@icebreakers/monorepo-templates 2.2.1 → 2.3.1

package/assets/.agents/skills/repoctl/references/commands.md

@@ -153,11 +153,16 @@ Usage:
 - `pnpm exec repo release ci --mode prepare`
 - `pnpm exec repo release ci --mode publish`
 - `pnpm exec repo release ci --mode publish-unpublished --package <name> --version <version>`
+- `pnpm exec repo release ci --mode oidc-audit`
 
 The command uses `GITHUB_TOKEN`, `GITHUB_REPOSITORY`, `GITHUB_API_URL`, and
 `GITHUB_SHA` to upsert the Release PR, package tags, and GitHub Releases. It
 consumes `pnpm-publish-summary.json` and is safe to retry.
 
+`oidc-audit` independently checks every versioned public child package using the current GitHub-hosted job's OIDC identity and the official npm registry. It returns safe JSON (`schemaVersion: 1`) with allowlisted identity fields, per-package HTTP status/message and aggregate success. The CLI fails if any exchange fails, but still checks all packages. It does not load release configuration, consume intents, execute quality scripts/hooks, publish, or create tags/Releases. Recovery flags (`source-sha`, `dry-run`, `package`, `version`) are incompatible. The managed workflow has a separate read-only audit job with Node 24, `id-token: write` and installation lifecycle scripts disabled; generated projects need only installed repoctl, while the source workspace builds its tooling closure.
+
+Use `auditReleaseOidc({ cwd, env?, fetch? })` for the same programmatic report. JWTs, request tokens and exchange tokens are never included or saved. A 404 alone cannot identify expired trust: check npm package settings and repository/workflow/environment matching. If npm explicitly says `Expired`, delete/recreate the configuration and perform the first successful publish within 48 hours under [npm's policy](https://github.blog/changelog/2026-10-02-unvalidated-npm-trusted-publishing-configurations-now-expire/). A successful exchange does not complete that initial publish validation; auditing immediately before publishing narrows that gap.
+
 ## workspace upgrade (alias: ws up)
 
 Purpose: sync monorepo assets and scripts into the workspace.

package/assets/.github/workflows/ci.yml

@@ -23,7 +23,7 @@ jobs:
   build:
     name: Build and Test
     # Preserve time for full validation and packaged checks on every platform.
-    timeout-minutes: 35
+    timeout-minutes: 45
     strategy:
       fail-fast: false
       matrix:
@@ -45,7 +45,7 @@ jobs:
       - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ matrix.node-version }}
           cache: pnpm

package/assets/.github/workflows/release-intent-auto.yml

@@ -31,7 +31,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
 

package/assets/.github/workflows/release.yml

@@ -22,6 +22,7 @@ on:
           - publish
           - publish-unpublished
           - reconcile
+          - oidc-audit
       package:
         description: Package used for unpublished-version recovery
         required: false
@@ -56,6 +57,7 @@ concurrency:
 
 jobs:
   release:
+    if: ${{ inputs.mode != 'oidc-audit' }}
     name: Release
     runs-on: ubuntu-latest
     steps:
@@ -89,7 +91,7 @@ jobs:
       - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
           cache: pnpm
@@ -113,7 +115,7 @@ jobs:
 
       - name: Preserve npm publish progress
         if: ${{ always() }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: npm-publish-progress-${{ github.run_id }}-${{ github.run_attempt }}
           path: |
@@ -122,3 +124,35 @@ jobs:
             repoctl-release-progress.json
           if-no-files-found: ignore
           retention-days: 14
+
+  oidc-audit:
+    name: Audit npm OIDC
+    if: ${{ github.event_name == 'workflow_dispatch' && inputs.mode == 'oidc-audit' }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - name: Checkout Repo
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+
+      - name: Setup Node.js environment
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 24
+          cache: pnpm
+
+      - name: Install Dependencies without lifecycle scripts
+        run: pnpm install --frozen-lockfile --ignore-scripts
+
+      - name: Audit every publishable package
+        env:
+          REPO_RELEASE_PACKAGE: ${{ inputs.package }}
+          REPO_RELEASE_VERSION: ${{ inputs.version }}
+          REPO_RELEASE_DRY_RUN: ${{ inputs.dry-run }}
+          REPO_RELEASE_RECOVERY_SOURCE_SHA: ${{ inputs.source-sha }}
+        run: pnpm exec repo release ci --mode oidc-audit

