@bleedingdev/modern-js-create 3.5.0-ultramodern.2 → 3.5.0-ultramodern.21

package/README.md

@@ -193,8 +193,8 @@ For strict Effect API migrations, update generated package metadata and Modern
 package aliases through the framework command before hand-editing app code:
 
 ```bash
-pnpm dlx @bleedingdev/modern-js-create@3.5.0-ultramodern.2 ultramodern \
-  migrate-strict-effect --version 3.5.0-ultramodern.2
+pnpm dlx @bleedingdev/modern-js-create@3.5.0-ultramodern.10 ultramodern \
+  migrate-strict-effect --version 3.5.0-ultramodern.10
 pnpm api:check
 pnpm contract:check
 pnpm check
@@ -202,16 +202,21 @@ pnpm build
 ```
 
 The command updates `.modernjs/ultramodern.json`, root `modernjs.packageSource`,
-generated Modern package aliases, old direct topology metadata, and the pnpm
+generated Modern package aliases, framework-owned toolchain pins, old direct
+topology metadata, strict Effect pnpm overrides/trust policy, and the pnpm
 lockfile. It does not invent compatibility shims or move business code behind
 your back. If `pnpm api:check` still fails, migrate the source to
 `shared/api.ts`, `api/index.ts`, and `src/api/*-client.ts` and delete
 `api/effect`, `api/lambda`, `shared/effect`, and `src/effect` paths.
 
 Generated strict Effect workspaces pin the compatible Effect cohort through
-`pnpm-workspace.yaml` overrides: `effect@4.0.0-beta.91` and
-`@effect/vitest@4.0.0-beta.91`. Do not override those in app packages; update
-the framework cohort when the runtime moves.
+`pnpm-workspace.yaml` overrides: `effect@4.0.0-beta.92`,
+`@effect/opentelemetry@4.0.0-beta.92`, and
+`@effect/vitest@4.0.0-beta.92`. The generated pnpm policy also excludes the
+known `effect@4.0.0-beta.92` and `@effect/opentelemetry@4.0.0-beta.92`
+versions from the 24-hour minimum-release-age gate and their trusted-publisher
+to provenance transitions from no-downgrade checks. Do not override those in
+app packages; update the framework cohort when the runtime moves.
 
 Use `--ultramodern-package-source=install` for published cohort proof and pin a
 specific release with `--ultramodern-package-version` when CI must prove an
@@ -376,19 +381,21 @@ updating workspaces.
 | `ULTRAMODERN_ASSET_PREFIX` | UltraModern asset prefix fallback | Modern/Rspack-emitted asset URLs when `MODERN_ASSET_PREFIX` is unset |
 | `ULTRAMODERN_PUBLIC_URL_<APP_ID>` | Per-app deployment/proof URL | Cloudflare proof inputs and Module Federation remote URLs |
 
-Asset URLs use this precedence: `MODERN_ASSET_PREFIX` →
-`ULTRAMODERN_ASSET_PREFIX` → origin-relative `/`. `MODERN_PUBLIC_SITE_URL` is
-canonical/SEO-only and must not be used as an asset-prefix fallback.
+Shell asset URLs use this precedence: `MODERN_ASSET_PREFIX` →
+`ULTRAMODERN_ASSET_PREFIX` → origin-relative `/`. Module Federation remotes use
+the same env precedence, then fall back to their per-app public origin:
+configured public URL, inferred workers.dev URL, or local dev port.
+`MODERN_PUBLIC_SITE_URL` is canonical/SEO-only and must not be used as an
+asset-prefix fallback.
 SEO output uses `MODERN_PUBLIC_SITE_URL`; if it is unset, generated local and
 preview outputs remain non-public until deployment proof provides explicit
 public URLs.
 
-Without public URLs configured, asset paths are origin-relative (`/`), and the
-dev server uses `dev.assetPrefix: '/'` — so apps work through tunnels and
-reverse proxies (ngrok, cloudflared) without triggering Chrome's Local Network
-Access prompt or mixed-content errors. Shell-only workspaces can set
-`MODERN_PUBLIC_SITE_URL` for SEO output without changing where assets load
-from.
+Without public URLs configured, shell asset paths are origin-relative (`/`).
+Remote dev manifests publish their own local origin so host shells load
+`remoteEntry.js` and exposed chunks from the remote dev server. Shell-only
+workspaces can set `MODERN_PUBLIC_SITE_URL` for SEO output without changing
+where assets load from.
 
