@bleedingdev/modern-js-create 3.5.0-ultramodern.4 → 3.5.0-ultramodern.40

package/templates/workspace-scripts/validate-ultramodern-workspace.mjs.handlebars

@@ -8,6 +8,10 @@ const packageScope = '{{packageScope}}';
 const expectedNodeVersion = '{{nodeVersion}}';
 const tailwindEnabled = {{tailwindEnabledJson}};
 const fullStackVerticals = {{fullStackVerticalsJson}};
+// Backend-federation and Zerops runtime surfaces only exist when the workspace
+// exposes API-bearing verticals. Shell-only workspaces skip their
+// materialization during migrate, so the contract must not require them.
+const hasBackendSurfaces = fullStackVerticals.length > 0;
 const shellNamespace = {{shellNamespaceJson}};
 const oldRemotePaths = {{oldRemotePathsJson}};
 const expectedBuildScript = {{expectedBuildScriptJson}};
@@ -53,8 +57,18 @@ const assertExists = relativePath => {
 const assertNotExists = relativePath => {
   assert(!fs.existsSync(path.join(root, relativePath)), `Unexpected ${relativePath}`);
 };
+const assertAnyOf = relativePaths => {
+  assert(
+    relativePaths.some(relativePath =>
+      fs.existsSync(path.join(root, relativePath)),
+    ),
+    `Missing one of: ${relativePaths.join(', ')}`,
+  );
+};
 const formatJson = value =>
   value === undefined ? 'undefined' : JSON.stringify(value);
+const quoteYamlString = value => `'${String(value).replace(/'/gu, "''")}'`;
+const quoteShellValue = value => `'${String(value).replace(/'/gu, "'\\''")}'`;
 const selfCheckFailure = (contract, message, fixArea) =>
   `MicroVertical contract self-check failed: ${contract}. ${message}. Fix area: ${fixArea}.`;
 const assertSelfCheck = (condition, contract, message, fixArea) => {
@@ -136,6 +150,41 @@ const buildMarkerFor = app =>
     .update(`${packageScope}:${app.packageSuffix}:${app.id}:0.1.0`)
     .digest('hex')
     .slice(0, 16);
+const deliveryUnitIdentityFixArea =
+  'regenerate vertical identity from delivery-unit record; do not hand-edit surface markers';
+const deliveryUnitBlock = record => ({
+  schemaVersion: record?.schemaVersion,
+  kind: record?.kind,
+  unitId: record?.unitId,
+  packageName: record?.packageName,
+  version: record?.version,
+  buildMarker: record?.buildMarker,
+  sourceRevision: record?.sourceRevision,
+});
+const compactDeliveryUnitFor = id => {
+  const compactApp = ultramodernConfig.topology?.apps?.find(
+    entry => entry?.id === id,
+  );
+  return (
+    compactApp?.backendFederation?.deliveryUnit ?? compactApp?.deliveryUnit
+  );
+};
+const expectedDeliveryUnitFor = (vertical, topologyEntry) =>
+  compactDeliveryUnitFor(vertical.id) ??
+  topologyEntry?.backendFederation?.deliveryUnit ??
+  topologyEntry?.deliveryUnit ??
+  vertical.deliveryUnit;
+const assertBuildFacadeExport = (source, exportName, sourcePath, contract) => {
+  const exportPattern = new RegExp(
+    `export const ${exportName} = ${sourcePath.replace(/\./gu, '\\.')};`,
+  );
+  assertSelfCheck(
+    exportPattern.test(source),
+    contract,
+    `${exportName} must re-export the canonical ultramodern-build.json artifact rather than hand-forking fields`,
+    deliveryUnitIdentityFixArea,
+  );
+};
 const normalizeCompactApp = rawApp => {
   const id = String(rawApp.id);
   const kind = rawApp.kind === 'vertical' ? 'vertical' : 'shell';
@@ -210,6 +259,14 @@ const normalizeCompactApp = rawApp => {
     verticalRefs: Array.isArray(moduleFederation.verticalRefs)
       ? moduleFederation.verticalRefs.filter(ref => typeof ref === 'string')
       : [],
+    deliveryUnit:
+      rawApp.deliveryUnit && typeof rawApp.deliveryUnit === 'object'
+        ? rawApp.deliveryUnit
+        : undefined,
+    backendFederation:
+      rawApp.backendFederation && typeof rawApp.backendFederation === 'object'
+        ? rawApp.backendFederation
+        : undefined,
     api,
   };
 };
@@ -486,7 +543,7 @@ const createAppConfigContract = app => ({
     'zephyrRspackPlugin',
   ],
   dev: {
-    assetPrefix: '/',
+    assetPrefix: app.kind === 'shell' ? '/' : 'app-public-origin',
   },
   output: {
     assetPrefix: {
@@ -625,20 +682,20 @@ const createAppContract = (app, apps) => ({
       : {}),
     exposes: app.exposes,
     dts: {
-      compilerInstance: 'tsgo',
+      compilerInstance: 'effect-tsgo',
       displayErrorInTerminal: true,
       tsConfigPath: './tsconfig.mf-types.json',
     },
     browserSafeExposesOnly: true,
   },
-  marker: {
-    appId: app.id,
-    packageName: app.package ?? packageNameFor(packageScope, app.packageSuffix),
-    version: '0.1.0',
-    build: buildMarkerFor(app),
-    deployProfile: 'cloudflare-ssr-mf-effect-v1',
-    uiSurface: 'ui',
-    ...(app.api ? { apiSurface: 'api' } : {}),
+    marker: {
+      appId: app.id,
+      packageName: app.package ?? packageNameFor(packageScope, app.packageSuffix),
+      version: '0.1.0',
+      build: app.deliveryUnit?.buildMarker ?? buildMarkerFor(app),
+      deployProfile: 'cloudflare-ssr-mf-effect-v1',
+      uiSurface: 'ui',
+      ...(app.api ? { apiSurface: 'api' } : {}),
   },
   ...(app.api
     ? {
@@ -772,6 +829,107 @@ const expectedManifestUrl = vertical =>
   `http://localhost:${vertical.port}/mf-manifest.json`;
 const expectedApiUrl = vertical =>
   `http://localhost:${vertical.port}${vertical.apiPrefix}`;
+const expectedBackendFederationName = vertical => `${vertical.mfName}Backend`;
+const expectedBackendManifestUrl = vertical =>
+  `http://localhost:${vertical.port}/backend-mf-manifest.json`;
+const expectedBackendContainerEntry = vertical =>
