@bleedingdev/modern-js-ultramodern-create 3.9.0-ultramodern.2 → 3.9.0-ultramodern.21

package/dist/esm-node/ultramodern-workspace/policy.js

@@ -1,10 +1,9 @@
 import "node:module";
-import { assertReleaseCohortPackageSource, parseUltramodernReleaseCohort, releaseCohortSelectors } from "../ultramodern-release-cohort.js";
 import { rpcPath } from "./api/rpc.js";
 import { appEmitsBrowserUi, appHasApi, appI18nNamespace, createCloudflarePublicUrlEnv, createCloudflareWorkerName, resolveApiPrefix, resolveApiProtocol, resolveApiStem } from "./descriptors.js";
 import { createLocalisedUrlsMap } from "./routes.js";
 import { isRecord } from "./types.js";
-import { CLOUDFLARE_COMPATIBILITY_DATE, CLOUDFLARE_WORKERS_TYPES_VERSION, CROSS_ENV_VERSION, DRIZZLE_ORM_VERSION, EFFECT_TSGO_VERSION, EFFECT_VERSION, EFFECT_VITEST_VERSION, I18NEXT_VERSION, LEFTHOOK_VERSION, MINIFLARE_VERSION, MODULE_FEDERATION_NODE_VERSION, MODULE_FEDERATION_VERSION, MSGPACKR_VERSION, NODE_FETCH_VERSION, NODE_VERSION, OXFMT_VERSION, OXLINT_VERSION, PNPM_VERSION, REACT_DOM_VERSION, REACT_VERSION, RSBUILD_PLUGIN_TAILWINDCSS_VERSION, TAILWIND_VERSION, TANSTACK_HISTORY_VERSION, TANSTACK_ROUTER_CORE_VERSION, TANSTACK_ROUTER_VERSION, TYPESCRIPT_NATIVE_PREVIEW_VERSION, TYPESCRIPT_VERSION, TYPES_NODE_VERSION, TYPES_REACT_DOM_VERSION, TYPES_REACT_VERSION, ULTRACITE_VERSION, WORKERD_VERSION, WRANGLER_VERSION, ZEPHYR_AGENT_VERSION, ZEPHYR_RSPACK_PLUGIN_VERSION, ZOD_VERSION } from "./versions.js";
+import { CLOUDFLARE_COMPATIBILITY_DATE, EFFECT_VERSION, NODE_VERSION, PNPM_VERSION, ULTRAMODERN_PACKAGE_PINS } from "./versions.js";
 function createCloudflareProofRoute(app) {
     if ('shell' === app.kind) return {
         ssr: '/en',
@@ -208,10 +207,6 @@ function createCloudflareDeployContract(scope, app) {
         routes: createCloudflareProofRoute(app),
         security: createCloudflareSecurityContract(),
         qualityGates: createPublicWebsiteQualityGateContract(),
-        evidence: {
-            proofScript: "scripts/proof-cloudflare-version.mts",
-            reportDefault: '.codex/reports/cloudflare-version-proof/public-url-proof.json'
-        },
         ...app.api ? {
             jsonSmokeChecks: [
                 createApiSmokeCheck(app)
@@ -219,344 +214,6 @@ function createCloudflareDeployContract(scope, app) {
         } : {}
     };
 }
-const ULTRAMODERN_PACKAGE_PINS = {
-    appDependencies: {
-        '@module-federation/bridge-react': MODULE_FEDERATION_VERSION,
-        '@module-federation/modern-js-v3': MODULE_FEDERATION_VERSION,
-        '@module-federation/runtime': MODULE_FEDERATION_VERSION,
-        '@tanstack/react-router': TANSTACK_ROUTER_VERSION,
-        i18next: I18NEXT_VERSION,
-        'node-fetch': NODE_FETCH_VERSION,
-        react: REACT_VERSION,
-        'react-dom': REACT_DOM_VERSION
-    },
-    bffEffectDependencies: {
-        '@effect/opentelemetry': EFFECT_VERSION,
-        effect: EFFECT_VERSION
-    },
-    appDevDependencies: {
-        '@effect/tsgo': EFFECT_TSGO_VERSION,
-        '@rsbuild/plugin-tailwindcss': `^${RSBUILD_PLUGIN_TAILWINDCSS_VERSION}`,
-        "@typescript/native": `npm:typescript@${TYPESCRIPT_VERSION}`,
-        '@types/node': TYPES_NODE_VERSION,
-        '@types/react': TYPES_REACT_VERSION,
-        '@types/react-dom': TYPES_REACT_DOM_VERSION,
-        'cross-env': CROSS_ENV_VERSION,
-        tailwindcss: `^${TAILWIND_VERSION}`,
-        typescript: TYPESCRIPT_VERSION,
-        wrangler: WRANGLER_VERSION,
-        'zephyr-rspack-plugin': ZEPHYR_RSPACK_PLUGIN_VERSION
-    },
-    rootDevDependencies: {
-        '@effect/tsgo': EFFECT_TSGO_VERSION,
-        "@typescript/native": `npm:typescript@${TYPESCRIPT_VERSION}`,
-        'cross-env': CROSS_ENV_VERSION,
-        lefthook: LEFTHOOK_VERSION,
-        miniflare: MINIFLARE_VERSION,
-        oxlint: OXLINT_VERSION,
-        oxfmt: OXFMT_VERSION,
-        ultracite: ULTRACITE_VERSION,
-        wrangler: WRANGLER_VERSION,
-        'zephyr-agent': ZEPHYR_AGENT_VERSION
-    },
-    transitiveDependencies: {
-        '@cloudflare/workers-types': CLOUDFLARE_WORKERS_TYPES_VERSION,