 ## Cloudflare And Zephyr Proof
 

package/dist/cjs/ultramodern-tooling/commands.cjs

@@ -52,7 +52,11 @@ var external_node_path_default = /*#__PURE__*/ __webpack_require__.n(external_no
 const external_node_url_namespaceObject = require("node:url");
 const external_create_package_root_cjs_namespaceObject = require("../create-package-root.cjs");
 const external_ultramodern_package_source_cjs_namespaceObject = require("../ultramodern-package-source.cjs");
+const app_files_cjs_namespaceObject = require("../ultramodern-workspace/app-files.cjs");
 const mf_validation_cjs_namespaceObject = require("../ultramodern-workspace/mf-validation.cjs");
+const module_federation_cjs_namespaceObject = require("../ultramodern-workspace/module-federation.cjs");
+const package_json_cjs_namespaceObject = require("../ultramodern-workspace/package-json.cjs");
+const versions_cjs_namespaceObject = require("../ultramodern-workspace/versions.cjs");
 const workspace_scripts_cjs_namespaceObject = require("../ultramodern-workspace/workspace-scripts.cjs");
 const external_config_cjs_namespaceObject = require("./config.cjs");
 const commands_dirname = external_node_path_default().dirname((0, external_node_url_namespaceObject.fileURLToPath)(__rslib_import_meta_url__));
@@ -198,6 +202,91 @@ function updateModernDependencies(packageJson, packageSource) {
     }
     return changed;
 }
+const generatedToolingDependencyPins = new Map([
+    [
+        '@effect/tsgo',
+        versions_cjs_namespaceObject.EFFECT_TSGO_VERSION
+    ],
+    [
+        "@typescript/native-preview",
+        versions_cjs_namespaceObject.TYPESCRIPT_NATIVE_PREVIEW_VERSION
+    ],
+    [
+        'oxfmt',
+        versions_cjs_namespaceObject.OXFMT_VERSION
+    ],
+    [
+        'oxlint',
+        versions_cjs_namespaceObject.OXLINT_VERSION
+    ],
+    [
+        'wrangler',
+        versions_cjs_namespaceObject.WRANGLER_VERSION
+    ],
+    [
+        'zephyr-agent',
+        versions_cjs_namespaceObject.ZEPHYR_AGENT_VERSION
+    ],
+    [
+        'zephyr-rspack-plugin',
+        versions_cjs_namespaceObject.ZEPHYR_RSPACK_PLUGIN_VERSION
+    ]
+]);
+const strictEffectPackageVersionPolicyExclusions = [
+    `effect@${versions_cjs_namespaceObject.EFFECT_VERSION}`,
+    `@effect/opentelemetry@${versions_cjs_namespaceObject.EFFECT_VERSION}`
+];
+const moduleFederationModernJsPatchPath = `patches/@module-federation__modern-js-v3@${versions_cjs_namespaceObject.MODULE_FEDERATION_VERSION}.patch`;
+const moduleFederationModernJsPatchSourcePath = external_node_path_default().join(createPackageRoot, 'template-workspace', moduleFederationModernJsPatchPath);
+const moduleFederationBridgeReactPatchPath = `patches/@module-federation__bridge-react@${versions_cjs_namespaceObject.MODULE_FEDERATION_VERSION}.patch`;
+const moduleFederationBridgeReactPatchSourcePath = external_node_path_default().join(createPackageRoot, 'template-workspace', moduleFederationBridgeReactPatchPath);
+const effectDeclarationPatchPath = 'patches/effect-schema-error-type-id.patch';
+const effectDeclarationPatchSourcePath = external_node_path_default().join(createPackageRoot, 'template-workspace', effectDeclarationPatchPath);
+const drizzleOrmDeclarationPatchPath = 'patches/drizzle-orm-ts7-strict-declarations.patch';
+const drizzleOrmDeclarationPatchSourcePath = external_node_path_default().join(createPackageRoot, 'template-workspace', drizzleOrmDeclarationPatchPath);
+function updateGeneratedToolingDependencies(packageJson) {
+    let changed = false;
+    for (const section of [
+        'dependencies',
+        'devDependencies',
+        'peerDependencies',
+        'optionalDependencies'
+    ]){
+        const dependencies = packageJson[section];
+        if (!(!dependencies || 'object' != typeof dependencies || Array.isArray(dependencies))) {
+            for (const [packageName, version] of generatedToolingDependencyPins)if (Object.prototype.hasOwnProperty.call(dependencies, packageName) && dependencies[packageName] !== version) {
+                dependencies[packageName] = version;
+                changed = true;
+            }
+        }
+    }
+    return changed;
+}
+const cloudflareModernDeployCommand = 'ULTRAMODERN_ZEPHYR=false MODERNJS_DEPLOY=cloudflare modern deploy';
+const cloudflareModernDeploySkipBuildCommand = `${cloudflareModernDeployCommand} --skip-build`;
