@taimos/projen 0.1.95 → 0.1.97

package/API.md

@@ -2,6 +2,293 @@
 
 ## Constructs <a name="Constructs" id="Constructs"></a>
 
+### GitHooks <a name="GitHooks" id="@taimos/projen.GitHooks"></a>
+
+Local git hooks managed by Lefthook (ADR-0013): a generated `lefthook.yml`, a root `prepare` script that runs `lefthook install`, and a pinned `lefthook` devDependency.
+
+Hooks cover a staged secret scan, projen drift, lint and typecheck per
+package, and a Conventional Commits check on the first commit of a branch.
+CI should set `LEFTHOOK=0`.
+
+#### Initializers <a name="Initializers" id="@taimos/projen.GitHooks.Initializer"></a>
+
+```typescript
+import { GitHooks } from '@taimos/projen'
+
+new GitHooks(tsProject: TypeScriptProject, options?: GitHooksOptions)
+```
+
+| **Name** | **Type** | **Description** |
+| --- | --- | --- |
+| <code><a href="#@taimos/projen.GitHooks.Initializer.parameter.tsProject">tsProject</a></code> | <code>projen.typescript.TypeScriptProject</code> | *No description.* |
+| <code><a href="#@taimos/projen.GitHooks.Initializer.parameter.options">options</a></code> | <code><a href="#@taimos/projen.GitHooksOptions">GitHooksOptions</a></code> | *No description.* |
+
+---
+
+##### `tsProject`<sup>Required</sup> <a name="tsProject" id="@taimos/projen.GitHooks.Initializer.parameter.tsProject"></a>
+
+- *Type:* projen.typescript.TypeScriptProject
+
+---
+
+##### `options`<sup>Optional</sup> <a name="options" id="@taimos/projen.GitHooks.Initializer.parameter.options"></a>
+
+- *Type:* <a href="#@taimos/projen.GitHooksOptions">GitHooksOptions</a>
+
+---
+
+#### Methods <a name="Methods" id="Methods"></a>
+
+| **Name** | **Description** |
+| --- | --- |
+| <code><a href="#@taimos/projen.GitHooks.toString">toString</a></code> | Returns a string representation of this construct. |
+| <code><a href="#@taimos/projen.GitHooks.with">with</a></code> | Applies one or more mixins to this construct. |
+| <code><a href="#@taimos/projen.GitHooks.postProjectCreation">postProjectCreation</a></code> | Called once, right after `postSynthesize()`, only when the project is created for the first time. |
+| <code><a href="#@taimos/projen.GitHooks.postSynthesize">postSynthesize</a></code> | Called after synthesis. |
+| <code><a href="#@taimos/projen.GitHooks.preSynthesize">preSynthesize</a></code> | Called before synthesis. |
+| <code><a href="#@taimos/projen.GitHooks.projectCreation">projectCreation</a></code> | Called once, right after `synthesize()`, only when the project is created for the first time. |
+| <code><a href="#@taimos/projen.GitHooks.synthesize">synthesize</a></code> | Synthesizes files to the project output directory. |
+| <code><a href="#@taimos/projen.GitHooks.addPackage">addPackage</a></code> | Add a package that runs its own lint and typecheck scripts. |
+
+---
+
+##### `toString` <a name="toString" id="@taimos/projen.GitHooks.toString"></a>
+
+```typescript
+public toString(): string
+```
+
+Returns a string representation of this construct.
+
+##### `with` <a name="with" id="@taimos/projen.GitHooks.with"></a>
+
+```typescript
+public with(mixins: ...IMixin[]): IConstruct
+```
+
+Applies one or more mixins to this construct.
+
+Mixins are applied in order. The list of constructs is captured at the
+start of the call, so constructs added by a mixin will not be visited.
+Use multiple `with()` calls if subsequent mixins should apply to added
+constructs.