-        '@module-federation/node': MODULE_FEDERATION_NODE_VERSION,
-        '@tanstack/history': TANSTACK_HISTORY_VERSION,
-        '@tanstack/router-core': TANSTACK_ROUTER_CORE_VERSION,
-        "@typescript/native-preview": TYPESCRIPT_NATIVE_PREVIEW_VERSION,
-        miniflare: MINIFLARE_VERSION,
-        workerd: WORKERD_VERSION
-    }
-};
-const requiredPatchPolicies = [
-    {
-        packageName: '@module-federation/dts-plugin',
-        version: MODULE_FEDERATION_VERSION,
-        path: `patches/@module-federation__dts-plugin@${MODULE_FEDERATION_VERSION}.patch`
-    },
-    {
-        packageName: '@module-federation/bridge-react',
-        version: MODULE_FEDERATION_VERSION,
-        path: `patches/@module-federation__bridge-react@${MODULE_FEDERATION_VERSION}.patch`
-    },
-    {
-        packageName: '@module-federation/modern-js-v3',
-        version: MODULE_FEDERATION_VERSION,
-        path: `patches/@module-federation__modern-js-v3@${MODULE_FEDERATION_VERSION}.patch`
-    },
-    {
-        packageName: '@module-federation/runtime-core',
-        version: MODULE_FEDERATION_VERSION,
-        path: `patches/@module-federation__runtime-core@${MODULE_FEDERATION_VERSION}.patch`
-    },
-    {
-        packageName: 'msgpackr',
-        version: MSGPACKR_VERSION,
-        path: `patches/msgpackr@${MSGPACKR_VERSION}.patch`
-    },
-    {
-        packageName: 'zod',
-        version: ZOD_VERSION,
-        path: `patches/zod@${ZOD_VERSION}.patch`
-    }
-];
-const conditionalPatchPolicies = [
-    {
-        packageName: 'drizzle-orm',
-        version: DRIZZLE_ORM_VERSION,
-        path: 'patches/drizzle-orm-ts7-strict-declarations.patch'
-    }
-];
-const stalePatchPolicies = [
-    {
-        packageName: '@tanstack/router-core',
-        version: '1.171.27',
-        path: 'patches/@tanstack__router-core@1.171.27.patch',
-        sha256: 'd0e147ec82083771b70989d2a1da6aa47f342ae42071af86c4247649f6a5b9e9'
-    },
-    {
-        packageName: 'msgpackr',
-        version: '2.0.6',
-        path: 'patches/msgpackr@2.0.6.patch',
-        sha256: 'ea06f707e02e6b95d68e199347ada7bd640764e2653bfdd77664592390fac811'
-    },
-    {
-        packageName: 'zod',
-        version: '4.4.3',
-        path: 'patches/zod@4.4.3.patch',
-        sha256: '2ae01a829b3f4082e46f1ccb4cbcffdea0db8664c2544b3566cb507e2c471c77'
-    },
-    {
-        packageName: '@module-federation/bridge-react',
-        version: '2.8.2',
-        path: 'patches/@module-federation__bridge-react@2.8.2.patch',
-        sha256: '8c084f41790295af8fd015b897c6298bbc13d927b796c624ac96cb2bdb4bc87c'
-    },
-    {
-        packageName: '@module-federation/modern-js-v3',
-        version: '2.8.2',
-        path: 'patches/@module-federation__modern-js-v3@2.8.2.patch',
-        sha256: '948d2a725ae526f395b0343b113ff80dfaa50dbdec8158179746e98259925d20'
-    },
-    {
-        packageName: '@module-federation/bridge-react',
-        version: '2.8.0',
-        path: 'patches/@module-federation__bridge-react@2.8.0.patch',
-        sha256: '54bfc79e097473222f83cbfa6d717792e3026bf16b5097c2ed91715b7da126be'
-    },
-    {
-        packageName: '@module-federation/modern-js-v3',
-        version: '2.8.0',
-        path: 'patches/@module-federation__modern-js-v3@2.8.0.patch',
-        sha256: '948d2a725ae526f395b0343b113ff80dfaa50dbdec8158179746e98259925d20'
-    },
-    {
-        packageName: '@module-federation/bridge-react',
-        version: '2.7.0',
-        path: 'patches/@module-federation__bridge-react@2.7.0.patch',
-        sha256: '2f89441475f83a6e12d8c2a755b5b15c4d2b04523a1b33fd318c2d537382537f'
-    },
-    {
-        packageName: '@module-federation/modern-js-v3',
-        version: '2.7.0',
-        path: 'patches/@module-federation__modern-js-v3@2.7.0.patch',
-        sha256: 'f51adf0aa6c6e2daa5b7d2978a7716c0d4fb05b29af449b2f16257b957fb7923'
-    },
-    {
-        packageName: 'effect',
-        version: '4.0.0-beta.107',
-        path: 'patches/effect-schema-error-type-id.patch',
-        sha256: 'ed9f636f82a1a1e5c128fc85e99e24a8fcf4ba06a35e89e3dd6460250875153f'
-    },
-    {