+const cloudflareWranglerDeployCommand = 'wrangler deploy --config .output/wrangler.json';
+const cloudflareWranglerDeployInvalidSkipBuildCommand = `${cloudflareWranglerDeployCommand} --skip-build`;
+function updateGeneratedPackageScripts(packageJson) {
+    const scripts = packageJson.scripts;
+    if (!scripts || 'object' != typeof scripts || Array.isArray(scripts)) return false;
+    let changed = false;
+    const cloudflareBuild = scripts['cloudflare:build'];
+    if ('string' == typeof cloudflareBuild) {
+        let nextCloudflareBuild = cloudflareBuild;
+        if (nextCloudflareBuild.includes(cloudflareModernDeployCommand) && !nextCloudflareBuild.includes(cloudflareModernDeploySkipBuildCommand)) nextCloudflareBuild = nextCloudflareBuild.replace(cloudflareModernDeployCommand, cloudflareModernDeploySkipBuildCommand);
+        nextCloudflareBuild = nextCloudflareBuild.replace(/ && node \S*scripts\/generate-public-surface-assets\.m[ct]s --app [^&]+ --target dist(?= && ULTRAMODERN_ZEPHYR=false MODERNJS_DEPLOY=cloudflare modern deploy --skip-build)/u, '');
+        if (nextCloudflareBuild !== cloudflareBuild) {
+            scripts['cloudflare:build'] = nextCloudflareBuild;
+            changed = true;
+        }
+    }
+    const cloudflareDeploy = scripts['cloudflare:deploy'];
+    if ('string' == typeof cloudflareDeploy && cloudflareDeploy.includes(cloudflareWranglerDeployInvalidSkipBuildCommand)) {
+        scripts['cloudflare:deploy'] = cloudflareDeploy.replace(cloudflareWranglerDeployInvalidSkipBuildCommand, cloudflareWranglerDeployCommand);
+        changed = true;
+    }
+    return changed;
+}
 function normalizeStrictEffectApiMetadata(value) {
     const api = value.api;
     if (!api || 'object' != typeof api || Array.isArray(api)) return false;
@@ -263,6 +352,236 @@ function normalizeStrictEffectApiMetadata(value) {
     }
     return changed;
 }
+function replaceYamlLine(source, pattern, replacement) {
+    const updated = source.replace(pattern, replacement);
+    return {
+        source: updated,
+        changed: updated !== source
+    };
+}
+function ensureYamlListItem(source, key, item) {
+    const itemLine = `  - '${item}'`;
+    const headerPattern = new RegExp(`^${key}:\\n(?:(?:  - .+\\n)*)`, 'mu');
+    const header = source.match(headerPattern);
+    if (header) {
+        if (header[0].split('\n').includes(itemLine)) return {
+            source,
+            changed: false
+        };
+        return {
+            source: source.replace(headerPattern, `${header[0]}${itemLine}\n`),
+            changed: true
+        };
+    }
+    const block = `${key}:\n${itemLine}\n`;
+    const afterTrustPolicyIgnore = source.replace(/^(trustPolicyIgnoreAfter: .+\n)/mu, `$1${block}`);
+    if (afterTrustPolicyIgnore !== source) return {
+        source: afterTrustPolicyIgnore,
+        changed: true
+    };
+    return {
+        source: `${source.trimEnd()}\n${block}`,
+        changed: true
+    };
+}
+function ensureYamlMapEntry(source, key, entryKey, value) {
+    const entryLine = `  '${entryKey}': ${value}`;
+    const packageName = entryKey.includes('@') ? entryKey.slice(0, entryKey.lastIndexOf('@')) : entryKey;
+    const escapedPackageName = packageName.replace(/[.*+?^${}()|[\]\\]/gu, '\\$&');
+    const currentEntryPattern = new RegExp(`^ {2}'${escapedPackageName}@[^']+': .+$`, 'mu');
+    const currentEntry = source.match(currentEntryPattern);
+    if (currentEntry) {
+        if (currentEntry[0] === entryLine) return {
+            source,
+            changed: false
+        };
+        return {
+            source: source.replace(currentEntryPattern, entryLine),
+            changed: true
+        };
+    }
+    const headerPattern = new RegExp(`^${key}:\\n(?:(?:  .+\\n)*)`, 'mu');
+    const header = source.match(headerPattern);
+    if (header) {
+        if (header[0].split('\n').includes(entryLine)) return {
+            source,
+            changed: false
+        };
+        return {
+            source: source.replace(headerPattern, `${header[0]}${entryLine}\n`),
+            changed: true
+        };
+    }
+    return {
+        source: `${source.trimEnd()}\n${key}:\n${entryLine}\n`,
+        changed: true
+    };
+}
+function ensureYamlScalarMapEntry(source, key, entryKey, value) {
+    const entryLine = `  ${entryKey}: ${value}`;
+    const escapedEntryKey = entryKey.replace(/[.*+?^${}()|[\]\\]/gu, '\\$&');
