@bleedingdev/modern-js-ultramodern-create 3.9.0-ultramodern.2 → 3.9.0-ultramodern.21

package/templates/workspace-scripts/validate-ultramodern-workspace.mjs.handlebars

@@ -1,4109 +0,0 @@
-import { execFileSync } from 'node:child_process';
-import crypto from 'node:crypto';
-import fs from 'node:fs';
-import { createRequire } from 'node:module';
-import path from 'node:path';
-
-// Generated by modern-js-create with an immutable expected proof contract.
-const root = process.cwd();
-const workspaceValidationContract = {{workspaceValidationContractJson}};
-const packageScope = workspaceValidationContract.packageScope;
-const expectedNodeVersion = workspaceValidationContract.versions.node;
-const expectedCrossEnvVersion =
-  workspaceValidationContract.versions.crossEnv;
-const expectedEffectVersion = workspaceValidationContract.versions.effect;
-const expectedEffectVitestVersion =
-  workspaceValidationContract.versions.effectVitest;
-const expectedModuleFederationVersion =
-  workspaceValidationContract.versions.moduleFederation;
-const expectedTanstackHistoryVersion =
-  workspaceValidationContract.versions.tanstackHistory;
-const expectedCloudflareCompatibilityDate =
-  workspaceValidationContract.versions.cloudflareCompatibilityDate;
-const tailwindEnabled = workspaceValidationContract.tailwindEnabled;
-const fullStackVerticals = workspaceValidationContract.fullStackVerticals;
-// Backend-federation and Zerops runtime surfaces only exist when the workspace
-// exposes API-bearing verticals. Shell-only workspaces skip their
-// materialization during migrate, so the contract must not require them.
-const hasBackendSurfaces = fullStackVerticals.some(
-  vertical => vertical.emitsApi,
-);
-// Every vertical (ui-only and horizontal-remote included) is a delivery unit
-// and deploys via Zerops; only the BACKEND proof/generation surfaces depend on
-// an API-bearing unit existing (split gating).
-const hasDeliveryUnits = fullStackVerticals.length > 0;
-const shellNamespace = workspaceValidationContract.shellNamespace;
-const oldRemotePaths = workspaceValidationContract.oldRemotePaths;
-const expectedBuildScript = workspaceValidationContract.scripts.build;
-const expectedCloudflareBuildScript =
-  workspaceValidationContract.scripts.cloudflareBuild;
-const expectedCloudflareDeployScript =
-  workspaceValidationContract.scripts.cloudflareDeploy;
-const expectedCloudflareSecurity =
-  workspaceValidationContract.cloudflareSecurity;
-const publicSurfaceManagedSourceAssetPaths =
-  workspaceValidationContract.publicSurfaceManagedSourceAssetPaths;
-const shellRouteMetaPaths = workspaceValidationContract.shellRouteMetaPaths;
-const compactConfigPath =
-  workspaceValidationContract.metadata.compactConfig.path;
-const retiredMetadataPaths =
-  workspaceValidationContract.legacy.retiredMetadataPaths;
-const modernPackageCohort =
-  workspaceValidationContract.cohort.modernPackages;
-const expectedAdditionalShellIds =
-  workspaceValidationContract.cohort.additionalShellIds ?? [];
-const expectedAdditionalShells =
-  workspaceValidationContract.additionalShells ?? [];
-const expectedPrimaryShellVerticalIds =
-  workspaceValidationContract.topology?.referenceTopology?.shell
-    ?.verticalRefs ?? workspaceValidationContract.cohort.verticalIds;
-const expectedReleaseCohort =
-  workspaceValidationContract.cohort.releaseCohort;
-const expectedModernPackageSpecifier = packageName => {
-  if (packageSource.strategy === 'workspace') {
-    return 'workspace:*';
-  }
-  const aliases = packageSource.modernPackages?.aliases ?? {};
-  const alias = aliases[packageName];
-  const specifier = packageSource.modernPackages?.specifier;
-  return typeof alias === 'string' ? `npm:${alias}@${specifier}` : specifier;
-};
-
-const readText = relativePath => fs.readFileSync(path.join(root, relativePath), 'utf-8');
-const readJson = relativePath => JSON.parse(readText(relativePath));
-const dependencyRequireCandidates = [
-  path.join(root, 'package.json'),
-  ...(typeof process.env.npm_package_json === 'string'
-    ? [process.env.npm_package_json]
-    : []),
-  ...(typeof process.env.npm_config_local_prefix === 'string'
-    ? [path.join(process.env.npm_config_local_prefix, 'package.json')]
-    : []),
-  ...(typeof process.env.INIT_CWD === 'string'
-    ? [
-        path.join(process.env.INIT_CWD, 'package.json'),
-        path.join(
-          process.env.INIT_CWD,
-          'packages/toolkit/ultramodern-create/package.json',
-        ),
-        path.join(process.env.INIT_CWD, 'packages/toolkit/create/package.json'),
-      ]
-    : []),
-];
-const loadDependency = packageName => {
-  const errors = [];
-  for (const requireFrom of dependencyRequireCandidates) {
-    if (!fs.existsSync(requireFrom)) {
-      continue;
-    }
-    try {
-      return createRequire(requireFrom)(packageName);
-    } catch (error) {
-      errors.push(`${requireFrom}: ${error.message}`);
-    }
-  }
-  throw new Error(
-    `Unable to load ${packageName}; install the generated workspace dependencies. ${errors.join(' | ')}`,
-  );
-};
-const loadFirstDependency = packageNames => {
-  const errors = [];
-  for (const packageName of packageNames) {
-    try {
-      return loadDependency(packageName);
-    } catch (error) {
-      errors.push(error.message);
-    }
-  }
-  throw new Error(errors.join(' | '));
-};
-const tryLoadFirstDependency = packageNames => {
-  try {
-    return loadFirstDependency(packageNames);
-  } catch {
-    return undefined;
-  }
-};
-const typescript = tryLoadFirstDependency([
-  '@typescript/native/unstable/ast',
-  'typescript/unstable/ast',
-]);
-const typescriptApi = tryLoadFirstDependency([
-  '@typescript/native/unstable/sync',
-  'typescript/unstable/sync',
-]);
-let compilerSnapshot;
-const assert = (condition, message) => {
-  if (!condition) {
-    throw new Error(message);
-  }
-};
-const assertPortableGeneratedEnvironmentScripts = (packageJson, label) => {
-  const build = packageJson.scripts?.build ?? '';
-  const cloudflareBuild = packageJson.scripts?.['cloudflare:build'] ?? '';
-  assert(build.includes('cross-env MODERNJS_DEPLOY=node modern deploy --skip-build'), `${label} build must use cross-env for its Node deploy`);
-  assert(cloudflareBuild.includes('cross-env MODERNJS_DEPLOY=cloudflare modern build'), `${label} cloudflare:build must use cross-env for Modern build`);
-  assert(cloudflareBuild.includes('cross-env MODERNJS_DEPLOY=cloudflare modern deploy --skip-build'), `${label} cloudflare:build must use cross-env for Modern deploy`);
-  assert(!/(?:^|\s+&&\s+)MODERNJS_DEPLOY=/u.test(build), `${label} build must not use a POSIX-only environment prefix`);
-  assert(!/(?:^|\s+&&\s+)MODERNJS_DEPLOY=/u.test(cloudflareBuild), `${label} cloudflare:build must not use a POSIX-only environment prefix`);
-};
-const assertExists = relativePath => {
-  assert(fs.existsSync(path.join(root, relativePath)), `Missing ${relativePath}`);
-};
-const assertNotExists = relativePath => {
-  assert(!fs.existsSync(path.join(root, relativePath)), `Unexpected ${relativePath}`);
-};
-const assertAnyOf = relativePaths => {
-  assert(
-    relativePaths.some(relativePath =>
-      fs.existsSync(path.join(root, relativePath)),
-    ),
-    `Missing one of: ${relativePaths.join(', ')}`,
-  );
-};
-const requiredShellWorkerCompositionPath = shellPath => {
-  const candidates = [
-    `${shellPath}/src/routes/vertical-components.worker.tsx`,
-    `${shellPath}/src/federated-components.worker.tsx`,
-  ];
-  const existingPath = candidates.find(candidate =>
-    fs.existsSync(path.join(root, candidate)),
-  );
-  if (existingPath !== undefined) {
-    return existingPath;
-  }
-  throw new Error(`Missing one of: ${candidates.join(', ')}`);
-};
-const canonicalizeJson = value => {
-  if (Array.isArray(value)) {
-    const entries = value.map(canonicalizeJson);
-    const keyedEntries = entries.every(
-      entry =>
-        entry !== null &&
-        typeof entry === 'object' &&
-        !Array.isArray(entry) &&
-        typeof entry.id === 'string',
-    );
-    if (keyedEntries) {
-      const ids = entries.map(entry => entry.id);
-      if (new Set(ids).size === ids.length) {
-        return entries.toSorted((left, right) => left.id.localeCompare(right.id));
-      }
-    }
-    return entries;
-  }
-  if (value !== null && typeof value === 'object') {
-    return Object.fromEntries(
-      Object.keys(value)
-        .toSorted()
-        .map(key => [key, canonicalizeJson(value[key])]),
-    );
-  }
-  return value;
-};
-const sameJson = (actual, expected) =>
-  JSON.stringify(canonicalizeJson(actual)) ===
-  JSON.stringify(canonicalizeJson(expected));
-const formatJson = value =>
-  value === undefined ? 'undefined' : JSON.stringify(canonicalizeJson(value));
-const quoteYamlString = value => `'${String(value).replace(/'/gu, "''")}'`;
-const quoteShellValue = value => `'${String(value).replace(/'/gu, "'\\''")}'`;
-const selfCheckFailure = (contract, message, fixArea) =>
-  `MicroVertical contract self-check failed: ${contract}. ${message}. Fix area: ${fixArea}.`;
-const assertSelfCheck = (condition, contract, message, fixArea) => {
-  assert(condition, selfCheckFailure(contract, message, fixArea));
-};
-const assertSameJson = (actual, expected, contract, fixArea) => {
-  assertSelfCheck(
-    sameJson(actual, expected),
-    contract,
-    `Expected ${formatJson(expected)}, found ${formatJson(actual)}`,
-    fixArea,
-  );
-};
-const assertObject = (value, contract, fixArea) => {
-  assertSelfCheck(
-    value !== null && typeof value === 'object' && !Array.isArray(value),
-    contract,
-    `Expected JSON object, found ${formatJson(value)}`,
-    fixArea,
-  );
-};
-const assertArray = (value, contract, fixArea) => {
-  assertSelfCheck(
-    Array.isArray(value),
-    contract,
-    `Expected JSON array, found ${formatJson(value)}`,
-    fixArea,
-  );
-};
-const assertUniqueStrings = (values, contract) => {
-  assert(Array.isArray(values), `${contract} must be an array`);
-  const seen = new Set();
-  for (const value of values) {
-    assert(
-      typeof value === 'string' && value.length > 0,
-      `${contract} must contain non-empty strings`,
-    );
-    assert(!seen.has(value), `Duplicate value "${value}" in ${contract}`);
-    seen.add(value);
-  }
-};
-const assertUniqueIdEntries = (entries, contract) => {
-  assert(Array.isArray(entries), `${contract} must be an array`);
-  const seen = new Set();
-  for (const entry of entries) {
-    const id = entry?.id;
-    assert(
-      typeof id === 'string' && id.length > 0,
-      `${contract} entries must have non-empty string ids`,
-    );
-    assert(!seen.has(id), `Duplicate id "${id}" in ${contract}`);
-    seen.add(id);
-  }
-};
-const assertSameIdCohort = (entries, expectedIds, contract, fixArea) => {
-  assertUniqueIdEntries(entries, contract);
-  assertSameJson(
-    entries.map(entry => entry.id).toSorted(),
-    [...expectedIds].toSorted(),
-    `${contract} cohort`,
-    fixArea,
-  );
-};
-const assertWorkspaceValidationContract = contract => {
-  assert(
-    contract !== null &&
-      typeof contract === 'object' &&
-      !Array.isArray(contract),
-    'Workspace validation contract must be a JSON object',
-  );
-  assert(
-    contract.schemaVersion === 2,
-    `Unsupported workspace validation contract schemaVersion ${formatJson(contract.schemaVersion)}; expected 2`,
-  );
-  assert(
-    contract.kind === 'modernjs.ultramodern-workspace-validation-contract',
-    `Unsupported workspace validation contract kind ${formatJson(contract.kind)}`,
-  );
-
-  const metadataEntries = Object.entries(contract.metadata ?? {});
-  assert(
-    metadataEntries.length === (contract.cohort?.releaseCohort ? 5 : 4),
-    'Workspace validation contract must declare every structured metadata input',
-  );
-  for (const [name, metadata] of metadataEntries) {
-    assert(
-      typeof metadata?.path === 'string' && metadata.path.length > 0,
-      `Workspace validation contract metadata.${name}.path is required`,
-    );
-    assert(
-      metadata.schemaVersion === 1,
-      `Unsupported expected metadata schemaVersion ${formatJson(metadata.schemaVersion)} for ${name}`,
-    );
-  }
-
-  assertUniqueStrings(
-    contract.cohort?.modernPackages,
-    'workspace validation contract Modern package cohort',
-  );
-  assertUniqueStrings(
-    contract.cohort?.appIds,
-    'workspace validation contract app cohort',
-  );
-  assertUniqueStrings(
-    contract.cohort?.additionalShellIds ?? [],
-    'workspace validation contract additional-shell cohort',
-  );
-  for (const [field, label] of [
-    [
-      'additionalShellOwnerIds',
-      'workspace validation contract additional-shell owner cohort',
-    ],
-    [
-      'additionalShellDeliveryUnitIds',
-      'workspace validation contract additional-shell delivery-unit cohort',
-    ],
-    [
-      'additionalShellDegradedStateIds',
-      'workspace validation contract additional-shell degraded-state cohort',
-    ],
-    [
-      'additionalShellBuildMarkerIds',
-      'workspace validation contract additional-shell build-marker cohort',
-    ],
-  ]) {
-    assertUniqueStrings(contract.cohort?.[field] ?? [], label);
-  }
-  assertUniqueStrings(
-    contract.cohort?.backendAppIds,
-    'workspace validation contract backend app cohort',
-  );
-  assertUniqueStrings(
-    contract.cohort?.verticalIds,
-    'workspace validation contract vertical cohort',
-  );
-  assertUniqueStrings(
-    contract.cohort?.sharedPackageIds,
-    'workspace validation contract shared package cohort',
-  );
-  assertUniqueStrings(
-    contract.cohort?.ownerIds,
-    'workspace validation contract owner cohort',
-  );
-  assertUniqueIdEntries(
-    contract.cohort?.packageManifests,
-    'workspace validation contract package manifests',
-  );
-  assertUniqueStrings(
-    (contract.cohort?.packageManifests ?? []).map(manifest => manifest.path),
-    'workspace validation contract package manifest paths',
-  );
-
-  const evidencePolicy = contract.validationEvidencePolicy;
-  assert(
-    evidencePolicy?.schemaVersion === 1,
-    `Unsupported validation evidence policy schemaVersion ${formatJson(evidencePolicy?.schemaVersion)}; expected 1`,
-  );
-  assertUniqueIdEntries(
-    evidencePolicy?.required,
-    'workspace validation contract evidence requirements',
-  );
-  const requiredEvidence = new Map([
-    ['typescript-compiler', 'compiler'],
-    ['architecture-compiler', 'compiler'],
-    ['executable-modern-config', 'runtime'],
-    ['executable-runtime-config', 'runtime'],
-    ['executable-module-federation-config', 'runtime'],
-    ['executable-build-facade', 'runtime'],
-    ['structured-package-config', 'structured'],
-    ['structured-deploy-config', 'structured'],
-    ['public-behavior-gates', 'behavior'],
-  ]);
-  assertSameJson(
-    evidencePolicy.required,
-    [...requiredEvidence].map(([id, kind]) => ({ id, kind })),
-    'workspace validation contract evidence requirements',
-    'restore the complete compiler, runtime, structured-data, and behavior evidence set',
-  );
-  for (const evidence of evidencePolicy.required) {
-    assert(
-      requiredEvidence.get(evidence.id) === evidence.kind,
-      `Unsupported validation evidence ${formatJson(evidence)}`,
-    );
-  }
-};
-const assertAdditionalShellContractShape = () => {
-  if ((workspaceValidationContract.cohort?.additionalShellIds ?? []).length > 0) {
-    for (const field of [
-      'additionalShellOwnerIds',
-      'additionalShellDeliveryUnitIds',
-      'additionalShellDegradedStateIds',
-      'additionalShellBuildMarkerIds',
-    ]) {
-      assertSameJson(
-        workspaceValidationContract.cohort?.[field],
-        workspaceValidationContract.cohort.additionalShellIds,
-        `workspace validation contract ${field}`,
-        'restore every generated additional-shell cohort',
-      );
-    }
-    assertSameIdCohort(
-      workspaceValidationContract.cohort?.additionalShellManifests,
-      workspaceValidationContract.cohort.additionalShellIds,
-      'workspace validation contract additional-shell manifests',
-      'restore every generated additional-shell package manifest',
-    );
-    assertSameIdCohort(
-      workspaceValidationContract.additionalShells,
-      workspaceValidationContract.cohort.additionalShellIds,
-      'workspace validation contract additional-shell records',
-      'restore every generated additional-shell contract record',
-    );
-  } else {
-    assert(
-      workspaceValidationContract.cohort?.additionalShellManifests === undefined,
-      'Single-shell workspace must not declare additional-shell manifests',
-    );
-    assert(
-      workspaceValidationContract.additionalShells === undefined,
-      'Single-shell workspace must not declare additional-shell records',
-    );
-    for (const field of [
-      'additionalShellOwnerIds',
-      'additionalShellDeliveryUnitIds',
-      'additionalShellDegradedStateIds',
-      'additionalShellBuildMarkerIds',
-    ]) {
-      assert(
-        workspaceValidationContract.cohort?.[field] === undefined,
-        `Single-shell workspace must not declare ${field}`,
-      );
-    }
-  }
-};
-const sourceExtensions = new Set([
-  '.cjs',
-  '.cts',
-  '.js',
-  '.jsx',
-  '.mjs',
-  '.mts',
-  '.ts',
-  '.tsx',
-]);
-const collectCompilerInputs = relativeDirectory => {
-  const absoluteDirectory = path.join(root, relativeDirectory);
-  if (!fs.existsSync(absoluteDirectory)) {
-    return [];
-  }
-  const files = [];
-  const queue = [absoluteDirectory];
-  while (queue.length > 0) {
-    const current = queue.shift();
-    for (const entry of fs.readdirSync(current, { withFileTypes: true })) {
-      const absoluteEntry = path.join(current, entry.name);
-      if (entry.isDirectory()) {
-        queue.push(absoluteEntry);
-      } else if (sourceExtensions.has(path.extname(entry.name))) {
-        files.push(absoluteEntry);
-      }
-    }
-  }
-  return files.toSorted();
-};
-const initializeCompilerSnapshot = absolutePaths => {
-  if (typescript === undefined || typescriptApi === undefined) {
-    return;
-  }
-  const compiler = new typescriptApi.API();
-  compilerSnapshot = compiler.updateSnapshot({
-    openFiles: [...absolutePaths],
-  });
-};
-const parseCompilerInput = absolutePath => {
-  const project = compilerSnapshot?.getDefaultProjectForFile(absolutePath);
-  const sourceFile = project?.program.getSourceFile(absolutePath);
-  assert(
-    sourceFile !== undefined,
-    `Native TypeScript compiler could not parse ${path.relative(root, absolutePath)}`,
-  );
-  return sourceFile;
-};
-const nodeName = node => {
-  if (
-    typescript.isIdentifier(node) ||
-    typescript.isPrivateIdentifier(node) ||
-    typescript.isStringLiteralLikeNode(node) ||
-    typescript.isNumericLiteral(node)
-  ) {
-    return node.text;
-  }
-  return undefined;
-};
-const propertyAccessPath = node => {
-  if (typescript.isIdentifier(node)) {
-    return [node.text];
-  }
-  if (
-    typescript.isPropertyAccessExpression(node) ||
-    typescript.isPropertyAccessChain?.(node)
-  ) {
-    const left = propertyAccessPath(node.expression);
-    return left === undefined ? undefined : [...left, node.name.text];
-  }
-  if (
-    typescript.isElementAccessExpression(node) &&
-    typescript.isStringLiteralLikeNode(node.argumentExpression)
-  ) {
-    const left = propertyAccessPath(node.expression);
-    return left === undefined
-      ? undefined
-      : [...left, node.argumentExpression.text];
-  }
-  return undefined;
-};
-const compilerFailure = (sourceFile, node, contract, diagnostic, fixArea) => {
-  const position = sourceFile.getLineAndCharacterOfPosition(
-    node.getStart(sourceFile),
-  );
-  const relativePath = path.relative(root, sourceFile.fileName).split(path.sep).join('/');
-  throw new Error(
-    selfCheckFailure(
-      contract,
-      `${diagnostic} Compiler evidence: ${relativePath}:${position.line + 1}:${position.character + 1}`,
-      fixArea,
-    ),
-  );
-};
-const runtimeModuleReferences = sourceFile => {
-  const references = [];
-  const record = (node, specifier, kind, typeOnly = false) => {
-    if (!typeOnly) {
-      references.push({ kind, node, specifier });
-    }
-  };
-  const visit = node => {
-    if (
-      typescript.isImportDeclaration(node) &&
-      typescript.isStringLiteralLikeNode(node.moduleSpecifier)
-    ) {
-      const importClause = node.importClause;
-      const namedBindings = importClause?.namedBindings;
-      const namedBindingsAreTypeOnly =
-        namedBindings !== undefined &&
-        typescript.isNamedImports(namedBindings) &&
-        namedBindings.elements.length > 0 &&
-        namedBindings.elements.every(element => element.isTypeOnly);
-      record(
-        node,
-        node.moduleSpecifier.text,
-        importClause === undefined ? 'side-effect-import' : 'static-import',
-        importClause?.isTypeOnly === true ||
-          (importClause?.name === undefined && namedBindingsAreTypeOnly),
-      );
-    } else if (
-      typescript.isExportDeclaration(node) &&
-      node.moduleSpecifier !== undefined &&
-      typescript.isStringLiteralLikeNode(node.moduleSpecifier)
-    ) {
-      record(
-        node,
-        node.moduleSpecifier.text,
-        'static-import',
-        node.isTypeOnly,
-      );
-    } else if (
-      typescript.isCallExpression(node) &&
-      node.arguments.length > 0 &&
-      typescript.isStringLiteralLikeNode(node.arguments[0])
-    ) {
-      if (node.expression.kind === typescript.SyntaxKind.ImportKeyword) {
-        record(node, node.arguments[0].text, 'dynamic-import');
-      } else if (
-        typescript.isIdentifier(node.expression) &&
-        node.expression.text === 'require'
-      ) {
-        record(node, node.arguments[0].text, 'require');
-      }
-    }
-    node.forEachChild(visit);
-  };
-  visit(sourceFile);
-  return references;
-};
-const importDiagnosticId = (prefix, kind) => {
-  switch (kind) {
-    case 'side-effect-import':
-      return `${prefix}-side-effect-import`;
-    case 'dynamic-import':
-      return `${prefix}-dynamic-import`;
-    case 'require':
-      return `${prefix}-require`;
-    default:
-      return prefix === 'vertical-directory'
-        ? 'vertical-directory-deep-import'
-        : 'workspace-package-source-import';
-  }
-};
-const isWorkspaceSourceSpecifier = specifier => {
-  const segments = specifier.split('/');
-  return (
-    segments.length > 3 &&
-    segments[0].startsWith('@') &&
-    segments[2] === 'src'
-  );
-};
-const resolvesInsideVerticalDirectory = (sourceFile, specifier) => {
-  if (!specifier.startsWith('.')) {
-    return false;
-  }
-  const specifierSegments = specifier.replaceAll('\\', '/').split('/');
-  if (
-    specifierSegments.some(
-      (segment, index) =>
-        segment === 'verticals' && specifierSegments[index + 1] !== undefined,
-    )
-  ) {
-    return true;
-  }
-  const absoluteTarget = path.resolve(path.dirname(sourceFile.fileName), specifier);
-  const verticalRoot = path.join(root, 'verticals') + path.sep;
-  if (!absoluteTarget.startsWith(verticalRoot)) {
-    return false;
-  }
-  const relativeSegments = path.relative(verticalRoot, absoluteTarget).split(path.sep);
-  return relativeSegments.length > 1;
-};
-const jsxTagName = tagName =>
-  typescript.isIdentifier(tagName) ? tagName.text : undefined;
-const jsxAttribute = (attributes, name) =>
-  attributes.properties.find(
-    property =>
-      typescript.isJsxAttribute(property) &&
-      nodeName(property.name) === name,
-  );
-const isBooleanLiteral = (node, value) =>
-  node?.kind ===
-  (value ? typescript.SyntaxKind.TrueKeyword : typescript.SyntaxKind.FalseKeyword);
-const isCallNamed = (node, names) => {
-  if (node === undefined || !typescript.isCallExpression(node)) {
-    return false;
-  }
-  const accessPath = propertyAccessPath(node.expression);
-  return accessPath !== undefined && names.has(accessPath.at(-1));
-};
-const objectLiteralProperty = (objectLiteral, name) =>
-  objectLiteral.properties.find(
-    property =>
-      typescript.isPropertyAssignment(property) &&
-      nodeName(property.name) === name,
-  );
-const moduleFederationConfigArgument = sourceFile => {
-  let argument;
-  const visit = node => {
-    if (argument !== undefined) {
-      return;
-    }
-    if (
-      typescript.isCallExpression(node) &&
-      typescript.isIdentifier(node.expression) &&
-      node.expression.text === 'createModuleFederationConfig' &&
-      node.arguments.length === 1 &&
-      typescript.isObjectLiteralExpression(node.arguments[0])
-    ) {
-      argument = node.arguments[0];
-      return;
-    }
-    node.forEachChild(visit);
-  };
-  visit(sourceFile);
-  return argument;
-};
-const appDeclaresReactRouter = appPath => {
-  const relativePath = `${appPath}/package.json`;
-  if (!fs.existsSync(path.join(root, relativePath))) {
-    return false;
-  }
-  const packageJson = readJson(relativePath);
-  return ['react-router', 'react-router-dom'].some(dependency =>
-    ['dependencies', 'devDependencies'].some(field =>
-      Object.hasOwn(packageJson[field] ?? {}, dependency),
-    ),
-  );
-};
-// TanStack Router is the frontend router of every generated workspace, and
-// `@module-federation/rspack` decides the bridge router purely from this flag
-// and `@module-federation/bridge-react` — it never inspects react-router. The
-// flag therefore has to mirror the app's own manifest: `false` (the router-free
-// bridge-react base entry) unless the app declares React Router itself.
