@bleedingdev/modern-js-main-doc 3.5.0-ultramodern.2 → 3.5.0-ultramodern.4

package/docs/en/configure/app/bff/effect.mdx

@@ -197,10 +197,14 @@ The generated `api.client.*` API only exists for loader-materialized `@api/index
 ## Effect cohort
 
 UltraModern-generated workspaces pin the framework-compatible Effect cohort
-through `pnpm-workspace.yaml` overrides. For `3.5.0-ultramodern.2`, generated
+through `pnpm-workspace.yaml` overrides. For `3.5.0-ultramodern.4`, generated
 apps use:
 
 ```yaml
+trustPolicyExclude:
+  - 'effect@4.0.0-beta.91'
+  - '@effect/opentelemetry@4.0.0-beta.91'
+
 overrides:
   '@effect/vitest': 4.0.0-beta.91
   effect: 4.0.0-beta.91
@@ -208,7 +212,10 @@ overrides:
 
 Do not add a different direct `effect` version in an app package. A mismatched
 Effect beta can fail while building layers or HTTP middleware because runtime
-services come from different package instances.
+services come from different package instances. Keep the generated
+`trustPolicyExclude` entries with the same Effect cohort; they handle the
+`effect` and `@effect/opentelemetry` trusted-publisher to provenance metadata
+transition without weakening UltraModern API architecture checks.
 
 ## Contract tests
 

package/docs/en/guides/get-started/ultramodern.mdx

@@ -78,33 +78,39 @@ mise exec -- pnpm check
 mise exec -- pnpm build
 ```
 
-Strict generated API migration requires `3.5.0-ultramodern.2` or newer.
+Strict generated API migration requires `3.5.0-ultramodern.4` or newer.
 `3.4.0-ultramodern.20` and earlier cohorts do not include this full direct
 `api/index.ts` generator, generated `.mts` checks, strict Oxlint boundary rule
 set, Effect cohort overrides, and strict Effect migration command. Agents that
 cannot install that BleedingDev cohort yet should use the local Modern.js
-workspace for migration validation; otherwise pin `3.5.0-ultramodern.2` or
+workspace for migration validation; otherwise pin `3.5.0-ultramodern.4` or
 newer with `--ultramodern-package-version`.
 
 Before hand-editing package aliases or generated metadata, run the framework
 migration command from the target workspace:
 
 ```bash
-pnpm dlx @bleedingdev/modern-js-create@3.5.0-ultramodern.2 ultramodern \
-  migrate-strict-effect --version 3.5.0-ultramodern.2
+pnpm dlx @bleedingdev/modern-js-create@3.5.0-ultramodern.4 ultramodern \
+  migrate-strict-effect --version 3.5.0-ultramodern.4
 pnpm api:check
 pnpm contract:check
 ```
 
 The command updates `.modernjs/ultramodern.json`, root
-`modernjs.packageSource`, generated Modern package aliases, direct topology API
-metadata, and the pnpm lockfile. Remaining failures are source migration work:
-move code to `shared/api.ts`, `api/index.ts`, and `src/api/*-client.ts`, then
-delete `api/effect`, `api/lambda`, `shared/effect`, and `src/effect`.
+`modernjs.packageSource`, generated Modern package aliases, framework-owned
+toolchain pins, direct topology API metadata, strict Effect pnpm
+overrides/trust policy, and the pnpm lockfile. Remaining failures are source
+migration work: move code to `shared/api.ts`, `api/index.ts`, and
+`src/api/*-client.ts`, then delete `api/effect`, `api/lambda`, `shared/effect`,
+and `src/effect`.
 
 Generated strict Effect workspaces pin the compatible Effect cohort with pnpm
 overrides: `effect@4.0.0-beta.91` and `@effect/vitest@4.0.0-beta.91`. Do not
-add app-local direct Effect versions that disagree with those overrides.
+add app-local direct Effect versions that disagree with those overrides. They
+also carry a generated pnpm trust-policy exclusion for
+`effect@4.0.0-beta.91` and `@effect/opentelemetry@4.0.0-beta.91` so pnpm
+no-downgrade checks do not block the Effect beta cohort's trusted-publisher to
+provenance metadata transition.
 