+    const currentEntryPattern = new RegExp(`^ {2}${escapedEntryKey}: .+$`, 'mu');
+    const currentEntry = source.match(currentEntryPattern);
+    if (currentEntry) {
+        if (currentEntry[0] === entryLine) return {
+            source,
+            changed: false
+        };
+        return {
+            source: source.replace(currentEntryPattern, entryLine),
+            changed: true
+        };
+    }
+    const headerPattern = new RegExp(`^${key}:\\n(?:(?:  .+\\n)*)`, 'mu');
+    const header = source.match(headerPattern);
+    if (header) return {
+        source: source.replace(headerPattern, `${header[0]}${entryLine}\n`),
+        changed: true
+    };
+    return {
+        source: `${source.trimEnd()}\n${key}:\n${entryLine}\n`,
+        changed: true
+    };
+}
+function removeYamlMapEntry(source, entryKey) {
+    const packageName = entryKey.includes('@') ? entryKey.slice(0, entryKey.lastIndexOf('@')) : entryKey;
+    const escapedPackageName = packageName.replace(/[.*+?^${}()|[\]\\]/gu, '\\$&');
+    const currentEntryPattern = new RegExp(`^ {2}'${escapedPackageName}@[^']+': .+\\n?`, 'mu');
+    if (!currentEntryPattern.test(source)) return {
+        source,
+        changed: false
+    };
+    return {
+        source: source.replace(currentEntryPattern, ''),
+        changed: true
+    };
+}
+function ensureGeneratedPatchFile(workspaceRoot, relativePatchPath, sourcePatchPath) {
+    const targetPath = external_node_path_default().join(workspaceRoot, relativePatchPath);
+    const patch = external_node_fs_default().readFileSync(sourcePatchPath, 'utf-8');
+    if (external_node_fs_default().existsSync(targetPath) && external_node_fs_default().readFileSync(targetPath, 'utf-8') === patch) return false;
+    external_node_fs_default().mkdirSync(external_node_path_default().dirname(targetPath), {
+        recursive: true
+    });
+    external_node_fs_default().writeFileSync(targetPath, patch, 'utf-8');
+    return true;
+}
+function removeGeneratedPatchFileIfUnchanged(workspaceRoot, relativePatchPath, sourcePatchPath) {
+    const targetPath = external_node_path_default().join(workspaceRoot, relativePatchPath);
+    if (!external_node_fs_default().existsSync(targetPath)) return false;
+    const patch = external_node_fs_default().readFileSync(sourcePatchPath, 'utf-8');
+    if (external_node_fs_default().readFileSync(targetPath, 'utf-8') !== patch) return false;
+    external_node_fs_default().rmSync(targetPath);
+    return true;
+}
+function workspaceUsesDependency(workspaceRoot, packageName) {
+    const packageJsonPaths = [
+        external_node_path_default().join(workspaceRoot, 'package.json')
+    ];
+    for (const workspaceDir of [
+        'apps',
+        'verticals',
+        'packages'
+    ]){
+        const absoluteWorkspaceDir = external_node_path_default().join(workspaceRoot, workspaceDir);
+        if (external_node_fs_default().existsSync(absoluteWorkspaceDir)) for (const entry of external_node_fs_default().readdirSync(absoluteWorkspaceDir, {
+            withFileTypes: true
+        })){
+            if (!entry.isDirectory()) continue;
+            const packageJsonPath = external_node_path_default().join(absoluteWorkspaceDir, entry.name, 'package.json');
+            if (external_node_fs_default().existsSync(packageJsonPath)) packageJsonPaths.push(packageJsonPath);
+        }
+    }
+    for (const packageJsonPath of packageJsonPaths){
+        const packageJson = JSON.parse(external_node_fs_default().readFileSync(packageJsonPath, 'utf-8'));
+        for (const field of [
+            'dependencies',
+            'devDependencies',
+            'peerDependencies',
+            'optionalDependencies'
+        ]){
+            const dependencies = packageJson[field];
+            if (dependencies && 'object' == typeof dependencies) {
+                if (Object.prototype.hasOwnProperty.call(dependencies, packageName)) return true;
+                for (const specifier of Object.values(dependencies))if ('string' == typeof specifier && specifier.startsWith(`npm:${packageName}@`)) return true;
+            }
+        }
+    }
+    return false;
+}
+function ensureGeneratedDeclarationPatches(workspaceRoot, options) {
+    let changed = false;
+    changed = ensureGeneratedPatchFile(workspaceRoot, moduleFederationModernJsPatchPath, moduleFederationModernJsPatchSourcePath) || changed;
