@commercetools-frontend/create-mc-app 27.6.2 → 27.7.0

package/CHANGELOG.md

@@ -1,5 +1,34 @@
 # @commercetools-frontend/create-mc-app
 
+## 27.7.0
+
+### Patch Changes
+
+- Updated dependencies []:
+  - @commercetools-frontend/application-config@27.7.0
+
+## 27.6.3
+
+### Patch Changes
+
+- [#4019](https://github.com/commercetools/merchant-center-application-kit/pull/4019) [`2bf3322`](https://github.com/commercetools/merchant-center-application-kit/commit/2bf33221525be981c8a03a951bfb6387438624a6) Thanks [@misama-ct](https://github.com/misama-ct)! - Support `workspace:^` and `catalog:` specifiers when scaffolding —
+  previously the CLI only handled `workspace:*`, so apps generated from
+  the latest templates failed to install.
+
+  Scaffolded `package.json` files now pin internal
+  `@commercetools-frontend/*` deps with caret ranges (`^x.y.z`) instead
+  of exact versions. Application Kit packages release in lockstep, so a
+  caret range always resolves to a synchronized set of latest patches —
+  the lockstep invariant is preserved, and subsequent
+  `npm install` / `yarn install` / `pnpm install` runs pick up
+  patch/minor updates automatically.
+
+  `npx create-mc-app …` continues to work against any template version,
+  old or new.
+
+- Updated dependencies []:
+  - @commercetools-frontend/application-config@27.6.3
+
 ## 27.6.2
 
 ### Patch Changes

package/dist/commercetools-frontend-create-mc-app.cjs.dev.js

@@ -9,7 +9,9 @@ var execa = require('execa');
 var semver = require('semver');
 var _Promise = require('@babel/runtime-corejs3/core-js-stable/promise');
 var _startsWithInstanceProperty = require('@babel/runtime-corejs3/core-js-stable/instance/starts-with');
+var _Date$now = require('@babel/runtime-corejs3/core-js-stable/date/now');
 var crypto = require('node:crypto');
+var os = require('node:os');
 var path = require('node:path');
 var readline = require('node:readline');
 var applicationConfig = require('@commercetools-frontend/application-config');
@@ -21,8 +23,6 @@ var fs = require('node:fs');
 var _Object$keys = require('@babel/runtime-corejs3/core-js-stable/object/keys');
 var _includesInstanceProperty = require('@babel/runtime-corejs3/core-js-stable/instance/includes');
 var _Object$values = require('@babel/runtime-corejs3/core-js-stable/object/values');
-var _Date$now = require('@babel/runtime-corejs3/core-js-stable/date/now');
-var os = require('node:os');
 var _Object$getOwnPropertySymbols = require('@babel/runtime-corejs3/core-js-stable/object/get-own-property-symbols');
 var _Object$getOwnPropertyDescriptor = require('@babel/runtime-corejs3/core-js-stable/object/get-own-property-descriptor');
 var _forEachInstanceProperty = require('@babel/runtime-corejs3/core-js-stable/instance/for-each');
@@ -31,10 +31,10 @@ var _Object$defineProperties = require('@babel/runtime-corejs3/core-js-stable/ob
 var _Object$defineProperty = require('@babel/runtime-corejs3/core-js-stable/object/define-property');
 var _defineProperty = require('@babel/runtime-corejs3/helpers/defineProperty');
 var _slicedToArray = require('@babel/runtime-corejs3/helpers/slicedToArray');
-var _reduceInstanceProperty = require('@babel/runtime-corejs3/core-js-stable/instance/reduce');
+var _Map = require('@babel/runtime-corejs3/core-js-stable/map');
 var _Object$entries = require('@babel/runtime-corejs3/core-js-stable/object/entries');
-var _Object$assign = require('@babel/runtime-corejs3/core-js-stable/object/assign');
 var _JSON$stringify = require('@babel/runtime-corejs3/core-js-stable/json/stringify');
+var yaml = require('yaml');
 var core = require('@babel/core');
 var prettier = require('prettier');
 
@@ -45,7 +45,9 @@ var execa__default = /*#__PURE__*/_interopDefault(execa);
 var semver__default = /*#__PURE__*/_interopDefault(semver);
 var _Promise__default = /*#__PURE__*/_interopDefault(_Promise);
 var _startsWithInstanceProperty__default = /*#__PURE__*/_interopDefault(_startsWithInstanceProperty);
+var _Date$now__default = /*#__PURE__*/_interopDefault(_Date$now);
 var crypto__default = /*#__PURE__*/_interopDefault(crypto);
+var os__default = /*#__PURE__*/_interopDefault(os);
 var path__default = /*#__PURE__*/_interopDefault(path);
 var readline__default = /*#__PURE__*/_interopDefault(readline);
 var _trimInstanceProperty__default = /*#__PURE__*/_interopDefault(_trimInstanceProperty);
@@ -56,23 +58,20 @@ var fs__default = /*#__PURE__*/_interopDefault(fs);
 var _Object$keys__default = /*#__PURE__*/_interopDefault(_Object$keys);
 var _includesInstanceProperty__default = /*#__PURE__*/_interopDefault(_includesInstanceProperty);
 var _Object$values__default = /*#__PURE__*/_interopDefault(_Object$values);
-var _Date$now__default = /*#__PURE__*/_interopDefault(_Date$now);
-var os__default = /*#__PURE__*/_interopDefault(os);
 var _Object$getOwnPropertySymbols__default = /*#__PURE__*/_interopDefault(_Object$getOwnPropertySymbols);
 var _Object$getOwnPropertyDescriptor__default = /*#__PURE__*/_interopDefault(_Object$getOwnPropertyDescriptor);
 var _forEachInstanceProperty__default = /*#__PURE__*/_interopDefault(_forEachInstanceProperty);
 var _Object$getOwnPropertyDescriptors__default = /*#__PURE__*/_interopDefault(_Object$getOwnPropertyDescriptors);
 var _Object$defineProperties__default = /*#__PURE__*/_interopDefault(_Object$defineProperties);
 var _Object$defineProperty__default = /*#__PURE__*/_interopDefault(_Object$defineProperty);
-var _reduceInstanceProperty__default = /*#__PURE__*/_interopDefault(_reduceInstanceProperty);
+var _Map__default = /*#__PURE__*/_interopDefault(_Map);
 var _Object$entries__default = /*#__PURE__*/_interopDefault(_Object$entries);
-var _Object$assign__default = /*#__PURE__*/_interopDefault(_Object$assign);
 var _JSON$stringify__default = /*#__PURE__*/_interopDefault(_JSON$stringify);
 var prettier__default = /*#__PURE__*/_interopDefault(prettier);
 
