@bleedingdev/modern-js-create 3.5.0-ultramodern.2 → 3.5.0-ultramodern.4

package/README.md

@@ -193,8 +193,8 @@ For strict Effect API migrations, update generated package metadata and Modern
 package aliases through the framework command before hand-editing app code:
 
 ```bash
-pnpm dlx @bleedingdev/modern-js-create@3.5.0-ultramodern.2 ultramodern \
-  migrate-strict-effect --version 3.5.0-ultramodern.2
+pnpm dlx @bleedingdev/modern-js-create@3.5.0-ultramodern.4 ultramodern \
+  migrate-strict-effect --version 3.5.0-ultramodern.4
 pnpm api:check
 pnpm contract:check
 pnpm check
@@ -202,7 +202,8 @@ pnpm build
 ```
 
 The command updates `.modernjs/ultramodern.json`, root `modernjs.packageSource`,
-generated Modern package aliases, old direct topology metadata, and the pnpm
+generated Modern package aliases, framework-owned toolchain pins, old direct
+topology metadata, strict Effect pnpm overrides/trust policy, and the pnpm
 lockfile. It does not invent compatibility shims or move business code behind
 your back. If `pnpm api:check` still fails, migrate the source to
 `shared/api.ts`, `api/index.ts`, and `src/api/*-client.ts` and delete
@@ -210,8 +211,11 @@ your back. If `pnpm api:check` still fails, migrate the source to
 
 Generated strict Effect workspaces pin the compatible Effect cohort through
 `pnpm-workspace.yaml` overrides: `effect@4.0.0-beta.91` and
-`@effect/vitest@4.0.0-beta.91`. Do not override those in app packages; update
-the framework cohort when the runtime moves.
+`@effect/vitest@4.0.0-beta.91`. The generated pnpm policy also excludes the
+known `effect@4.0.0-beta.91` and `@effect/opentelemetry@4.0.0-beta.91`
+trusted-publisher to provenance transitions from no-downgrade checks. Do not
+override those in app packages; update the framework cohort when the runtime
+moves.
 
 Use `--ultramodern-package-source=install` for published cohort proof and pin a
 specific release with `--ultramodern-package-version` when CI must prove an