+
+###### `mixins`<sup>Required</sup> <a name="mixins" id="@taimos/projen.GitHooks.with.parameter.mixins"></a>
+
+- *Type:* ...constructs.IMixin[]
+
+The mixins to apply.
+
+---
+
+##### `postProjectCreation` <a name="postProjectCreation" id="@taimos/projen.GitHooks.postProjectCreation"></a>
+
+```typescript
+public postProjectCreation(initProject: InitProject): void
+```
+
+Called once, right after `postSynthesize()`, only when the project is created for the first time.
+
+It does not run on later `projen` invocations. It only fires for `projen new` (or `Projects.createProject`).
+It is also skipped when post-synthesis steps are disabled, e.g. `--no-post` or `PROJEN_DISABLE_POST`.
+Use it for one-off setup that can be turned off by the user, like running a task to give the user immediate
+feedback on their new project. Order across components is not guaranteed.
+
+###### `initProject`<sup>Required</sup> <a name="initProject" id="@taimos/projen.GitHooks.postProjectCreation.parameter.initProject"></a>
+
+- *Type:* projen.InitProject
+
+Details about how the project was created, e.g. its type and the original CLI args.
+
+---
+
+##### `postSynthesize` <a name="postSynthesize" id="@taimos/projen.GitHooks.postSynthesize"></a>
+
+```typescript
+public postSynthesize(): void
+```
+
+Called after synthesis.
+
+Order is *not* guaranteed.
+
+##### `preSynthesize` <a name="preSynthesize" id="@taimos/projen.GitHooks.preSynthesize"></a>
+
+```typescript
+public preSynthesize(): void
+```
+
+Called before synthesis.
+
+##### `projectCreation` <a name="projectCreation" id="@taimos/projen.GitHooks.projectCreation"></a>
+
+```typescript
+public projectCreation(initProject: InitProject): void
+```
+
+Called once, right after `synthesize()`, only when the project is created for the first time.
+
+It does not run on later `projen` invocations. It only fires for `projen new` (or `Projects.createProject`).
+Use it for deterministic, one-off file generation. Order across components is not guaranteed.
+
+###### `initProject`<sup>Required</sup> <a name="initProject" id="@taimos/projen.GitHooks.projectCreation.parameter.initProject"></a>
+
+- *Type:* projen.InitProject
+
+Details about how the project was created, e.g. its type and the original CLI args.
+
+---
+
+##### `synthesize` <a name="synthesize" id="@taimos/projen.GitHooks.synthesize"></a>
+
+```typescript
+public synthesize(): void
+```
+
+Synthesizes files to the project output directory.
+
+##### `addPackage` <a name="addPackage" id="@taimos/projen.GitHooks.addPackage"></a>
+
+```typescript
+public addPackage(pkg: GitHooksPackage): void
+```
+
+Add a package that runs its own lint and typecheck scripts.
+
+###### `pkg`<sup>Required</sup> <a name="pkg" id="@taimos/projen.GitHooks.addPackage.parameter.pkg"></a>
+
+- *Type:* <a href="#@taimos/projen.GitHooksPackage">GitHooksPackage</a>
+
+---
+
+#### Static Functions <a name="Static Functions" id="Static Functions"></a>
+
+| **Name** | **Description** |
+| --- | --- |
+| <code><a href="#@taimos/projen.GitHooks.isConstruct">isConstruct</a></code> | Checks if `x` is a construct. |
+| <code><a href="#@taimos/projen.GitHooks.isComponent">isComponent</a></code> | Test whether the given construct is a component. |
+
+---
+
+##### `isConstruct` <a name="isConstruct" id="@taimos/projen.GitHooks.isConstruct"></a>
+
+```typescript
+import { GitHooks } from '@taimos/projen'
+
+GitHooks.isConstruct(x: any)
+```
+
+Checks if `x` is a construct.
+
+Use this method instead of `instanceof` to properly detect `Construct`
+instances, even when the construct library is symlinked.