 var pkgJson = {
 	name: "@commercetools-frontend/create-mc-app",
-	version: "27.6.2",
+	version: "27.7.0",
 	description: "Create Merchant Center applications to quickly get up and running",
 	bugs: "https://github.com/commercetools/merchant-center-application-kit/issues",
 	repository: {
@@ -95,21 +94,22 @@ var pkgJson = {
 	module: "dist/commercetools-frontend-create-mc-app.esm.js",
 	bin: "./bin/cli.js",
 	dependencies: {
-		"@babel/core": "^7.22.17",
-		"@babel/runtime": "^7.22.15",
-		"@babel/runtime-corejs3": "^7.22.15",
-		"@commercetools-frontend/application-config": "^27.6.2",
-		"@types/babel__core": "^7.20.1",
-		"@types/semver": "^7.5.1",
-		commander: "^13.1.0",
-		execa: "5.1.1",
-		listr2: "5.0.8",
-		prettier: "2.8.8",
-		semver: "7.7.2"
+		"@babel/core": "catalog:build",
+		"@babel/runtime": "catalog:build",
+		"@babel/runtime-corejs3": "catalog:build",
+		"@commercetools-frontend/application-config": "workspace:^",
+		"@types/babel__core": "catalog:",
+		"@types/semver": "catalog:",
+		commander: "catalog:",
+		execa: "catalog:",
+		listr2: "catalog:",
+		prettier: "catalog:lint",
+		semver: "catalog:",
+		yaml: "catalog:"
 	},
 	devDependencies: {
-		"@tsconfig/node22": "^22.0.0",
-		"@types/prettier": "2.7.3"
+		"@tsconfig/node22": "catalog:",
+		"@types/prettier": "catalog:"
 	},
 	engines: {
 		node: "18.x || 20.x || >=22.0.0"
@@ -345,12 +345,22 @@ async function processOptions(projectDirectoryName, options) {
   const initialProjectKey = await getInitialProjectKey(rl, options);
   const cloudIdentifier = await getCloudIdentifier(rl, options);
   rl.close();
+
+  // Compute the path used by `downloadTemplate` to clone the app-kit repo
+  // here so subsequent tasks (e.g. `updatePackageJson`) can read
+  // pnpm-workspace.yaml from the same checkout to resolve catalog refs.
+  // Branch names with `/` (`feat/foo`) would otherwise create a nested
+  // tmp path and break dirname/basename splits downstream — sanitize them
+  // into the folder name only.
+  const safeBranchSegment = tagOrBranchVersion.replace(/[^A-Za-z0-9._-]/g, '_');
+  const clonedRepositoryPath = path__default["default"].join(os__default["default"].tmpdir(), ['merchant-center-application-kit', '--', safeBranchSegment, '--', _Date$now__default["default"]().toString()].join(''));
   return {
     applicationType: options.applicationType,
     projectDirectoryName,
     projectDirectoryPath,
     templateName,
     tagOrBranchVersion,
+    clonedRepositoryPath,
     entryPointUriPath,
     initialProjectKey,
     cloudIdentifier,
@@ -363,9 +373,9 @@ function downloadTemplate(options) {
   return {
     title: 'Downloading template',
     task: () => {
-      const tmpDir = os__default["default"].tmpdir();
-      const tmpFolderNameForClonedRepository = ['merchant-center-application-kit', '--', options.tagOrBranchVersion, '--', _Date$now__default["default"]().toString()].join('');
-      const clonedRepositoryPath = path__default["default"].join(tmpDir, tmpFolderNameForClonedRepository);
+      const clonedRepositoryPath = options.clonedRepositoryPath;
+      const tmpDir = path__default["default"].dirname(clonedRepositoryPath);
+      const tmpFolderNameForClonedRepository = path__default["default"].basename(clonedRepositoryPath);
       const templateFolderPath = path__default["default"].join(clonedRepositoryPath, options.applicationType === applicationTypes['custom-view'] ? 'custom-views-templates' : 'application-templates', options.templateName);
       return new listr2.Listr([{
         title: `Cloning repository using branch ${options.tagOrBranchVersion}`,
@@ -439,20 +449,120 @@ function installDependencies(options) {
 }
 
 function ownKeys(e, r) { var t = _Object$keys__default["default"](e); if (_Object$getOwnPropertySymbols__default["default"]) { var o = _Object$getOwnPropertySymbols__default["default"](e); r && (o = _filterInstanceProperty__default["default"](o).call(o, function (r) { return _Object$getOwnPropertyDescriptor__default["default"](e, r).enumerable; })), t.push.apply(t, o); } return t; }
-function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var _context2, _context3; var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? _forEachInstanceProperty__default["default"](_context2 = ownKeys(Object(t), !0)).call(_context2, function (r) { _defineProperty(e, r, t[r]); }) : _Object$getOwnPropertyDescriptors__default["default"] ? _Object$defineProperties__default["default"](e, _Object$getOwnPropertyDescriptors__default["default"](t)) : _forEachInstanceProperty__default["default"](_context3 = ownKeys(Object(t))).call(_context3, function (r) { _Object$defineProperty__default["default"](e, r, _Object$getOwnPropertyDescriptor__default["default"](t, r)); }); } return e; }
-const replaceApplicationKitPackageVersionWith = function (releaseVersion) {
-  var _context;
-  let dependencies = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {};
-  return _reduceInstanceProperty__default["default"](_context = _Object$entries__default["default"](dependencies)).call(_context, (updatedDependencies, _ref) => {
-    let _ref2 = _slicedToArray(_ref, 2),
-      dependencyName = _ref2[0],
-      dependencyVersion = _ref2[1];
-    const updatedVersion = dependencyVersion === 'workspace:*' ? releaseVersion : dependencyVersion;
-    return _objectSpread(_objectSpread({}, updatedDependencies), {}, {
-      [dependencyName]: updatedVersion
-    });
-  }, {});
+function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var _context, _context2; var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? _forEachInstanceProperty__default["default"](_context = ownKeys(Object(t), !0)).call(_context, function (r) { _defineProperty(e, r, t[r]); }) : _Object$getOwnPropertyDescriptors__default["default"] ? _Object$defineProperties__default["default"](e, _Object$getOwnPropertyDescriptors__default["default"](t)) : _forEachInstanceProperty__default["default"](_context2 = ownKeys(Object(t))).call(_context2, function (r) { _Object$defineProperty__default["default"](e, r, _Object$getOwnPropertyDescriptor__default["default"](t, r)); }); } return e; }
+
+// Catalog references in workspace package.json files point at entries in
+// pnpm-workspace.yaml. They have to be flattened to concrete version
+// specifiers in the scaffolded app because the scaffolded app is not part
+// of any workspace.
+//
+// Shape: catalogName -> depName -> resolved spec. The default `catalog:`
+// block is keyed as 'default' so `catalog:` and `catalog:<name>` lookups
+// share one code path.
+
+function parseCatalogs(yamlText) {
+  const doc = yaml.parse(yamlText) ?? {};
+  const out = new _Map__default["default"]();
+  if (doc.catalog) {
+    out.set('default', new _Map__default["default"](_Object$entries__default["default"](doc.catalog)));
+  }
+  for (const _ref of _Object$entries__default["default"](doc.catalogs ?? {})) {
+    var _ref2 = _slicedToArray(_ref, 2);
+    const name = _ref2[0];
+    const entries = _ref2[1];
+    out.set(name, new _Map__default["default"](_Object$entries__default["default"](entries)));
+  }
+  return out;
+}
+
+// `workspace:` specifier → rewriter that takes the release version and
+// returns the concrete spec. The supported set is data, not branching
+// logic — extend the table to handle new protocol additions.
+const WORKSPACE_REWRITERS = {
+  'workspace:*': v => v,
+  'workspace:^': v => `^${v}`,
+  'workspace:~': v => `~${v}`
 };
+
+/**
+ * Resolve a `catalog:` / `catalog:<name>` specifier to a concrete version
+ * string by looking it up in the parsed `pnpm-workspace.yaml`.
+ *
+ * @throws {Error} when the named catalog does not exist in the template's
+ *   `pnpm-workspace.yaml`, or when the catalog exists but does not declare
+ *   an entry for `depName`. Both cases mean the scaffold cannot produce a
+ *   valid `package.json` and is unrecoverable — let it propagate.
+ */
+function resolveCatalogRef(spec, depName, catalogs) {
+  // `catalog:` and `catalog:default` both target the default block.
+  const name = spec === 'catalog:' || spec === 'catalog:default' ? 'default' : _sliceInstanceProperty__default["default"](spec).call(spec, 'catalog:'.length);
+  const block = catalogs.get(name);
+  if (!block) {
+    throw new Error(`Unable to resolve catalog reference "${spec}" for "${depName}": catalog "${name}" is not declared in the template's pnpm-workspace.yaml.`);
+  }
+  const resolved = block.get(depName);
+  if (!resolved) {
+    const where = name === 'default' ? 'the default catalog' : `catalogs.${name}`;
+    throw new Error(`Unable to resolve catalog reference "${spec}" for "${depName}": dep is not declared under ${where} in the template's pnpm-workspace.yaml.`);
+  }
+  return resolved;
+}
+function resolveSpec(depName, spec, releaseVersion, catalogs) {
+  const workspaceRewriter = WORKSPACE_REWRITERS[spec];
+  if (workspaceRewriter) return workspaceRewriter(releaseVersion);
+  if (_startsWithInstanceProperty__default["default"](spec).call(spec, 'catalog:')) return resolveCatalogRef(spec, depName, catalogs);
+  return spec;
+}
+function resolveDependencies() {
+  let dependencies = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {};
+  let releaseVersion = arguments.length > 1 ? arguments[1] : undefined;
+  let catalogs = arguments.length > 2 ? arguments[2] : undefined;
+  const out = {};
+  for (const _ref3 of _Object$entries__default["default"](dependencies)) {
+    var _ref4 = _slicedToArray(_ref3, 2);
+    const name = _ref4[0];
+    const spec = _ref4[1];
+    out[name] = resolveSpec(name, spec, releaseVersion, catalogs);
+  }
+  return out;
+}
+
+// Read catalogs from the cloned template repo. Older template tags predate
+// catalog adoption — fall back to an empty map so the workspace-only
+// rewrite path still works.
+function loadCatalogsFromClone(clonedRepositoryPath) {
+  const workspaceYamlPath = path__default["default"].join(clonedRepositoryPath, 'pnpm-workspace.yaml');
+  if (!fs__default["default"].existsSync(workspaceYamlPath)) return new _Map__default["default"]();
+  return parseCatalogs(fs__default["default"].readFileSync(workspaceYamlPath, {
+    encoding: 'utf8'
+  }));
+}
+function buildUpdatedPackageJson(appPackageJson, options, releaseVersion, catalogs) {
+  const packageManager = getPreferredPackageManager(options);
+  // Flatten workspace: and catalog: specifiers into concrete versions across
+  // every dependency section — the scaffolded app is not part of any pnpm
+  // workspace and would otherwise fail to install.
+  const resolve = deps => resolveDependencies(deps, releaseVersion, catalogs);
+  return _objectSpread(_objectSpread(_objectSpread(_objectSpread({}, appPackageJson), {}, {
+    version: '1.0.0',
+    // Given the package name is derived from the `projectDirectoryName`
+    // the latter needs to be sanitised to have a ensure a valid package name.
+    // The `projectDirectoryName` should not have restrictions (e.g. no `_`)
+    // as a result the package name potentially needs to be altered when derived.
+    name: slugify(options.projectDirectoryName),
+    description: '',
+    dependencies: resolve(appPackageJson.dependencies),
+    devDependencies: resolve(appPackageJson.devDependencies)
+  }, appPackageJson.peerDependencies && {
+    peerDependencies: resolve(appPackageJson.peerDependencies)
+  }), appPackageJson.optionalDependencies && {
+    optionalDependencies: resolve(appPackageJson.optionalDependencies)
+  }), {}, {
+    scripts: _objectSpread(_objectSpread({}, appPackageJson.scripts), {}, {
+      'start:prod:local': appPackageJson.scripts['start:prod:local'].replace('yarn', packageManager)
+    })
+  });
+}
 function updatePackageJson(options, releaseVersion) {
   return {
     title: 'Updating package.json',
@@ -461,22 +571,8 @@ function updatePackageJson(options, releaseVersion) {
       const appPackageJson = JSON.parse(fs__default["default"].readFileSync(packageJsonPath, {
         encoding: 'utf8'
       }));
-      const packageManager = getPreferredPackageManager(options);
-      const updatedAppPackageJson = _Object$assign__default["default"]({}, appPackageJson, {
-        version: '1.0.0',
-        // Given the package name is derived from the `projectDirectoryName`
-        // the latter needs to be sanitised to have a ensure a valid package name.
-        // The `projectDirectoryName` should not have restrictions (e.g. no `_`)
-        // as a result the package name potentially needs to be altered when derived.
-        name: slugify(options.projectDirectoryName),
-        description: '',
-        // Replace the package versions with the `workspace:` syntax to the real version.
-        dependencies: replaceApplicationKitPackageVersionWith(releaseVersion, appPackageJson.dependencies),
-        devDependencies: replaceApplicationKitPackageVersionWith(releaseVersion, appPackageJson.devDependencies),
-        scripts: _objectSpread(_objectSpread({}, appPackageJson.scripts), {}, {
-          'start:prod:local': appPackageJson.scripts['start:prod:local'].replace('yarn', packageManager)
-        })
-      });
+      const catalogs = loadCatalogsFromClone(options.clonedRepositoryPath);
+      const updatedAppPackageJson = buildUpdatedPackageJson(appPackageJson, options, releaseVersion, catalogs);
       fs__default["default"].writeFileSync(packageJsonPath, _JSON$stringify__default["default"](updatedAppPackageJson, null, 2) + os__default["default"].EOL, {
         encoding: 'utf8'
       });

