@icebreakers/monorepo-templates 2.1.0 → 2.2.1

package/assets/.agents/skills/repoctl/SKILL.md

@@ -29,6 +29,7 @@ pnpm exec repo doctor
 | User intent              | `--templates` key  |
 | ------------------------ | ------------------ |
 | Vue / full-stack web app | `vue-hono`         |
+| React SSR / App Router   | `next`             |
 | API / Hono service       | `hono-server`      |
 | TypeScript library / SDK | `tsdown`           |
 | Vue component library    | `vue-lib`          |
@@ -66,3 +67,4 @@ pnpm exec repo check
 - `references/templates.md` for template keys and `repo new` flags.
 - `references/commands.md` for other CLI commands.
 - `references/config.md` for `repoctl.config.ts`.
+- `references/knip.md` for explicit unused-code checks and reviewed baselines.

package/assets/.agents/skills/repoctl/references/commands.md

@@ -28,20 +28,44 @@ Usage:
 
 ## check
 
+Explicit unused-code/dependency analysis is available through `repo check knip`.
+See [Optional Knip checks](./knip.md) before enabling native analysis or saving a baseline.
+
 Purpose: run recommended local checks.
 Usage:
 
 - npx repoctl check
 - npx repoctl check --staged
 - npx repoctl check --full
+- npx repoctl check --affected --base origin/main --head HEAD --json
+- npx repoctl check --affected --filter @acme/web --report reports/affected.json
 - npx repoctl check --dry-run
 - npx repoctl check --json --out reports/check-plan.json
+- npx repoctl check --full --report reports/check-result.json --redact
+- npx repoctl check --full --report reports/check-result.md --report-format markdown
   Notes:
 - default mode runs the lightweight local verification flow
+- `--affected` selects changed packages and consumers, using merge-base plus the current working tree.
+  Missing history, manifest/global input changes and unresolved graph diagnostics explicitly fall back
+  to full checks. `--filter` intersects exact names/directories; `--global-input` adds globs.
+  Both flags are repeatable. Execution uses build, lint, typecheck, tsd, test order; build includes
+  dependency prerequisites and pnpm controls package ordering. Plans explain files, paths and skips.
+  Existing preview flags remain read-only; reports embed the same model as `affectedPlan`.
+  Affected mode cannot combine with full, staged or edit-file. Root scripts implement full fallback
+  where available; explicit filters limit fallback checks too. See tasks/checks for global input rules.
 - `--staged` adds staged typecheck routing
-- `--full` maps to the heavier pre-push verification flow
+- `--full` runs the existing root lint, typecheck, test and build scripts
 - `--dry-run` previews the verification route without running checks
 - `--json` and `--out <file>` emit the same plan for automation and imply dry-run
+- `--report <file>` executes checks and writes versioned results separately from live logs;
+  `--report-format` accepts `json` (default) or `markdown`. It cannot be combined with preview flags.
+- Reports preserve failures, skipped tasks and graceful signal interruptions, with timestamps,
+  duration, exit code and actual command arguments. `--redact` replaces cwd/home prefixes.
+  Environment values and child output are not persisted. Abrupt termination cannot guarantee a report.
+
+## check cache
+
+`repo check cache <current-summary.json> [previous-summary.json] --json` analyzes existing Turbo run summaries without running tasks or mutating caches. Use `--markdown` and redirect stdout for a CI artifact; `--slowest` accepts 1–100. Schema 1 compares stable task IDs and digested input/global/dependency/environment/configuration evidence. Missing evidence or unsupported schemas remain unknown; cache misses are not assigned a speculative cause. Actual durations and a verifiable dependency critical path are reported separately from observed wall span. Environment values and commands never appear in output. Parent execution and file-output flags are rejected; regular check JSON remains preview-only.
 
 ## doctor
 
@@ -56,8 +80,35 @@ Usage:
 - `--json` emits the structured report only and still exits non-zero when blocking failures exist
 - `--out <file>` persists the text or JSON report and still exits non-zero when blocking failures exist
 
+```bash
+repo doctor --list-rules
+repo doctor --rules root-scripts,package-manager --strict
+repo doctor --rules root-scripts --fix --out plans/doctor-fix.json
+repo doctor --apply plans/doctor-fix.json --json
+```
+
+`--rules` selects exact stable check IDs before execution; unknown IDs fail and list the available rules. The CLI replaces `commands.doctor.rules`; omitted rules run all checks, while an explicit empty config array runs none. Shared discovery and rule prerequisites still run. `manifest-health` is an aggregate over the static manifest checks. Workspace boundaries and dependency admission use stable `boundary-*` / `admission-*` IDs; selecting only `boundary-policy` or `admission-policy` preserves the actual aggregate failure status, and prerequisite configuration failures remain visible. Custom policy names appear only in diagnostic details.
+
+Configure reasoned waivers under `commands.doctor.suppressions`. Each item needs `id` and a nonempty `reason`; optional `path` matches an exact workspace-relative finding path. Optional `expires` is an inclusive UTC date (`YYYY-MM-DD`). JSON retains the original finding status, `suppression`, `rawSummary`, and every waiver with its matched count. Only active waivers are excluded from effective `summary` and strict exit status; expired and unmatched waivers remain visible.
+
+`repo templates drift --json` diagnoses registered instance and trustworthy root asset baselines without modifying them. Versions, local modifications/deletions and missing evidence are independent. Defaults use installed metadata offline; `--source-dir` reads an extracted package, and explicit `--remote` queries public npm. Remote failures remain unknown. `--markdown --out <file>` writes a report without business file bodies. Persistent exclusions are not read, and unowned additions are ignored. Reuse doctor suppressions; `--strict` fails on remaining warnings. Select `template-version-evidence`, `template-instance-registry`, `template-instance-baseline`, `template-instance-version`, `template-instance-drift`, `root-asset-registry`, `root-asset-version` or `root-asset-drift` with doctor rules.
+
+`--fix` previews JSON without modifying project files. Only missing `repo:init`, `repo:new`, `repo:check`, and `repo:doctor` keys in the root `package.json` are supported. Existing values, including empty/custom scripts, are preserved for manual review. An actively suppressed or unselected rule produces no fix. Review the additions, complete before/after content, hashes, risk, and diff before using `--apply`. Plans contain original manifest content and cannot be redacted or rendered as Markdown for execution.
+
+Apply checks the canonical workspace and original file contents, rejects links and modified operations, reuses the staged file transaction with rollback, and reruns the root-script check without suppression. A changed input stops the fix; regenerate the plan. Reapplying an already applied plan is unchanged. Textual `fix` suggestions are never executed, and dependency installation or release workflow modification is outside this fixer.
+
+Doctor fix application holds `.repoctl/doctor-fix.lock` through validation, verification, rollback and cleanup. After a crash, confirm no writer remains and reconcile backups before manually removing the lock.
+
 ## upgrade
 
