecifier('@modern-js/plugin-tanstack'), 'Shell plugin-tanstack dependency must match package source metadata');
 assert(shellPackage.dependencies?.['@modern-js/runtime'] === expectedModernPackageSpecifier('@modern-js/runtime'), 'Shell runtime dependency must match package source metadata');
+assert(shellPackage.scripts?.['cloudflare:deploy'] === 'ULTRAMODERN_CLOUDFLARE_REQUIRE_PUBLIC_URLS=true pnpm run cloudflare:build && wrangler deploy --config .output/wrangler.json', 'Shell must expose cloudflare:deploy');
+assertBuildCacheBase('shell-super-app', shellModernConfig);
+assertCloudflareBuildSkipsDeployRebuild('shell-super-app', shellPackage);
 const shellContract = generatedContract.apps?.find(app => app.id === 'shell-super-app');
 assert(shellContract?.deploy?.cloudflare?.workerName === expectedWorkerName('shell-super-app'), 'Shell Cloudflare workerName is incorrect');
 assert(shellContract?.deploy?.cloudflare?.publicUrlEnv === 'ULTRAMODERN_PUBLIC_URL_SHELL_SUPER_APP', 'Shell Cloudflare public URL env is incorrect');
@@ -1847,6 +1866,8 @@ for (const vertical of fullStackVerticals) {
   assert(routeMetadata.includes("authoring: 'colocated-route-meta'"), `${vertical.id} route metadata manifest must advertise colocated authoring`);
   assert(packageJson.name === vertical.packageName, `${vertical.id} package name is incorrect`);
   assert(packageJson.scripts?.['cloudflare:deploy'] === 'ULTRAMODERN_CLOUDFLARE_REQUIRE_PUBLIC_URLS=true pnpm run cloudflare:build && wrangler deploy --config .output/wrangler.json', `${vertical.id} must expose cloudflare:deploy`);
+  assertBuildCacheBase(vertical.id, modernConfig);
+  assertCloudflareBuildSkipsDeployRebuild(vertical.id, packageJson);
   assert(packageJson.scripts?.['cloudflare:proof']?.includes(`--app ${vertical.id}`), `${vertical.id} must expose cloudflare:proof`);
   assert(packageJson.devDependencies?.['@modern-js/app-tools'] === expectedModernPackageSpecifier('@modern-js/app-tools'), `${vertical.id} app-tools dependency must match package source metadata`);
   assert(packageJson.dependencies?.['@modern-js/plugin-bff'] === expectedModernPackageSpecifier('@modern-js/plugin-bff'), `${vertical.id} plugin-bff dependency must match package source metadata`);