@bleedingdev/modern-js-create 3.5.0-ultramodern.15 → 3.5.0-ultramodern.16

package/README.md

@@ -380,19 +380,21 @@ updating workspaces.
 | `ULTRAMODERN_ASSET_PREFIX` | UltraModern asset prefix fallback | Modern/Rspack-emitted asset URLs when `MODERN_ASSET_PREFIX` is unset |
 | `ULTRAMODERN_PUBLIC_URL_<APP_ID>` | Per-app deployment/proof URL | Cloudflare proof inputs and Module Federation remote URLs |
 
-Asset URLs use this precedence: `MODERN_ASSET_PREFIX` →
-`ULTRAMODERN_ASSET_PREFIX` → origin-relative `/`. `MODERN_PUBLIC_SITE_URL` is
-canonical/SEO-only and must not be used as an asset-prefix fallback.
+Shell asset URLs use this precedence: `MODERN_ASSET_PREFIX` →
+`ULTRAMODERN_ASSET_PREFIX` → origin-relative `/`. Module Federation remotes use
+the same env precedence, then fall back to their per-app public origin:
+configured public URL, inferred workers.dev URL, or local dev port.
+`MODERN_PUBLIC_SITE_URL` is canonical/SEO-only and must not be used as an
+asset-prefix fallback.
 SEO output uses `MODERN_PUBLIC_SITE_URL`; if it is unset, generated local and
 preview outputs remain non-public until deployment proof provides explicit
 public URLs.
 
-Without public URLs configured, asset paths are origin-relative (`/`), and the
-dev server uses `dev.assetPrefix: '/'` — so apps work through tunnels and
-reverse proxies (ngrok, cloudflared) without triggering Chrome's Local Network
-Access prompt or mixed-content errors. Shell-only workspaces can set
-`MODERN_PUBLIC_SITE_URL` for SEO output without changing where assets load
-from.
+Without public URLs configured, shell asset paths are origin-relative (`/`).
+Remote dev manifests publish their own local origin so host shells load
+`remoteEntry.js` and exposed chunks from the remote dev server. Shell-only
+workspaces can set `MODERN_PUBLIC_SITE_URL` for SEO output without changing
+where assets load from.
 
 ## Cloudflare And Zephyr Proof
 

package/dist/cjs/ultramodern-workspace/module-federation.cjs

@@ -76,6 +76,11 @@ function createAppModernConfig(scope, app) {
   (cloudflareDeployEnabled ? '/' : \`http://localhost:\${port}\`);
 const defaultRemoteAssetPrefix = \`\${remoteAssetOrigin.replace(/\\/+$/u, '')}/\`;
 const defaultAssetPrefix = defaultRemoteAssetPrefix;`;
+    const devAssetPrefixSource = 'shell' === app.kind ? `        // Keep shell dev assets origin-relative so the shell works through
+        // tunnels and local previews without rewriting its own chunks.
+        assetPrefix: '/',` : `        // Remote dev manifests must publish an absolute publicPath so host
+        // shells load remoteEntry.js and exposed chunks from this dev server.
+        assetPrefix,`;
     return `// @effect-diagnostics processEnv:off
 import {
   appTools,
@@ -177,9 +182,7 @@ ${bffConfig}      ...(cloudflareDeployEnabled
           }
         : {}),
       dev: {
-        // Keep dev assets origin-relative too; the default absolute
-        // http://localhost:<port> prefix breaks pages served through tunnels.
-        assetPrefix: '/',
+${devAssetPrefixSource}
       },
       html: {
         outputStructure: 'flat',