package/assets/package.json

@@ -3,7 +3,7 @@
   "type": "module",
   "version": "0.0.0",
   "private": true,
-  "packageManager": "pnpm@12.8.1",
+  "packageManager": "pnpm@12.10.1",
   "description": "Source workspace for repoctl and Icebreaker's shared development packages",
   "author": "ice breaker <hi@sonofmagic.top>",
   "license": "MIT",
@@ -69,10 +69,10 @@
   "devDependencies": {
     "@commitlint/cli": "^21.2.3",
     "@eslint/config-inspector": "^3.5.0",
-    "@types/node": "^26.6.3",
+    "@types/node": "^26.6.4",
     "@vitest/coverage-v8": "~5.0.3",
-    "eslint": "^10.11.0",
-    "execa": "^10.0.1",
+    "eslint": "^10.12.0",
+    "execa": "^10.1.0",
     "husky": "^9.1.7",
     "lint-staged": "^17.6.0",
     "only-allow": "^1.2.2",
@@ -81,7 +81,7 @@
     "tailwindcss": "^4.3.3",
     "tsd": "^0.33.0",
     "tsdown": "0.23.0",
-    "turbo": "^2.11.6",
+    "turbo": "^2.11.7",
     "typescript": "^6.0.3",
     "vitest": "~5.0.3",
     "yaml": "^2.9.1"

package/assets/pnpm-workspace.yaml

@@ -18,12 +18,12 @@ allowBuilds:
 overrides:
   prettier: 3.9.9
   typescript: 6.0.3
-  "@arethetypeswrong/core>typescript": 5.6.1-rc
-  vite: 8.3.2
-  postcss: 8.5.28
+  "@arethetypeswrong/core>typescript": 5.9.3
+  vite: 8.3.3
+  postcss: 8.5.29
   postcss-selector-parser: 7.1.6
-  js-yaml: 5.4.2
-  nanoid: 6.0.1
+  js-yaml: 5.4.3
+  nanoid: 6.0.2
   brace-expansion: 5.0.12
   minimatch@<4>brace-expansion: 1.1.21
   minimatch@>=4 <10>brace-expansion: 2.1.7

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@icebreakers/monorepo-templates",
   "type": "module",
-  "version": "2.2.1",
+  "version": "2.3.1",
   "description": "Built-in project templates and managed workspace assets for repoctl",
   "author": "ice breaker <hi@sonofmagic.top>",
   "license": "MIT",
@@ -46,10 +46,10 @@
     "node": ">=22.13.0"
   },
   "dependencies": {
-    "@inquirer/checkbox": "^5.2.5",
-    "@inquirer/input": "^5.1.6",
-    "@inquirer/password": "^5.2.2",
-    "@inquirer/select": "^5.2.5",
+    "@inquirer/checkbox": "^5.2.6",
+    "@inquirer/input": "^5.1.7",
+    "@inquirer/password": "^5.2.3",
+    "@inquirer/select": "^5.2.6",
     "commander": "^15.0.0",
     "nanoexec": "^1.1.0",
     "yaml": "^2.9.1"

package/templates/client/package.json

@@ -37,9 +37,9 @@
   },
   "dependencies": {
     "@faker-js/faker": "^10.6.0",
-    "@tanstack/vue-query": "^5.104.0",
-    "@tanstack/vue-query-devtools": "^6.3.0",
-    "@tanstack/vue-table": "^9.2.4",
+    "@tanstack/vue-query": "^5.104.1",
+    "@tanstack/vue-query-devtools": "^6.3.1",
+    "@tanstack/vue-table": "^9.2.7",
     "@tanstack/vue-virtual": "^3.13.39",
     "@trpc/client": "^11.19.0",
     "clsx": "^2.1.1",
@@ -47,12 +47,12 @@
     "tailwind-merge": "^3.7.0",
     "tailwind-variants": "^3.3.1",
     "vue": "^3.5.43",
-    "vue-i18n": "^11.4.12",
-    "vue-router": "^5.3.1"
+    "vue-i18n": "^11.4.13",
+    "vue-router": "^5.4.0"
   },
   "devDependencies": {
     "@cloudflare/vite-plugin": "^1.56.0",
-    "@hono/node-server": "^2.1.3",
+    "@hono/node-server": "^2.1.4",
     "@hono/trpc-server": "^0.4.2",
     "@tailwindcss/vite": "^4.3.3",
     "@trpc/server": "^11.19.0",
@@ -60,13 +60,13 @@
     "@vitejs/plugin-vue-jsx": "^5.1.6",
     "@vue/tsconfig": "^0.9.1",
     "consola": "^3.4.2",
-    "hono": "^4.13.12",
+    "hono": "^4.13.13",
     "tailwindcss": "^4.3.3",
     "typescript": "~6.0.3",
-    "vite": "^8.3.2",
+    "vite": "^8.3.3",
     "vite-plugin-vue-devtools": "^8.2.1",
     "vite-tsconfig-paths": "^6.1.1",
-    "vue-tsc": "3.3.11",
+    "vue-tsc": "3.3.12",
     "wrangler": "^4.135.0",
     "zod": "^4.6.5"
   }

