@bleedingdev/modern-js-ultramodern-create 3.8.3-ultramodern.2

package/dist/esm-node/ultramodern-workspace/policy.js

@@ -0,0 +1,956 @@
+import "node:module";
+import { assertReleaseCohortPackageSource, parseUltramodernReleaseCohort, releaseCohortSelectors } from "../ultramodern-release-cohort.js";
+import { rpcPath } from "./api/rpc.js";
+import { appEmitsBrowserUi, appHasApi, appI18nNamespace, createCloudflarePublicUrlEnv, createCloudflareWorkerName, resolveApiPrefix, resolveApiProtocol, resolveApiStem } from "./descriptors.js";
+import { createLocalisedUrlsMap } from "./routes.js";
+import { isRecord } from "./types.js";
+import { CLOUDFLARE_COMPATIBILITY_DATE, CLOUDFLARE_WORKERS_TYPES_VERSION, CROSS_ENV_VERSION, DRIZZLE_ORM_VERSION, EFFECT_TSGO_VERSION, EFFECT_VERSION, EFFECT_VITEST_VERSION, I18NEXT_VERSION, LEFTHOOK_VERSION, MINIFLARE_VERSION, MODULE_FEDERATION_NODE_VERSION, MODULE_FEDERATION_VERSION, MSGPACKR_VERSION, NODE_FETCH_VERSION, NODE_VERSION, OXFMT_VERSION, OXLINT_VERSION, PNPM_VERSION, REACT_DOM_VERSION, REACT_VERSION, RSBUILD_PLUGIN_TAILWINDCSS_VERSION, TAILWIND_VERSION, TANSTACK_HISTORY_VERSION, TANSTACK_ROUTER_CORE_VERSION, TANSTACK_ROUTER_VERSION, TYPESCRIPT_NATIVE_PREVIEW_VERSION, TYPESCRIPT_VERSION, TYPES_NODE_VERSION, TYPES_REACT_DOM_VERSION, TYPES_REACT_VERSION, ULTRACITE_VERSION, WORKERD_VERSION, WRANGLER_VERSION, ZEPHYR_AGENT_VERSION, ZEPHYR_RSPACK_PLUGIN_VERSION, ZOD_VERSION } from "./versions.js";
+function createCloudflareProofRoute(app) {
+    if ('shell' === app.kind) return {
+        ssr: '/en',
+        mfManifest: '/mf-manifest.json',
+        locale: `/locales/en/${appI18nNamespace(app)}.json`
+    };
+    const languageRoutes = createLocalisedUrlsMap(app);
+    const firstCanonicalPath = Object.keys(languageRoutes)[0];
+    const localizedPath = firstCanonicalPath && isRecord(languageRoutes[firstCanonicalPath]) ? languageRoutes[firstCanonicalPath].en : void 0;
+    return {
+        ...appEmitsBrowserUi(app) ? {
+            ssr: localizedPath ?? '/en',
+            mfManifest: '/mf-manifest.json',
+            locale: `/locales/en/${appI18nNamespace(app)}.json`
+        } : {},
+        ...appHasApi(app) ? 'rpc' === resolveApiProtocol(app) ? {
+            rpc: rpcPath(app)
+        } : {
+            apiReadiness: `${resolveApiPrefix(app)}/${resolveApiStem(app)}/readiness`
+        } : {}
+    };
+}
+function createApiSmokeCheck(app) {
+    const stem = resolveApiStem(app);
+    if ('rpc' === resolveApiProtocol(app)) {
+        const id = `${app.id}-cloudflare-proof`;
+        return {
+            id: `${app.id}-rpc-smoke`,
+            method: 'POST',
+            route: rpcPath(app),
+            body: {
+                jsonrpc: '2.0',
+                id,
+                method: 'list',
+                params: {
+                    limit: 1
+                }
+            },
+            expect: {
+                id,
+                'result.items.0.id': `starter-${stem}`
+            }
+        };
+    }
+    return {
+        id: `${app.id}-readiness-smoke`,
+        route: `${resolveApiPrefix(app)}/${stem}/readiness`,
+        expect: {
+            status: 'ready',
+            'checks.api': 'ready',
+            'checks.moduleFederation': 'ready',
+            'checks.ssr': 'ready'
+        }
+    };
+}
+function createCloudflareSecurityContract() {
+    return {
+        enabled: true,
+        headers: {
+            referrerPolicy: 'strict-origin-when-cross-origin',
+            contentTypeOptions: 'nosniff',
+            permissionsPolicy: 'camera=(), geolocation=(), microphone=(), payment=(), usb=()'
+        },
+        contentSecurityPolicy: {
+            mode: 'report-only',
+            directives: {
+                'base-uri': [
+                    "'self'"
+                ],
+                'connect-src': [
+                    "'self'",
+                    'https:',
+                    'http:',
+                    'wss:',
+                    'ws:'
+                ],
+                'default-src': [
+                    "'self'"
+                ],
+                'font-src': [
+                    "'self'",
+                    'data:',
+                    'https:',
+                    'http:'
+                ],
+                'form-action': [
+                    "'self'"
+                ],
+                'frame-ancestors': [
+                    "'self'"
+                ],
+                'img-src': [
+                    "'self'",
+                    'data:',
+                    'blob:',
+                    'https:',
+                    'http:'
+                ],
+                'manifest-src': [
+                    "'self'",
+                    'https:',
+                    'http:'
+                ],
+                'object-src': [
+                    "'none'"
+                ],
+                "script-src": [
+                    "'self'",
+                    "'unsafe-inline'",
+                    "'unsafe-eval'",
+                    'https:',
+                    'http:',
+                    'blob:'
+                ],
+                'style-src': [
+                    "'self'",
+                    "'unsafe-inline'",
+                    'https:',
+                    'http:'
+                ],
+                'worker-src': [
+                    "'self'",
+                    'blob:'
+                ]
+            },
+            reason: "Report-only by default so Cloudflare Module Federation SSR can prove remote script, style, and connect compatibility before enforcement."