+  `http://localhost:${vertical.port}/backendRemoteEntry.mjs`;
+const expectedBackendManifestEnv = vertical =>
+  `VERTICAL_${toEnvSegment(vertical.domain ?? vertical.id)}_BACKEND_MF_MANIFEST`;
+const expectedPublicUrlEnv = vertical =>
+  `ULTRAMODERN_PUBLIC_URL_${toEnvSegment(vertical.id)}`;
+const expectedCloudflareWorkerName = vertical =>
+  toKebabCase(`${packageScope}-${vertical.packageSuffix ?? vertical.id}`).slice(
+    0,
+    63,
+  );
+const backendFederationSubset = backendFederation => ({
+  role: backendFederation?.role,
+  name: backendFederation?.name,
+  runtimeFramework: backendFederation?.runtimeFramework,
+  strictEffectApproach: backendFederation?.strictEffectApproach,
+  exposeRuntime: backendFederation?.exposes?.['./effect-api']?.runtime,
+  exposeReadiness: backendFederation?.exposes?.['./effect-api']?.readiness,
+  versionBoundary: {
+    invariant: backendFederation?.versionBoundary?.invariant,
+    uiManifestUrl: backendFederation?.versionBoundary?.ui?.manifestUrl,
+    apiReadiness: backendFederation?.versionBoundary?.api?.readiness,
+  },
+  cloudflare: {
+    kind: backendFederation?.executionSurfaces?.cloudflare?.kind,
+    workerName: backendFederation?.executionSurfaces?.cloudflare?.workerName,
+    publicUrlEnv:
+      backendFederation?.executionSurfaces?.cloudflare?.publicUrlEnv,
+    zephyrRuntime:
+      backendFederation?.executionSurfaces?.cloudflare?.zephyr?.runtime,
+  },
+  node: {
+    kind: backendFederation?.executionSurfaces?.node?.kind,
+    remoteName: backendFederation?.executionSurfaces?.node?.remoteName,
+    manifestEnv: backendFederation?.executionSurfaces?.node?.manifestEnv,
+    manifestUrl: backendFederation?.executionSurfaces?.node?.manifestUrl,
+    containerEntry:
+      backendFederation?.executionSurfaces?.node?.containerEntry,
+    remoteType: backendFederation?.executionSurfaces?.node?.remoteType,
+    expose: backendFederation?.executionSurfaces?.node?.expose,
+  },
+  compatibility: {
+    contractVersion: backendFederation?.compatibility?.contractVersion,
+  },
+  topLevelManifestUrl: backendFederation?.manifestUrl,
+  topLevelContainerEntry: backendFederation?.containerEntry,
+});
+const expectedBackendFederationSubset = vertical => ({
+  role: 'microvertical-server',
+  name: expectedBackendFederationName(vertical),
+  runtimeFramework: 'effect',
+  strictEffectApproach: true,
+  exposeRuntime: `${vertical.path}/api/index.ts`,
+  exposeReadiness: `${vertical.apiPrefix}/${vertical.stem}/readiness`,
+  versionBoundary: {
+    invariant: 'web-and-api-same-build',
+    uiManifestUrl: expectedManifestUrl(vertical),
+    apiReadiness: `${vertical.apiPrefix}/${vertical.stem}/readiness`,
+  },
+  cloudflare: {
+    kind: 'cloudflare-worker-snapshot',
+    workerName: expectedCloudflareWorkerName(vertical),
+    publicUrlEnv: expectedPublicUrlEnv(vertical),
+    zephyrRuntime: 'ssr-worker',
+  },
+  node: {
+    kind: 'node-mf-runtime',
+    remoteName: expectedBackendFederationName(vertical),
+    manifestEnv: expectedBackendManifestEnv(vertical),
+    manifestUrl: expectedBackendManifestUrl(vertical),
+    containerEntry: expectedBackendContainerEntry(vertical),
+    remoteType: 'module',
+    expose: './effect-api',
+  },
+  compatibility: {
+    contractVersion: 'microvertical-server-effect-v1',
+  },
+  topLevelManifestUrl: undefined,
+  topLevelContainerEntry: undefined,
+});
+const serverExecutionSubset = serverExecution => ({
+  apiBaseUrl: serverExecution?.apiBaseUrl,
+  versionBoundary: serverExecution?.versionBoundary,
+  cloudflareKind: serverExecution?.cloudflare?.kind,
+  cloudflareWorkerName: serverExecution?.cloudflare?.workerName,
+  nodeKind: serverExecution?.node?.kind,
+  nodeManifestUrl: serverExecution?.node?.manifestUrl,
+  nodeContainerEntry: serverExecution?.node?.containerEntry,
+});
+const expectedServerExecutionSubset = vertical => ({
+  apiBaseUrl: expectedApiUrl(vertical),
+  versionBoundary: 'web-and-api-same-build',
+  cloudflareKind: 'cloudflare-worker-snapshot',
+  cloudflareWorkerName: expectedCloudflareWorkerName(vertical),
+  nodeKind: 'node-mf-runtime',
+  nodeManifestUrl: expectedBackendManifestUrl(vertical),
+  nodeContainerEntry: expectedBackendContainerEntry(vertical),
+});
 const remoteContractSubset = remote => ({
   id: remote?.id,
   name: remote?.name,
@@ -791,9 +949,11 @@ const requiredMicroVerticalPaths = vertical => [
   `${vertical.path}/package.json`,
   `${vertical.path}/tsconfig.json`,
   `${vertical.path}/tsconfig.mf-types.json`,
-  `${vertical.path}/modern.config.ts`,
-  `${vertical.path}/module-federation.config.ts`,
-  `${vertical.path}/api/index.ts`,
+    `${vertical.path}/modern.config.ts`,
+    `${vertical.path}/module-federation.config.ts`,
+    `${vertical.path}/backend-federation.config.ts`,
+    `${vertical.path}/api/effect-api.ts`,
+    `${vertical.path}/api/index.ts`,
   `${vertical.path}/shared/api.ts`,
   `${vertical.path}/src/api/${vertical.stem}-client.ts`,
   `${vertical.path}/src/modern-app-env.d.ts`,
@@ -988,6 +1148,36 @@ const assertMicroVerticalContractGraph = ({
       `topology/reference-topology.json verticals.${vertical.id}`,
       'restore generated topology vertical entries',
     );
+ assertSameJson(
+ backendFederationSubset(topologyEntry.backendFederation),
+ expectedBackendFederationSubset(vertical),
+ `topology/reference-topology.json verticals.${vertical.id}.backendFederation`,
+ 'restore generated MicroVertical server execution contract',
