@bleedingdev/modern-js-create 3.2.0-ultramodern.14 → 3.2.0-ultramodern.15

package/dist/index.js

@@ -1919,6 +1919,7 @@ function createTemplateManifest(modernVersion, packageSource) {
             ],
             postMaterializationValidation: [
                 'ultramodern-workspace-contract-check',
+                'pnpm-11-policy-enforced',
                 'template-manifest-retained'
             ],
             expectedCommands: [
@@ -2222,6 +2223,7 @@ function createBuiltinTemplateManifest(version) {
                 'oxfmt.config.ts',
                 'oxlint.config.ts',
                 'package.json',
+                'pnpm-workspace.yaml',
                 'postcss.config.mjs',
                 'rstest.config.mts',
                 "scripts/**",
@@ -2258,11 +2260,12 @@ function createBuiltinTemplateManifest(version) {
                 'ultramodern-contract-check',
                 'dependency-install-with-lifecycle-deny',
                 'package-source-retained',
+                'pnpm-11-policy-enforced',
                 'rstest-smoke-tests',
                 'template-manifest-retained'
             ],
             expectedCommands: [
-                "pnpm install --ignore-scripts",
+                'pnpm install',
                 'pnpm test',
                 'pnpm run ultramodern:check'
             ]

package/package.json

@@ -21,7 +21,7 @@
   "engines": {
     "node": ">=20"
   },
-  "version": "3.2.0-ultramodern.14",
+  "version": "3.2.0-ultramodern.15",
   "types": "./dist/types/index.d.ts",
   "main": "./dist/index.js",
   "bin": {
@@ -41,7 +41,7 @@
     "@types/node": "^25.8.0",
     "@typescript/native-preview": "7.0.0-dev.20260516.1",
     "tsx": "^4.22.0",
-    "@modern-js/i18n-utils": "npm:@bleedingdev/modern-js-i18n-utils@3.2.0-ultramodern.14"
+    "@modern-js/i18n-utils": "npm:@bleedingdev/modern-js-i18n-utils@3.2.0-ultramodern.15"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",
@@ -54,6 +54,6 @@
     "start": "node ./dist/index.js"
   },
   "ultramodern": {
-    "frameworkVersion": "3.2.0-ultramodern.14"
+    "frameworkVersion": "3.2.0-ultramodern.15"
   }
 }

package/template/.github/workflows/ultramodern-gates.yml.handlebars

@@ -21,7 +21,7 @@ jobs:
           cache: pnpm
 
       - name: Install Dependencies
-        run: pnpm install --ignore-scripts
+        run: pnpm install
 
       - name: Validate Ultramodern Contract
         run: pnpm run ultramodern:check

package/template/package.json.handlebars

@@ -73,13 +73,5 @@
   "engines": {
     "node": ">=20",
     "pnpm": ">=11.0.0"
-  },
-  "pnpm": {
-    "onlyBuiltDependencies": [
-      "@swc/core",
-      "core-js",
-      "esbuild",
-      "msgpackr-extract"
-    ]
   }
 }

package/template/pnpm-workspace.yaml

@@ -0,0 +1,24 @@
+minimumReleaseAge: 1440
+minimumReleaseAgeStrict: true
+minimumReleaseAgeIgnoreMissingTime: false
+minimumReleaseAgeExclude:
+  - '@modern-js/*'
+  - '@bleedingdev/*'
+  - '@effect/tsgo'
+  - '@effect/tsgo-*'
+  - '@typescript/native-preview'
+  - '@typescript/native-preview-*'
+trustPolicy: no-downgrade
+trustPolicyIgnoreAfter: 1440
+blockExoticSubdeps: true
+engineStrict: true
+pmOnFail: error
+verifyDepsBeforeRun: error
+strictDepBuilds: true
+
+allowBuilds:
+  '@swc/core': true
+  core-js: true
+  esbuild: true
+  msgpackr-extract: true
+  simple-git-hooks: true

package/template/scripts/validate-ultramodern.mjs.handlebars

@@ -53,6 +53,7 @@ const requiredPostMaterialization = [
   'ultramodern-contract-check',
   'dependency-install-with-lifecycle-deny',
   'package-source-retained',
+  'pnpm-11-policy-enforced',
   'rstest-smoke-tests',
   'template-manifest-retained',
 ];
@@ -66,6 +67,7 @@ const requiredPaths = [
   'scripts/bootstrap-agent-skills.mjs',
 {{/unless}}
   '.modernjs/ultramodern-package-source.json',
+  'pnpm-workspace.yaml',
   'rstest.config.mts',
   'scripts/check-i18n-strings.mjs',
   'config/public/locales/en/translation.json',
@@ -162,6 +164,10 @@ if (manifestErrors.length > 0) {
 const packageJson = JSON.parse(
   fs.readFileSync(path.resolve(process.cwd(), 'package.json'), 'utf-8'),
 );
+const pnpmWorkspace = fs.readFileSync(
+  path.resolve(process.cwd(), 'pnpm-workspace.yaml'),
+  'utf-8',
+);
 const packageSource = JSON.parse(fs.readFileSync(packageSourcePath, 'utf-8'));
 const unresolvedTemplateMarker = String.fromCodePoint(123, 123);
 if (JSON.stringify(packageJson).includes(unresolvedTemplateMarker)) {
@@ -225,6 +231,36 @@ if (packageJson.engines?.pnpm !== '>=11.0.0') {
   process.exit(1);
 }
 
