@bleedingdev/modern-js-create 3.5.0-ultramodern.27 → 3.5.0-ultramodern.29

package/templates/workspace-scripts/ultramodern-cloudflare-proof.mjs

@@ -20,8 +20,8 @@ function resolveModuleFederationPublicPath(publicPath, manifestUrl) {
   }
 }
 
-async function fetchText(url) {
-  const response = await fetch(url);
+async function fetchText(url, init) {
+  const response = await fetch(url, init);
   return {
     ok: response.ok,
     status: response.status,
@@ -48,6 +48,52 @@ function parseMaybeJson(body) {
   }
 }
 
+function jsonPathValue(value, path) {
+  const segments = String(path ?? '')
+    .split('.')
+    .filter(Boolean);
+  let current = value;
+
+  for (const segment of segments) {
+    if (current === null || current === undefined) {
+      return undefined;
+    }
+
+    if (Array.isArray(current) && /^\d+$/u.test(segment)) {
+      current = current[Number(segment)];
+      continue;
+    }
+
+    if (typeof current === 'object' && Object.hasOwn(current, segment)) {
+      current = current[segment];
+      continue;
+    }
+
+    return undefined;
+  }
+
+  return current;
+}
+
+function jsonValuesEqual(left, right) {
+  return JSON.stringify(left) === JSON.stringify(right);
+}
+
+function normalizeJsonSmokeExpectations(check) {
+  if (Array.isArray(check.expectations)) {
+    return check.expectations;
+  }
+
+  if (check.expect && typeof check.expect === 'object') {
+    return Object.entries(check.expect).map(([path, equals]) => ({
+      path,
+      equals,
+    }));
+  }
+
+  return [];
+}
+
 function markerFromJson(value) {
   if (!value || typeof value !== 'object') {
     return undefined;
@@ -687,6 +733,27 @@ function validateUiMarkerEvidence(evidence, app, ssr) {
     status: uiMarker === app.marker?.build ? 'pass' : 'fail',
   });
   assert(uiMarker === app.marker?.build, `${app.id} UI marker mismatch`);
+
+  if (app.deliveryUnit) {
+    evidence.assertions.push({
+      type: 'delivery-unit-ui-marker',
+      unitId: app.deliveryUnit.unitId,
+      expected: app.deliveryUnit.surfaces?.ui?.buildMarker ?? app.deliveryUnit.buildMarker,
+      actual: uiMarker,
+      status:
+        uiMarker === (app.deliveryUnit.surfaces?.ui?.buildMarker ?? app.deliveryUnit.buildMarker)
+          ? 'pass'
+          : 'fail',
+    });
+    assert(
+      uiMarker !== undefined,
+      `${app.id} delivery unit ${app.deliveryUnit.unitId} is declared but SSR response is missing its build marker`,
+    );
+    assert(
+      uiMarker === (app.deliveryUnit.surfaces?.ui?.buildMarker ?? app.deliveryUnit.buildMarker),
+      `${app.id} delivery unit ${app.deliveryUnit.unitId} UI surface build marker mismatch`,
+    );
+  }
 }
 
 function validateCssRootMarkerEvidence(evidence, app, ssr) {
@@ -857,6 +924,123 @@ async function validateReadinessEvidence(evidence, app, publicUrl, routes) {
       `${app.id} Effect readiness returned HTTP ${readiness.status}`,
     );
     assert(apiMarker === app.marker?.build, `${app.id} API marker mismatch`);
+
+    if (app.deliveryUnit) {
+      evidence.assertions.push({
+        type: 'delivery-unit-api-marker',
+        route: routes.apiReadiness,
+        unitId: app.deliveryUnit.unitId,
+        expected: app.deliveryUnit.buildMarker,
+        actual: apiMarker,
+        status: apiMarker === app.deliveryUnit.buildMarker ? 'pass' : 'fail',
+      });
+      assert(
+        apiMarker !== undefined,
+        `${app.id} delivery unit ${app.deliveryUnit.unitId} is declared but readiness response is missing its build marker`,
+      );
+      assert(
+        apiMarker === app.deliveryUnit.buildMarker,
+        `${app.id} delivery unit ${app.deliveryUnit.unitId} API surface build marker mismatch`,
+      );
+    }
+  }
+}
+
+async function validateServiceBindingEvidence(evidence, app, publicUrl) {
+  const serviceBindings = app.deploy?.cloudflare?.serviceBindings ?? [];
+
+  for (const binding of serviceBindings) {
+    const response = await fetchText(joinUrl(publicUrl, binding.route));
+    const responseJson = parseMaybeJson(response.body);