+Preview the complete operation with `repo upgrade --dry-run`, `--json` or `--markdown`; these modes never write or prepare missing assets. Save JSON and review every add/modify/delete/skip/conflict before `repo upgrade --apply <plan.json>`. Plans contain exact bytes and input hashes, including semantic merges and legacy prerelease metadata migration. Application rejects stale inputs, keeps migration groups together and rolls back recoverable failures. Retained `.repoctl-upgrade-*.bak` originals support manual recovery after interruption or a concurrent edit. `--no-overwrite` protects existing assets and legacy metadata; custom release workflows still require `--overwrite-release`. Public APIs: `planUpgrade`, `formatUpgradePlan`, `applyUpgradePlan`, and `upgradeMonorepo({ dryRun: true })`.
+
+Root assets use old-upstream/local/new-upstream three-way merging. Commit `.repoctl/baselines/root/` to preserve the upstream records across clones; record updates are reviewed in each file's `baseline` plan entry and applied atomically with that file. Independent changes merge automatically, while conflicting files and their baselines stay unchanged. Local deletion is never undone. API results expose unresolved `conflicts`; CLI preview and apply exit with code 1 when conflicts remain. Saved plans are reviewed write payloads; their hashes detect stale inputs and inconsistent content, not authorship. Generated app/package directories are outside this feature.
+
+Upgrade apply holds `.repoctl/upgrade.lock` through validation, no-op detection, writes, rollback and cleanup. It never removes colliding recovery files, changed recovery bytes or replacement directories. After an interruption, confirm no writer is active and recover retained backups before removing the lock and regenerating the plan.
+
+Versioned migrations appear in `migrations` with stable IDs and affected files. The Changesets-to-pnpm migration starts at template 1.1.0. Use `--from-version <exact-semver>` only when the old version is known; dependency ranges are not version evidence. Unknown sources adopt only recognized legacy formats. Commit `.repoctl/migrations/ledger.json` when created; its cursor covers migrations, not all assets. Preview writes nothing. Pending/failed bytes and completed diffs are reviewed together; migration groups cannot be split, and completed is written only at the end of a successful migration transaction. Re-preview pending/failed attempts to see already-applied versus remaining files; third-state local edits block recovery and retain attempt-specific backups. The shared `.repoctl/upgrade.lock` is never stolen by age; confirm no writer is active and recover pending backups before clearing it. Recovery performs no network/publish actions or historical script execution.
+
 Purpose: sync repo assets and scripts into the workspace.
 Usage:
 
@@ -69,12 +120,29 @@ Usage:
 - --core: sync core config only (skip GitHub assets)
 - --outDir <dir>: write to another directory
 - --skip-overwrite: never overwrite existing files
+- --overwrite: explicitly replace differing managed assets and adopt the new upstream baseline
 - --overwrite-release: explicitly replace an unmarked custom release workflow
 
-For the first migration of an existing project, bootstrap with
-`pnpm dlx repoctl@latest upgrade --yes`. Managed and official legacy release
-workflows are migrated automatically; unmarked custom workflows are preserved
-unless `--overwrite-release` is supplied.
+For the first migration of an existing project, preview with
+`pnpm dlx repoctl@latest upgrade --json`. A differing asset without a historical
+baseline remains a `baseline-missing` conflict, including a legacy release
+workflow. Review an explicit `--overwrite --json` plan before applying it;
+`--yes` alone does not resolve conflicts. Unmarked custom release workflows
+remain protected unless `--overwrite-release` is supplied.
+
+## release plan and branch mapping
+
+Use `repo release plan --branch 1.x --json` to inspect native versions before consuming intents.
+`commands.release.branches` maps a primary `stable` branch (default `main`), bounded non-overlapping
+`maintenance: [{ branch, range, tag }]`, and optional `prerelease: [{ branch, lane, tag, target }]`.
+Stable and maintenance use pnpm's `main` lane; `branchRule` reports the Git branch, native lane,
+allowed range, maintenance exclusions, npm dist-tag and target. Private versions are not publication
+candidates. Maintenance ranges apply to every public package; latest excludes those ranges.
+Names and tags must be unique; use `legacy-1`, not a SemVer-like npm tag. `snapshot-` is reserved.
+Preview/apply `repo upgrade` after configuration changes to synchronize managed workflow branches.
+Preparation, PR base, publish tag and original-source recovery all use the selected rule. Recovery
+SHA must belong to `origin/<selected-branch>`. `pre exit` returns the target lane and reports the
+stable/maintenance branch without switching Git branches.
 
 ## release ci
 
@@ -127,6 +195,43 @@ Usage:
 - --include-root: include the workspace root package
 - --pattern <glob>: add custom workspace globs; repeatable
 
+## workspace graph / why / impact
+
+Purpose: inspect read-only manifest dependency relationships using one stable graph model.
+Usage:
+
+- npx repoctl workspace graph --json --redact
+- npx repoctl workspace graph --mermaid
+- npx repoctl workspace graph --package @acme/shared --type dependencies
+- npx repoctl workspace why @acme/web @acme/shared --json
+- npx repoctl workspace impact @acme/shared --direct --json
+
+Private packages are included by default; use `--exclude-private` or `--include-root` to adjust discovery.
+`--type` can be repeated with dependencies, devDependencies, peerDependencies or optionalDependencies.
+Graph package filters retain the selected nodes and their direct incoming/outgoing relationships.
+Why returns one deterministic shortest path; impact returns reverse reachability and minimum distances.
+Names must be unambiguous; `./packages/name` explicitly selects a directory. Cycles are safe.
+Workspace aliases/ranges and local paths resolve internally; ordinary semver/npm aliases only connect
+when the local version matches. This does not resolve lockfiles, catalogs, registry tags or source imports.
+Edges distinguish workspace/local references from semver candidates through `resolution`.
+Catalogs and unsupported specifiers with local candidates retain `unresolved_specifier` diagnostics;
+inspect diagnostics before treating the graph as complete or computing affected checks.
+JSON has schema version 1, stable directory IDs and unresolved/ambiguous reference diagnostics.
+Mermaid uses the same graph. Queries do not write files; JSON and Mermaid flags are mutually exclusive.
+
+## deps catalog check / plan / apply
+
+Inspect default/named catalog references, missing or unused entries, direct-version bypasses,
+and migration candidates with `repo deps catalog check --json`. Integrity checks cover all catalogs;
+`--catalog <name>` selects the policy for direct declarations and migration candidates.
+
+Preview one dependency section/cohort with
+`repo deps catalog plan <dependency> --section devDependencies --json > catalog-plan.json`,
+review the linked YAML/manifest changes, then run `repo deps catalog apply catalog-plan.json`.
+`--catalog`, `--group` and `--to` choose a named catalog, configured cohort and explicit common
+subrange. Planning never writes; apply rejects stale inputs and preserves peer ranges.
+See [dependency governance](./dependencies.md) for migration boundaries and pnpm verification.
+
 ## tooling init (alias: tg init)
 