 Gradual migration means old, unmigrated Modern.js apps can keep their existing
 runtime until they are converted. Once a surface is generated or migrated as

package/docs/zh/configure/app/bff/effect.mdx

@@ -195,16 +195,23 @@ export default defineConfig({
 ## Effect 版本组
 
 UltraModern 生成的 workspace 会通过 `pnpm-workspace.yaml` overrides 锁定与框架兼容的
-Effect 版本组。`3.5.0-ultramodern.2` 使用：
+Effect 版本组。`3.5.0-ultramodern.4` 使用：
 
 ```yaml
+trustPolicyExclude:
+  - 'effect@4.0.0-beta.91'
+  - '@effect/opentelemetry@4.0.0-beta.91'
+
 overrides:
   '@effect/vitest': 4.0.0-beta.91
   effect: 4.0.0-beta.91
 ```
 
 不要在应用包里添加不同版本的直接 `effect` 依赖。Effect beta 不一致时，Layer 或 HTTP
-middleware 构建可能因为运行时 service 来自不同包实例而失败。
+middleware 构建可能因为运行时 service 来自不同包实例而失败。保留生成的
+`trustPolicyExclude` 条目并让它跟随同一个 Effect 版本组；它用于处理 `effect` 和
+`@effect/opentelemetry` 从 trusted-publisher metadata 迁移到 provenance
+attestation 时的 pnpm no-downgrade 检查。
 
 ## 契约测试
 

package/docs/zh/guides/get-started/ultramodern.mdx

@@ -71,30 +71,34 @@ mise exec -- pnpm check
 mise exec -- pnpm build
 ```
 
-严格生成 API 迁移要求 `3.5.0-ultramodern.2` 或更新版本。
+严格生成 API 迁移要求 `3.5.0-ultramodern.4` 或更新版本。
 `3.4.0-ultramodern.20` 及更早 cohort 还没有这套完整的直接
 `api/index.ts` 生成器、生成的 `.mts` 检查、严格 Oxlint 边界规则、Effect 版本组
 overrides 和严格 Effect 迁移命令。还不能安装该 BleedingDev cohort 的 agent 应使用本地
 Modern.js workspace 做迁移校验；否则用 `--ultramodern-package-version` 固定
-`3.5.0-ultramodern.2` 或更新版本。
+`3.5.0-ultramodern.4` 或更新版本。
 
 手写 package alias 或生成 metadata 之前，先在目标 workspace 运行框架迁移命令：
 
 ```bash
-pnpm dlx @bleedingdev/modern-js-create@3.5.0-ultramodern.2 ultramodern \
-  migrate-strict-effect --version 3.5.0-ultramodern.2
+pnpm dlx @bleedingdev/modern-js-create@3.5.0-ultramodern.4 ultramodern \
+  migrate-strict-effect --version 3.5.0-ultramodern.4
 pnpm api:check
 pnpm contract:check
 ```
 
 该命令会更新 `.modernjs/ultramodern.json`、根 `modernjs.packageSource`、生成的
-Modern package alias、直接 topology API metadata 和 pnpm lockfile。剩余失败就是源码迁移：
-把代码移到 `shared/api.ts`、`api/index.ts` 和 `src/api/*-client.ts`，再删除
-`api/effect`、`api/lambda`、`shared/effect` 和 `src/effect`。
+Modern package alias、框架拥有的 toolchain pin、直接 topology API metadata、严格 Effect
+pnpm overrides/trust policy 和 pnpm lockfile。剩余失败就是源码迁移：把代码移到
+`shared/api.ts`、`api/index.ts` 和 `src/api/*-client.ts`，再删除 `api/effect`、
+`api/lambda`、`shared/effect` 和 `src/effect`。
 
 严格 Effect 生成 workspace 会通过 pnpm overrides 固定兼容版本组：
 `effect@4.0.0-beta.91` 和 `@effect/vitest@4.0.0-beta.91`。不要添加与这些
-overrides 冲突的 app 本地直接 Effect 版本。
+overrides 冲突的 app 本地直接 Effect 版本。生成的 pnpm policy 还会为
+`effect@4.0.0-beta.91` 和 `@effect/opentelemetry@4.0.0-beta.91` 添加
+trust-policy exclusion，避免 Effect beta 版本组从 trusted-publisher metadata
+迁移到 provenance attestation 时被 pnpm no-downgrade 检查误拦截。
 
 渐进迁移意味着尚未迁移的旧 Modern.js app 可以保留现有 runtime，直到被转换为
 UltraModern。一个 surface 一旦生成为或迁移为 UltraModern HTTP API，就只能使用

package/package.json

@@ -19,14 +19,14 @@
     "modern.js",
     "ultramodern.js"
   ],
-  "version": "3.5.0-ultramodern.2",
+  "version": "3.5.0-ultramodern.4",
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",
     "access": "public"
   },
   "dependencies": {
     "mermaid": "^11.16.0",
-    "@modern-js/sandpack-react": "npm:@bleedingdev/modern-js-sandpack-react@3.5.0-ultramodern.2"
+    "@modern-js/sandpack-react": "npm:@bleedingdev/modern-js-sandpack-react@3.5.0-ultramodern.4"
   },
   "devDependencies": {
     "@rsbuild/plugin-sass": "2.0.0",