+    const apiMarker = markerFromJson(responseJson);
+    const passed = response.ok && apiMarker === binding.expectedMarker;
+
+    evidence.assertions.push({
+      type: 'service-binding-api-marker',
+      appId: binding.appId,
+      binding: binding.binding,
+      route: binding.route,
+      expected: binding.expectedMarker,
+      actual: apiMarker,
+      status: passed ? 'pass' : 'fail',
+      statusCode: response.status,
+    });
+    assert(
+      response.ok,
+      `${app.id} service binding ${binding.binding} returned HTTP ${response.status}`,
+    );
+    assert(
+      apiMarker === binding.expectedMarker,
+      `${app.id} service binding ${binding.binding} API marker mismatch`,
+    );
+  }
+}
+
+async function validateJsonSmokeEvidence(evidence, app, publicUrl) {
+  const checks = app.deploy?.cloudflare?.jsonSmokeChecks ?? [];
+
+  for (const check of checks) {
+    const route = check.route;
+    assert(
+      typeof route === 'string' && route.length > 0,
+      `${app.id} JSON smoke check is missing a route`,
+    );
+
+    const method = String(check.method ?? 'GET').toUpperCase();
+    const requestBody =
+      check.body ?? check.payload ?? check.requestBody ?? undefined;
+    const response = await fetchText(joinUrl(publicUrl, route), {
+      method,
+      headers: {
+        accept: 'application/json',
+        ...(requestBody === undefined
+          ? {}
+          : { 'content-type': 'application/json' }),
+      },
+      ...(requestBody === undefined
+        ? {}
+        : { body: JSON.stringify(requestBody) }),
+    });
+    const responseJson = parseMaybeJson(response.body);
+    const checkId = check.id ?? route;
+
+    evidence.assertions.push({
+      type: 'json-smoke-http',
+      id: checkId,
+      method,
+      route,
+      status: response.ok && responseJson !== undefined ? 'pass' : 'fail',
+      statusCode: response.status,
+    });
+    assert(
+      response.ok,
+      `${app.id} JSON smoke ${checkId} returned HTTP ${response.status}`,
+    );
+    assert(
+      responseJson !== undefined,
+      `${app.id} JSON smoke ${checkId} did not return JSON`,
+    );
+
+    for (const expectation of normalizeJsonSmokeExpectations(check)) {
+      const actual = jsonPathValue(responseJson, expectation.path);
+      const passed = jsonValuesEqual(actual, expectation.equals);
+
+      evidence.assertions.push({
+        type: 'json-smoke-value',
+        id: checkId,
+        route,
+        path: expectation.path,
+        expected: expectation.equals,
+        actual,
+        status: passed ? 'pass' : 'fail',
+      });
+      assert(
+        passed,
+        `${app.id} JSON smoke ${checkId} expected ${expectation.path} to equal ${JSON.stringify(
+          expectation.equals,
+        )}`,
+      );
+    }
   }
 }
 
@@ -869,6 +1053,8 @@ async function validateApp(app, publicUrl) {
   await validateModuleFederationManifestEvidence(evidence, app, publicUrl, routes);
   await validateI18nEvidence(evidence, app, publicUrl, routes);
   await validateReadinessEvidence(evidence, app, publicUrl, routes);
+  await validateServiceBindingEvidence(evidence, app, publicUrl);
+  await validateJsonSmokeEvidence(evidence, app, publicUrl);
 
   return evidence;
 }

package/templates/workspace-scripts/validate-ultramodern-workspace.mjs.handlebars

@@ -53,6 +53,14 @@ const assertExists = relativePath => {
 const assertNotExists = relativePath => {
   assert(!fs.existsSync(path.join(root, relativePath)), `Unexpected ${relativePath}`);
 };
+const assertAnyOf = relativePaths => {
+  assert(
+    relativePaths.some(relativePath =>
+      fs.existsSync(path.join(root, relativePath)),
+    ),
+    `Missing one of: ${relativePaths.join(', ')}`,
+  );
+};
 const formatJson = value =>
   value === undefined ? 'undefined' : JSON.stringify(value);
 const selfCheckFailure = (contract, message, fixArea) =>
@@ -136,6 +144,28 @@ const buildMarkerFor = app =>
     .update(`${packageScope}:${app.packageSuffix}:${app.id}:0.1.0`)
     .digest('hex')
     .slice(0, 16);