package/dist/cjs/ultramodern-tooling/commands.cjs

@@ -53,6 +53,7 @@ const external_node_url_namespaceObject = require("node:url");
 const external_create_package_root_cjs_namespaceObject = require("../create-package-root.cjs");
 const external_ultramodern_package_source_cjs_namespaceObject = require("../ultramodern-package-source.cjs");
 const mf_validation_cjs_namespaceObject = require("../ultramodern-workspace/mf-validation.cjs");
+const versions_cjs_namespaceObject = require("../ultramodern-workspace/versions.cjs");
 const workspace_scripts_cjs_namespaceObject = require("../ultramodern-workspace/workspace-scripts.cjs");
 const external_config_cjs_namespaceObject = require("./config.cjs");
 const commands_dirname = external_node_path_default().dirname((0, external_node_url_namespaceObject.fileURLToPath)(__rslib_import_meta_url__));
@@ -198,6 +199,58 @@ function updateModernDependencies(packageJson, packageSource) {
     }
     return changed;
 }
+const generatedToolingDependencyPins = new Map([
+    [
+        '@effect/tsgo',
+        versions_cjs_namespaceObject.EFFECT_TSGO_VERSION
+    ],
+    [
+        "@typescript/native-preview",
+        versions_cjs_namespaceObject.TYPESCRIPT_NATIVE_PREVIEW_VERSION
+    ],
+    [
+        'oxfmt',
+        versions_cjs_namespaceObject.OXFMT_VERSION
+    ],
+    [
+        'oxlint',
+        versions_cjs_namespaceObject.OXLINT_VERSION
+    ],
+    [
+        'wrangler',
+        versions_cjs_namespaceObject.WRANGLER_VERSION
+    ],
+    [
+        'zephyr-agent',
+        versions_cjs_namespaceObject.ZEPHYR_AGENT_VERSION
+    ],
+    [
+        'zephyr-rspack-plugin',
+        versions_cjs_namespaceObject.ZEPHYR_RSPACK_PLUGIN_VERSION
+    ]
+]);
+const strictEffectTrustPolicyExclusions = [
+    `effect@${versions_cjs_namespaceObject.EFFECT_VERSION}`,
+    `@effect/opentelemetry@${versions_cjs_namespaceObject.EFFECT_VERSION}`
+];
+function updateGeneratedToolingDependencies(packageJson) {
+    let changed = false;
+    for (const section of [
+        'dependencies',
+        'devDependencies',
+        'peerDependencies',
+        'optionalDependencies'
+    ]){
+        const dependencies = packageJson[section];
+        if (!(!dependencies || 'object' != typeof dependencies || Array.isArray(dependencies))) {
+            for (const [packageName, version] of generatedToolingDependencyPins)if (Object.prototype.hasOwnProperty.call(dependencies, packageName) && dependencies[packageName] !== version) {
+                dependencies[packageName] = version;
+                changed = true;
+            }
+        }
+    }
+    return changed;
+}
 function normalizeStrictEffectApiMetadata(value) {
     const api = value.api;
     if (!api || 'object' != typeof api || Array.isArray(api)) return false;
@@ -263,6 +316,74 @@ function normalizeStrictEffectApiMetadata(value) {
     }
     return changed;
 }
+function replaceYamlLine(source, pattern, replacement) {
+    const updated = source.replace(pattern, replacement);
+    return {
+        source: updated,
+        changed: updated !== source
+    };
+}
+function ensureYamlListItem(source, key, item) {
+    const itemLine = `  - '${item}'`;
+    const headerPattern = new RegExp(`^${key}:\\n(?:(?:  - .+\\n)*)`, 'mu');
+    const existingItemPattern = new RegExp(`^  - '${item.replace(/[.*+?^${}()|[\]\\]/gu, '\\$&')}'$`, 'mu');
+    if (existingItemPattern.test(source)) return {
+        source,
+        changed: false
+    };
+    const header = source.match(headerPattern);
+    if (header) return {
+        source: source.replace(headerPattern, `${header[0]}${itemLine}\n`),
+        changed: true
+    };
+    const block = `${key}:\n${itemLine}\n`;
+    const afterTrustPolicyIgnore = source.replace(/^(trustPolicyIgnoreAfter: .+\n)/mu, `$1${block}`);
+    if (afterTrustPolicyIgnore !== source) return {
+        source: afterTrustPolicyIgnore,
+        changed: true
+    };
+    return {
+        source: `${source.trimEnd()}\n${block}`,
+        changed: true
+    };
+}
+function updateGeneratedPnpmWorkspacePolicy(workspaceRoot) {
+    const workspaceFile = external_node_path_default().join(workspaceRoot, 'pnpm-workspace.yaml');
+    if (!external_node_fs_default().existsSync(workspaceFile)) return false;
+    let source = external_node_fs_default().readFileSync(workspaceFile, 'utf-8');
+    let changed = false;
+    const replacements = [
+        [
+            /^ {4}'@effect\/vitest>effect': .+$/mu,
+            `    '@effect/vitest>effect': '${versions_cjs_namespaceObject.EFFECT_VERSION}'`
+        ],
+        [
+            /^ {2}'@effect\/vitest': .+$/mu,
+            `  '@effect/vitest': ${versions_cjs_namespaceObject.EFFECT_VITEST_VERSION}`
+        ],
+        [
+            /^ {2}effect: .+$/mu,
+            `  effect: ${versions_cjs_namespaceObject.EFFECT_VERSION}`
+        ]
+    ];
+    for (const [pattern, replacement] of replacements){
+        const result = replaceYamlLine(source, pattern, replacement);
+        source = result.source;
+        changed = result.changed || changed;
+    }
+    for (const item of strictEffectTrustPolicyExclusions){
+        const packageName = item.slice(0, item.lastIndexOf('@'));
+        const escapedPackageName = packageName.replace(/[.*+?^${}()|[\]\\]/gu, '\\$&');
+        const currentVersion = replaceYamlLine(source, new RegExp(`^ {2}- '${escapedPackageName}@[^']+'$`, 'mu'), `  - '${item}'`);
+        source = currentVersion.source;
+        changed = currentVersion.changed || changed;
+        const trustPolicyExclude = ensureYamlListItem(source, 'trustPolicyExclude', item);
+        source = trustPolicyExclude.source;
+        changed = trustPolicyExclude.changed || changed;
+    }
+    if (changed) external_node_fs_default().writeFileSync(workspaceFile, source, 'utf-8');
+    return changed;
+}
 function updateUltramodernConfig(workspaceRoot, packageSource) {
     const configPath = external_node_path_default().join(workspaceRoot, '.modernjs/ultramodern.json');
     const config = readJsonFile(configPath);
@@ -344,8 +465,9 @@ function runMigrateStrictEffect(args, context) {
   modern-js-create ultramodern migrate-strict-effect --version <version> [--skip-install]
 