+
+Explanation: in JavaScript, multiple copies of the `constructs` library on
+disk are seen as independent, completely different libraries. As a
+consequence, the class `Construct` in each copy of the `constructs` library
+is seen as a different class, and an instance of one class will not test as
+`instanceof` the other class. `npm install` will not create installations
+like this, but users may manually symlink construct libraries together or
+use a monorepo tool: in those cases, multiple copies of the `constructs`
+library can be accidentally installed, and `instanceof` will behave
+unpredictably. It is safest to avoid using `instanceof`, and using
+this type-testing method instead.
+
+###### `x`<sup>Required</sup> <a name="x" id="@taimos/projen.GitHooks.isConstruct.parameter.x"></a>
+
+- *Type:* any
+
+Any object.
+
+---
+
+##### `isComponent` <a name="isComponent" id="@taimos/projen.GitHooks.isComponent"></a>
+
+```typescript
+import { GitHooks } from '@taimos/projen'
+
+GitHooks.isComponent(x: any)
+```
+
+Test whether the given construct is a component.
+
+###### `x`<sup>Required</sup> <a name="x" id="@taimos/projen.GitHooks.isComponent.parameter.x"></a>
+
+- *Type:* any
+
+---
+
+#### Properties <a name="Properties" id="Properties"></a>
+
+| **Name** | **Type** | **Description** |
+| --- | --- | --- |
+| <code><a href="#@taimos/projen.GitHooks.property.node">node</a></code> | <code>constructs.Node</code> | The tree node. |
+| <code><a href="#@taimos/projen.GitHooks.property.project">project</a></code> | <code>projen.Project</code> | *No description.* |
+| <code><a href="#@taimos/projen.GitHooks.property.commitMsgScript">commitMsgScript</a></code> | <code>projen.TextFile</code> | The generated commit-msg check script. |
+| <code><a href="#@taimos/projen.GitHooks.property.configFile">configFile</a></code> | <code>projen.YamlFile</code> | The generated `lefthook.yml`. |
+| <code><a href="#@taimos/projen.GitHooks.property.projenDriftScript">projenDriftScript</a></code> | <code>projen.TextFile</code> | The generated projen drift check script, if enabled. |
+
+---
+
+##### `node`<sup>Required</sup> <a name="node" id="@taimos/projen.GitHooks.property.node"></a>
+
+```typescript
+public readonly node: Node;
+```
+
+- *Type:* constructs.Node
+
+The tree node.
+
+---
+
+##### `project`<sup>Required</sup> <a name="project" id="@taimos/projen.GitHooks.property.project"></a>
+
+```typescript
+public readonly project: Project;
+```
+
+- *Type:* projen.Project
+
+---
+
+##### `commitMsgScript`<sup>Required</sup> <a name="commitMsgScript" id="@taimos/projen.GitHooks.property.commitMsgScript"></a>
+
+```typescript
+public readonly commitMsgScript: TextFile;
+```
+
+- *Type:* projen.TextFile
+
+The generated commit-msg check script.
+
+---
+
+##### `configFile`<sup>Required</sup> <a name="configFile" id="@taimos/projen.GitHooks.property.configFile"></a>
+
+```typescript
+public readonly configFile: YamlFile;
+```
+
+- *Type:* projen.YamlFile
+
+The generated `lefthook.yml`.
+
+---
+
+##### `projenDriftScript`<sup>Optional</sup> <a name="projenDriftScript" id="@taimos/projen.GitHooks.property.projenDriftScript"></a>
+
+```typescript
+public readonly projenDriftScript: TextFile;
+```
+
+- *Type:* projen.TextFile
+
+The generated projen drift check script, if enabled.
+
+---
+
+
 ### GitHubAmplifyDeploy <a name="GitHubAmplifyDeploy" id="@taimos/projen.GitHubAmplifyDeploy"></a>
 
 Adds one path-scoped deploy workflow per Amplify Hosting app.