+    changed = ensureGeneratedPatchFile(workspaceRoot, moduleFederationBridgeReactPatchPath, moduleFederationBridgeReactPatchSourcePath) || changed;
+    changed = ensureGeneratedPatchFile(workspaceRoot, effectDeclarationPatchPath, effectDeclarationPatchSourcePath) || changed;
+    changed = options.includeDrizzleOrmPatch ? ensureGeneratedPatchFile(workspaceRoot, drizzleOrmDeclarationPatchPath, drizzleOrmDeclarationPatchSourcePath) || changed : removeGeneratedPatchFileIfUnchanged(workspaceRoot, drizzleOrmDeclarationPatchPath, drizzleOrmDeclarationPatchSourcePath) || changed;
+    return changed;
+}
+function updateGeneratedPnpmWorkspacePolicy(workspaceRoot) {
+    const workspaceFile = external_node_path_default().join(workspaceRoot, 'pnpm-workspace.yaml');
+    if (!external_node_fs_default().existsSync(workspaceFile)) return false;
+    let source = external_node_fs_default().readFileSync(workspaceFile, 'utf-8');
+    let changed = false;
+    const usesDrizzleOrm = workspaceUsesDependency(workspaceRoot, 'drizzle-orm');
+    const replacements = [
+        [
+            /^ {4}'@effect\/vitest>effect': .+$/mu,
+            `    '@effect/vitest>effect': '${versions_cjs_namespaceObject.EFFECT_VERSION}'`
+        ]
+    ];
+    for (const [pattern, replacement] of replacements){
+        const result = replaceYamlLine(source, pattern, replacement);
+        source = result.source;
+        changed = result.changed || changed;
+    }
+    for (const [entryKey, version] of [
+        [
+            "'@effect/opentelemetry'",
+            versions_cjs_namespaceObject.EFFECT_VERSION
+        ],
+        [
+            "'@effect/vitest'",
+            versions_cjs_namespaceObject.EFFECT_VITEST_VERSION
+        ],
+        [
+            'effect',
+            versions_cjs_namespaceObject.EFFECT_VERSION
+        ]
+    ]){
+        const result = ensureYamlScalarMapEntry(source, 'overrides', entryKey, version);
+        source = result.source;
+        changed = result.changed || changed;
+    }
+    for (const item of strictEffectPackageVersionPolicyExclusions){
+        const packageName = item.slice(0, item.lastIndexOf('@'));
+        const escapedPackageName = packageName.replace(/[.*+?^${}()|[\]\\]/gu, '\\$&');
+        const currentVersion = replaceYamlLine(source, new RegExp(`^ {2}- '${escapedPackageName}@[^']+'$`, 'gmu'), `  - '${item}'`);
+        source = currentVersion.source;
+        changed = currentVersion.changed || changed;
+        for (const policyKey of [
+            'minimumReleaseAgeExclude',
+            'trustPolicyExclude'
+        ]){
+            const policyExclude = ensureYamlListItem(source, policyKey, item);
+            source = policyExclude.source;
+            changed = policyExclude.changed || changed;
+        }
+    }
+    const effectPatch = ensureYamlMapEntry(source, 'patchedDependencies', `effect@${versions_cjs_namespaceObject.EFFECT_VERSION}`, effectDeclarationPatchPath);
+    source = effectPatch.source;
+    changed = effectPatch.changed || changed;
+    const moduleFederationModernJsPatch = ensureYamlMapEntry(source, 'patchedDependencies', `@module-federation/modern-js-v3@${versions_cjs_namespaceObject.MODULE_FEDERATION_VERSION}`, moduleFederationModernJsPatchPath);
+    source = moduleFederationModernJsPatch.source;
+    changed = moduleFederationModernJsPatch.changed || changed;
+    const moduleFederationBridgeReactPatch = ensureYamlMapEntry(source, 'patchedDependencies', `@module-federation/bridge-react@${versions_cjs_namespaceObject.MODULE_FEDERATION_VERSION}`, moduleFederationBridgeReactPatchPath);
+    source = moduleFederationBridgeReactPatch.source;
+    changed = moduleFederationBridgeReactPatch.changed || changed;
+    const drizzleOrmPatch = usesDrizzleOrm ? ensureYamlMapEntry(source, 'patchedDependencies', `drizzle-orm@${versions_cjs_namespaceObject.DRIZZLE_ORM_VERSION}`, drizzleOrmDeclarationPatchPath) : removeYamlMapEntry(source, `drizzle-orm@${versions_cjs_namespaceObject.DRIZZLE_ORM_VERSION}`);
+    source = drizzleOrmPatch.source;
+    changed = drizzleOrmPatch.changed || changed;
+    if (changed) external_node_fs_default().writeFileSync(workspaceFile, source, 'utf-8');
+    return changed;
+}
 function updateUltramodernConfig(workspaceRoot, packageSource) {
     const configPath = external_node_path_default().join(workspaceRoot, '.modernjs/ultramodern.json');