 Updates generated UltraModern package-source metadata, Modern package aliases,
-direct Effect API topology metadata, and the pnpm lockfile for strict Effect
-workspaces. Source code still has to pass pnpm api:check and pnpm contract:check.
+framework-owned toolchain pins, direct Effect API topology metadata, strict
+Effect pnpm overrides/trust policy, and the pnpm lockfile. Source code still
+has to pass pnpm api:check and pnpm contract:check.
 `);
         return 0;
     }
@@ -363,9 +485,13 @@ workspaces. Source code still has to pass pnpm api:check and pnpm contract:check
                 config: './.modernjs/ultramodern.json'
             };
         }
-        if (updateModernDependencies(packageJson, packageSource)) writeJsonFile(packageFile, packageJson);
+        const modernDependenciesChanged = updateModernDependencies(packageJson, packageSource);
+        const toolingDependenciesChanged = updateGeneratedToolingDependencies(packageJson);
+        const changed = modernDependenciesChanged || toolingDependenciesChanged;
+        if (changed) writeJsonFile(packageFile, packageJson);
         else if ('package.json' === relativePackageFile) writeJsonFile(packageFile, packageJson);
     }
+    updateGeneratedPnpmWorkspacePolicy(context.workspaceRoot);
     if (!hasFlag(args, '--skip-install')) {
         const status = runPnpmLockfileRefresh(context);
         if (0 !== status) return status;