+        },
+        noindex: {
+            workersDev: true,
+            localhost: true,
+            previewHostnames: []
+        }
+    };
+}
+const PUBLIC_WEBSITE_POLICY = {
+    qualityGates: {
+        publicRoutes: {
+            requireSitemapWhenPresent: true,
+            requireRobotsSitemapConsistency: true,
+            requireWebManifestWhenPresent: true
+        },
+        statusCodes: {
+            notFoundRoute: '/__ultramodern-smoke-missing/nope',
+            unknownRouteStatus: 404
+        },
+        indexing: {
+            previewNoindex: true,
+            productionPublicRoutesIndexable: true
+        },
+        assets: {
+            cssPreloadRequired: true,
+            cssResponseRequired: true,
+            cacheControlRequiredForCss: true,
+            sourcemapsPubliclyReferenced: false
+        },
+        budgets: {
+            ssrHtmlMaxBytes: 250000,
+            mfManifestMaxBytes: 500000,
+            localeJsonMaxBytes: 100000,
+            sitemapXmlMaxBytes: 500000,
+            cssAssetMaxBytes: 750000
+        },
+        csp: {
+            finalMode: 'report-only-dogfood',
+            decision: "Report-only remains the generated final mode until public smoke proof records MF SSR script/style/connect compatibility for the deployed surface."
+        }
+    },
+    publicHead: {
+        indexableRobots: 'index, follow',
+        privateRouteRobots: 'noindex, nofollow'
+    },
+    publicSurface: {
+        defaultProviderFile: 'route.sitemap.mjs',
+        draftPolicy: 'omit-draft-by-default',
+        indexablePolicy: 'omit-indexable-false'
+    }
+};
+function formatTsJsonValue(value, indent) {
+    return JSON.stringify(value, null, 2).replaceAll('\n', `\n${' '.repeat(indent)}`);
+}
+function createPublicWebsiteQualityGateContract() {
+    return PUBLIC_WEBSITE_POLICY.qualityGates;
+}
+function createPublicHeadRobotsPolicy() {
+    return PUBLIC_WEBSITE_POLICY.publicHead;
+}
+function createPublicSurfaceContentExpansionPolicy() {
+    return PUBLIC_WEBSITE_POLICY.publicSurface;
+}
+function createCloudflareDeployContract(scope, app) {
+    return {
+        target: 'cloudflare',
+        workerName: createCloudflareWorkerName(scope, app),
+        publicUrlEnv: createCloudflarePublicUrlEnv(app),
+        compatibilityDate: CLOUDFLARE_COMPATIBILITY_DATE,
+        compatibilityFlags: [
+            'nodejs_compat',
+            'global_fetch_strictly_public'
+        ],
+        assetsBinding: 'ASSETS',
+        routes: createCloudflareProofRoute(app),
+        security: createCloudflareSecurityContract(),
+        qualityGates: createPublicWebsiteQualityGateContract(),
+        evidence: {
+            proofScript: "scripts/proof-cloudflare-version.mts",
+            reportDefault: '.codex/reports/cloudflare-version-proof/public-url-proof.json'
+        },
+        ...app.api ? {
+            jsonSmokeChecks: [
+                createApiSmokeCheck(app)
+            ]
+        } : {}
+    };
+}
+const releaseAgeReasons = {
+    cloudflare: 'Reviewed Cloudflare runtime cohort required by generated Worker tooling before pnpm minimum release age elapsed.',
+    framework: 'Reviewed Modern.js framework and fresh generated dependency closure required by workspaces before pnpm minimum release age elapsed.',
+    typescript: 'Reviewed TypeScript compiler and platform cohort required by generated TypeScript 7 workspaces before pnpm minimum release age elapsed.'
+};
+const releaseAgeReviewEvidence = {
+    rsbuildRspack20260826: {
+        reviewer: 'Petr Glaser <syreanis+1@gmail.com>',
+        reviewedAt: '2026-08-26T10:06:26.000Z',
+        expiresAt: '2026-08-27T02:46:55.656Z',
+        uri: 'https://github.com/BleedingDev/ultramodern.js/commit/986768d419f032f98d0cdcfd0893538b94ef1ea5',
+        sha256: 'fe2b9cbf8027a6241d6cad9fc2bfd1efbc1517af95cbddde5bf5167fb0ae6b38'
+    }
+};
+function createReleaseAgeApproval(seed) {
+    return {
+        packageName: seed.packageName,
+        version: seed.version,
+        reason: seed.reason,
+        reviewer: seed.review.reviewer,
+        reviewedAt: seed.review.reviewedAt,
+        evidence: {
+            uri: seed.review.uri,
+            sha256: seed.review.sha256,
+            sha256Subject: 'git-commit-payload'
+        },
+        registry: {
+            publishedAt: seed.publishedAt,
+            dist: {
+                integrity: seed.integrity
+            }
+        },
+        expiresAt: seed.review.expiresAt
+    };
+}
+const ULTRAMODERN_PACKAGE_PINS = {
+    appDependencies: {
+        '@module-federation/bridge-react': MODULE_FEDERATION_VERSION,
+        '@module-federation/modern-js-v3': MODULE_FEDERATION_VERSION,
+        '@module-federation/runtime': MODULE_FEDERATION_VERSION,
+        '@tanstack/react-router': TANSTACK_ROUTER_VERSION,
+        i18next: I18NEXT_VERSION,
+        'node-fetch': NODE_FETCH_VERSION,
+        react: REACT_VERSION,
+        'react-dom': REACT_DOM_VERSION
+    },
+    bffEffectDependencies: {