+const deliveryUnitIdentityFixArea =
+  'regenerate vertical identity from delivery-unit record; do not hand-edit surface markers';
+const deliveryUnitBlock = record => ({
+  schemaVersion: record?.schemaVersion,
+  kind: record?.kind,
+  unitId: record?.unitId,
+  packageName: record?.packageName,
+  version: record?.version,
+  buildMarker: record?.buildMarker,
+  sourceRevision: record?.sourceRevision,
+});
+const assertDeliveryUnitMarkerSpread = (source, exportName, contract) => {
+  const spreadPattern = new RegExp(
+    `export const ${exportName} = \\{\\s*\\.\\.\\.ultramodernDeliveryUnit,`,
+  );
+  assertSelfCheck(
+    spreadPattern.test(source),
+    contract,
+    `${exportName} must spread ...ultramodernDeliveryUnit rather than hand-forking per-surface fields`,
+    deliveryUnitIdentityFixArea,
+  );
+};
 const normalizeCompactApp = rawApp => {
   const id = String(rawApp.id);
   const kind = rawApp.kind === 'vertical' ? 'vertical' : 'shell';
@@ -772,6 +802,107 @@ const expectedManifestUrl = vertical =>
   `http://localhost:${vertical.port}/mf-manifest.json`;
 const expectedApiUrl = vertical =>
   `http://localhost:${vertical.port}${vertical.apiPrefix}`;
+const expectedBackendFederationName = vertical => `${vertical.mfName}Backend`;
+const expectedBackendManifestUrl = vertical =>
+  `http://localhost:${vertical.port}/backend-mf-manifest.json`;
+const expectedBackendContainerEntry = vertical =>
+  `http://localhost:${vertical.port}/backendRemoteEntry.mjs`;
+const expectedBackendManifestEnv = vertical =>
+  `VERTICAL_${toEnvSegment(vertical.domain ?? vertical.id)}_BACKEND_MF_MANIFEST`;
+const expectedPublicUrlEnv = vertical =>
+  `ULTRAMODERN_PUBLIC_URL_${toEnvSegment(vertical.id)}`;
+const expectedCloudflareWorkerName = vertical =>
+  toKebabCase(`${packageScope}-${vertical.packageSuffix ?? vertical.id}`).slice(
+    0,
+    63,
+  );
+const backendFederationSubset = backendFederation => ({
+  role: backendFederation?.role,
+  name: backendFederation?.name,
+  runtimeFramework: backendFederation?.runtimeFramework,
+  strictEffectApproach: backendFederation?.strictEffectApproach,
+  exposeRuntime: backendFederation?.exposes?.['./effect-api']?.runtime,
+  exposeReadiness: backendFederation?.exposes?.['./effect-api']?.readiness,
+  versionBoundary: {
+    invariant: backendFederation?.versionBoundary?.invariant,
+    uiManifestUrl: backendFederation?.versionBoundary?.ui?.manifestUrl,
+    apiReadiness: backendFederation?.versionBoundary?.api?.readiness,
+  },
+  cloudflare: {
+    kind: backendFederation?.executionSurfaces?.cloudflare?.kind,
+    workerName: backendFederation?.executionSurfaces?.cloudflare?.workerName,
+    publicUrlEnv:
+      backendFederation?.executionSurfaces?.cloudflare?.publicUrlEnv,
+    zephyrRuntime:
+      backendFederation?.executionSurfaces?.cloudflare?.zephyr?.runtime,
+  },
+  node: {
+    kind: backendFederation?.executionSurfaces?.node?.kind,
+    remoteName: backendFederation?.executionSurfaces?.node?.remoteName,
+    manifestEnv: backendFederation?.executionSurfaces?.node?.manifestEnv,
+    manifestUrl: backendFederation?.executionSurfaces?.node?.manifestUrl,
+    containerEntry:
+      backendFederation?.executionSurfaces?.node?.containerEntry,
+    remoteType: backendFederation?.executionSurfaces?.node?.remoteType,
+    expose: backendFederation?.executionSurfaces?.node?.expose,
+  },
+  compatibility: {
+    contractVersion: backendFederation?.compatibility?.contractVersion,
+  },
+  topLevelManifestUrl: backendFederation?.manifestUrl,
+  topLevelContainerEntry: backendFederation?.containerEntry,
+});
+const expectedBackendFederationSubset = vertical => ({
+  role: 'microvertical-server',
+  name: expectedBackendFederationName(vertical),
+  runtimeFramework: 'effect',
+  strictEffectApproach: true,
+  exposeRuntime: `${vertical.path}/api/index.ts`,
+  exposeReadiness: `${vertical.apiPrefix}/${vertical.stem}/readiness`,
+  versionBoundary: {
+    invariant: 'web-and-api-same-build',
+    uiManifestUrl: expectedManifestUrl(vertical),