-const bridgeRouterFixArea =
-  'declare bridge.enableBridgeRouter: false, or true only in an app that declares react-router or react-router-dom';
-const assertBridgeRouterCapability = (sourceFile, appPath) => {
-  const contract = 'module federation bridge capability';
-  const configArgument = moduleFederationConfigArgument(sourceFile);
-  if (configArgument === undefined) {
-    compilerFailure(
-      sourceFile,
-      sourceFile,
-      contract,
-      'Generated Module Federation must pass a literal config object to createModuleFederationConfig.',
-      bridgeRouterFixArea,
-    );
-  }
-  const bridge = objectLiteralProperty(configArgument, 'bridge');
-  const declaration =
-    bridge !== undefined &&
-    typescript.isObjectLiteralExpression(bridge.initializer)
-      ? objectLiteralProperty(bridge.initializer, 'enableBridgeRouter')
-      : undefined;
-  if (declaration === undefined) {
-    compilerFailure(
-      sourceFile,
-      bridge ?? configArgument,
-      contract,
-      'Generated Module Federation must declare bridge.enableBridgeRouter in its config object.',
-      bridgeRouterFixArea,
-    );
-  }
-  if (isBooleanLiteral(declaration.initializer, false)) {
-    return;
-  }
-  if (!isBooleanLiteral(declaration.initializer, true)) {
-    compilerFailure(
-      sourceFile,
-      declaration,
-      contract,
-      'Generated Module Federation must declare bridge.enableBridgeRouter as a boolean literal.',
-      bridgeRouterFixArea,
-    );
-  }
-  if (!appDeclaresReactRouter(appPath)) {
-    compilerFailure(
-      sourceFile,
-      declaration,
-      contract,
-      `Generated Module Federation enables the React bridge router while ${appPath}/package.json declares neither react-router nor react-router-dom.`,
-      bridgeRouterFixArea,
-    );
-  }
-};
-const assertCompilerArchitecture = () => {
-  const structuralPolicy = workspaceValidationContract.structuralShellPolicy;
-  assert(
-    structuralPolicy?.schemaVersion === 1,
-    'Structural thin-shell compiler policy must use schemaVersion 1',
-  );
-  const compositionPolicy = workspaceValidationContract.federatedCompositionPolicy;
-  assert(
-    compositionPolicy?.schemaVersion === 1,
-    'Federated composition compiler policy must use schemaVersion 1',
-  );
-  const compilerInputs = new Set([
-    ...(structuralPolicy.shells ?? []).flatMap(shell =>
-      collectCompilerInputs(shell.srcDir),
-    ),
-    ...(compositionPolicy.hosts ?? []).flatMap(host =>
-      collectCompilerInputs(host.srcDir),
-    ),
-    ...workspaceValidationContract.topology.compactConfig.apps.flatMap(app =>
-      collectCompilerInputs(app.path),
-    ),
-  ]);
-  initializeCompilerSnapshot(compilerInputs);
-  for (const shell of structuralPolicy.shells ?? []) {
-    for (const forbidden of structuralPolicy.forbiddenPathClasses ?? []) {
-      assert(
-        !fs.existsSync(path.join(root, shell.packageDir, forbidden.path)),
-        selfCheckFailure(
-          `structural thin-shell ${forbidden.id}`,
-          `${forbidden.diagnostic} Forbidden artifact ${shell.packageDir}/${forbidden.path} exists`,
-          `remove forbidden thin-shell artifact ${shell.packageDir}/${forbidden.path}`,
-        ),
-      );
-    }
-    if (compilerSnapshot === undefined) {
-      continue;
-    }
-    for (const absolutePath of collectCompilerInputs(shell.srcDir)) {
-      const sourceFile = parseCompilerInput(absolutePath);
-      for (const reference of runtimeModuleReferences(sourceFile)) {
-        if (resolvesInsideVerticalDirectory(sourceFile, reference.specifier)) {
-          const id = importDiagnosticId('vertical-directory', reference.kind);
-          compilerFailure(
-            sourceFile,
-            reference.node,
-            `structural thin-shell ${id}`,
-            'A thin Shell must consume only published vertical surfaces, never a vertical implementation directory.',
-            'consume only published surfaces from the thin shell',
-          );
-        }
-        if (isWorkspaceSourceSpecifier(reference.specifier)) {
-          const id = importDiagnosticId('workspace-package', reference.kind);
-          compilerFailure(
-            sourceFile,
-            reference.node,
-            `structural thin-shell ${id}`,
-            'A thin Shell must consume only package exports, never another package raw src directory.',
-            'consume only published surfaces from the thin shell',
-          );
-        }
-      }
-    }
-  }
-
-  if (compilerSnapshot === undefined) {
-    const packageJson = readJson('package.json');
-    assert(
-      typeof packageJson.devDependencies?.['@typescript/native'] === 'string',
-      'Generated workspaces must declare the native TypeScript compiler used by architecture evidence',
-    );
-    assert(
-      packageJson.scripts?.check?.split('&&').some(
-        stage => stage.trim() === 'pnpm typecheck',
-      ),
-      'Generated workspace check must execute compiler evidence before contract validation',
-    );
-    return;
-  }
-
-  for (const host of compositionPolicy.hosts ?? []) {
-    for (const absolutePath of collectCompilerInputs(host.srcDir)) {
-      const sourceFile = parseCompilerInput(absolutePath);
-      if (sourceFile.isDeclarationFile) {
-        continue;
-      }
-      const remoteImplementation = specifier =>
-        (host.remotes ?? []).find(remote => {
-          if (specifier === remote.packageName) {
-            return true;
-          }
-          if (specifier.startsWith(`${remote.packageName}/`)) {
-            const subpath = specifier.slice(remote.packageName.length + 1);
-            return subpath !== 'api' && !subpath.startsWith('api/');
-          }
-          if (!specifier.startsWith('.')) {
-            return false;
-          }
-          const absoluteTarget = path.resolve(
-            path.dirname(sourceFile.fileName),
-            specifier,
-          );
-          const remoteDirectory = path.join(root, remote.directory);
-          return (
-            absoluteTarget === remoteDirectory ||
-            absoluteTarget.startsWith(remoteDirectory + path.sep)
-          );
-        });
-      for (const reference of runtimeModuleReferences(sourceFile)) {
-        const remote = remoteImplementation(reference.specifier);
-        if (remote !== undefined) {
-          compilerFailure(
-            sourceFile,
-            reference.node,
-            'federated composition remote-runtime-package-import',
-            `Host ${host.id} imports the ${remote.id} render implementation through ${reference.specifier}.`,
-            'use import type for contracts or compose the implementation through Module Federation',
-          );
-        }
-      }
-
-      const hydrationStateSetters = new Set();
-      const visit = node => {
-        if (
-          typescript.isVariableDeclaration(node) &&
-          typescript.isArrayBindingPattern(node.name) &&
-          node.name.elements.length >= 2 &&
-          isCallNamed(node.initializer, new Set(['useState'])) &&
-          isBooleanLiteral(node.initializer.arguments[0], false)
-        ) {
-          const stateName = nodeName(node.name.elements[0].name)?.toLowerCase();
-          const setterName = nodeName(node.name.elements[1].name);
-          if (
-            (stateName === 'hydrated' || stateName === 'ishydrated') &&
-            setterName !== undefined
-          ) {
-            hydrationStateSetters.add(setterName);
-          }
-        }
-        if (
-          (typescript.isVariableDeclaration(node) ||
-            typescript.isFunctionDeclaration(node)) &&
-          nodeName(node.name) === 'createHydratedRemote'
-        ) {
-          compilerFailure(
-            sourceFile,
-            node,
-            'federated composition hydrated-remote-factory',
-            'Federated hosts must use the distributed SSR boundary directly; hydration-time remote factories are forbidden.',
-            'compose remote rendering through framework Module Federation primitives',
-          );
-        }
-        if (
-          (typescript.isPropertyAssignment(node) ||
-            typescript.isJsxAttribute(node)) &&
-          (nodeName(node.name) === 'loading' || nodeName(node.name) === 'fallback')
-        ) {
-          const value = typescript.isPropertyAssignment(node)
-            ? node.initializer
-            : node.initializer !== undefined &&
-                typescript.isJsxExpression(node.initializer)
-              ? node.initializer.expression
-              : undefined;
-          if (
-            value !== undefined &&
-            (typescript.isJsxElement(value) ||
-              typescript.isJsxSelfClosingElement(value))
-          ) {
-            const tagName = typescript.isJsxElement(value)
-              ? jsxTagName(value.openingElement.tagName)
-              : jsxTagName(value.tagName);
-            if (tagName === 'ServerComponent' || tagName === 'LocalComponent') {
-              compilerFailure(
-                sourceFile,
-                node,
-                'federated composition local-loading-copy',
-                'Federated hosts must not render a local component copy while loading a remote implementation.',
-                'use an explicit unavailable-state component instead of a local implementation copy',
-              );
-            }
-          }
-        }
-        node.forEachChild(visit);
-      };
-      visit(sourceFile);
-      if (hydrationStateSetters.size > 0) {
-        const findHydrationSetter = node => {
-          if (
-            typescript.isCallExpression(node) &&
-            typescript.isIdentifier(node.expression) &&
-            hydrationStateSetters.has(node.expression.text) &&
-            isBooleanLiteral(node.arguments[0], true)
-          ) {
-            compilerFailure(
-              sourceFile,
-              node,
-              'federated composition hydration-flag',
-              'Federated hosts must hydrate the server DOM directly; hydrated-state component switching is forbidden.',
-              'compose remote rendering through framework Module Federation primitives',
-            );
-          }
-          node.forEachChild(findHydrationSetter);
-        };
-        findHydrationSetter(sourceFile);
-      }
-    }
-  }
-
-  const shellRouteDirectories = (structuralPolicy.shells ?? []).map(
-    shell => `${shell.packageDir}/src/routes`,
-  );
-  const appPaths = workspaceValidationContract.topology.compactConfig.apps.map(
-    app => app.path,
-  );
-  const configFiles = appPaths.flatMap(appPath => [
-    `${appPath}/modern.config.ts`,
-    `${appPath}/module-federation.config.ts`,
-  ]);
-  const moduleFederationConfigAppPaths = new Map(
-    appPaths
-      .map(appPath => [
-        path.join(root, `${appPath}/module-federation.config.ts`),
-        appPath,
-      ])
-      .filter(entry => fs.existsSync(entry[0])),
-  );
-  const checkedFiles = new Set([
-    ...shellRouteDirectories.flatMap(collectCompilerInputs),
-    ...configFiles
-      .map(relativePath => path.join(root, relativePath))
-      .filter(absolutePath => fs.existsSync(absolutePath)),
-  ]);
-  for (const absolutePath of checkedFiles) {
-    const sourceFile = parseCompilerInput(absolutePath);
-    const isShellRoute = shellRouteDirectories.some(relativeDirectory => {
-      const absoluteDirectory = path.join(root, relativeDirectory);
-      return absolutePath.startsWith(absoluteDirectory + path.sep);
-    });
-    const moduleFederationAppPath =
-      moduleFederationConfigAppPaths.get(absolutePath);
-    const visit = node => {
-      if (
-        typescript.isImportDeclaration(node) &&
-        typescript.isStringLiteralLikeNode(node.moduleSpecifier) &&
-        node.moduleSpecifier.text === 'node:child_process'
-      ) {
-        compilerFailure(
-          sourceFile,
-          node,
-          'framework config API node-child-process-access',
-          'Generated config must not invoke node:child_process directly.',
-          'use the framework config environment API',
-        );
-      }
-      const accessPath = propertyAccessPath(node);
-      if (sameJson(accessPath, ['process', 'env'])) {
-        compilerFailure(
-          sourceFile,
-          node,
-          'framework config API direct-process-env-access',
-          'Generated config must use the framework config environment API instead of process.env.',
-          'use getBuildConfigEnvironment',
-        );
-      }
-      if (
-        typescript.isIdentifier(node) &&
-        node.text === 'ULTRAMODERN_ZEPHYR'
-      ) {
-        compilerFailure(
-          sourceFile,
-          node,
-          'zephyr gating ultramodern-zephyr-environment-gate',
-          'Generated Zephyr integration must not be gated through ULTRAMODERN_ZEPHYR.',
-          'use Zephyr native deploy-token behavior',
-        );
-      }
-      if (typescript.isPropertyAssignment(node)) {
-        const property = nodeName(node.name);
-        if (
-          // Inside a Module Federation config the flag is required evidence
-          // checked positionally after this walk; anywhere else it is a
-          // deviation, whatever it is set to.
-          (property === 'enableBridgeRouter' &&
-            moduleFederationAppPath === undefined) ||
-          (property === 'disableDynamicRemoteTypeHints' &&
-            isBooleanLiteral(node.initializer, true)) ||
-          property === 'treeShakingSharedExcludePlugins'
-        ) {
-          compilerFailure(
-            sourceFile,
-            node,
-            'module federation bridge capability',
-            `Generated Module Federation carries forbidden option ${property}.`,
-            'use framework-owned Module Federation defaults',
-          );
-        }
-      }
-      if (isShellRoute) {
-        if (
-          typescript.isJsxOpeningElement(node) &&
-          jsxTagName(node.tagName) === 'a' &&
-          jsxAttribute(node.attributes, 'onClick') !== undefined
-        ) {
-          compilerFailure(
-            sourceFile,
-            node,
-            'shell routing synthetic-anchor-click-interception',
-            'Shell routing must not intercept anchor clicks synthetically.',
-            'use the router Link primitive',
-          );
-        }
-        if (
-          isCallNamed(node, new Set(['hydrateRoot', 'loadRemote', 'loadShare']))
-        ) {
-          compilerFailure(
-            sourceFile,
-            node,
-            'module federation native loading',
-            'Shell routing must use framework Module Federation loading primitives.',
-            'remove manual hydration or remote-loading wrappers',
-          );
-        }
-        if (
-          (typescript.isBinaryExpression(node) &&
-            node.operatorToken.kind === typescript.SyntaxKind.EqualsToken &&
-            propertyAccessPath(node.left)?.slice(0, 2).join('.') ===
-              'window.location') ||
-          (typescript.isCallExpression(node) &&
-            propertyAccessPath(node.expression)?.slice(0, 2).join('.') ===
-              'window.location')
-        ) {
-          compilerFailure(
-            sourceFile,
-            node,
-            'shell routing window-location-navigation',
-            'Shell routing must use router navigation instead of window.location.',
-            'use the router navigation primitive',
-          );
-        }
-      }
-      node.forEachChild(visit);
-    };
-    visit(sourceFile);
-    if (moduleFederationAppPath !== undefined) {
-      assertBridgeRouterCapability(sourceFile, moduleFederationAppPath);
-    }
-  }
-};
-const compactConfigPolicyView = config => ({
-  schemaVersion: config.schemaVersion,
-  profile: config.profile,
-  workspace: config.workspace,
-  features: config.features,
-  deploy: config.deploy,
-  moduleFederation: config.moduleFederation,
-  backendFederation: config.backendFederation,
-  agentSkills: config.agentSkills,
-  tooling: config.tooling,
-});
-const assertStructuredWorkspaceMetadata = ({
-  ultramodernConfig,
-  topology,
-  ownership,
-  overlay,
-}) => {
-  const observedMetadata = [
-    {
-      contract: workspaceValidationContract.metadata.compactConfig,
-      value: ultramodernConfig,
-    },
-    {
-      contract: workspaceValidationContract.metadata.referenceTopology,
-      value: topology,
-    },
-    {
-      contract: workspaceValidationContract.metadata.ownership,
-      value: ownership,
-    },
-    {
-      contract: workspaceValidationContract.metadata.developmentOverlay,
-      value: overlay,
-    },
-  ];
-
-  for (const entry of observedMetadata) {
-    assert(
-      entry.value !== null &&
-        typeof entry.value === 'object' &&
-        !Array.isArray(entry.value),
-      `${entry.contract.path} must contain a JSON object`,
-    );
-    assert(
-      Number.isInteger(entry.value.schemaVersion),
-      `${entry.contract.path} must declare an integer schemaVersion`,
-    );
-  }
-
-  const observedSchemaVersions = new Set(
-    observedMetadata.map(entry => entry.value.schemaVersion),
-  );
-  assert(
-    observedSchemaVersions.size === 1,
-    `Mixed workspace metadata schema versions: ${observedMetadata
-      .map(entry => `${entry.contract.path}=${entry.value.schemaVersion}`)
-      .join(', ')}`,
-  );
-  for (const entry of observedMetadata) {
-    assert(
-      entry.value.schemaVersion === entry.contract.schemaVersion,
-      `Unsupported workspace metadata schemaVersion ${entry.value.schemaVersion} at ${entry.contract.path}; expected ${entry.contract.schemaVersion}`,
-    );
-  }
-
-  assertObject(
-    ultramodernConfig.packageSource,
-    `${compactConfigPath} packageSource`,
-    'restore generated compact package-source metadata',
-  );
-  for (const field of
-    workspaceValidationContract.legacy.forbiddenCompactConfigFields) {
-    assert(
-      !Object.hasOwn(ultramodernConfig, field),
-      `Stale legacy field ${compactConfigPath}.${field} is forbidden`,
-    );
-  }
-  for (const field of
-    workspaceValidationContract.legacy.forbiddenPackageSourceFields) {
-    assert(
-      !Object.hasOwn(ultramodernConfig.packageSource, field),
-      `Stale legacy field ${compactConfigPath}.packageSource.${field} is forbidden`,
-    );
-  }
-  for (const field of workspaceValidationContract.legacy.forbiddenTopologyFields) {
-    assert(
-      !Object.hasOwn(topology, field),
-      `Stale legacy field ${workspaceValidationContract.metadata.referenceTopology.path}.${field} is forbidden`,
-    );
-  }
-
-  assertSameIdCohort(
-    ultramodernConfig.topology?.apps,
-    workspaceValidationContract.cohort.appIds,
-    `${compactConfigPath} topology.apps`,
-    'restore the complete generated app cohort',
-  );
-  assertSameIdCohort(
-    ultramodernConfig.moduleFederation?.apps,
-    workspaceValidationContract.cohort.appIds,
-    `${compactConfigPath} moduleFederation.apps`,
-    'restore the complete generated Module Federation app cohort',
-  );
-  assertSameIdCohort(
-    ultramodernConfig.backendFederation?.apps,
-    workspaceValidationContract.cohort.backendAppIds,
-    `${compactConfigPath} backendFederation.apps`,
-    'restore the complete generated backend app cohort',
-  );
-  assertSameIdCohort(
-    topology.verticals,
-    workspaceValidationContract.cohort.verticalIds,
-    `${workspaceValidationContract.metadata.referenceTopology.path} verticals`,
-    'restore the complete generated vertical cohort',
-  );
-  assertSameIdCohort(
-    topology.sharedPackages,
-    workspaceValidationContract.cohort.sharedPackageIds,
-    `${workspaceValidationContract.metadata.referenceTopology.path} sharedPackages`,
-    'restore the complete generated shared package cohort',
-  );
-  assertSameIdCohort(
-    topology.shell?.moduleFederation?.remotes,
-    workspaceValidationContract.topology.referenceTopology.shell.moduleFederation.remotes.map(
-      remote => remote.id,
-    ),
-    `${workspaceValidationContract.metadata.referenceTopology.path} shell.moduleFederation.remotes`,
-    'restore the complete generated shell remote cohort',
-  );
-  assertSameIdCohort(
-    ownership.owners,
-    workspaceValidationContract.cohort.ownerIds,
-    `${workspaceValidationContract.metadata.ownership.path} owners`,
-    'restore the complete generated ownership cohort',
-  );
-
-  for (const manifest of workspaceValidationContract.cohort.packageManifests) {
-    assertExists(manifest.path);
-    const packageJson = readJson(manifest.path);
-    assert(
-      packageJson.name === manifest.packageName,
-      `${manifest.path} package name must be ${manifest.packageName}`,
-    );
-    if (manifest.role === 'shell' || manifest.role === 'vertical') {
-      assert(
-        packageJson.modernjs?.appId === manifest.id,
-        `${manifest.path} modernjs.appId must be ${manifest.id}`,
-      );
-    }
-  }
-  if (expectedReleaseCohort) {
-    const releaseCohortContract = workspaceValidationContract.metadata.releaseCohort;
-    assertSelfCheck(
-      releaseCohortContract?.path === '.modernjs/release-cohort.json',
-      'authenticated release cohort projection',
-      'Expected release-cohort metadata path is missing or invalid',
-      '.modernjs/release-cohort.json',
-    );
-    assertSameJson(
-      readJson(releaseCohortContract.path),
-      expectedReleaseCohort,
-      'authenticated release cohort projection',
-      releaseCohortContract.path,
-    );
-  }
-};
-const assertStructuredWorkspaceMetadataSemantics = ({
-  ultramodernConfig,
-  topology,
-  ownership,
-  overlay,
-}) => {
-  assertSameJson(
-    compactConfigPolicyView(ultramodernConfig),
-    workspaceValidationContract.policy.compactConfig,
-    `${compactConfigPath} policy`,
-    'restore generated compact workspace policy metadata',
-  );
-  assertSameJson(
-    ultramodernConfig.topology,
-    workspaceValidationContract.topology.compactConfig,
-    `${compactConfigPath} topology`,
-    'restore the complete generated compact topology cohort',
-  );
-  assertSameJson(
-    topology,
-    workspaceValidationContract.topology.referenceTopology,
-    workspaceValidationContract.metadata.referenceTopology.path,
-    'restore the complete generated reference topology',
-  );
-  assertSameJson(
-    ownership,
-    workspaceValidationContract.topology.ownership,
-    workspaceValidationContract.metadata.ownership.path,
-    'restore the complete generated ownership topology',
-  );
-  assertSameJson(
-    overlay,
-    workspaceValidationContract.topology.developmentOverlay,
-    workspaceValidationContract.metadata.developmentOverlay.path,
-    'restore the complete generated development topology',
-  );
-};
-const findById = (entries, id) =>
-  Array.isArray(entries) ? entries.find(entry => entry?.id === id) : undefined;
-const generatedContractLabel = compactConfigPath;
-const toKebabCase = value =>
-  String(value)
-    .trim()
-    .replace(/([a-z0-9])([A-Z])/gu, '$1-$2')
-    .replace(/[^a-zA-Z0-9._-]+/gu, '-')
-    .replace(/[._]+/gu, '-')
-    .toLowerCase()
-    .replace(/-+/gu, '-')
-    .replace(/^-+|-+$/gu, '');
-const toPascalCase = value =>
-  toKebabCase(value)
-    .split('-')
-    .filter(Boolean)
-    .map(part => part.charAt(0).toUpperCase() + part.slice(1))
-    .join('');
-const toCamelCase = value => {
-  const pascal = toPascalCase(value);
-  return `${pascal.charAt(0).toLowerCase()}${pascal.slice(1)}`;
-};
-const toEnvSegment = value => toKebabCase(value).replace(/-/gu, '_').toUpperCase();
-const packageNameFor = (scope, suffix) => `@${scope}/${suffix}`;
-const normalizeRelativePath = value =>
-  String(value ?? '').replace(/\\/gu, '/').replace(/^\.\/+/u, '');
-const appNamespace = app => (app.kind === 'shell' ? 'shell' : (app.domain ?? app.id));
-const tailwindPrefixDigitWords = [
-  'zero',
-  'one',
-  'two',
-  'three',
-  'four',
-  'five',
-  'six',
-  'seven',
-  'eight',
-  'nine',
-];
-const tailwindPrefixFor = app =>
-  app.kind === 'shell'
-    ? 'shell'
-    : String(app.domain ?? app.id)
-        .toLowerCase()
-        .replace(/[^a-z0-9]/gu, '')
-        .replace(/[0-9]/gu, digit => tailwindPrefixDigitWords[Number(digit)]);
-const buildMarkerFor = app =>
-  crypto
-    .createHash('sha256')
-    .update(`${packageScope}:${app.packageSuffix}:${app.id}:0.1.0`)
-    .digest('hex')
-    .slice(0, 16);
-const deliveryUnitIdentityFixArea =
-  'regenerate vertical identity from delivery-unit record; do not hand-edit surface markers';
-const deliveryUnitBlock = record => ({
-  schemaVersion: record?.schemaVersion,
-  kind: record?.kind,
-  unitId: record?.unitId,
-  packageName: record?.packageName,
-  version: record?.version,
-  buildMarker: record?.buildMarker,
-  sourceRevision: record?.sourceRevision,
-});
-const expectedCompactAppFor = id =>
-  workspaceValidationContract.topology.compactConfig?.apps?.find(
-    entry => entry?.id === id,
-  );
-const expectedDeliveryUnitFor = vertical => {
-  const expectedApp = expectedCompactAppFor(vertical.id);
-  return (
-    expectedApp?.backendFederation?.deliveryUnit ??
