@icebreakers/monorepo-templates 3.0.0 → 3.0.1

package/assets/.agents/skills/repoctl/references/commands.md

@@ -159,7 +159,7 @@ The command uses `GITHUB_TOKEN`, `GITHUB_REPOSITORY`, `GITHUB_API_URL`, and
 `GITHUB_SHA` to upsert the Release PR, package tags, and GitHub Releases. It
 consumes `pnpm-publish-summary.json` and is safe to retry.
 
-`oidc-audit` independently checks every versioned public child package using the current GitHub-hosted job's OIDC identity and the official npm registry. It returns safe JSON (`schemaVersion: 1`) with allowlisted identity fields, per-package HTTP status/message and aggregate success. The CLI fails if any exchange fails, but still checks all packages. It does not load release configuration, consume intents, execute quality scripts/hooks, publish, or create tags/Releases. Recovery flags (`source-sha`, `dry-run`, `package`, `version`) are incompatible. The managed workflow has a separate read-only audit job with Node 24, `id-token: write` and installation lifecycle scripts disabled; generated projects need only installed repoctl, while the source workspace builds its tooling closure.
+`oidc-audit` independently checks every versioned public child package using the current GitHub-hosted job's OIDC identity and the official npm registry. It returns safe JSON (`schemaVersion: 1`) with allowlisted identity fields, per-package HTTP status/message and aggregate success. The CLI fails if any exchange fails, but still checks all packages. It does not load release configuration, consume intents, execute quality scripts/hooks, publish, or create tags/Releases. Recovery flags (`source-sha`, `dry-run`, `package`, `version`) are incompatible. The managed workflow has a separate read-only audit job with Node.js 24.22.1, `id-token: write` and installation lifecycle scripts disabled; generated projects need only installed repoctl, while the source workspace builds its tooling closure.
 
 Use `auditReleaseOidc({ cwd, env?, fetch? })` for the same programmatic report. JWTs, request tokens and exchange tokens are never included or saved. A 404 alone cannot identify expired trust: check npm package settings and repository/workflow/environment matching. If npm explicitly says `Expired`, delete/recreate the configuration and perform the first successful publish within 48 hours under [npm's policy](https://github.blog/changelog/2026-10-02-unvalidated-npm-trusted-publishing-configurations-now-expire/). A successful exchange does not complete that initial publish validation; auditing immediately before publishing narrows that gap.
 

package/assets/.github/workflows/ci.yml

@@ -28,7 +28,7 @@ jobs:
       fail-fast: false
       matrix:
         os: [ ubuntu-latest, windows-latest, macos-latest ]
-        node-version: [ 22, 24 ]
+        node-version: [ 22.23.4, 24.22.1, 26.12.1 ]
     runs-on: ${{ matrix.os }}
     # Remote Caching enabled - configure TURBO_TOKEN and TURBO_TEAM in repository settings
     env:
@@ -65,11 +65,11 @@ jobs:
         run: pnpm build
 
       - name: Typecheck
-        if: ${{ matrix.os != 'windows-latest' || matrix.node-version != 22 }}
+        if: ${{ matrix.os != 'windows-latest' || matrix.node-version != '22.23.4' }}
         run: pnpm typecheck
 
       - name: Typecheck (Windows Node 22)
-        if: ${{ matrix.os == 'windows-latest' && matrix.node-version == 22 }}
+        if: ${{ matrix.os == 'windows-latest' && matrix.node-version == '22.23.4' }}
         run: pnpm exec turbo run typecheck --concurrency=1
 
       - name: TSD

package/assets/.github/workflows/release-intent-auto.yml

@@ -33,7 +33,7 @@ jobs:
       - name: Setup Node.js environment
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: 24
+          node-version: 24.22.1
 
       - name: Validate GitHub App configuration
         if: ${{ github.event_name == 'workflow_dispatch' || github.event.pull_request.head.repo.full_name == github.repository }}

package/assets/.github/workflows/release.yml

@@ -98,7 +98,7 @@ jobs:
       - name: Setup Node.js environment
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: 24
+          node-version: 24.22.1
           cache: pnpm
 
       - name: Install npm with trusted publishing support
@@ -239,7 +239,7 @@ jobs:
       - name: Setup Node.js environment
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: 24
+          node-version: 24.22.1
           cache: pnpm
 
       - name: Install npm with trusted publishing support
@@ -296,7 +296,7 @@ jobs:
       - name: Setup Node.js environment
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: 24
+          node-version: 24.22.1
           cache: pnpm
 