+    apiReadiness: `${vertical.apiPrefix}/${vertical.stem}/readiness`,
+  },
+  cloudflare: {
+    kind: 'cloudflare-worker-snapshot',
+    workerName: expectedCloudflareWorkerName(vertical),
+    publicUrlEnv: expectedPublicUrlEnv(vertical),
+    zephyrRuntime: 'ssr-worker',
+  },
+  node: {
+    kind: 'node-mf-runtime',
+    remoteName: expectedBackendFederationName(vertical),
+    manifestEnv: expectedBackendManifestEnv(vertical),
+    manifestUrl: expectedBackendManifestUrl(vertical),
+    containerEntry: expectedBackendContainerEntry(vertical),
+    remoteType: 'module',
+    expose: './effect-api',
+  },
+  compatibility: {
+    contractVersion: 'microvertical-server-effect-v1',
+  },
+  topLevelManifestUrl: undefined,
+  topLevelContainerEntry: undefined,
+});
+const serverExecutionSubset = serverExecution => ({
+  apiBaseUrl: serverExecution?.apiBaseUrl,
+  versionBoundary: serverExecution?.versionBoundary,
+  cloudflareKind: serverExecution?.cloudflare?.kind,
+  cloudflareWorkerName: serverExecution?.cloudflare?.workerName,
+  nodeKind: serverExecution?.node?.kind,
+  nodeManifestUrl: serverExecution?.node?.manifestUrl,
+  nodeContainerEntry: serverExecution?.node?.containerEntry,
+});
+const expectedServerExecutionSubset = vertical => ({
+  apiBaseUrl: expectedApiUrl(vertical),
+  versionBoundary: 'web-and-api-same-build',
+  cloudflareKind: 'cloudflare-worker-snapshot',
+  cloudflareWorkerName: expectedCloudflareWorkerName(vertical),
+  nodeKind: 'node-mf-runtime',
+  nodeManifestUrl: expectedBackendManifestUrl(vertical),
+  nodeContainerEntry: expectedBackendContainerEntry(vertical),
+});
 const remoteContractSubset = remote => ({
   id: remote?.id,
   name: remote?.name,
@@ -791,9 +922,11 @@ const requiredMicroVerticalPaths = vertical => [
   `${vertical.path}/package.json`,
   `${vertical.path}/tsconfig.json`,
   `${vertical.path}/tsconfig.mf-types.json`,
-  `${vertical.path}/modern.config.ts`,
-  `${vertical.path}/module-federation.config.ts`,
-  `${vertical.path}/api/index.ts`,
+    `${vertical.path}/modern.config.ts`,
+    `${vertical.path}/module-federation.config.ts`,
+    `${vertical.path}/backend-federation.config.ts`,
+    `${vertical.path}/api/effect-api.ts`,
+    `${vertical.path}/api/index.ts`,
   `${vertical.path}/shared/api.ts`,
   `${vertical.path}/src/api/${vertical.stem}-client.ts`,
   `${vertical.path}/src/modern-app-env.d.ts`,
@@ -988,6 +1121,34 @@ const assertMicroVerticalContractGraph = ({
       `topology/reference-topology.json verticals.${vertical.id}`,
       'restore generated topology vertical entries',
     );
+ assertSameJson(
+ backendFederationSubset(topologyEntry.backendFederation),
+ expectedBackendFederationSubset(vertical),
+ `topology/reference-topology.json verticals.${vertical.id}.backendFederation`,
+ 'restore generated MicroVertical server execution contract',
+ );
+
+    if (vertical.deliveryUnit) {
+      const expectedDeliveryUnit = deliveryUnitBlock(vertical.deliveryUnit);
+      assertSameJson(
+        deliveryUnitBlock(topologyEntry.deliveryUnit),
+        expectedDeliveryUnit,
+        `topology/reference-topology.json verticals.${vertical.id}.deliveryUnit`,
+        deliveryUnitIdentityFixArea,
+      );
+      assertSameJson(
+        deliveryUnitBlock(topologyEntry.backendFederation?.deliveryUnit),
+        expectedDeliveryUnit,
+        `topology/reference-topology.json verticals.${vertical.id}.backendFederation.deliveryUnit`,
+        deliveryUnitIdentityFixArea,
+      );
+      assertSelfCheck(
+        topologyEntry.backendFederation?.versionBoundary?.identityRoot === 'deliveryUnit',
+        `topology/reference-topology.json verticals.${vertical.id}.backendFederation.versionBoundary.identityRoot`,
+        `Expected "deliveryUnit", found ${formatJson(topologyEntry.backendFederation?.versionBoundary?.identityRoot)}`,
+        deliveryUnitIdentityFixArea,
+      );
+    }
 
     assertObject(
       ownershipEntry,
@@ -1025,6 +1186,13 @@ const assertMicroVerticalContractGraph = ({