package/dist/commercetools-frontend-create-mc-app.cjs.prod.js

@@ -9,7 +9,9 @@ var execa = require('execa');
 var semver = require('semver');
 var _Promise = require('@babel/runtime-corejs3/core-js-stable/promise');
 var _startsWithInstanceProperty = require('@babel/runtime-corejs3/core-js-stable/instance/starts-with');
+var _Date$now = require('@babel/runtime-corejs3/core-js-stable/date/now');
 var crypto = require('node:crypto');
+var os = require('node:os');
 var path = require('node:path');
 var readline = require('node:readline');
 var applicationConfig = require('@commercetools-frontend/application-config');
@@ -21,8 +23,6 @@ var fs = require('node:fs');
 var _Object$keys = require('@babel/runtime-corejs3/core-js-stable/object/keys');
 var _includesInstanceProperty = require('@babel/runtime-corejs3/core-js-stable/instance/includes');
 var _Object$values = require('@babel/runtime-corejs3/core-js-stable/object/values');
-var _Date$now = require('@babel/runtime-corejs3/core-js-stable/date/now');
-var os = require('node:os');
 var _Object$getOwnPropertySymbols = require('@babel/runtime-corejs3/core-js-stable/object/get-own-property-symbols');
 var _Object$getOwnPropertyDescriptor = require('@babel/runtime-corejs3/core-js-stable/object/get-own-property-descriptor');
 var _forEachInstanceProperty = require('@babel/runtime-corejs3/core-js-stable/instance/for-each');
@@ -31,10 +31,10 @@ var _Object$defineProperties = require('@babel/runtime-corejs3/core-js-stable/ob
 var _Object$defineProperty = require('@babel/runtime-corejs3/core-js-stable/object/define-property');
 var _defineProperty = require('@babel/runtime-corejs3/helpers/defineProperty');
 var _slicedToArray = require('@babel/runtime-corejs3/helpers/slicedToArray');
-var _reduceInstanceProperty = require('@babel/runtime-corejs3/core-js-stable/instance/reduce');
+var _Map = require('@babel/runtime-corejs3/core-js-stable/map');
 var _Object$entries = require('@babel/runtime-corejs3/core-js-stable/object/entries');
-var _Object$assign = require('@babel/runtime-corejs3/core-js-stable/object/assign');
 var _JSON$stringify = require('@babel/runtime-corejs3/core-js-stable/json/stringify');
+var yaml = require('yaml');
 var core = require('@babel/core');
 var prettier = require('prettier');
 
@@ -45,7 +45,9 @@ var execa__default = /*#__PURE__*/_interopDefault(execa);
 var semver__default = /*#__PURE__*/_interopDefault(semver);
 var _Promise__default = /*#__PURE__*/_interopDefault(_Promise);
 var _startsWithInstanceProperty__default = /*#__PURE__*/_interopDefault(_startsWithInstanceProperty);
+var _Date$now__default = /*#__PURE__*/_interopDefault(_Date$now);
 var crypto__default = /*#__PURE__*/_interopDefault(crypto);
+var os__default = /*#__PURE__*/_interopDefault(os);
 var path__default = /*#__PURE__*/_interopDefault(path);
 var readline__default = /*#__PURE__*/_interopDefault(readline);
 var _trimInstanceProperty__default = /*#__PURE__*/_interopDefault(_trimInstanceProperty);
@@ -56,23 +58,20 @@ var fs__default = /*#__PURE__*/_interopDefault(fs);
 var _Object$keys__default = /*#__PURE__*/_interopDefault(_Object$keys);
 var _includesInstanceProperty__default = /*#__PURE__*/_interopDefault(_includesInstanceProperty);
 var _Object$values__default = /*#__PURE__*/_interopDefault(_Object$values);
-var _Date$now__default = /*#__PURE__*/_interopDefault(_Date$now);
-var os__default = /*#__PURE__*/_interopDefault(os);
 var _Object$getOwnPropertySymbols__default = /*#__PURE__*/_interopDefault(_Object$getOwnPropertySymbols);
 var _Object$getOwnPropertyDescriptor__default = /*#__PURE__*/_interopDefault(_Object$getOwnPropertyDescriptor);
 var _forEachInstanceProperty__default = /*#__PURE__*/_interopDefault(_forEachInstanceProperty);
 var _Object$getOwnPropertyDescriptors__default = /*#__PURE__*/_interopDefault(_Object$getOwnPropertyDescriptors);
 var _Object$defineProperties__default = /*#__PURE__*/_interopDefault(_Object$defineProperties);
 var _Object$defineProperty__default = /*#__PURE__*/_interopDefault(_Object$defineProperty);
-var _reduceInstanceProperty__default = /*#__PURE__*/_interopDefault(_reduceInstanceProperty);
+var _Map__default = /*#__PURE__*/_interopDefault(_Map);
 var _Object$entries__default = /*#__PURE__*/_interopDefault(_Object$entries);
-var _Object$assign__default = /*#__PURE__*/_interopDefault(_Object$assign);
 var _JSON$stringify__default = /*#__PURE__*/_interopDefault(_JSON$stringify);
 var prettier__default = /*#__PURE__*/_interopDefault(prettier);
 