+        '@effect/opentelemetry': EFFECT_VERSION,
+        effect: EFFECT_VERSION
+    },
+    appDevDependencies: {
+        '@effect/tsgo': EFFECT_TSGO_VERSION,
+        '@rsbuild/plugin-tailwindcss': `^${RSBUILD_PLUGIN_TAILWINDCSS_VERSION}`,
+        "@typescript/native": `npm:typescript@${TYPESCRIPT_VERSION}`,
+        '@types/node': TYPES_NODE_VERSION,
+        '@types/react': TYPES_REACT_VERSION,
+        '@types/react-dom': TYPES_REACT_DOM_VERSION,
+        'cross-env': CROSS_ENV_VERSION,
+        tailwindcss: `^${TAILWIND_VERSION}`,
+        typescript: TYPESCRIPT_VERSION,
+        wrangler: WRANGLER_VERSION,
+        'zephyr-rspack-plugin': ZEPHYR_RSPACK_PLUGIN_VERSION
+    },
+    rootDevDependencies: {
+        '@effect/tsgo': EFFECT_TSGO_VERSION,
+        "@typescript/native": `npm:typescript@${TYPESCRIPT_VERSION}`,
+        'cross-env': CROSS_ENV_VERSION,
+        lefthook: LEFTHOOK_VERSION,
+        miniflare: MINIFLARE_VERSION,
+        oxlint: OXLINT_VERSION,
+        oxfmt: OXFMT_VERSION,
+        ultracite: ULTRACITE_VERSION,
+        wrangler: WRANGLER_VERSION,
+        'zephyr-agent': ZEPHYR_AGENT_VERSION
+    },
+    transitiveDependencies: {
+        '@cloudflare/workers-types': CLOUDFLARE_WORKERS_TYPES_VERSION,
+        '@module-federation/node': MODULE_FEDERATION_NODE_VERSION,
+        '@tanstack/history': TANSTACK_HISTORY_VERSION,
+        '@tanstack/router-core': TANSTACK_ROUTER_CORE_VERSION,
+        "@typescript/native-preview": TYPESCRIPT_NATIVE_PREVIEW_VERSION,
+        miniflare: MINIFLARE_VERSION,
+        workerd: WORKERD_VERSION
+    }
+};
+const requiredPatchPolicies = [
+    {
+        packageName: '@module-federation/dts-plugin',
+        version: MODULE_FEDERATION_VERSION,
+        path: `patches/@module-federation__dts-plugin@${MODULE_FEDERATION_VERSION}.patch`
+    },
+    {
+        packageName: '@module-federation/bridge-react',
+        version: MODULE_FEDERATION_VERSION,
+        path: `patches/@module-federation__bridge-react@${MODULE_FEDERATION_VERSION}.patch`
+    },
+    {
+        packageName: '@module-federation/modern-js-v3',
+        version: MODULE_FEDERATION_VERSION,
+        path: `patches/@module-federation__modern-js-v3@${MODULE_FEDERATION_VERSION}.patch`
+    },
+    {
+        packageName: '@module-federation/runtime-core',
+        version: MODULE_FEDERATION_VERSION,
+        path: `patches/@module-federation__runtime-core@${MODULE_FEDERATION_VERSION}.patch`
+    },
+    {
+        packageName: '@tanstack/router-core',
+        version: TANSTACK_ROUTER_CORE_VERSION,
+        path: `patches/@tanstack__router-core@${TANSTACK_ROUTER_CORE_VERSION}.patch`
+    },
+    {
+        packageName: 'msgpackr',
+        version: MSGPACKR_VERSION,
+        path: `patches/msgpackr@${MSGPACKR_VERSION}.patch`
+    },
+    {
+        packageName: 'zod',
+        version: ZOD_VERSION,
+        path: `patches/zod@${ZOD_VERSION}.patch`
+    }
+];
+const conditionalPatchPolicies = [
+    {
+        packageName: 'drizzle-orm',
+        version: DRIZZLE_ORM_VERSION,
+        path: 'patches/drizzle-orm-ts7-strict-declarations.patch'
+    }
+];
+const stalePatchPolicies = [
+    {
+        packageName: '@module-federation/bridge-react',
+        version: '2.8.2',
+        path: 'patches/@module-federation__bridge-react@2.8.2.patch',
+        sha256: '8c084f41790295af8fd015b897c6298bbc13d927b796c624ac96cb2bdb4bc87c'
+    },
+    {
+        packageName: '@module-federation/modern-js-v3',
+        version: '2.8.2',
+        path: 'patches/@module-federation__modern-js-v3@2.8.2.patch',
+        sha256: '948d2a725ae526f395b0343b113ff80dfaa50dbdec8158179746e98259925d20'
+    },
+    {
+        packageName: '@module-federation/bridge-react',
+        version: '2.8.0',
+        path: 'patches/@module-federation__bridge-react@2.8.0.patch',
+        sha256: '54bfc79e097473222f83cbfa6d717792e3026bf16b5097c2ed91715b7da126be'
+    },
+    {
+        packageName: '@module-federation/modern-js-v3',
+        version: '2.8.0',
+        path: 'patches/@module-federation__modern-js-v3@2.8.0.patch',
+        sha256: '948d2a725ae526f395b0343b113ff80dfaa50dbdec8158179746e98259925d20'
+    },
+    {
+        packageName: '@module-federation/bridge-react',
+        version: '2.7.0',
+        path: 'patches/@module-federation__bridge-react@2.7.0.patch',
+        sha256: '2f89441475f83a6e12d8c2a755b5b15c4d2b04523a1b33fd318c2d537382537f'
+    },
+    {
+        packageName: '@module-federation/modern-js-v3',
+        version: '2.7.0',
+        path: 'patches/@module-federation__modern-js-v3@2.7.0.patch',
+        sha256: 'f51adf0aa6c6e2daa5b7d2978a7716c0d4fb05b29af449b2f16257b957fb7923'
+    },
+    {
+        packageName: 'effect',
+        version: '4.0.0-beta.107',
+        path: 'patches/effect-schema-error-type-id.patch',
+        sha256: 'ed9f636f82a1a1e5c128fc85e99e24a8fcf4ba06a35e89e3dd6460250875153f'
+    },
+    {
+        packageName: 'effect',
+        version: '4.0.0-beta.94',
+        path: 'patches/effect-schema-error-type-id.patch',