package/dist/esm/ultramodern-workspace/module-federation.js

@@ -25,6 +25,11 @@ function createAppModernConfig(scope, app) {
   (cloudflareDeployEnabled ? '/' : \`http://localhost:\${port}\`);
 const defaultRemoteAssetPrefix = \`\${remoteAssetOrigin.replace(/\\/+$/u, '')}/\`;
 const defaultAssetPrefix = defaultRemoteAssetPrefix;`;
+    const devAssetPrefixSource = 'shell' === app.kind ? `        // Keep shell dev assets origin-relative so the shell works through
+        // tunnels and local previews without rewriting its own chunks.
+        assetPrefix: '/',` : `        // Remote dev manifests must publish an absolute publicPath so host
+        // shells load remoteEntry.js and exposed chunks from this dev server.
+        assetPrefix,`;
     return `// @effect-diagnostics processEnv:off
 import {
   appTools,
@@ -126,9 +131,7 @@ ${bffConfig}      ...(cloudflareDeployEnabled
           }
         : {}),
       dev: {
-        // Keep dev assets origin-relative too; the default absolute
-        // http://localhost:<port> prefix breaks pages served through tunnels.
-        assetPrefix: '/',
+${devAssetPrefixSource}
       },
       html: {
         outputStructure: 'flat',

package/dist/esm-node/ultramodern-workspace/module-federation.js

@@ -26,6 +26,11 @@ function createAppModernConfig(scope, app) {
   (cloudflareDeployEnabled ? '/' : \`http://localhost:\${port}\`);
 const defaultRemoteAssetPrefix = \`\${remoteAssetOrigin.replace(/\\/+$/u, '')}/\`;
 const defaultAssetPrefix = defaultRemoteAssetPrefix;`;
+    const devAssetPrefixSource = 'shell' === app.kind ? `        // Keep shell dev assets origin-relative so the shell works through
+        // tunnels and local previews without rewriting its own chunks.
+        assetPrefix: '/',` : `        // Remote dev manifests must publish an absolute publicPath so host
+        // shells load remoteEntry.js and exposed chunks from this dev server.
+        assetPrefix,`;
     return `// @effect-diagnostics processEnv:off
 import {
   appTools,
@@ -127,9 +132,7 @@ ${bffConfig}      ...(cloudflareDeployEnabled
           }
         : {}),
       dev: {
-        // Keep dev assets origin-relative too; the default absolute
-        // http://localhost:<port> prefix breaks pages served through tunnels.
-        assetPrefix: '/',
+${devAssetPrefixSource}
       },
       html: {
         outputStructure: 'flat',

package/package.json

@@ -21,7 +21,7 @@
   "engines": {
     "node": ">=20"
   },
-  "version": "3.5.0-ultramodern.15",
+  "version": "3.5.0-ultramodern.16",
   "types": "./dist/types/index.d.ts",
   "main": "./dist/esm-node/index.js",
   "bin": {
@@ -77,7 +77,7 @@
     "@modern-js/codesmith": "2.6.9",
     "oxfmt": "0.56.0",
     "ultracite": "7.8.3",
-    "@modern-js/i18n-utils": "npm:@bleedingdev/modern-js-i18n-utils@3.5.0-ultramodern.15"
+    "@modern-js/i18n-utils": "npm:@bleedingdev/modern-js-i18n-utils@3.5.0-ultramodern.16"
   },
   "devDependencies": {
     "@rslib/core": "0.23.1",
@@ -99,6 +99,6 @@
     "test": "rm -rf dist && rslib build -c rslibconfig.mts && rstest --passWithNoTests"
   },
   "ultramodern": {
-    "frameworkVersion": "3.5.0-ultramodern.15"
+    "frameworkVersion": "3.5.0-ultramodern.16"
   }
 }

package/template-workspace/README.md.handlebars

@@ -117,19 +117,21 @@ regenerating or updating the workspace.
 | `ULTRAMODERN_ASSET_PREFIX` | UltraModern compatibility asset prefix | Modern/Rspack-emitted asset URLs when `MODERN_ASSET_PREFIX` is unset |
 | `ULTRAMODERN_PUBLIC_URL_<APP_ID>` | Per-app deployment/proof URL | Cloudflare proof inputs and Module Federation remote URLs |
 