package/templates/next/package.json

@@ -19,7 +19,7 @@
     "test:dev": "vitest"
   },
   "dependencies": {
-    "next": "16.3.8",
+    "next": "16.4.0",
     "react": "^19.3.0",
     "react-dom": "^19.3.0"
   },
@@ -28,8 +28,8 @@
     "@testing-library/react": "^16.3.3",
     "@types/react": "^19.3.0",
     "@types/react-dom": "^19.3.0",
-    "@vitejs/plugin-react": "^6.1.1",
-    "jsdom": "^30.1.1",
+    "@vitejs/plugin-react": "^6.1.2",
+    "jsdom": "^30.1.2",
     "typescript": "~6.0.3",
     "vitest": "~5.0.3"
   }

package/templates/nimbus/UPSTREAM.md

@@ -4,10 +4,10 @@ This template adapts the static empty starter from [Cloudflare Nimbus](https://g
 
 - Starter tag: `templates-v0.7.9`
 - Starter commit: `aae348048a8c659f84c39696ee6b20c2ad2f5ae2`
-- Nimbus package: `@cloudflare/nimbus-docs@0.15.2`
-- Astro: `7.3.1`
+- Nimbus package: `@cloudflare/nimbus-docs@0.16.0`
+- Astro: `7.3.6`
 
-Nimbus declares Astro `>=7.2.6 <8`; Astro requires Node `>=22.12.0`, so this workspace retains its stricter Node `>=22.13.0` baseline. Builds, Astro diagnostics and TypeScript checks were verified with the repository's TypeScript `6.0.3` and Vite `8.3.1` constraints. Resolved dependencies are recorded in the monorepo's root `pnpm-lock.yaml`; generated projects use their own root workspace lockfile.
+Nimbus declares Astro `>=7.2.6 <8`; Astro requires Node `>=22.12.0`, so this workspace retains its stricter Node `>=22.13.0` baseline. Builds, Astro diagnostics and TypeScript checks were verified with the repository's TypeScript `6.0.3` and Vite `8.3.3` constraints. Resolved dependencies are recorded in the monorepo's root `pnpm-lock.yaml`; generated projects use their own root workspace lockfile.
 
 Agent endpoint routes and the content-loading approach come from that starter. The bilingual layout, navigation, search interface, examples and workspace checks are repoctl adaptations. These files are maintained locally; generating a project never downloads the upstream starter.
 

package/templates/nimbus/nimbus.json

@@ -1,4 +1,4 @@
 {
   "$schema": "https://nimbus-docs.com/schema/nimbus.json",
-  "lastReviewedNimbusVersion": "0.15.2"
+  "lastReviewedNimbusVersion": "0.16.0"
 }

package/templates/nimbus/package.json

@@ -19,12 +19,12 @@
     "check:locales": "node scripts/check-locales.mjs"
   },
   "dependencies": {
-    "@cloudflare/nimbus-docs": "0.15.2",
-    "astro": "7.3.5"
+    "@cloudflare/nimbus-docs": "0.16.0",
+    "astro": "7.3.7"
   },
   "devDependencies": {
     "@astrojs/check": "^0.9.10",
-    "@astrojs/language-server": "2.17.1",
+    "@astrojs/language-server": "2.17.2",
     "astro-eslint-parser": "^3.2.0",
     "eslint-plugin-astro": "^3.2.1",
     "eslint-plugin-mdx": "^3.8.1",