package/dist/esm/ultramodern-tooling/commands.js

@@ -6,6 +6,7 @@ import { fileURLToPath } from "node:url";
 import { resolveCreatePackageRoot } from "../create-package-root.js";
 import { BLEEDINGDEV_PACKAGE_NAME_PREFIX, BLEEDINGDEV_PACKAGE_SCOPE, ULTRAMODERN_SINGLE_APP_MODERN_PACKAGES, ULTRAMODERN_WORKSPACE_MODERN_PACKAGES, WORKSPACE_PACKAGE_VERSION, modernPackageSpecifier } from "../ultramodern-package-source.js";
 import { validateModuleFederationTypes } from "../ultramodern-workspace/mf-validation.js";
+import { EFFECT_TSGO_VERSION, EFFECT_VERSION, EFFECT_VITEST_VERSION, OXFMT_VERSION, OXLINT_VERSION, TYPESCRIPT_NATIVE_PREVIEW_VERSION, WRANGLER_VERSION, ZEPHYR_AGENT_VERSION, ZEPHYR_RSPACK_PLUGIN_VERSION } from "../ultramodern-workspace/versions.js";
 import { createWorkspaceValidationScript } from "../ultramodern-workspace/workspace-scripts.js";
 import { readUltramodernConfig, workspaceAppsFromToolingConfig } from "./config.js";
 const commands_dirname = node_path.dirname(fileURLToPath(import.meta.url));
@@ -151,6 +152,58 @@ function updateModernDependencies(packageJson, packageSource) {
     }
     return changed;
 }
+const generatedToolingDependencyPins = new Map([
+    [
+        '@effect/tsgo',
+        EFFECT_TSGO_VERSION
+    ],
+    [
+        "@typescript/native-preview",
+        TYPESCRIPT_NATIVE_PREVIEW_VERSION
+    ],
+    [
+        'oxfmt',
+        OXFMT_VERSION
+    ],
+    [
+        'oxlint',
+        OXLINT_VERSION
+    ],
+    [
+        'wrangler',
+        WRANGLER_VERSION
+    ],
+    [
+        'zephyr-agent',
+        ZEPHYR_AGENT_VERSION
+    ],
+    [
+        'zephyr-rspack-plugin',
+        ZEPHYR_RSPACK_PLUGIN_VERSION
+    ]
+]);
+const strictEffectTrustPolicyExclusions = [
+    `effect@${EFFECT_VERSION}`,
+    `@effect/opentelemetry@${EFFECT_VERSION}`
+];
+function updateGeneratedToolingDependencies(packageJson) {
+    let changed = false;
+    for (const section of [
+        'dependencies',
+        'devDependencies',
+        'peerDependencies',
+        'optionalDependencies'
+    ]){
+        const dependencies = packageJson[section];
+        if (!(!dependencies || 'object' != typeof dependencies || Array.isArray(dependencies))) {
+            for (const [packageName, version] of generatedToolingDependencyPins)if (Object.prototype.hasOwnProperty.call(dependencies, packageName) && dependencies[packageName] !== version) {
+                dependencies[packageName] = version;
+                changed = true;
+            }
+        }
+    }
+    return changed;
+}
 function normalizeStrictEffectApiMetadata(value) {
     const api = value.api;
     if (!api || 'object' != typeof api || Array.isArray(api)) return false;
@@ -216,6 +269,74 @@ function normalizeStrictEffectApiMetadata(value) {
     }
     return changed;
 }
+function replaceYamlLine(source, pattern, replacement) {
+    const updated = source.replace(pattern, replacement);
+    return {
+        source: updated,
+        changed: updated !== source
+    };
+}
+function ensureYamlListItem(source, key, item) {
+    const itemLine = `  - '${item}'`;
+    const headerPattern = new RegExp(`^${key}:\\n(?:(?:  - .+\\n)*)`, 'mu');
+    const existingItemPattern = new RegExp(`^  - '${item.replace(/[.*+?^${}()|[\]\\]/gu, '\\$&')}'$`, 'mu');
+    if (existingItemPattern.test(source)) return {
+        source,
+        changed: false
+    };
+    const header = source.match(headerPattern);
+    if (header) return {
+        source: source.replace(headerPattern, `${header[0]}${itemLine}\n`),
+        changed: true
+    };
+    const block = `${key}:\n${itemLine}\n`;
+    const afterTrustPolicyIgnore = source.replace(/^(trustPolicyIgnoreAfter: .+\n)/mu, `$1${block}`);
+    if (afterTrustPolicyIgnore !== source) return {
+        source: afterTrustPolicyIgnore,
+        changed: true
+    };
+    return {
+        source: `${source.trimEnd()}\n${block}`,
+        changed: true
+    };
+}
+function updateGeneratedPnpmWorkspacePolicy(workspaceRoot) {
+    const workspaceFile = node_path.join(workspaceRoot, 'pnpm-workspace.yaml');
+    if (!node_fs.existsSync(workspaceFile)) return false;
+    let source = node_fs.readFileSync(workspaceFile, 'utf-8');
+    let changed = false;
+    const replacements = [
+        [
+            /^ {4}'@effect\/vitest>effect': .+$/mu,
+            `    '@effect/vitest>effect': '${EFFECT_VERSION}'`
+        ],
+        [
+            /^ {2}'@effect\/vitest': .+$/mu,
+            `  '@effect/vitest': ${EFFECT_VITEST_VERSION}`
+        ],
+        [
+            /^ {2}effect: .+$/mu,
+            `  effect: ${EFFECT_VERSION}`
+        ]
+    ];
+    for (const [pattern, replacement] of replacements){
+        const result = replaceYamlLine(source, pattern, replacement);
+        source = result.source;
+        changed = result.changed || changed;
+    }
+    for (const item of strictEffectTrustPolicyExclusions){
+        const packageName = item.slice(0, item.lastIndexOf('@'));
+        const escapedPackageName = packageName.replace(/[.*+?^${}()|[\]\\]/gu, '\\$&');
+        const currentVersion = replaceYamlLine(source, new RegExp(`^ {2}- '${escapedPackageName}@[^']+'$`, 'mu'), `  - '${item}'`);
+        source = currentVersion.source;
+        changed = currentVersion.changed || changed;
+        const trustPolicyExclude = ensureYamlListItem(source, 'trustPolicyExclude', item);
+        source = trustPolicyExclude.source;
+        changed = trustPolicyExclude.changed || changed;
+    }
+    if (changed) node_fs.writeFileSync(workspaceFile, source, 'utf-8');
+    return changed;
+}
 function updateUltramodernConfig(workspaceRoot, packageSource) {
     const configPath = node_path.join(workspaceRoot, '.modernjs/ultramodern.json');
     const config = readJsonFile(configPath);
@@ -297,8 +418,9 @@ function runMigrateStrictEffect(args, context) {
   modern-js-create ultramodern migrate-strict-effect --version <version> [--skip-install]
 