 var pkgJson = {
 	name: "@commercetools-frontend/create-mc-app",
-	version: "27.6.2",
+	version: "27.7.0",
 	description: "Create Merchant Center applications to quickly get up and running",
 	bugs: "https://github.com/commercetools/merchant-center-application-kit/issues",
 	repository: {
@@ -95,21 +94,22 @@ var pkgJson = {
 	module: "dist/commercetools-frontend-create-mc-app.esm.js",
 	bin: "./bin/cli.js",
 	dependencies: {
-		"@babel/core": "^7.22.17",
-		"@babel/runtime": "^7.22.15",
-		"@babel/runtime-corejs3": "^7.22.15",
-		"@commercetools-frontend/application-config": "^27.6.2",
-		"@types/babel__core": "^7.20.1",
-		"@types/semver": "^7.5.1",
-		commander: "^13.1.0",
-		execa: "5.1.1",
-		listr2: "5.0.8",
-		prettier: "2.8.8",
-		semver: "7.7.2"
+		"@babel/core": "catalog:build",
+		"@babel/runtime": "catalog:build",
+		"@babel/runtime-corejs3": "catalog:build",
+		"@commercetools-frontend/application-config": "workspace:^",
+		"@types/babel__core": "catalog:",
+		"@types/semver": "catalog:",
+		commander: "catalog:",
+		execa: "catalog:",
+		listr2: "catalog:",
+		prettier: "catalog:lint",
+		semver: "catalog:",
+		yaml: "catalog:"
 	},
 	devDependencies: {
-		"@tsconfig/node22": "^22.0.0",
-		"@types/prettier": "2.7.3"
+		"@tsconfig/node22": "catalog:",
+		"@types/prettier": "catalog:"
 	},
 	engines: {
 		node: "18.x || 20.x || >=22.0.0"
@@ -345,12 +345,22 @@ async function processOptions(projectDirectoryName, options) {
   const initialProjectKey = await getInitialProjectKey(rl, options);
   const cloudIdentifier = await getCloudIdentifier(rl, options);
   rl.close();
+
+  // Compute the path used by `downloadTemplate` to clone the app-kit repo
+  // here so subsequent tasks (e.g. `updatePackageJson`) can read
+  // pnpm-workspace.yaml from the same checkout to resolve catalog refs.
+  // Branch names with `/` (`feat/foo`) would otherwise create a nested
+  // tmp path and break dirname/basename splits downstream — sanitize them
+  // into the folder name only.
+  const safeBranchSegment = tagOrBranchVersion.replace(/[^A-Za-z0-9._-]/g, '_');
+  const clonedRepositoryPath = path__default["default"].join(os__default["default"].tmpdir(), ['merchant-center-application-kit', '--', safeBranchSegment, '--', _Date$now__default["default"]().toString()].join(''));
   return {
     applicationType: options.applicationType,
     projectDirectoryName,
     projectDirectoryPath,
     templateName,
     tagOrBranchVersion,
+    clonedRepositoryPath,
     entryPointUriPath,
     initialProjectKey,
     cloudIdentifier,
@@ -363,9 +373,9 @@ function downloadTemplate(options) {
   return {
     title: 'Downloading template',
     task: () => {
-      const tmpDir = os__default["default"].tmpdir();
-      const tmpFolderNameForClonedRepository = ['merchant-center-application-kit', '--', options.tagOrBranchVersion, '--', _Date$now__default["default"]().toString()].join('');
-      const clonedRepositoryPath = path__default["default"].join(tmpDir, tmpFolderNameForClonedRepository);
+      const clonedRepositoryPath = options.clonedRepositoryPath;
+      const tmpDir = path__default["default"].dirname(clonedRepositoryPath);
+      const tmpFolderNameForClonedRepository = path__default["default"].basename(clonedRepositoryPath);
       const templateFolderPath = path__default["default"].join(clonedRepositoryPath, options.applicationType === applicationTypes['custom-view'] ? 'custom-views-templates' : 'application-templates', options.templateName);
       return new listr2.Listr([{
         title: `Cloning repository using branch ${options.tagOrBranchVersion}`,
@@ -439,20 +449,120 @@ function installDependencies(options) {
 }
 