       - name: Install Dependencies without lifecycle scripts

package/assets/.github/workflows/repoctl-docs-deploy.yml

@@ -46,7 +46,7 @@ jobs:
 
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: 24
+          node-version: 24.22.1
           cache: pnpm
 
       - run: pnpm install --frozen-lockfile

package/assets/.github/workflows/repoctl-docs.yml

@@ -47,7 +47,7 @@ jobs:
       - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
-          node-version: 24
+          node-version: 24.22.1
           cache: pnpm
       - run: pnpm install --frozen-lockfile
       - id: sites

package/assets/AGENTS.md

@@ -26,7 +26,15 @@ Preview without writing files: `pnpm exec repo new <name> --template <key> --dry
 
 If the user asks you to create a new business project, do not add it inside an
 existing unrelated repository. Use a new or empty directory outside the repoctl
-source checkout. Start a new workspace with:
+source checkout.
+
+Node.js 25+ does not bundle Corepack. On those versions, or if `corepack` is
+unavailable, first run `npm install --global corepack@0.36.0`. Then run
+`corepack enable` before the first pnpm command. After entering the generated
+project, run `corepack enable` again as shown below so pnpm uses that workspace's
+`packageManager` field.
+
+Start a new workspace with:
 
 ```bash
 pnpm create repoctl@latest <dir> -- --yes --templates <keys>
@@ -52,7 +60,7 @@ pnpm exec repo check
 
 ## Requirements
 
-- Node.js 22.13 or newer
+- Node.js matching `^22.23.4 || ^24.22.1 || >=26.12.1` (24.22.1 LTS recommended)
 - pnpm (run `corepack enable` so the declared workspace version is used)
 - CLI output is English by default; `--lang zh-CN` or `REPOCTL_LANG=zh-CN` selects Simplified Chinese
 

package/assets/CONTRIBUTING.md

@@ -6,7 +6,7 @@ repoctl accepts bug fixes, documentation improvements, tests, and focused featur
 
 ## Development setup
 
-1. Use Node.js 22.13+ and enable Corepack.
+1. Use Node.js matching `^22.23.4 || ^24.22.1 || >=26.12.1` (24.22.1 LTS recommended). On Node.js 25+ or if `corepack` is unavailable, first run `npm install --global corepack@0.36.0`; then run `corepack enable`.
 2. Run `pnpm install`.
 3. Create a focused branch from `main`.
 4. Add or update tests with the implementation.

package/assets/Dockerfile

@@ -1,4 +1,4 @@
-FROM node:22-alpine AS base
+FROM node:24.22.1-alpine AS base
 ENV PNPM_HOME="/pnpm"
 ENV PATH="$PNPM_HOME:$PATH"
 RUN corepack enable

package/assets/package.json

@@ -3,7 +3,7 @@
   "type": "module",
   "version": "0.0.0",
   "private": true,
-  "packageManager": "pnpm@12.13.0",
+  "packageManager": "pnpm@12.14.0",
   "description": "Source workspace for repoctl and Icebreaker's shared development packages",
   "author": "ice breaker <hi@sonofmagic.top>",
   "license": "MIT",
@@ -23,7 +23,7 @@
     "typescript"
   ],
   "engines": {
-    "node": ">=22.13.0"
+    "node": "^22.23.4 || ^24.22.1 || >=26.12.1"
   },
   "scripts": {
     "build": "turbo run build",
@@ -71,7 +71,7 @@
     "@commitlint/cli": "^21.2.3",
     "@eslint/config-inspector": "^3.5.0",
     "@types/node": "^26.6.5",
-    "@vitest/coverage-v8": "~5.0.4",
+    "@vitest/coverage-v8": "~5.0.5",
     "eslint": "^10.12.0",
     "execa": "^10.1.1",
     "lefthook": "2.2.2",
@@ -83,7 +83,7 @@
     "tsdown": "0.23.1",
     "turbo": "^2.11.8",
     "typescript": "^6.0.3",
-    "vitest": "~5.0.4",
+    "vitest": "~5.0.5",
     "yaml": "^2.9.1"
   },
   "publishConfig": {

package/assets/pnpm-workspace.yaml

@@ -23,7 +23,7 @@ overrides:
   vite: 8.3.4
   postcss: 8.5.30
   postcss-selector-parser: 7.1.6