-    expectedApp?.deliveryUnit ??
-    vertical.deliveryUnit
-  );
-};
-const normalizeCompactApp = rawApp => {
-  const id = String(rawApp.id);
-  const kind = rawApp.kind === 'vertical' ? 'vertical' : 'shell';
-  const appPath =
-    typeof rawApp.path === 'string'
-      ? normalizeRelativePath(rawApp.path)
-      : kind === 'shell'
-        ? 'apps/shell-super-app'
-        : `verticals/${toKebabCase(id)}`;
-  const packageSuffix =
-    typeof rawApp.packageSuffix === 'string'
-      ? rawApp.packageSuffix
-      : appPath.split('/').at(-1) ?? id;
-  const domain =
-    typeof rawApp.domain === 'string'
-      ? rawApp.domain
-      : kind === 'vertical'
-        ? packageSuffix
-        : undefined;
-  const moduleFederation =
-    rawApp.moduleFederation && typeof rawApp.moduleFederation === 'object'
-      ? rawApp.moduleFederation
-      : {};
-  const api =
-    rawApp.api && typeof rawApp.api === 'object'
-      ? {
-          stem:
-            typeof rawApp.api.stem === 'string'
-              ? rawApp.api.stem
-              : domain ?? id,
-          prefix:
-            typeof rawApp.api.prefix === 'string'
-              ? rawApp.api.prefix
-              : `/${domain ?? id}-api`,
-          consumedBy: Array.isArray(rawApp.api.consumedBy)
-            ? rawApp.api.consumedBy.filter(
-                consumer => typeof consumer === 'string',
-              )
-            : ['shell-super-app', id],
-          // Preserve the API protocol so the synthesized generated contract can
-          // branch between the REST (`shared/api.ts` + `./api/client`) and RPC
-          // (`shared/rpc.ts` + `./api/rpc-client`) surfaces.
-          protocol: rawApp.api.protocol === 'rpc' ? 'rpc' : 'rest',
-        }
-      : undefined;
-
-  return {
-    id,
-    kind,
-    path: appPath,
-    package: typeof rawApp.package === 'string' ? rawApp.package : undefined,
-    packageSuffix,
-    domain,
-    port:
-      typeof rawApp.port === 'number'
-        ? rawApp.port
-        : kind === 'shell'
-          ? 3020
-          : 3030,
-    portEnv:
-      typeof rawApp.portEnv === 'string'
-        ? rawApp.portEnv
-        : kind === 'shell'
-          ? 'SHELL_SUPER_APP_PORT'
-          : `VERTICAL_${toEnvSegment(domain ?? id)}_PORT`,
-    mfName:
-      typeof moduleFederation.name === 'string'
-        ? moduleFederation.name
-        : kind === 'shell'
-          ? 'shellSuperApp'
-          : `vertical${toPascalCase(domain ?? id)}`,
-    exposes: Array.isArray(moduleFederation.exposes)
-      ? moduleFederation.exposes.filter(expose => typeof expose === 'string')
-      : [],
-    moduleFederationSsr: moduleFederation.ssr !== false,
-    verticalRefs: Array.isArray(moduleFederation.verticalRefs)
-      ? moduleFederation.verticalRefs.filter(ref => typeof ref === 'string')
-      : [],
-    deliveryUnit:
-      rawApp.deliveryUnit && typeof rawApp.deliveryUnit === 'object'
-        ? rawApp.deliveryUnit
-        : undefined,
-    backendFederation:
-      rawApp.backendFederation && typeof rawApp.backendFederation === 'object'
-        ? rawApp.backendFederation
-        : undefined,
-    api,
-  };
-};
-const compactAppsFromConfig = config =>
-  Array.isArray(config.topology?.apps)
-    ? config.topology.apps.map(normalizeCompactApp)
-    : [];
-const remoteDependencyAliasFor = app => toCamelCase(app.domain ?? app.id.replace(/^remote-/u, ''));
-const remoteContractsFor = (app, apps) =>
-  (app.verticalRefs ?? [])
-    .map(ref => apps.find(candidate => candidate.id === ref))
-    .filter(Boolean)
-    .map(remote => ({
-      id: remote.id,
-      alias: remoteDependencyAliasFor(remote),
-      name: remote.mfName,
-      manifestEnv: `VERTICAL_${toEnvSegment(remote.domain ?? remote.id)}_MF_MANIFEST`,
-      manifestUrl: `http://localhost:${remote.port}/mf-manifest.json`,
-    }));
-const createRouteOwnedEntries = app => {
-  const namespace = appNamespace(app);
-  const base = {
-    descriptionKey: `${namespace}.seo.description`,
-    mfBoundaryId: app.mfName,
-    namespace,
-    ownerAppId: app.id,
-    public: false,
-    indexable: false,
-    publicSurface: 'private-app-screen',
-  };
-
-  return [
-    {
-      ...base,
-      canonicalPath: '/',
-      id: app.kind === 'shell' ? 'shell-home' : `${app.id}-home`,
-      localisedPaths: {
-        cs: '/',
-        en: '/',
-      },
-      titleKey: app.kind === 'shell' ? 'shell.title' : `${namespace}.title`,
-    },
-  ];
-};
-const createPublicRoutes = app =>
-  createRouteOwnedEntries(app)
-    .filter(route => route.public && route.indexable)
-    .map(route => ({
-      canonicalPath: route.canonicalPath,
-      id: route.id,
-      localisedPaths: route.localisedPaths,
-      namespace: route.namespace,
-      ownerAppId: route.ownerAppId,
-      descriptionKey: route.descriptionKey,
-      titleKey: route.titleKey,
-    }));
-const createLocalisedUrls = app =>
-  Object.fromEntries(
-    createRouteOwnedEntries(app).flatMap(route => {
-      if (route.canonicalPath === '/') {
-        return [];
-      }
-      return Array.from(
-        new Set([route.canonicalPath, ...Object.values(route.localisedPaths)]),
-      ).map(pathname => [pathname, route.localisedPaths]);
-    }),
-  );
-const createPublicSurface = app => {
-  const publicRoutes = createPublicRoutes(app);
-  return {
-    authoring: 'colocated-route-meta',
-    artifactLifecycle: 'build-and-deploy-output',
-    generatedManifest: './src/routes/ultramodern-route-metadata',
-    source: 'route-owned-public-routes',
-    metadataExport: './src/routes/ultramodern-route-metadata',
-    generator: 'scripts/generate-public-surface-assets.mts',
-    outputRoot: 'dist/public',
-    cloudflareBuildOutputRoot: 'dist-cloudflare/public',
-    privateRoutePolicy: 'omit-from-generated-public-surface',
-    files:
-      publicRoutes.length > 0
-        ? ['robots.txt', 'sitemap.xml', 'site.webmanifest']
-        : ['robots.txt'],
-    omittedByDefault: ['api-catalog.json', 'llms.txt', 'security.txt'],
-    languages: ['en', 'cs'],
-    contentExpansion: {
-      authoring: 'route-owned-esm-provider',
-      defaultProviderFile: 'route.sitemap.mjs',
-      entryExport: 'default-or-entries',
-      paramsSource: 'params-or-localeParams',
-      draftPolicy: 'omit-draft-by-default',
-      indexablePolicy: 'omit-indexable-false',
-      lifecycle: 'executed-during-public-surface-generation',
-    },
-    contentSources: [],
-    publicRoutes,
-    routeEntries: [],
-    concreteUrlPaths: [],
-  };
-};
-const createPublicHead = () => ({
-  authoring: 'colocated-route-meta',
-  generator: './src/routes/ultramodern-route-head',
-  renderer: '@modern-js/runtime/head Helmet',
-  ssr: true,
-  title: {
-    required: true,
-    source: 'route.titleKey',
-  },
-  description: {
-    required: true,
-    source: 'route.descriptionKey',
-  },
-  canonical: {
-    publicIndexableOnly: true,
-    source: 'localized canonical route URL',
-  },
-  alternates: {
-    hreflang: ['en', 'cs'],
-    xDefault: 'en',
-  },
-  openGraph: {
-    publicIndexableOnly: true,
-    required: ['og:title', 'og:description', 'og:url', 'og:type'],
-  },
-  twitter: {
-    publicIndexableOnly: true,
-    required: ['twitter:card', 'twitter:title', 'twitter:description'],
-  },
-  structuredData: {
-    publicIndexableOnly: true,
-    optional: true,
-    source: 'route.jsonLd',
-    inference: false,
-    helperModule: './src/routes/ultramodern-jsonld',
-    helperTypes: [
-      'WebPage',
-      'WebApplication',
-      'SoftwareApplication',
-      'BreadcrumbList',
-      'FAQPage',
-      'Organization',
-    ],
-    sanitizesHtmlOpenBracket: true,
-  },
-  privateRouteRobots: 'noindex, nofollow',
-});
-const createQualityGates = () => ({
-  publicRoutes: {
-    requireSitemapWhenPresent: true,
-    requireRobotsSitemapConsistency: true,
-    requireWebManifestWhenPresent: true,
-  },
-  statusCodes: {
-    notFoundRoute: '/__ultramodern-smoke-missing/nope',
-    unknownRouteStatus: 404,
-  },
-  indexing: {
-    previewNoindex: true,
-    productionPublicRoutesIndexable: true,
-  },
-  assets: {
-    cssPreloadRequired: true,
-    cssResponseRequired: true,
-    cacheControlRequiredForCss: true,
-    sourcemapsPubliclyReferenced: false,
-  },
-  budgets: {
-    ssrHtmlMaxBytes: 250_000,
-    mfManifestMaxBytes: 500_000,
-    localeJsonMaxBytes: 100_000,
-    sitemapXmlMaxBytes: 500_000,
-    cssAssetMaxBytes: 750_000,
-  },
-  csp: {
-    finalMode: 'report-only-dogfood',
-    decision:
-      'Report-only remains the generated final mode until public smoke proof records MF SSR script/style/connect compatibility for the deployed surface.',
-  },
-});
-const createCloudflareRoutes = app => ({
-  ssr: '/en',
-  mfManifest: '/mf-manifest.json',
-  locale: `/locales/en/${appNamespace(app)}.json`,
-  // Mirrors policy.ts:76 — the Cloudflare proof carries a REST readiness route
-  // only for `rest` units. An `rpc` unit exposes its `/rpc` route instead and
-  // must not emit (or require) a REST readiness path.
-  ...(app.api && app.api.protocol === 'rest'
-    ? {
-        apiReadiness: `${app.api.prefix}/${app.api.stem}/readiness`,
-      }
-    : {}),
-});
-const createCloudflareDeploy = app => ({
-  target: 'cloudflare',
-  workerName: expectedWorkerName(app.packageSuffix),
-  publicUrlEnv: `ULTRAMODERN_PUBLIC_URL_${toEnvSegment(app.id)}`,
-  compatibilityDate: expectedCloudflareCompatibilityDate,
-  compatibilityFlags: ['nodejs_compat', 'global_fetch_strictly_public'],
-  assetsBinding: 'ASSETS',
-  routes: createCloudflareRoutes(app),
-  security: expectedCloudflareSecurity,
-  qualityGates: createQualityGates(),
-  evidence: {
-    proofScript: 'scripts/proof-cloudflare-version.mts',
-    reportDefault:
-      '.codex/reports/cloudflare-version-proof/public-url-proof.json',
-  },
-});
-const createEffectReadiness = app => ({
-  endpoint: `/${app.api.stem}/readiness`,
-  marker: {
-    ui: 'ultramodernUiMarker',
-    api: 'ultramodernApiMarker',
-    skew: 'none',
-  },
-  checks: ['moduleFederation', 'ssr', 'translations', 'api'],
-});
-const createEffectRequestContext = () => ({
-  propagatedHeaders: [
-    'accept-language',
-    'authorization',
-    'traceparent',
-    'x-correlation-id',
-    'x-tenant-id',
-    'x-ultramodern-env',
-    'x-vertical-version-id',
-  ],
-  source: 'shell-to-vertical-api-client',
-});
-const createEffectDomainOperations = app => {
-  const stem = app.api.stem;
-  const group = toCamelCase(stem);
-  const basePath = `/${stem}`;
-  return {
-    workspaceFeed: {
-      client: `list${toPascalCase(stem)}`,
-      method: 'GET',
-      path: basePath,
-      resource: 'workspace-items',
-      owner: app.id,
-    },
-    workspaceDetail: {
-      client: `get${toPascalCase(stem)}`,
-      method: 'GET',
-      path: `${basePath}/:id`,
-      resource: 'workspace-item',
-      owner: app.id,
-    },
-    workspaceCreate: {
-      client: `create${toPascalCase(stem)}`,
-      method: 'POST',
-      path: basePath,
-      resource: group,
-      owner: app.id,
-    },
-  };
-};
-const createEffectOperationContract = app => ({
-  group: toCamelCase(app.api.stem),
-  operations: {
-    readiness: {
-      method: 'GET',
-      path: `/${app.api.stem}/readiness`,
-      source: 'generated-client',
-    },
-  },
-});
-const createAppConfigContract = app => ({
-  preset: 'presetUltramodern',
-  plugins: [
-    'appTools',
-    'ultramodernReleaseEnvelopePlugin',
-    'tanstackRouterPlugin',
-    'i18nPlugin',
-    ...(app.api ? ['bffPlugin'] : []),
-    'moduleFederationPlugin',
-    'zephyrRspackPlugin',
-  ],
-  dev: {
-    assetPrefix: app.kind === 'shell' ? '/' : 'app-public-origin',
-  },
-  output: {
-    assetPrefix: {
-      envFallbackOrder: ['MODERN_ASSET_PREFIX', 'ULTRAMODERN_ASSET_PREFIX'],
-      default: app.kind === 'shell' ? '/' : 'app-public-origin',
-    },
-    disableTsChecker: false,
-  },
-  performance: {
-    readinessDiagnostics: {
-      default: 'enabled',
-      optOut: {
-        env: 'ULTRAMODERN_PERFORMANCE_READINESS_DIAGNOSTICS=false',
-        config: 'scripts/ultramodern-performance-readiness.config.mjs',
-      },
-      failOn: 'framework-invariant',
-    },
-  },
-  rspack: {
-    output: {
-      uniqueName: app.mfName,
-      chunkLoadingGlobal: expectedChunkLoadingGlobal(app.mfName),
-    },
-  },
-  source: {
-    siteUrl: {
-      envFallbackOrder: [
-        'MODERN_PUBLIC_SITE_URL',
-        `ULTRAMODERN_PUBLIC_URL_${toEnvSegment(app.id)}`,
-        'ULTRAMODERN_CLOUDFLARE_WORKERS_DEV_SUBDOMAIN',
-        app.portEnv,
-      ],
-      defaultLocalhostPort: app.port,
-    },
-  },
-});
-const cssDedupe = () => ({
-  strategy: 'shared-token-package-plus-css-content-hash',
-  sharedPackage: packageNameFor(packageScope, 'shared-design-tokens'),
-  sharedLayers: ['ultramodern-shared-tokens'],
-  runtimeLoad: 'once-per-content-hash',
-  duplicateBaseStylesAllowed: false,
-});
-const createStylingContract = app => {
-  const sharedTokenPackage = packageNameFor(packageScope, 'shared-design-tokens');
-  const ownedLayers =
-    app.kind === 'shell'
-      ? ['ultramodern-shell-base', 'ultramodern-shell-overlay']
-      : [`ultramodern-vertical-${app.domain ?? app.id}`];
-
-  return {
-    tailwind: tailwindEnabled,
-    federation: {
-      owner: {
-        id: app.id,
-        package: app.package ?? packageNameFor(packageScope, app.packageSuffix),
-      },
-      role: app.kind === 'shell' ? 'shell-base-overlay' : 'vertical-css',
-      rootSelector: `[data-app-id="${app.id}"]`,
-      classPrefix: `${tailwindPrefixFor(app)}:`,
-      layers: {
-        shared: ['ultramodern-shared-tokens'],
-        owned: ownedLayers,
-      },
-      entrypoints: {
-        layoutImport: 'src/routes/layout.tsx',
-        css: ['src/routes/index.css'],
-        ...(app.kind === 'shell'
-          ? {}
-          : { federationEntry: 'src/federation-entry.tsx' }),
-      },
-      assets: {
-        shared: [`${sharedTokenPackage}/tokens.css`],
-        owned: ['src/routes/index.css'],
-      },
-      dedupe: cssDedupe(),
-      ssr: {
-        cloudflare: true,
-        firstPaintRequired: true,
-        verticalCss:
-          app.kind === 'shell'
-            ? 'host-preloads-shell-and-shared-css'
-            : 'federated-manifest-owned-css',
-      },
-    },
-  };
-};
-const createAppContract = (app, apps) => ({
-  id: app.id,
-  package: app.package ?? packageNameFor(packageScope, app.packageSuffix),
-  path: app.path,
-  kind: app.kind,
-  config: createAppConfigContract(app),
-  styling: createStylingContract(app),
-  deploy: {
-    target: 'cloudflare',
-    cloudflare: createCloudflareDeploy(app),
-    worker: {
-      compatibilityDate: expectedCloudflareCompatibilityDate,
-      name: expectedWorkerName(app.packageSuffix),
-      security: expectedCloudflareSecurity,
-      ssr: true,
-    },
-  },
-  ssr: app.moduleFederationSsr
-    ? {
-        mode: 'stream',
-        moduleFederationAppSSR: true,
-      }
-    : undefined,
-  i18n: {
-    languages: ['en', 'cs'],
-    namespace: appNamespace(app),
-    localisedUrls: createLocalisedUrls(app),
-  },
-  routes: {
-    source: 'route-owned',
-    metadataAuthoring: 'colocated-route-meta',
-    generatedManifest: true,
-    metadataExport: './src/routes/ultramodern-route-metadata',
-    localisedUrls: createLocalisedUrls(app),
-    owned: createRouteOwnedEntries(app),
-    publicRoutes: createPublicRoutes(app),
-    privateByDefault: true,
-    publicnessDefault: 'private-app-screen',
-    publicHead: createPublicHead(),
-    publicSurface: createPublicSurface(app),
-  },
-  moduleFederation: {
-    name: app.mfName,
-    ...(app.verticalRefs?.length
-      ? {
-          verticalRefs: app.verticalRefs,
-          remotes: remoteContractsFor(app, apps),
-        }
-      : {}),
-    exposes: app.exposes,
-    dts: {
-      compilerInstance: 'effect-tsgo',
-      displayErrorInTerminal: true,
-      tsConfigPath: './tsconfig.mf-types.json',
-    },
-    browserSafeExposesOnly: true,
-  },
-    marker: {
-      appId: app.id,
-      packageName: app.package ?? packageNameFor(packageScope, app.packageSuffix),
-      version: '0.1.0',
-      build: app.deliveryUnit?.buildMarker ?? buildMarkerFor(app),
-      deployProfile: 'cloudflare-ssr-mf-effect-v1',
-      uiSurface: 'ui',
-      ...(app.api ? { apiSurface: 'api' } : {}),
-  },
-  ...(app.api
-    ? {
-        // An `rpc` unit exposes the Effect RpcGroup contract/client and the
-        // `/rpc` route instead of the REST `shared/api.ts` + `./api/client`
-        // surface, so it carries no OpenAPI/readiness/domain-operation metadata.
