@bleedingdev/modern-js-create 3.5.0-ultramodern.2 → 3.5.0-ultramodern.20

package/package.json

@@ -21,7 +21,7 @@
   "engines": {
     "node": ">=20"
   },
-  "version": "3.5.0-ultramodern.2",
+  "version": "3.5.0-ultramodern.20",
   "types": "./dist/types/index.d.ts",
   "main": "./dist/esm-node/index.js",
   "bin": {
@@ -77,7 +77,7 @@
     "@modern-js/codesmith": "2.6.9",
     "oxfmt": "0.56.0",
     "ultracite": "7.8.3",
-    "@modern-js/i18n-utils": "npm:@bleedingdev/modern-js-i18n-utils@3.5.0-ultramodern.2"
+    "@modern-js/i18n-utils": "npm:@bleedingdev/modern-js-i18n-utils@3.5.0-ultramodern.20"
   },
   "devDependencies": {
     "@rslib/core": "0.23.1",
@@ -99,6 +99,6 @@
     "test": "rm -rf dist && rslib build -c rslibconfig.mts && rstest --passWithNoTests"
   },
   "ultramodern": {
-    "frameworkVersion": "3.5.0-ultramodern.2"
+    "frameworkVersion": "3.5.0-ultramodern.20"
   }
 }

package/template-workspace/.gitignore.handlebars

@@ -1,8 +1,11 @@
 node_modules/
 dist/
+dist-cloudflare/
 build/
 .modernjs/cache/
 .modern-js/
 **/.modern-js/
+.mf/
+**/.mf/
 .modernjs/agent-reference-repos-tmp/
 .codex/reports/

package/template-workspace/README.md.handlebars

@@ -117,19 +117,21 @@ regenerating or updating the workspace.
 | `ULTRAMODERN_ASSET_PREFIX` | UltraModern compatibility asset prefix | Modern/Rspack-emitted asset URLs when `MODERN_ASSET_PREFIX` is unset |
 | `ULTRAMODERN_PUBLIC_URL_<APP_ID>` | Per-app deployment/proof URL | Cloudflare proof inputs and Module Federation remote URLs |
 
-Asset URLs use this precedence: `MODERN_ASSET_PREFIX` →
-`ULTRAMODERN_ASSET_PREFIX` → origin-relative `/`. `MODERN_PUBLIC_SITE_URL` is
-canonical/SEO-only and must not be used as an asset-prefix fallback.
+Shell asset URLs use this precedence: `MODERN_ASSET_PREFIX` →
+`ULTRAMODERN_ASSET_PREFIX` → origin-relative `/`. Module Federation remotes use
+the same env precedence, then fall back to their per-app public origin:
+configured public URL, inferred workers.dev URL, or local dev port.
+`MODERN_PUBLIC_SITE_URL` is canonical/SEO-only and must not be used as an
+asset-prefix fallback.
 SEO output uses `MODERN_PUBLIC_SITE_URL`; if it is unset, generated local and
 preview outputs remain non-public until deployment proof provides explicit
 public URLs.
 
-Without public URLs configured, asset paths are origin-relative (`/`), and the
-dev server uses `dev.assetPrefix: '/'` — so apps work through tunnels and
-reverse proxies (ngrok, cloudflared) without triggering Chrome's Local Network
-Access prompt or mixed-content errors. Shell-only workspaces can set
-`MODERN_PUBLIC_SITE_URL` for SEO output without changing where assets load
-from.
+Without public URLs configured, shell asset paths are origin-relative (`/`).
+Remote dev manifests publish their own local origin so host shells load
+`remoteEntry.js` and exposed chunks from the remote dev server. Shell-only
+workspaces can set `MODERN_PUBLIC_SITE_URL` for SEO output without changing
+where assets load from.
 