-        packageName: 'effect',
-        version: '4.0.0-beta.94',
-        path: 'patches/effect-schema-error-type-id.patch',
-        sha256: 'ed9f636f82a1a1e5c128fc85e99e24a8fcf4ba06a35e89e3dd6460250875153f',
-        acceptedLegacySha256: [
-            'd9e12b42d06a051957899a9df14b2b7b2385fc3a5677a89037eeee3674d64ebe',
-            'dc7e8088e600beb20185eb877754d749c4a93909fb79f49465e8319e40d6596a',
-            'bd29a0ae24f0674c6007e5e6060d847dbeb9499a6e2cf4c9f13b24ba9fb3af37'
-        ]
-    },
-    {
-        packageName: 'effect',
-        version: '4.0.0-beta.97',
-        path: 'patches/effect-schema-error-type-id.patch',
-        sha256: 'ed9f636f82a1a1e5c128fc85e99e24a8fcf4ba06a35e89e3dd6460250875153f',
-        acceptedLegacySha256: [
-            'd9e12b42d06a051957899a9df14b2b7b2385fc3a5677a89037eeee3674d64ebe',
-            'dc7e8088e600beb20185eb877754d749c4a93909fb79f49465e8319e40d6596a',
-            'bd29a0ae24f0674c6007e5e6060d847dbeb9499a6e2cf4c9f13b24ba9fb3af37'
-        ]
-    },
-    {
-        packageName: 'effect',
-        version: '4.0.0-beta.102',
-        path: 'patches/effect-schema-error-type-id.patch',
-        sha256: 'ed9f636f82a1a1e5c128fc85e99e24a8fcf4ba06a35e89e3dd6460250875153f',
-        acceptedLegacySha256: [
-            'd9e12b42d06a051957899a9df14b2b7b2385fc3a5677a89037eeee3674d64ebe',
-            'dc7e8088e600beb20185eb877754d749c4a93909fb79f49465e8319e40d6596a',
-            'bd29a0ae24f0674c6007e5e6060d847dbeb9499a6e2cf4c9f13b24ba9fb3af37'
-        ]
-    },
-    {
-        packageName: '@module-federation/dts-plugin',
-        version: '2.7.0',
-        path: 'patches/@module-federation__dts-plugin@2.7.0.patch',
-        sha256: '768cc3bb22e2dede264515f141fdc8af937c8f53d4f8ef8f83469bb0cec1c9a0'
-    },
-    {
-        packageName: '@module-federation/bridge-react',
-        version: '2.6.0',
-        path: 'patches/@module-federation__bridge-react@2.6.0.patch',
-        sha256: '75982bd9b4d40922ce3110ded5254f7faca39112b79d41f27fe0ac4bb416c467'
-    },
-    {
-        packageName: '@module-federation/dts-plugin',
-        version: '2.6.0',
-        path: 'patches/@module-federation__dts-plugin@2.6.0.patch',
-        sha256: 'bc998f74617f7f060ea0f65235f071a5880aade3144ccd610d098d6bbc1c52fe',
-        acceptedLegacySha256: [
-            'ad19439992ca0757dc7354ad4197eecd5ac83f3ef5ed990e9200c672138600d5'
-        ]
-    },
-    {
-        packageName: '@module-federation/modern-js-v3',
-        version: '2.6.0',
-        path: 'patches/@module-federation__modern-js-v3@2.6.0.patch',
-        sha256: '51ab49dc776c56cdaa8eb43fbd0bb2788633d6b05acfb18fb2f3a1db81c02d87'
-    },
-    {
-        packageName: '@tanstack/router-core',
-        version: '1.171.21',
-        path: 'patches/@tanstack__router-core@1.171.21.patch',
-        sha256: 'fb269f2a1c6c789ffb2d4f9341f6dd6a1dbb977b5bb66ce8e31a3a9cdd197dad'
-    },
-    {
-        packageName: '@tanstack/router-core',
-        version: '1.171.13',
-        path: 'patches/@tanstack__router-core@1.171.13.patch',
-        sha256: '0c6119dcaa6ad35a11e1ce4fd95179bf929d5b5a86e9cbee110f45bd07c5c8d3'
-    },
-    {
-        packageName: '@tanstack/router-core',
-        version: '1.171.14',
-        path: 'patches/@tanstack__router-core@1.171.14.patch',
-        sha256: '1e1572940e00d6327c75bb8457c108e32e75a2292e4d90d764208d5b6f330155'
-    },
-    {
-        packageName: 'react-server-dom-rspack',
-        version: '0.0.3',
-        path: 'patches/@react-server-dom-rspack@0.0.3.patch',
-        sha256: '11e471512012c0015883a233017b3ad695765e344cbd1d8174e79196ab6ba567'
-    }
-];
-const moduleFederationRegistryReleases = [
-    [
-        'bridge-react',
-        '2026-08-24T08:18:02.542Z',
-        'sha512-3wEVz9IMsDnbdTZjG+0XA7BHUU2yIvfTqWRrMPR9RciSOVojJUXocZ6Anksu7WhuYnasc7am8szpms7pZGotnA=='
-    ],
-    [
-        'bridge-react-webpack-plugin',
-        '2026-08-24T08:19:41.007Z',
-        'sha512-hv3fuQkGERQ/COBKTVbFV1GWovReSg/bzJzDuxWR1F84h6NYtbYMWQqX8Egvb7HKMtn9Rflzw0GeaLr8F08vDg=='
-    ],
-    [
-        'cli',
-        '2026-08-24T08:21:41.802Z',