-  js-yaml: 5.4.3
+  js-yaml: 5.5.0
   nanoid: 6.0.2
   brace-expansion: 5.0.12
   minimatch@<4>brace-expansion: 1.1.21

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@icebreakers/monorepo-templates",
   "type": "module",
-  "version": "3.0.0",
+  "version": "3.0.1",
   "description": "Built-in project templates and managed workspace assets for repoctl",
   "author": "ice breaker <hi@sonofmagic.top>",
   "license": "MIT",
@@ -43,7 +43,7 @@
     "templates"
   ],
   "engines": {
-    "node": ">=22.13.0"
+    "node": "^22.23.4 || ^24.22.1 || >=26.12.1"
   },
   "dependencies": {
     "@inquirer/checkbox": "^5.2.6",

package/templates/cli/package.json

@@ -25,7 +25,7 @@
     "ice": "./dev/index.ts"
   },
   "engines": {
-    "node": ">=22.13.0"
+    "node": "^22.23.4 || ^24.22.1 || >=26.12.1"
   },
   "scripts": {
     "start": "node --experimental-strip-types src/index.ts",

package/templates/client/package.json

@@ -22,7 +22,7 @@
     "template"
   ],
   "engines": {
-    "node": ">=22.13.0"
+    "node": "^22.23.4 || ^24.22.1 || >=26.12.1"
   },
   "scripts": {
     "dev": "pnpm cf-typegen && vite --host",
@@ -37,10 +37,10 @@
   },
   "dependencies": {
     "@faker-js/faker": "^10.6.0",
-    "@tanstack/vue-query": "^5.104.2",
-    "@tanstack/vue-query-devtools": "^6.3.2",
+    "@tanstack/vue-query": "^5.104.3",
+    "@tanstack/vue-query-devtools": "^6.3.3",
     "@tanstack/vue-table": "^9.3.1",
-    "@tanstack/vue-virtual": "^3.13.45",
+    "@tanstack/vue-virtual": "^3.13.46",
     "@trpc/client": "^11.19.0",
     "clsx": "^2.1.1",
     "pinia": "^4.1.0",

package/templates/next/README.md

@@ -1,6 +1,6 @@
 # Next.js App Router workspace
 
-This TypeScript template follows `create-next-app@16.3.8`'s App Router layout and uses the shared repoctl tooling. It includes a server page, a client counter and `GET /api/health`. It requires Node 22.13 or newer and shares the workspace's pnpm version and lockfile.
+This TypeScript template follows `create-next-app@16.3.8`'s App Router layout and uses the shared repoctl tooling. It includes a server page, a client counter and `GET /api/health`. It supports Node.js `^22.23.4 || ^24.22.1 || >=26.12.1` (24.22.1 LTS recommended) and shares the workspace's pnpm version and lockfile.
 
 Run these from the generated workspace root:
 

package/templates/next/package.json

@@ -6,7 +6,7 @@
   "description": "Internal Next.js App Router and TypeScript application template shipped with repoctl",
   "license": "MIT",
   "engines": {
-    "node": ">=22.13.0"
+    "node": "^22.23.4 || ^24.22.1 || >=26.12.1"
   },
   "scripts": {
     "dev": "next dev",
@@ -19,7 +19,7 @@
     "test:dev": "vitest"
   },
   "dependencies": {
-    "next": "16.4.1",
+    "next": "16.4.2",
     "react": "^19.3.1",
     "react-dom": "^19.3.1"
   },
@@ -29,8 +29,8 @@
     "@types/react": "^19.3.0",
     "@types/react-dom": "^19.3.0",
     "@vitejs/plugin-react": "^6.1.2",
-    "jsdom": "^30.1.2",
+    "jsdom": "^30.1.3",
     "typescript": "~6.0.3",
-    "vitest": "~5.0.4"
+    "vitest": "~5.0.5"
   }
 }

package/templates/nimbus/UPSTREAM.md

@@ -6,9 +6,9 @@ This template adapts the static empty starter from [Cloudflare Nimbus](https://g
 - Starter commit: `aae348048a8c659f84c39696ee6b20c2ad2f5ae2`
 - Nimbus package: `@cloudflare/nimbus-docs@0.17.0`
 - Nimbus release commit: `1951de5cc3e420a5e672f192c334584216716c1e`
-- Astro: `7.3.8`
+- Astro: `7.4.0`
 