 function ownKeys(e, r) { var t = _Object$keys__default["default"](e); if (_Object$getOwnPropertySymbols__default["default"]) { var o = _Object$getOwnPropertySymbols__default["default"](e); r && (o = _filterInstanceProperty__default["default"](o).call(o, function (r) { return _Object$getOwnPropertyDescriptor__default["default"](e, r).enumerable; })), t.push.apply(t, o); } return t; }
-function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var _context2, _context3; var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? _forEachInstanceProperty__default["default"](_context2 = ownKeys(Object(t), !0)).call(_context2, function (r) { _defineProperty(e, r, t[r]); }) : _Object$getOwnPropertyDescriptors__default["default"] ? _Object$defineProperties__default["default"](e, _Object$getOwnPropertyDescriptors__default["default"](t)) : _forEachInstanceProperty__default["default"](_context3 = ownKeys(Object(t))).call(_context3, function (r) { _Object$defineProperty__default["default"](e, r, _Object$getOwnPropertyDescriptor__default["default"](t, r)); }); } return e; }
-const replaceApplicationKitPackageVersionWith = function (releaseVersion) {
-  var _context;
-  let dependencies = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {};
-  return _reduceInstanceProperty__default["default"](_context = _Object$entries__default["default"](dependencies)).call(_context, (updatedDependencies, _ref) => {
-    let _ref2 = _slicedToArray(_ref, 2),
-      dependencyName = _ref2[0],
-      dependencyVersion = _ref2[1];
-    const updatedVersion = dependencyVersion === 'workspace:*' ? releaseVersion : dependencyVersion;
-    return _objectSpread(_objectSpread({}, updatedDependencies), {}, {
-      [dependencyName]: updatedVersion
-    });
-  }, {});
+function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var _context, _context2; var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? _forEachInstanceProperty__default["default"](_context = ownKeys(Object(t), !0)).call(_context, function (r) { _defineProperty(e, r, t[r]); }) : _Object$getOwnPropertyDescriptors__default["default"] ? _Object$defineProperties__default["default"](e, _Object$getOwnPropertyDescriptors__default["default"](t)) : _forEachInstanceProperty__default["default"](_context2 = ownKeys(Object(t))).call(_context2, function (r) { _Object$defineProperty__default["default"](e, r, _Object$getOwnPropertyDescriptor__default["default"](t, r)); }); } return e; }
+
+// Catalog references in workspace package.json files point at entries in
+// pnpm-workspace.yaml. They have to be flattened to concrete version
+// specifiers in the scaffolded app because the scaffolded app is not part
+// of any workspace.
+//
+// Shape: catalogName -> depName -> resolved spec. The default `catalog:`
+// block is keyed as 'default' so `catalog:` and `catalog:<name>` lookups
+// share one code path.
+
+function parseCatalogs(yamlText) {
+  const doc = yaml.parse(yamlText) ?? {};
+  const out = new _Map__default["default"]();
+  if (doc.catalog) {
+    out.set('default', new _Map__default["default"](_Object$entries__default["default"](doc.catalog)));
+  }
+  for (const _ref of _Object$entries__default["default"](doc.catalogs ?? {})) {
+    var _ref2 = _slicedToArray(_ref, 2);
+    const name = _ref2[0];
+    const entries = _ref2[1];
+    out.set(name, new _Map__default["default"](_Object$entries__default["default"](entries)));
+  }
+  return out;
+}
+
+// `workspace:` specifier → rewriter that takes the release version and
+// returns the concrete spec. The supported set is data, not branching
+// logic — extend the table to handle new protocol additions.
+const WORKSPACE_REWRITERS = {
+  'workspace:*': v => v,
+  'workspace:^': v => `^${v}`,
+  'workspace:~': v => `~${v}`
 };
+
+/**
+ * Resolve a `catalog:` / `catalog:<name>` specifier to a concrete version
+ * string by looking it up in the parsed `pnpm-workspace.yaml`.
+ *
+ * @throws {Error} when the named catalog does not exist in the template's
+ *   `pnpm-workspace.yaml`, or when the catalog exists but does not declare
+ *   an entry for `depName`. Both cases mean the scaffold cannot produce a
+ *   valid `package.json` and is unrecoverable — let it propagate.
+ */
+function resolveCatalogRef(spec, depName, catalogs) {
+  // `catalog:` and `catalog:default` both target the default block.
+  const name = spec === 'catalog:' || spec === 'catalog:default' ? 'default' : _sliceInstanceProperty__default["default"](spec).call(spec, 'catalog:'.length);
+  const block = catalogs.get(name);
+  if (!block) {
+    throw new Error(`Unable to resolve catalog reference "${spec}" for "${depName}": catalog "${name}" is not declared in the template's pnpm-workspace.yaml.`);
+  }
+  const resolved = block.get(depName);
+  if (!resolved) {
+    const where = name === 'default' ? 'the default catalog' : `catalogs.${name}`;
+    throw new Error(`Unable to resolve catalog reference "${spec}" for "${depName}": dep is not declared under ${where} in the template's pnpm-workspace.yaml.`);
+  }
+  return resolved;
+}
+function resolveSpec(depName, spec, releaseVersion, catalogs) {
+  const workspaceRewriter = WORKSPACE_REWRITERS[spec];
+  if (workspaceRewriter) return workspaceRewriter(releaseVersion);
+  if (_startsWithInstanceProperty__default["default"](spec).call(spec, 'catalog:')) return resolveCatalogRef(spec, depName, catalogs);
+  return spec;
+}
+function resolveDependencies() {
+  let dependencies = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {};
+  let releaseVersion = arguments.length > 1 ? arguments[1] : undefined;
+  let catalogs = arguments.length > 2 ? arguments[2] : undefined;
+  const out = {};
+  for (const _ref3 of _Object$entries__default["default"](dependencies)) {
+    var _ref4 = _slicedToArray(_ref3, 2);
+    const name = _ref4[0];
+    const spec = _ref4[1];
+    out[name] = resolveSpec(name, spec, releaseVersion, catalogs);
+  }
+  return out;
+}
+
+// Read catalogs from the cloned template repo. Older template tags predate
+// catalog adoption — fall back to an empty map so the workspace-only
+// rewrite path still works.
+function loadCatalogsFromClone(clonedRepositoryPath) {
+  const workspaceYamlPath = path__default["default"].join(clonedRepositoryPath, 'pnpm-workspace.yaml');
+  if (!fs__default["default"].existsSync(workspaceYamlPath)) return new _Map__default["default"]();
+  return parseCatalogs(fs__default["default"].readFileSync(workspaceYamlPath, {
+    encoding: 'utf8'
+  }));
+}
+function buildUpdatedPackageJson(appPackageJson, options, releaseVersion, catalogs) {
+  const packageManager = getPreferredPackageManager(options);
+  // Flatten workspace: and catalog: specifiers into concrete versions across
+  // every dependency section — the scaffolded app is not part of any pnpm
+  // workspace and would otherwise fail to install.
+  const resolve = deps => resolveDependencies(deps, releaseVersion, catalogs);
+  return _objectSpread(_objectSpread(_objectSpread(_objectSpread({}, appPackageJson), {}, {
+    version: '1.0.0',
+    // Given the package name is derived from the `projectDirectoryName`
+    // the latter needs to be sanitised to have a ensure a valid package name.
+    // The `projectDirectoryName` should not have restrictions (e.g. no `_`)
+    // as a result the package name potentially needs to be altered when derived.
+    name: slugify(options.projectDirectoryName),
+    description: '',
+    dependencies: resolve(appPackageJson.dependencies),
+    devDependencies: resolve(appPackageJson.devDependencies)
+  }, appPackageJson.peerDependencies && {
+    peerDependencies: resolve(appPackageJson.peerDependencies)
+  }), appPackageJson.optionalDependencies && {
+    optionalDependencies: resolve(appPackageJson.optionalDependencies)
+  }), {}, {
+    scripts: _objectSpread(_objectSpread({}, appPackageJson.scripts), {}, {
+      'start:prod:local': appPackageJson.scripts['start:prod:local'].replace('yarn', packageManager)
+    })
+  });
+}
 function updatePackageJson(options, releaseVersion) {
   return {
     title: 'Updating package.json',
@@ -461,22 +571,8 @@ function updatePackageJson(options, releaseVersion) {
       const appPackageJson = JSON.parse(fs__default["default"].readFileSync(packageJsonPath, {
         encoding: 'utf8'
       }));
-      const packageManager = getPreferredPackageManager(options);
-      const updatedAppPackageJson = _Object$assign__default["default"]({}, appPackageJson, {
-        version: '1.0.0',
-        // Given the package name is derived from the `projectDirectoryName`
-        // the latter needs to be sanitised to have a ensure a valid package name.
-        // The `projectDirectoryName` should not have restrictions (e.g. no `_`)
-        // as a result the package name potentially needs to be altered when derived.
-        name: slugify(options.projectDirectoryName),
-        description: '',
-        // Replace the package versions with the `workspace:` syntax to the real version.
-        dependencies: replaceApplicationKitPackageVersionWith(releaseVersion, appPackageJson.dependencies),
-        devDependencies: replaceApplicationKitPackageVersionWith(releaseVersion, appPackageJson.devDependencies),
-        scripts: _objectSpread(_objectSpread({}, appPackageJson.scripts), {}, {
-          'start:prod:local': appPackageJson.scripts['start:prod:local'].replace('yarn', packageManager)
-        })
-      });
+      const catalogs = loadCatalogsFromClone(options.clonedRepositoryPath);
+      const updatedAppPackageJson = buildUpdatedPackageJson(appPackageJson, options, releaseVersion, catalogs);
       fs__default["default"].writeFileSync(packageJsonPath, _JSON$stringify__default["default"](updatedAppPackageJson, null, 2) + os__default["default"].EOL, {
         encoding: 'utf8'
       });

package/dist/commercetools-frontend-create-mc-app.esm.js

@@ -5,7 +5,9 @@ import execa from 'execa';
 import semver from 'semver';
 import _Promise from '@babel/runtime-corejs3/core-js-stable/promise';
 import _startsWithInstanceProperty from '@babel/runtime-corejs3/core-js-stable/instance/starts-with';
+import _Date$now from '@babel/runtime-corejs3/core-js-stable/date/now';
 import crypto from 'node:crypto';
+import os from 'node:os';
 import path from 'node:path';
 import readline from 'node:readline';
 import { CLOUD_IDENTIFIERS } from '@commercetools-frontend/application-config';
@@ -17,8 +19,6 @@ import fs from 'node:fs';
 import _Object$keys from '@babel/runtime-corejs3/core-js-stable/object/keys';
 import _includesInstanceProperty from '@babel/runtime-corejs3/core-js-stable/instance/includes';
 import _Object$values from '@babel/runtime-corejs3/core-js-stable/object/values';
-import _Date$now from '@babel/runtime-corejs3/core-js-stable/date/now';
-import os from 'node:os';
 import _Object$getOwnPropertySymbols from '@babel/runtime-corejs3/core-js-stable/object/get-own-property-symbols';
 import _Object$getOwnPropertyDescriptor from '@babel/runtime-corejs3/core-js-stable/object/get-own-property-descriptor';
 import _forEachInstanceProperty from '@babel/runtime-corejs3/core-js-stable/instance/for-each';
@@ -27,16 +27,16 @@ import _Object$defineProperties from '@babel/runtime-corejs3/core-js-stable/obje
 import _Object$defineProperty from '@babel/runtime-corejs3/core-js-stable/object/define-property';
 import _defineProperty from '@babel/runtime-corejs3/helpers/esm/defineProperty';
 import _slicedToArray from '@babel/runtime-corejs3/helpers/esm/slicedToArray';
-import _reduceInstanceProperty from '@babel/runtime-corejs3/core-js-stable/instance/reduce';
+import _Map from '@babel/runtime-corejs3/core-js-stable/map';
 import _Object$entries from '@babel/runtime-corejs3/core-js-stable/object/entries';
-import _Object$assign from '@babel/runtime-corejs3/core-js-stable/object/assign';
 import _JSON$stringify from '@babel/runtime-corejs3/core-js-stable/json/stringify';
+import { parse } from 'yaml';
 import { transformFileSync, types } from '@babel/core';
 import prettier from 'prettier';
 