+ );
+
+    if (vertical.deliveryUnit) {
+ const expectedDeliveryUnit = deliveryUnitBlock(
+ expectedDeliveryUnitFor(vertical, topologyEntry),
+ );
+      assertSameJson(
+        deliveryUnitBlock(topologyEntry.deliveryUnit),
+        expectedDeliveryUnit,
+        `topology/reference-topology.json verticals.${vertical.id}.deliveryUnit`,
+        deliveryUnitIdentityFixArea,
+      );
+      assertSameJson(
+        deliveryUnitBlock(topologyEntry.backendFederation?.deliveryUnit),
+        expectedDeliveryUnit,
+        `topology/reference-topology.json verticals.${vertical.id}.backendFederation.deliveryUnit`,
+        deliveryUnitIdentityFixArea,
+      );
+      assertSelfCheck(
+        topologyEntry.backendFederation?.versionBoundary?.identityRoot === 'deliveryUnit',
+        `topology/reference-topology.json verticals.${vertical.id}.backendFederation.versionBoundary.identityRoot`,
+        `Expected "deliveryUnit", found ${formatJson(topologyEntry.backendFederation?.versionBoundary?.identityRoot)}`,
+        deliveryUnitIdentityFixArea,
+      );
+    }
 
     assertObject(
       ownershipEntry,
@@ -1025,6 +1215,13 @@ const assertMicroVerticalContractGraph = ({
       `topology/local-overlays/development.json apis.${vertical.id}`,
       'restore generated local API overlay',
     );
+ assertSameJson(
+ serverExecutionSubset(overlay.serverExecution?.[vertical.id]),
+ expectedServerExecutionSubset(vertical),
+ `topology/local-overlays/development.json serverExecution.${vertical.id}`,
+ 'restore generated local MicroVertical server execution overlay',
+ );
+
 
     assertSameJson(
       shellPackage.dependencies?.[vertical.packageName],
@@ -1116,6 +1313,7 @@ const assertProjectReferenceEmitConfig = (tsConfig, packagePath) => {
   );
 };
 const assertTsConfigReferenceGraph = () => {
+  const baseTsConfig = readJson('tsconfig.base.json');
   const rootTsConfig = readJson('tsconfig.json');
   const shellTsConfig = readJson('apps/shell-super-app/tsconfig.json');
   const shellMfTypesTsConfig = readJson(
@@ -1151,6 +1349,13 @@ const assertTsConfigReferenceGraph = () => {
     'apps/shell-super-app/tsconfig.json references',
     'restore the generated shell project-reference graph',
   );
+  assert(baseTsConfig.compilerOptions?.skipLibCheck !== true, 'tsconfig.base.json must not use skipLibCheck');
+  assertSameJson(
+    shellTsConfig.include ?? [],
+    ['src', 'locales/**/*.json', 'package.json', 'shared'],
+    'apps/shell-super-app/tsconfig.json include',
+    'restore the generated shell typecheck boundary',
+  );
   assertProjectReferenceEmitConfig(
     shellTsConfig,
     'apps/shell-super-app',
@@ -1158,7 +1363,7 @@ const assertTsConfigReferenceGraph = () => {
   assertSameJson(
     shellMfTypesTsConfig,
     {
-      extends: './tsconfig.json',
+      extends: '../../tsconfig.base.json',
       include: ['src/modern-app-env.d.ts'],
     },
     'apps/shell-super-app/tsconfig.mf-types.json',
@@ -1191,11 +1396,17 @@ const assertTsConfigReferenceGraph = () => {
       `${vertical.path}/tsconfig.json references`,
       'restore the generated MicroVertical project-reference graph',
     );
+    assertSameJson(
+      verticalTsConfig.include ?? [],
+      ['src', 'locales/**/*.json', 'package.json', 'shared', 'api'],
+      `${vertical.path}/tsconfig.json include`,
+      'restore the generated MicroVertical typecheck boundary',
+    );
     assertProjectReferenceEmitConfig(verticalTsConfig, vertical.path);
     assertSameJson(
       verticalMfTypesTsConfig,
       {
-        extends: './tsconfig.json',
+        extends: '../../tsconfig.base.json',
         include: [
           'src/federation-entry.tsx',
           ...vertical.componentPaths.map(componentPath =>
@@ -1216,7 +1427,7 @@ const packageJsonFiles = startDir => {
     const current = queue.shift();
     for (const entry of fs.readdirSync(current, { withFileTypes: true })) {
       if (
-        ['.git', '.output', 'dist', 'node_modules', 'repos'].includes(
+      ['.git', '.output', '.zerops', 'dist', 'node_modules', 'repos'].includes(
           entry.name,
         )
       ) {
@@ -1349,6 +1560,33 @@ const extractAssetPrefixExpression = modernConfig => {
   assert(match?.groups?.expression, 'modern.config.ts must assign assetPrefix');
   return match.groups.expression;
 };
+const assertTargetIsolatedBuildArtifacts = (appId, modernConfig) => {
+  assert(
+    modernConfig.includes("const buildTarget = cloudflareDeployEnabled ? 'cloudflare' : 'web';") &&
+      modernConfig.includes("const buildOutputRoot = cloudflareDeployEnabled ? 'dist-cloudflare' : 'dist';") &&
+      modernConfig.includes('const buildTempDirectory = `node_modules/.modern-js-${appId}-${buildTarget}`;') &&
+      modernConfig.includes('const buildCacheDirectory = `node_modules/.cache/rspack-${appId}-${buildTarget}`;') &&
+      modernConfig.includes('root: buildOutputRoot,') &&
+      modernConfig.includes('tempDir: buildTempDirectory,') &&
+      modernConfig.includes('cacheDigest: [appId, buildTarget],') &&
+      modernConfig.includes('cacheDirectory: buildCacheDirectory,'),
+    `${appId} must isolate build output, Modern temp files, and Rspack cache by app and build target`,
+  );
+};
+const assertCloudflareBuildSkipsDeployRebuild = (appId, packageJson) => {
+  assert(
+    packageJson.scripts?.['cloudflare:build']?.includes(
+      'ULTRAMODERN_ZEPHYR=false MODERNJS_DEPLOY=cloudflare modern deploy --skip-build',
+    ),