-Nimbus declares Astro `>=7.2.6 <8`; Astro requires Node `>=22.12.0`, so this workspace retains its stricter Node `>=22.13.0` baseline. The repository validates builds, Astro diagnostics and TypeScript checks with TypeScript `6.0.3` and Vite `8.3.4`. Resolved dependencies are recorded in the monorepo's root `pnpm-lock.yaml`; generated projects use their own root workspace lockfile.
+Nimbus declares Astro `>=7.2.6 <8`; Astro `7.4.0` requires Node `>=22.22.0`. This workspace applies the stricter security baseline `^22.23.4 || ^24.22.1 || >=26.12.1` and recommends Node.js 24.22.1 LTS. The repository validates builds, Astro diagnostics and TypeScript checks with TypeScript `6.0.3` and Vite `8.3.4`. Resolved dependencies are recorded in the monorepo's root `pnpm-lock.yaml`; generated projects use their own root workspace lockfile.
 
 Agent endpoint routes and the content-loading approach come from that starter. The bilingual layout, navigation, search interface, examples and workspace checks are repoctl adaptations. These files are maintained locally; generating a project never downloads the upstream starter.
 

package/templates/nimbus/package.json

@@ -6,7 +6,7 @@
   "description": "Bilingual Nimbus documentation starter",
   "license": "MIT",
   "engines": {
-    "node": ">=22.13.0"
+    "node": "^22.23.4 || ^24.22.1 || >=26.12.1"
   },
   "scripts": {
     "dev": "astro dev",
@@ -20,7 +20,7 @@
   },
   "dependencies": {
     "@cloudflare/nimbus-docs": "0.17.0",
-    "astro": "7.3.8"
+    "astro": "7.4.0"
   },
   "devDependencies": {
     "@astrojs/check": "^0.9.10",

package/templates/react-lib/package.json

@@ -16,7 +16,7 @@
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "files": ["LICENSE", "README.md", "dist"],
-  "engines": { "node": ">=22.13.0" },
+  "engines": { "node": "^22.23.4 || ^24.22.1 || >=26.12.1" },
   "scripts": {
     "build": "vite build",
     "lint": "eslint . && stylelint \"src/**/*.css\"",
@@ -27,8 +27,8 @@
     "test:dev": "vitest"
   },
   "peerDependencies": {
-    "react": "^19.3.0",
-    "react-dom": "^19.3.0"
+    "react": "^19.3.1",
+    "react-dom": "^19.3.1"
   },
   "devDependencies": {
     "@testing-library/dom": "^10.4.2",
@@ -36,13 +36,13 @@
     "@types/react": "^19.3.0",
     "@types/react-dom": "^19.3.0",
     "@vitejs/plugin-react": "^6.1.2",
-    "jsdom": "^30.1.2",
+    "jsdom": "^30.1.3",
     "react": "^19.3.1",
     "react-dom": "^19.3.1",
     "tsd": "^0.33.0",
     "typescript": "~6.0.3",
     "vite": "^8.3.4",
     "vite-plugin-dts": "^5.1.2",
-    "vitest": "~5.0.4"
+    "vitest": "~5.0.5"
   }
 }

package/templates/react-vite/package.json

@@ -6,7 +6,7 @@
   "description": "Internal React, Vite and TypeScript application template shipped with repoctl",
   "license": "MIT",
   "engines": {
-    "node": ">=22.13.0"
+    "node": "^22.23.4 || ^24.22.1 || >=26.12.1"
   },
   "scripts": {
     "dev": "vite",
@@ -28,9 +28,9 @@
     "@types/react": "^19.3.0",
     "@types/react-dom": "^19.3.0",
     "@vitejs/plugin-react": "^6.1.2",
-    "jsdom": "^30.1.2",
+    "jsdom": "^30.1.3",
     "typescript": "~6.0.3",
     "vite": "^8.3.4",
-    "vitest": "~5.0.4"
+    "vitest": "~5.0.5"
   }
 }

package/templates/server/package.json

@@ -31,7 +31,7 @@
     "dist"
   ],
   "engines": {
-    "node": ">=22.13.0"
+    "node": "^22.23.4 || ^24.22.1 || >=26.12.1"
   },
   "scripts": {
     "dev": "pnpm cf-typegen && wrangler dev",

package/templates/tsdown/package.json

@@ -43,7 +43,7 @@
   ],
   "publishConfig": {},
   "engines": {
-    "node": ">=22.13.0"
+    "node": "^22.23.4 || ^24.22.1 || >=26.12.1"
   },
   "scripts": {
     "dev": "tsdown -w",

package/templates/vitepress/package.json

@@ -22,7 +22,7 @@
     "monorepo"
   ],
   "engines": {