-        'sha512-r9RdlLRy3zWxuWQRonif48xdDu1reBGx18QpkZwLQ4JfSrOARjycNIGY2Y7QaUw7dedzxyee4FtKFeX/kOVLYQ=='
-    ],
-    [
-        'dts-plugin',
-        '2026-08-24T08:19:17.035Z',
-        'sha512-uMGqEG/p9odG2BVr7WRbBe2OgrvzBd3LPzcp5WP+bm3djBdUJ4PZ3ozqKp6qpy+NFnlh6vnM815Xn6AXkKy1Vw=='
-    ],
-    [
-        'enhanced',
-        '2026-08-24T08:20:25.023Z',
-        'sha512-Jd/JHoFL9fNKL4Nnzo/9hf6FD/oQo3gKpE8xt6EGuhxmrvg6wM0radPtqgHiSSWLMW7CiXr2agNjKvquKd83rw=='
-    ],
-    [
-        'error-codes',
-        '2026-08-24T08:22:25.614Z',
-        'sha512-IGpd+VRlji3NyGOGGTsk7YEmPRKcDoBK4YHqIuP+OQwyb2YhHCUHO2vW9RXeQxCuKwi+c6xkTweRYG+Umy+0Zw=='
-    ],
-    [
-        'inject-external-runtime-core-plugin',
-        '2026-08-24T08:21:16.321Z',
-        'sha512-k3wCSZsY21HjYQ61wmIJUQleOgcHgqx/sX4qXYw0XnJnzHuFo64rzMvgr+TuBIgZ1peAQtfILLlTnWyTRjtZHw=='
-    ],
-    [
-        'managers',
-        '2026-08-24T08:19:45.898Z',
-        'sha512-8KhB2PF4g+M0hGaethU1H4GVWabLn5sF5TvnM6VxgAcDL4TfLY8aC/YobAXHG/SV0jpU5lsGe6s6xy6ccV0MQw=='
-    ],
-    [
-        'manifest',
-        '2026-08-24T08:19:49.387Z',
-        'sha512-Zhm9luVOw9XPou50eTwsvdgr208CszoQ6cGORQDCPAMhjpGb5oYFtilJ+LKW7hQ1LktD15bEZmGhC1anvgXEiQ=='
-    ],
-    [
-        'modern-js-v3',
-        '2026-08-24T08:21:54.080Z',
-        'sha512-IzFEJnO53vEVLrm5qlDrCPO1bEmN11TLaPHrZtPqHfy7yjwhBDi/63uLAVwcqKVGZnK5Erbqg9Y3hJkZKxd4AQ=='
-    ],
-    [
-        'rsbuild-plugin',
-        '2026-08-24T08:19:38.788Z',
-        'sha512-CaWAxZg+zOMw/BfgRXQdNBQZ/e5U7DBZvE13LzG13GEclt7yxaMQgKH0si3uOsq9f/X2NC8UnuhNHLIkloqlqA=='
-    ],
-    [
-        'rspack',
-        '2026-08-24T08:21:20.630Z',
-        'sha512-9zSlmQYKRHKVWqhlZSMyjstp2A3VVrQV2Of8mrF5NXhngFemNx7Hw35+MTo+gsRfF5glpN8bAzLyIokRUo1Cog=='
-    ],
-    [
-        'runtime',
-        '2026-08-24T08:21:03.780Z',
-        'sha512-3cyAav0hWP+dNvB7qrcK9CKxQn+JvkbRvLtZz3zS2g0EyxtDFDjgbHY0Afcf7oHf8IHhKeEdzb/3Kjr1Pjmr7A=='
-    ],
-    [
-        'runtime-core',
-        '2026-08-24T08:19:49.581Z',
-        'sha512-dLykRYfpbEJBTdk2NlbNoVVTB196O3qujawTBguLABJkPCWETJNk60NR1yZO34eI+DTH+eGwHU3m7FddAWnbnw=='
-    ],
-    [
-        'runtime-tools',
-        '2026-08-24T08:19:57.575Z',
-        'sha512-u2puqsaHiw1bVvLNk1uh98iPo6UzaBuci/aTvOFwKvbT/RF18C3vGGnm+ShHPKQEnoN6ctPtnygyOZDPR+8cgg=='
-    ],
-    [
-        'sdk',
-        '2026-08-24T08:20:29.076Z',
-        'sha512-IMjObgBGQTXd33jTTCYcxvz8iOQGLsZ2QIPOj90rDxuBtJsN4WJwYyXqligrhY/e5p/BipUPdbIgKmWL7zFhTw=='
-    ],
-    [
-        'third-party-dts-extractor',
-        '2026-08-24T08:22:33.751Z',
-        'sha512-R1Xuqnqzw6wQxWV3yU9fX1FydXAeZF2TNVFAVo1N1oLBA2j5y7aUO/Fc3VSNgd9/gxMzJgTVBdA+nMiD2SFCgg=='
-    ],
-    [
-        'webpack-bundler-runtime',
-        '2026-08-24T08:20:31.955Z',
-        'sha512-MdU6NQibT57MaJG3KPBjC30IVBrz5eU7IcjHoVDYnMh7OmASw3stagBu7hYjdMTP31luNdtzUn85s9axvdwTlw=='
-    ]
-];
-const moduleFederationNodeRegistryRelease = {
-    packageName: '@module-federation/node',
-    version: MODULE_FEDERATION_NODE_VERSION,
-    registry: {
-        publishedAt: '2026-08-24T08:22:30.137Z',
-        dist: {
-            integrity: 'sha512-mbpQRdafyeWgsmYoJfdhOQf76zS6onOGpC2X1ELpWXB1Y4BcZGloL0CLjNMNon9m3ucfpc99tOGAQqFzQVkSBQ=='
-        }
-    }
-};
-const releaseAgeApprovals = [];
 const ULTRAMODERN_WORKSPACE_POLICY = {
     schemaVersion: 1,
     dependencies: ULTRAMODERN_PACKAGE_PINS,
@@ -577,10 +234,6 @@ const ULTRAMODERN_WORKSPACE_POLICY = {
         minimumReleaseAgeIgnoreMissingTime: false,
         trustPolicy: 'no-downgrade',
         trustPolicyIgnoreAfter: 1440,
-        trustPolicyExclude: [
-            `@effect/opentelemetry@${EFFECT_VERSION}`,
-            `effect@${EFFECT_VERSION}`
-        ],
         blockExoticSubdeps: true,
         engineStrict: true,
         pmOnFail: 'error',
@@ -592,230 +245,15 @@ const ULTRAMODERN_WORKSPACE_POLICY = {
                 '@effect/vitest>effect': EFFECT_VERSION
             }
         },
-        overrides: {
-            '@effect/opentelemetry': EFFECT_VERSION,
-            '@effect/vitest': EFFECT_VITEST_VERSION,
-            '@tanstack/history': TANSTACK_HISTORY_VERSION,