-        api:
-          (app.api.protocol ?? 'rest') === 'rpc'
-            ? {
-                runtime: 'effect',
-                import: '@modern-js/plugin-bff/effect-edge',
-                prefix: app.api.prefix,
-                protocol: 'rpc',
-                strictEffectApproach: true,
-                workerEntry: 'worker/__modern_bff_effect.js',
-                contract: './api',
-                client: './api/rpc-client',
-                group: toCamelCase(app.api.stem),
-                rpc: { path: '/rpc', serialization: 'json' },
-                rpcPath: `${app.api.prefix}/rpc`,
-              }
-            : {
-                runtime: 'effect',
-                import: '@modern-js/plugin-bff/effect-edge',
-                prefix: app.api.prefix,
-                openapi: '/openapi.json',
-                strictEffectApproach: true,
-                workerEntry: 'worker/__modern_bff_effect.js',
-                contract: './api',
-                client: './api/client',
-                readiness: createEffectReadiness(app),
-                requestContext: createEffectRequestContext(),
-                domainOperations: createEffectDomainOperations(app),
-                ...createEffectOperationContract(app),
-              },
-      }
-    : {}),
-});
-const createCssFederationContract = () => ({
-  sharedDesignTokens: {
-    owner: {
-      id: 'shared-design-tokens',
-      package: packageNameFor(packageScope, 'shared-design-tokens'),
-    },
-    role: 'shared-design-tokens',
-    rootSelector: ':root',
-    classPrefix: '--um-',
-    layers: {
-      owned: ['ultramodern-shared-tokens'],
-    },
-    entrypoints: {
-      css: ['packages/shared-design-tokens/src/tokens.css'],
-    },
-    assets: {
-      exports: ['./tokens.css'],
-    },
-    dedupe: cssDedupe(),
-    ssr: {
-      firstPaintRequired: true,
-    },
-  },
-});
-const createPerformanceReadinessContract = () => ({
-  default: 'enabled',
-  mode: 'diagnostic',
-  scope: 'ultramodern-generated-and-framework-owned',
-  report: {
-    script: 'scripts/ultramodern-performance-readiness.mts',
-    config: 'scripts/ultramodern-performance-readiness.config.mjs',
-    deterministic: true,
-  },
-  optOut: {
-    env: 'ULTRAMODERN_PERFORMANCE_READINESS_DIAGNOSTICS=false',
-  },
-  signals: [
-    'bfcache',
-    'core-web-vitals-rum',
-    'duplicate-prefetch-warmup',
-    'cache-policy-sanity',
-    'save-data-behavior',
-    'cloudflare-ssr-cache-hints',
-  ].map(id => ({ id })),
-});
-const createModernPackageAliases = packageSourceConfig => {
-  if (typeof packageSourceConfig?.aliasScope !== 'string') {
-    return undefined;
-  }
-  const scope = packageSourceConfig.aliasScope.replace(/^@/u, '');
-  const prefix =
-    typeof packageSourceConfig.aliasPackageNamePrefix === 'string'
-      ? packageSourceConfig.aliasPackageNamePrefix
-      : '';
-  return Object.fromEntries(
-    modernPackageCohort.map(packageName => [
-      packageName,
-      `@${scope}/${prefix}${packageName.split('/').at(-1)}`,
-    ]),
-  );
-};
-const createPackageSourceView = config => {
-  const source = config.packageSource;
-  assert(
-    source !== null && typeof source === 'object' && !Array.isArray(source),
-    `${compactConfigPath} packageSource must be a JSON object`,
-  );
-  assert(
-    source.strategy === 'workspace' || source.strategy === 'install',
-    `${compactConfigPath} packageSource.strategy must be workspace or install`,
-  );
-  if (source.strategy === 'install') {
-    assert(
-      typeof source.modernPackageVersion === 'string' &&
-        source.modernPackageVersion.length > 0,
-      `${compactConfigPath} install package source must declare modernPackageVersion`,
-    );
-  }
-  const strategy = source.strategy;
-  const specifier =
-    strategy === 'install' ? source.modernPackageVersion : 'workspace:*';
-  const aliases = createModernPackageAliases(source);
-  return {
-    schemaVersion: 1,
-    strategy,
-    modernPackages: {
-      packages: modernPackageCohort,
-      specifier,
-      ...(typeof source.registry === 'string'
-        ? { registry: source.registry }
-        : {}),
-      ...(aliases ? { aliases } : {}),
-    },
-    generatedWorkspacePackages: {
-      packages: [
-        packageNameFor(packageScope, 'shared-contracts'),
-        packageNameFor(packageScope, 'shared-design-tokens'),
-      ],
-      specifier: 'workspace:*',
-    },
-  };
-};
-const synthesizeGeneratedContractFromCompact = config => {
-  const apps = compactAppsFromConfig(config);
-  return {
-    schemaVersion: 1,
-    profile: config.profile ?? 'cloudflare-ssr-mf-effect-v1',
-    node: {
-      version: config.workspace?.node?.version ?? expectedNodeVersion,
-      engineRange: '>=26',
-    },
-    performanceReadiness: createPerformanceReadinessContract(),
-    cssFederation: createCssFederationContract(),
-    apps: apps.map(app => createAppContract(app, apps)),
-  };
-};
-const readGeneratedContractView = config => {
-  return synthesizeGeneratedContractFromCompact(config);
-};
-const expectedManifestUrl = vertical =>
-  `http://localhost:${vertical.port}/mf-manifest.json`;
-const expectedApiUrl = vertical =>
-  `http://localhost:${vertical.port}${vertical.apiPrefix}${
-    vertical.apiProtocol === 'rpc' ? '/rpc' : ''
-  }`;
-const expectedBackendFederationName = vertical => `${vertical.mfName}Backend`;
-const expectedBackendManifestUrl = vertical =>
-  `http://localhost:${vertical.port}/backend-mf-manifest.json`;
-const expectedBackendContainerEntry = vertical =>
-  `http://localhost:${vertical.port}/backendRemoteEntry.cjs`;
-const expectedBackendManifestEnv = vertical =>
-  `VERTICAL_${toEnvSegment(vertical.domain ?? vertical.id)}_BACKEND_MF_MANIFEST`;
-const expectedPublicUrlEnv = vertical =>
-  `ULTRAMODERN_PUBLIC_URL_${toEnvSegment(vertical.id)}`;
-const expectedCloudflareWorkerName = vertical =>
-  toKebabCase(`${packageScope}-${vertical.packageSuffix ?? vertical.id}`).slice(
-    0,
-    63,
-  );
-const backendFederationSubset = backendFederation => ({
-  role: backendFederation?.role,
-  name: backendFederation?.name,
-  runtimeFramework: backendFederation?.runtimeFramework,
-  strictEffectApproach: backendFederation?.strictEffectApproach,
-  exposeRuntime: backendFederation?.exposes?.['./effect-api']?.runtime,
-  exposeReadiness: backendFederation?.exposes?.['./effect-api']?.readiness,
-  versionBoundary: {
-    invariant: backendFederation?.versionBoundary?.invariant,
-    hasUi: Object.hasOwn(backendFederation?.versionBoundary ?? {}, 'ui'),
-    uiManifestUrl: backendFederation?.versionBoundary?.ui?.manifestUrl,
-    apiReadiness: backendFederation?.versionBoundary?.api?.readiness,
-  },
-  cloudflare: {
-    kind: backendFederation?.executionSurfaces?.cloudflare?.kind,
-    hasApi: Object.hasOwn(
-      backendFederation?.executionSurfaces?.cloudflare ?? {},
-      'api',
-    ),
-    hasSsr: Object.hasOwn(
-      backendFederation?.executionSurfaces?.cloudflare ?? {},
-      'ssr',
-    ),
-    workerName: backendFederation?.executionSurfaces?.cloudflare?.workerName,
-    publicUrlEnv:
-      backendFederation?.executionSurfaces?.cloudflare?.publicUrlEnv,
-    zephyrRuntime:
-      backendFederation?.executionSurfaces?.cloudflare?.zephyr?.runtime,
-  },
-  node: {
-    kind: backendFederation?.executionSurfaces?.node?.kind,
-    remoteName: backendFederation?.executionSurfaces?.node?.remoteName,
-    manifestEnv: backendFederation?.executionSurfaces?.node?.manifestEnv,
-    manifestUrl: backendFederation?.executionSurfaces?.node?.manifestUrl,
-    containerEntry:
-      backendFederation?.executionSurfaces?.node?.containerEntry,
-    remoteType: backendFederation?.executionSurfaces?.node?.remoteType,
-    expose: backendFederation?.executionSurfaces?.node?.expose,
-  },
-  compatibility: {
-    contractVersion: backendFederation?.compatibility?.contractVersion,
-  },
-  topLevelManifestUrl: backendFederation?.manifestUrl,
-  topLevelContainerEntry: backendFederation?.containerEntry,
-});
-const expectedBackendFederationSubset = vertical => ({
-  role: 'microvertical-server',
-  name: expectedBackendFederationName(vertical),
-  runtimeFramework: 'effect',
-  strictEffectApproach: true,
-  exposeRuntime: `${vertical.path}/api/index.ts`,
-  // The RPC surface exposes no REST readiness endpoint, so its backend
-  // federation contract omits the readiness probes (G7a).
-  exposeReadiness:
-    vertical.apiProtocol === 'rpc'
-      ? undefined
-      : `${vertical.apiPrefix}/${vertical.stem}/readiness`,
-  versionBoundary: {
-    invariant: 'web-and-api-same-build',
-    hasUi: vertical.emitsUi,
-    uiManifestUrl: vertical.emitsUi
-      ? expectedManifestUrl(vertical)
-      : undefined,
-    apiReadiness:
-      vertical.apiProtocol === 'rpc'
-        ? undefined
-        : `${vertical.apiPrefix}/${vertical.stem}/readiness`,
-  },
-  cloudflare: {
-    kind: 'cloudflare-worker-snapshot',
-    hasApi: !vertical.emitsUi,
-    hasSsr: vertical.emitsUi,
-    workerName: expectedCloudflareWorkerName(vertical),
-    publicUrlEnv: expectedPublicUrlEnv(vertical),
-    zephyrRuntime: vertical.emitsUi ? 'ssr-worker' : 'api-worker',
-  },
-  node: {
-    kind: 'node-mf-runtime',
-    remoteName: expectedBackendFederationName(vertical),
-    manifestEnv: expectedBackendManifestEnv(vertical),
-    manifestUrl: expectedBackendManifestUrl(vertical),
-    containerEntry: expectedBackendContainerEntry(vertical),
-    remoteType: 'commonjs-module',
-    expose: './effect-api',
-  },
-  compatibility: {
-    contractVersion: 'microvertical-server-effect-v1',
-  },
-  topLevelManifestUrl: undefined,
-  topLevelContainerEntry: undefined,
-});
-const serverExecutionSubset = serverExecution => ({
-  apiBaseUrl: serverExecution?.apiBaseUrl,
-  versionBoundary: serverExecution?.versionBoundary,
-  cloudflareKind: serverExecution?.cloudflare?.kind,
-  cloudflareWorkerName: serverExecution?.cloudflare?.workerName,
-  nodeKind: serverExecution?.node?.kind,
-  nodeManifestUrl: serverExecution?.node?.manifestUrl,
-  nodeContainerEntry: serverExecution?.node?.containerEntry,
-});
-const expectedServerExecutionSubset = vertical => ({
-  apiBaseUrl: expectedApiUrl(vertical),
-  versionBoundary: 'web-and-api-same-build',
-  cloudflareKind: 'cloudflare-worker-snapshot',
-  cloudflareWorkerName: expectedCloudflareWorkerName(vertical),
-  nodeKind: 'node-mf-runtime',
-  nodeManifestUrl: expectedBackendManifestUrl(vertical),
-  nodeContainerEntry: expectedBackendContainerEntry(vertical),
-});
-const remoteContractSubset = remote => ({
-  id: remote?.id,
-  name: remote?.name,
-  manifestUrl: remote?.manifestUrl,
-});
-const expectedRemoteContractSubset = vertical => ({
-  id: vertical.id,
-  name: vertical.mfName,
-  manifestUrl: expectedManifestUrl(vertical),
-});
-const expectedRemoteSubsetsForRefs = refs =>
-  refs
-    .map(ref => fullStackVerticals.find(vertical => vertical.id === ref))
-    .filter(Boolean)
-    .map(expectedRemoteContractSubset);
-const requiredMicroVerticalPaths = vertical => [
-  `${vertical.path}/package.json`,
-  `${vertical.path}/tsconfig.json`,
-  `${vertical.path}/tsconfig.mf-types.json`,
-  `${vertical.path}/modern.config.ts`,
-  `${vertical.path}/src/modern-app-env.d.ts`,
-  `${vertical.path}/src/modern.runtime.ts`,
-  `${vertical.path}/locales/en/translation.json`,
-  `${vertical.path}/locales/en/${vertical.namespace}.json`,
-  `${vertical.path}/locales/cs/translation.json`,
-  `${vertical.path}/locales/cs/${vertical.namespace}.json`,
-  ...(vertical.emitsUi
-    ? [
-        `${vertical.path}/module-federation.config.ts`,
-        `${vertical.path}/src/federation-entry.tsx`,
-        ...vertical.componentPaths,
-        `${vertical.path}/src/routes/index.css`,
-        `${vertical.path}/src/routes/layout.tsx`,
-        `${vertical.path}/src/routes/ultramodern-route-head.tsx`,
-        `${vertical.path}/src/routes/ultramodern-route-metadata.ts`,
-        `${vertical.path}/src/routes/[lang]/page.tsx`,
-        ...(vertical.exposes.includes('./Widget')
-          ? [
-              `${vertical.path}/src/routes/[lang]/_mf/fragment/widget/page.tsx`,
-            ]
-          : []),
-        ...vertical.routePagePaths,
-        ...vertical.routeMetaPaths,
-      ]
-    : []),
-  ...(vertical.emitsApi
-    ? [
-        `${vertical.path}/backend-federation.config.ts`,
-        `${vertical.path}/api/effect-api.ts`,
-        `${vertical.path}/api/index.ts`,
-        `${vertical.path}/${vertical.apiContractPath}`,
-        `${vertical.path}/${vertical.apiClientPath}`,
-      ]
-    : []),
-];
-// UI/MF artifacts an `api-only` unit must NOT emit (headless invariant), and
-// API/BFF artifacts a `ui-only`/Horizontal Remote unit must NOT emit.
-const forbiddenMicroVerticalPaths = vertical => [
-  ...(vertical.emitsUi
-    ? []
-    : [
-        `${vertical.path}/module-federation.config.ts`,
-        `${vertical.path}/src/federation-entry.tsx`,
-        // The federated demo `./Widget` component (descriptors.ts:127 ->
-        // remoteComponentOutputPath) is a UI-only artifact; a headless api-only
-        // unit exposes no browser component and must not ship it.
-        `${vertical.path}/src/components/${vertical.domain ?? vertical.id}-widget.tsx`,
-        `${vertical.path}/src/routes/layout.tsx`,
-        `${vertical.path}/src/routes/[lang]/page.tsx`,
-        `${vertical.path}/src/routes/[lang]/_mf/fragment/widget/page.tsx`,
-        // A headless api-only unit renders no browser surface, so it must not
-        // ship route components, the colocated route-metadata/head modules, or
-        // the colocated `[lang]/route.meta.ts` route-meta file.
-        `${vertical.path}/src/routes/[lang]/route.meta.ts`,
-        `${vertical.path}/src/routes/ultramodern-route-head.tsx`,
-        `${vertical.path}/src/routes/ultramodern-route-metadata.ts`,
-        `${vertical.path}/src/routes/index.css`,
-      ]),
-  ...(vertical.emitsApi
-    ? []
-    : [
-        `${vertical.path}/shared/api.ts`,
-        // A ui-only/Horizontal Remote unit carries no API contract in either
-        // protocol (neither the REST `shared/api.ts` nor the RPC `shared/rpc.ts`)
-        // and no generated API client.
-        `${vertical.path}/shared/rpc.ts`,
-        `${vertical.path}/backend-federation.config.ts`,
-        `${vertical.path}/api/index.ts`,
-        `${vertical.path}/api/effect-api.ts`,
-        `${vertical.path}/src/api/${vertical.domain ?? vertical.id}-client.ts`,
-        `${vertical.path}/src/api/${vertical.domain ?? vertical.id}-rpc-client.ts`,
-      ]),
-];
-const assertRequiredVerticalFile = vertical => relativePath => {
-  assertSelfCheck(
-    fs.existsSync(path.join(root, relativePath)),
-    `required files for ${vertical.id}`,
-    `Missing ${relativePath}`,
-    'restore the generated MicroVertical files or rerun the MicroVertical generator',
-  );
-};
-const assertForbiddenVerticalFile = vertical => relativePath => {
-  assertSelfCheck(
-    !fs.existsSync(path.join(root, relativePath)),
-    `forbidden files for ${vertical.id}`,
-    `Unexpected ${relativePath} for a ${vertical.surfaceProfile} unit`,
-    `remove ${relativePath}; a ${vertical.surfaceProfile} unit does not emit this surface`,
-  );
-};
-const assertMicroVerticalContractGraph = ({
-  generatedContract,
-  topology,
-  ownership,
-  overlay,
-  shellPackage,
-}) => {
-  const expectedVerticalIds = fullStackVerticals.map(vertical => vertical.id);
-  const expectedAppIds = ['shell-super-app', ...expectedVerticalIds];
-  const expectedShellVerticalIds = expectedPrimaryShellVerticalIds;
-  const expectedShellRemotes = expectedShellVerticalIds.flatMap(
-    verticalId => {
-      const vertical = fullStackVerticals.find(
-        candidate => candidate.id === verticalId,
-      );
-      return vertical === undefined
-        ? []
-        : [expectedRemoteContractSubset(vertical)];
-    },
-  );
-
-  assertObject(
-    topology.shell,
-    'topology/reference-topology.json shell',
-    'restore generated topology shell metadata',
-  );
-  assertArray(
-    topology.verticals,
-    'topology/reference-topology.json verticals',
-    'restore generated topology vertical entries',
-  );
-  assertObject(
-    topology.shell?.moduleFederation,
-    'topology/reference-topology.json shell.moduleFederation',
-    'restore generated shell Module Federation metadata',
-  );
-  assertArray(
-    topology.shell?.moduleFederation?.remotes,
-    'topology/reference-topology.json shell.moduleFederation.remotes',
-    'restore generated shell Module Federation remotes',
-  );
-  assertArray(
-    ownership.owners,
-    'topology/ownership.json owners',
-    'restore generated ownership entries',
-  );
-  assertObject(
-    overlay.ports,
-    'topology/local-overlays/development.json ports',
-    'restore generated local development port overlays',
-  );
-  assertObject(
-    overlay.manifests,
-    'topology/local-overlays/development.json manifests',
-    'restore generated local Module Federation manifest overlays',
-  );
-  assertObject(
-    overlay.apis,
-    'topology/local-overlays/development.json apis',
-    'restore generated local API overlays',
-  );
-  assertArray(
-    generatedContract.apps,
-    `${generatedContractLabel} apps`,
-    'regenerate the generated contract from the workspace topology',
-  );
-
-  assertSameJson(
-    topology.shell.verticalRefs ?? [],
-    expectedShellVerticalIds,
-    'topology/reference-topology.json shell.verticalRefs',
-    'restore generated topology shell references',
-  );
-  assertSameJson(
-    topology.verticals.map(vertical => vertical?.id),
-    expectedVerticalIds,
-    'topology/reference-topology.json verticals',
-    'restore generated topology vertical entries',
-  );
-  assertSameJson(
-    topology.shell.moduleFederation.remotes.map(remoteContractSubset),
-    expectedShellRemotes,
-    'topology/reference-topology.json shell.moduleFederation.remotes',
-    'restore generated shell Module Federation remotes',
-  );
-  assertSameJson(
-    generatedContract.apps.map(app => app?.id),
-    expectedAppIds,
-    `${generatedContractLabel} apps`,
-    'regenerate the generated contract after topology changes',
-  );
-
-  const shellContract = findById(generatedContract.apps, 'shell-super-app');
-  assertObject(
-    shellContract,
-    `${generatedContractLabel} apps.shell-super-app`,
-    'regenerate the generated shell contract entry',
-  );
-  assertSameJson(
-    shellContract.moduleFederation?.verticalRefs ?? [],
-    expectedShellVerticalIds,
-    `${generatedContractLabel} shell moduleFederation.verticalRefs`,
-    'regenerate the generated shell Module Federation contract',
-  );
-  assertSameJson(
-    (shellContract.moduleFederation?.remotes ?? []).map(remoteContractSubset),
-    expectedShellRemotes,
-    `${generatedContractLabel} shell moduleFederation.remotes`,
-    'regenerate the generated shell Module Federation contract',
-  );
-  assertSameJson(
-    shellContract.ssr,
-    {
-      mode: 'stream',
-      moduleFederationAppSSR: true,
-    },
-    `${generatedContractLabel} shell SSR contract`,
-    'restore generated streaming SSR Module Federation settings',
-  );
-
-  for (const vertical of fullStackVerticals) {
-    const expectedRefs = vertical.verticalRefs ?? [];
-    const topologyEntry = findById(topology.verticals, vertical.id);
-    const ownershipEntry = findById(ownership.owners, vertical.id);
-    const contractEntry = findById(generatedContract.apps, vertical.id);
-    const expectedExposes = Array.isArray(vertical.exposes)
-      ? vertical.exposes
-      : Object.keys(vertical.exposes ?? {});
-
-    requiredMicroVerticalPaths(vertical).forEach(
-      assertRequiredVerticalFile(vertical),
-    );
-
-    assertObject(
-      topologyEntry,
-      `topology/reference-topology.json verticals.${vertical.id}`,
-      'restore generated topology vertical entries',
-    );
-    assertSameJson(
-      {
-        kind: topologyEntry.kind,
-        package: topologyEntry.package,
-        path: topologyEntry.path,
-        moduleFederation: {
-          name: topologyEntry.moduleFederation?.name,
-          manifestUrl: topologyEntry.moduleFederation?.manifestUrl,
-          exposes: topologyEntry.moduleFederation?.exposes ?? [],
-          verticalRefs: topologyEntry.moduleFederation?.verticalRefs ?? [],
-          remotes: (topologyEntry.moduleFederation?.remotes ?? []).map(
-            remoteContractSubset,
-          ),
-        },
-        ...(vertical.emitsApi
-          ? {
-              api: {
-                prefix: topologyEntry.api?.bff?.prefix,
-                serverEntry: topologyEntry.api?.serverEntry,
-              },
-            }
-          : {}),
-      },
-      {
-        kind: 'vertical',
-        package: vertical.packageName,
-        path: vertical.path,
-        moduleFederation: {
-          name: vertical.mfName,
-          manifestUrl: expectedManifestUrl(vertical),
-          exposes: expectedExposes,
-          verticalRefs: expectedRefs,
-          remotes: expectedRemoteSubsetsForRefs(expectedRefs),
-        },
-        ...(vertical.emitsApi
-          ? {
-              api: {
-                prefix: vertical.apiPrefix,
-                serverEntry: `${vertical.path}/api/index.ts`,
-              },
-            }
-          : {}),
-      },
-      `topology/reference-topology.json verticals.${vertical.id}`,
-      'restore generated topology vertical entries',
-    );
-    if (vertical.emitsApi) {
-      assertSameJson(
-        backendFederationSubset(topologyEntry.backendFederation),
-        expectedBackendFederationSubset(vertical),
-        `topology/reference-topology.json verticals.${vertical.id}.backendFederation`,
-        'restore generated MicroVertical server execution contract',
-      );
-    }
-
-    if (vertical.deliveryUnit) {
-      const compactApp = findById(
-        ultramodernConfig.topology?.apps,
-        vertical.id,
-      );
-      const expectedDeliveryUnit = deliveryUnitBlock(
-        expectedDeliveryUnitFor(vertical),
-      );
-      assertSameJson(
-        deliveryUnitBlock(compactApp?.deliveryUnit),
-        expectedDeliveryUnit,
-        `${generatedContractLabel} topology.apps.${vertical.id}.deliveryUnit`,
-        deliveryUnitIdentityFixArea,
-      );
-      if (vertical.emitsApi) {
-        assertSameJson(
-          deliveryUnitBlock(compactApp?.backendFederation?.deliveryUnit),
-          expectedDeliveryUnit,
-          `${generatedContractLabel} topology.apps.${vertical.id}.backendFederation.deliveryUnit`,
-          deliveryUnitIdentityFixArea,
-        );
-      }
-      assertSameJson(
-        deliveryUnitBlock(topologyEntry.deliveryUnit),
-        expectedDeliveryUnit,
-        `topology/reference-topology.json verticals.${vertical.id}.deliveryUnit`,
-        deliveryUnitIdentityFixArea,
-      );
-      if (vertical.emitsApi) {
-        assertSameJson(
-          deliveryUnitBlock(topologyEntry.backendFederation?.deliveryUnit),
-          expectedDeliveryUnit,
-          `topology/reference-topology.json verticals.${vertical.id}.backendFederation.deliveryUnit`,
-          deliveryUnitIdentityFixArea,
-        );
-        assertSelfCheck(
-          topologyEntry.backendFederation?.versionBoundary?.identityRoot === 'deliveryUnit',
-          `topology/reference-topology.json verticals.${vertical.id}.backendFederation.versionBoundary.identityRoot`,
-          `Expected "deliveryUnit", found ${formatJson(topologyEntry.backendFederation?.versionBoundary?.identityRoot)}`,
-          deliveryUnitIdentityFixArea,
-        );
-      }
-    }
-
-    assertObject(
-      ownershipEntry,
-      `topology/ownership.json owners.${vertical.id}`,
-      'restore generated ownership entries',
-    );
-    assertSameJson(
-      {
-        package: ownershipEntry.package,
-        path: ownershipEntry.path,
-      },
-      {
-        package: vertical.packageName,
-        path: vertical.path,
-      },
-      `topology/ownership.json owners.${vertical.id}`,
-      'restore generated ownership entries',
-    );
-
-    assertSameJson(
-      overlay.ports[vertical.id],
-      vertical.port,
-      `topology/local-overlays/development.json ports.${vertical.id}`,
-      'restore generated local development port overlay',
-    );
-    if (vertical.emitsUi) {
-      assertSameJson(
-        overlay.manifests[vertical.id],
-        expectedManifestUrl(vertical),
-        `topology/local-overlays/development.json manifests.${vertical.id}`,
-        'restore generated local Module Federation manifest overlay',
-      );
-    }
-    if (vertical.emitsApi) {
-      assertSameJson(
-        overlay.apis[vertical.id],
-        expectedApiUrl(vertical),
-        `topology/local-overlays/development.json apis.${vertical.id}`,
-        'restore generated local API overlay',
-      );
-      assertSameJson(
-        serverExecutionSubset(overlay.serverExecution?.[vertical.id]),
-        expectedServerExecutionSubset(vertical),
-        `topology/local-overlays/development.json serverExecution.${vertical.id}`,
-        'restore generated local MicroVertical server execution overlay',
-      );
-    }
-
-
-    // Plain workspace dependencies and Zephyr metadata are gated
-    // INDEPENDENTLY (G2a/G28): every shell depends on each API-emitting
-    // vertical (its vertical-clients.ts re-exports the client) regardless of
-    // UI composition, while Zephyr metadata follows UI composition refs only.