@@ -1499,6 +1786,7 @@ When given a project, this it the project itself.
 | <code><a href="#@taimos/projen.MonorepoProject.property.amplifyDeploy">amplifyDeploy</a></code> | <code><a href="#@taimos/projen.GitHubAmplifyDeploy">GitHubAmplifyDeploy</a></code> | The Amplify deploy workflows, when `amplifyDeployOptions` is set. |
 | <code><a href="#@taimos/projen.MonorepoProject.property.amplifyFile">amplifyFile</a></code> | <code>projen.YamlFile</code> | The generated `amplify.yml`, if any Amplify apps were configured. |
 | <code><a href="#@taimos/projen.MonorepoProject.property.assignApprover">assignApprover</a></code> | <code>projen-pipelines.GitHubAssignApprover</code> | The PR approver assignment, if enabled. |
+| <code><a href="#@taimos/projen.MonorepoProject.property.gitHooks">gitHooks</a></code> | <code><a href="#@taimos/projen.GitHooks">GitHooks</a></code> | The Lefthook git hooks component, if enabled. |
 | <code><a href="#@taimos/projen.MonorepoProject.property.gitleaks">gitleaks</a></code> | <code><a href="#@taimos/projen.Gitleaks">Gitleaks</a></code> | The gitleaks secret-scanning component, if enabled. |
 | <code><a href="#@taimos/projen.MonorepoProject.property.productionRelease">productionRelease</a></code> | <code><a href="#@taimos/projen.GitHubProductionRelease">GitHubProductionRelease</a></code> | The production release workflow, if enabled. |
 
@@ -2273,6 +2561,18 @@ The PR approver assignment, if enabled.
 
 ---
 
+##### `gitHooks`<sup>Optional</sup> <a name="gitHooks" id="@taimos/projen.MonorepoProject.property.gitHooks"></a>
+
+```typescript
+public readonly gitHooks: GitHooks;
+```
+
+- *Type:* <a href="#@taimos/projen.GitHooks">GitHooks</a>
+
+The Lefthook git hooks component, if enabled.
+
+---
+
 ##### `gitleaks`<sup>Optional</sup> <a name="gitleaks" id="@taimos/projen.MonorepoProject.property.gitleaks"></a>
 
 ```typescript
@@ -12602,6 +12902,202 @@ The OpenAPI spec file, relative to the package root.
 
 ---
 
+### GitHooksOptions <a name="GitHooksOptions" id="@taimos/projen.GitHooksOptions"></a>
+
+#### Initializer <a name="Initializer" id="@taimos/projen.GitHooksOptions.Initializer"></a>
+
+```typescript
+import { GitHooksOptions } from '@taimos/projen'
+
+const gitHooksOptions: GitHooksOptions = { ... }
+```
+
+#### Properties <a name="Properties" id="Properties"></a>
+
+| **Name** | **Type** | **Description** |
+| --- | --- | --- |
+| <code><a href="#@taimos/projen.GitHooksOptions.property.commitTypes">commitTypes</a></code> | <code>string[]</code> | Types accepted by the commit-msg check on the first commit of a branch. |
+| <code><a href="#@taimos/projen.GitHooksOptions.property.defaultBranch">defaultBranch</a></code> | <code>string</code> | The branch the first-commit detection compares against. |
+| <code><a href="#@taimos/projen.GitHooksOptions.property.gitleaks">gitleaks</a></code> | <code>boolean</code> | Add a pre-commit gitleaks scan of staged changes. |
+| <code><a href="#@taimos/projen.GitHooksOptions.property.lefthookVersion">lefthookVersion</a></code> | <code>string</code> | The pinned lefthook version added as a devDependency. |
+| <code><a href="#@taimos/projen.GitHooksOptions.property.packages">packages</a></code> | <code><a href="#@taimos/projen.GitHooksPackage">GitHooksPackage</a>[]</code> | Additional (non-projen) packages, e.g. frontends, that run their own `lint` and `typecheck` package scripts. |
+| <code><a href="#@taimos/projen.GitHooksOptions.property.projenDrift">projenDrift</a></code> | <code>boolean</code> | Add a pre-commit check that fails when `projen` synth changes any file. |
+| <code><a href="#@taimos/projen.GitHooksOptions.property.subprojectChecks">subprojectChecks</a></code> | <code>boolean</code> | Generate eslint and `tsc --noEmit` jobs for every projen TypeScript subproject, scoped to the subproject directory. |
+
+---
+
+##### `commitTypes`<sup>Optional</sup> <a name="commitTypes" id="@taimos/projen.GitHooksOptions.property.commitTypes"></a>
+
+```typescript
+public readonly commitTypes: string[];
+```
+
+- *Type:* string[]
+- *Default:* ['feat', 'fix', 'chore', 'docs', 'ci', 'spec']
+
+Types accepted by the commit-msg check on the first commit of a branch.