 ## Cloudflare Proof
 
@@ -169,19 +171,23 @@ in API modules.
 Generated pnpm overrides pin the framework-compatible Effect cohort. Keep
 `effect` and `@effect/vitest` aligned with `pnpm-workspace.yaml`; do not add
 new direct package-level Effect versions unless the whole UltraModern cohort is
-upgraded.
+upgraded. The generated pnpm policy intentionally excludes the matching
+`effect` and `@effect/opentelemetry` cohort versions from the
+minimum-release-age and no-downgrade checks while Effect's beta publishes move
+from trusted-publisher metadata to provenance attestations.
 
 For older generated workspaces, run the framework migration command first:
 
 ```bash
-pnpm dlx @bleedingdev/modern-js-create@3.5.0-ultramodern.2 ultramodern \
-  migrate-strict-effect --version 3.5.0-ultramodern.2
+pnpm dlx @bleedingdev/modern-js-create@3.5.0-ultramodern.10 ultramodern \
+  migrate-strict-effect --version 3.5.0-ultramodern.10
 pnpm api:check
 pnpm contract:check
 ```
 
 The command updates generated package-source metadata, Modern package aliases,
-direct API topology metadata, and the lockfile. Remaining failures are source
+framework-owned toolchain pins, direct API topology metadata, strict Effect pnpm
+overrides/trust policy, and the lockfile. Remaining failures are source
 migration work; fix the owning API files instead of adding compatibility shims.
 