-Asset URLs use this precedence: `MODERN_ASSET_PREFIX` →
-`ULTRAMODERN_ASSET_PREFIX` → origin-relative `/`. `MODERN_PUBLIC_SITE_URL` is
-canonical/SEO-only and must not be used as an asset-prefix fallback.
+Shell asset URLs use this precedence: `MODERN_ASSET_PREFIX` →
+`ULTRAMODERN_ASSET_PREFIX` → origin-relative `/`. Module Federation remotes use
+the same env precedence, then fall back to their per-app public origin:
+configured public URL, inferred workers.dev URL, or local dev port.
+`MODERN_PUBLIC_SITE_URL` is canonical/SEO-only and must not be used as an
+asset-prefix fallback.
 SEO output uses `MODERN_PUBLIC_SITE_URL`; if it is unset, generated local and
 preview outputs remain non-public until deployment proof provides explicit
 public URLs.
 
-Without public URLs configured, asset paths are origin-relative (`/`), and the
-dev server uses `dev.assetPrefix: '/'` — so apps work through tunnels and
-reverse proxies (ngrok, cloudflared) without triggering Chrome's Local Network
-Access prompt or mixed-content errors. Shell-only workspaces can set
-`MODERN_PUBLIC_SITE_URL` for SEO output without changing where assets load
-from.
+Without public URLs configured, shell asset paths are origin-relative (`/`).
+Remote dev manifests publish their own local origin so host shells load
+`remoteEntry.js` and exposed chunks from the remote dev server. Shell-only
+workspaces can set `MODERN_PUBLIC_SITE_URL` for SEO output without changing
+where assets load from.
 
 ## Cloudflare Proof
 

package/templates/workspace-scripts/validate-ultramodern-workspace.mjs.handlebars

@@ -486,7 +486,7 @@ const createAppConfigContract = app => ({
     'zephyrRspackPlugin',
   ],
   dev: {
-    assetPrefix: '/',
+    assetPrefix: app.kind === 'shell' ? '/' : 'app-public-origin',
   },
   output: {
     assetPrefix: {
@@ -1967,9 +1967,9 @@ for (const vertical of fullStackVerticals) {
   assert(!verticalAssetPrefixExpression.includes('configuredSiteUrl') && !verticalAssetPrefixExpression.includes('MODERN_PUBLIC_SITE_URL'), `${vertical.id} asset prefix must not fall back to MODERN_PUBLIC_SITE_URL`);
   assert(modernConfig.includes(`envValue('ULTRAMODERN_PUBLIC_URL_${vertical.id.replace(/-/g, '_').toUpperCase()}')`), `${vertical.id} asset prefix must read its per-app public URL`);
   assert(modernConfig.includes('inferredCloudflareUrl'), `${vertical.id} asset prefix must support workers.dev origin inference`);
-  assert(modernConfig.includes("assetPrefix: '/'"), `${vertical.id} modern.config.ts must keep dev assets origin-relative`);
+  assert(/dev:\s*\{\s*\/\/ Remote dev manifests must publish an absolute publicPath[\s\S]*?assetPrefix,\s*\}/u.test(modernConfig), `${vertical.id} modern.config.ts must publish dev assets from its own remote origin`);
   assert(modernConfig.includes('assetPrefix,'), `${vertical.id} modern.config.ts must wire output.assetPrefix to the derived asset prefix`);
-  assert(contractEntry?.config?.dev?.assetPrefix === '/', `${vertical.id} dev asset prefix must stay origin-relative`);
+  assert(contractEntry?.config?.dev?.assetPrefix === 'app-public-origin', `${vertical.id} dev asset prefix must default to its app public origin`);
   assert(contractEntry?.config?.output?.assetPrefix?.default === 'app-public-origin', `${vertical.id} asset prefix must default to its app public origin`);
   assert(JSON.stringify(contractEntry?.config?.output?.assetPrefix?.envFallbackOrder) === JSON.stringify(['MODERN_ASSET_PREFIX', 'ULTRAMODERN_ASSET_PREFIX']), `${vertical.id} asset prefix env fallback order is incorrect`);
   assert(contractEntry?.config?.output?.disableTsChecker === false, `${vertical.id} must keep the framework TypeScript checker enabled`);