+    `${appId} cloudflare:build must deploy with --skip-build after the explicit Cloudflare build`,
+  );
+  assert(
+    !packageJson.scripts?.['cloudflare:build']?.includes(
+      '--target dist && ULTRAMODERN_ZEPHYR=false MODERNJS_DEPLOY=cloudflare modern deploy',
+    ),
+    `${appId} cloudflare:build must not write public-surface assets into the normal web dist before deploy`,
+  );
+};
 const stripYamlInlineComment = value => {
   let quote = undefined;
   for (let index = 0; index < value.length; index += 1) {
@@ -1462,6 +1700,9 @@ const requiredPaths = [
   '.gitignore',
   'package.json',
   'pnpm-workspace.yaml',
+  'patches/@module-federation__modern-js-v3@{{moduleFederationVersion}}.patch',
+  'patches/@module-federation__bridge-react@{{moduleFederationVersion}}.patch',
+  'patches/effect-schema-error-type-id.patch',
   'tsconfig.json',
   'tsconfig.base.json',
   'oxlint.config.ts',
@@ -1469,8 +1710,6 @@ const requiredPaths = [
   '.github/renovate.json',
   '.github/workflows/ultramodern-workspace-gates.yml',
   '.agents/agent-reference-repos.json',
-  '.codex/skills-lock.json',
-  '.codex/rstackjs-agent-skills-LICENSE',
   'topology/reference-topology.json',
   'topology/ownership.json',
   'topology/local-overlays/development.json',
@@ -1478,13 +1717,17 @@ const requiredPaths = [
   'scripts/bootstrap-agent-skills.mts',
   'scripts/check-ultramodern-api-boundaries.mts',
   'scripts/check-ultramodern-i18n-boundaries.mts',
+  ...(hasBackendSurfaces ? ['scripts/generate-node-backend-federation.mts'] : []),
   'scripts/generate-public-surface-assets.mts',
+  'scripts/generate-tanstack-routes.mts',
   'scripts/proof-cloudflare-version.mts',
+  ...(hasBackendSurfaces ? ['scripts/proof-node-backend-federation.mts'] : []),
   'scripts/setup-agent-reference-repos.mts',
   'scripts/ultramodern-performance-readiness.config.mjs',
   'scripts/ultramodern-performance-readiness.mts',
   'scripts/ultramodern-typecheck.mts',
   'scripts/validate-ultramodern-workspace.mts',
+  'scripts/verify-cloudflare-output.mts',
   'apps/shell-super-app/package.json',
   'apps/shell-super-app/tsconfig.json',
   'apps/shell-super-app/tsconfig.mf-types.json',
@@ -1518,10 +1761,8 @@ for (const vertical of fullStackVerticals) {
 
 if (tailwindEnabled) {
   requiredPaths.push(
-    'apps/shell-super-app/postcss.config.mjs',
     'apps/shell-super-app/tailwind.config.ts',
     ...fullStackVerticals.flatMap(vertical => [
-      `${vertical.path}/postcss.config.mjs`,
       `${vertical.path}/tailwind.config.ts`,
     ]),
   );
@@ -1537,6 +1778,40 @@ for (const vertical of fullStackVerticals) {
 for (const requiredPath of requiredPaths) {
   assertExists(requiredPath);
 }
+// Agent skills metadata may live under .agents/ (agents-standard layout) or
+// .codex/ (legacy scaffold default).
+assertAnyOf(['.agents/skills-lock.json', '.codex/skills-lock.json']);
+assertAnyOf([
+  '.agents/rstackjs-agent-skills-LICENSE',
+  '.codex/rstackjs-agent-skills-LICENSE',
+]);
+const pnpmWorkspace = readText('pnpm-workspace.yaml');
+assert(
+  pnpmWorkspace.includes("'@effect/opentelemetry': {{effectVersion}}"),
+  'pnpm-workspace.yaml must override @effect/opentelemetry to the generated Effect cohort',
+);
+assert(
+  pnpmWorkspace.includes('effect: {{effectVersion}}'),
+  'pnpm-workspace.yaml must override effect to the generated Effect cohort',
+);
+assert(
+  pnpmWorkspace.includes(
+    "'@module-federation/modern-js-v3@{{moduleFederationVersion}}': patches/@module-federation__modern-js-v3@{{moduleFederationVersion}}.patch",
+  ),
+  'pnpm-workspace.yaml must patch the generated Module Federation Modern.js integration cohort',
+);
+assert(
+  pnpmWorkspace.includes(
+    "'@module-federation/bridge-react@{{moduleFederationVersion}}': patches/@module-federation__bridge-react@{{moduleFederationVersion}}.patch",
+  ),
+  'pnpm-workspace.yaml must patch the generated Module Federation React bridge cohort',
+);
+assert(
+  pnpmWorkspace.includes(
+    "'effect@{{effectVersion}}': patches/effect-schema-error-type-id.patch",
+  ),
+  'pnpm-workspace.yaml must patch the generated Effect declaration cohort',
+);
 for (const oldRemotePath of oldRemotePaths) {
   assertNotExists(oldRemotePath);
 }
@@ -1605,6 +1880,11 @@ assert(
     expectedModernPackageSpecifier('@modern-js/code-tools'),
   'Root must depend on @modern-js/code-tools through package source metadata',
 );
+assert(
+  rootPackage.devDependencies?.['@modern-js/plugin-bff'] ===
+    expectedModernPackageSpecifier('@modern-js/plugin-bff'),
+  'Root must depend on @modern-js/plugin-bff for Node backend federation proof',
+);
 if (packageSource.strategy === 'install') {
   const installSpecifier = packageSource.modernPackages?.specifier;
   assert(
@@ -1664,20 +1944,75 @@ if (bridgeConfig) {
   }
   assert(rootPackage.scripts?.['bridge:check'], 'Bridge workspaces must expose bridge:check');
 } else {
-  assert(rootPackage.scripts?.typecheck === 'node ./scripts/ultramodern-typecheck.mts --build tsconfig.json', 'Root typecheck must run TS-Go build mode across project references');
+  assert(rootPackage.scripts?.typecheck === 'node ./scripts/ultramodern-typecheck.mts --project tsconfig.json', 'Root typecheck must run TS-Go across the root project reference graph');
 }
 assert(rootPackage.scripts?.['contract:check'] === 'node ./scripts/validate-ultramodern-workspace.mts', 'Root must expose contract:check');