-            '@tanstack/react-router': TANSTACK_ROUTER_VERSION,
-            '@tanstack/router-core': TANSTACK_ROUTER_CORE_VERSION,
-            effect: EFFECT_VERSION,
-            msgpackr: MSGPACKR_VERSION,
-            'node-fetch': NODE_FETCH_VERSION,
-            zod: ZOD_VERSION
-        },
         allowBuilds: {
             '@parcel/watcher': true,
             '@swc/core': true,
             'core-js': true,
             esbuild: true,
             lefthook: true,
-            'msgpackr-extract': true,
             sharp: true,
             workerd: true
-        },
-        patchedDependencies: {
-            required: requiredPatchPolicies,
-            conditional: conditionalPatchPolicies,
-            stale: stalePatchPolicies
-        },
-        releaseAge: {
-            approvals: releaseAgeApprovals,
-            registryEvidence: {
-                moduleFederation: {
-                    version: MODULE_FEDERATION_VERSION,
-                    nodeVersion: MODULE_FEDERATION_NODE_VERSION,
-                    releases: moduleFederationRegistryReleases.map(([packageSuffix, publishedAt, integrity])=>({
-                            packageName: `@module-federation/${packageSuffix}`,
-                            version: MODULE_FEDERATION_VERSION,
-                            registry: {
-                                publishedAt,
-                                dist: {
-                                    integrity
-                                }
-                            }
-                        })),
-                    node: moduleFederationNodeRegistryRelease
-                }
-            },
-            firstParty: {
-                source: 'authenticated-release-cohort-projection',
-                exactVersionOnly: true,
-                staticApprovals: false
-            }
-        }
-    },
-    metadata: {
-        packageSource: {
-            configPath: '.modernjs/ultramodern.json',
-            rootManifestPath: 'modernjs.packageSource',
-            ownedKeys: [
-                'strategy',
-                'modernPackageVersion',
-                'registry',
-                'aliasScope',
-                'aliasPackageNamePrefix'
-            ]
-        },
-        moduleFederation: {
-            version: MODULE_FEDERATION_VERSION,
-            nodeVersion: MODULE_FEDERATION_NODE_VERSION,
-            configPath: 'moduleFederation',
-            appConfigPath: 'topology.apps[].moduleFederation'
-        },
-        nativePreview: {
-            packageName: "@typescript/native-preview",
-            version: TYPESCRIPT_NATIVE_PREVIEW_VERSION,
-            generatedDependencyPolicy: 'forbidden',
-            releaseAgePolicy: 'exact-reviewed-closure-only'
         }
     }
 };
-const exactPackageNamePattern = /^(?:@[a-z0-9][a-z0-9._~-]*\/[a-z0-9][a-z0-9._~-]*|[a-z0-9][a-z0-9._~-]*)$/u;
-const exactVersionPattern = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/u;
-const integrityPattern = /^sha(?:256|384|512)-[A-Za-z0-9+/]+={0,2}$/u;
-const sha256Pattern = /^[a-f0-9]{64}$/u;
-const immutableCommitUriPattern = /^https:\/\/github\.com\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+\/commit\/[a-f0-9]{40}$/u;
-function comparePackageVersions(left, right) {
-    if (left.packageName !== right.packageName) return left.packageName < right.packageName ? -1 : 1;
-    if (left.version === right.version) return 0;
-    return left.version < right.version ? -1 : 1;
-}
-function packageVersionKey(value) {
-    return `${value.packageName}@${value.version}`;
-}
-function assertCanonicalInstant(value, label) {
-    if ('string' != typeof value) throw new Error(`${label} must be an ISO-8601 UTC timestamp.`);
-    const timestamp = Date.parse(value);
-    if (!Number.isFinite(timestamp) || new Date(timestamp).toISOString() !== value) throw new Error(`${label} must be a canonical ISO-8601 UTC timestamp.`);
-    return timestamp;
-}
-function assertExactPackageVersion(value, label) {
-    if ('string' != typeof value.packageName || !exactPackageNamePattern.test(value.packageName)) throw new Error(`${label}.packageName must be an exact npm package name without ranges, tags, or globs.`);