       `topology/local-overlays/development.json apis.${vertical.id}`,
       'restore generated local API overlay',
     );
+ assertSameJson(
+ serverExecutionSubset(overlay.serverExecution?.[vertical.id]),
+ expectedServerExecutionSubset(vertical),
+ `topology/local-overlays/development.json serverExecution.${vertical.id}`,
+ 'restore generated local MicroVertical server execution overlay',
+ );
+
 
     assertSameJson(
       shellPackage.dependencies?.[vertical.packageName],
@@ -1230,7 +1398,7 @@ const packageJsonFiles = startDir => {
     const current = queue.shift();
     for (const entry of fs.readdirSync(current, { withFileTypes: true })) {
       if (
-        ['.git', '.output', 'dist', 'node_modules', 'repos'].includes(
+      ['.git', '.output', '.zerops', 'dist', 'node_modules', 'repos'].includes(
           entry.name,
         )
       ) {
@@ -1513,8 +1681,6 @@ const requiredPaths = [
   '.github/renovate.json',
   '.github/workflows/ultramodern-workspace-gates.yml',
   '.agents/agent-reference-repos.json',
-  '.codex/skills-lock.json',
-  '.codex/rstackjs-agent-skills-LICENSE',
   'topology/reference-topology.json',
   'topology/ownership.json',
   'topology/local-overlays/development.json',
@@ -1522,13 +1688,17 @@ const requiredPaths = [
   'scripts/bootstrap-agent-skills.mts',
   'scripts/check-ultramodern-api-boundaries.mts',
   'scripts/check-ultramodern-i18n-boundaries.mts',
+  'scripts/generate-node-backend-federation.mts',
   'scripts/generate-public-surface-assets.mts',
+  'scripts/generate-tanstack-routes.mts',
   'scripts/proof-cloudflare-version.mts',
+  'scripts/proof-node-backend-federation.mts',
   'scripts/setup-agent-reference-repos.mts',
   'scripts/ultramodern-performance-readiness.config.mjs',
   'scripts/ultramodern-performance-readiness.mts',
   'scripts/ultramodern-typecheck.mts',
   'scripts/validate-ultramodern-workspace.mts',
+  'scripts/verify-cloudflare-output.mts',
   'apps/shell-super-app/package.json',
   'apps/shell-super-app/tsconfig.json',
   'apps/shell-super-app/tsconfig.mf-types.json',
@@ -1581,6 +1751,13 @@ for (const vertical of fullStackVerticals) {
 for (const requiredPath of requiredPaths) {
   assertExists(requiredPath);
 }
+// Agent skills metadata may live under .agents/ (agents-standard layout) or
+// .codex/ (legacy scaffold default).
+assertAnyOf(['.agents/skills-lock.json', '.codex/skills-lock.json']);
+assertAnyOf([
+  '.agents/rstackjs-agent-skills-LICENSE',
+  '.codex/rstackjs-agent-skills-LICENSE',
+]);
 const pnpmWorkspace = readText('pnpm-workspace.yaml');
 assert(
   pnpmWorkspace.includes("'@effect/opentelemetry': {{effectVersion}}"),
@@ -1676,6 +1853,11 @@ assert(
     expectedModernPackageSpecifier('@modern-js/code-tools'),
   'Root must depend on @modern-js/code-tools through package source metadata',
 );
+assert(
+  rootPackage.devDependencies?.['@modern-js/plugin-bff'] ===
+    expectedModernPackageSpecifier('@modern-js/plugin-bff'),
+  'Root must depend on @modern-js/plugin-bff for Node backend federation proof',
+);
 if (packageSource.strategy === 'install') {
   const installSpecifier = packageSource.modernPackages?.specifier;
   assert(
@@ -1735,21 +1917,60 @@ if (bridgeConfig) {
   }
   assert(rootPackage.scripts?.['bridge:check'], 'Bridge workspaces must expose bridge:check');
 } else {
-  assert(rootPackage.scripts?.typecheck === 'node ./scripts/ultramodern-typecheck.mts --build tsconfig.json', 'Root typecheck must run TS-Go build mode across project references');
+  assert(rootPackage.scripts?.typecheck === 'node ./scripts/ultramodern-typecheck.mts --project tsconfig.json', 'Root typecheck must run TS-Go across the root project reference graph');
 }
 assert(rootPackage.scripts?.['contract:check'] === 'node ./scripts/validate-ultramodern-workspace.mts', 'Root must expose contract:check');
 assert(rootPackage.scripts?.['api:check'] === 'node ./scripts/check-ultramodern-api-boundaries.mts', 'Root must expose api:check');
 assert(rootPackage.scripts?.['i18n:boundaries'] === 'node ./scripts/check-ultramodern-i18n-boundaries.mts', 'Root must expose i18n:boundaries');