     const config = readJsonFile(configPath);
@@ -282,6 +601,64 @@ function updateUltramodernConfig(workspaceRoot, packageSource) {
     for (const app of config.topology?.apps ?? [])if (app && 'object' == typeof app && !Array.isArray(app)) normalizeStrictEffectApiMetadata(app);
     writeJsonFile(configPath, config);
 }
+function writeJsonIfChanged(filePath, value) {
+    const next = `${JSON.stringify(value, null, 2)}\n`;
+    if (external_node_fs_default().existsSync(filePath) && external_node_fs_default().readFileSync(filePath, 'utf-8') === next) return false;
+    external_node_fs_default().mkdirSync(external_node_path_default().dirname(filePath), {
+        recursive: true
+    });
+    external_node_fs_default().writeFileSync(filePath, next, 'utf-8');
+    return true;
+}
+function writeTextIfChanged(filePath, value) {
+    if (external_node_fs_default().existsSync(filePath) && external_node_fs_default().readFileSync(filePath, 'utf-8') === value) return false;
+    external_node_fs_default().mkdirSync(external_node_path_default().dirname(filePath), {
+        recursive: true
+    });
+    external_node_fs_default().writeFileSync(filePath, value, 'utf-8');
+    return true;
+}
+function ensureGeneratedIgnoreRules(workspaceRoot) {
+    const gitignorePath = external_node_path_default().join(workspaceRoot, '.gitignore');
+    const existing = external_node_fs_default().existsSync(gitignorePath) ? external_node_fs_default().readFileSync(gitignorePath, 'utf-8') : '';
+    const lines = 0 === existing.trimEnd().length ? [] : existing.trimEnd().split(/\r?\n/u);
+    let changed = false;
+    for (const rule of [
+        '.mf/',
+        '**/.mf/',
+        'dist-cloudflare/'
+    ])if (!lines.includes(rule)) {
+        lines.push(rule);
+        changed = true;
+    }
+    if (!changed) return false;
+    const next = `${lines.join('\n')}\n`;
+    external_node_fs_default().writeFileSync(gitignorePath, next, 'utf-8');
+    return true;
+}
+function updateGeneratedTypeScriptSurfaces(workspaceRoot, config) {
+    let changed = false;
+    const apps = (0, external_config_cjs_namespaceObject.workspaceAppsFromToolingConfig)(config);
+    const remotes = apps.filter((app)=>'shell' !== app.kind);
+    changed = writeJsonIfChanged(external_node_path_default().join(workspaceRoot, 'tsconfig.base.json'), (0, package_json_cjs_namespaceObject.createTsConfigBase)()) || changed;
+    changed = ensureGeneratedIgnoreRules(workspaceRoot) || changed;
+    for (const sharedPackage of [
+        'packages/shared-contracts',
+        'packages/shared-design-tokens'
+    ])changed = writeJsonIfChanged(external_node_path_default().join(workspaceRoot, sharedPackage, 'tsconfig.json'), (0, package_json_cjs_namespaceObject.createSharedPackageTsConfig)(sharedPackage)) || changed;
+    for (const app of apps){
+        changed = writeJsonIfChanged(external_node_path_default().join(workspaceRoot, app.directory, 'tsconfig.json'), (0, package_json_cjs_namespaceObject.createAppTsConfig)(app, remotes)) || changed;
+        changed = writeJsonIfChanged(external_node_path_default().join(workspaceRoot, app.directory, 'tsconfig.mf-types.json'), (0, package_json_cjs_namespaceObject.createAppMfTypesTsConfig)(app)) || changed;
+        changed = writeTextIfChanged(external_node_path_default().join(workspaceRoot, app.directory, 'src/modern-app-env.d.ts'), (0, app_files_cjs_namespaceObject.createAppEnvDts)(app, remotes)) || changed;
+    }
+    return changed;
+}
+function updateGeneratedModernConfigs(workspaceRoot, config) {
+    let changed = false;
+    const apps = (0, external_config_cjs_namespaceObject.workspaceAppsFromToolingConfig)(config);
+    for (const app of apps)changed = writeTextIfChanged(external_node_path_default().join(workspaceRoot, app.directory, 'modern.config.ts'), (0, module_federation_cjs_namespaceObject.createAppModernConfig)(config.workspace.packageScope, app)) || changed;
+    return changed;
+}
 function updateReferenceTopology(workspaceRoot) {
     const topologyPath = external_node_path_default().join(workspaceRoot, 'topology/reference-topology.json');
     if (!external_node_fs_default().existsSync(topologyPath)) return false;
@@ -344,8 +721,10 @@ function runMigrateStrictEffect(args, context) {
   modern-js-create ultramodern migrate-strict-effect --version <version> [--skip-install]
 