-    "node": ">=22.13.0"
+    "node": "^22.23.4 || ^24.22.1 || >=26.12.1"
   },
   "scripts": {
     "dev": "vitepress dev",
@@ -44,7 +44,7 @@
     "tailwindcss": "^4.3.3",
     "vitepress": "2.0.0-alpha.20",
     "vitepress-plugin-llms": "^1.14.0",
-    "vitest": "~5.0.4",
+    "vitest": "~5.0.5",
     "vue-tsc": "^3.3.13",
     "wrangler": "^4.135.0"
   }

package/templates/vitepress/reference/devcontainer.md

@@ -10,7 +10,7 @@ repo tooling devcontainer --apply ../devcontainer-plan.json
 
 Review the JSON plan before applying it. Four files are proposed under the root `.devcontainer`: `devcontainer.json`, `Dockerfile`, `setup.mjs` and `README.md`. Existing custom files and an alternate root `.devcontainer.json` block application and are preserved. JSON contains per-file hashes and unified diffs; replaying a fully applied plan is a no-op. Input or target changes require a fresh preview. `--out` creates a new plan file and refuses to overwrite one.
 
-The preset chooses the first pinned Node version compatible with root `engines.node`: `24.21.0`, then `22.23.3`. Use `--node-version <exact-version>` for another stable Node version at least `22.13.0` that satisfies the declared range. The requested `node:<version>-bookworm` image must exist when Docker starts; preview does not contact a registry. Root `packageManager` must pin a stable pnpm version, optionally with a Corepack integrity hash.
+The preset chooses the first pinned Node version compatible with root `engines.node`: `24.22.1`, then `22.23.4`, then `26.12.1`. Node.js 24.22.1 LTS is recommended. Use `--node-version <exact-version>` for another stable Node version that satisfies both the security baseline `^22.23.4 || ^24.22.1 || >=26.12.1` and root `engines.node`. The requested `node:<version>-bookworm` image must exist when Docker starts; preview does not contact a registry. Root `packageManager` must pin a stable pnpm version, optionally with a Corepack integrity hash.
 
 Open the generated workspace with the Dev Containers extension, or explicitly run the [Dev Containers CLI](https://github.com/devcontainers/cli). Container creation installs Corepack `0.36.0`, enables pnpm, checks its exact version and installs the workspace with engine enforcement. A present `pnpm-lock.yaml` is frozen; initial setup without a lockfile creates it. Corepack or installation failures stop setup.
 

package/templates/vitepress/start/index.md

@@ -25,4 +25,6 @@ The CLI works with pnpm workspaces and understands Turborepo task graphs. It doe
 
 ## Before you continue
 
-You need Node.js 22.13 or newer and pnpm available on your path. Run commands from the repository root so repoctl can read the workspace configuration.
+You need Node.js matching `^22.23.4 || ^24.22.1 || >=26.12.1` (24.22.1 LTS recommended) and pnpm available on your path. Run commands from the repository root so repoctl can read the workspace configuration.
+
+On Node.js 25+ or if `corepack` is unavailable, first run `npm install --global corepack@0.36.0`, then run `corepack enable`. See [installation prerequisites](./install.md#prerequisites).

package/templates/vitepress/start/install-repoctl.md

@@ -7,6 +7,8 @@ description: Install repoctl in a pnpm monorepo, initialize managed defaults, an
 
 Install repoctl as a development dependency so every teammate and CI job uses the same version.
 
+Prepare pnpm first using the [installation prerequisites](./install.md#prerequisites), including installing Corepack separately on Node.js 25+ or when the `corepack` command is unavailable.
+
 ```bash
 pnpm add -D repoctl
 pnpm exec repo init