 Purpose: generate tooling config files plus matching devDependencies.
@@ -142,17 +247,55 @@ Usage:
 - Built-in tooling targets: commitlint, eslint, stylelint, lint-staged, tsconfig, vitest
 - Generated files also update root package.json devDependencies
 
+## tooling devcontainer
+
+Preview an optional root Dev Container with `repo tooling devcontainer --json --out ../plan.json`, review it, then apply with `repo tooling devcontainer --apply ../plan.json`. Preview and application never start Docker or install dependencies. Existing custom configuration blocks application and stays unchanged; a fully applied plan replays without writes. Root engines.node and an exact pnpm packageManager are required. `--node-version` selects an exact compatible Node image version. Start the container explicitly with the Dev Containers extension or CLI. Its setup enables Corepack, checks the exact pnpm version and installs with a frozen lockfile when present. The non-root node user and an external pnpm store volume are configured; customize forwardPorts for the app. Do not add a business package for this preset.
+
+## workspace move
+
+Use `workspace move <exact-name-or-./directory> --to <relative-directory> --name <npm-name> --json` to preview moving, renaming, or both; either option may be omitted. Save the plan outside the target and review consumers, before/after files, blockers and file/line manual tasks. It updates manifest dependencies/aliases/metadata, workspace patterns and explicit supported TypeScript paths while preserving source code. Git-tracked text scanning is bounded, not complete import analysis; resolve manual source/configuration tasks before building. Dirty targets/updated files, existing destinations, duplicate names, symlinks in ancestry, nested workspaces/repos and stale inputs are blocked. Apply only the saved plan with `workspace move --apply <plan.json>`. Failures preserve concurrent edits and report retained recovery files; committed cleanup failures return `cleanupPending`. Run explicit lockfile-only/frozen pnpm installs and affected checks afterward. Published-package renames create a new npm identity; never publish or deprecate as a side effect.
+
+## workspace remove
+
+For removal of one specific existing package, prefer `workspace remove <exact-name-or-./directory> --json`. It always previews, including root/private/transitive consumers. Save the JSON outside the selected directory. Consumers block by default; `--remove-references` plans only exact manifest dependency fields and matching metadata. Review source/configuration candidates manually: the scan covers only Git-tracked text literal matches and is not an exhaustive import analysis. Git HEAD and a clean selected directory are required; ignored files are inventoried. Root/outside/linked/nested-workspace boundaries and uncertain dependency relationships cannot be forced. Apply only a reviewed plan with `workspace remove --apply <plan.json>`. The `.repoctl/workspace-remove.lock` serializes replay checks through verification, rollback and cleanup; after interruption, verify no writer is active and recover retained originals before removing it. Before commit, failures restore manifests and the directory when safe, preserving concurrent edits and reporting recovery paths; after commit, `cleanupPending` reports retained operation files. Run `pnpm install --lockfile-only`, `pnpm install --frozen-lockfile`, workspace checks, and review Git diff explicitly afterward. Do not hand-edit the lockfile or remove user documentation/global skills.
+
 ## workspace clean (alias: ws clean)
 
-Purpose: remove selected packages and update the repo helper package version.
-Usage:
+Remove explicitly selected workspace package directories. Nothing is preselected.
+Empty selection or cancelling the prompt changes no files. Repository docs,
+`.qoder`, and global agent skills are not added to the selection or removed as
+cleanup side effects.
+Clean configuration is read from the workspace root, including when invoked from
+a package subdirectory.
 
-- npx repoctl workspace clean
-- npx repoctl ws clean
-  Options:
-- --yes: auto confirm
-- --include-private
-- --pinned-version <version>
+See also `deps check`, `deps plan` and `deps apply` in [Dependency consistency](./dependencies.md) for version policy and reviewed manifest changes.
+
+```bash
+pnpm exec repo workspace clean --dry-run
+pnpm exec repo workspace clean --yes --dry-run
+pnpm exec repo workspace clean --yes
+```
+
+- `--yes` selects all eligible packages after `ignorePackages` and private-package filtering.
+- `--dry-run` prints a JSON plan with `deletions` and every root `package.json`
+  dependency change; it does not write a report file or modify the workspace.
+- `--include-private` overrides `commands.clean.includePrivate: false`.
+  Private packages are included by default for compatibility.
+- `--pinned-version <version>` explicitly replaces `devDependencies.repoctl`.
+  Otherwise its current range is retained; when absent, `latest` is used.
+
+Only a nonempty selection may also remove the legacy
+`devDependencies.@icebreakers/monorepo` entry and ensure `devDependencies.repoctl`.
+An already-correct manifest is not rewritten. All targets are validated before
+execution: workspace root/outside paths, symbolic-link targets or parent paths,
+linked root manifests, and unselected nested workspaces are rejected. Dependency
+references from consuming packages are not rewritten by this command.
+
+## env check
+
+Use `repo env check [tasks...]` to compare static source/example variable names with Turbo hash, passthrough and inferred declarations. Default task: `build`; private packages are included. `--json` and `--markdown` show source locations without values or snippets; `--strict` fails warnings and `--no-framework-inference` disables dependency-based prefix assumptions. The command is always read-only and does not run tasks or load actual dotenv values.
+
+Root/package JSONC configuration, array replacement, `$TURBO_EXTENDS$`, wildcard exclusions and environment-file input coverage are resolved explicitly. Configure `commands.env` task/include/exclude options and reasoned `suppressions` with rule/package/task/variable/path selectors. Dynamic reads and unsupported source syntax remain visible; unused exceptions warn. Static task reachability, aliases, shadowed globals, template expressions, generated code and cross-package source imports are not resolved. Never suggest placing every discovered variable in `globalEnv`; review task-local hash declarations and intentional passthrough separately.
 