 Updates generated UltraModern package-source metadata, Modern package aliases,
-direct Effect API topology metadata, and the pnpm lockfile for strict Effect
-workspaces. Source code still has to pass pnpm api:check and pnpm contract:check.
+framework-owned toolchain pins, direct Effect API topology metadata, strict
+Effect pnpm overrides/trust policy, framework-owned TypeScript config
+surfaces, and the pnpm lockfile. Source code still has to pass pnpm api:check
+and pnpm contract:check.
 `);
         return 0;
     }
@@ -353,6 +732,9 @@ workspaces. Source code still has to pass pnpm api:check and pnpm contract:check
     const packageSource = createMigrationPackageSource(args, current);
     updateUltramodernConfig(context.workspaceRoot, packageSource);
     updateReferenceTopology(context.workspaceRoot);
+    const migrated = (0, external_config_cjs_namespaceObject.readUltramodernConfig)(context.workspaceRoot);
+    updateGeneratedTypeScriptSurfaces(context.workspaceRoot, migrated);
+    updateGeneratedModernConfigs(context.workspaceRoot, migrated);
     for (const relativePackageFile of listWorkspacePackageFiles(context.workspaceRoot)){
         const packageFile = external_node_path_default().join(context.workspaceRoot, relativePackageFile);
         const packageJson = readJsonFile(packageFile);
@@ -363,9 +745,17 @@ workspaces. Source code still has to pass pnpm api:check and pnpm contract:check
                 config: './.modernjs/ultramodern.json'
             };
         }
-        if (updateModernDependencies(packageJson, packageSource)) writeJsonFile(packageFile, packageJson);
+        const modernDependenciesChanged = updateModernDependencies(packageJson, packageSource);
+        const toolingDependenciesChanged = updateGeneratedToolingDependencies(packageJson);
+        const generatedScriptsChanged = updateGeneratedPackageScripts(packageJson);
+        const changed = modernDependenciesChanged || toolingDependenciesChanged || generatedScriptsChanged;
+        if (changed) writeJsonFile(packageFile, packageJson);
         else if ('package.json' === relativePackageFile) writeJsonFile(packageFile, packageJson);
     }
+    updateGeneratedPnpmWorkspacePolicy(context.workspaceRoot);
+    ensureGeneratedDeclarationPatches(context.workspaceRoot, {
+        includeDrizzleOrmPatch: workspaceUsesDependency(context.workspaceRoot, 'drizzle-orm')
+    });
     if (!hasFlag(args, '--skip-install')) {
         const status = runPnpmLockfileRefresh(context);
         if (0 !== status) return status;