package/templates/react-lib/package.json

@@ -35,14 +35,14 @@
     "@testing-library/react": "^16.3.3",
     "@types/react": "^19.3.0",
     "@types/react-dom": "^19.3.0",
-    "@vitejs/plugin-react": "^6.1.1",
-    "jsdom": "^30.1.1",
+    "@vitejs/plugin-react": "^6.1.2",
+    "jsdom": "^30.1.2",
     "react": "^19.3.0",
     "react-dom": "^19.3.0",
     "tsd": "^0.33.0",
     "typescript": "~6.0.3",
-    "vite": "^8.3.2",
-    "vite-plugin-dts": "^5.1.1",
+    "vite": "^8.3.3",
+    "vite-plugin-dts": "^5.1.2",
     "vitest": "~5.0.3"
   }
 }

package/templates/react-vite/package.json

@@ -27,10 +27,10 @@
     "@testing-library/react": "^16.3.3",
     "@types/react": "^19.3.0",
     "@types/react-dom": "^19.3.0",
-    "@vitejs/plugin-react": "^6.1.1",
-    "jsdom": "^30.1.1",
+    "@vitejs/plugin-react": "^6.1.2",
+    "jsdom": "^30.1.2",
     "typescript": "~6.0.3",
-    "vite": "^8.3.2",
+    "vite": "^8.3.3",
     "vitest": "~5.0.3"
   }
 }

package/templates/server/package.json

@@ -64,9 +64,9 @@
     "types": "./dist/index.d.ts"
   },
   "devDependencies": {
-    "@hono/node-server": "^2.1.3",
+    "@hono/node-server": "^2.1.4",
     "consola": "^3.4.2",
-    "hono": "^4.13.12",
+    "hono": "^4.13.13",
     "tsdown": "0.23.0",
     "wrangler": "^4.135.0",
     "zod": "^4.6.5"

package/templates/vitepress/package.json

@@ -42,12 +42,12 @@
   },
   "devDependencies": {
     "@tailwindcss/vite": "^4.3.3",
-    "mermaid": "^12.0.0",
+    "mermaid": "^12.1.0",
     "tailwindcss": "^4.3.3",
     "vitepress": "2.0.0-alpha.20",
     "vitepress-plugin-llms": "^1.14.0",
     "vitest": "~5.0.3",
-    "vue-tsc": "^3.3.11",
+    "vue-tsc": "^3.3.12",
     "wrangler": "^4.135.0"
   }
 }

package/templates/vitepress/tasks/release.md

@@ -67,7 +67,23 @@ After changing the mapping, preview `repo upgrade --dry-run --json` and apply th
 
 - Missing intent: add a changeset and rerun the plan.
 - Fixed group mismatch: inspect the package relationships before editing versions.
-- Registry authentication failure: refresh the local token and rerun the publish step; do not commit credentials.
+- Registry authentication failure in CI: run the OIDC audit below from the publishing workflow and inspect npm package settings.
+
+## Audit npm trusted publishing
+
+Choose `oidc-audit` when manually dispatching the managed Release workflow, or run this in your existing GitHub-hosted publishing job:
+
+```bash
+pnpm exec repo release ci --mode oidc-audit
+```
+
+The job needs `id-token: write`, Node 24 and the same repository, workflow file and environment as actual publishing. A different diagnostic workflow has a different identity. The managed workflow uses a separate audit job with only `contents: read` and `id-token: write`, disables install lifecycle scripts and skips GitHub App credentials and release quality checks. Only the repoctl source workspace builds its tooling closure; consumer workflows use the installed CLI. Custom workflows should use the same isolation and install with `pnpm install --frozen-lockfile --ignore-scripts`.
+
+The command independently routes before release configuration and checks every versioned public child package against the official npm registry, including packages already published. It requests short-lived exchange credentials but never uploads packages, changes versions/intents, runs hooks, writes progress files, creates tags/Releases or saves tokens. `source-sha`, `dry-run`, `package` and `version` recovery inputs must be empty. JSON includes `schemaVersion: 1`, safe identity fields, each package's HTTP status/message and `ok`; failures complete the whole package report before exiting with code 1. `auditReleaseOidc({ cwd, env?, fetch? })` exposes the same report without printing it; callers must check `ok`.
+
+An npm HTTP 404 or `OIDC token exchange error - package not found` does not by itself distinguish a missing package, mismatched trust or expired configuration. Check the npm package's trusted publisher status and compare repository, workflow and environment with the safe identity report. Never paste JWTs or exchange tokens into logs or support requests.
+
+Under [npm's initial validation policy](https://github.blog/changelog/2026-10-02-unvalidated-npm-trusted-publishing-configurations-now-expire/), configurations without a first successful publish expire after 48 hours. If the npm page explicitly shows `Expired`, delete and recreate that package's trusted publisher, then complete the first publish within 48 hours. Editing an expired configuration does not reset it. Existing configuration, successful exchange and successful first publish are separate evidence; an audit does not reset or satisfy this clock. After the first successful publish, that initial 48-hour limit no longer applies. Use OIDC/provenance for publication and keep npm token fallbacks out of publishing jobs.
 