-    const shellPackagesForDependencyChecks = [
-      {
-        id: 'shell-super-app',
-        path: 'apps/shell-super-app',
-        pkg: shellPackage,
-        uiRefs: expectedShellVerticalIds,
-      },
-      ...expectedAdditionalShells.map(additionalShell => ({
-        id: additionalShell.id,
-        path: additionalShell.path,
-        pkg: readJson(`${additionalShell.path}/package.json`),
-        uiRefs: additionalShell.verticalRefs ?? [],
-      })),
-    ];
-    for (const shellEntry of shellPackagesForDependencyChecks) {
-      const composed = shellEntry.uiRefs.includes(vertical.id);
-      if (vertical.emitsApi || composed) {
-        assertSameJson(
-          shellEntry.pkg.dependencies?.[vertical.packageName],
-          'workspace:*',
-          `${shellEntry.path}/package.json dependencies.${vertical.packageName}`,
-          'restore shell dependency for the MicroVertical consumer',
-        );
-      }
-      if (composed) {
-        assertSameJson(
-          shellEntry.pkg['zephyr:dependencies']?.[vertical.zephyrAlias],
-          `${vertical.packageName}@workspace:*`,
-          `${shellEntry.path}/package.json zephyr:dependencies.${vertical.zephyrAlias}`,
-          'restore shell Zephyr dependency metadata for the MicroVertical',
-        );
-      }
-    }
-
-    assertObject(
-      contractEntry,
-      `${generatedContractLabel} apps.${vertical.id}`,
-      'regenerate the generated MicroVertical contract entry',
-    );
-    assertSameJson(
-      {
-        kind: contractEntry.kind,
-        package: contractEntry.package,
-        path: contractEntry.path,
-        moduleFederation: {
-          name: contractEntry.moduleFederation?.name,
-          exposes: contractEntry.moduleFederation?.exposes ?? [],
-          verticalRefs: contractEntry.moduleFederation?.verticalRefs ?? [],
-          remotes: (contractEntry.moduleFederation?.remotes ?? []).map(
-            remoteContractSubset,
-          ),
-        },
-        ...(vertical.emitsApi
-          ? {
-              api: {
-                prefix: contractEntry.api?.prefix,
-                contract: contractEntry.api?.contract,
-                client: contractEntry.api?.client,
-              },
-            }
-          : {}),
-        ssr: contractEntry.ssr,
-      },
-      {
-        kind: 'vertical',
-        package: vertical.packageName,
-        path: vertical.path,
-        moduleFederation: {
-          name: vertical.mfName,
-          exposes: expectedExposes,
-          verticalRefs: expectedRefs,
-          remotes: expectedRemoteSubsetsForRefs(expectedRefs),
-        },
-        ...(vertical.emitsApi
-          ? {
-              api: {
-                prefix: vertical.apiPrefix,
-                // Protocol-aware exports: `rest` -> `./api`/`./api/client`,
-                // `rpc` -> `./api`/`./api/rpc-client`.
-                contract: vertical.apiContractExport,
-                client: vertical.apiClientExport,
-              },
-            }
-          : {}),
-        ssr: {
-          mode: 'stream',
-          moduleFederationAppSSR: true,
-        },
-      },
-      `${generatedContractLabel} apps.${vertical.id}`,
-      'regenerate the generated MicroVertical contract entry',
-    );
-  }
-};
-const toPosixPath = value => value.split(path.sep).join('/');
-const referenceFrom = (fromPath, toPath) => ({
-  path: toPosixPath(path.relative(fromPath, toPath)),
-});
-const sharedPackagePaths = [
-  'packages/shared-contracts',
-  'packages/shared-design-tokens',
-];
-const tsgoCacheKey = packagePath => packagePath.replace(/[^a-zA-Z0-9._-]+/gu, '__');
-const assertProjectReferenceEmitConfig = (tsConfig, packagePath) => {
-  const compilerOptions = tsConfig.compilerOptions ?? {};
-  const relativeRoot = toPosixPath(path.relative(packagePath, '.')) || '.';
-  assert(compilerOptions.composite === true, `${packagePath} must stay a composite TS-Go project`);
-  assert(compilerOptions.declaration === true, `${packagePath} must emit declarations for TS-Go build mode`);
-  assert(compilerOptions.declarationMap === false, `${packagePath} must not emit declaration maps during checks`);
-  assert(compilerOptions.emitDeclarationOnly === true, `${packagePath} must only emit declarations during checks`);
-  assert(compilerOptions.noEmit === false, `${packagePath} must override root noEmit for TS-Go build mode`);
-  assert(
-    compilerOptions.outDir === `${relativeRoot}/node_modules/.cache/tsgo/declarations/${tsgoCacheKey(packagePath)}`,
-    `${packagePath} must emit TS-Go declarations into the generated cache`,
-  );
-  assert(
-    compilerOptions.tsBuildInfoFile === `${relativeRoot}/node_modules/.cache/tsgo/${tsgoCacheKey(packagePath)}.tsbuildinfo`,
-    `${packagePath} must keep TS-Go build info in the generated cache`,
-  );
-};
-const assertTsConfigReferenceGraph = () => {
-  const baseTsConfig = readJson('tsconfig.base.json');
-  const rootTsConfig = readJson('tsconfig.json');
-  const shellTsConfig = readJson('apps/shell-super-app/tsconfig.json');
-  const shellMfTypesTsConfig = readJson(
-    'apps/shell-super-app/tsconfig.mf-types.json',
-  );
-  const additionalShellPaths = (
-    workspaceValidationContract.structuralShellPolicy?.shells ?? []
-  )
-    .filter(shell => shell.id !== 'shell-super-app')
-    .map(shell => shell.packageDir);
-  const expectedRootReferences = [
-    ...sharedPackagePaths,
-    'apps/shell-super-app',
-    ...fullStackVerticals.map(vertical => vertical.path),
-    ...additionalShellPaths,
-  ].map(referencePath => ({ path: referencePath }));
-  const expectedShellReferences = sharedPackagePaths.map(referencePath =>
-    referenceFrom('apps/shell-super-app', referencePath),
-  );
-
-  assertSameJson(
-    rootTsConfig.files,
-    [],
-    'tsconfig.json files',
-    'restore the generated root project-reference tsconfig',
-  );
-  assertSameJson(
-    rootTsConfig.references ?? [],
-    expectedRootReferences,
-    'tsconfig.json references',
-    'restore the generated root project-reference graph',
-  );
-  assertSameJson(
-    shellTsConfig.references ?? [],
-    expectedShellReferences,
-    'apps/shell-super-app/tsconfig.json references',
-    'restore the generated shell project-reference graph',
-  );
-  assert(baseTsConfig.compilerOptions?.skipLibCheck !== true, 'tsconfig.base.json must not use skipLibCheck');
-  assertSameJson(
-    shellTsConfig.include ?? [],
-    ['src', 'locales/**/*.json', 'package.json', 'shared', 'server'],
-    'apps/shell-super-app/tsconfig.json include',
-    'restore the generated shell typecheck boundary',
-  );
-  assertProjectReferenceEmitConfig(
-    shellTsConfig,
-    'apps/shell-super-app',
-  );
-  assertSameJson(
-    shellMfTypesTsConfig,
-    {
-      extends: '../../tsconfig.base.json',
-      include: ['src/modern-app-env.d.ts'],
-      compilerOptions: {
-        skipLibCheck: true,
-      },
-    },
-    'apps/shell-super-app/tsconfig.mf-types.json',
-    'restore the generated shell Module Federation DTS boundary',
-  );
-  for (const sharedPackagePath of sharedPackagePaths) {
-    assertProjectReferenceEmitConfig(
-      readJson(`${sharedPackagePath}/tsconfig.json`),
-      sharedPackagePath,
-    );
-  }
-
-  for (const vertical of fullStackVerticals) {
-    const verticalTsConfig = readJson(`${vertical.path}/tsconfig.json`);
-    const verticalMfTypesTsConfig = readJson(
-      `${vertical.path}/tsconfig.mf-types.json`,
-    );
-    const expectedVerticalReferences = [
-      ...sharedPackagePaths,
-      ...(vertical.verticalRefs ?? [])
-        .map(verticalRef =>
-          fullStackVerticals.find(candidate => candidate.id === verticalRef),
-        )
-        .filter(Boolean)
-        .map(referencedVertical => referencedVertical.path),
-    ].map(referencePath => referenceFrom(vertical.path, referencePath));
-    assertSameJson(
-      verticalTsConfig.references ?? [],
-      expectedVerticalReferences,
-      `${vertical.path}/tsconfig.json references`,
-      'restore the generated MicroVertical project-reference graph',
-    );
-    assertSameJson(
-      verticalTsConfig.include ?? [],
-      [
-        'src',
-        'locales/**/*.json',
-        'package.json',
-        'shared',
-        'server',
-        ...(vertical.emitsApi ? ['api'] : []),
-      ],
-      `${vertical.path}/tsconfig.json include`,
-      'restore the generated MicroVertical typecheck boundary',
-    );
-    assertProjectReferenceEmitConfig(verticalTsConfig, vertical.path);
-    assert(
-      (vertical.verticalRefs ?? []).length > 0
-        ? verticalTsConfig.compilerOptions?.skipLibCheck === true
-        : verticalTsConfig.compilerOptions?.skipLibCheck !== true,
-      `${vertical.path}/tsconfig.json must scope skipLibCheck to composed remotes`,
-    );
-    assertSameJson(
-      verticalMfTypesTsConfig,
-      {
-        extends: '../../tsconfig.base.json',
-        // A headless (api-only) unit exposes no Module Federation surface, so
-        // its DTS boundary only covers the ambient env declarations (G2a).
-        include: vertical.emitsUi
-          ? [
-              'src/federation-entry.tsx',
-              ...vertical.componentPaths.map(componentPath =>
-                componentPath.replace(`${vertical.path}/`, ''),
-              ),
-              'src/modern-app-env.d.ts',
-            ]
-          : ['src/modern-app-env.d.ts'],
-        compilerOptions: {
-          skipLibCheck: true,
-        },
-      },
-      `${vertical.path}/tsconfig.mf-types.json`,
-      'restore the generated MicroVertical Module Federation DTS boundary',
-    );
-  }
-
-  for (const shell of expectedAdditionalShells) {
-    const shellTsConfig = readJson(`${shell.path}/tsconfig.json`);
-    const shellMfTypesTsConfig = readJson(
-      `${shell.path}/tsconfig.mf-types.json`,
-    );
-    const expectedShellReferences = sharedPackagePaths.map(referencePath =>
-      referenceFrom(shell.path, referencePath),
-    );
-    assertSameJson(
-      shellTsConfig.references ?? [],
-      expectedShellReferences,
-      `${shell.path}/tsconfig.json references`,
-      'restore the generated additional-shell project-reference graph',
-    );
-    assertSameJson(
-      shellTsConfig.include ?? [],
-      ['src', 'locales/**/*.json', 'package.json', 'shared', 'server'],
-      `${shell.path}/tsconfig.json include`,
-      'restore the generated additional-shell typecheck boundary',
-    );
-    assertProjectReferenceEmitConfig(shellTsConfig, shell.path);
-    assertSameJson(
-      shellMfTypesTsConfig,
-      {
-        extends: '../../tsconfig.base.json',
-        include: ['src/modern-app-env.d.ts'],
-        compilerOptions: {
-          skipLibCheck: true,
-        },
-      },
-      `${shell.path}/tsconfig.mf-types.json`,
-      'restore the generated additional-shell Module Federation DTS boundary',
-    );
-  }
-};
-const packageJsonFiles = startDir => {
-  const files = [];
-  const queue = [startDir];
-  while (queue.length > 0) {
-    const current = queue.shift();
-    for (const entry of fs.readdirSync(current, { withFileTypes: true })) {
-      if (
-      ['.git', '.output', '.zerops', 'dist', 'node_modules', 'repos'].includes(
-          entry.name,
-        )
-      ) {
-        continue;
-      }
-      const absolute = path.join(current, entry.name);
-      if (entry.isDirectory()) {
-        queue.push(absolute);
-      } else if (entry.name === 'package.json') {
-        files.push(absolute);
-      }
-    }
-  }
-  return files.sort();
-};
-const modernDependencyNames = packageJson =>
-  [
-    ...new Set(
-      [
-        'dependencies',
-        'devDependencies',
-        'optionalDependencies',
-        'peerDependencies',
-      ]
-        .flatMap(section => Object.keys(packageJson[section] ?? {}))
-        .filter(packageName => packageName.startsWith('@modern-js/')),
-    ),
-  ];
-const assertModernPackageCohort = () => {
-  const modernPackageNames = workspaceValidationContract.cohort.modernPackages;
-  const modernPackageNameSet = new Set(modernPackageNames);
-  const observedModernPackageNames = new Set();
-  const observedAppIds = [];
-  // Additional shells (G28) are their own Delivery Units registered in the
-  // additive `config.shells` collection and gated by the structural thin-shell
-  // policy; they are deliberately kept out of the strict topology.apps cohort,
-  // so their package manifests are excluded from the app-id cohort walk here.
-  const additionalShellAppIds = new Set(
-    (workspaceValidationContract.structuralShellPolicy?.shells ?? [])
-      .map(shell => shell.id)
-      .filter(id => id !== 'shell-super-app'),
-  );
-  for (const packageJsonPath of packageJsonFiles(root)) {
-    const relativePath = path.relative(root, packageJsonPath).split(path.sep).join('/');
-    const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf-8'));
-    if (
-      typeof packageJson.modernjs?.appId === 'string' &&
-      !additionalShellAppIds.has(packageJson.modernjs.appId)
-    ) {
-      observedAppIds.push(packageJson.modernjs.appId);
-    }
-    for (const packageName of modernDependencyNames(packageJson)) {
-      observedModernPackageNames.add(packageName);
-      assert(
-        modernPackageNameSet.has(packageName),
-        `${relativePath} declares ${packageName} outside package source metadata`,
-      );
-    }
-    for (const section of [
-      'dependencies',
-      'devDependencies',
-      'optionalDependencies',
-      'peerDependencies',
-    ]) {
-      for (const packageName of modernPackageNames) {
-        const actual = packageJson[section]?.[packageName];
-        if (actual !== undefined) {
-          assert(
-            actual === expectedModernPackageSpecifier(packageName),
-            `${relativePath} ${section}.${packageName} must match package source metadata`,
-          );
-        }
-      }
-    }
-  }
-
-  for (const packageName of modernPackageNames) {
-    assert(
-      observedModernPackageNames.has(packageName),
-      `Modern package cohort is missing ${packageName}`,
-    );
-  }
-  assertUniqueStrings(observedAppIds, 'generated app package manifests');
-  // The app-id cohort is a SET: observedAppIds is discovered by a
-  // filesystem-ordered package.json walk, while cohort.appIds is in generation
-  // insertion order. Compare order-insensitively (every other cohort check uses
-  // the same sorted comparison via assertSameIdCohort) so a multi-vertical
-  // workspace whose insertion order differs from filesystem order still passes.