+        sha256: 'ed9f636f82a1a1e5c128fc85e99e24a8fcf4ba06a35e89e3dd6460250875153f',
+        acceptedLegacySha256: [
+            'd9e12b42d06a051957899a9df14b2b7b2385fc3a5677a89037eeee3674d64ebe',
+            'dc7e8088e600beb20185eb877754d749c4a93909fb79f49465e8319e40d6596a',
+            'bd29a0ae24f0674c6007e5e6060d847dbeb9499a6e2cf4c9f13b24ba9fb3af37'
+        ]
+    },
+    {
+        packageName: 'effect',
+        version: '4.0.0-beta.97',
+        path: 'patches/effect-schema-error-type-id.patch',
+        sha256: 'ed9f636f82a1a1e5c128fc85e99e24a8fcf4ba06a35e89e3dd6460250875153f',
+        acceptedLegacySha256: [
+            'd9e12b42d06a051957899a9df14b2b7b2385fc3a5677a89037eeee3674d64ebe',
+            'dc7e8088e600beb20185eb877754d749c4a93909fb79f49465e8319e40d6596a',
+            'bd29a0ae24f0674c6007e5e6060d847dbeb9499a6e2cf4c9f13b24ba9fb3af37'
+        ]
+    },
+    {
+        packageName: 'effect',
+        version: '4.0.0-beta.102',
+        path: 'patches/effect-schema-error-type-id.patch',
+        sha256: 'ed9f636f82a1a1e5c128fc85e99e24a8fcf4ba06a35e89e3dd6460250875153f',
+        acceptedLegacySha256: [
+            'd9e12b42d06a051957899a9df14b2b7b2385fc3a5677a89037eeee3674d64ebe',
+            'dc7e8088e600beb20185eb877754d749c4a93909fb79f49465e8319e40d6596a',
+            'bd29a0ae24f0674c6007e5e6060d847dbeb9499a6e2cf4c9f13b24ba9fb3af37'
+        ]
+    },
+    {
+        packageName: '@module-federation/dts-plugin',
+        version: '2.7.0',
+        path: 'patches/@module-federation__dts-plugin@2.7.0.patch',
+        sha256: '768cc3bb22e2dede264515f141fdc8af937c8f53d4f8ef8f83469bb0cec1c9a0'
+    },
+    {
+        packageName: '@module-federation/bridge-react',
+        version: '2.6.0',
+        path: 'patches/@module-federation__bridge-react@2.6.0.patch',
+        sha256: '75982bd9b4d40922ce3110ded5254f7faca39112b79d41f27fe0ac4bb416c467'
+    },
+    {
+        packageName: '@module-federation/dts-plugin',
+        version: '2.6.0',
+        path: 'patches/@module-federation__dts-plugin@2.6.0.patch',
+        sha256: 'bc998f74617f7f060ea0f65235f071a5880aade3144ccd610d098d6bbc1c52fe',
+        acceptedLegacySha256: [
+            'ad19439992ca0757dc7354ad4197eecd5ac83f3ef5ed990e9200c672138600d5'
+        ]
+    },
+    {
+        packageName: '@module-federation/modern-js-v3',
+        version: '2.6.0',
+        path: 'patches/@module-federation__modern-js-v3@2.6.0.patch',
+        sha256: '51ab49dc776c56cdaa8eb43fbd0bb2788633d6b05acfb18fb2f3a1db81c02d87'
+    },
+    {
+        packageName: '@tanstack/router-core',
+        version: '1.171.21',
+        path: 'patches/@tanstack__router-core@1.171.21.patch',
+        sha256: 'fb269f2a1c6c789ffb2d4f9341f6dd6a1dbb977b5bb66ce8e31a3a9cdd197dad'
+    },
+    {
+        packageName: '@tanstack/router-core',
+        version: '1.171.13',
+        path: 'patches/@tanstack__router-core@1.171.13.patch',
+        sha256: '0c6119dcaa6ad35a11e1ce4fd95179bf929d5b5a86e9cbee110f45bd07c5c8d3'
+    },
+    {
+        packageName: '@tanstack/router-core',
+        version: '1.171.14',
+        path: 'patches/@tanstack__router-core@1.171.14.patch',
+        sha256: '1e1572940e00d6327c75bb8457c108e32e75a2292e4d90d764208d5b6f330155'
+    },
+    {
+        packageName: 'react-server-dom-rspack',
+        version: '0.0.3',
+        path: 'patches/@react-server-dom-rspack@0.0.3.patch',
+        sha256: '11e471512012c0015883a233017b3ad695765e344cbd1d8174e79196ab6ba567'
+    }
+];
+const moduleFederationRegistryReleases = [
+    [
+        'bridge-react',
+        '2026-08-24T08:18:02.542Z',
+        'sha512-3wEVz9IMsDnbdTZjG+0XA7BHUU2yIvfTqWRrMPR9RciSOVojJUXocZ6Anksu7WhuYnasc7am8szpms7pZGotnA=='
+    ],
+    [
+        'bridge-react-webpack-plugin',
+        '2026-08-24T08:19:41.007Z',
+        'sha512-hv3fuQkGERQ/COBKTVbFV1GWovReSg/bzJzDuxWR1F84h6NYtbYMWQqX8Egvb7HKMtn9Rflzw0GeaLr8F08vDg=='
+    ],
+    [
+        'cli',
+        '2026-08-24T08:21:41.802Z',
+        'sha512-r9RdlLRy3zWxuWQRonif48xdDu1reBGx18QpkZwLQ4JfSrOARjycNIGY2Y7QaUw7dedzxyee4FtKFeX/kOVLYQ=='
+    ],
+    [
+        'dts-plugin',
+        '2026-08-24T08:19:17.035Z',
+        'sha512-uMGqEG/p9odG2BVr7WRbBe2OgrvzBd3LPzcp5WP+bm3djBdUJ4PZ3ozqKp6qpy+NFnlh6vnM815Xn6AXkKy1Vw=='
+    ],
+    [
+        'enhanced',
+        '2026-08-24T08:20:25.023Z',
+        'sha512-Jd/JHoFL9fNKL4Nnzo/9hf6FD/oQo3gKpE8xt6EGuhxmrvg6wM0radPtqgHiSSWLMW7CiXr2agNjKvquKd83rw=='
+    ],
+    [
+        'error-codes',
+        '2026-08-24T08:22:25.614Z',
+        'sha512-IGpd+VRlji3NyGOGGTsk7YEmPRKcDoBK4YHqIuP+OQwyb2YhHCUHO2vW9RXeQxCuKwi+c6xkTweRYG+Umy+0Zw=='
+    ],
+    [
+        'inject-external-runtime-core-plugin',
+        '2026-08-24T08:21:16.321Z',
+        'sha512-k3wCSZsY21HjYQ61wmIJUQleOgcHgqx/sX4qXYw0XnJnzHuFo64rzMvgr+TuBIgZ1peAQtfILLlTnWyTRjtZHw=='
+    ],
+    [
+        'managers',
+        '2026-08-24T08:19:45.898Z',
+        'sha512-8KhB2PF4g+M0hGaethU1H4GVWabLn5sF5TvnM6VxgAcDL4TfLY8aC/YobAXHG/SV0jpU5lsGe6s6xy6ccV0MQw=='
+    ],
+    [
+        'manifest',