-    if ('string' != typeof value.version || !exactVersionPattern.test(value.version)) throw new Error(`${label}.version must be one exact semantic version without ranges, tags, or globs.`);
-}
-function requiredRecord(value, label) {
-    if (!value || 'object' != typeof value || Array.isArray(value)) throw new Error(`${label} must be an object.`);
-    return value;
-}
-function validateReleaseAgeApprovals(approvals, options = {}) {
-    if (!Array.isArray(approvals)) throw new Error('releaseAge.approvals must be an array.');
-    const now = options.now ?? new Date();
-    if (!Number.isFinite(now.getTime())) throw new Error('Release-age validation requires a valid current time.');
-    const seen = new Set();
-    const validated = approvals.map((rawApproval, index)=>{
-        const label = `releaseAge.approvals[${index}]`;
-        const approval = requiredRecord(rawApproval, label);
-        assertExactPackageVersion(approval, label);
-        const key = packageVersionKey({
-            packageName: approval.packageName,
-            version: approval.version
-        });
-        if (seen.has(key)) throw new Error(`Duplicate release-age approval for ${key}.`);
-        seen.add(key);
-        for (const field of [
-            'reason',
-            'reviewer'
-        ]){
-            const value = approval[field];
-            if ('string' != typeof value || 0 === value.trim().length || /^(?:unknown|todo|tbd|placeholder)$/iu.test(value.trim())) throw new Error(`${label}.${field} must identify real review evidence.`);
-        }
-        const reviewedAt = assertCanonicalInstant(approval.reviewedAt, `${label}.reviewedAt`);
-        const expiresAt = assertCanonicalInstant(approval.expiresAt, `${label}.expiresAt`);
-        if (expiresAt <= reviewedAt) throw new Error(`${key} expiresAt must be after reviewedAt.`);
-        const evidence = requiredRecord(approval.evidence, `${label}.evidence`);
-        if ('string' != typeof evidence.uri || !immutableCommitUriPattern.test(evidence.uri)) throw new Error(`${label}.evidence.uri must reference an immutable full GitHub commit.`);
-        if ('string' != typeof evidence.sha256 || !sha256Pattern.test(evidence.sha256)) throw new Error(`${label}.evidence.sha256 must be a SHA-256 digest.`);
-        if ('git-commit-payload' !== evidence.sha256Subject) throw new Error(`${label}.evidence.sha256Subject must identify the raw Git commit payload.`);
-        const registry = requiredRecord(approval.registry, `${label}.registry`);
-        const publishedAt = assertCanonicalInstant(registry.publishedAt, `${label}.registry.publishedAt`);
-        if (publishedAt > reviewedAt) throw new Error(`${key} cannot be reviewed before its registry publish time.`);
-        const dist = requiredRecord(registry.dist, `${label}.registry.dist`);
-        if ('string' != typeof dist.integrity || !integrityPattern.test(dist.integrity)) throw new Error(`${label}.registry.dist.integrity must be a valid SRI.`);
-        return approval;
-    });
-    return validated.sort(comparePackageVersions);
-}
-function renderMinimumReleaseAgeExclude(options = {}) {
-    const now = options.now ?? new Date();
-    const nowTimestamp = now.getTime();
-    const reviewedSelectors = validateReleaseAgeApprovals(options.approvals ?? ULTRAMODERN_WORKSPACE_POLICY.pnpm.releaseAge.approvals, {
-        now
-    }).filter((approval)=>{
-        const reviewedAt = Date.parse(approval.reviewedAt);
-        const expiresAt = Date.parse(approval.expiresAt);
-        const maturesAt = Date.parse(approval.registry.publishedAt) + 60000 * ULTRAMODERN_WORKSPACE_POLICY.pnpm.minimumReleaseAge;
-        return reviewedAt <= nowTimestamp && nowTimestamp < expiresAt && nowTimestamp < maturesAt;
-    }).map(packageVersionKey).sort();
-    const packageSource = options.packageSource;
-    if (packageSource?.strategy !== 'install' || !exactVersionPattern.test(packageSource.modernPackageVersion)) return reviewedSelectors;