 assert(rootPackage.scripts?.['performance:readiness'] === 'node ./scripts/ultramodern-performance-readiness.mts', 'Root must expose default-on performance readiness diagnostics');
+assert(rootPackage.scripts?.['node:backend-federation:generate'] === 'node ./scripts/generate-node-backend-federation.mts', 'Root must expose local Node backend federation artifact generation');
+assert(rootPackage.scripts?.['zerops:materialize'] === 'node ./scripts/materialize-zerops-runtime.mjs', 'Root must expose Zerops runtime materialization script');
+assertNotExists('scripts/generate-node-backend-federation.mjs');
+assertNotExists('scripts/proof-node-backend-federation.mjs');
+assertNotExists('scripts/verify-cloudflare-output.mjs');
+assertNotExists('scripts/generate-tanstack-routes.mjs');
+assert(
+  rootPackage.scripts?.['node:proof'] ===
+    'node ./scripts/proof-node-backend-federation.mts',
+  'Root must expose node:proof for backend federation Effect modules',
+);
 assert(
   bridgeConfig
     ? rootPackage.scripts?.check?.includes('pnpm api:check') &&
+        rootPackage.scripts.check.includes('pnpm node:proof') &&
         rootPackage.scripts.check.endsWith('&& pnpm performance:readiness && pnpm bridge:check')
     : rootPackage.scripts?.check?.includes('pnpm api:check') &&
+        rootPackage.scripts.check.includes('pnpm node:proof') &&
         rootPackage.scripts.check.endsWith('&& pnpm performance:readiness'),
-  'Root check must run default-on performance readiness diagnostics and bridge gates when configured',
+  'Root check must run Node backend federation proof, default-on performance readiness diagnostics, and bridge gates when configured',
+);
+const zeropsYaml = readText('zerops.yaml');
+assert(zeropsYaml.includes('zerops:'), 'Zerops manifest must include zerops services');
+assert(zeropsYaml.includes('setup: shell-super-app'), 'Zerops manifest must include shell service');
+assert(zeropsYaml.includes('base: nodejs@26'), 'Zerops manifest must use generated Node runtime major');
+assert(zeropsYaml.includes('deployFiles:'), 'Zerops manifest must deploy package-pruned runtime directories');
+assert(
+  zeropsYaml.includes('start: cd .zerops/runtime/shell-super-app && npm run serve'),
+  'Zerops shell service must start from materialized runtime package',
+);
+assert(
+  zeropsYaml.includes('SHELL_SUPER_APP_PORT:') &&
+    zeropsYaml.includes('ULTRAMODERN_ZEROPS_SERVICE:'),
+  'Zerops manifest must expose service identity and ports',
 );
+for (const vertical of fullStackVerticals) {
+  assert(zeropsYaml.includes(`setup: ${vertical.id}`), `${vertical.id} must have a Zerops service`);
+  assert(
+    zeropsYaml.includes(`~/.local/bin/mise exec -- pnpm run zerops:materialize -- --app ${vertical.id} --package ${vertical.packageName} --package-dir ${vertical.path}`),
+    `${vertical.id} Zerops service must materialize its runtime package`,
+  );
+  assert(
+    zeropsYaml.includes(`path: ${vertical.apiPrefix}/${vertical.stem}/readiness`),
+    `${vertical.id} BFF readiness path must use generated API prefix`,
+  );
+}
 const performanceReadinessConfig = readText('scripts/ultramodern-performance-readiness.config.mjs');
+const zeropsMaterializer = readText('scripts/materialize-zerops-runtime.mjs');
 const assertToolWrapper = (scriptPath, command) => {
   const source = readText(scriptPath);
   assert(source.includes('modern-js-create'), `${scriptPath} must delegate to modern-js-create`);
@@ -1760,6 +1981,16 @@ const assertToolWrapper = (scriptPath, command) => {
 assert(performanceReadinessConfig.includes('UltramodernPerformanceReadinessDiagnosticsConfig'), 'Performance readiness config must carry the typed opt-out surface');
 assert(performanceReadinessConfig.includes('enabled: true'), 'Performance readiness diagnostics must be default-on');
 assert(performanceReadinessConfig.includes("failOn: 'framework-invariant'"), 'Performance readiness diagnostics must only fail framework invariants by default');