package/dist/cjs/ultramodern-workspace/app-files.cjs

@@ -71,17 +71,14 @@ function createAppEnvDts(app, remotes = []) {
 }
 `;
         })).join('\n');
-    const reactTypeReference = remoteModuleDeclarations ? "/// <reference types='react' />\n" : '';
-    const siteUrlDeclaration = 'declare const ULTRAMODERN_SITE_URL: string;';
-    return `${reactTypeReference}/// <reference types='@modern-js/app-tools/types' />
-
-${siteUrlDeclaration}
-declare module '*.svg' {
-  const url: string;
-  export default url;
-}
-declare module '*.css';
-${remoteModuleDeclarations ? `\n${remoteModuleDeclarations}` : ''}`;
+    const reactTypeImport = remoteModuleDeclarations ? "import type React from 'react';\n" : '';
+    return [
+        `import '@modern-js/app-tools/types';\n${reactTypeImport}`.trimEnd(),
+        `declare global {
+  const ULTRAMODERN_SITE_URL: string;
+}`,
+        remoteModuleDeclarations.trimEnd()
+    ].filter((section)=>section.length > 0).join('\n\n').concat('\n');
 }
 function createAppRuntimeConfig(app, scope, remotes = []) {
     const pluginsConfig = 'shell' === app.kind ? `  plugins: [

package/dist/cjs/ultramodern-workspace/module-federation.cjs

@@ -76,6 +76,11 @@ function createAppModernConfig(scope, app) {
   (cloudflareDeployEnabled ? '/' : \`http://localhost:\${port}\`);
 const defaultRemoteAssetPrefix = \`\${remoteAssetOrigin.replace(/\\/+$/u, '')}/\`;
 const defaultAssetPrefix = defaultRemoteAssetPrefix;`;
+    const devAssetPrefixSource = 'shell' === app.kind ? `        // Keep shell dev assets origin-relative so the shell works through
+        // tunnels and local previews without rewriting its own chunks.
+        assetPrefix: '/',` : `        // Remote dev manifests must publish an absolute publicPath so host
+        // shells load remoteEntry.js and exposed chunks from this dev server.
+        assetPrefix,`;
     return `// @effect-diagnostics processEnv:off
 import {
   appTools,
@@ -144,8 +149,10 @@ ${defaultAssetPrefixSource}
 // load remoteEntry.js and exposed chunks from the remote origin, not the host.
 const assetPrefix =
   configuredModernAssetPrefix || configuredUltramodernAssetPrefix || defaultAssetPrefix;
-const buildCacheTarget = cloudflareDeployEnabled ? 'cloudflare' : 'web';
-const buildCacheDirectory = \`node_modules/.cache/rspack-\${appId}-\${buildCacheTarget}\`;
+const buildTarget = cloudflareDeployEnabled ? 'cloudflare' : 'web';
+const buildOutputRoot = cloudflareDeployEnabled ? 'dist-cloudflare' : 'dist';
+const buildTempDirectory = \`node_modules/.modern-js-\${appId}-\${buildTarget}\`;
+const buildCacheDirectory = \`node_modules/.cache/rspack-\${appId}-\${buildTarget}\`;
 
 if (
   cloudflareDeployEnabled &&
@@ -175,9 +182,7 @@ ${bffConfig}      ...(cloudflareDeployEnabled
           }
         : {}),
       dev: {
-        // Keep dev assets origin-relative too; the default absolute
-        // http://localhost:<port> prefix breaks pages served through tunnels.
-        assetPrefix: '/',
+${devAssetPrefixSource}
       },
       html: {
         outputStructure: 'flat',
@@ -187,13 +192,15 @@ ${bffConfig}      ...(cloudflareDeployEnabled
         disableTsChecker: false,
         distPath: {
           html: './',
+          root: buildOutputRoot,
         },
         polyfill: 'off',
         splitRouteChunks: true,
+        tempDir: buildTempDirectory,
       },
       performance: {
         buildCache: {
-          cacheDigest: [appId, buildCacheTarget],
+          cacheDigest: [appId, buildTarget],
           cacheDirectory: buildCacheDirectory,
         },
         rsdoctor: {