 var pkgJson = {
 	name: "@commercetools-frontend/create-mc-app",
-	version: "27.6.2",
+	version: "27.7.0",
 	description: "Create Merchant Center applications to quickly get up and running",
 	bugs: "https://github.com/commercetools/merchant-center-application-kit/issues",
 	repository: {
@@ -59,21 +59,22 @@ var pkgJson = {
 	module: "dist/commercetools-frontend-create-mc-app.esm.js",
 	bin: "./bin/cli.js",
 	dependencies: {
-		"@babel/core": "^7.22.17",
-		"@babel/runtime": "^7.22.15",
-		"@babel/runtime-corejs3": "^7.22.15",
-		"@commercetools-frontend/application-config": "^27.6.2",
-		"@types/babel__core": "^7.20.1",
-		"@types/semver": "^7.5.1",
-		commander: "^13.1.0",
-		execa: "5.1.1",
-		listr2: "5.0.8",
-		prettier: "2.8.8",
-		semver: "7.7.2"
+		"@babel/core": "catalog:build",
+		"@babel/runtime": "catalog:build",
+		"@babel/runtime-corejs3": "catalog:build",
+		"@commercetools-frontend/application-config": "workspace:^",
+		"@types/babel__core": "catalog:",
+		"@types/semver": "catalog:",
+		commander: "catalog:",
+		execa: "catalog:",
+		listr2: "catalog:",
+		prettier: "catalog:lint",
+		semver: "catalog:",
+		yaml: "catalog:"
 	},
 	devDependencies: {
-		"@tsconfig/node22": "^22.0.0",
-		"@types/prettier": "2.7.3"
+		"@tsconfig/node22": "catalog:",
+		"@types/prettier": "catalog:"
 	},
 	engines: {
 		node: "18.x || 20.x || >=22.0.0"
@@ -309,12 +310,22 @@ async function processOptions(projectDirectoryName, options) {
   const initialProjectKey = await getInitialProjectKey(rl, options);
   const cloudIdentifier = await getCloudIdentifier(rl, options);
   rl.close();
+
+  // Compute the path used by `downloadTemplate` to clone the app-kit repo
+  // here so subsequent tasks (e.g. `updatePackageJson`) can read
+  // pnpm-workspace.yaml from the same checkout to resolve catalog refs.
+  // Branch names with `/` (`feat/foo`) would otherwise create a nested
+  // tmp path and break dirname/basename splits downstream — sanitize them
+  // into the folder name only.
+  const safeBranchSegment = tagOrBranchVersion.replace(/[^A-Za-z0-9._-]/g, '_');
+  const clonedRepositoryPath = path.join(os.tmpdir(), ['merchant-center-application-kit', '--', safeBranchSegment, '--', _Date$now().toString()].join(''));
   return {
     applicationType: options.applicationType,
     projectDirectoryName,
     projectDirectoryPath,
     templateName,
     tagOrBranchVersion,
+    clonedRepositoryPath,
     entryPointUriPath,
     initialProjectKey,
     cloudIdentifier,
@@ -327,9 +338,9 @@ function downloadTemplate(options) {
   return {
     title: 'Downloading template',
     task: () => {
-      const tmpDir = os.tmpdir();
-      const tmpFolderNameForClonedRepository = ['merchant-center-application-kit', '--', options.tagOrBranchVersion, '--', _Date$now().toString()].join('');
-      const clonedRepositoryPath = path.join(tmpDir, tmpFolderNameForClonedRepository);
+      const clonedRepositoryPath = options.clonedRepositoryPath;
+      const tmpDir = path.dirname(clonedRepositoryPath);
+      const tmpFolderNameForClonedRepository = path.basename(clonedRepositoryPath);
       const templateFolderPath = path.join(clonedRepositoryPath, options.applicationType === applicationTypes['custom-view'] ? 'custom-views-templates' : 'application-templates', options.templateName);
       return new Listr([{
         title: `Cloning repository using branch ${options.tagOrBranchVersion}`,
@@ -403,20 +414,120 @@ function installDependencies(options) {
 }
 