 assert(rootPackage.scripts?.['api:check'] === 'node ./scripts/check-ultramodern-api-boundaries.mts', 'Root must expose api:check');
 assert(rootPackage.scripts?.['i18n:boundaries'] === 'node ./scripts/check-ultramodern-i18n-boundaries.mts', 'Root must expose i18n:boundaries');
 assert(rootPackage.scripts?.['performance:readiness'] === 'node ./scripts/ultramodern-performance-readiness.mts', 'Root must expose default-on performance readiness diagnostics');
+if (hasBackendSurfaces) {
+  assert(rootPackage.scripts?.['node:backend-federation:generate'] === 'node ./scripts/generate-node-backend-federation.mts', 'Root must expose local Node backend federation artifact generation');
+  assert(rootPackage.scripts?.['zerops:materialize'] === 'node ./scripts/materialize-zerops-runtime.mjs', 'Root must expose Zerops runtime materialization script');
+  assert(
+    rootPackage.scripts?.['node:proof'] ===
+      'pnpm node:backend-federation:generate && node ./scripts/proof-node-backend-federation.mts',
+    'Root must expose node:proof for backend federation Effect modules',
+  );
+}
+assertNotExists('scripts/generate-node-backend-federation.mjs');
+assertNotExists('scripts/proof-node-backend-federation.mjs');
+assertNotExists('scripts/verify-cloudflare-output.mjs');
+assertNotExists('scripts/generate-tanstack-routes.mjs');
 assert(
-  bridgeConfig
-    ? rootPackage.scripts?.check?.includes('pnpm api:check') &&
-        rootPackage.scripts.check.endsWith('&& pnpm performance:readiness && pnpm bridge:check')
-    : rootPackage.scripts?.check?.includes('pnpm api:check') &&
-        rootPackage.scripts.check.endsWith('&& pnpm performance:readiness'),
-  'Root check must run default-on performance readiness diagnostics and bridge gates when configured',
+  rootPackage.scripts?.check?.includes('pnpm api:check') &&
+    (hasBackendSurfaces
+      ? rootPackage.scripts.check.includes('pnpm node:proof')
+      : !rootPackage.scripts.check.includes('pnpm node:proof')) &&
+    rootPackage.scripts.check.endsWith(
+      bridgeConfig
+        ? '&& pnpm performance:readiness && pnpm bridge:check'
+        : '&& pnpm performance:readiness',
+    ),
+  'Root check must run Node backend federation proof when backend surfaces exist, default-on performance readiness diagnostics, and bridge gates when configured',
 );
+if (hasBackendSurfaces) {
+  const zeropsYaml = readText('zerops.yaml');
+  assert(zeropsYaml.includes('zerops:'), 'Zerops manifest must include zerops services');
+  assert(zeropsYaml.includes(`setup: ${quoteYamlString('shell-super-app')}`), 'Zerops manifest must include shell service');
+  assert(zeropsYaml.includes(`base: ${quoteYamlString('nodejs@26')}`), 'Zerops manifest must use generated Node runtime major');
+  assert(zeropsYaml.includes('deployFiles:'), 'Zerops manifest must deploy package-pruned runtime directories');
+  assert(
+    zeropsYaml.includes(`start: cd ${quoteShellValue('.zerops/runtime/shell-super-app')} && npm run serve`),
+    'Zerops shell service must start from materialized runtime package',
+  );
+  assert(
+    zeropsYaml.includes('SHELL_SUPER_APP_PORT:') &&
+      zeropsYaml.includes('ULTRAMODERN_ZEROPS_SERVICE:'),
+    'Zerops manifest must expose service identity and ports',
+  );
+  for (const vertical of fullStackVerticals) {
+    assert(zeropsYaml.includes(`setup: ${quoteYamlString(vertical.id)}`), `${vertical.id} must have a Zerops service`);
+    assert(
+      zeropsYaml.includes(`~/.local/bin/mise exec -- pnpm run zerops:materialize -- --app ${quoteShellValue(vertical.id)} --package ${quoteShellValue(vertical.packageName)} --package-dir ${quoteShellValue(vertical.path)}`),
+      `${vertical.id} Zerops service must materialize its runtime package`,
+    );
+    assert(
+      zeropsYaml.includes(`path: ${quoteYamlString(`${vertical.apiPrefix}/${vertical.stem}/readiness`)}`),
+      `${vertical.id} BFF readiness path must use generated API prefix`,
+    );
+  }
+  const zeropsMaterializer = readText('scripts/materialize-zerops-runtime.mjs');
+  assert(zeropsMaterializer.includes("MODERNJS_DEPLOY: 'node'"), 'Zerops materializer must use Modern.js Node deploy target');
+  assert(/'deploy',\s*'--skip-build'/.test(zeropsMaterializer), 'Zerops materializer must pass --skip-build directly to Modern deploy');
+  assert(zeropsMaterializer.includes('normalizeRuntimePackageDependencies'), 'Zerops materializer must normalize generated Modern package aliases before installing dependencies');
+  assert(zeropsMaterializer.includes('officialPackageName'), 'Zerops materializer must add official Modern.js npm aliases for generated runtime imports');
+  assert(zeropsMaterializer.includes('installRuntimeDependencies'), 'Zerops materializer must install dependencies outside the workspace copy runtime node_modules');
+  assert(zeropsMaterializer.includes('copyWorkspacePackage'), 'Zerops materializer must preserve generated local workspace package dependencies');
+  assert(zeropsMaterializer.includes('makeWorkspacePackageRuntimeSafe'), 'Zerops materializer must rewrite copied workspace packages to runtime-safe JavaScript exports');
+  assert(zeropsMaterializer.includes("serve: runtimePackage.scripts?.serve ?? 'node index.js'"), 'Zerops materializer must preserve runtime serve script fallback');
+  assert(/'install',\s*'--omit=dev'/.test(zeropsMaterializer), 'Zerops materializer must omit dev dependencies from runtime installs');
+  assert(zeropsMaterializer.includes("'--legacy-peer-deps'"), 'Zerops materializer must tolerate generated-workspace peer dependency ranges in npm runtime install');