-  assertSameJson(
-    [...observedAppIds].toSorted(),
-    [...workspaceValidationContract.cohort.appIds].toSorted(),
-    'generated app package manifest cohort',
-    'restore every generated app package manifest',
-  );
-};
-const assertPublicSurfaceAssets = (appPath, publicRoutes) => {
-  for (const relativePath of publicSurfaceManagedSourceAssetPaths) {
-    assertNotExists(`${appPath}/${relativePath}`);
-  }
-  void publicRoutes;
-};
-const assertPublicSurfaceContract = (appId, publicSurface) => {
-  assert(publicSurface?.artifactLifecycle === 'build-and-deploy-output', `${appId} public surface artifacts must be build/deploy outputs`);
-  assert(publicSurface?.generator === 'scripts/generate-public-surface-assets.mts', `${appId} public surface generator script is incorrect`);
-  assert(publicSurface?.outputRoot === 'dist/public', `${appId} public surface dist outputRoot is incorrect`);
-  assert(publicSurface?.cloudflareBuildOutputRoot === 'dist-cloudflare/public', `${appId} public surface Cloudflare build outputRoot is incorrect`);
-  assert(!('cloudflareOutputRoot' in (publicSurface ?? {})), `${appId} public surface must not target final .output directly`);
-  assert(!('staticRoot' in (publicSurface ?? {})), `${appId} public surface must not point at source config/public`);
-  assert((publicSurface?.files ?? []).includes('robots.txt'), `${appId} public surface must always emit robots.txt`);
-  assert(publicSurface?.contentExpansion?.authoring === 'route-owned-esm-provider', `${appId} public content expansion authoring is incorrect`);
-  assert(publicSurface?.contentExpansion?.defaultProviderFile === 'route.sitemap.mjs', `${appId} public content expansion provider file is incorrect`);
-  assert(publicSurface?.contentExpansion?.draftPolicy === 'omit-draft-by-default', `${appId} public content expansion draft policy is incorrect`);
-  assert(publicSurface?.contentExpansion?.indexablePolicy === 'omit-indexable-false', `${appId} public content expansion indexable policy is incorrect`);
-  assert(Array.isArray(publicSurface?.contentSources), `${appId} public content sources must be an array`);
-  if ((publicSurface?.publicRoutes ?? []).length === 0) {
-    assert(!(publicSurface?.files ?? []).includes('sitemap.xml'), `${appId} private public surface must omit sitemap.xml`);
-    assert(!(publicSurface?.files ?? []).includes('site.webmanifest'), `${appId} private public surface must omit site.webmanifest`);
-  } else {
-    assert((publicSurface?.files ?? []).includes('sitemap.xml'), `${appId} public surface must emit sitemap.xml when public routes exist`);
-    assert((publicSurface?.files ?? []).includes('site.webmanifest'), `${appId} public surface must emit site.webmanifest when public routes exist`);
-  }
-};
-const assertPublicHeadContract = (appId, publicHead) => {
-  assert(publicHead?.generator === './src/routes/ultramodern-route-head', `${appId} public head generator is incorrect`);
-  assert(publicHead?.renderer === '@modern-js/runtime/head Helmet', `${appId} public head renderer is incorrect`);
-  assert(publicHead?.ssr === true, `${appId} public head must be SSR-rendered`);
-  assert(publicHead?.title?.source === 'route.titleKey', `${appId} public head title must come from route metadata`);
-  assert(publicHead?.description?.source === 'route.descriptionKey', `${appId} public head description must come from route metadata`);
-  assert(publicHead?.canonical?.publicIndexableOnly === true, `${appId} canonical links must be public/indexable only`);
-  assert(publicHead?.structuredData?.optional === true, `${appId} structured data must be optional`);
-  assert(publicHead?.structuredData?.source === 'route.jsonLd', `${appId} structured data must come from explicit route metadata`);
-  assert(publicHead?.structuredData?.inference === false, `${appId} structured data inference must stay disabled`);
-  assert(publicHead?.structuredData?.helperModule === './src/routes/ultramodern-jsonld', `${appId} structured data helper module is incorrect`);
-  assert(publicHead?.structuredData?.sanitizesHtmlOpenBracket === true, `${appId} structured data must sanitize HTML open brackets`);
-  assert(publicHead?.privateRouteRobots === 'noindex, nofollow', `${appId} private route robots policy is incorrect`);
-};
-const assertCloudflareQualityGates = (appId, qualityGates) => {
-  assert(qualityGates?.publicRoutes?.requireSitemapWhenPresent === true, `${appId} quality gates must require sitemap for public routes`);
-  assert(qualityGates?.publicRoutes?.requireRobotsSitemapConsistency === true, `${appId} quality gates must require robots/sitemap consistency`);
-  assert(qualityGates?.statusCodes?.unknownRouteStatus === 404, `${appId} quality gates must require 404 unknown routes`);
-  assert(qualityGates?.indexing?.previewNoindex === true, `${appId} quality gates must require preview noindex`);
-  assert(qualityGates?.indexing?.productionPublicRoutesIndexable === true, `${appId} quality gates must require production public routes to be indexable`);
-  assert(qualityGates?.assets?.cssPreloadRequired === true, `${appId} quality gates must require CSS preload evidence`);
-  assert(qualityGates?.assets?.sourcemapsPubliclyReferenced === false, `${appId} quality gates must reject public sourcemap references`);
-  assert(typeof qualityGates?.budgets?.ssrHtmlMaxBytes === 'number', `${appId} quality gates must define SSR HTML byte budget`);
-  assert(typeof qualityGates?.budgets?.mfManifestMaxBytes === 'number', `${appId} quality gates must define MF manifest byte budget`);
-  assert(qualityGates?.csp?.finalMode === 'report-only-dogfood', `${appId} CSP final mode decision is missing`);
-};
-const expectedWorkerName = packageSuffix => `${packageScope}-${packageSuffix}`.slice(0, 63);
-const expectedChunkLoadingGlobal = mfName =>
-  `__ULTRAMODERN_${mfName
-    .replace(/([a-z0-9])([A-Z])/g, '$1_$2')
-    .replace(/[^a-zA-Z0-9]+/g, '_')
-    .replace(/^_+|_+$/g, '')
-    .toUpperCase()}_LOADED_CHUNKS__`;
-const parseSemver = version => {
-  const match = /^(\d+)\.(\d+)\.(\d+)/u.exec(version);
-  assert(match, `Unable to parse pnpm version: ${version}`);
-  return {
-    major: Number(match[1]),
-    minor: Number(match[2]),
-    patch: Number(match[3]),
-  };
-};
-const compareSemver = (left, right) =>
-  left.major - right.major || left.minor - right.minor || left.patch - right.patch;
-
-const activePnpmVersion = execFileSync('pnpm', ['--pm-on-fail=ignore', '--version'], {
-  cwd: root,
-  encoding: 'utf-8',
-  stdio: ['ignore', 'pipe', 'pipe'],
-}).trim();
-const activeNodeVersion = process.versions.node;
-const minimumPnpmVersion = { major: 11, minor: 0, patch: 0 };
-const currentPnpmVersion = parseSemver(activePnpmVersion);
-const minimumNodeVersion = { major: 26, minor: 0, patch: 0 };
-const currentNodeVersion = parseSemver(activeNodeVersion);
-
-assert(
-  compareSemver(currentPnpmVersion, minimumPnpmVersion) >= 0,
-  `Generated workspace requires pnpm >=11; active pnpm is ${activePnpmVersion}. Run mise install, then rerun pnpm from the activated shell.`,
-);
-assert(
-  compareSemver(currentNodeVersion, minimumNodeVersion) >= 0,
-  `Generated workspace requires Node >=26; active Node is ${activeNodeVersion}. Run mise install, then rerun node from the activated shell.`,
-);
-
-const agentInstructionPaths = ['AGENTS.md', 'CLAUDE.md'];
-const presentAgentInstructionPaths = agentInstructionPaths.filter(
-  relativePath => fs.existsSync(path.join(root, relativePath)),
-);
-assert(
-  presentAgentInstructionPaths.length === 0 ||
-    presentAgentInstructionPaths.length === agentInstructionPaths.length,
-  'Agent instruction files must be either fully enabled (AGENTS.md and CLAUDE.md) or fully disabled',
-);
-
-const requiredPaths = [
-  '.gitignore',
-  'package.json',
-  'pnpm-workspace.yaml',
-  `patches/@module-federation__modern-js-v3@${expectedModuleFederationVersion}.patch`,
-  `patches/@module-federation__bridge-react@${expectedModuleFederationVersion}.patch`,
-  `patches/@module-federation__runtime-core@${expectedModuleFederationVersion}.patch`,
-  'tsconfig.json',
-  'tsconfig.base.json',
-  'oxlint.config.ts',
-  'oxfmt.config.ts',
-  '.github/renovate.json',
-  '.github/workflows/ultramodern-workspace-gates.yml',
-  '.agents/agent-reference-repos.json',
-  'topology/reference-topology.json',
-  'topology/ownership.json',
-  'topology/local-overlays/development.json',
-  'scripts/assert-mf-types.mts',
-  'scripts/bootstrap-agent-skills.mts',
-  'scripts/check-ultramodern-api-boundaries.mts',
-  'scripts/check-ultramodern-i18n-boundaries.mts',
-  ...(hasBackendSurfaces ? ['scripts/generate-node-backend-federation.mts'] : []),
-  'scripts/generate-public-surface-assets.mts',
-  'scripts/generate-tanstack-routes.mts',
-  'scripts/proof-cloudflare-version.mts',
-  ...(hasDeliveryUnits ? ['scripts/proof-workerd-ssr.mts'] : []),
-  ...(hasBackendSurfaces ? ['scripts/proof-node-backend-federation.mts'] : []),
-  'scripts/setup-agent-reference-repos.mts',
-  'scripts/ultramodern-performance-readiness.config.mjs',
-  'scripts/ultramodern-performance-readiness.mts',
-  'scripts/ultramodern-typecheck.mts',
-  'scripts/validate-ultramodern-workspace.mts',
-  'scripts/verify-cloudflare-output.mts',
-  'apps/shell-super-app/package.json',
-  'apps/shell-super-app/tsconfig.json',
-  'apps/shell-super-app/tsconfig.mf-types.json',
-  'apps/shell-super-app/modern.config.ts',
-  'apps/shell-super-app/module-federation.config.ts',
-  'apps/shell-super-app/src/modern-app-env.d.ts',
-  'apps/shell-super-app/src/modern.runtime.ts',
-  'apps/shell-super-app/src/api/vertical-clients.ts',
-  'apps/shell-super-app/locales/en/translation.json',
-  `apps/shell-super-app/locales/en/${shellNamespace}.json`,
-  'apps/shell-super-app/locales/cs/translation.json',
-  `apps/shell-super-app/locales/cs/${shellNamespace}.json`,
-  'apps/shell-super-app/src/routes/index.css',
-  'apps/shell-super-app/src/routes/layout.tsx',
-  'apps/shell-super-app/src/routes/shell-frame.tsx',
-  'apps/shell-super-app/src/routes/ultramodern-route-head.tsx',
-  'apps/shell-super-app/src/routes/ultramodern-route-metadata.ts',
-  'apps/shell-super-app/src/routes/vertical-components.tsx',
-  requiredShellWorkerCompositionPath('apps/shell-super-app'),
-  'apps/shell-super-app/src/routes/[lang]/page.tsx',
-  ...shellRouteMetaPaths,
-  'packages/shared-contracts/package.json',
-  'packages/shared-contracts/src/index.ts',
-  'packages/shared-contracts/tsconfig.json',
-  'packages/shared-design-tokens/package.json',
-  'packages/shared-design-tokens/src/index.ts',
-  'packages/shared-design-tokens/src/tokens.css',
-  'packages/shared-design-tokens/tsconfig.json',
-];
-
-for (const vertical of fullStackVerticals) {
-  requiredPaths.push(...requiredMicroVerticalPaths(vertical));
-}
-
-if (tailwindEnabled) {
-  requiredPaths.push(
-    'apps/shell-super-app/tailwind.config.ts',
-    ...fullStackVerticals
-      .filter(vertical => vertical.emitsUi)
-      .flatMap(vertical => [`${vertical.path}/tailwind.config.ts`]),
-  );
-}
-
-requiredPaths.push(compactConfigPath);
-
-for (const vertical of fullStackVerticals) {
-  requiredMicroVerticalPaths(vertical).forEach(
-    assertRequiredVerticalFile(vertical),
-  );
-  // Reject profile-foreign surfaces planted into a unit (e.g. a browser MF
-  // config in a headless api-only unit, or an API contract in a UI-only unit).
-  forbiddenMicroVerticalPaths(vertical).forEach(
-    assertForbiddenVerticalFile(vertical),
-  );
-}
-for (const shell of expectedAdditionalShells) {
-  requiredPaths.push(
-    `${shell.path}/package.json`,
-    `${shell.path}/tsconfig.json`,
-    `${shell.path}/tsconfig.mf-types.json`,
-    `${shell.path}/modern.config.ts`,
-    `${shell.path}/module-federation.config.ts`,
-    `${shell.path}/src/modern-app-env.d.ts`,
-    `${shell.path}/src/modern.runtime.ts`,
-    `${shell.path}/src/api/vertical-clients.ts`,
-    `${shell.path}/locales/en/translation.json`,
-    `${shell.path}/locales/en/${shellNamespace}.json`,
-    `${shell.path}/locales/cs/translation.json`,
-    `${shell.path}/locales/cs/${shellNamespace}.json`,
-    `${shell.path}/src/routes/index.css`,
-    `${shell.path}/src/routes/layout.tsx`,
-    `${shell.path}/src/routes/shell-frame.tsx`,
-    `${shell.path}/src/routes/vertical-components.tsx`,
-    requiredShellWorkerCompositionPath(shell.path),
-    `${shell.path}/src/routes/ultramodern-route-head.tsx`,
-    `${shell.path}/src/routes/ultramodern-route-metadata.ts`,
-    `${shell.path}/src/routes/[lang]/page.tsx`,
-    ...shellRouteMetaPaths.map(relativePath =>
-      relativePath.replace(/^apps\/shell-super-app/u, shell.path),
-    ),
-  );
-  if (tailwindEnabled) {
-    requiredPaths.push(`${shell.path}/tailwind.config.ts`);
-  }
-}
-for (const requiredPath of requiredPaths) {
-  assertExists(requiredPath);
-}
-// Agent skills metadata may live under .agents/ (agents-standard layout) or
-// .codex/ (legacy scaffold default).
-assertAnyOf(['.agents/skills-lock.json', '.codex/skills-lock.json']);
-assertAnyOf([
-  '.agents/rstackjs-agent-skills-LICENSE',
-  '.codex/rstackjs-agent-skills-LICENSE',
-]);
-const readPnpmWorkspaceConfig = key =>
-  JSON.parse(
-    execFileSync('pnpm', ['config', 'get', key, '--json'], {
-      cwd: root,
-      encoding: 'utf-8',
-    }),
-  );
-const pnpmOverrides = readPnpmWorkspaceConfig('overrides');
-const pnpmPatches = readPnpmWorkspaceConfig('patchedDependencies');
-// pnpm reports patch paths realpathed against the workspace dir; on Windows
-// that can be the long-name form while `root` (process.cwd()) is the 8.3
-// short form, so compare realpaths instead of raw string equality.
-const canonicalFsPath = target => {
-  try {
-    return fs.realpathSync.native(target);
-  } catch {
-    return path.resolve(target);
-  }
-};
-const patchPathMatches = (key, expectedRelativePath) =>
-  typeof pnpmPatches[key] === 'string' &&
-  canonicalFsPath(pnpmPatches[key]) ===
-    canonicalFsPath(path.join(root, expectedRelativePath));
-assert(
-  pnpmOverrides['@effect/opentelemetry'] === expectedEffectVersion,
-  'pnpm-workspace.yaml must override @effect/opentelemetry to the generated Effect cohort',
-);
-assert(
-  pnpmOverrides.effect === expectedEffectVersion,
-  'pnpm-workspace.yaml must override effect to the generated Effect cohort',
-);
-assert(
-  pnpmOverrides['@effect/vitest'] === expectedEffectVitestVersion,
-  'pnpm-workspace.yaml must override @effect/vitest to the generated Effect test cohort',
-);
-assert(
-  pnpmOverrides['@tanstack/history'] === expectedTanstackHistoryVersion,
-  'pnpm-workspace.yaml must override @tanstack/history to the generated TanStack cohort',
-);
-assert(
-  patchPathMatches(
-    `@module-federation/modern-js-v3@${expectedModuleFederationVersion}`,
-    `patches/@module-federation__modern-js-v3@${expectedModuleFederationVersion}.patch`,
-  ),
-  'pnpm-workspace.yaml must patch the generated Module Federation Modern.js integration cohort',
-);
-assert(
-  patchPathMatches(
-    `@module-federation/bridge-react@${expectedModuleFederationVersion}`,
-    `patches/@module-federation__bridge-react@${expectedModuleFederationVersion}.patch`,
-  ),
-  'pnpm-workspace.yaml must patch the generated Module Federation React bridge cohort',
-);
-assert(
-  patchPathMatches(
-    `@module-federation/runtime-core@${expectedModuleFederationVersion}`,
-    `patches/@module-federation__runtime-core@${expectedModuleFederationVersion}.patch`,
-  ),
-  'pnpm-workspace.yaml must patch the generated Module Federation runtime-core cohort',
-);
-assertWorkspaceValidationContract(workspaceValidationContract);
-assertAdditionalShellContractShape();
-assertCompilerArchitecture();
-for (const oldRemotePath of oldRemotePaths) {
-  assertNotExists(oldRemotePath);
-}
-for (const retiredMetadataPath of retiredMetadataPaths) {
-  assertNotExists(retiredMetadataPath);
-}
-const rootPackage = readJson('package.json');
-const ultramodernConfig = readJson(compactConfigPath);
-const topology = readJson(
-  workspaceValidationContract.metadata.referenceTopology.path,
-);
-const ownership = readJson(workspaceValidationContract.metadata.ownership.path);
-const overlay = readJson(
-  workspaceValidationContract.metadata.developmentOverlay.path,
-);
-assertStructuredWorkspaceMetadata({
-  ultramodernConfig,
-  topology,
-  ownership,
-  overlay,
-});
-const bridgeConfig =
-  ultramodernConfig?.bridge?.enabled === true ? ultramodernConfig.bridge : undefined;
-const packageSource = createPackageSourceView(ultramodernConfig);
-const generatedContract = readGeneratedContractView(ultramodernConfig);
-const shellPackage = readJson('apps/shell-super-app/package.json');
-
-assertMicroVerticalContractGraph({
-  generatedContract,
-  topology,
-  ownership,
-  overlay,
-  shellPackage,
-});
-assertStructuredWorkspaceMetadataSemantics({
-  ultramodernConfig,
-  topology,
-  ownership,
-  overlay,
-});
-assertTsConfigReferenceGraph();
-
-assert(rootPackage.private === true, 'Root package must be private');
-assert(typeof rootPackage.packageManager === 'string', 'Root must declare packageManager');
-const packageManagerPnpmVersionMatch = /^pnpm@(\d+\.\d+\.\d+)$/u.exec(rootPackage.packageManager);
-assert(packageManagerPnpmVersionMatch, 'Root packageManager must pin pnpm with a semver version');
-const packageManagerPnpmVersion = packageManagerPnpmVersionMatch[1];
-assert(
-  compareSemver(parseSemver(packageManagerPnpmVersion), minimumPnpmVersion) >= 0,
-  'Root packageManager must use pnpm >=11',
-);
-assert(rootPackage.engines?.node === '>=26', 'Root must require Node >=26');
-assert(rootPackage.engines?.pnpm === '>=11', 'Root must require pnpm >=11');
-assert(generatedContract.node?.version === expectedNodeVersion, 'Generated contract must record the Node toolchain version');
-assert(generatedContract.node?.engineRange === '>=26', 'Generated contract must record the Node engine range');
-const activeMiseTools = JSON.parse(
-  execFileSync('mise', ['ls', '--current', '--json'], {
-    cwd: root,
-    encoding: 'utf-8',
-  }),
-);
-assert(
-  activeMiseTools.node?.some(tool => tool.requested_version === expectedNodeVersion),
-  'mise must activate the generated Node version',
-);
-assert(
-  activeMiseTools.pnpm?.some(
-    tool => tool.requested_version === packageManagerPnpmVersion,
-  ),
-  'mise must activate the generated pnpm version',
-);
-assertExists('.github/workflows/ultramodern-workspace-gates.yml');
-assert(rootPackage.modernjs?.preset === 'presetUltramodern', 'Root must declare presetUltramodern');
-assert(
-  rootPackage.modernjs?.packageSource?.config === './.modernjs/ultramodern.json',
-  'Root must point at compact UltraModern config',
-);
-assert(rootPackage.modernjs?.packageSource?.strategy === packageSource.strategy, 'Root package source strategy must match metadata');
-assert(packageSource.strategy === 'workspace' || packageSource.strategy === 'install', 'Package source strategy must be workspace or install');
-assert(packageSource.strategy === 'install' || packageSource.modernPackages?.specifier === 'workspace:*', 'Workspace package source must be explicitly backed by workspace:*');
-assertModernPackageCohort();
-const assertAdditionalShellCohort = () => {
-  const primaryShellConfig = findById(
-    ultramodernConfig.topology?.apps,
-    'shell-super-app',
-  );
-  const overlayPorts = overlay.ports ?? {};
-  const configuredPorts = [
-    ...Object.entries(overlayPorts).map(([id, port]) => ({ id, port })),
-    ...(!Object.hasOwn(overlayPorts, 'shell-super-app')
-      ? [{ id: 'shell-super-app', port: primaryShellConfig?.port }]
-      : []),
-    ...expectedAdditionalShells.map(shell => ({
-      id: shell.id,
-      port: shell.port,
-    })),
-  ];
-  const portsByValue = new Map();
-  for (const { id, port } of configuredPorts) {
-    assert(
-      typeof port === 'number' && Number.isFinite(port),
-      `Configured development port for ${id} must be finite`,
-    );
-    const previous = portsByValue.get(port);
-    assert(
-      previous === undefined,
-      `Duplicate configured development port ${port} for ${previous} and ${id}`,
-    );
-    portsByValue.set(port, id);
-  }
-
-  if (expectedAdditionalShellIds.length === 0) {
-    assert(
-      ultramodernConfig.shells === undefined,
-      'Single-shell workspace must not declare config.shells',
-    );
-    return;
-  }
-
-  assertSameIdCohort(
-    ultramodernConfig.shells,
-    expectedAdditionalShellIds,
-    `${compactConfigPath} shells`,
-    'restore every configured additional shell',
-  );
-  const configuredShellRecords = ultramodernConfig.shells;
-  const configuredShellById = new Map(
-    configuredShellRecords.map(shell => [shell.id, shell]),
-  );
-  assertUniqueStrings(
-    [
-      primaryShellConfig?.moduleFederation?.name,
-      ...expectedAdditionalShells.map(shell => shell.mfName),
-    ],
-    'configured shell Module Federation identities',
-  );
-  assertUniqueStrings(
-    expectedAdditionalShells.map(
-      shell => shell.deliveryUnit?.buildMarker,
-    ),
-    'configured shell build markers',
-  );
-
-  for (const shell of expectedAdditionalShells) {
-    const configShell = configuredShellById.get(shell.id);
-    assertObject(
-      configShell,
-      `${compactConfigPath} shells.${shell.id}`,
-      'restore the generated additional-shell config record',
-    );
-    assertSameJson(
-      {
-        id: configShell.id,
-        name: configShell.name,
-        kind: configShell.kind,
-        package: configShell.package,
-        path: configShell.path,
-        port: configShell.port,
-        portEnv: configShell.portEnv,
-        mfName: configShell.mfName,
-        verticalRefs: configShell.verticalRefs,
-        owner: configShell.owner,
-        deliveryUnit: configShell.deliveryUnit,
-        moduleFederation: configShell.moduleFederation,
-      },
-      {
-        id: shell.id,
-        name: shell.id.replace(/^shell-/u, ''),
-        kind: 'shell',
-        package: shell.packageName,
-        path: shell.path,
-        port: shell.port,
-        portEnv: shell.portEnv,
-        mfName: shell.mfName,
-        verticalRefs: shell.verticalRefs,
-        owner: shell.owner,
-        deliveryUnit: shell.deliveryUnit,
-        moduleFederation: shell.moduleFederation,
-      },
-      `${compactConfigPath} shells.${shell.id}`,
-      'restore the complete additional-shell config record',
-    );
-    assert(
-      !Object.hasOwn(overlay.ports ?? {}, shell.id),
-      `${shell.id} port must stay in config.shells, not the development overlay`,
-    );
-    const owner = configShell.owner;
-    assertObject(
-      owner,
-      `${compactConfigPath} shells.${shell.id}.owner`,
-      'record exactly one owner for every configured Delivery Unit',
-    );
-    assert(
-      ['team', 'agent', 'agent-team'].includes(owner.kind) &&
-        typeof owner.id === 'string' &&
-        owner.id.length > 0,
-      `${compactConfigPath} shells.${shell.id}.owner must identify one accountable owner`,
-    );
-    assertSameJson(
-      owner,
-      shell.owner,
-      `${compactConfigPath} shells.${shell.id}.owner`,
-      'restore the generated additional-shell owner attribution',
-    );
-    assertObject(
-      configShell.deliveryUnit,
-      `${compactConfigPath} shells.${shell.id}.deliveryUnit`,
-      'restore the generated additional-shell Delivery Unit identity',
-    );
-    assert(
-      typeof configShell.deliveryUnit.unitId === 'string' &&
-        configShell.deliveryUnit.unitId.length > 0 &&
-        typeof configShell.deliveryUnit.buildMarker === 'string' &&
-        configShell.deliveryUnit.buildMarker.length > 0,
-      `${compactConfigPath} shells.${shell.id}.deliveryUnit must carry unitId and buildMarker`,
-    );
-
-    const packagePath = `${shell.path}/package.json`;
-    const packageJson = readJson(packagePath);
-    assert(packageJson.name === shell.packageName, `${shell.id} package name is incorrect`);
-    assert(packageJson.modernjs?.appId === shell.id, `${shell.id} package modernjs.appId is incorrect`);
-    assert(packageJson.modernjs?.role === 'shell', `${shell.id} package modernjs.role must be shell`);
-    assert(packageJson.scripts?.['cloudflare:deploy'] === 'cross-env ULTRAMODERN_CLOUDFLARE_REQUIRE_PUBLIC_URLS=true pnpm run cloudflare:build && wrangler deploy --config .output/wrangler.json', `${shell.id} must expose a portable cloudflare:deploy`);
-    assert(packageJson.devDependencies?.['cross-env'] === expectedCrossEnvVersion, `${shell.id} cross-env dependency must match the portable generated-script cohort`);
-    assertPortableGeneratedEnvironmentScripts(packageJson, shell.id);
-
-    const buildArtifact = readJson(`${shell.path}/shared/ultramodern-build.json`);
-    assert(buildArtifact.deliveryUnit?.appId === shell.id, `${shell.id} build artifact appId is incorrect`);
-    assert(buildArtifact.deliveryUnit?.buildMarker === shell.deliveryUnit?.buildMarker, `${shell.id} build marker is not participating in the build artifact`);
-    assertSameJson(
-      deliveryUnitBlock(configShell.deliveryUnit),
-      deliveryUnitBlock(shell.deliveryUnit),
-      `${compactConfigPath} shells.${shell.id}.deliveryUnit`,
-      deliveryUnitIdentityFixArea,
-    );
-    assertSameJson(
-      deliveryUnitBlock(buildArtifact.deliveryUnit),
-      deliveryUnitBlock(shell.deliveryUnit),
-      `${shell.path}/shared/ultramodern-build.json deliveryUnit`,
-      deliveryUnitIdentityFixArea,
-    );
-    assert(
-      shell.degradedState?.appId === shell.id &&
-        shell.degradedState?.status === 'degraded',
-      `${shell.id} degraded-state contract must identify its own shell`,
-    );
-
-    if ((shell.verticalRefs ?? []).length > 0) {
-      assert(
-        shell.degradedState.required === true,
-        `${shell.id} degraded-state contract must be required for remote consumption`,
-      );
-    }
-  }
-
-
-  // Zerops artifacts exist whenever the workspace has delivery units at all
-  // (ui-only and horizontal-remote units deploy too); a shell-only workspace
-  // must not carry one.