 ## env info (alias: e i)
 
@@ -242,3 +385,71 @@ Usage:
   `--dry-run` and does not write files.
 - Add `--out <file>` to write the preview or JSON plan to disk. It also implies
   `--dry-run`.
+
+## Affected CI matrix
+
+`repo check --affected --matrix` previews a versioned GitHub Actions matrix without running checks. `--shards N` deterministically groups workspaces into at most 1–256 jobs. Reuse base/head, filters and global inputs from affected mode. Pass only `matrix` to Actions `fromJSON`, gate strategy expansion with `hasWork`, and execute each row's non-skipped executable/args arrays in order from the checkout root. Each job builds dependencies itself. Full fallbacks stay in one job and retain diagnostics. No workflow is changed or triggered; only explicit `--out` writes a report.
+
+### Public API baselines
+
+Use `repoctl package api check --json` after building opted-in `tooling.apiReports` library declarations. Local API Extractor >=7.52.12 <8 is required. `package api update --json` produces a read-only plan; explicitly review it before `package api update --apply <plan.json>`. Preserve existing baselines on check, report failures, review change intents, and never claim API signature differences determine complete SemVer compatibility. Baseline paths are workspace-relative; entries/tsconfig are package-relative.
+
+### Installation security
+
+Use `repo doctor security --json` for a read-only, version-aware pnpm policy report. `--expectations policy.json --strict` checks organization requirements. `--preset balanced` previews only absent supported keys; save the JSON and explicitly use `--apply plan.json` after review. Preserve explicit policies, including release age zero and build approvals. Do not run lifecycle scripts or approve dependencies as part of inspection. Unknown versions/configuration are reported, not treated as safe.
+
+## `repo tooling references`
+
+`check --json` checks existing references without opt-in. `plan` and `sync --dry-run` preview deterministic JSON without writes. With `tooling.projectReferences.enabled: true`, use `sync` or `apply <plan.json>` to maintain only registered references. Existing manual references and TypeScript/Vue validation scripts are preserved; incompatible compiler options, cycles, missing targets and stale plans block application. See [configuration](./config.md#typescript-project-references) for discovery, explicit compilation relationships, ownership and recovery.
+
+### Incremental Playwright capability
+
+Add browser tests to an existing Vue/React Vite application with `build` and `preview` scripts:
+
+```sh
+repo tooling capability list --json
+repo tooling capability plan playwright --target web --route / --role button --name Increment --expect-text 'Count: 1' --json > e2e-plan.json
+repo tooling capability apply e2e-plan.json --json
+pnpm install
+pnpm --filter @repoctl-e2e/web test:e2e:install
+pnpm test:e2e
+```
+
+Use `--test-id` instead of `--role`/`--name` for a test-id locator. The route, click and expected text describe a real interaction in your application. The plan shows file diffs, dependencies, scripts, conflicts and next steps, without installing anything. Apply uses those exact reviewed bytes, rejects stale inputs and conflicts, and rolls back failed writes. A repeated unchanged apply has no effect. Choose an empty destination (`--directory`) for the new E2E workspace. Existing application sources and differing generated files are protected.
+
+The capability creates an independent E2E workspace, headless Chromium tests, Turbo build dependencies, a dedicated CI workflow, HTML reports and failure traces. Browser installation is explicit. `--port` and `--ci-port` set distinct local and CI ports. CI never reuses a running service. `--reuse-existing-server` opts into local reuse; Playwright cleans up its own service after success, failure or interruption, and leaves a borrowed service running. Commit the lockfile after installation.
+
+Public APIs: `listToolingCapabilities()`, `planToolingCapability(cwd, options)` and `applyToolingCapability(plan)`. JSON uses schema version 1 and stable English keys regardless of CLI language.
+
+### Optional Storybook for a component library
+
+`repo tooling capability plan storybook --target <exact-workspace> --framework vue|react --component <named-export> --example example.json --json` previews a separate `stories/<slug>` workspace. Apply the reviewed JSON with `repo tooling capability apply plan.json`. The first version supports Vue 3 and React 18/19 libraries with a build script, public entry and an explicit runtime version range. Install dependencies after applying and commit the resulting lockfile. Discovery and planning do not install Storybook or a browser.
+
+A Vue prop-update example is `{"kind":"prop-update","prop":"msg","initial":"Hello Storybook","updated":"Updated component"}`. For a React counter use `{"kind":"click","args":{"initialCount":0},"alternateArgs":{"initialCount":4},"click":{"role":"button","name":"Increase"},"expectText":"1"}`. Component props must be JSON primitives; interaction assertions exercise the selected component. `Default`, `Alternate` and `Interaction` stories provide two states and a play test.
+
+Run `pnpm build:storybook` for the static site, then `pnpm --filter @repoctl-stories/<slug> test:storybook:install` and `pnpm test:storybook` for headless Chromium tests. Turbo builds library dependencies first and records `storybook-static/**`; play tests run without caching and write a JUnit report. Use the generated workspace's `storybook` script for local development. Its independent Vitest and Vite configurations leave the library's existing tests, package exports, runtime dependencies and tarball contents unchanged. Existing stories and configuration are preserved; differing generated files block application and require a new review. No hosted visual testing service is enabled.
+
+## Maintenance
+
+- `repo maintenance upgrade --base <full-sha> --head <full-sha> --out <external-empty-directory>` prepares a managed-asset report and validated patch in a disposable clean checkout when the locked root repoctl version or a directly configured, exactly pinned root preset changes. Existing preset baselines use three-way merging; newly declared files require explicit adoption. Unchanged bytes and unrelated updates produce no PR. Conflicts/failed checks block PR publication.
+- `repo maintenance workflow --out .github/workflows/repoctl-upgrade.yml` exports an opt-in two-job recipe without overwriting files. Use only the trusted default branch; keep project execution in the read-only job and acquire the GitHub App write token only after immutable artifact, SHA, path, mode and hash verification. App permissions must include contents, pull requests and workflows write.
+
+Maintenance report hashes describe exact Git blobs; planned working-file bytes are validated before staging. The isolated publisher verifies index bytes and Git-equivalent checkout contents across line-ending conversions, with hooks, executable filters and filesystem monitors disabled through PR creation. Preset reports carry exact raw preconditions and restricted checkout settings; the independent publisher uses Git built-in conversion to bind raw plans to committed and patched blobs while preserving fixed preset ownership. Preset before bytes use HEAD attributes; after bytes use the authorized patched attributes, including .gitattributes updates. Patch/report path mismatches are rejected before apply; final plan checks can still reject the isolated checkout before any write token is obtained.
+
+Preset authorization is embedded as fixed package/source/target triples at workflow export from validated installed manifests. The publisher independently verifies committed exact dependencies and existing baseline identity/content hashes before acquiring credentials; report-supplied paths never grant ownership. Refresh a reviewed workflow after explicit new asset adoption. Inherited-only preset changes and provider transfers remain manual. Report schema 1 adds optional `presets`; original root `versions` and `plan` stay compatible.
+
+Automatic maintenance can complete the built-in Changesets migration and update only its exact `.repoctl/migrations/ledger.json` metadata path. Preparation and publication share the same fixed migration identity, committed legacy-source, journal and completed-history checks; the target template version comes from the committed root repoctl → monorepo → templates lockfile dependency chain, not the repoctl version number. The publisher binds every migration output to the verified Git patch and checks public-package prerelease lanes against committed workspace membership. Interrupted journals, ambiguous lockfiles, noncanonical workspace patterns, and YAML/JSON5 workspace manifests require a reviewed manual `repo upgrade`; no broader `.repoctl` path is authorized. Refresh the trusted exported workflow to adopt this migration policy.
+
+Automatic maintenance can complete the built-in Changesets migration and update only its exact `.repoctl/migrations/ledger.json` metadata path. Preparation and publication share the same fixed migration identity, committed legacy-source, journal and completed-history checks; the target template version comes from the committed root repoctl → monorepo → templates lockfile dependency chain, not the repoctl version number. The publisher binds every migration output to the verified Git patch and checks public-package prerelease lanes against committed workspace membership. Interrupted journals, ambiguous lockfiles, noncanonical workspace patterns, and YAML/JSON5 workspace manifests require a reviewed manual `repo upgrade`; no broader `.repoctl` path is authorized. Refresh the trusted exported workflow to adopt this migration policy.
+
+## release snapshot
+
+`repo release snapshot --kind pr --pr <number> --commit <full-HEAD-sha> --build-id <run-attempt> --dry-run --json` previews deterministic temporary versions. Use `--kind nightly` without `--pr` for nightly packages. Without dry-run, archive committed HEAD outside the repository, install frozen dependencies, build, pack and validate isolated consumers. `--output` chooses an external artifact parent. Every public package receives an exact snapshot version and internal references follow those versions. Source manifests/intents/ledger/changelogs/Git refs stay unchanged.
+
+`--publish` requires `REPOCTL_SNAPSHOT_PUBLISH=1` in a trusted same-repository GitHub Actions event whose SHA matches HEAD: `pull_request` for PRs; `schedule` or `workflow_dispatch` for nightly. Fork and `pull_request_target` publication is rejected. Only snapshot tags are used; no GitHub Releases or Git tags are created. Repeat the same identity only for identical artifacts; metadata and tarball integrity are checked before skipping existing versions. Unknown registry state fails closed. Reports retain exact install instructions, artifact paths and validation errors.
+
+## Build contexts and production directories
+
+Preview `repo workspace prepare <exact-name-or-./directory> --mode prune|deploy --out ../empty-output --json`; save the plan outside the source workspace. Apply only after review with `repo workspace prepare --apply ../plan.json`. Prune uses local Turbo 2 and optional `--docker`; deploy uses exact pinned pnpm 10/11/12 with production dependencies, frozen lockfile, disabled lifecycle/pnpmfile hooks, optional `--offline`/explicit `--legacy`, and an existing built `--entry` or manifest main/single bin. Native version-specific injection and peer behavior remains authoritative. No application, image publishing or cloud deployment is executed.
+
+Native commands receive an isolated copy without node_modules, Git/operation/cache directories, real env files or named authentication files. Public .env.example/.env.sample remain. Source symlinks/special files, source-directed native write settings and inventories above 100,000 entries/1 GiB are unsupported. Output must be outside the workspace; links must remain inside the artifact. Publish files exclusively and commit the receipt last. Replays verify source/tool/config fingerprints and complete output; failures preserve concurrent edits and report retained paths. Review cleanupPending and recover partial output before removing a stale .repoctl/workspace-artifacts.lock. Do not hand-edit lockfiles or overwrite nonempty output. On Windows, transfer junction contents with an appropriate copy/archive mode.