package/templates/vitepress/start/install.md

@@ -4,10 +4,12 @@ This guide follows the order you would use when adding repoctl to a workspace.
 
 ## Prerequisites
 
-- Node.js 22.13 or newer.
+- Node.js matching `^22.23.4 || ^24.22.1 || >=26.12.1` (24.22.1 LTS recommended).
 - pnpm. Corepack is recommended: `corepack enable`.
 - Git. `repo doctor` reads repository metadata and checks the commit workflow.
 
+Node.js 25+ does not bundle Corepack. On those versions, or if `corepack` is unavailable, first run `npm install --global corepack@0.36.0`, then run `corepack enable`.
+
 ```bash
 node -v
 pnpm -v

package/templates/vitepress/tasks/adopt-existing.md

@@ -8,7 +8,7 @@ Use this task when a workspace already has scripts, hooks, or configuration that
 
 - Run commands from the workspace root.
 - Commit or stash unrelated local changes.
-- Confirm that Node.js 22.13 or newer and pnpm are available.
+- Confirm that Node.js matches `^22.23.4 || ^24.22.1 || >=26.12.1` (24.22.1 LTS recommended) and pnpm is available.
 
 ## Smallest Command
 

package/templates/vitepress/tasks/ci.md

@@ -144,7 +144,7 @@ jobs:
       - uses: pnpm/action-setup@v6
       - uses: actions/setup-node@v7
         with:
-          node-version: 22
+          node-version: 24.22.1
           cache: pnpm
       - run: pnpm install --frozen-lockfile
       - id: matrix
@@ -177,7 +177,7 @@ jobs:
       - uses: pnpm/action-setup@v6
       - uses: actions/setup-node@v7
         with:
-          node-version: 22
+          node-version: 24.22.1
           cache: pnpm
       - run: pnpm install --frozen-lockfile
       - name: Run this job's planned stages

package/templates/vitepress/tasks/release.md

@@ -79,7 +79,7 @@ Choose `oidc-audit` when manually dispatching the managed Release workflow, or r
 pnpm exec repo release ci --mode oidc-audit
 ```
 
-The job needs `id-token: write`, Node 24 and the same repository, workflow file and environment as actual publishing. A different diagnostic workflow has a different identity. The managed workflow uses a separate audit job with only `contents: read` and `id-token: write`, disables install lifecycle scripts and skips GitHub App credentials and release quality checks. Only the repoctl source workspace builds its tooling closure; consumer workflows use the installed CLI. Custom workflows should use the same isolation and install with `pnpm install --frozen-lockfile --ignore-scripts`.
+The job needs `id-token: write`, Node.js 24.22.1 and the same repository, workflow file and environment as actual publishing. A different diagnostic workflow has a different identity. The managed workflow uses a separate audit job with only `contents: read` and `id-token: write`, disables install lifecycle scripts and skips GitHub App credentials and release quality checks. Only the repoctl source workspace builds its tooling closure; consumer workflows use the installed CLI. Custom workflows should use the same isolation and install with `pnpm install --frozen-lockfile --ignore-scripts`.
 
 The command independently routes before release configuration and checks every versioned public child package against the official npm registry, including packages already published. It requests short-lived exchange credentials but never uploads packages, changes versions/intents, runs hooks, writes progress files, creates tags/Releases or saves tokens. `source-sha`, `dry-run`, `package` and `version` recovery inputs must be empty. JSON includes `schemaVersion: 1`, safe identity fields, each package's HTTP status/message and `ok`; failures complete the whole package report before exiting with code 1. `auditReleaseOidc({ cwd, env?, fetch? })` exposes the same report without printing it; callers must check `ok`.
 
@@ -199,7 +199,7 @@ Scheduled npm checks skip only when every current public package is already avai
 
 Nightly runs configured `qualityScripts` and `hooks.verify`, prepares real tarballs from committed source outside the checkout, and validates package exports, types and isolated installation. Versions include the base version, nightly marker, full commit SHA and build digest. After publication, a clean consumer installs the actual tags or URLs and checks identities, entrypoints and types. Formal versioning and post-publication hooks remain part of the normal release flow.
 
-The workflow uses Node 24, the workspace's pinned pnpm, checkout without persisted credentials and the existing publication concurrency group. Reports, tarballs and consumer diagnostics are retained for 14 days, including failed runs; the Actions summary contains the result and install commands.
+The workflow uses Node.js 24.22.1, the workspace's pinned pnpm, checkout without persisted credentials and the existing publication concurrency group. Reports, tarballs and consumer diagnostics are retained for 14 days, including failed runs; the Actions summary contains the result and install commands.
 