 function ownKeys(e, r) { var t = _Object$keys(e); if (_Object$getOwnPropertySymbols) { var o = _Object$getOwnPropertySymbols(e); r && (o = _filterInstanceProperty(o).call(o, function (r) { return _Object$getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
-function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var _context2, _context3; var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? _forEachInstanceProperty(_context2 = ownKeys(Object(t), !0)).call(_context2, function (r) { _defineProperty(e, r, t[r]); }) : _Object$getOwnPropertyDescriptors ? _Object$defineProperties(e, _Object$getOwnPropertyDescriptors(t)) : _forEachInstanceProperty(_context3 = ownKeys(Object(t))).call(_context3, function (r) { _Object$defineProperty(e, r, _Object$getOwnPropertyDescriptor(t, r)); }); } return e; }
-const replaceApplicationKitPackageVersionWith = function (releaseVersion) {
-  var _context;
-  let dependencies = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {};
-  return _reduceInstanceProperty(_context = _Object$entries(dependencies)).call(_context, (updatedDependencies, _ref) => {
-    let _ref2 = _slicedToArray(_ref, 2),
-      dependencyName = _ref2[0],
-      dependencyVersion = _ref2[1];
-    const updatedVersion = dependencyVersion === 'workspace:*' ? releaseVersion : dependencyVersion;
-    return _objectSpread(_objectSpread({}, updatedDependencies), {}, {
-      [dependencyName]: updatedVersion
-    });
-  }, {});
+function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var _context, _context2; var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? _forEachInstanceProperty(_context = ownKeys(Object(t), !0)).call(_context, function (r) { _defineProperty(e, r, t[r]); }) : _Object$getOwnPropertyDescriptors ? _Object$defineProperties(e, _Object$getOwnPropertyDescriptors(t)) : _forEachInstanceProperty(_context2 = ownKeys(Object(t))).call(_context2, function (r) { _Object$defineProperty(e, r, _Object$getOwnPropertyDescriptor(t, r)); }); } return e; }
+
+// Catalog references in workspace package.json files point at entries in
+// pnpm-workspace.yaml. They have to be flattened to concrete version
+// specifiers in the scaffolded app because the scaffolded app is not part
+// of any workspace.
+//
+// Shape: catalogName -> depName -> resolved spec. The default `catalog:`
+// block is keyed as 'default' so `catalog:` and `catalog:<name>` lookups
+// share one code path.
+
+function parseCatalogs(yamlText) {
+  const doc = parse(yamlText) ?? {};
+  const out = new _Map();
+  if (doc.catalog) {
+    out.set('default', new _Map(_Object$entries(doc.catalog)));
+  }
+  for (const _ref of _Object$entries(doc.catalogs ?? {})) {
+    var _ref2 = _slicedToArray(_ref, 2);
+    const name = _ref2[0];
+    const entries = _ref2[1];
+    out.set(name, new _Map(_Object$entries(entries)));
+  }
+  return out;
+}
+
+// `workspace:` specifier → rewriter that takes the release version and
+// returns the concrete spec. The supported set is data, not branching
+// logic — extend the table to handle new protocol additions.
+const WORKSPACE_REWRITERS = {
+  'workspace:*': v => v,
+  'workspace:^': v => `^${v}`,
+  'workspace:~': v => `~${v}`
 };
+
+/**
+ * Resolve a `catalog:` / `catalog:<name>` specifier to a concrete version
+ * string by looking it up in the parsed `pnpm-workspace.yaml`.
+ *
+ * @throws {Error} when the named catalog does not exist in the template's
+ *   `pnpm-workspace.yaml`, or when the catalog exists but does not declare
+ *   an entry for `depName`. Both cases mean the scaffold cannot produce a
+ *   valid `package.json` and is unrecoverable — let it propagate.
+ */
+function resolveCatalogRef(spec, depName, catalogs) {
+  // `catalog:` and `catalog:default` both target the default block.
+  const name = spec === 'catalog:' || spec === 'catalog:default' ? 'default' : _sliceInstanceProperty(spec).call(spec, 'catalog:'.length);
+  const block = catalogs.get(name);
+  if (!block) {
+    throw new Error(`Unable to resolve catalog reference "${spec}" for "${depName}": catalog "${name}" is not declared in the template's pnpm-workspace.yaml.`);
+  }
+  const resolved = block.get(depName);
+  if (!resolved) {
+    const where = name === 'default' ? 'the default catalog' : `catalogs.${name}`;
+    throw new Error(`Unable to resolve catalog reference "${spec}" for "${depName}": dep is not declared under ${where} in the template's pnpm-workspace.yaml.`);
+  }
+  return resolved;
+}
+function resolveSpec(depName, spec, releaseVersion, catalogs) {
+  const workspaceRewriter = WORKSPACE_REWRITERS[spec];
+  if (workspaceRewriter) return workspaceRewriter(releaseVersion);
+  if (_startsWithInstanceProperty(spec).call(spec, 'catalog:')) return resolveCatalogRef(spec, depName, catalogs);
+  return spec;
+}
+function resolveDependencies() {
+  let dependencies = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {};
+  let releaseVersion = arguments.length > 1 ? arguments[1] : undefined;
+  let catalogs = arguments.length > 2 ? arguments[2] : undefined;
+  const out = {};
+  for (const _ref3 of _Object$entries(dependencies)) {
+    var _ref4 = _slicedToArray(_ref3, 2);
+    const name = _ref4[0];
+    const spec = _ref4[1];
+    out[name] = resolveSpec(name, spec, releaseVersion, catalogs);
+  }
+  return out;
+}
+
+// Read catalogs from the cloned template repo. Older template tags predate
+// catalog adoption — fall back to an empty map so the workspace-only
+// rewrite path still works.
+function loadCatalogsFromClone(clonedRepositoryPath) {
+  const workspaceYamlPath = path.join(clonedRepositoryPath, 'pnpm-workspace.yaml');
+  if (!fs.existsSync(workspaceYamlPath)) return new _Map();
+  return parseCatalogs(fs.readFileSync(workspaceYamlPath, {
+    encoding: 'utf8'
+  }));
+}
+function buildUpdatedPackageJson(appPackageJson, options, releaseVersion, catalogs) {
+  const packageManager = getPreferredPackageManager(options);
+  // Flatten workspace: and catalog: specifiers into concrete versions across
+  // every dependency section — the scaffolded app is not part of any pnpm
+  // workspace and would otherwise fail to install.
+  const resolve = deps => resolveDependencies(deps, releaseVersion, catalogs);
+  return _objectSpread(_objectSpread(_objectSpread(_objectSpread({}, appPackageJson), {}, {
+    version: '1.0.0',
+    // Given the package name is derived from the `projectDirectoryName`
+    // the latter needs to be sanitised to have a ensure a valid package name.
+    // The `projectDirectoryName` should not have restrictions (e.g. no `_`)
+    // as a result the package name potentially needs to be altered when derived.
+    name: slugify(options.projectDirectoryName),
+    description: '',
+    dependencies: resolve(appPackageJson.dependencies),
+    devDependencies: resolve(appPackageJson.devDependencies)
+  }, appPackageJson.peerDependencies && {
+    peerDependencies: resolve(appPackageJson.peerDependencies)
+  }), appPackageJson.optionalDependencies && {
+    optionalDependencies: resolve(appPackageJson.optionalDependencies)
+  }), {}, {
+    scripts: _objectSpread(_objectSpread({}, appPackageJson.scripts), {}, {
+      'start:prod:local': appPackageJson.scripts['start:prod:local'].replace('yarn', packageManager)
+    })
+  });
+}
 function updatePackageJson(options, releaseVersion) {
   return {
     title: 'Updating package.json',
@@ -425,22 +536,8 @@ function updatePackageJson(options, releaseVersion) {
       const appPackageJson = JSON.parse(fs.readFileSync(packageJsonPath, {
         encoding: 'utf8'
       }));
-      const packageManager = getPreferredPackageManager(options);
-      const updatedAppPackageJson = _Object$assign({}, appPackageJson, {
-        version: '1.0.0',
-        // Given the package name is derived from the `projectDirectoryName`
-        // the latter needs to be sanitised to have a ensure a valid package name.
-        // The `projectDirectoryName` should not have restrictions (e.g. no `_`)
-        // as a result the package name potentially needs to be altered when derived.
-        name: slugify(options.projectDirectoryName),
-        description: '',
-        // Replace the package versions with the `workspace:` syntax to the real version.
-        dependencies: replaceApplicationKitPackageVersionWith(releaseVersion, appPackageJson.dependencies),
-        devDependencies: replaceApplicationKitPackageVersionWith(releaseVersion, appPackageJson.devDependencies),
-        scripts: _objectSpread(_objectSpread({}, appPackageJson.scripts), {}, {
-          'start:prod:local': appPackageJson.scripts['start:prod:local'].replace('yarn', packageManager)
-        })
-      });
+      const catalogs = loadCatalogsFromClone(options.clonedRepositoryPath);
+      const updatedAppPackageJson = buildUpdatedPackageJson(appPackageJson, options, releaseVersion, catalogs);
       fs.writeFileSync(packageJsonPath, _JSON$stringify(updatedAppPackageJson, null, 2) + os.EOL, {
         encoding: 'utf8'
       });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@commercetools-frontend/create-mc-app",
-  "version": "27.6.2",
+  "version": "27.7.0",
   "description": "Create Merchant Center applications to quickly get up and running",
   "bugs": "https://github.com/commercetools/merchant-center-application-kit/issues",
   "repository": {
@@ -26,14 +26,15 @@
     "@babel/core": "^7.22.17",
     "@babel/runtime": "^7.22.15",
     "@babel/runtime-corejs3": "^7.22.15",
-    "@commercetools-frontend/application-config": "^27.6.2",
     "@types/babel__core": "^7.20.1",
     "@types/semver": "^7.5.1",
     "commander": "^13.1.0",
     "execa": "5.1.1",
     "listr2": "5.0.8",
     "prettier": "2.8.8",
-    "semver": "7.7.2"
+    "semver": "7.7.2",
+    "yaml": "^2.6.1",
+    "@commercetools-frontend/application-config": "^27.7.0"
   },
   "devDependencies": {
     "@tsconfig/node22": "^22.0.0",

package/src/process-options.ts

@@ -1,4 +1,5 @@
 import crypto from 'node:crypto';
+import os from 'node:os';
 import path from 'node:path';
 import readline, { type Interface } from 'node:readline';
 import { CLOUD_IDENTIFIERS } from '@commercetools-frontend/application-config';
@@ -118,12 +119,31 @@ async function processOptions(
   const cloudIdentifier = await getCloudIdentifier(rl, options);
   rl.close();
 
+  // Compute the path used by `downloadTemplate` to clone the app-kit repo
+  // here so subsequent tasks (e.g. `updatePackageJson`) can read
+  // pnpm-workspace.yaml from the same checkout to resolve catalog refs.
+  // Branch names with `/` (`feat/foo`) would otherwise create a nested
+  // tmp path and break dirname/basename splits downstream — sanitize them
+  // into the folder name only.
+  const safeBranchSegment = tagOrBranchVersion.replace(/[^A-Za-z0-9._-]/g, '_');
+  const clonedRepositoryPath = path.join(
+    os.tmpdir(),
+    [
+      'merchant-center-application-kit',
+      '--',
+      safeBranchSegment,
+      '--',
+      Date.now().toString(),
+    ].join('')
+  );
+
   return {
     applicationType: options.applicationType,
     projectDirectoryName,
     projectDirectoryPath,
     templateName,
     tagOrBranchVersion,
+    clonedRepositoryPath,
     entryPointUriPath,
     initialProjectKey,
     cloudIdentifier,

package/src/tasks/download-template.ts

@@ -1,4 +1,3 @@
-import os from 'node:os';
 import path from 'node:path';
 import execa from 'execa';
 import { Listr, type ListrTask } from 'listr2';
@@ -13,18 +12,10 @@ function downloadTemplate(options: TCliTaskOptions): ListrTask {
   return {
     title: 'Downloading template',
     task: () => {
-      const tmpDir = os.tmpdir();
-      const tmpFolderNameForClonedRepository = [
-        'merchant-center-application-kit',
-        '--',
-        options.tagOrBranchVersion,
-        '--',
-        Date.now().toString(),
-      ].join('');
-      const clonedRepositoryPath = path.join(
-        tmpDir,
-        tmpFolderNameForClonedRepository
-      );
+      const clonedRepositoryPath = options.clonedRepositoryPath;
+      const tmpDir = path.dirname(clonedRepositoryPath);
+      const tmpFolderNameForClonedRepository =
+        path.basename(clonedRepositoryPath);
       const templateFolderPath = path.join(
         clonedRepositoryPath,
         options.applicationType === applicationTypes['custom-view']

package/src/tasks/update-package-json.ts

@@ -2,26 +2,169 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import type { ListrTask } from 'listr2';
+import { parse as parseYaml } from 'yaml';
 import type { TCliTaskOptions } from '../types';
 import { getPreferredPackageManager, slugify } from '../utils';
 