-  if (!hasDeliveryUnits) {
-    assertNotExists('zerops.yaml');
-  } else {
-  assertExists('zerops.yaml');
-  const zeropsYaml = readText('zerops.yaml');
-  assert(
-    zeropsYaml.includes(`setup: ${quoteYamlString('shell-super-app')}`),
-    'shell-super-app must have a Zerops service',
-  );
-  for (const shell of expectedAdditionalShells) {
-    assert(zeropsYaml.includes(`setup: ${quoteYamlString(shell.id)}`), `${shell.id} must have a Zerops service`);
-    assert(zeropsYaml.includes(`start: cd ${quoteShellValue(`.zerops/runtime/${shell.id}`)} && npm run serve`), `${shell.id} Zerops service start command is missing`);
-    assert(zeropsYaml.includes(`        ${shell.portEnv}: ${quoteYamlString(String(shell.port))}`), `${shell.id} Zerops service port environment is missing`);
-  }
-  }
-};
-assertAdditionalShellCohort();
-assert(
-  rootPackage.devDependencies?.['@modern-js/ultramodern-create'] ===
-    expectedModernPackageSpecifier('@modern-js/ultramodern-create'),
-  'Root must depend on @modern-js/ultramodern-create through package source metadata',
-);
-assert(
-  rootPackage.devDependencies?.['@modern-js/code-tools'] ===
-    expectedModernPackageSpecifier('@modern-js/code-tools'),
-  'Root must depend on @modern-js/code-tools through package source metadata',
-);
-assert(
-  rootPackage.devDependencies?.['@modern-js/plugin-bff'] ===
-    expectedModernPackageSpecifier('@modern-js/plugin-bff'),
-  'Root must depend on @modern-js/plugin-bff for Node backend federation proof',
-);
-assert(rootPackage.devDependencies?.['cross-env'] === expectedCrossEnvVersion, 'Root cross-env dependency must match the portable generated-script cohort');
-assert(rootPackage.scripts?.format === 'oxfmt .', 'Root format script must rely on the cross-platform Oxfmt ignore configuration');
-assert(rootPackage.scripts?.['format:check'] === 'oxfmt --check .', 'Root format:check script must rely on the cross-platform Oxfmt ignore configuration');
-if (packageSource.strategy === 'install') {
-  const installSpecifier = packageSource.modernPackages?.specifier;
-  assert(
-    typeof installSpecifier === 'string' &&
-      /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(installSpecifier) &&
-      installSpecifier.includes('ultramodern'),
-    'Install package source must use a semver UltraModern published cohort',
-  );
-  const modernAliases = packageSource.modernPackages?.aliases ?? {};
-  if (Object.keys(modernAliases).length > 0) {
-    for (const modernPackageName of [
-      '@modern-js/app-tools',
-      '@modern-js/code-tools',
-      '@modern-js/plugin-bff',
-      '@modern-js/plugin-i18n',
-      '@modern-js/plugin-tanstack',
-      '@modern-js/runtime',
-      '@modern-js/ultramodern-create',
-    ]) {
-      assert(
-        /^@[^/]+\/.+/.test(modernAliases[modernPackageName] ?? ''),
-        `Install package source alias for ${modernPackageName} must be a scoped npm package`,
-      );
-    }
-  }
-}
-assert(packageSource.generatedWorkspacePackages?.specifier === 'workspace:*', 'Generated workspace packages must keep workspace:* links');
-assert(
-  rootPackage.scripts?.build === expectedBuildScript,
-  'Root build script must build verticals before shell',
-);
-assert(rootPackage.scripts?.['cloudflare:build'] === expectedCloudflareBuildScript, 'Root cloudflare:build script is incorrect');
-assert(!('ultramodern:check' in (rootPackage.scripts ?? {})), 'Root must not expose ultramodern:check');
-if (bridgeConfig) {
-  assert(
-    rootPackage.scripts?.typecheck ===
-      'pnpm -r --filter "./apps/*" --filter "./verticals/*" --filter "./packages/*" run typecheck',
-    'Bridge root typecheck must check generated package boundaries without building parent implementation sources',
-  );
-  assert(Array.isArray(bridgeConfig.workspacePackages), 'Bridge config must record workspace package patterns');
-  for (const workspacePackage of bridgeConfig.workspacePackages) {
-    assert(
-      rootPackage.workspaces?.includes(workspacePackage.pattern),
-      `Root workspaces must include bridge package pattern ${workspacePackage.pattern}`,
-    );
-    assert(
-      readPnpmWorkspaceConfig('packages').includes(workspacePackage.pattern),
-      `pnpm-workspace.yaml must include bridge package pattern ${workspacePackage.pattern}`,
-    );
-  }
-  for (const gate of bridgeConfig.gates ?? []) {
-    const expectedGateScript = `${gate.cwd ? `cd ${gate.cwd} && ` : ''}${gate.command}`;
-    assert(
-      rootPackage.scripts?.[`bridge:${gate.name}`] === expectedGateScript,
-      `Bridge gate script bridge:${gate.name} is incorrect`,
-    );
-  }
-  assert(rootPackage.scripts?.['bridge:check'], 'Bridge workspaces must expose bridge:check');
-} else {
-  assert(rootPackage.scripts?.typecheck === 'node ./scripts/ultramodern-typecheck.mts --project tsconfig.json', 'Root typecheck must run TS-Go across the root project reference graph');
-}
-assert(rootPackage.scripts?.['contract:check'] === 'node ./scripts/validate-ultramodern-workspace.mts', 'Root must expose contract:check');
-assert(rootPackage.scripts?.['api:check'] === 'node ./scripts/check-ultramodern-api-boundaries.mts', 'Root must expose api:check');
-assert(rootPackage.scripts?.['i18n:boundaries'] === 'node ./scripts/check-ultramodern-i18n-boundaries.mts', 'Root must expose i18n:boundaries');
-assert(rootPackage.scripts?.['performance:readiness'] === 'node ./scripts/ultramodern-performance-readiness.mts', 'Root must expose default-on performance readiness diagnostics');
-if (hasBackendSurfaces) {
-  assert(rootPackage.scripts?.['node:backend-federation:generate'] === 'node ./scripts/generate-node-backend-federation.mts', 'Root must expose local Node backend federation artifact generation');
-  assert(
-    rootPackage.scripts?.['node:proof'] ===
-      'node ./scripts/proof-node-backend-federation.mts',
-    'Root must expose read-only node:proof for already-built backend federation Effect modules',
-  );
-} else {
-  assert(rootPackage.scripts?.['node:backend-federation:generate'] === undefined, 'Root must not expose backend federation generation without an API surface');
-  assert(rootPackage.scripts?.['node:proof'] === undefined, 'Root must not expose node:proof without an API surface');
-}
-if (hasDeliveryUnits) {
-  assert(rootPackage.scripts?.['zerops:materialize'] === 'node ./scripts/materialize-zerops-runtime.mjs', 'Root must expose Zerops runtime materialization script');
-  assert(rootPackage.scripts?.['cloudflare:ssr-proof'] === 'node ./scripts/proof-workerd-ssr.mts', 'Root must expose workerd distributed SSR composition proof');
-  assert(rootPackage.scripts?.['cloudflare:build']?.endsWith('&& pnpm cloudflare:ssr-proof'), 'Root Cloudflare build must finish with workerd distributed SSR composition proof');
-} else {
-  assert(rootPackage.scripts?.['zerops:materialize'] === undefined, 'Root must not expose Zerops materialization in a shell-only workspace');
-  assert(rootPackage.scripts?.['cloudflare:ssr-proof'] === undefined, 'Root must not expose workerd SSR proof in a shell-only workspace');
-}
-assertNotExists('scripts/generate-node-backend-federation.mjs');
-assertNotExists('scripts/proof-node-backend-federation.mjs');
-assertNotExists('scripts/verify-cloudflare-output.mjs');
-assertNotExists('scripts/generate-tanstack-routes.mjs');
-assert(
-  typeof rootPackage.scripts?.check === 'string',
-  'Root check must expose the generated quality gate',
-);
-if (hasDeliveryUnits) {
-  const zeropsYaml = readText('zerops.yaml');
-  assert(zeropsYaml.includes('zerops:'), 'Zerops manifest must include zerops services');
-  assert(zeropsYaml.includes(`setup: ${quoteYamlString('shell-super-app')}`), 'Zerops manifest must include shell service');
-  assert(zeropsYaml.includes(`base: ${quoteYamlString('nodejs@26')}`), 'Zerops manifest must use generated Node runtime major');
-  assert(zeropsYaml.includes('deployFiles:'), 'Zerops manifest must deploy package-pruned runtime directories');
-  assert(
-    zeropsYaml.includes(`start: cd ${quoteShellValue('.zerops/runtime/shell-super-app')} && npm run serve`),
-    'Zerops shell service must start from materialized runtime package',
-  );
-  assert(
-    zeropsYaml.includes('SHELL_SUPER_APP_PORT:') &&
-      zeropsYaml.includes('ULTRAMODERN_ZEROPS_SERVICE:'),
-    'Zerops manifest must expose service identity and ports',
-  );
-  for (const vertical of fullStackVerticals) {
-    assert(zeropsYaml.includes(`setup: ${quoteYamlString(vertical.id)}`), `${vertical.id} must have a Zerops service`);
-    assert(
-      zeropsYaml.includes(`~/.local/bin/mise exec -- pnpm run zerops:materialize -- --app ${quoteShellValue(vertical.id)} --package ${quoteShellValue(vertical.packageName)} --package-dir ${quoteShellValue(vertical.path)}`),
-      `${vertical.id} Zerops service must materialize its runtime package`,
-    );
-    // Only REST-backed (or headless-less UI) units expose an HTTP readiness
-    // probe; the RPC surface has no REST readiness endpoint (G7a).
-    if (!vertical.emitsApi || vertical.apiProtocol === 'rest') {
-      const zeropsReadinessPath = vertical.emitsApi
-        ? `${vertical.apiPrefix}/${vertical.stem}/readiness`
-        : '/';
-      assert(
-        zeropsYaml.includes(`path: ${quoteYamlString(zeropsReadinessPath)}`),
-        `${vertical.id} BFF readiness path must use generated API prefix`,
-      );
-    }
-  }
-}
-assert(rootPackage.scripts?.['mf:types'] === 'node ./scripts/assert-mf-types.mts', 'Root must expose mf:types');
-assert(rootPackage.scripts?.['cloudflare:deploy'] === expectedCloudflareDeployScript, 'Root must expose cloudflare:deploy');
-assert(rootPackage.scripts?.['cloudflare:proof'] === 'node ./scripts/proof-cloudflare-version.mts --out .codex/reports/cloudflare-version-proof/public-url-proof.json', 'Root must expose cloudflare:proof');
-assert(rootPackage.scripts?.['migrate:strict-effect'] === 'node ./scripts/migrate-strict-effect.mts', 'Root must expose migrate:strict-effect');
-assert(rootPackage.scripts?.['skills:install'] === 'node ./scripts/bootstrap-agent-skills.mts', 'Root must expose skills:install');
-assert(rootPackage.scripts?.['skills:check'] === 'node ./scripts/bootstrap-agent-skills.mts --check', 'Root must expose skills:check');
-assert(rootPackage.scripts?.postinstall === 'node ./scripts/bootstrap-agent-skills.mts --postinstall && oxfmt .', 'Root postinstall must run the default-on Codex skills bootstrap, format installed skills through the cross-platform ignore configuration, and leave reference repository installs explicit');
-assert(rootPackage.scripts?.['agents:refs:install'] === 'node ./scripts/setup-agent-reference-repos.mts', 'Root must expose agents:refs:install as the explicit reference repo installer');
-
-const expectedAppIds = ['shell-super-app', ...fullStackVerticals.map(vertical => vertical.id)];
-const expectedCloudflareCompatibilityFlags = ['nodejs_compat', 'global_fetch_strictly_public'];
-assert(
-  sameJson(generatedContract.apps?.map(app => app.id), expectedAppIds),
-  'Generated contract must contain shell plus the full-stack verticals',
-);
-assert(generatedContract.cssFederation?.sharedDesignTokens?.owner?.id === 'shared-design-tokens', 'CSS federation must declare shared design token ownership');
-assert(generatedContract.cssFederation?.sharedDesignTokens?.role === 'shared-design-tokens', 'CSS federation must mark shared-design-tokens as token owner');
-assert(generatedContract.cssFederation?.sharedDesignTokens?.rootSelector === ':root', 'Shared design tokens must declare their root selector');
-assert(generatedContract.cssFederation?.sharedDesignTokens?.classPrefix === '--um-', 'Shared design tokens must declare their CSS custom property prefix');
-assert(generatedContract.cssFederation?.sharedDesignTokens?.layers?.owned?.includes('ultramodern-shared-tokens'), 'Shared design tokens must own the shared token CSS layer');
-assert(generatedContract.cssFederation?.sharedDesignTokens?.entrypoints?.css?.includes('packages/shared-design-tokens/src/tokens.css'), 'Shared design tokens must declare their CSS entrypoint');
-assert(generatedContract.cssFederation?.sharedDesignTokens?.assets?.exports?.includes('./tokens.css'), 'Shared design tokens must export their CSS asset');
-assert(generatedContract.cssFederation?.sharedDesignTokens?.dedupe?.duplicateBaseStylesAllowed === false, 'Shared design token CSS must be deduplicated');
-assert(generatedContract.cssFederation?.sharedDesignTokens?.ssr?.firstPaintRequired === true, 'Shared design token CSS must be required for SSR first paint');
-const expectedPerformanceReadinessSignals = [
-  'bfcache',
-  'core-web-vitals-rum',
-  'duplicate-prefetch-warmup',
-  'cache-policy-sanity',
-  'save-data-behavior',
-  'cloudflare-ssr-cache-hints',
-];
-assert(generatedContract.performanceReadiness?.default === 'enabled', 'Performance readiness diagnostics must be default-on in the generated contract');
-assert(generatedContract.performanceReadiness?.mode === 'diagnostic', 'Performance readiness must remain diagnostic-only');
-assert(generatedContract.performanceReadiness?.report?.script === 'scripts/ultramodern-performance-readiness.mts', 'Performance readiness contract must point at the generated script');
-assert(generatedContract.performanceReadiness?.report?.deterministic === true, 'Performance readiness reports must be deterministic');
-assert(generatedContract.performanceReadiness?.optOut?.env === 'ULTRAMODERN_PERFORMANCE_READINESS_DIAGNOSTICS=false', 'Performance readiness env opt-out is incorrect');
-assert(sameJson(generatedContract.performanceReadiness?.signals?.map(signal => signal.id), expectedPerformanceReadinessSignals), 'Performance readiness signal ids are incorrect');
-
-const expectedZephyrDependencies = Object.fromEntries(
-  expectedPrimaryShellVerticalIds.map(verticalId => {
-    const vertical = fullStackVerticals.find(
-      candidate => candidate.id === verticalId,
-    );
-    assert(vertical, `Missing primary-shell vertical ${verticalId}`);
-    return [
-      vertical.zephyrAlias,
-      `${vertical.packageName}@workspace:*`,
-    ];
-  }),
-);
-assert(
-  sameJson(shellPackage['zephyr:dependencies'], expectedZephyrDependencies),
-  'Shell Zephyr dependencies must reference every primary-shell vertical package',
-);
-assert(shellPackage.devDependencies?.['@modern-js/app-tools'] === expectedModernPackageSpecifier('@modern-js/app-tools'), 'Shell app-tools dependency must match package source metadata');
-assert(shellPackage.dependencies?.['@modern-js/plugin-bff'] === expectedModernPackageSpecifier('@modern-js/plugin-bff'), 'Shell plugin-bff dependency must match package source metadata');
-assert(shellPackage.dependencies?.['@modern-js/plugin-i18n'] === expectedModernPackageSpecifier('@modern-js/plugin-i18n'), 'Shell plugin-i18n dependency must match package source metadata');
-assert(shellPackage.dependencies?.['@modern-js/plugin-tanstack'] === expectedModernPackageSpecifier('@modern-js/plugin-tanstack'), 'Shell plugin-tanstack dependency must match package source metadata');
-assert(shellPackage.dependencies?.['@modern-js/runtime'] === expectedModernPackageSpecifier('@modern-js/runtime'), 'Shell runtime dependency must match package source metadata');
-assert(shellPackage.scripts?.['cloudflare:deploy'] === 'cross-env ULTRAMODERN_CLOUDFLARE_REQUIRE_PUBLIC_URLS=true pnpm run cloudflare:build && wrangler deploy --config .output/wrangler.json', 'Shell must expose a portable cloudflare:deploy');
-assert(shellPackage.devDependencies?.['cross-env'] === expectedCrossEnvVersion, 'Shell cross-env dependency must match the portable generated-script cohort');
-assertPortableGeneratedEnvironmentScripts(shellPackage, 'Shell');
-const shellContract = generatedContract.apps?.find(app => app.id === 'shell-super-app');
-assert(shellContract?.deploy?.cloudflare?.workerName === expectedWorkerName('shell-super-app'), 'Shell Cloudflare workerName is incorrect');
-assert(shellContract?.deploy?.cloudflare?.publicUrlEnv === 'ULTRAMODERN_PUBLIC_URL_SHELL_SUPER_APP', 'Shell Cloudflare public URL env is incorrect');
-assert(shellContract?.deploy?.cloudflare?.compatibilityDate === expectedCloudflareCompatibilityDate, 'Shell Cloudflare compatibilityDate is incorrect');
-assert(sameJson(shellContract?.deploy?.cloudflare?.compatibilityFlags, expectedCloudflareCompatibilityFlags), 'Shell Cloudflare compatibility flags are incorrect');
-assert(sameJson(shellContract?.deploy?.cloudflare?.security, expectedCloudflareSecurity), 'Shell Cloudflare security contract is incorrect');
-assertCloudflareQualityGates('shell-super-app', shellContract?.deploy?.cloudflare?.qualityGates);
-assert(shellContract?.deploy?.worker?.compatibilityDate === expectedCloudflareCompatibilityDate, 'Shell worker compatibilityDate is incorrect');
-assert(shellContract?.deploy?.worker?.name === expectedWorkerName('shell-super-app'), 'Shell worker name is incorrect');
-assert(shellContract?.config?.dev?.assetPrefix === '/', 'Shell dev asset prefix must stay origin-relative');
-assert(shellContract?.config?.output?.assetPrefix?.default === '/', 'Shell asset prefix must default to origin-relative paths');
-assert(sameJson(shellContract?.config?.output?.assetPrefix?.envFallbackOrder, ['MODERN_ASSET_PREFIX', 'ULTRAMODERN_ASSET_PREFIX']), 'Shell asset prefix env fallback order is incorrect');
-assert(shellContract?.config?.output?.disableTsChecker === false, 'Shell must keep the framework TypeScript checker enabled');
-assert(shellContract?.config?.performance?.readinessDiagnostics?.default === 'enabled', 'Shell performance readiness diagnostics must be default-on');
-assert(shellContract?.config?.performance?.readinessDiagnostics?.failOn === 'framework-invariant', 'Shell performance readiness diagnostics must only fail framework invariants by default');
-assert(shellContract?.config?.performance?.readinessDiagnostics?.optOut?.env === 'ULTRAMODERN_PERFORMANCE_READINESS_DIAGNOSTICS=false', 'Shell performance readiness env opt-out is incorrect');
-assert(sameJson(shellContract?.config?.source?.siteUrl?.envFallbackOrder, ['MODERN_PUBLIC_SITE_URL', 'ULTRAMODERN_PUBLIC_URL_SHELL_SUPER_APP', 'ULTRAMODERN_CLOUDFLARE_WORKERS_DEV_SUBDOMAIN', 'SHELL_SUPER_APP_PORT']), 'Shell site URL env fallback order is incorrect');
-assert(shellContract?.config?.rspack?.output?.uniqueName === 'shellSuperApp', 'Shell Rspack uniqueName is incorrect');
-assert(shellContract?.config?.rspack?.output?.chunkLoadingGlobal === expectedChunkLoadingGlobal('shellSuperApp'), 'Shell Rspack chunkLoadingGlobal is incorrect');
-assert(shellContract?.moduleFederation?.dts?.compilerInstance === 'effect-tsgo', 'Shell must keep mandatory DTS compiler');
-assert(shellContract?.moduleFederation?.dts?.tsConfigPath === './tsconfig.mf-types.json', 'Shell must keep dedicated Module Federation DTS tsconfig');
-assert(topology.shell?.cloudflare?.workerName === expectedWorkerName('shell-super-app'), 'Shell topology Cloudflare workerName is incorrect');
-assert(shellContract?.styling?.federation?.owner?.id === 'shell-super-app', 'Shell CSS federation owner is missing');
-assert(shellContract?.styling?.federation?.role === 'shell-base-overlay', 'Shell must own base and overlay CSS');
-assert(shellContract?.styling?.federation?.rootSelector === '[data-app-id="shell-super-app"]', 'Shell CSS root selector is incorrect');
-assert(shellContract?.styling?.federation?.classPrefix === 'shell:', 'Shell CSS class prefix is incorrect');
-assert(shellContract?.styling?.federation?.layers?.owned?.includes('ultramodern-shell-base'), 'Shell must own the base CSS layer');
-assert(shellContract?.styling?.federation?.layers?.owned?.includes('ultramodern-shell-overlay'), 'Shell must own the overlay CSS layer');
-assert(shellContract?.styling?.federation?.entrypoints?.css?.includes('src/routes/index.css'), 'Shell CSS entrypoint is missing');
-assert(shellContract?.styling?.federation?.assets?.shared?.some(asset => asset.endsWith('/shared-design-tokens/tokens.css')), 'Shell must import the shared design token CSS asset');
-assert(shellContract?.styling?.federation?.dedupe?.duplicateBaseStylesAllowed === false, 'Shell CSS contract must forbid duplicated base styles');
-assert(shellContract?.styling?.federation?.ssr?.firstPaintRequired === true, 'Shell CSS must be required for SSR first paint');
-assert(shellContract?.routes?.privateByDefault === true, 'Shell routes must be private by default');
-assert(shellContract?.routes?.metadataAuthoring === 'colocated-route-meta', 'Shell route metadata authoring mode is incorrect');
-assert(shellContract?.routes?.generatedManifest === true, 'Shell route metadata manifest must be generated');
-assert(shellContract?.routes?.publicnessDefault === 'private-app-screen', 'Shell route publicness default is incorrect');
-assert(sameJson(shellContract?.routes?.publicRoutes ?? [], []), 'Shell must not expose generated public routes by default');
-assertPublicHeadContract('shell-super-app', shellContract?.routes?.publicHead);
-assertPublicSurfaceContract('shell-super-app', shellContract?.routes?.publicSurface);
-assert(
-  (shellContract?.routes?.owned ?? []).every(route => route.public === false && route.indexable === false && route.publicSurface === 'private-app-screen' && typeof route.descriptionKey === 'string'),
-  'Shell owned routes must be non-indexable private app screens by default and include description keys',
-);
-assertPublicSurfaceAssets('apps/shell-super-app', shellContract?.routes?.publicRoutes ?? []);
-assert(
-  topology.shell?.verticalRefs?.join(',') === expectedPrimaryShellVerticalIds.join(','),
-  'Topology shell verticalRefs must match generated verticals',
-);
-assert(topology.verticals?.length === fullStackVerticals.length, 'Topology must contain only generated verticals');
-assert(!('remotes' in topology), 'Topology must not expose legacy remotes; use verticals');
-assert(!('effectServices' in topology), 'Default APIs must be vertical-owned, not effectServices');
-
-for (const vertical of fullStackVerticals) {
-  const packageJson = readJson(`${vertical.path}/package.json`);
-  const ultramodernBuildArtifact = readJson(`${vertical.path}/shared/ultramodern-build.json`);
-  if (vertical.deliveryUnit) {
-    const topologyEntry = findById(topology.verticals, vertical.id);
-    const expectedDeliveryUnit = deliveryUnitBlock(
-      expectedDeliveryUnitFor(vertical, topologyEntry),
-    );
-    const buildLabel = `${vertical.path}/shared/ultramodern-build.json deliveryUnit`;
-    const buildIdentity = ultramodernBuildArtifact.deliveryUnit ?? {};
-    assertSelfCheck(
-      buildIdentity.buildMarker === expectedDeliveryUnit.buildMarker,
-      buildLabel,
-      `Expected build "${expectedDeliveryUnit.buildMarker}", found ${formatJson(buildIdentity.buildMarker)}`,
-      deliveryUnitIdentityFixArea,
-    );
-    assertSelfCheck(
-      buildIdentity.unitId === expectedDeliveryUnit.unitId,
-      buildLabel,
-      `Expected unitId "${expectedDeliveryUnit.unitId}", found ${formatJson(buildIdentity.unitId)}`,
-      deliveryUnitIdentityFixArea,
-    );
-    assertSelfCheck(
-      buildIdentity.packageName === expectedDeliveryUnit.packageName,
-      buildLabel,
-      `Expected packageName "${expectedDeliveryUnit.packageName}", found ${formatJson(buildIdentity.packageName)}`,
-      deliveryUnitIdentityFixArea,
-    );
-    assertSelfCheck(
-      buildIdentity.version === expectedDeliveryUnit.version,
-      buildLabel,
-      `Expected version "${expectedDeliveryUnit.version}", found ${formatJson(buildIdentity.version)}`,
-      deliveryUnitIdentityFixArea,
-    );
-  }
-  assert(packageJson.name === vertical.packageName, `${vertical.id} package name is incorrect`);
-  assert(packageJson.scripts?.['cloudflare:deploy'] === 'cross-env ULTRAMODERN_CLOUDFLARE_REQUIRE_PUBLIC_URLS=true pnpm run cloudflare:build && wrangler deploy --config .output/wrangler.json', `${vertical.id} must expose a portable cloudflare:deploy`);
-  assert(packageJson.devDependencies?.['cross-env'] === expectedCrossEnvVersion, `${vertical.id} cross-env dependency must match the portable generated-script cohort`);
-  assertPortableGeneratedEnvironmentScripts(packageJson, vertical.id);
-  assert(packageJson.devDependencies?.['@modern-js/app-tools'] === expectedModernPackageSpecifier('@modern-js/app-tools'), `${vertical.id} app-tools dependency must match package source metadata`);
-  if (vertical.emitsApi) {
-    assert(packageJson.dependencies?.['@modern-js/plugin-bff'] === expectedModernPackageSpecifier('@modern-js/plugin-bff'), `${vertical.id} plugin-bff dependency must match package source metadata`);
-  }
-  assert(packageJson.dependencies?.['@modern-js/plugin-i18n'] === expectedModernPackageSpecifier('@modern-js/plugin-i18n'), `${vertical.id} plugin-i18n dependency must match package source metadata`);
-  assert(packageJson.dependencies?.['@modern-js/plugin-tanstack'] === expectedModernPackageSpecifier('@modern-js/plugin-tanstack'), `${vertical.id} plugin-tanstack dependency must match package source metadata`);
-  assert(packageJson.dependencies?.['@modern-js/runtime'] === expectedModernPackageSpecifier('@modern-js/runtime'), `${vertical.id} runtime dependency must match package source metadata`);
-  if (vertical.emitsApi) {
-    assert(packageJson.exports?.[vertical.apiClientExport] === `./${vertical.apiClientPath}`, `${vertical.id} must export its API client`);
-    assert(packageJson.exports?.['./api'] === `./${vertical.apiContractPath}`, `${vertical.id} must export its API contract`);
-    // API protocol exclusivity (G7a): an RPC unit ships only the RPC contract
-    // and `${stem}-rpc-client`; a REST unit ships only the REST contract and
-    // `${stem}-client`. Neither may carry the other protocol's surface.