+if (packageJson.pnpm !== undefined) {
+  console.error('Generated app must keep pnpm policy in pnpm-workspace.yaml, not package.json');
+  process.exit(1);
+}
+
+for (const requiredSnippet of [
+  'minimumReleaseAge: 1440',
+  'minimumReleaseAgeStrict: true',
+  'minimumReleaseAgeIgnoreMissingTime: false',
+  "minimumReleaseAgeExclude:\n  - '@modern-js/*'\n  - '@bleedingdev/*'\n  - '@effect/tsgo'\n  - '@effect/tsgo-*'\n  - '@typescript/native-preview'\n  - '@typescript/native-preview-*'",
+  'trustPolicy: no-downgrade',
+  'trustPolicyIgnoreAfter: 1440',
+  'blockExoticSubdeps: true',
+  'engineStrict: true',
+  'pmOnFail: error',
+  'verifyDepsBeforeRun: error',
+  'strictDepBuilds: true',
+  "allowBuilds:\n  '@swc/core': true\n  core-js: true\n  esbuild: true\n  msgpackr-extract: true\n  simple-git-hooks: true",
+]) {
+  if (!pnpmWorkspace.includes(requiredSnippet)) {
+    console.error(`pnpm-workspace.yaml must retain ${requiredSnippet.split('\n')[0]}`);
+    process.exit(1);
+  }
+}
+
+if (pnpmWorkspace.includes('onlyBuiltDependencies')) {
+  console.error('pnpm-workspace.yaml must use pnpm 11 allowBuilds instead of onlyBuiltDependencies');
+  process.exit(1);
+}
+
 if (packageJson.modernjs?.preset !== 'presetUltramodern') {
   console.error('package.json must declare presetUltramodern metadata');
   process.exit(1);

package/template-workspace/pnpm-workspace.yaml

@@ -4,14 +4,27 @@ packages:
   - services/*
   - packages/*
 
+minimumReleaseAge: 1440
+minimumReleaseAgeStrict: true
+minimumReleaseAgeIgnoreMissingTime: false
+minimumReleaseAgeExclude:
+  - '@modern-js/*'
+  - '@bleedingdev/*'
+  - '@effect/tsgo'
+  - '@effect/tsgo-*'
+  - '@typescript/native-preview'
+  - '@typescript/native-preview-*'
+trustPolicy: no-downgrade
+trustPolicyIgnoreAfter: 1440
+blockExoticSubdeps: true
+engineStrict: true
+pmOnFail: error
+verifyDepsBeforeRun: error
+strictDepBuilds: true
+
 allowBuilds:
   '@swc/core': true
   core-js: true
   esbuild: true
   msgpackr-extract: true
-
-onlyBuiltDependencies:
-  - '@swc/core'
-  - core-js
-  - esbuild
-  - msgpackr-extract
+  simple-git-hooks: true

package/template-workspace/scripts/validate-ultramodern-workspace.mjs.handlebars

@@ -142,14 +142,28 @@ assert(rootPackage.packageManager === 'pnpm@11.1.2', 'Root must pin pnpm 11.1.2'
 assert(rootPackage.engines?.pnpm === '>=11.0.0', 'Root must require pnpm >=11');
 for (const requiredSnippet of [
   'packages:\n  - apps/*\n  - apps/remotes/*\n  - services/*\n  - packages/*',
-  "allowBuilds:\n  '@swc/core': true\n  core-js: true\n  esbuild: true\n  msgpackr-extract: true",
-  "onlyBuiltDependencies:\n  - '@swc/core'\n  - core-js\n  - esbuild\n  - msgpackr-extract",
+  'minimumReleaseAge: 1440',
+  'minimumReleaseAgeStrict: true',
+  'minimumReleaseAgeIgnoreMissingTime: false',
+  "minimumReleaseAgeExclude:\n  - '@modern-js/*'\n  - '@bleedingdev/*'\n  - '@effect/tsgo'\n  - '@effect/tsgo-*'\n  - '@typescript/native-preview'\n  - '@typescript/native-preview-*'",
+  'trustPolicy: no-downgrade',
+  'trustPolicyIgnoreAfter: 1440',
+  'blockExoticSubdeps: true',
+  'engineStrict: true',
+  'pmOnFail: error',
+  'verifyDepsBeforeRun: error',
+  'strictDepBuilds: true',
+  "allowBuilds:\n  '@swc/core': true\n  core-js: true\n  esbuild: true\n  msgpackr-extract: true\n  simple-git-hooks: true",
 ]) {
   assert(
     pnpmWorkspace.includes(requiredSnippet),
     `pnpm-workspace.yaml must retain ${requiredSnippet.split('\n')[0]}`,
   );
 }
+assert(
+  !pnpmWorkspace.includes('onlyBuiltDependencies'),
+  'pnpm-workspace.yaml must use pnpm 11 allowBuilds instead of onlyBuiltDependencies',
+);
 assert(
   rootPackage.modernjs?.packageSource?.config === './.modernjs/ultramodern-package-source.json',
   'Root must point to the UltraModern package source metadata',
@@ -488,5 +502,9 @@ assert(
   manifest.validation?.expectedCommands?.includes('pnpm run ultramodern:check'),
   'Template manifest must document the validation command',
 );
+assert(
+  manifest.validation?.postMaterializationValidation?.includes('pnpm-11-policy-enforced'),
+  'Template manifest must document pnpm 11 policy validation',
+);
 
 console.log('UltraModern workspace scaffold validated');