 Updates generated UltraModern package-source metadata, Modern package aliases,
-direct Effect API topology metadata, and the pnpm lockfile for strict Effect
-workspaces. Source code still has to pass pnpm api:check and pnpm contract:check.
+framework-owned toolchain pins, direct Effect API topology metadata, strict
+Effect pnpm overrides/trust policy, and the pnpm lockfile. Source code still
+has to pass pnpm api:check and pnpm contract:check.
 `);
         return 0;
     }
@@ -316,9 +438,13 @@ workspaces. Source code still has to pass pnpm api:check and pnpm contract:check
                 config: './.modernjs/ultramodern.json'
             };
         }
-        if (updateModernDependencies(packageJson, packageSource)) writeJsonFile(packageFile, packageJson);
+        const modernDependenciesChanged = updateModernDependencies(packageJson, packageSource);
+        const toolingDependenciesChanged = updateGeneratedToolingDependencies(packageJson);
+        const changed = modernDependenciesChanged || toolingDependenciesChanged;
+        if (changed) writeJsonFile(packageFile, packageJson);
         else if ('package.json' === relativePackageFile) writeJsonFile(packageFile, packageJson);
     }
+    updateGeneratedPnpmWorkspacePolicy(context.workspaceRoot);
     if (!hasFlag(args, '--skip-install')) {
         const status = runPnpmLockfileRefresh(context);
         if (0 !== status) return status;