+        '2026-08-24T08:19:49.387Z',
+        'sha512-Zhm9luVOw9XPou50eTwsvdgr208CszoQ6cGORQDCPAMhjpGb5oYFtilJ+LKW7hQ1LktD15bEZmGhC1anvgXEiQ=='
+    ],
+    [
+        'modern-js-v3',
+        '2026-08-24T08:21:54.080Z',
+        'sha512-IzFEJnO53vEVLrm5qlDrCPO1bEmN11TLaPHrZtPqHfy7yjwhBDi/63uLAVwcqKVGZnK5Erbqg9Y3hJkZKxd4AQ=='
+    ],
+    [
+        'rsbuild-plugin',
+        '2026-08-24T08:19:38.788Z',
+        'sha512-CaWAxZg+zOMw/BfgRXQdNBQZ/e5U7DBZvE13LzG13GEclt7yxaMQgKH0si3uOsq9f/X2NC8UnuhNHLIkloqlqA=='
+    ],
+    [
+        'rspack',
+        '2026-08-24T08:21:20.630Z',
+        'sha512-9zSlmQYKRHKVWqhlZSMyjstp2A3VVrQV2Of8mrF5NXhngFemNx7Hw35+MTo+gsRfF5glpN8bAzLyIokRUo1Cog=='
+    ],
+    [
+        'runtime',
+        '2026-08-24T08:21:03.780Z',
+        'sha512-3cyAav0hWP+dNvB7qrcK9CKxQn+JvkbRvLtZz3zS2g0EyxtDFDjgbHY0Afcf7oHf8IHhKeEdzb/3Kjr1Pjmr7A=='
+    ],
+    [
+        'runtime-core',
+        '2026-08-24T08:19:49.581Z',
+        'sha512-dLykRYfpbEJBTdk2NlbNoVVTB196O3qujawTBguLABJkPCWETJNk60NR1yZO34eI+DTH+eGwHU3m7FddAWnbnw=='
+    ],
+    [
+        'runtime-tools',
+        '2026-08-24T08:19:57.575Z',
+        'sha512-u2puqsaHiw1bVvLNk1uh98iPo6UzaBuci/aTvOFwKvbT/RF18C3vGGnm+ShHPKQEnoN6ctPtnygyOZDPR+8cgg=='
+    ],
+    [
+        'sdk',
+        '2026-08-24T08:20:29.076Z',
+        'sha512-IMjObgBGQTXd33jTTCYcxvz8iOQGLsZ2QIPOj90rDxuBtJsN4WJwYyXqligrhY/e5p/BipUPdbIgKmWL7zFhTw=='
+    ],
+    [
+        'third-party-dts-extractor',
+        '2026-08-24T08:22:33.751Z',
+        'sha512-R1Xuqnqzw6wQxWV3yU9fX1FydXAeZF2TNVFAVo1N1oLBA2j5y7aUO/Fc3VSNgd9/gxMzJgTVBdA+nMiD2SFCgg=='
+    ],
+    [
+        'webpack-bundler-runtime',
+        '2026-08-24T08:20:31.955Z',
+        'sha512-MdU6NQibT57MaJG3KPBjC30IVBrz5eU7IcjHoVDYnMh7OmASw3stagBu7hYjdMTP31luNdtzUn85s9axvdwTlw=='
+    ]
+];
+const moduleFederationNodeRegistryRelease = {
+    packageName: '@module-federation/node',
+    version: MODULE_FEDERATION_NODE_VERSION,
+    registry: {
+        publishedAt: '2026-08-24T08:22:30.137Z',
+        dist: {
+            integrity: 'sha512-mbpQRdafyeWgsmYoJfdhOQf76zS6onOGpC2X1ELpWXB1Y4BcZGloL0CLjNMNon9m3ucfpc99tOGAQqFzQVkSBQ=='
+        }
+    }
+};
+const rsbuildRspackRegistryReleases = [
+    [
+        '@rsbuild/core',
+        '2.2.0',
+        '2026-08-26T02:46:55.656Z',
+        'sha512-UnBBfxWIDKVdLz2BUBq7hFBatwLclJ4moFhlDFg+pFBPPJ1g34MmCbGUC0c9Mo1DhPGdYJG69qMIldh5MvC74w=='
+    ],
+    [
+        '@rspack/core',
+        '2.2.0',
+        '2026-08-26T02:17:40.412Z',
+        'sha512-3W7oX0BAHbK4VlknH3lfyfRvupzxdZtyEa+DfKmdjzmIAcqYtHnFd0nLqp5dzitDPyDI1TIKkDhpB0AZJn0pVg=='
+    ],
+    [
+        '@rspack/binding',
+        '2.2.0',
+        '2026-08-26T02:15:34.205Z',
+        'sha512-nxZzJqqB0EmEKp6qjzFNkBb/SgGt0k0DSENrLvAJgvVvrm3waVsubD0cfxtPlZY/rd5SzadzxWGEHRyFcds5nA=='
+    ],
+    [
+        '@rspack/binding-darwin-arm64',
+        '2.2.0',
+        '2026-08-26T02:10:44.109Z',
+        'sha512-KAVVT7hp3NBjtc/RY2UtOjzzc8i+s4pIhW1p52UV+Aev6ywQCu3dXwkHTonpPvJO3hqLXc4zIMH5l4HbMqBm4g=='
+    ],
+    [
+        '@rspack/binding-darwin-x64',
+        '2.2.0',
+        '2026-08-26T02:10:51.901Z',
+        'sha512-rzyJCX99aFwl540trsVMNZOgK4+IFm2d5+YeP+RdNo9Uprxloz8vHz0J4dYtaq6MRiCAyM60dAwEa3wJMwqWAQ=='
+    ],
+    [
+        '@rspack/binding-linux-arm64-gnu',
+        '2.2.0',
+        '2026-08-26T02:16:09.113Z',
+        'sha512-0t8QOiOMcBV7RvPSsTJ5DQ4QCK6FIyUZy77qbxnS6asGTOXPZZn7V5cL26IxEv/wuHdQ6tQOXheau1fi+gGyBQ=='
+    ],
+    [
+        '@rspack/binding-linux-arm64-musl',
+        '2.2.0',
+        '2026-08-26T02:11:06.138Z',
+        'sha512-BAvCukqcuHxUdE294ITCohvhVkEklW8RbkKkR36Uo0WyIiMPGrnvPjARPn0/4Q4xMAz7lUmC60sZrvJHlAOKMw=='
+    ],
+    [
+        '@rspack/binding-linux-ppc64-gnu',
+        '2.2.0',
+        '2026-08-26T02:11:12.739Z',
+        'sha512-nCHqZLv/E8nm2ccGkb00F5DQtXxzGy3W3X73ArA+N0+zXJUnzRcSRSwr7AE8pVgP/FYfX4yMFgUXy0g0YxYGRA=='
+    ],
+    [
+        '@rspack/binding-linux-riscv64-gnu',
+        '2.2.0',
+        '2026-08-26T02:11:19.331Z',
+        'sha512-CA3WEqKFDI6FAZTnCho2n9pmdPWZYAW/S8mqgxd0cx2Jix43at3VyLxhCC7ED5A9WBSFn/AdHaIbVtgoQHVhWA=='
+    ],
+    [
+        '@rspack/binding-linux-riscv64-musl',
+        '2.2.0',
+        '2026-08-26T02:11:26.587Z',
+        'sha512-kHB960oClkoPRPZ6sdkhRvqbdRIlbpIMYd/Tbxfmn3DWQahiCk1pkUFJbOtFq3EgESxZISV4THl442W2Y57HvQ=='
+    ],
+    [
+        '@rspack/binding-linux-s390x-gnu',
+        '2.2.0',
+        '2026-08-26T02:11:34.448Z',
+        'sha512-lVBdiffVo1jq0P0jT36jNou2suLB4ueQI4aWUs+HM+h67YPBtVKWu/mo5Wh59+8nowgcZmYaFM5hdH69963I9w=='
+    ],
+    [
+        '@rspack/binding-linux-x64-gnu',
+        '2.2.0',
+        '2026-08-26T02:13:49.303Z',
+        'sha512-M49UaWspE0YJ3268DsquD8idEQTfjBDMvO/I8qccV/Z5T+Q98FJ+kIs5liUaTWb48OIbDEK+8ZKx5QzLbfVN6g=='
+    ],
+    [
+        '@rspack/binding-linux-x64-musl',
+        '2.2.0',
+        '2026-08-26T02:21:58.999Z',
+        'sha512-YYbs0wmey+5blhEQDE4Dax3TwJtqfGwe2QBm3OLphlBHo/fcZVvimzKkMV0/pVrZTLy2z5ZAwNhGMY64bNr77w=='
+    ],