+
+Keep this in sync with the PR title check.
+
+---
+
+##### `defaultBranch`<sup>Optional</sup> <a name="defaultBranch" id="@taimos/projen.GitHooksOptions.property.defaultBranch"></a>
+
+```typescript
+public readonly defaultBranch: string;
+```
+
+- *Type:* string
+- *Default:* the `defaultReleaseBranch` of the project, falling back to 'main'
+
+The branch the first-commit detection compares against.
+
+---
+
+##### `gitleaks`<sup>Optional</sup> <a name="gitleaks" id="@taimos/projen.GitHooksOptions.property.gitleaks"></a>
+
+```typescript
+public readonly gitleaks: boolean;
+```
+
+- *Type:* boolean
+- *Default:* true
+
+Add a pre-commit gitleaks scan of staged changes.
+
+Requires the `gitleaks`
+binary on the PATH. It reuses `.gitleaks.toml` when that file exists.
+
+---
+
+##### `lefthookVersion`<sup>Optional</sup> <a name="lefthookVersion" id="@taimos/projen.GitHooksOptions.property.lefthookVersion"></a>
+
+```typescript
+public readonly lefthookVersion: string;
+```
+
+- *Type:* string
+- *Default:* '1.11.13'
+
+The pinned lefthook version added as a devDependency.
+
+---
+
+##### `packages`<sup>Optional</sup> <a name="packages" id="@taimos/projen.GitHooksOptions.property.packages"></a>
+
+```typescript
+public readonly packages: GitHooksPackage[];
+```
+
+- *Type:* <a href="#@taimos/projen.GitHooksPackage">GitHooksPackage</a>[]
+- *Default:* []
+
+Additional (non-projen) packages, e.g. frontends, that run their own `lint` and `typecheck` package scripts.
+
+---
+
+##### `projenDrift`<sup>Optional</sup> <a name="projenDrift" id="@taimos/projen.GitHooksOptions.property.projenDrift"></a>
+
+```typescript
+public readonly projenDrift: boolean;
+```
+
+- *Type:* boolean
+- *Default:* true
+
+Add a pre-commit check that fails when `projen` synth changes any file.
+
+---
+
+##### `subprojectChecks`<sup>Optional</sup> <a name="subprojectChecks" id="@taimos/projen.GitHooksOptions.property.subprojectChecks"></a>
+
+```typescript
+public readonly subprojectChecks: boolean;
+```
+
+- *Type:* boolean
+- *Default:* true
+
+Generate eslint and `tsc --noEmit` jobs for every projen TypeScript subproject, scoped to the subproject directory.
+
+---
+
+### GitHooksPackage <a name="GitHooksPackage" id="@taimos/projen.GitHooksPackage"></a>
+
+A package that gets lint and typecheck jobs in `lefthook.yml`.