package/dist/esm-node/ultramodern-tooling/commands.js

@@ -7,6 +7,7 @@ import { fileURLToPath } from "node:url";
 import { resolveCreatePackageRoot } from "../create-package-root.js";
 import { BLEEDINGDEV_PACKAGE_NAME_PREFIX, BLEEDINGDEV_PACKAGE_SCOPE, ULTRAMODERN_SINGLE_APP_MODERN_PACKAGES, ULTRAMODERN_WORKSPACE_MODERN_PACKAGES, WORKSPACE_PACKAGE_VERSION, modernPackageSpecifier } from "../ultramodern-package-source.js";
 import { validateModuleFederationTypes } from "../ultramodern-workspace/mf-validation.js";
+import { EFFECT_TSGO_VERSION, EFFECT_VERSION, EFFECT_VITEST_VERSION, OXFMT_VERSION, OXLINT_VERSION, TYPESCRIPT_NATIVE_PREVIEW_VERSION, WRANGLER_VERSION, ZEPHYR_AGENT_VERSION, ZEPHYR_RSPACK_PLUGIN_VERSION } from "../ultramodern-workspace/versions.js";
 import { createWorkspaceValidationScript } from "../ultramodern-workspace/workspace-scripts.js";
 import { readUltramodernConfig, workspaceAppsFromToolingConfig } from "./config.js";
 const commands_dirname = node_path.dirname(fileURLToPath(import.meta.url));
@@ -152,6 +153,58 @@ function updateModernDependencies(packageJson, packageSource) {
     }
     return changed;
 }
+const generatedToolingDependencyPins = new Map([
+    [
+        '@effect/tsgo',
+        EFFECT_TSGO_VERSION
+    ],
+    [
+        "@typescript/native-preview",
+        TYPESCRIPT_NATIVE_PREVIEW_VERSION
+    ],
+    [
+        'oxfmt',
+        OXFMT_VERSION
+    ],
+    [
+        'oxlint',
+        OXLINT_VERSION
+    ],
+    [
+        'wrangler',
+        WRANGLER_VERSION
+    ],
+    [
+        'zephyr-agent',
+        ZEPHYR_AGENT_VERSION
+    ],
+    [
+        'zephyr-rspack-plugin',
+        ZEPHYR_RSPACK_PLUGIN_VERSION
+    ]
+]);
+const strictEffectTrustPolicyExclusions = [
+    `effect@${EFFECT_VERSION}`,
+    `@effect/opentelemetry@${EFFECT_VERSION}`
+];
+function updateGeneratedToolingDependencies(packageJson) {
+    let changed = false;
+    for (const section of [
+        'dependencies',
+        'devDependencies',
+        'peerDependencies',
+        'optionalDependencies'
+    ]){
+        const dependencies = packageJson[section];
+        if (!(!dependencies || 'object' != typeof dependencies || Array.isArray(dependencies))) {
+            for (const [packageName, version] of generatedToolingDependencyPins)if (Object.prototype.hasOwnProperty.call(dependencies, packageName) && dependencies[packageName] !== version) {
+                dependencies[packageName] = version;
+                changed = true;
+            }
+        }
+    }
+    return changed;
+}
 function normalizeStrictEffectApiMetadata(value) {
     const api = value.api;
     if (!api || 'object' != typeof api || Array.isArray(api)) return false;
@@ -217,6 +270,74 @@ function normalizeStrictEffectApiMetadata(value) {
     }
     return changed;
 }
+function replaceYamlLine(source, pattern, replacement) {
+    const updated = source.replace(pattern, replacement);
+    return {
+        source: updated,
+        changed: updated !== source
+    };
+}
+function ensureYamlListItem(source, key, item) {
+    const itemLine = `  - '${item}'`;
+    const headerPattern = new RegExp(`^${key}:\\n(?:(?:  - .+\\n)*)`, 'mu');
+    const existingItemPattern = new RegExp(`^  - '${item.replace(/[.*+?^${}()|[\]\\]/gu, '\\$&')}'$`, 'mu');
+    if (existingItemPattern.test(source)) return {
+        source,
+        changed: false
+    };
+    const header = source.match(headerPattern);
+    if (header) return {
+        source: source.replace(headerPattern, `${header[0]}${itemLine}\n`),
+        changed: true
+    };
+    const block = `${key}:\n${itemLine}\n`;
+    const afterTrustPolicyIgnore = source.replace(/^(trustPolicyIgnoreAfter: .+\n)/mu, `$1${block}`);
+    if (afterTrustPolicyIgnore !== source) return {
+        source: afterTrustPolicyIgnore,
+        changed: true
+    };
+    return {
+        source: `${source.trimEnd()}\n${block}`,
+        changed: true
+    };
+}
+function updateGeneratedPnpmWorkspacePolicy(workspaceRoot) {
+    const workspaceFile = node_path.join(workspaceRoot, 'pnpm-workspace.yaml');
+    if (!node_fs.existsSync(workspaceFile)) return false;
+    let source = node_fs.readFileSync(workspaceFile, 'utf-8');
+    let changed = false;
+    const replacements = [
+        [
+            /^ {4}'@effect\/vitest>effect': .+$/mu,
+            `    '@effect/vitest>effect': '${EFFECT_VERSION}'`
+        ],
+        [
+            /^ {2}'@effect\/vitest': .+$/mu,
+            `  '@effect/vitest': ${EFFECT_VITEST_VERSION}`
+        ],
+        [
+            /^ {2}effect: .+$/mu,
+            `  effect: ${EFFECT_VERSION}`
+        ]
+    ];
+    for (const [pattern, replacement] of replacements){
+        const result = replaceYamlLine(source, pattern, replacement);
+        source = result.source;
+        changed = result.changed || changed;
+    }
+    for (const item of strictEffectTrustPolicyExclusions){
+        const packageName = item.slice(0, item.lastIndexOf('@'));
+        const escapedPackageName = packageName.replace(/[.*+?^${}()|[\]\\]/gu, '\\$&');
+        const currentVersion = replaceYamlLine(source, new RegExp(`^ {2}- '${escapedPackageName}@[^']+'$`, 'mu'), `  - '${item}'`);
+        source = currentVersion.source;
+        changed = currentVersion.changed || changed;
+        const trustPolicyExclude = ensureYamlListItem(source, 'trustPolicyExclude', item);
+        source = trustPolicyExclude.source;
+        changed = trustPolicyExclude.changed || changed;
+    }
+    if (changed) node_fs.writeFileSync(workspaceFile, source, 'utf-8');
+    return changed;
+}
 function updateUltramodernConfig(workspaceRoot, packageSource) {
     const configPath = node_path.join(workspaceRoot, '.modernjs/ultramodern.json');
     const config = readJsonFile(configPath);
@@ -298,8 +419,9 @@ function runMigrateStrictEffect(args, context) {
   modern-js-create ultramodern migrate-strict-effect --version <version> [--skip-install]
 