package/assets/.agents/skills/repoctl/references/config.md

@@ -2,13 +2,17 @@
 
 Preferred filename: `repoctl.config.ts`
 
-Compatible legacy filename: `monorepo.config.ts`
-
 Rule:
 
-- `repoctl.config.*` has higher priority
-- `monorepo.config.*` remains supported
-- if both exist at the same time, CLI loading fails fast with an error
+- Load `repoctl.config.*`; rename legacy `monorepo.config.*`, which is no longer loaded.
+- Validate repoctl-owned fields before command side effects with `repo config validate --json`.
+- Native tooling passthrough and callbacks keep their extension boundary. Config modules are trusted executable project code.
+- Use `repo config inspect --command ai --set 'format="json"' --json` for shared defaults/project/CLI provenance. Contexts: ai, clean, create, deps, doctor, init, mirror, release, upgrade. Runtime selection is explained by each command's plan.
+- Reports redact env values and native tool payloads by default; `--redact` additionally hides local paths. For programmatic safe reports use `explainMonorepoConfig` or `validateConfigFile`; runtime config APIs retain callbacks and should not be serialized for sharing.
+- Replace the old ignored `tooling.lintStaged.monorepoCommand` field with `repoCommand`.
+- Organization presets use `presets: [{ packageName, version }]` with an exact installed dependency and JSON-only `repoctl.preset.json`. Loading never imports package code, installs or fetches. Parents precede declaring presets, then the project and CLI; arrays replace at preset boundaries. `config inspect` exposes ordered layers and precise package/version sources.
+- `repo presets inspect --json` lists recommendations and owned assets. `repo presets plan --json --out new-plan.json` is read-only; `repo presets apply new-plan.json` explicitly applies reviewed assets with three-way merge and a shared root-upgrade lock. Existing files and other provider baselines cannot be adopted implicitly. Commit `.repoctl/baselines/presets` alongside managed files.
+- Preset templates enter the unified catalog as fixed npm sources from the declaring package. `repo templates fetch <key>` prepares verified assets; previews and offline creation require that cache. Capability recommendations do not apply capabilities automatically.
 