+    [
+        '@rspack/binding-wasm32-wasi',
+        '2.2.0',
+        '2026-08-26T02:11:53.777Z',
+        'sha512-rerLPTN/HD4EvLNWs3O2N+Eb37eGvLRIP3dXXc3n+UzTebOepAsahNn44vXeRBsE4m/pHkpDJjwgWTytgQ2gBw=='
+    ],
+    [
+        '@rspack/binding-win32-arm64-msvc',
+        '2.2.0',
+        '2026-08-26T02:11:59.878Z',
+        'sha512-JUAmnbOQYGTRyX28vls/MOMonZWcmcCi5YtEq6YMc8Xqh3Qx0HUwaLM/I1xr/N9BX3b8CV0dQDOpNuBc2ei+CA=='
+    ],
+    [
+        '@rspack/binding-win32-ia32-msvc',
+        '2.2.0',
+        '2026-08-26T02:12:06.484Z',
+        'sha512-wOmQRUaOG0eWH/fnfslA9yK9xKfaq9X+3Xa1TdTJnTqlo0ARJYs6A+Lzjbs7cxdY/o1f12Xe00BG3nQozReUOg=='
+    ],
+    [
+        '@rspack/binding-win32-x64-msvc',
+        '2.2.0',
+        '2026-08-26T02:12:13.441Z',
+        'sha512-v6/3bFr9+i7hRpgulL9b5qCvZL0VgR4vQGQNqOWezUzZmPUj9LYpvB0L9xZIVwDQ2ug/xBiA58bfg5IbESgoyw=='
+    ]
+];
+const releaseAgeApprovals = [
+    ...rsbuildRspackRegistryReleases.map(([packageName, version, publishedAt, integrity])=>createReleaseAgeApproval({
+            packageName,
+            version,
+            reason: releaseAgeReasons.framework,
+            publishedAt,
+            integrity,
+            review: releaseAgeReviewEvidence.rsbuildRspack20260826
+        }))
+];
+const ULTRAMODERN_WORKSPACE_POLICY = {
+    schemaVersion: 1,
+    dependencies: ULTRAMODERN_PACKAGE_PINS,
+    toolchain: {
+        node: {
+            version: NODE_VERSION,
+            engineRange: '>=26'
+        },
+        packageManager: {
+            name: 'pnpm',
+            version: PNPM_VERSION,
+            engineRange: '>=11'
+        }
+    },
+    pnpm: {
+        minimumReleaseAge: 1440,
+        minimumReleaseAgeStrict: true,
+        minimumReleaseAgeIgnoreMissingTime: false,
+        trustPolicy: 'no-downgrade',
+        trustPolicyIgnoreAfter: 1440,
+        trustPolicyExclude: [
+            `@effect/opentelemetry@${EFFECT_VERSION}`,
+            `effect@${EFFECT_VERSION}`
+        ],
+        blockExoticSubdeps: true,
+        engineStrict: true,
+        pmOnFail: 'error',
+        verifyDepsBeforeRun: 'error',
+        strictDepBuilds: true,
+        peerDependencyRules: {
+            allowedVersions: {
+                react: '>=19.0.0',
+                '@effect/vitest>effect': EFFECT_VERSION
+            }
+        },
+        overrides: {
+            '@effect/opentelemetry': EFFECT_VERSION,
+            '@effect/vitest': EFFECT_VITEST_VERSION,
+            '@tanstack/history': TANSTACK_HISTORY_VERSION,
+            '@tanstack/react-router': TANSTACK_ROUTER_VERSION,
+            '@tanstack/router-core': TANSTACK_ROUTER_CORE_VERSION,
+            effect: EFFECT_VERSION,
+            msgpackr: MSGPACKR_VERSION,
+            'node-fetch': NODE_FETCH_VERSION,
+            zod: ZOD_VERSION
+        },
+        allowBuilds: {
+            '@parcel/watcher': true,
+            '@swc/core': true,
+            'core-js': true,
+            esbuild: true,
+            lefthook: true,
+            'msgpackr-extract': true,
+            sharp: true,
+            workerd: true
+        },
+        patchedDependencies: {
+            required: requiredPatchPolicies,
+            conditional: conditionalPatchPolicies,
+            stale: stalePatchPolicies
+        },
+        releaseAge: {
+            approvals: releaseAgeApprovals,
+            registryEvidence: {
+                moduleFederation: {
+                    version: MODULE_FEDERATION_VERSION,
+                    nodeVersion: MODULE_FEDERATION_NODE_VERSION,
+                    releases: moduleFederationRegistryReleases.map(([packageSuffix, publishedAt, integrity])=>({
+                            packageName: `@module-federation/${packageSuffix}`,
+                            version: MODULE_FEDERATION_VERSION,
+                            registry: {
+                                publishedAt,
+                                dist: {
+                                    integrity
+                                }
+                            }
+                        })),
+                    node: moduleFederationNodeRegistryRelease
+                }
+            },
+            firstParty: {
+                source: 'authenticated-release-cohort-projection',
+                exactVersionOnly: true,
+                staticApprovals: false
+            }
+        }
+    },
+    metadata: {
+        packageSource: {
+            configPath: '.modernjs/ultramodern.json',
+            rootManifestPath: 'modernjs.packageSource',
+            ownedKeys: [
+                'strategy',
+                'modernPackageVersion',
+                'registry',
+                'aliasScope',
+                'aliasPackageNamePrefix'
+            ]
+        },
+        moduleFederation: {
+            version: MODULE_FEDERATION_VERSION,
+            nodeVersion: MODULE_FEDERATION_NODE_VERSION,
+            configPath: 'moduleFederation',
+            appConfigPath: 'topology.apps[].moduleFederation'
+        },
+        nativePreview: {