+
+#### Initializer <a name="Initializer" id="@taimos/projen.GitHooksPackage.Initializer"></a>
+
+```typescript
+import { GitHooksPackage } from '@taimos/projen'
+
+const gitHooksPackage: GitHooksPackage = { ... }
+```
+
+#### Properties <a name="Properties" id="Properties"></a>
+
+| **Name** | **Type** | **Description** |
+| --- | --- | --- |
+| <code><a href="#@taimos/projen.GitHooksPackage.property.path">path</a></code> | <code>string</code> | Package directory relative to the repo root, e.g. `packages/web`. |
+| <code><a href="#@taimos/projen.GitHooksPackage.property.glob">glob</a></code> | <code>string</code> | File glob that selects the staged files that trigger the jobs. |
+| <code><a href="#@taimos/projen.GitHooksPackage.property.lint">lint</a></code> | <code>string</code> | Command that lints the package. |
+| <code><a href="#@taimos/projen.GitHooksPackage.property.typecheck">typecheck</a></code> | <code>string</code> | Command that typechecks the package. |
+
+---
+
+##### `path`<sup>Required</sup> <a name="path" id="@taimos/projen.GitHooksPackage.property.path"></a>
+
+```typescript
+public readonly path: string;
+```
+
+- *Type:* string
+
+Package directory relative to the repo root, e.g. `packages/web`.
+
+---
+
+##### `glob`<sup>Optional</sup> <a name="glob" id="@taimos/projen.GitHooksPackage.property.glob"></a>
+
+```typescript
+public readonly glob: string;
+```
+
+- *Type:* string
+- *Default:* '*.{ts,tsx}'
+
+File glob that selects the staged files that trigger the jobs.
+
+---
+
+##### `lint`<sup>Optional</sup> <a name="lint" id="@taimos/projen.GitHooksPackage.property.lint"></a>
+
+```typescript
+public readonly lint: string;
+```
+
+- *Type:* string
+- *Default:* 'pnpm run lint'
+
+Command that lints the package.
+
+`{staged_files}` is replaced by lefthook.
+
+---
+
+##### `typecheck`<sup>Optional</sup> <a name="typecheck" id="@taimos/projen.GitHooksPackage.property.typecheck"></a>
+
+```typescript
+public readonly typecheck: string;
+```
+
+- *Type:* string
+- *Default:* 'pnpm run typecheck'
+
+Command that typechecks the package.
+
+---
+
 ### GitHubAmplifyDeployOptions <a name="GitHubAmplifyDeployOptions" id="@taimos/projen.GitHubAmplifyDeployOptions"></a>
 
 #### Initializer <a name="Initializer" id="@taimos/projen.GitHubAmplifyDeployOptions.Initializer"></a>
@@ -13238,8 +13734,11 @@ const monorepoProjectOptions: MonorepoProjectOptions = { ... }
 | <code><a href="#@taimos/projen.MonorepoProjectOptions.property.npmRegistryUrl">npmRegistryUrl</a></code> | <code>string</code> | The base URL of the npm package registry. |
 | <code><a href="#@taimos/projen.MonorepoProjectOptions.property.npmTokenSecret">npmTokenSecret</a></code> | <code>string</code> | GitHub secret which contains the NPM token to use when publishing packages. |
 | <code><a href="#@taimos/projen.MonorepoProjectOptions.property.npmTrustedPublishing">npmTrustedPublishing</a></code> | <code>boolean</code> | Use trusted publishing for publishing to npmjs.com Needs to be pre-configured on npm.js to work. |
+| <code><a href="#@taimos/projen.MonorepoProjectOptions.property.npmVerifyPublished">npmVerifyPublished</a></code> | <code>boolean</code> | Wait until the published package version is available from the npm registry before the publish job completes. |
+| <code><a href="#@taimos/projen.MonorepoProjectOptions.property.npmVerifyPublishedTimeoutSeconds">npmVerifyPublishedTimeoutSeconds</a></code> | <code>number</code> | How long to wait, in seconds, for the published package version to be available. |