 Use `defineMonorepoConfig` to set default options for CLI commands.
 Only include the fields you need.
@@ -33,6 +37,7 @@ export default defineMonorepoConfig({
     },
     clean: {
       autoConfirm: false,
+      dryRun: false,
       ignorePackages: ['docs'],
       includePrivate: true,
       pinnedVersion: 'latest',
@@ -61,7 +66,66 @@ Key areas:
 
 - ai: default output, format, batch tasks
 - create: default template and template directory
-- clean: auto confirm and pinned version control
+- clean: explicit package selection, optional read-only dryRun, private/ignored package filtering, and an explicit pinnedVersion override; existing repoctl versions are retained otherwise
 - upgrade: overwrite behavior and extra targets
 - init: skip steps for README/package.json/pnpm change intent setup
 - mirror: add or override env mirrors
+
+## `commands.doctor`
+
+Validate the schema of the whole configuration before executing selected doctor rules. Omitted `rules` selects every rule; explicit `rules: []` selects none. Valid but unsatisfied unselected policies do not contribute findings. `config inspect --command doctor` and doctor both consume workspace-root policy from package directories, with explicit CLI selection taking precedence.
+
+```ts
+export default defineMonorepoConfig({
+  commands: {
+    doctor: {
+      rules: ['root-scripts', 'commit-hooks'],
+      suppressions: [{
+        id: 'commit-hooks',
+        reason: 'CI validates commits while the hooks migration is scheduled',
+        expires: '2026-12-31',
+      }],
+    },
+  },
+})
+```
+
+Configure reasoned waivers under `commands.doctor.suppressions`. Each item needs `id` and a nonempty `reason`; optional `path` matches an exact workspace-relative finding path. Optional `expires` is an inclusive UTC date (`YYYY-MM-DD`). JSON retains the original finding status, `suppression`, `rawSummary`, and every waiver with its matched count. Only active waivers are excluded from effective `summary` and strict exit status; expired and unmatched waivers remain visible.
+
+## TypeScript project references
+
+Check an existing reference graph without enabling writes:
+
+```bash
+repo tooling references check --json
+repo tooling references plan > references-plan.json
+repo tooling references sync --dry-run
+repo tooling references apply references-plan.json
+repo tooling references sync
+```
+
+`check` exits with 1 for diagnostics or pending managed changes. All commands emit versioned JSON. `check`, `plan` and `sync --dry-run` never write. `apply` and `sync` require explicit `tooling.projectReferences.enabled: true`:
+
+```ts
+export default defineMonorepoConfig({
+  tooling: {
+    projectReferences: {
+      enabled: true,
+      root: 'tsconfig.json',
+      projects: ['packages/*/tsconfig.json', 'apps/*/tsconfig.build.json'],
+      exclude: ['packages/legacy/tsconfig.json'],
+      relations: [
+        { source: 'packages/app/tsconfig.json', target: 'packages/shared/tsconfig.json' },
+      ],
+    },
+  },
+})
+```
+
+The root solution and selected configs must already exist. Without `projects`, discovery selects `tsconfig.json` in each actual pnpm workspace package, including private packages; non-TS packages are skipped. Patterns are workspace-relative and can select multiple configs per package. Exclusions affect managed discovery, not existing manual references. Configs outside workspace packages are not automatically selected. The source workspace's references are never copied into generated projects.
+
+The root aggregates selected projects. Only explicit `relations` add compilation dependencies between them: npm dependencies do not imply a TypeScript reference. TypeScript must be installed in the target workspace. Its compiler reads inherited settings and checks missing targets, reference cycles, `composite`, declaration output and `noEmit` compatibility before writes. repoctl never enables composite, changes compiler options, creates tsconfigs or replaces scripts. The plan lists validation commands, preserving each package's existing `typecheck` script (including `vue-tsc`); run them after synchronization to check actual source files. Planning validates configuration, not a full source compilation.
+
+Existing references remain manually owned. Only newly added entries are recorded in `.repoctl/typescript-references.json`; commit that registry alongside the tsconfigs. Removing or excluding a project removes only entries recorded there. Editing/removing an owned entry blocks synchronization: restore it, or deliberately remove its registry entry to return ownership to the user. JSONC content outside the `references` value, BOM and line endings are preserved. Root aggregation and explicit edges produce stable relative config-file paths.
+
+Saved plans include input fingerprints and exact diffs. Applying a stale or edited plan fails before writes; reapplying an already completed plan is a no-op. A process lock at `.repoctl/typescript-references.lock` covers revalidation, writing, verification, rollback and cleanup. Changes stage together with backups and roll back on failure. If concurrent edits prevent safe rollback, the error names retained recovery files: preserve them, reconcile the business edit with the original backup, restore the ownership registry consistently and generate a new plan. A killed process can also leave `.repoctl-references-*.bak`/`.tmp` files; verify no writer remains, reconcile matching backups and the registry, then remove the stale lock. No recovery action overwrites a concurrent edit automatically.