-    if (vertical.apiProtocol === 'rpc') {
-      assert(!fs.existsSync(path.join(root, `${vertical.path}/src/api/${vertical.stem}-client.ts`)), `${vertical.id} RPC unit must not emit the REST API client`);
-      assert(!fs.existsSync(path.join(root, `${vertical.path}/shared/api.ts`)), `${vertical.id} RPC unit must not emit the REST API contract`);
-    } else {
-      assert(!fs.existsSync(path.join(root, `${vertical.path}/src/api/${vertical.stem}-rpc-client.ts`)), `${vertical.id} REST unit must not emit the RPC API client`);
-      assert(!fs.existsSync(path.join(root, `${vertical.path}/shared/rpc.ts`)), `${vertical.id} REST unit must not emit the RPC API contract`);
-    }
-  }
-  const expectedVerticalZephyrDependencies = Object.fromEntries(
-    fullStackVerticals
-      .filter(candidate => vertical.verticalRefs.includes(candidate.id))
-      .map(candidate => [
-        candidate.zephyrAlias,
-        `${candidate.packageName}@workspace:*`,
-      ]),
-  );
-  assert(
-    sameJson(packageJson['zephyr:dependencies'], expectedVerticalZephyrDependencies),
-    `${vertical.id} Zephyr dependencies must match declared vertical refs`,
-  );
-
-  const contractEntry = generatedContract.apps?.find(app => app.id === vertical.id);
-  assert(contractEntry?.path === vertical.path, `${vertical.id} generated contract path is incorrect`);
-  assert(contractEntry?.kind === 'vertical', `${vertical.id} generated contract kind is incorrect`);
-  assert(contractEntry?.deploy?.cloudflare?.workerName === expectedWorkerName(vertical.id), `${vertical.id} Cloudflare workerName is incorrect`);
-  assert(contractEntry?.deploy?.cloudflare?.publicUrlEnv === `ULTRAMODERN_PUBLIC_URL_${vertical.id.replace(/-/g, '_').toUpperCase()}`, `${vertical.id} Cloudflare public URL env is incorrect`);
-  assert(contractEntry?.deploy?.cloudflare?.compatibilityDate === expectedCloudflareCompatibilityDate, `${vertical.id} Cloudflare compatibilityDate is incorrect`);
-  assert(sameJson(contractEntry?.deploy?.cloudflare?.compatibilityFlags, expectedCloudflareCompatibilityFlags), `${vertical.id} Cloudflare compatibility flags are incorrect`);
-  assert(sameJson(contractEntry?.deploy?.cloudflare?.security, expectedCloudflareSecurity), `${vertical.id} Cloudflare security contract is incorrect`);
-  assertCloudflareQualityGates(vertical.id, contractEntry?.deploy?.cloudflare?.qualityGates);
-  assert(contractEntry?.deploy?.worker?.compatibilityDate === expectedCloudflareCompatibilityDate, `${vertical.id} worker compatibilityDate is incorrect`);
-  assert(contractEntry?.deploy?.worker?.name === expectedWorkerName(vertical.id), `${vertical.id} worker name is incorrect`);
-  assert(contractEntry?.config?.dev?.assetPrefix === 'app-public-origin', `${vertical.id} dev asset prefix must default to its app public origin`);
-  assert(contractEntry?.config?.output?.assetPrefix?.default === 'app-public-origin', `${vertical.id} asset prefix must default to its app public origin`);
-  assert(sameJson(contractEntry?.config?.output?.assetPrefix?.envFallbackOrder, ['MODERN_ASSET_PREFIX', 'ULTRAMODERN_ASSET_PREFIX']), `${vertical.id} asset prefix env fallback order is incorrect`);
-  assert(contractEntry?.config?.output?.disableTsChecker === false, `${vertical.id} must keep the framework TypeScript checker enabled`);
-  assert(contractEntry?.config?.performance?.readinessDiagnostics?.default === 'enabled', `${vertical.id} performance readiness diagnostics must be default-on`);
-  assert(contractEntry?.config?.performance?.readinessDiagnostics?.failOn === 'framework-invariant', `${vertical.id} performance readiness diagnostics must only fail framework invariants by default`);
-  assert(contractEntry?.config?.performance?.readinessDiagnostics?.optOut?.config === 'scripts/ultramodern-performance-readiness.config.mjs', `${vertical.id} performance readiness opt-out config is incorrect`);
-  if (vertical.emitsApi) {
-    // Per policy.ts:76 the Cloudflare proof advertises a REST readiness route
-    // only for `rest` units; an `rpc` unit must not carry one.
-    if (vertical.apiProtocol === 'rpc') {
-      assert(contractEntry?.deploy?.cloudflare?.routes?.apiReadiness === undefined, `${vertical.id} rpc unit must not carry a REST Cloudflare readiness route`);
-    } else {
-      assert(contractEntry?.deploy?.cloudflare?.routes?.apiReadiness === `${vertical.apiPrefix}/${vertical.stem}/readiness`, `${vertical.id} Cloudflare proof readiness route is incorrect`);
-    }
-  }
-  assert(contractEntry?.config?.rspack?.output?.uniqueName === vertical.mfName, `${vertical.id} Rspack uniqueName is incorrect`);
-  assert(contractEntry?.config?.rspack?.output?.chunkLoadingGlobal === expectedChunkLoadingGlobal(vertical.mfName), `${vertical.id} Rspack chunkLoadingGlobal is incorrect`);
-  assert(contractEntry?.moduleFederation?.name === vertical.mfName, `${vertical.id} MF name is incorrect`);
-  assert(sameJson(contractEntry?.moduleFederation?.exposes, vertical.exposes), `${vertical.id} MF exposes are incorrect`);
-  // The browser Module Federation DTS surface and its config file only exist
-  // for UI-emitting units; a headless api-only unit federates no browser types.
-  if (vertical.emitsUi) {
-    assert(contractEntry?.moduleFederation?.dts?.compilerInstance === 'effect-tsgo', `${vertical.id} must keep mandatory DTS compiler`);
-    assert(contractEntry?.moduleFederation?.dts?.tsConfigPath === './tsconfig.mf-types.json', `${vertical.id} must keep dedicated Module Federation DTS tsconfig`);
-  }
-  assert(sameJson(contractEntry?.moduleFederation?.verticalRefs ?? [], vertical.verticalRefs), `${vertical.id} MF verticalRefs are incorrect`);
-  assert(
-    sameJson(
-      (contractEntry?.moduleFederation?.remotes ?? []).map(remote => remote.id),
-      vertical.verticalRefs,
-    ),
-    `${vertical.id} MF consumed verticals are incorrect`,
-  );
-  // API contract surface is only present for API-bearing units.
-  if (vertical.emitsApi) {
-    assert(contractEntry?.api?.prefix === vertical.apiPrefix, `${vertical.id} API prefix is incorrect`);
-    assert(contractEntry?.api?.group === vertical.group, `${vertical.id} API group is incorrect`);
-    assert(contractEntry?.api?.runtime === 'effect', `${vertical.id} API runtime must be Effect`);
-    assert(contractEntry?.api?.strictEffectApproach === true, `${vertical.id} strictEffectApproach must be enabled`);
-    assert(contractEntry?.api?.contract === vertical.apiContractExport, `${vertical.id} API contract export is incorrect`);
-    assert(contractEntry?.api?.client === vertical.apiClientExport, `${vertical.id} API client export is incorrect`);
-    if (vertical.apiProtocol === 'rpc') {
-      // An `rpc` unit records the `/rpc` route/serialization; it must not carry
-      // REST readiness or domain-operation semantics.
-      assert(contractEntry?.api?.protocol === 'rpc', `${vertical.id} generated contract API protocol must be rpc`);
-      assert(contractEntry?.api?.rpc?.path === '/rpc', `${vertical.id} generated contract RPC route path is incorrect`);
-      assert(contractEntry?.api?.rpcPath === `${vertical.apiPrefix}/rpc`, `${vertical.id} generated contract RPC path is incorrect`);
-    } else {
-      assert(contractEntry?.api?.readiness?.endpoint === `/${vertical.stem}/readiness`, `${vertical.id} readiness endpoint is incorrect`);
-      assert(contractEntry?.api?.operations?.readiness?.path === `/${vertical.stem}/readiness`, `${vertical.id} readiness operation is missing`);
-      assert(contractEntry?.api?.requestContext?.propagatedHeaders?.includes('traceparent'), `${vertical.id} trace context propagation is missing`);
-      assert(Object.keys(contractEntry?.api?.domainOperations ?? {}).length >= 3, `${vertical.id} domain operations are missing`);
-    }
-  }
-  assert(contractEntry?.i18n?.languages?.includes('en') && contractEntry?.i18n?.languages?.includes('cs'), `${vertical.id} must declare i18n languages`);
-  assert(contractEntry?.i18n?.namespace === vertical.namespace, `${vertical.id} i18n namespace is incorrect`);
-  assert(
-    JSON.stringify(contractEntry?.i18n?.localisedUrls) === JSON.stringify(vertical.localisedUrls),
-    `${vertical.id} localisedUrls must come from route metadata`,
-  );
-  assert(contractEntry?.routes?.source === 'route-owned', `${vertical.id} routes must be route-owned`);
-  assert(contractEntry?.routes?.metadataAuthoring === 'colocated-route-meta', `${vertical.id} route metadata authoring mode is incorrect`);
-  assert(contractEntry?.routes?.generatedManifest === true, `${vertical.id} route metadata manifest must be generated`);
-  assert(contractEntry?.routes?.metadataExport === './src/routes/ultramodern-route-metadata', `${vertical.id} route metadata export is incorrect`);
-  assert(contractEntry?.routes?.privateByDefault === true, `${vertical.id} routes must be private by default`);
-  assert(contractEntry?.routes?.publicnessDefault === 'private-app-screen', `${vertical.id} route publicness default is incorrect`);
-  assert(JSON.stringify(contractEntry?.routes?.publicRoutes ?? []) === '[]', `${vertical.id} must not expose generated public routes by default`);
-  // Public head/surface and owned browser routes only exist for UI-emitting
-  // units; a headless api-only unit renders no route head or public surface.
-  if (vertical.emitsUi) {
-    assertPublicHeadContract(vertical.id, contractEntry?.routes?.publicHead);
-    assertPublicSurfaceContract(vertical.id, contractEntry?.routes?.publicSurface);
-    assert(
-      (contractEntry?.routes?.owned ?? []).every(route => route.public === false && route.indexable === false && route.publicSurface === 'private-app-screen' && typeof route.descriptionKey === 'string'),
-      `${vertical.id} owned routes must be non-indexable private app screens by default and include description keys`,
-    );
-    assertPublicSurfaceAssets(vertical.path, contractEntry?.routes?.publicRoutes ?? []);
-  }
-  // CSS federation (a federated browser stylesheet keyed off the federation
-  // entry) only applies to UI-emitting units; a headless api-only unit owns no
-  // vertical CSS surface.
-  if (vertical.emitsUi) {
-    assert(contractEntry?.styling?.federation?.owner?.id === vertical.id, `${vertical.id} CSS federation owner is missing`);
-    assert(contractEntry?.styling?.federation?.role === 'vertical-css', `${vertical.id} must own only vertical CSS`);
-    assert(contractEntry?.styling?.federation?.rootSelector === `[data-app-id="${vertical.id}"]`, `${vertical.id} CSS root selector is incorrect`);
-    assert(contractEntry?.styling?.federation?.classPrefix === `${vertical.tailwindPrefix}:`, `${vertical.id} CSS class prefix is incorrect`);
-    assert(contractEntry?.styling?.federation?.layers?.owned?.includes(`ultramodern-vertical-${vertical.domain}`), `${vertical.id} vertical CSS layer is missing`);
-    assert(!contractEntry?.styling?.federation?.layers?.owned?.includes('ultramodern-shell-base'), `${vertical.id} must not own shell base CSS`);
-    assert(contractEntry?.styling?.federation?.entrypoints?.federationEntry === 'src/federation-entry.tsx', `${vertical.id} CSS contract must include federation entry`);
-    assert(contractEntry?.styling?.federation?.assets?.shared?.some(asset => asset.endsWith('/shared-design-tokens/tokens.css')), `${vertical.id} must import shared design token CSS`);
-    assert(contractEntry?.styling?.federation?.dedupe?.runtimeLoad === 'once-per-content-hash', `${vertical.id} CSS dedupe strategy is incorrect`);
-    assert(contractEntry?.styling?.federation?.ssr?.verticalCss === 'federated-manifest-owned-css', `${vertical.id} SSR CSS loading contract is incorrect`);
-  }
-
-  const topologyEntry = topology.verticals?.find(verticalEntry => verticalEntry.id === vertical.id);
-  assert(topologyEntry?.kind === 'vertical', `${vertical.id} topology kind is incorrect`);
-  assert(topologyEntry?.package === vertical.packageName, `${vertical.id} topology package is incorrect`);
-  assert(topologyEntry?.cloudflare?.workerName === expectedWorkerName(vertical.id), `${vertical.id} topology Cloudflare workerName is incorrect`);
-  assert(topologyEntry?.moduleFederation?.name === vertical.mfName, `${vertical.id} topology MF name is incorrect`);
-  assert(JSON.stringify(topologyEntry?.moduleFederation?.exposes) === JSON.stringify(vertical.exposes), `${vertical.id} topology exposes are incorrect`);
-  assert(JSON.stringify(topologyEntry?.moduleFederation?.verticalRefs ?? []) === JSON.stringify(vertical.verticalRefs), `${vertical.id} topology verticalRefs are incorrect`);
-  // API/BFF topology metadata only exists for API-bearing units; and the REST
-  // readiness/domain-operation surface is absent for the RPC protocol (G7a).
-  if (vertical.emitsApi) {
-    assert(topologyEntry?.api?.bff?.prefix === vertical.apiPrefix, `${vertical.id} topology API prefix is incorrect`);
-    assert(topologyEntry?.api?.bff?.strictEffectApproach === true, `${vertical.id} topology strictEffectApproach is incorrect`);
-    assert(topologyEntry?.api?.serverEntry === `${vertical.path}/api/index.ts`, `${vertical.id} topology server entry is incorrect`);
-    if (vertical.apiProtocol !== 'rpc') {
-      assert(topologyEntry?.api?.readiness?.endpoint === `/${vertical.stem}/readiness`, `${vertical.id} topology readiness endpoint is incorrect`);
-      assert(Object.keys(topologyEntry?.api?.domainOperations ?? {}).length >= 3, `${vertical.id} topology domain operations are missing`);
-    }
-  }
-
-  if (vertical.deliveryUnit) {
-    const expectedDeliveryUnit = deliveryUnitBlock(
-      expectedDeliveryUnitFor(vertical, topologyEntry),
-    );
-    const compactAppEntry = ultramodernConfig.topology?.apps?.find(
-      entry => entry?.id === vertical.id,
-    );
-    // The backend-federation delivery-unit mirror only exists for API-bearing
-    // units; a UI-only vertical carries just the app-level delivery unit.
-    if (vertical.emitsApi) {
-      const compactBackendDeliveryUnit = deliveryUnitBlock(
-        compactAppEntry?.backendFederation?.deliveryUnit,
-      );
-      assertSameJson(
-        deliveryUnitBlock(compactAppEntry?.deliveryUnit),
-        compactBackendDeliveryUnit,
-        `${compactConfigPath} topology.apps.${vertical.id}.deliveryUnit`,
-        deliveryUnitIdentityFixArea,
-      );
-      assertSameJson(
-        compactBackendDeliveryUnit,
-        expectedDeliveryUnit,
-        `${compactConfigPath} topology.apps.${vertical.id}.backendFederation.deliveryUnit`,
-        deliveryUnitIdentityFixArea,
-      );
-      assertSelfCheck(
-        compactAppEntry?.backendFederation?.versionBoundary?.identityRoot === 'deliveryUnit',
-        `${compactConfigPath} topology.apps.${vertical.id}.backendFederation.versionBoundary.identityRoot`,
-        `Expected "deliveryUnit", found ${formatJson(compactAppEntry?.backendFederation?.versionBoundary?.identityRoot)}`,
-        deliveryUnitIdentityFixArea,
-      );
-    }
-    assertSameJson(
-      deliveryUnitBlock(compactAppEntry?.deliveryUnit),
-      expectedDeliveryUnit,
-      `${compactConfigPath} topology.apps.${vertical.id}.deliveryUnit`,
-      deliveryUnitIdentityFixArea,
-    );
-    assertSameJson(
-      deliveryUnitBlock(compactAppEntry?.deliveryUnit),
-      deliveryUnitBlock(topologyEntry?.deliveryUnit),
-      `${compactConfigPath} vs topology/reference-topology.json verticals.${vertical.id}.deliveryUnit`,
-      deliveryUnitIdentityFixArea,
-    );
-  }
-
-  assert(ownership.owners?.some(owner => owner.id === vertical.id && owner.path === vertical.path), `${vertical.id} ownership entry is missing`);
-  assert(overlay.ports?.[vertical.id], `${vertical.id} development port is missing`);
-  if (vertical.emitsUi) {
-    assert(overlay.manifests?.[vertical.id]?.includes('/mf-manifest.json'), `${vertical.id} development manifest is missing`);
-  }
-  if (vertical.emitsApi) {
-    assert(overlay.apis?.[vertical.id]?.endsWith(vertical.apiProtocol === 'rpc' ? `${vertical.apiPrefix}/rpc` : vertical.apiPrefix), `${vertical.id} development API URL is missing`);
-  }
-}
-
-// Delivery-unit identity for ALL unit kinds (G29). Every workspace app —
-// shell, UI-only vertical, and API-bearing vertical — is an indivisible
-// delivery unit and must carry one consistent identity record across the
-// compact config, the reference topology, and its generated build artifact
-// (ADR-0019: one delivery-unit record, one build marker).
-for (const expectedApp of workspaceValidationContract.topology.compactConfig?.apps ?? []) {
-  const unitLabel = `delivery-unit identity for ${expectedApp.id}`;
-  const expectedDeliveryUnit = deliveryUnitBlock(expectedApp.deliveryUnit);
-  assertSelfCheck(
-    typeof expectedDeliveryUnit.unitId === 'string' && expectedDeliveryUnit.unitId.length > 0 &&
-      typeof expectedDeliveryUnit.buildMarker === 'string' && expectedDeliveryUnit.buildMarker.length > 0,
-    unitLabel,
-    `Every unit kind must declare a delivery-unit record; found ${formatJson(expectedApp.deliveryUnit)}`,
-    deliveryUnitIdentityFixArea,
-  );
-
-  const compactAppEntry = ultramodernConfig.topology?.apps?.find(
-    entry => entry?.id === expectedApp.id,
-  );
-  assertSameJson(
-    compactAppEntry?.deploy?.cloudflare,
-    expectedApp.deploy?.cloudflare,
-    `${compactConfigPath} topology.apps.${expectedApp.id}.deploy.cloudflare`,
-    'regenerate the app Cloudflare deployment contract; do not add local proof-only smoke checks',
-  );
-  assertSameJson(
-    deliveryUnitBlock(compactAppEntry?.deliveryUnit),
-    expectedDeliveryUnit,
-    `${compactConfigPath} topology.apps.${expectedApp.id}.deliveryUnit`,
-    deliveryUnitIdentityFixArea,
-  );
-
-  const topologyUnitEntry =
-    expectedApp.kind === 'shell'
-      ? topology.shell
-      : topology.verticals?.find(entry => entry?.id === expectedApp.id);
-  assertSameJson(
-    deliveryUnitBlock(topologyUnitEntry?.deliveryUnit),
-    expectedDeliveryUnit,
-    `topology/reference-topology.json ${expectedApp.kind === 'shell' ? 'shell' : `verticals.${expectedApp.id}`}.deliveryUnit`,
-    deliveryUnitIdentityFixArea,
-  );
-
-  const appPath = expectedApp.path;
-  const buildArtifactPath = `${appPath}/shared/ultramodern-build.json`;
-  assertExists(buildArtifactPath);
-  const buildIdentity = readJson(buildArtifactPath).deliveryUnit ?? {};
-  assertSelfCheck(
-    buildIdentity.unitId === expectedDeliveryUnit.unitId &&
-      buildIdentity.buildMarker === expectedDeliveryUnit.buildMarker,
-    `${buildArtifactPath} deliveryUnit`,
-    `Expected ${formatJson({ unitId: expectedDeliveryUnit.unitId, buildMarker: expectedDeliveryUnit.buildMarker })}, found ${formatJson({ unitId: buildIdentity.unitId, buildMarker: buildIdentity.buildMarker })}`,
-    deliveryUnitIdentityFixArea,
-  );
-}
-
-console.log('UltraModern workspace scaffold validated');