 The workflow command is:
 

package/templates/vitepress/zh/reference/devcontainer.md

@@ -10,7 +10,7 @@ repo tooling devcontainer --apply ../devcontainer-plan.json
 
 先审阅 JSON，再应用计划。预设在根 `.devcontainer` 下生成 `devcontainer.json`、`Dockerfile`、`setup.mjs` 和 `README.md`。已有自定义文件或根 `.devcontainer.json` 会阻止应用并保留原状。JSON 提供逐文件 hash 和 unified diff；完整应用过的计划再次执行不会写入。输入或目标变化后应重新预览。`--out` 只创建新计划文件，不覆盖已有文件。
 
-默认依次从 `24.21.0`、`22.23.3` 中选择满足根 `engines.node` 的固定版本。可用 `--node-version <精确版本>` 指定其他满足声明范围、至少为 `22.13.0` 的稳定 Node 版本。启动 Docker 时对应 `node:<版本>-bookworm` 镜像必须存在；预览不会访问 registry。根 `packageManager` 必须固定稳定 pnpm 版本，可以包含 Corepack integrity hash。
+默认依次从 `24.22.1`、`22.23.4`、`26.12.1` 中选择满足根 `engines.node` 的固定版本，推荐使用 Node.js 24.22.1 LTS。可用 `--node-version <精确版本>` 指定其他同时满足安全基线 `^22.23.4 || ^24.22.1 || >=26.12.1` 和根 `engines.node` 的稳定 Node 版本。启动 Docker 时对应 `node:<版本>-bookworm` 镜像必须存在；预览不会访问 registry。根 `packageManager` 必须固定稳定 pnpm 版本，可以包含 Corepack integrity hash。
 
 生成配置后，通过 Dev Containers 扩展打开工作区，或主动运行 [Dev Containers CLI](https://github.com/devcontainers/cli)。创建容器会安装 Corepack `0.36.0`、启用 pnpm、检查其精确版本，并强制校验 engines 后安装工作区。存在 `pnpm-lock.yaml` 时使用 frozen lockfile；首次没有 lockfile 时创建它。Corepack 或安装失败会终止初始化。
 

package/templates/vitepress/zh/start/index.md

@@ -25,4 +25,6 @@ CLI 支持 pnpm workspace，并能理解 Turborepo 任务图，但不会替代
 
 ## 开始前确认
 
-你需要 Node.js 22.13 或更新版本，并确保 pnpm 在 PATH 中。从仓库根目录执行命令，这样 repoctl 才能读取 workspace 配置。
+你需要满足 `^22.23.4 || ^24.22.1 || >=26.12.1` 的 Node.js（推荐 24.22.1 LTS），并确保 pnpm 在 PATH 中。从仓库根目录执行命令，这样 repoctl 才能读取 workspace 配置。
+
+使用 Node.js 25+ 或找不到 `corepack` 命令时，先运行 `npm install --global corepack@0.36.0`，再运行 `corepack enable`。详见[安装前提](./install.md)。

package/templates/vitepress/zh/start/install-repoctl.md

@@ -7,6 +7,8 @@ description: 在 pnpm monorepo 中安装 repoctl，初始化受管默认值并
 
 把 repoctl 安装为开发依赖，让成员和 CI 使用同一个版本。
 
+先按[安装前提](./install.md)准备 pnpm；使用 Node.js 25+ 或找不到 `corepack` 命令时，需要单独安装 Corepack。
+
 ```bash
 pnpm add -D repoctl
 pnpm exec repo init

package/templates/vitepress/zh/start/install.md

@@ -4,10 +4,12 @@
 
 ## 准备环境
 
-- Node.js 22.13 或更高版本。
+- 满足 `^22.23.4 || ^24.22.1 || >=26.12.1` 的 Node.js（推荐 24.22.1 LTS）。
 - pnpm。推荐通过 Corepack 启用：`corepack enable`。
 - Git。`repo doctor` 会读取仓库信息，用来补全 package metadata 和诊断提交链路。
 
+Node.js 25+ 不再内置 Corepack。使用这些版本，或找不到 `corepack` 命令时，先运行 `npm install --global corepack@0.36.0`，再运行 `corepack enable`。
+
 ```bash
 node -v
 pnpm -v

package/templates/vitepress/zh/tasks/adopt-existing.md

@@ -8,7 +8,7 @@
 
 - 在 workspace 根目录执行命令。
 - 提交或暂存与本次接入无关的本地改动。
-- 确认 Node.js 22.13 或更新版本以及 pnpm 可用。
+- 确认 Node.js 满足 `^22.23.4 || ^24.22.1 || >=26.12.1`（推荐 24.22.1 LTS），并且 pnpm 可用。
 