package/assets/.agents/skills/repoctl/references/dependencies.md

@@ -0,0 +1,37 @@
+# Dependency consistency
+
+Use `repo deps check --json` to inventory root/private/workspace dependency declarations by name, dependency section and configured cohort. Reports distinguish identical, equivalent, compatible, conflicting, uncomparable, managed and exception groups with exact file locations. Catalog references are resolved for comparison; workspace references and unknown protocols remain report-only. npm aliases retain their actual source package. Peer and development declarations are independent.
+
+Create a read-only preview with `repo deps plan <dependency> --section <section> --to <specifier> --json`. `deps fix` aliases `deps plan`; neither writes manifests. The target is explicit and must overlap the entire compatible cohort. No registry queries or automatic major upgrades occur. Save and review JSON, then use `repo deps apply <plan.json>`. pnpm lockfile updates and installation are explicit user steps: `pnpm install --lockfile-only`, then `pnpm install --frozen-lockfile`.
+
+Configure `commands.deps.groups` at the workspace root. Each group has a unique `name`, exact workspace-relative `workspaces`, exact `dependencies`, a nonempty `reason`, optional `sections`, and optional `ignore: true` for report-only exceptions. Unmatched declarations use `default`; ambiguous overlapping selectors fail. Choose a cohort with `--group`.
+
+Plans carry before/after specifiers and input/file hashes. Applying re-discovers the workspace, verifies every input, reconstructs the planned changes and rejects stale or modified plans before replacement. Repeated applications are no-ops. Multi-file replacements retain backups until completion and roll back failures. On interrupted or failed recovery, inspect the reported `.repoctl-deps-*.bak` backups before generating another plan. Do not overwrite unrelated concurrent edits.
+
+Public APIs: `checkDependencies`, `planDependencyFix`, `applyDependencyFixPlan` from `repoctl`. JSON schema/status keys remain independent of locale.
+
+## pnpm catalog inspection and migration
+
+```bash
+pnpm exec repo deps catalog check --json
+pnpm exec repo deps catalog check --catalog legacy --json
+pnpm exec repo deps catalog plan typescript --section devDependencies --json > catalog-plan.json
+pnpm exec repo deps catalog plan react --section dependencies --group react18 --catalog react18 --to '^18.3.0' --json
+pnpm exec repo deps catalog apply catalog-plan.json --json
+pnpm install --lockfile-only
+pnpm install --frozen-lockfile
+```
+
+`catalog check` inspects every default and named catalog, root/private workspace consumer, missing catalog or entry, and unused entry. `catalog:` and `catalog:default` are equivalent. The default catalog may live at `catalog` or `catalogs.default`; declaring both is a pnpm configuration error. `--catalog` chooses the policy used to report direct-version bypasses and migration candidates; reference integrity is always checked across all catalogs. Direct peer ranges and explicit ignored version groups are exempt from bypass findings.
+
+The versioned JSON includes exact manifest paths, dependency sections, package names, original specifiers, catalog entries, consumers and stable finding codes. `missing_catalog`, `missing_entry` and `direct_declaration` make check exit with code 1. `unused_entry` and `uncomparable_entry` are informational; an unused entry is never automatically deleted. Simple `overrides` consumers, including version-qualified package selectors, are counted. Nested override selectors are reported as `unresolved_selector`, with possibly referenced entries marked `usage_unknown` instead of claiming they are unused.
+
+Migration reuses dependency consistency cohorts from `commands.deps.groups`; sections remain separate. Identical or semver-equivalent declarations can propose one entry automatically. Compatible but different ranges return `needs_target`: provide `--to` with a range that is a **subset of every selected declaration**, so migration cannot widen allowed versions or introduce a major upgrade. Mutually incompatible versions require explicit cohorts and separate named catalogs, or no migration. No registry is queried and no newest version is chosen.
+
+Only plain semver ranges and same-source npm aliases can migrate. An alias keeps its complete `npm:source@range` in the catalog. Workspace/file/link/Git/URL/tag and unknown declarations stay unchanged. Direct `peerDependencies` are report-only and cannot be migrated by this command. Existing catalog references are preserved; a cohort mixing references to other catalogs requires explicit grouping. Existing entries are never overwritten, including when `--to` differs: choose a new named catalog or separately review an entry change affecting all its consumers.
+
+`catalog plan` is always read-only, with or without `--dry-run`. Its JSON contains complete before/after YAML and consumer-manifest contents, file hashes, every discovered input hash and the normalized selection. Review the linked changes before `catalog apply`. YAML AST editing preserves unrelated configuration and comments; an edited catalog mapping shared through YAML anchors/aliases is rejected rather than changing unrelated alias consumers. Existing default/named catalog locations are retained. Lockfile generation remains a separate explicit pnpm action.
+
+Apply is bound to the same workspace and full input set. Stale YAML, changed manifests/policies, new packages, linked files, partial application and modified plan contents are rejected before writes. It uses the same staged replacements, backups and rollback as dependency fixes, across both YAML and JSON. A fully applied plan and a repeated migration are no-ops. If recovery cannot safely replace a concurrent edit, inspect the listed `.repoctl-deps-*.bak` originals, restore reviewed files, remove stale temporary files and generate a fresh plan; the concurrent edit is preserved.
+
+Public APIs are `checkCatalogs(cwd, options?)`, `planCatalogMigration(cwd, options)` and `applyCatalogMigrationPlan(cwd, plan)`. See [pnpm catalogs](https://pnpm.io/catalogs) for protocol semantics and [Syncpack](https://syncpack.dev/) for intentional version-group policy patterns.

package/assets/.agents/skills/repoctl/references/knip.md

@@ -0,0 +1,34 @@
+# Optional Knip checks
+
+Use `pnpm exec repo check knip` only when unused code/dependency analysis is requested.
+Ordinary check modes do not enable it. A workspace-root installation of Knip
+`>=6.39.0 <7` is required; missing-tool guidance is `pnpm add -Dw knip@^6.39.0`.
+repoctl does not download it, fall back to global/parent tools or run native fixes.
+
+1. Inspect `repo check knip --recommend-config` and merge useful native settings manually.
+   Preserve existing JSON/JS/TS configuration, plugins and intentional dynamic entries.
+   Generated outputs have suggested exclusions; review example/fixture exclusions explicitly.
+2. Preview with `repo check knip --dry-run --json`, then run `repo check knip --json`.
+   JSON means an actual report on this subcommand. Put all options after `knip`.
+3. Use `--production` or `--strict` only after reviewing native production entries.
+   Strict mode implies production and checks direct dependency declarations per workspace.
+4. Review findings before explicitly saving with `--save-baseline knip-baseline.json`.
+   Saving preserves the current exit code and cannot overwrite arbitrary files.
+5. Compare with `--baseline knip-baseline.json --new-only` for incremental adoption.
+   Do not refresh a baseline silently to hide failures. Baseline errors fail closed.
+
+Reports preserve workspace, source location, native category/reason and warn/error severity.
+Exit 0 means the policy passes, 1 means blocking findings, and 2 means incomplete analysis
+or invalid baseline. Baseline comparison reports existing, added and fixed findings.
+Source line shifts do not create new findings; severity escalation does.
+
+Baseline scope binds the exact tool version, modes, root name, native workspace set,
+primary config hashes, categories and enabled plugins. Source/dependency fixes are allowed.
+Imported config helpers, environment changes and every plugin auxiliary config are not fully
+fingerprinted: review and explicitly rebaseline after changing those policies.
+Config paths are relative to invocation cwd; baseline paths are relative to the workspace root.
+Review retained temporary paths after interrupted saves or cleanup failures.
+
+Public APIs: `planKnipCheck`, `runKnipCheck`, `getKnipConfigurationSuggestions`,
+`saveKnipBaseline`, with exported plan/report/baseline types. Timeout and cancellation fail
+closed. Neither repoctl configuration recommendations nor its analyzer runs edit user config.