+assert(zeropsMaterializer.includes("MODERNJS_DEPLOY: 'node'"), 'Zerops materializer must use Modern.js Node deploy target');
+assert(/'deploy',\s*'--skip-build'/.test(zeropsMaterializer), 'Zerops materializer must pass --skip-build directly to Modern deploy');
+assert(zeropsMaterializer.includes('normalizeRuntimePackageDependencies'), 'Zerops materializer must normalize generated Modern package aliases before installing dependencies');
+assert(zeropsMaterializer.includes('officialPackageName'), 'Zerops materializer must add official Modern.js npm aliases for generated runtime imports');
+assert(zeropsMaterializer.includes('installRuntimeDependencies'), 'Zerops materializer must install dependencies outside the workspace copy runtime node_modules');
+assert(zeropsMaterializer.includes('copyWorkspacePackage'), 'Zerops materializer must preserve generated local workspace package dependencies');
+assert(zeropsMaterializer.includes('makeWorkspacePackageRuntimeSafe'), 'Zerops materializer must rewrite copied workspace packages to runtime-safe JavaScript exports');
+assert(zeropsMaterializer.includes("serve: runtimePackage.scripts?.serve ?? 'node index.js'"), 'Zerops materializer must preserve runtime serve script fallback');
+assert(zeropsMaterializer.includes("'install', '--omit=dev'"), 'Zerops materializer must omit dev dependencies from runtime installs');
+assert(zeropsMaterializer.includes("'--legacy-peer-deps'"), 'Zerops materializer must tolerate generated-workspace peer dependency ranges in npm runtime install');
 assertToolWrapper('scripts/validate-ultramodern-workspace.mts', 'validate');
 assertToolWrapper('scripts/ultramodern-performance-readiness.mts', 'performance-readiness');
 const i18nBoundaryScript = readText('scripts/check-ultramodern-i18n-boundaries.mts');
@@ -1779,8 +2010,12 @@ assert(rootPackage.scripts?.postinstall === "oxfmt . '!repos/**' && node ./scrip
 assert(rootPackage.scripts?.['agents:refs:install'] === 'node ./scripts/setup-agent-reference-repos.mts', 'Root must expose agents:refs:install as the explicit reference repo installer');
 const agentSkillsBootstrap = readText('scripts/bootstrap-agent-skills.mts');
 assertToolWrapper('scripts/assert-mf-types.mts', 'mf-types');
+assertToolWrapper('scripts/generate-node-backend-federation.mts', 'backend-federation-generate');
 assertToolWrapper('scripts/generate-public-surface-assets.mts', 'public-surface');
+assertToolWrapper('scripts/generate-tanstack-routes.mts', 'routes-generate');
+assertToolWrapper('scripts/proof-node-backend-federation.mts', 'backend-federation-proof');
 assertToolWrapper('scripts/proof-cloudflare-version.mts', 'cloudflare-proof');
+assertToolWrapper('scripts/verify-cloudflare-output.mts', 'cloudflare-output-verify');
 assertToolWrapper('scripts/migrate-strict-effect.mts', 'migrate-strict-effect');
 assertToolWrapper('scripts/bootstrap-agent-skills.mts', 'skills');
 assert(!agentSkillsBootstrap.includes("run('brew'") && !agentSkillsBootstrap.includes('runShell('), 'Agent skills bootstrap must never invoke system package managers');
@@ -1927,6 +2162,54 @@ for (const vertical of fullStackVerticals) {
   const modernAppEnv = readText(`${vertical.path}/src/modern-app-env.d.ts`);
   const routeHead = readText(`${vertical.path}/src/routes/ultramodern-route-head.tsx`);
   const routeMetadata = readText(`${vertical.path}/src/routes/ultramodern-route-metadata.ts`);
+  const ultramodernBuildSource = readText(`${vertical.path}/shared/ultramodern-build.ts`);
+  if (vertical.deliveryUnit) {
+    const buildLabel = `${vertical.path}/shared/ultramodern-build.ts ultramodernDeliveryUnit`;
+    assertSelfCheck(
+      ultramodernBuildSource.includes('export const ultramodernDeliveryUnit'),
+      buildLabel,
+      'Missing ultramodernDeliveryUnit export',
+      deliveryUnitIdentityFixArea,
+    );
+    const buildMatch = /\bbuild:\s*'([^']+)'/u.exec(ultramodernBuildSource);
+    const unitIdMatch = /\bunitId:\s*'([^']+)'/u.exec(ultramodernBuildSource);
+    const packageNameMatch = /\bpackageName:\s*'([^']+)'/u.exec(ultramodernBuildSource);