 Updates generated UltraModern package-source metadata, Modern package aliases,
-direct Effect API topology metadata, and the pnpm lockfile for strict Effect
-workspaces. Source code still has to pass pnpm api:check and pnpm contract:check.
+framework-owned toolchain pins, direct Effect API topology metadata, strict
+Effect pnpm overrides/trust policy, and the pnpm lockfile. Source code still
+has to pass pnpm api:check and pnpm contract:check.
 `);
         return 0;
     }
@@ -317,9 +439,13 @@ workspaces. Source code still has to pass pnpm api:check and pnpm contract:check
                 config: './.modernjs/ultramodern.json'
             };
         }
-        if (updateModernDependencies(packageJson, packageSource)) writeJsonFile(packageFile, packageJson);
+        const modernDependenciesChanged = updateModernDependencies(packageJson, packageSource);
+        const toolingDependenciesChanged = updateGeneratedToolingDependencies(packageJson);
+        const changed = modernDependenciesChanged || toolingDependenciesChanged;
+        if (changed) writeJsonFile(packageFile, packageJson);
         else if ('package.json' === relativePackageFile) writeJsonFile(packageFile, packageJson);
     }
+    updateGeneratedPnpmWorkspacePolicy(context.workspaceRoot);
     if (!hasFlag(args, '--skip-install')) {
         const status = runPnpmLockfileRefresh(context);
         if (0 !== status) return status;

package/package.json

@@ -21,7 +21,7 @@
   "engines": {
     "node": ">=20"
   },
-  "version": "3.5.0-ultramodern.2",
+  "version": "3.5.0-ultramodern.4",
   "types": "./dist/types/index.d.ts",
   "main": "./dist/esm-node/index.js",
   "bin": {
@@ -77,7 +77,7 @@
     "@modern-js/codesmith": "2.6.9",
     "oxfmt": "0.56.0",
     "ultracite": "7.8.3",
-    "@modern-js/i18n-utils": "npm:@bleedingdev/modern-js-i18n-utils@3.5.0-ultramodern.2"
+    "@modern-js/i18n-utils": "npm:@bleedingdev/modern-js-i18n-utils@3.5.0-ultramodern.4"
   },
   "devDependencies": {
     "@rslib/core": "0.23.1",
@@ -99,6 +99,6 @@
     "test": "rm -rf dist && rslib build -c rslibconfig.mts && rstest --passWithNoTests"
   },
   "ultramodern": {
-    "frameworkVersion": "3.5.0-ultramodern.2"
+    "frameworkVersion": "3.5.0-ultramodern.4"
   }
 }

package/template-workspace/README.md.handlebars

@@ -169,19 +169,23 @@ in API modules.
 Generated pnpm overrides pin the framework-compatible Effect cohort. Keep
 `effect` and `@effect/vitest` aligned with `pnpm-workspace.yaml`; do not add
 new direct package-level Effect versions unless the whole UltraModern cohort is
-upgraded.
+upgraded. The generated pnpm trust policy intentionally excludes the matching
+`effect` and `@effect/opentelemetry` cohort packages from no-downgrade checks
+while Effect's beta publishes move from trusted-publisher metadata to
+provenance attestations.
 
 For older generated workspaces, run the framework migration command first:
 
 ```bash
-pnpm dlx @bleedingdev/modern-js-create@3.5.0-ultramodern.2 ultramodern \
-  migrate-strict-effect --version 3.5.0-ultramodern.2
+pnpm dlx @bleedingdev/modern-js-create@3.5.0-ultramodern.4 ultramodern \
+  migrate-strict-effect --version 3.5.0-ultramodern.4
 pnpm api:check
 pnpm contract:check
 ```
 
 The command updates generated package-source metadata, Modern package aliases,
-direct API topology metadata, and the lockfile. Remaining failures are source
+framework-owned toolchain pins, direct API topology metadata, strict Effect pnpm
+overrides/trust policy, and the lockfile. Remaining failures are source
 migration work; fix the owning API files instead of adding compatibility shims.
 
 ## Troubleshooting

package/template-workspace/pnpm-workspace.yaml.handlebars

@@ -24,6 +24,9 @@ minimumReleaseAgeExclude:
   - 'ts-checker-rspack-plugin'
 trustPolicy: no-downgrade
 trustPolicyIgnoreAfter: 1440
+trustPolicyExclude:
+  - 'effect@{{effectVersion}}'
+  - '@effect/opentelemetry@{{effectVersion}}'
 blockExoticSubdeps: true
 engineStrict: true
 pmOnFail: error