-    if (void 0 === options.releaseCohort) throw new Error('Authenticated release cohort projection is required for install package sources.');
-    const releaseCohort = parseUltramodernReleaseCohort(options.releaseCohort);
-    assertReleaseCohortPackageSource(releaseCohort, packageSource);
-    const firstPartySelectors = releaseCohortSelectors(releaseCohort);
-    return [
-        ...new Set([
-            ...reviewedSelectors,
-            ...firstPartySelectors
-        ])
-    ].sort();
-}
-function resolveReleaseAgeApprovals(candidates, options = {}) {
-    if (!Array.isArray(candidates)) throw new Error('Release-age dependency closure must be an array.');
-    const approvals = validateReleaseAgeApprovals(options.approvals ?? ULTRAMODERN_WORKSPACE_POLICY.pnpm.releaseAge.approvals, {
-        now: options.now
-    });
-    const now = options.now ?? new Date();
-    const nowTimestamp = now.getTime();
-    const approvalsByKey = new Map(approvals.map((approval)=>[
-            packageVersionKey(approval),
-            approval
-        ]));
-    const candidatesByKey = new Map();
-    for (const [index, candidate] of candidates.entries()){
-        const label = `dependencyClosure[${index}]`;
-        const record = requiredRecord(candidate, label);
-        assertExactPackageVersion(record, label);
-        const registry = requiredRecord(record.registry, `${label}.registry`);
-        const dist = requiredRecord(registry.dist, `${label}.registry.dist`);
-        if ('string' != typeof dist.integrity || !integrityPattern.test(dist.integrity)) throw new Error(`${label}.registry.dist.integrity is required; registry uncertainty is fail-closed.`);
-        const publishedAt = assertCanonicalInstant(registry.publishedAt, `${label}.registry.publishedAt`);
-        if (publishedAt > nowTimestamp) throw new Error(`${label}.registry.publishedAt is in the future; registry uncertainty is fail-closed.`);
-        const key = packageVersionKey(record);
-        if (candidatesByKey.has(key)) throw new Error(`Duplicate dependency-closure candidate for ${key}.`);
-        candidatesByKey.set(key, {
-            candidate,
-            publishedAt
-        });
-    }
-    const approved = [];
-    const reviewCandidates = [];
-    for (const [key, resolvedCandidate] of candidatesByKey){
-        const { candidate, publishedAt } = resolvedCandidate;
-        const approval = approvalsByKey.get(key);
-        const maturesAt = publishedAt + 60000 * ULTRAMODERN_WORKSPACE_POLICY.pnpm.minimumReleaseAge;
-        if (approval) {
-            if (candidate.registry.dist.integrity !== approval.registry.dist.integrity) throw new Error(`Release-age approval ${key} does not match lock integrity.`);
-            if (candidate.registry.publishedAt !== approval.registry.publishedAt) throw new Error(`Release-age approval ${key} does not match registry publish time.`);
-        }
-        if (!(nowTimestamp >= maturesAt)) {
-            if (!approval || Date.parse(approval.reviewedAt) > nowTimestamp) {
-                reviewCandidates.push(candidate);
-                continue;
-            }
-            if (Date.parse(approval.expiresAt) <= nowTimestamp) throw new Error(`Release-age approval for immature ${key} expired at ${approval.expiresAt}.`);
-            approved.push(candidate);
-        }
-    }
-    for (const approval of approvals){
-        const key = packageVersionKey(approval);
-        const reviewedAt = Date.parse(approval.reviewedAt);
-        const expiresAt = Date.parse(approval.expiresAt);
-        const maturesAt = Date.parse(approval.registry.publishedAt) + 60000 * ULTRAMODERN_WORKSPACE_POLICY.pnpm.minimumReleaseAge;
-        if (reviewedAt <= nowTimestamp && nowTimestamp < expiresAt && nowTimestamp < maturesAt && !candidatesByKey.has(key)) throw new Error(`Release-age approval ${key} is unmatched by the dependency closure.`);
-    }
-    return {
-        minimumReleaseAgeExclude: approved.sort(comparePackageVersions).map(packageVersionKey),
-        reviewCandidates: reviewCandidates.sort(comparePackageVersions)
-    };
-}