+    const versionMatch = /\bversion:\s*'([^']+)'/u.exec(ultramodernBuildSource);
+    assertSelfCheck(
+      buildMatch?.[1] === vertical.deliveryUnit.buildMarker,
+      buildLabel,
+      `Expected build "${vertical.deliveryUnit.buildMarker}", found ${formatJson(buildMatch?.[1])}`,
+      deliveryUnitIdentityFixArea,
+    );
+    assertSelfCheck(
+      unitIdMatch?.[1] === vertical.deliveryUnit.unitId,
+      buildLabel,
+      `Expected unitId "${vertical.deliveryUnit.unitId}", found ${formatJson(unitIdMatch?.[1])}`,
+      deliveryUnitIdentityFixArea,
+    );
+    assertSelfCheck(
+      packageNameMatch?.[1] === vertical.deliveryUnit.packageName,
+      buildLabel,
+      `Expected packageName "${vertical.deliveryUnit.packageName}", found ${formatJson(packageNameMatch?.[1])}`,
+      deliveryUnitIdentityFixArea,
+    );
+    assertSelfCheck(
+      versionMatch?.[1] === vertical.deliveryUnit.version,
+      buildLabel,
+      `Expected version "${vertical.deliveryUnit.version}", found ${formatJson(versionMatch?.[1])}`,
+      deliveryUnitIdentityFixArea,
+    );
+    assertDeliveryUnitMarkerSpread(
+      ultramodernBuildSource,
+      'ultramodernUiMarker',
+      `${vertical.path}/shared/ultramodern-build.ts ultramodernUiMarker`,
+    );
+    assertDeliveryUnitMarkerSpread(
+      ultramodernBuildSource,
+      'ultramodernApiMarker',
+      `${vertical.path}/shared/ultramodern-build.ts ultramodernApiMarker`,
+    );
+  }
   assert(modernAppEnv.includes("import '@modern-js/app-tools/types';"), `${vertical.id} app env must import the framework-owned app ambient type bundle through module resolution`);
   assert(/declare global \{\s*const ULTRAMODERN_SITE_URL: string;\s*\}/u.test(modernAppEnv), `${vertical.id} app env must keep generated globals explicit after importing app ambient types`);
   assert(!modernAppEnv.includes("declare module '*.svg'"), `${vertical.id} app env must not redeclare framework-owned svg asset modules`);
@@ -2057,6 +2340,37 @@ for (const vertical of fullStackVerticals) {
   assert(topologyEntry?.api?.readiness?.endpoint === `/${vertical.stem}/readiness`, `${vertical.id} topology readiness endpoint is incorrect`);
   assert(Object.keys(topologyEntry?.api?.domainOperations ?? {}).length >= 3, `${vertical.id} topology domain operations are missing`);
 
+  if (vertical.deliveryUnit) {
+    const expectedDeliveryUnit = deliveryUnitBlock(vertical.deliveryUnit);
+    const compactAppEntry = ultramodernConfig.topology?.apps?.find(
+      entry => entry?.id === vertical.id,
+    );
+    assertSameJson(
+      deliveryUnitBlock(compactAppEntry?.deliveryUnit),
+      expectedDeliveryUnit,
+      `${compactConfigPath} topology.apps.${vertical.id}.deliveryUnit`,
+      deliveryUnitIdentityFixArea,
+    );
+    assertSameJson(
+      deliveryUnitBlock(compactAppEntry?.backendFederation?.deliveryUnit),
+      expectedDeliveryUnit,
+      `${compactConfigPath} topology.apps.${vertical.id}.backendFederation.deliveryUnit`,
+      deliveryUnitIdentityFixArea,
+    );
+    assertSelfCheck(
+      compactAppEntry?.backendFederation?.versionBoundary?.identityRoot === 'deliveryUnit',
+      `${compactConfigPath} topology.apps.${vertical.id}.backendFederation.versionBoundary.identityRoot`,
+      `Expected "deliveryUnit", found ${formatJson(compactAppEntry?.backendFederation?.versionBoundary?.identityRoot)}`,
+      deliveryUnitIdentityFixArea,
+    );
+    assertSameJson(
+      deliveryUnitBlock(compactAppEntry?.deliveryUnit),
+      deliveryUnitBlock(topologyEntry?.deliveryUnit),
+      `${compactConfigPath} vs topology/reference-topology.json verticals.${vertical.id}.deliveryUnit`,
+      deliveryUnitIdentityFixArea,
+    );
+  }
+
   assert(ownership.owners?.some(owner => owner.id === vertical.id && owner.path === vertical.path), `${vertical.id} ownership entry is missing`);
   assert(overlay.ports?.[vertical.id], `${vertical.id} development port is missing`);
   assert(overlay.manifests?.[vertical.id]?.includes('/mf-manifest.json'), `${vertical.id} development manifest is missing`);