+            packageName: "@typescript/native-preview",
+            version: TYPESCRIPT_NATIVE_PREVIEW_VERSION,
+            generatedDependencyPolicy: 'forbidden',
+            releaseAgePolicy: 'exact-reviewed-closure-only'
+        }
+    }
+};
+const exactPackageNamePattern = /^(?:@[a-z0-9][a-z0-9._~-]*\/[a-z0-9][a-z0-9._~-]*|[a-z0-9][a-z0-9._~-]*)$/u;
+const exactVersionPattern = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/u;
+const integrityPattern = /^sha(?:256|384|512)-[A-Za-z0-9+/]+={0,2}$/u;
+const sha256Pattern = /^[a-f0-9]{64}$/u;
+const immutableCommitUriPattern = /^https:\/\/github\.com\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+\/commit\/[a-f0-9]{40}$/u;
+function comparePackageVersions(left, right) {
+    if (left.packageName !== right.packageName) return left.packageName < right.packageName ? -1 : 1;
+    if (left.version === right.version) return 0;
+    return left.version < right.version ? -1 : 1;
+}
+function packageVersionKey(value) {
+    return `${value.packageName}@${value.version}`;
+}
+function assertCanonicalInstant(value, label) {
+    if ('string' != typeof value) throw new Error(`${label} must be an ISO-8601 UTC timestamp.`);
+    const timestamp = Date.parse(value);
+    if (!Number.isFinite(timestamp) || new Date(timestamp).toISOString() !== value) throw new Error(`${label} must be a canonical ISO-8601 UTC timestamp.`);
+    return timestamp;
+}
+function assertExactPackageVersion(value, label) {
+    if ('string' != typeof value.packageName || !exactPackageNamePattern.test(value.packageName)) throw new Error(`${label}.packageName must be an exact npm package name without ranges, tags, or globs.`);
+    if ('string' != typeof value.version || !exactVersionPattern.test(value.version)) throw new Error(`${label}.version must be one exact semantic version without ranges, tags, or globs.`);
+}
+function requiredRecord(value, label) {
+    if (!value || 'object' != typeof value || Array.isArray(value)) throw new Error(`${label} must be an object.`);
+    return value;
+}
+function validateReleaseAgeApprovals(approvals, options = {}) {
+    if (!Array.isArray(approvals)) throw new Error('releaseAge.approvals must be an array.');
+    const now = options.now ?? new Date();
+    if (!Number.isFinite(now.getTime())) throw new Error('Release-age validation requires a valid current time.');
+    const seen = new Set();
+    const validated = approvals.map((rawApproval, index)=>{
+        const label = `releaseAge.approvals[${index}]`;
+        const approval = requiredRecord(rawApproval, label);
+        assertExactPackageVersion(approval, label);
+        const key = packageVersionKey({
+            packageName: approval.packageName,
+            version: approval.version
+        });
+        if (seen.has(key)) throw new Error(`Duplicate release-age approval for ${key}.`);
+        seen.add(key);
+        for (const field of [
+            'reason',
+            'reviewer'
+        ]){
+            const value = approval[field];
+            if ('string' != typeof value || 0 === value.trim().length || /^(?:unknown|todo|tbd|placeholder)$/iu.test(value.trim())) throw new Error(`${label}.${field} must identify real review evidence.`);
+        }
+        const reviewedAt = assertCanonicalInstant(approval.reviewedAt, `${label}.reviewedAt`);
+        const expiresAt = assertCanonicalInstant(approval.expiresAt, `${label}.expiresAt`);
+        if (expiresAt <= reviewedAt) throw new Error(`${key} expiresAt must be after reviewedAt.`);
+        const evidence = requiredRecord(approval.evidence, `${label}.evidence`);
+        if ('string' != typeof evidence.uri || !immutableCommitUriPattern.test(evidence.uri)) throw new Error(`${label}.evidence.uri must reference an immutable full GitHub commit.`);
+        if ('string' != typeof evidence.sha256 || !sha256Pattern.test(evidence.sha256)) throw new Error(`${label}.evidence.sha256 must be a SHA-256 digest.`);
+        if ('git-commit-payload' !== evidence.sha256Subject) throw new Error(`${label}.evidence.sha256Subject must identify the raw Git commit payload.`);
+        const registry = requiredRecord(approval.registry, `${label}.registry`);
+        const publishedAt = assertCanonicalInstant(registry.publishedAt, `${label}.registry.publishedAt`);
+        if (publishedAt > reviewedAt) throw new Error(`${key} cannot be reviewed before its registry publish time.`);
+        const dist = requiredRecord(registry.dist, `${label}.registry.dist`);
+        if ('string' != typeof dist.integrity || !integrityPattern.test(dist.integrity)) throw new Error(`${label}.registry.dist.integrity must be a valid SRI.`);
+        return approval;
+    });
+    return validated.sort(comparePackageVersions);
+}
+function renderMinimumReleaseAgeExclude(options = {}) {
+    const now = options.now ?? new Date();
+    const nowTimestamp = now.getTime();
+    const reviewedSelectors = validateReleaseAgeApprovals(options.approvals ?? ULTRAMODERN_WORKSPACE_POLICY.pnpm.releaseAge.approvals, {