 ## Troubleshooting

package/template-workspace/patches/@module-federation__bridge-react@2.6.0.patch

@@ -0,0 +1,140 @@
+diff --git a/dist/lazy-load-component-plugin-BYI941I2.mjs b/dist/lazy-load-component-plugin-BYI941I2.mjs
+index dfba15be1e9753e0f164b53cfb22feda13f39ea4..6be1b47903b9f6807bb0111df6c588f0d54ebf53 100644
+--- a/dist/lazy-load-component-plugin-BYI941I2.mjs
++++ b/dist/lazy-load-component-plugin-BYI941I2.mjs
+@@ -235,6 +235,41 @@ function getTargetModuleInfo(id, instance) {
+     remoteEntry
+   };
+ }
++function normalizeHref(href) {
++  if (typeof document === "undefined") {
++    return href;
++  }
++  try {
++    return new URL(href, document.baseURI).href;
++  } catch {
++    return href;
++  }
++}
++function isStylesheetLink(link) {
++  return link.relList.contains("stylesheet") || link.rel.toLowerCase().split(/\s+/u).includes("stylesheet");
++}
++function hasStylesheetLinkInHead(href, ignoredLink) {
++  if (typeof document === "undefined" || !document.head) {
++    return false;
++  }
++  const normalizedHref = normalizeHref(href);
++  return Array.from(
++    document.head.querySelectorAll("link[href]")
++  ).some(
++    (link) => link !== ignoredLink && isStylesheetLink(link) && normalizeHref(link.href) === normalizedHref
++  );
++}
++function StylesheetAsset({ href }) {
++  const [shouldRender, setShouldRender] = useState(true);
++  const linkRef = useRef(null);
++  useEffect(() => {
++    setShouldRender(!hasStylesheetLinkInHead(href, linkRef.current));
++  }, [href]);
++  if (!shouldRender) {
++    return null;
++  }
++  return /* @__PURE__ */ React__default.createElement("link", { ref: linkRef, href, rel: "stylesheet", type: "text/css" });
++}
+ function collectSSRAssets(options) {
+   const {
+     id,
+@@ -253,15 +288,19 @@ function collectSSRAssets(options) {
+   }
+   const { module: targetModule, publicPath, remoteEntry } = moduleAndPublicPath;
+   if (injectLink) {
++    const stylesheetHrefs = /* @__PURE__ */ new Set();
+     [...targetModule.assets.css.sync, ...targetModule.assets.css.async].sort().forEach((file, index) => {
++      const href = `${publicPath}${file}`;
++      if (stylesheetHrefs.has(href)) {
++        return;
++      }
++      stylesheetHrefs.add(href);
+       links.push(
+         /* @__PURE__ */ React__default.createElement(
+-          "link",
++          StylesheetAsset,
+           {
+             key: `${file.split(".")[0]}_${index}`,
+-            href: `${publicPath}${file}`,
+-            rel: "stylesheet",
+-            type: "text/css"
++            href
+           }
+         )
+       );
+diff --git a/dist/lazy-load-component-plugin-DG4e3Tib.js b/dist/lazy-load-component-plugin-DG4e3Tib.js
+index 321c9c3cd55bf9d62a6825c9186267dfe28e5e93..867e7237d5a2ea613130c7e1710cdd998924d9db 100644
+--- a/dist/lazy-load-component-plugin-DG4e3Tib.js
++++ b/dist/lazy-load-component-plugin-DG4e3Tib.js
+@@ -236,6 +236,41 @@ function getTargetModuleInfo(id, instance) {
+     remoteEntry
+   };
+ }
++function normalizeHref(href) {
++  if (typeof document === "undefined") {
++    return href;
++  }
++  try {
++    return new URL(href, document.baseURI).href;
++  } catch {
++    return href;
++  }
++}
++function isStylesheetLink(link) {
++  return link.relList.contains("stylesheet") || link.rel.toLowerCase().split(/\s+/u).includes("stylesheet");
++}
++function hasStylesheetLinkInHead(href, ignoredLink) {
++  if (typeof document === "undefined" || !document.head) {
++    return false;
++  }
++  const normalizedHref = normalizeHref(href);
++  return Array.from(
++    document.head.querySelectorAll("link[href]")
++  ).some(
++    (link) => link !== ignoredLink && isStylesheetLink(link) && normalizeHref(link.href) === normalizedHref
++  );
++}
++function StylesheetAsset({ href }) {
++  const [shouldRender, setShouldRender] = React.useState(true);
++  const linkRef = React.useRef(null);
++  React.useEffect(() => {
++    setShouldRender(!hasStylesheetLinkInHead(href, linkRef.current));
++  }, [href]);
++  if (!shouldRender) {
++    return null;
++  }
++  return /* @__PURE__ */ React.createElement("link", { ref: linkRef, href, rel: "stylesheet", type: "text/css" });
++}
+ function collectSSRAssets(options) {
+   const {
+     id,
+@@ -254,15 +289,19 @@ function collectSSRAssets(options) {
+   }
+   const { module: targetModule, publicPath, remoteEntry } = moduleAndPublicPath;
+   if (injectLink) {
++    const stylesheetHrefs = /* @__PURE__ */ new Set();
+     [...targetModule.assets.css.sync, ...targetModule.assets.css.async].sort().forEach((file, index) => {
++      const href = `${publicPath}${file}`;
++      if (stylesheetHrefs.has(href)) {
++        return;
++      }
++      stylesheetHrefs.add(href);
+       links.push(
+         /* @__PURE__ */ React.createElement(
+-          "link",
++          StylesheetAsset,
+           {
+             key: `${file.split(".")[0]}_${index}`,
+-            href: `${publicPath}${file}`,
+-            rel: "stylesheet",
+-            type: "text/css"
++            href
+           }
+         )
+       );