 | <code><a href="#@taimos/projen.MonorepoProjectOptions.property.packageManager">packageManager</a></code> | <code>projen.javascript.NodePackageManager</code> | The Node Package Manager used to execute scripts. |
 | <code><a href="#@taimos/projen.MonorepoProjectOptions.property.packageName">packageName</a></code> | <code>string</code> | The "name" in package.json. |
+| <code><a href="#@taimos/projen.MonorepoProjectOptions.property.peerDependenciesMeta">peerDependenciesMeta</a></code> | <code>{[ key: string ]: projen.javascript.PeerDependencyMeta}</code> | Additional information about how peer dependencies are used, rendered as `peerDependenciesMeta` in `package.json`. For example, this can mark peer dependencies as optional. |
 | <code><a href="#@taimos/projen.MonorepoProjectOptions.property.peerDependencyOptions">peerDependencyOptions</a></code> | <code>projen.javascript.PeerDependencyOptions</code> | Options for `peerDeps`. |
 | <code><a href="#@taimos/projen.MonorepoProjectOptions.property.peerDeps">peerDeps</a></code> | <code>string[]</code> | Peer dependencies for this module. |
 | <code><a href="#@taimos/projen.MonorepoProjectOptions.property.pnpmOptions">pnpmOptions</a></code> | <code>projen.javascript.PnpmOptions</code> | Options for pnpm. |
@@ -13313,6 +13812,7 @@ const monorepoProjectOptions: MonorepoProjectOptions = { ... }
 | <code><a href="#@taimos/projen.MonorepoProjectOptions.property.workflowGitIdentity">workflowGitIdentity</a></code> | <code>projen.github.GitIdentity</code> | The git identity to use in workflows. |
 | <code><a href="#@taimos/projen.MonorepoProjectOptions.property.workflowNodeVersion">workflowNodeVersion</a></code> | <code>string</code> | The node version used in GitHub Actions workflows. |
 | <code><a href="#@taimos/projen.MonorepoProjectOptions.property.workflowPackageCache">workflowPackageCache</a></code> | <code>boolean</code> | Enable Node.js package cache in GitHub workflows. |
+| <code><a href="#@taimos/projen.MonorepoProjectOptions.property.workflowPermissions">workflowPermissions</a></code> | <code>projen.github.workflows.JobPermissions</code> | Permissions for the main build, release and dependency upgrade jobs. |
 | <code><a href="#@taimos/projen.MonorepoProjectOptions.property.disableTsconfig">disableTsconfig</a></code> | <code>boolean</code> | Do not generate a `tsconfig.json` file (used by jsii projects since tsconfig.json is generated by the jsii compiler). |
 | <code><a href="#@taimos/projen.MonorepoProjectOptions.property.disableTsconfigDev">disableTsconfigDev</a></code> | <code>boolean</code> | Do not generate a development tsconfig file. |
 | <code><a href="#@taimos/projen.MonorepoProjectOptions.property.docgen">docgen</a></code> | <code>boolean</code> | Docgen by Typedoc. |
@@ -13339,6 +13839,8 @@ const monorepoProjectOptions: MonorepoProjectOptions = { ... }
 | <code><a href="#@taimos/projen.MonorepoProjectOptions.property.assignApprover">assignApprover</a></code> | <code>boolean</code> | Whether to assign PR approvers via `GitHubAssignApprover`. |
 | <code><a href="#@taimos/projen.MonorepoProjectOptions.property.cdkServerless">cdkServerless</a></code> | <code>boolean</code> | Whether to add `cdk-serverless` as a workspace dev dependency. |
 | <code><a href="#@taimos/projen.MonorepoProjectOptions.property.defaultApprovers">defaultApprovers</a></code> | <code>string[]</code> | Approvers assigned when no author-specific mapping matches. |