-export { ULTRAMODERN_PACKAGE_PINS, ULTRAMODERN_WORKSPACE_POLICY, createCloudflareDeployContract, createCloudflareSecurityContract, createPublicHeadRobotsPolicy, createPublicSurfaceContentExpansionPolicy, formatTsJsonValue, renderMinimumReleaseAgeExclude, resolveReleaseAgeApprovals, validateReleaseAgeApprovals };
+export { ULTRAMODERN_WORKSPACE_POLICY, createCloudflareDeployContract, createCloudflareSecurityContract, createPublicHeadRobotsPolicy, createPublicSurfaceContentExpansionPolicy, formatTsJsonValue };

package/dist/esm-node/ultramodern-workspace/public-surface.js

@@ -49,7 +49,7 @@ function createPublicSurfaceOutputFiles(app) {
     ];
 }
 function createPublicSurfaceGenerationCommand(app, target, requirePublicOrigin = false) {
-    return `node ${relativeRootFor(app.directory)}/scripts/generate-public-surface-assets.mts --app ${app.id} --target ${target}${requirePublicOrigin ? ' --require-public-origin' : ''}`;
+    return `pnpm --dir ${relativeRootFor(app.directory)} exec ultramodern-create ultramodern public-surface --app ${app.id} --target ${target}${requirePublicOrigin ? ' --require-public-origin' : ''}`;
 }
 function rewriteWorkspaceAssetsForApp(workspaceRoot, app) {
     for (const relativePath of publicSurfaceManagedSourceAssetPaths)node_fs.rmSync(node_path.join(workspaceRoot, app.directory, relativePath), {
@@ -65,7 +65,7 @@ function createPublicSurfaceContract(app) {
         generatedManifest: './src/routes/ultramodern-route-metadata',
         source: 'route-owned-public-routes',
         metadataExport: './src/routes/ultramodern-route-metadata',
-        generator: "scripts/generate-public-surface-assets.mts",
+        generator: 'ultramodern-create ultramodern public-surface',
         outputRoot: 'dist/public',
         cloudflareBuildOutputRoot: 'dist-cloudflare/public',
         privateRoutePolicy: 'omit-from-generated-public-surface',
@@ -163,7 +163,7 @@ function createPublicWebAppArtifacts(app) {
         },
         routeMetadataFile: {
             path: `${app.directory}/src/routes/ultramodern-route-metadata.ts`,
-            content: createRouteMetadataModule(app)
+            content: createRouteMetadataModule()
         },
         routeHeadFile: {
             path: `${app.directory}/src/routes/ultramodern-route-head.tsx`,

package/dist/esm-node/ultramodern-workspace/routes.js

@@ -74,17 +74,8 @@ function createPublicRouteMetadata(app) {
 function createJsonLdHelperModule() {
     return renderFileTemplate('workspace/apps/shared/src/routes/ultramodern-jsonld.ts', {});
 }
-function createRouteMetadataModule(app) {
-    const routes = sortJsonValue(createRouteOwnedI18nPaths(app));
-    const localisedUrls = sortJsonValue(createLocalisedUrlsMap(app));
-    const publicRoutes = sortJsonValue(createPublicRouteMetadata(app));
-    const namespace = appI18nNamespace(app);
-    return renderFileTemplate('workspace/apps/shared/src/routes/ultramodern-route-metadata.ts', {
-        value0: namespace,
-        value1: JSON.stringify(routes, null, 2),
-        value2: JSON.stringify(localisedUrls, null, 2),
-        value3: JSON.stringify(publicRoutes, null, 2)
-    });
+function createRouteMetadataModule() {
+    return renderFileTemplate('workspace/apps/shared/src/routes/ultramodern-route-metadata.ts', {});
 }
 function createRouteMetaModule(route) {
     return `const routeMeta = ${JSON.stringify(sortJsonValue(route), null, 2)} as const;

package/dist/esm-node/ultramodern-workspace/shared-patches.js

@@ -1,4 +1,4 @@
 import "node:module";
-import { ULTRAMODERN_WORKSPACE_POLICY } from "./policy.js";
-const SHARED_ULTRAMODERN_WORKSPACE_PATCH_FILES = ULTRAMODERN_WORKSPACE_POLICY.pnpm.patchedDependencies.required.map((patch)=>patch.path.replace(/^patches\//u, '')).filter((patchFile)=>patchFile.startsWith('@module-federation__') || patchFile.startsWith('@tanstack__') || patchFile.startsWith('msgpackr@') || patchFile.startsWith('zod@'));
+import patch_inventory from "./patch-inventory.js";
+const SHARED_ULTRAMODERN_WORKSPACE_PATCH_FILES = patch_inventory.filter((patch)=>patch.repository && null !== patch.workspace).map((patch)=>patch.path.slice(8));
 export { SHARED_ULTRAMODERN_WORKSPACE_PATCH_FILES };