+}
 const performanceReadinessConfig = readText('scripts/ultramodern-performance-readiness.config.mjs');
 const assertToolWrapper = (scriptPath, command) => {
   const source = readText(scriptPath);
@@ -1708,8 +2043,14 @@ assert(rootPackage.scripts?.postinstall === "oxfmt . '!repos/**' && node ./scrip
 assert(rootPackage.scripts?.['agents:refs:install'] === 'node ./scripts/setup-agent-reference-repos.mts', 'Root must expose agents:refs:install as the explicit reference repo installer');
 const agentSkillsBootstrap = readText('scripts/bootstrap-agent-skills.mts');
 assertToolWrapper('scripts/assert-mf-types.mts', 'mf-types');
+if (hasBackendSurfaces) {
+  assertToolWrapper('scripts/generate-node-backend-federation.mts', 'backend-federation-generate');
+  assertToolWrapper('scripts/proof-node-backend-federation.mts', 'backend-federation-proof');
+}
 assertToolWrapper('scripts/generate-public-surface-assets.mts', 'public-surface');
+assertToolWrapper('scripts/generate-tanstack-routes.mts', 'routes-generate');
 assertToolWrapper('scripts/proof-cloudflare-version.mts', 'cloudflare-proof');
+assertToolWrapper('scripts/verify-cloudflare-output.mts', 'cloudflare-output-verify');
 assertToolWrapper('scripts/migrate-strict-effect.mts', 'migrate-strict-effect');
 assertToolWrapper('scripts/bootstrap-agent-skills.mts', 'skills');
 assert(!agentSkillsBootstrap.includes("run('brew'") && !agentSkillsBootstrap.includes('runShell('), 'Agent skills bootstrap must never invoke system package managers');
@@ -1751,8 +2092,17 @@ assert(JSON.stringify(generatedContract.performanceReadiness?.signals?.map(signa
 
 const shellModernConfig = readText('apps/shell-super-app/modern.config.ts');
 const shellModuleFederationConfig = readText('apps/shell-super-app/module-federation.config.ts');
+const shellModernAppEnv = readText('apps/shell-super-app/src/modern-app-env.d.ts');
+const gitignore = readText('.gitignore');
 const shellRouteHead = readText('apps/shell-super-app/src/routes/ultramodern-route-head.tsx');
 const shellRouteMetadata = readText('apps/shell-super-app/src/routes/ultramodern-route-metadata.ts');
+assert(/^\.mf\/$/mu.test(gitignore), 'Generated .gitignore must ignore root Module Federation diagnostics');
+assert(/^\*\*\/\.mf\/$/mu.test(gitignore), 'Generated .gitignore must ignore per-app Module Federation diagnostics');
+assert(/^dist-cloudflare\/$/mu.test(gitignore), 'Generated .gitignore must ignore Cloudflare build output');
+assert(shellModernAppEnv.includes("import '@modern-js/app-tools/types';"), 'Shell app env must import the framework-owned app ambient type bundle through module resolution');
+assert(/declare global \{\s*const ULTRAMODERN_SITE_URL: string;\s*\}/u.test(shellModernAppEnv), 'Shell app env must keep generated globals explicit after importing app ambient types');
+assert(!shellModernAppEnv.includes("declare module '*.svg'"), 'Shell app env must not redeclare framework-owned svg asset modules');
+assert(!shellModernAppEnv.includes("declare module '*.css'"), 'Shell app env must not redeclare framework-owned css asset modules');
 assert(shellRouteMetadata.includes('@generated by @modern-js/create'), 'Shell route metadata compatibility manifest must be marked generated');
 assert(shellRouteMetadata.includes("authoring: 'colocated-route-meta'"), 'Shell route metadata manifest must advertise colocated authoring');
 const expectedZephyrDependencies = Object.fromEntries(
@@ -1771,6 +2121,9 @@ assert(shellPackage.dependencies?.['@modern-js/plugin-bff'] === expectedModernPa
 assert(shellPackage.dependencies?.['@modern-js/plugin-i18n'] === expectedModernPackageSpecifier('@modern-js/plugin-i18n'), 'Shell plugin-i18n dependency must match package source metadata');
 assert(shellPackage.dependencies?.['@modern-js/plugin-tanstack'] === expectedModernPackageSpecifier('@modern-js/plugin-tanstack'), 'Shell plugin-tanstack dependency must match package source metadata');
 assert(shellPackage.dependencies?.['@modern-js/runtime'] === expectedModernPackageSpecifier('@modern-js/runtime'), 'Shell runtime dependency must match package source metadata');
+assert(shellPackage.scripts?.['cloudflare:deploy'] === 'ULTRAMODERN_CLOUDFLARE_REQUIRE_PUBLIC_URLS=true pnpm run cloudflare:build && wrangler deploy --config .output/wrangler.json', 'Shell must expose cloudflare:deploy');
+assertTargetIsolatedBuildArtifacts('shell-super-app', shellModernConfig);
+assertCloudflareBuildSkipsDeployRebuild('shell-super-app', shellPackage);
 const shellContract = generatedContract.apps?.find(app => app.id === 'shell-super-app');
 assert(shellContract?.deploy?.cloudflare?.workerName === expectedWorkerName('shell-super-app'), 'Shell Cloudflare workerName is incorrect');
 assert(shellContract?.deploy?.cloudflare?.publicUrlEnv === 'ULTRAMODERN_PUBLIC_URL_SHELL_SUPER_APP', 'Shell Cloudflare public URL env is incorrect');
@@ -1803,7 +2156,7 @@ assert(shellContract?.config?.performance?.readinessDiagnostics?.optOut?.env ===
 assert(JSON.stringify(shellContract?.config?.source?.siteUrl?.envFallbackOrder) === JSON.stringify(['MODERN_PUBLIC_SITE_URL', 'ULTRAMODERN_PUBLIC_URL_SHELL_SUPER_APP', 'ULTRAMODERN_CLOUDFLARE_WORKERS_DEV_SUBDOMAIN', 'SHELL_SUPER_APP_PORT']), 'Shell site URL env fallback order is incorrect');
 assert(shellContract?.config?.rspack?.output?.uniqueName === 'shellSuperApp', 'Shell Rspack uniqueName is incorrect');