package/template-workspace/patches/@module-federation__modern-js-v3@2.6.0.patch

@@ -0,0 +1,57 @@
+diff --git a/dist/cjs/cli/configPlugin.js b/dist/cjs/cli/configPlugin.js
+index 0d01ad0..e5485a2 100644
+--- a/dist/cjs/cli/configPlugin.js
++++ b/dist/cjs/cli/configPlugin.js
+@@ -212,9 +212,12 @@ var __webpack_exports__ = {};
+         if (!chain.output.get('uniqueName')) chain.output.uniqueName(mfConfig.name);
+         const splitChunkConfig = chain.optimization.splitChunks.entries();
+         if (!isServer) (0, utils_namespaceObject.autoDeleteSplitChunkCacheGroups)(mfConfig, splitChunkConfig);
+-        if (!isServer && enableSSR && splitChunkConfig && 'object' == typeof splitChunkConfig && splitChunkConfig.cacheGroups) {
++        if (!isServer && enableSSR && splitChunkConfig && 'object' == typeof splitChunkConfig && splitChunkConfig.cacheGroups && splitChunkConfig.chunks !== undefined && splitChunkConfig.chunks !== 'async') {
++            const previousChunks = splitChunkConfig.chunks;
+             splitChunkConfig.chunks = 'async';
+-            external_logger_js_default().warn('splitChunks.chunks = async is not allowed with stream SSR mode, it will auto changed to "async"');
++            if (void 0 !== previousChunks) {
++                external_logger_js_default().warn(`splitChunks.chunks = ${previousChunks} is not allowed with stream SSR mode, it will auto changed to "async"`);
++            }
+         }
+         if ((0, external_utils_js_namespaceObject.isDev)() && 'auto' === chain.output.get('publicPath')) {
+             var _modernjsConfig_server;
+diff --git a/dist/esm/cli/configPlugin.mjs b/dist/esm/cli/configPlugin.mjs
+index 3e880c8..93e4290 100644
+--- a/dist/esm/cli/configPlugin.mjs
++++ b/dist/esm/cli/configPlugin.mjs
+@@ -194,9 +194,12 @@ function patchBundlerConfig(options) {
+     if (!chain.output.get('uniqueName')) chain.output.uniqueName(mfConfig.name);
+     var splitChunkConfig = chain.optimization.splitChunks.entries();
+     if (!isServer) autoDeleteSplitChunkCacheGroups(mfConfig, splitChunkConfig);
+-    if (!isServer && enableSSR && splitChunkConfig && (void 0 === splitChunkConfig ? "undefined" : _type_of__(splitChunkConfig)) === 'object' && splitChunkConfig.cacheGroups) {
++    if (!isServer && enableSSR && splitChunkConfig && (void 0 === splitChunkConfig ? "undefined" : _type_of__(splitChunkConfig)) === 'object' && splitChunkConfig.cacheGroups && void 0 !== splitChunkConfig.chunks && splitChunkConfig.chunks !== 'async') {
++        var previousChunks = splitChunkConfig.chunks;
+         splitChunkConfig.chunks = 'async';
+-        logger.warn('splitChunks.chunks = async is not allowed with stream SSR mode, it will auto changed to "async"');
++        if (void 0 !== previousChunks) {
++            logger.warn("splitChunks.chunks = ".concat(previousChunks, " is not allowed with stream SSR mode, it will auto changed to \"async\""));
++        }
+     }
+     if (isDev() && 'auto' === chain.output.get('publicPath')) {
+         var _modernjsConfig_server;
+diff --git a/dist/esm-node/cli/configPlugin.mjs b/dist/esm-node/cli/configPlugin.mjs
+index 722f1bb..dcac7ec 100644
+--- a/dist/esm-node/cli/configPlugin.mjs
++++ b/dist/esm-node/cli/configPlugin.mjs
+@@ -165,9 +165,12 @@ function patchBundlerConfig(options) {
+     if (!chain.output.get('uniqueName')) chain.output.uniqueName(mfConfig.name);
+     const splitChunkConfig = chain.optimization.splitChunks.entries();
+     if (!isServer) autoDeleteSplitChunkCacheGroups(mfConfig, splitChunkConfig);
+-    if (!isServer && enableSSR && splitChunkConfig && 'object' == typeof splitChunkConfig && splitChunkConfig.cacheGroups) {
++    if (!isServer && enableSSR && splitChunkConfig && 'object' == typeof splitChunkConfig && splitChunkConfig.cacheGroups && splitChunkConfig.chunks !== undefined && splitChunkConfig.chunks !== 'async') {
++        const previousChunks = splitChunkConfig.chunks;
+         splitChunkConfig.chunks = 'async';
+-        logger.warn('splitChunks.chunks = async is not allowed with stream SSR mode, it will auto changed to "async"');
++        if (void 0 !== previousChunks) {
++            logger.warn(`splitChunks.chunks = ${previousChunks} is not allowed with stream SSR mode, it will auto changed to "async"`);
++        }
+     }
+     if (isDev() && 'auto' === chain.output.get('publicPath')) {
+         var _modernjsConfig_server;