 ## 最小命令
 

package/templates/vitepress/zh/tasks/ci.md

@@ -172,7 +172,7 @@ jobs:
       - uses: pnpm/action-setup@v6
       - uses: actions/setup-node@v7
         with:
-          node-version: 22
+          node-version: 24.22.1
           cache: pnpm
       - run: pnpm install --frozen-lockfile
       - id: matrix
@@ -205,7 +205,7 @@ jobs:
       - uses: pnpm/action-setup@v6
       - uses: actions/setup-node@v7
         with:
-          node-version: 22
+          node-version: 24.22.1
           cache: pnpm
       - run: pnpm install --frozen-lockfile
       - name: Run this job's planned stages

package/templates/vitepress/zh/tasks/release.md

@@ -147,7 +147,7 @@ repo release ci --mode prepare
 pnpm exec repo release ci --mode oidc-audit
 ```
 
-job 需要 `id-token: write` 和 Node 24，并使用实际发布时的仓库、工作流文件及 environment。另建诊断工作流会改变身份。受管工作流使用独立的核验 job，只授予 `contents: read` 和 `id-token: write`，关闭安装 lifecycle scripts，跳过 GitHub App 令牌及发布质量检查。只有 repoctl 源码仓库构建工具依赖闭包；消费方直接使用已安装的 CLI。自定义工作流也应隔离这些步骤，使用 `pnpm install --frozen-lockfile --ignore-scripts` 安装。
+job 需要 `id-token: write` 和 Node.js 24.22.1，并使用实际发布时的仓库、工作流文件及 environment。另建诊断工作流会改变身份。受管工作流使用独立的核验 job，只授予 `contents: read` 和 `id-token: write`，关闭安装 lifecycle scripts，跳过 GitHub App 令牌及发布质量检查。只有 repoctl 源码仓库构建工具依赖闭包；消费方直接使用已安装的 CLI。自定义工作流也应隔离这些步骤，使用 `pnpm install --frozen-lockfile --ignore-scripts` 安装。
 
 命令在加载发布配置前独立路由，向官方 npm registry 逐个核验有版本号的公开子包，包含已发布的包。它只申请短时交换凭据，不上传包、不修改版本或 intent、不运行 hooks、不写进度文件、不创建 tag/Release，也不保存 token。`source-sha`、`dry-run`、`package` 和 `version` 恢复输入必须为空。JSON 包含 `schemaVersion: 1`、允许展示的身份字段、每包 HTTP 状态及 npm 错误信息、整体 `ok`；即使某包失败也会继续完成全部包报告，最后以退出码 1 失败。程序化 API `auditReleaseOidc({ cwd, env?, fetch? })` 返回同一报告而不打印；调用者须检查 `ok`。
 
@@ -205,7 +205,7 @@ npm 定时任务只有在全部公开包都对应当前提交和同一构建身
 
 nightly 执行配置的 `qualityScripts` 和 `hooks.verify`，在检出目录以外从已提交源码构建真实 tarball，并验证包导出、类型和隔离安装。版本包含基础版本、nightly 标记、完整提交 SHA 和构建摘要。发布后，干净消费者通过实际标签或 URL 安装，再核验身份、运行入口和类型。正式版本准备与发布后 hooks 仍属于普通发布流程。
 
-工作流使用 Node 24、仓库锁定的 pnpm、不保留凭据的 checkout，并复用现有发布并发组。成功与失败均保留报告、tarball 和消费者诊断 14 天；Actions 摘要提供结果与安装命令。
+工作流使用 Node.js 24.22.1、仓库锁定的 pnpm、不保留凭据的 checkout，并复用现有发布并发组。成功与失败均保留报告、tarball 和消费者诊断 14 天；Actions 摘要提供结果与安装命令。
 
 工作流执行：
 

package/templates/vue-lib/package.json

@@ -33,7 +33,7 @@
     "dist"
   ],
   "engines": {
-    "node": ">=22.13.0"
+    "node": "^22.23.4 || ^24.22.1 || >=26.12.1"
   },
   "scripts": {
     "build": "vue-tsc -b && vite build",
@@ -62,7 +62,7 @@
     "@vitejs/plugin-vue": "^6.0.10",
     "@vue/test-utils": "^2.5.1",
     "@vue/tsconfig": "^0.9.1",
-    "jsdom": "^30.1.2",
+    "jsdom": "^30.1.3",
     "vite": "^8.3.4",
     "vite-plugin-dts": "^5.1.2",
     "vue": "^3.5.44",