 assert(shellContract?.config?.rspack?.output?.chunkLoadingGlobal === expectedChunkLoadingGlobal('shellSuperApp'), 'Shell Rspack chunkLoadingGlobal is incorrect');
-assert(shellContract?.moduleFederation?.dts?.compilerInstance === 'tsgo', 'Shell must keep mandatory DTS compiler');
+assert(shellContract?.moduleFederation?.dts?.compilerInstance === 'effect-tsgo', 'Shell must keep mandatory DTS compiler');
 assert(shellContract?.moduleFederation?.dts?.tsConfigPath === './tsconfig.mf-types.json', 'Shell must keep dedicated Module Federation DTS tsconfig');
 assert(shellModuleFederationConfig.includes("tsConfigPath: './tsconfig.mf-types.json'"), 'Shell Module Federation config must use the dedicated DTS tsconfig');
 assert(topology.shell?.cloudflare?.workerName === expectedWorkerName('shell-super-app'), 'Shell topology Cloudflare workerName is incorrect');
@@ -1841,12 +2194,71 @@ for (const vertical of fullStackVerticals) {
   const packageJson = readJson(`${vertical.path}/package.json`);
   const modernConfig = readText(`${vertical.path}/modern.config.ts`);
   const moduleFederationConfig = readText(`${vertical.path}/module-federation.config.ts`);
+  const modernAppEnv = readText(`${vertical.path}/src/modern-app-env.d.ts`);
   const routeHead = readText(`${vertical.path}/src/routes/ultramodern-route-head.tsx`);
   const routeMetadata = readText(`${vertical.path}/src/routes/ultramodern-route-metadata.ts`);
+  const ultramodernBuildSource = readText(`${vertical.path}/shared/ultramodern-build.ts`);
+  const ultramodernBuildArtifact = readJson(`${vertical.path}/shared/ultramodern-build.json`);
+  if (vertical.deliveryUnit) {
+    const topologyEntry = findById(topology.verticals, vertical.id);
+    const expectedDeliveryUnit = deliveryUnitBlock(
+      expectedDeliveryUnitFor(vertical, topologyEntry),
+    );
+    const buildLabel = `${vertical.path}/shared/ultramodern-build.json deliveryUnit`;
+    assertSelfCheck(
+      ultramodernBuildSource.includes('export const ultramodernDeliveryUnit'),
+      buildLabel,
+      'Missing ultramodernDeliveryUnit export',
+      deliveryUnitIdentityFixArea,
+    );
+    const buildIdentity = ultramodernBuildArtifact.deliveryUnit ?? {};
+    assertSelfCheck(
+      buildIdentity.buildMarker === expectedDeliveryUnit.buildMarker,
+      buildLabel,
+      `Expected build "${expectedDeliveryUnit.buildMarker}", found ${formatJson(buildIdentity.buildMarker)}`,
+      deliveryUnitIdentityFixArea,
+    );
+    assertSelfCheck(
+      buildIdentity.unitId === expectedDeliveryUnit.unitId,
+      buildLabel,
+      `Expected unitId "${expectedDeliveryUnit.unitId}", found ${formatJson(buildIdentity.unitId)}`,
+      deliveryUnitIdentityFixArea,
+    );
+    assertSelfCheck(
+      buildIdentity.packageName === expectedDeliveryUnit.packageName,
+      buildLabel,
+      `Expected packageName "${expectedDeliveryUnit.packageName}", found ${formatJson(buildIdentity.packageName)}`,
+      deliveryUnitIdentityFixArea,
+    );
+    assertSelfCheck(
+      buildIdentity.version === expectedDeliveryUnit.version,
+      buildLabel,
+      `Expected version "${expectedDeliveryUnit.version}", found ${formatJson(buildIdentity.version)}`,
+      deliveryUnitIdentityFixArea,
+    );
+    assertBuildFacadeExport(
+      ultramodernBuildSource,
+      'ultramodernUiMarker',
+      'ultramodernBuildArtifact.surfaces.ui',
+      `${vertical.path}/shared/ultramodern-build.ts ultramodernUiMarker`,
+    );
+    assertBuildFacadeExport(
+      ultramodernBuildSource,
+      'ultramodernApiMarker',
+      'ultramodernBuildArtifact.surfaces.api',
+      `${vertical.path}/shared/ultramodern-build.ts ultramodernApiMarker`,
+    );
+  }
+  assert(modernAppEnv.includes("import '@modern-js/app-tools/types';"), `${vertical.id} app env must import the framework-owned app ambient type bundle through module resolution`);
+  assert(/declare global \{\s*const ULTRAMODERN_SITE_URL: string;\s*\}/u.test(modernAppEnv), `${vertical.id} app env must keep generated globals explicit after importing app ambient types`);
+  assert(!modernAppEnv.includes("declare module '*.svg'"), `${vertical.id} app env must not redeclare framework-owned svg asset modules`);
+  assert(!modernAppEnv.includes("declare module '*.css'"), `${vertical.id} app env must not redeclare framework-owned css asset modules`);
   assert(routeMetadata.includes('@generated by @modern-js/create'), `${vertical.id} route metadata compatibility manifest must be marked generated`);
   assert(routeMetadata.includes("authoring: 'colocated-route-meta'"), `${vertical.id} route metadata manifest must advertise colocated authoring`);
   assert(packageJson.name === vertical.packageName, `${vertical.id} package name is incorrect`);
   assert(packageJson.scripts?.['cloudflare:deploy'] === 'ULTRAMODERN_CLOUDFLARE_REQUIRE_PUBLIC_URLS=true pnpm run cloudflare:build && wrangler deploy --config .output/wrangler.json', `${vertical.id} must expose cloudflare:deploy`);
+  assertTargetIsolatedBuildArtifacts(vertical.id, modernConfig);
+  assertCloudflareBuildSkipsDeployRebuild(vertical.id, packageJson);
   assert(packageJson.scripts?.['cloudflare:proof']?.includes(`--app ${vertical.id}`), `${vertical.id} must expose cloudflare:proof`);
   assert(packageJson.devDependencies?.['@modern-js/app-tools'] === expectedModernPackageSpecifier('@modern-js/app-tools'), `${vertical.id} app-tools dependency must match package source metadata`);