+        now
+    }).filter((approval)=>{
+        const reviewedAt = Date.parse(approval.reviewedAt);
+        const expiresAt = Date.parse(approval.expiresAt);
+        const maturesAt = Date.parse(approval.registry.publishedAt) + 60000 * ULTRAMODERN_WORKSPACE_POLICY.pnpm.minimumReleaseAge;
+        return reviewedAt <= nowTimestamp && nowTimestamp < expiresAt && nowTimestamp < maturesAt;
+    }).map(packageVersionKey).sort();
+    const packageSource = options.packageSource;
+    if (packageSource?.strategy !== 'install' || !exactVersionPattern.test(packageSource.modernPackageVersion)) return reviewedSelectors;
+    if (void 0 === options.releaseCohort) throw new Error('Authenticated release cohort projection is required for install package sources.');
+    const releaseCohort = parseUltramodernReleaseCohort(options.releaseCohort);
+    assertReleaseCohortPackageSource(releaseCohort, packageSource);
+    const firstPartySelectors = releaseCohortSelectors(releaseCohort);
+    return [
+        ...new Set([
+            ...reviewedSelectors,
+            ...firstPartySelectors
+        ])
+    ].sort();
+}
+function resolveReleaseAgeApprovals(candidates, options = {}) {
+    if (!Array.isArray(candidates)) throw new Error('Release-age dependency closure must be an array.');
+    const approvals = validateReleaseAgeApprovals(options.approvals ?? ULTRAMODERN_WORKSPACE_POLICY.pnpm.releaseAge.approvals, {
+        now: options.now
+    });
+    const now = options.now ?? new Date();
+    const nowTimestamp = now.getTime();
+    const approvalsByKey = new Map(approvals.map((approval)=>[
+            packageVersionKey(approval),
+            approval
+        ]));
+    const candidatesByKey = new Map();
+    for (const [index, candidate] of candidates.entries()){
+        const label = `dependencyClosure[${index}]`;
+        const record = requiredRecord(candidate, label);
+        assertExactPackageVersion(record, label);
+        const registry = requiredRecord(record.registry, `${label}.registry`);
+        const dist = requiredRecord(registry.dist, `${label}.registry.dist`);
+        if ('string' != typeof dist.integrity || !integrityPattern.test(dist.integrity)) throw new Error(`${label}.registry.dist.integrity is required; registry uncertainty is fail-closed.`);
+        const publishedAt = assertCanonicalInstant(registry.publishedAt, `${label}.registry.publishedAt`);
+        if (publishedAt > nowTimestamp) throw new Error(`${label}.registry.publishedAt is in the future; registry uncertainty is fail-closed.`);
+        const key = packageVersionKey(record);
+        if (candidatesByKey.has(key)) throw new Error(`Duplicate dependency-closure candidate for ${key}.`);
+        candidatesByKey.set(key, {
+            candidate,
+            publishedAt
+        });
+    }
+    const approved = [];
+    const reviewCandidates = [];
+    for (const [key, resolvedCandidate] of candidatesByKey){
+        const { candidate, publishedAt } = resolvedCandidate;
+        const approval = approvalsByKey.get(key);
+        const maturesAt = publishedAt + 60000 * ULTRAMODERN_WORKSPACE_POLICY.pnpm.minimumReleaseAge;
+        if (approval) {
+            if (candidate.registry.dist.integrity !== approval.registry.dist.integrity) throw new Error(`Release-age approval ${key} does not match lock integrity.`);
+            if (candidate.registry.publishedAt !== approval.registry.publishedAt) throw new Error(`Release-age approval ${key} does not match registry publish time.`);
+        }
+        if (!(nowTimestamp >= maturesAt)) {
+            if (!approval || Date.parse(approval.reviewedAt) > nowTimestamp) {
+                reviewCandidates.push(candidate);
+                continue;
+            }
+            if (Date.parse(approval.expiresAt) <= nowTimestamp) throw new Error(`Release-age approval for immature ${key} expired at ${approval.expiresAt}.`);
+            approved.push(candidate);
+        }
+    }
+    for (const approval of approvals){
+        const key = packageVersionKey(approval);
+        const reviewedAt = Date.parse(approval.reviewedAt);
+        const expiresAt = Date.parse(approval.expiresAt);
+        const maturesAt = Date.parse(approval.registry.publishedAt) + 60000 * ULTRAMODERN_WORKSPACE_POLICY.pnpm.minimumReleaseAge;
+        if (reviewedAt <= nowTimestamp && nowTimestamp < expiresAt && nowTimestamp < maturesAt && !candidatesByKey.has(key)) throw new Error(`Release-age approval ${key} is unmatched by the dependency closure.`);
+    }
+    return {
+        minimumReleaseAgeExclude: approved.sort(comparePackageVersions).map(packageVersionKey),
+        reviewCandidates: reviewCandidates.sort(comparePackageVersions)
+    };
+}
+export { ULTRAMODERN_PACKAGE_PINS, ULTRAMODERN_WORKSPACE_POLICY, createCloudflareDeployContract, createCloudflareSecurityContract, createPublicHeadRobotsPolicy, createPublicSurfaceContentExpansionPolicy, formatTsJsonValue, renderMinimumReleaseAgeExclude, resolveReleaseAgeApprovals, validateReleaseAgeApprovals };