-const replaceApplicationKitPackageVersionWith = (
+// Catalog references in workspace package.json files point at entries in
+// pnpm-workspace.yaml. They have to be flattened to concrete version
+// specifiers in the scaffolded app because the scaffolded app is not part
+// of any workspace.
+//
+// Shape: catalogName -> depName -> resolved spec. The default `catalog:`
+// block is keyed as 'default' so `catalog:` and `catalog:<name>` lookups
+// share one code path.
+type Catalogs = Map<string, Map<string, string>>;
+
+type WorkspaceYaml = {
+  catalog?: Record<string, string>;
+  catalogs?: Record<string, Record<string, string>>;
+};
+
+function parseCatalogs(yamlText: string): Catalogs {
+  const doc = (parseYaml(yamlText) ?? {}) as WorkspaceYaml;
+  const out: Catalogs = new Map();
+  if (doc.catalog) {
+    out.set('default', new Map(Object.entries(doc.catalog)));
+  }
+  for (const [name, entries] of Object.entries(doc.catalogs ?? {})) {
+    out.set(name, new Map(Object.entries(entries)));
+  }
+  return out;
+}
+
+// `workspace:` specifier → rewriter that takes the release version and
+// returns the concrete spec. The supported set is data, not branching
+// logic — extend the table to handle new protocol additions.
+const WORKSPACE_REWRITERS: Record<string, (releaseVersion: string) => string> =
+  {
+    'workspace:*': (v) => v,
+    'workspace:^': (v) => `^${v}`,
+    'workspace:~': (v) => `~${v}`,
+  };
+
+/**
+ * Resolve a `catalog:` / `catalog:<name>` specifier to a concrete version
+ * string by looking it up in the parsed `pnpm-workspace.yaml`.
+ *
+ * @throws {Error} when the named catalog does not exist in the template's
+ *   `pnpm-workspace.yaml`, or when the catalog exists but does not declare
+ *   an entry for `depName`. Both cases mean the scaffold cannot produce a
+ *   valid `package.json` and is unrecoverable — let it propagate.
+ */
+function resolveCatalogRef(
+  spec: string,
+  depName: string,
+  catalogs: Catalogs
+): string {
+  // `catalog:` and `catalog:default` both target the default block.
+  const name =
+    spec === 'catalog:' || spec === 'catalog:default'
+      ? 'default'
+      : spec.slice('catalog:'.length);
+  const block = catalogs.get(name);
+  if (!block) {
+    throw new Error(
+      `Unable to resolve catalog reference "${spec}" for "${depName}": catalog "${name}" is not declared in the template's pnpm-workspace.yaml.`
+    );
+  }
+  const resolved = block.get(depName);
+  if (!resolved) {
+    const where =
+      name === 'default' ? 'the default catalog' : `catalogs.${name}`;
+    throw new Error(
+      `Unable to resolve catalog reference "${spec}" for "${depName}": dep is not declared under ${where} in the template's pnpm-workspace.yaml.`
+    );
+  }
+  return resolved;
+}
+
+function resolveSpec(
+  depName: string,
+  spec: string,
   releaseVersion: string,
-  dependencies: Record<string, string> = {}
-) =>
-  Object.entries(dependencies).reduce(
-    (updatedDependencies, [dependencyName, dependencyVersion]) => {
-      const updatedVersion =
-        dependencyVersion === 'workspace:*'
-          ? releaseVersion
-          : dependencyVersion;
-      return {
-        ...updatedDependencies,
-        [dependencyName]: updatedVersion,
-      };
-    },
-    {}
+  catalogs: Catalogs
+): string {
+  const workspaceRewriter = WORKSPACE_REWRITERS[spec];
+  if (workspaceRewriter) return workspaceRewriter(releaseVersion);
+  if (spec.startsWith('catalog:'))
+    return resolveCatalogRef(spec, depName, catalogs);
+  return spec;
+}
+
+function resolveDependencies(
+  dependencies: Record<string, string> = {},
+  releaseVersion: string,
+  catalogs: Catalogs
+): Record<string, string> {
+  const out: Record<string, string> = {};
+  for (const [name, spec] of Object.entries(dependencies)) {
+    out[name] = resolveSpec(name, spec, releaseVersion, catalogs);
+  }
+  return out;
+}
+
+// Read catalogs from the cloned template repo. Older template tags predate
+// catalog adoption — fall back to an empty map so the workspace-only
+// rewrite path still works.
+function loadCatalogsFromClone(clonedRepositoryPath: string): Catalogs {
+  const workspaceYamlPath = path.join(
+    clonedRepositoryPath,
+    'pnpm-workspace.yaml'
   );
+  if (!fs.existsSync(workspaceYamlPath)) return new Map();
+  return parseCatalogs(
+    fs.readFileSync(workspaceYamlPath, { encoding: 'utf8' })
+  );
+}
+
+type TAppPackageJson = {
+  dependencies?: Record<string, string>;
+  devDependencies?: Record<string, string>;
+  peerDependencies?: Record<string, string>;
+  optionalDependencies?: Record<string, string>;
+  scripts: Record<string, string> & { 'start:prod:local': string };
+  [key: string]: unknown;
+};
+
+function buildUpdatedPackageJson(
+  appPackageJson: TAppPackageJson,
+  options: TCliTaskOptions,
+  releaseVersion: string,
+  catalogs: Catalogs
+): TAppPackageJson {
+  const packageManager = getPreferredPackageManager(options);
+  // Flatten workspace: and catalog: specifiers into concrete versions across
+  // every dependency section — the scaffolded app is not part of any pnpm
+  // workspace and would otherwise fail to install.
+  const resolve = (deps?: Record<string, string>) =>
+    resolveDependencies(deps, releaseVersion, catalogs);
+  return {
+    ...appPackageJson,
+    version: '1.0.0',
+    // Given the package name is derived from the `projectDirectoryName`
+    // the latter needs to be sanitised to have a ensure a valid package name.
+    // The `projectDirectoryName` should not have restrictions (e.g. no `_`)
+    // as a result the package name potentially needs to be altered when derived.
+    name: slugify(options.projectDirectoryName),
+    description: '',
+    dependencies: resolve(appPackageJson.dependencies),
+    devDependencies: resolve(appPackageJson.devDependencies),
+    ...(appPackageJson.peerDependencies && {
+      peerDependencies: resolve(appPackageJson.peerDependencies),
+    }),
+    ...(appPackageJson.optionalDependencies && {
+      optionalDependencies: resolve(appPackageJson.optionalDependencies),
+    }),
+    scripts: {
+      ...appPackageJson.scripts,
+      'start:prod:local': appPackageJson.scripts['start:prod:local'].replace(
+        'yarn',
+        packageManager
+      ),
+    },
+  };
+}
 
 function updatePackageJson(
   options: TCliTaskOptions,
@@ -37,33 +180,13 @@ function updatePackageJson(
       const appPackageJson = JSON.parse(
         fs.readFileSync(packageJsonPath, { encoding: 'utf8' })
       );
-      const packageManager = getPreferredPackageManager(options);
-
-      const updatedAppPackageJson = Object.assign({}, appPackageJson, {
-        version: '1.0.0',
-        // Given the package name is derived from the `projectDirectoryName`
-        // the latter needs to be sanitised to have a ensure a valid package name.
-        // The `projectDirectoryName` should not have restrictions (e.g. no `_`)
-        // as a result the package name potentially needs to be altered when derived.
-        name: slugify(options.projectDirectoryName),
-        description: '',
-        // Replace the package versions with the `workspace:` syntax to the real version.
-        dependencies: replaceApplicationKitPackageVersionWith(
-          releaseVersion,
-          appPackageJson.dependencies
-        ),
-        devDependencies: replaceApplicationKitPackageVersionWith(
-          releaseVersion,
-          appPackageJson.devDependencies
-        ),
-        scripts: {
-          ...appPackageJson.scripts,
-          'start:prod:local': appPackageJson.scripts[
-            'start:prod:local'
-          ].replace('yarn', packageManager),
-        },
-      });
-
+      const catalogs = loadCatalogsFromClone(options.clonedRepositoryPath);
+      const updatedAppPackageJson = buildUpdatedPackageJson(
+        appPackageJson,
+        options,
+        releaseVersion,
+        catalogs
+      );
       fs.writeFileSync(
         packageJsonPath,
         JSON.stringify(updatedAppPackageJson, null, 2) + os.EOL,

package/src/types.ts

@@ -26,6 +26,10 @@ export type TCliTaskOptions = {
   projectDirectoryPath: string;
   templateName: TCliCommandOptions['template'];
   tagOrBranchVersion: string;
+  // Absolute path to the temporary directory where the app-kit repo is
+  // cloned by `downloadTemplate`. Subsequent tasks read pnpm-workspace.yaml
+  // from here to resolve catalog references in the scaffolded package.json.
+  clonedRepositoryPath: string;
   entryPointUriPath?: string;
   initialProjectKey: string;
   cloudIdentifier: string;