   assert(packageJson.dependencies?.['@modern-js/plugin-bff'] === expectedModernPackageSpecifier('@modern-js/plugin-bff'), `${vertical.id} plugin-bff dependency must match package source metadata`);
@@ -1892,9 +2304,9 @@ for (const vertical of fullStackVerticals) {
   assert(!verticalAssetPrefixExpression.includes('configuredSiteUrl') && !verticalAssetPrefixExpression.includes('MODERN_PUBLIC_SITE_URL'), `${vertical.id} asset prefix must not fall back to MODERN_PUBLIC_SITE_URL`);
   assert(modernConfig.includes(`envValue('ULTRAMODERN_PUBLIC_URL_${vertical.id.replace(/-/g, '_').toUpperCase()}')`), `${vertical.id} asset prefix must read its per-app public URL`);
   assert(modernConfig.includes('inferredCloudflareUrl'), `${vertical.id} asset prefix must support workers.dev origin inference`);
-  assert(modernConfig.includes("assetPrefix: '/'"), `${vertical.id} modern.config.ts must keep dev assets origin-relative`);
+  assert(/dev:\s*\{\s*\/\/ Remote dev manifests must publish an absolute publicPath[\s\S]*?assetPrefix,\s*\}/u.test(modernConfig), `${vertical.id} modern.config.ts must publish dev assets from its own remote origin`);
   assert(modernConfig.includes('assetPrefix,'), `${vertical.id} modern.config.ts must wire output.assetPrefix to the derived asset prefix`);
-  assert(contractEntry?.config?.dev?.assetPrefix === '/', `${vertical.id} dev asset prefix must stay origin-relative`);
+  assert(contractEntry?.config?.dev?.assetPrefix === 'app-public-origin', `${vertical.id} dev asset prefix must default to its app public origin`);
   assert(contractEntry?.config?.output?.assetPrefix?.default === 'app-public-origin', `${vertical.id} asset prefix must default to its app public origin`);
   assert(JSON.stringify(contractEntry?.config?.output?.assetPrefix?.envFallbackOrder) === JSON.stringify(['MODERN_ASSET_PREFIX', 'ULTRAMODERN_ASSET_PREFIX']), `${vertical.id} asset prefix env fallback order is incorrect`);
   assert(contractEntry?.config?.output?.disableTsChecker === false, `${vertical.id} must keep the framework TypeScript checker enabled`);
@@ -1906,7 +2318,7 @@ for (const vertical of fullStackVerticals) {
   assert(contractEntry?.config?.rspack?.output?.chunkLoadingGlobal === expectedChunkLoadingGlobal(vertical.mfName), `${vertical.id} Rspack chunkLoadingGlobal is incorrect`);
   assert(contractEntry?.moduleFederation?.name === vertical.mfName, `${vertical.id} MF name is incorrect`);
   assert(JSON.stringify(contractEntry?.moduleFederation?.exposes) === JSON.stringify(vertical.exposes), `${vertical.id} MF exposes are incorrect`);
-  assert(contractEntry?.moduleFederation?.dts?.compilerInstance === 'tsgo', `${vertical.id} must keep mandatory DTS compiler`);
+  assert(contractEntry?.moduleFederation?.dts?.compilerInstance === 'effect-tsgo', `${vertical.id} must keep mandatory DTS compiler`);
   assert(contractEntry?.moduleFederation?.dts?.tsConfigPath === './tsconfig.mf-types.json', `${vertical.id} must keep dedicated Module Federation DTS tsconfig`);
   assert(moduleFederationConfig.includes("tsConfigPath: './tsconfig.mf-types.json'"), `${vertical.id} Module Federation config must use the dedicated DTS tsconfig`);
   assert(JSON.stringify(contractEntry?.moduleFederation?.verticalRefs ?? []) === JSON.stringify(vertical.verticalRefs), `${vertical.id} MF verticalRefs are incorrect`);
@@ -1967,6 +2379,42 @@ for (const vertical of fullStackVerticals) {
   assert(topologyEntry?.api?.readiness?.endpoint === `/${vertical.stem}/readiness`, `${vertical.id} topology readiness endpoint is incorrect`);
   assert(Object.keys(topologyEntry?.api?.domainOperations ?? {}).length >= 3, `${vertical.id} topology domain operations are missing`);
 
+  if (vertical.deliveryUnit) {
+    const expectedDeliveryUnit = deliveryUnitBlock(
+      expectedDeliveryUnitFor(vertical, topologyEntry),
+    );
+    const compactAppEntry = ultramodernConfig.topology?.apps?.find(
+      entry => entry?.id === vertical.id,
+    );
+    const compactBackendDeliveryUnit = deliveryUnitBlock(
+      compactAppEntry?.backendFederation?.deliveryUnit,
+    );
+    assertSameJson(
+      deliveryUnitBlock(compactAppEntry?.deliveryUnit),
+      compactBackendDeliveryUnit,
+      `${compactConfigPath} topology.apps.${vertical.id}.deliveryUnit`,
+      deliveryUnitIdentityFixArea,
+    );
+    assertSameJson(
+      compactBackendDeliveryUnit,
+      expectedDeliveryUnit,
+      `${compactConfigPath} topology.apps.${vertical.id}.backendFederation.deliveryUnit`,
+      deliveryUnitIdentityFixArea,
+    );
+    assertSelfCheck(
+      compactAppEntry?.backendFederation?.versionBoundary?.identityRoot === 'deliveryUnit',
+      `${compactConfigPath} topology.apps.${vertical.id}.backendFederation.versionBoundary.identityRoot`,
+      `Expected "deliveryUnit", found ${formatJson(compactAppEntry?.backendFederation?.versionBoundary?.identityRoot)}`,
+      deliveryUnitIdentityFixArea,
+    );
+    assertSameJson(
+      deliveryUnitBlock(compactAppEntry?.deliveryUnit),
+      deliveryUnitBlock(topologyEntry?.deliveryUnit),
+      `${compactConfigPath} vs topology/reference-topology.json verticals.${vertical.id}.deliveryUnit`,
+      deliveryUnitIdentityFixArea,
+    );
+  }
+
   assert(ownership.owners?.some(owner => owner.id === vertical.id && owner.path === vertical.path), `${vertical.id} ownership entry is missing`);
   assert(overlay.ports?.[vertical.id], `${vertical.id} development port is missing`);
   assert(overlay.manifests?.[vertical.id]?.includes('/mf-manifest.json'), `${vertical.id} development manifest is missing`);