 ## Partial publication and registry visibility
 

package/templates/vitepress/zh/tasks/release.md

@@ -137,6 +137,22 @@ repo release ci --mode prepare
 
 验证脚本（`qualityScripts` 和 `hooks.verify`）不继承本次发布的控制参数，例如发布模式或恢复来源；普通 CI 与认证环境变量仍会保留。其他生命周期 hook 继续使用原有发布上下文。
 
+## 核验 npm trusted publishing
+
+在受管 Release 工作流的手动调度中选择 `oidc-audit`，或者在现有的 GitHub-hosted 发布 job 中运行：
+
+```bash
+pnpm exec repo release ci --mode oidc-audit
+```
+
+job 需要 `id-token: write` 和 Node 24，并使用实际发布时的仓库、工作流文件及 environment。另建诊断工作流会改变身份。受管工作流使用独立的核验 job，只授予 `contents: read` 和 `id-token: write`，关闭安装 lifecycle scripts，跳过 GitHub App 令牌及发布质量检查。只有 repoctl 源码仓库构建工具依赖闭包；消费方直接使用已安装的 CLI。自定义工作流也应隔离这些步骤，使用 `pnpm install --frozen-lockfile --ignore-scripts` 安装。
+
+命令在加载发布配置前独立路由，向官方 npm registry 逐个核验有版本号的公开子包，包含已发布的包。它只申请短时交换凭据，不上传包、不修改版本或 intent、不运行 hooks、不写进度文件、不创建 tag/Release，也不保存 token。`source-sha`、`dry-run`、`package` 和 `version` 恢复输入必须为空。JSON 包含 `schemaVersion: 1`、允许展示的身份字段、每包 HTTP 状态及 npm 错误信息、整体 `ok`；即使某包失败也会继续完成全部包报告，最后以退出码 1 失败。程序化 API `auditReleaseOidc({ cwd, env?, fetch? })` 返回同一报告而不打印；调用者须检查 `ok`。
+
+HTTP 404 或 `OIDC token exchange error - package not found` 本身无法区分包不存在、信任声明不匹配或配置过期。核对 npm 包设置里的 trusted publisher 状态，以及报告中的仓库、工作流和 environment。不要把 JWT 或交换 token 复制到日志或求助信息。
+
+根据 [npm 首次发布验证策略](https://github.blog/changelog/2026-10-02-unvalidated-npm-trusted-publishing-configurations-now-expire/)，创建后 48 小时内没有首次成功发布的配置会过期。只有 npm 页面明确显示 `Expired` 时，才按过期处理：删除并重建该包的配置，在 48 小时内完成首次发布；单纯编辑不会重置它。“配置存在”“交换成功”“首次成功发布”是不同证据；核验不能重置或完成这个时限。首次成功发布后不再受初始 48 小时限制。实际发布继续使用 OIDC/provenance，不在发布 job 增加 npm token 兜底。
+
 ## 下一步
 
 阅读[发包与变更日志](/zh/learn/monorepo/publish)，再查看[报告与输出](/zh/tasks/reports)了解 CI 产物。

package/templates/vue-lib/package.json

@@ -62,10 +62,10 @@
     "@vitejs/plugin-vue": "^6.0.9",
     "@vue/test-utils": "^2.5.1",
     "@vue/tsconfig": "^0.9.1",
-    "jsdom": "^30.1.1",
-    "vite": "^8.3.2",
-    "vite-plugin-dts": "^5.1.1",
+    "jsdom": "^30.1.2",
+    "vite": "^8.3.3",
+    "vite-plugin-dts": "^5.1.2",
     "vue": "^3.5.43",
-    "vue-tsc": "^3.3.11"
+    "vue-tsc": "^3.3.12"
   }
 }