package/assets/.agents/skills/repoctl/references/templates.md

@@ -36,6 +36,7 @@ Built-in template map:
 - vue-lib -> templates/vue-lib => packages/vue-lib
 - hono-server -> templates/server => apps/server
 - vue-hono -> templates/client => apps/client
+- next -> templates/next => apps/next (Next.js App Router, server page, client state and health route)
 - nimbus -> templates/nimbus => apps/docs (default documentation template)
 - vitepress -> templates/vitepress => apps/website (explicit alternative)
 - cli -> templates/cli => apps/cli
@@ -45,3 +46,25 @@ Notes:
 - The command prompts for template selection unless defaults are set in
   repoctl.config.ts or monorepo.config.ts.
 - Override mappings with `commands.create.templateMap` and `commands.create.templatesDir`.
+
+For `next`, run `typecheck` to generate Next route types before `tsc`. Its local Turbo config caches production output and excludes `.next/cache`. Compiled workspace libraries use public package exports and `^build`; source-exporting libraries must be named in `transpilePackages`. Never copy `.next`, `next-env.d.ts` or an independent pnpm lockfile into the template.
+
+## Custom catalog
+
+Creation, list/detail, interactive choices and `repo templates --check` share `resolveTemplateCatalog({ cwd })`. Object entries in `commands.create.templateMap` accept `source`, `target`, optional `label`, `description`, and `category` (`app`, `docs`, `library`, `service`, `tool`); string entries still map the same source and target. Absolute sources coexist with installed templates. `templatesDir` replaces the root for all relative sources, including built-ins, and is relative to the configuration file, including when invoked in a nested workspace package. A non-empty `choices` array preserves explicit ordering/inclusion and supplies the same labels/descriptions shown by discovery.
+
+Detail/JSON include `origin`, `overridesBuiltin`, `sourceDir`, `configFile` and `configPath`; create JSON includes `templateInfo`. Health checks report invalid declarations, duplicate choices, sources and targets, missing directories/manifests and metadata. Checks are read-only and do not execute template code. Prefer `--check --json` for diagnostic locations; listing JSON keeps the array shape.
+
+## Author validation
+
+Use `repo templates validate <key> --fixture <workspace-skeleton> --json` for explicit generated-project validation. `--dry-run` inspects required scripts without executing them; repeated `--name` validates renamed samples. `--parameter-matrix matrix.json` reads a JSON array of typed parameter objects and crosses it with names (at most 20 samples). The public helper uses `parameterSets`. Each combination inspects its rendered files and conditional scripts before execution. Sensitive values are redacted, and sensitive combinations hide child output and diagnostic messages while retaining stages, exit codes and diagnostic codes; retained generated files can still contain those inputs. Execution order is install → build → lint/Stylelint → typecheck → tsd for typed libraries → built-artifact tests and declared E2E. Library samples additionally pack, analyze and consume actual tarballs. Default cleanup removes samples; `--keep-failed` retains failure diagnostics and `--keep-temp` retains every sample. `--timeout` bounds each child command, and interruption stops only the validation process tree. Ordinary template discovery/check never executes scripts.
+
+## Remote assets
+
+A custom entry can add `remote: { kind: 'npm', packageName, version, registry? }` or `remote: { kind: 'git', repository, ref }`; `source` is a relative archive directory, including `.` for its root. npm requires an exact version; prefer a full Git commit for reproducibility across fresh caches. `repo templates fetch <key> --json` prepares verified assets. Actual creation/validation may fetch, while listing, health and previews remain read-only and need a previously fetched cache. `--offline` refuses a miss; `--cache-dir` or `commands.create.cacheDir` overrides the cache relative to invocation cwd.
+
+npm configuration supplies scoped registry/authentication. Never put credentials in the remote declaration. Fetching runs no lifecycle scripts, hooks, submodules or dependency installs. Cache hits recheck original archives against extracted asset contents; corruption is an error, not an automatic refresh. A Git ref stays pinned to its first cached commit. Instances record resolved provenance and retained baselines; remote upgrades are explicitly unsupported by the built-in-version `templates upgrade` command. The exported `resolveRemoteTemplateSource` helper is the same acquisition boundary used by the CLI.
+
+## Existing-package generators
+
+Use `repo generate <vue-component|react-component|hono-route> <kebab-name> --package <exact-name-or-relative-dir> --json` to inspect source and behavior-test files before writing. Run without `--json` to apply; `--export` explicitly adds a named export to `src/index.ts` (or `--barrel`). `--directory` stays inside the selected package. Strict parameters, framework requirements, stale plans, symlinks and conflicting files fail before writes. Repeated identical generation is unchanged. Hono route registration remains an explicit printed next step. Validate generated output with build, ESLint/Stylelint, tsc/vue-tsc and tests. Keep `repo new` for whole new packages; it never overwrites existing directories.

package/assets/.github/workflows/ci.yml

@@ -4,7 +4,7 @@ on:
   # push:
   #   branches: ['main']
   pull_request:
-    types: [opened, synchronize]
+    types: [ opened, synchronize ]
     paths-ignore:
       - '**/*.md'
       - 'docs/**'
@@ -15,20 +15,26 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build:
     name: Build and Test
-    timeout-minutes: 15
+    # Preserve time for full validation and packaged checks on every platform.
+    timeout-minutes: 35
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest]
-        node-version: [22, 24]
+        os: [ ubuntu-latest, windows-latest, macos-latest ]
+        node-version: [ 22, 24 ]
     runs-on: ${{ matrix.os }}
     # Remote Caching enabled - configure TURBO_TOKEN and TURBO_TEAM in repository settings
     env:
       TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
       TURBO_TEAM: ${{ vars.TURBO_TEAM }}
+      NEXT_TELEMETRY_DISABLED: '1'
 
     steps:
       - name: Check out code
@@ -48,12 +54,6 @@ jobs:
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
-      - name: Check tracked build artifacts
-        run: pnpm check:no-tracked-build-artifacts
-
-      - name: Check CI/CD workflow contracts
-        run: pnpm check:workflows
-
       - name: Security Audit
         run: pnpm audit --audit-level=moderate
         continue-on-error: true