+| <code><a href="#@taimos/projen.MonorepoProjectOptions.property.gitHooks">gitHooks</a></code> | <code>boolean</code> | Whether to add local git hooks managed by Lefthook: a `lefthook.yml`, a root `prepare` script and a pinned `lefthook` devDependency (see `GitHooks`). |
+| <code><a href="#@taimos/projen.MonorepoProjectOptions.property.gitHooksOptions">gitHooksOptions</a></code> | <code><a href="#@taimos/projen.GitHooksOptions">GitHooksOptions</a></code> | Options for the git hooks component. |
 | <code><a href="#@taimos/projen.MonorepoProjectOptions.property.gitleaks">gitleaks</a></code> | <code>boolean</code> | Whether to add gitleaks secret-scanning: a `.gitleaks.toml` config plus a pull-request workflow that scans the full git history (see `Gitleaks`). |
 | <code><a href="#@taimos/projen.MonorepoProjectOptions.property.gitleaksOptions">gitleaksOptions</a></code> | <code><a href="#@taimos/projen.GitleaksOptions">GitleaksOptions</a></code> | Options for the gitleaks component. |
 | <code><a href="#@taimos/projen.MonorepoProjectOptions.property.nodeVersion">nodeVersion</a></code> | <code>string</code> | The Node.js version used in the generated build workflow. |
@@ -14246,7 +14748,8 @@ public readonly npmRegistryUrl: string;
 
 The base URL of the npm package registry.
 
-Must be a URL (e.g. start with "https://" or "http://")
+Must be a URL (e.g. start with "https://" or "http://").
+A trailing slash is added if missing.
 
 ---
 
@@ -14276,6 +14779,36 @@ Use trusted publishing for publishing to npmjs.com Needs to be pre-configured on
 
 ---
 
+##### `npmVerifyPublished`<sup>Optional</sup> <a name="npmVerifyPublished" id="@taimos/projen.MonorepoProjectOptions.property.npmVerifyPublished"></a>
+
+```typescript
+public readonly npmVerifyPublished: boolean;
+```
+
+- *Type:* boolean
+- *Default:* false
+
+Wait until the published package version is available from the npm registry before the publish job completes.
+
+Enable this when packages that depend on the published package are released right after.
+
+---
+
+##### `npmVerifyPublishedTimeoutSeconds`<sup>Optional</sup> <a name="npmVerifyPublishedTimeoutSeconds" id="@taimos/projen.MonorepoProjectOptions.property.npmVerifyPublishedTimeoutSeconds"></a>
+
+```typescript
+public readonly npmVerifyPublishedTimeoutSeconds: number;
+```
+
+- *Type:* number
+- *Default:* 3600
+
+How long to wait, in seconds, for the published package version to be available.
+
+Requires `npmVerifyPublished` to be enabled.
+
+---
+
 ##### `packageManager`<sup>Optional</sup> <a name="packageManager" id="@taimos/projen.MonorepoProjectOptions.property.packageManager"></a>
 
 ```typescript
@@ -14302,6 +14835,30 @@ The "name" in package.json.
 
 ---
 
+##### `peerDependenciesMeta`<sup>Optional</sup> <a name="peerDependenciesMeta" id="@taimos/projen.MonorepoProjectOptions.property.peerDependenciesMeta"></a>
+
+```typescript
+public readonly peerDependenciesMeta: {[ key: string ]: PeerDependencyMeta};
+```
+
+- *Type:* {[ key: string ]: projen.javascript.PeerDependencyMeta}
+- *Default:* no `peerDependenciesMeta`
+
+Additional information about how peer dependencies are used, rendered as `peerDependenciesMeta` in `package.json`. For example, this can mark peer dependencies as optional.
+
+Each key must also be declared as a peer dependency.
+
+> [https://docs.npmjs.com/cli/v11/configuring-npm/package-json#peerdependenciesmeta](https://docs.npmjs.com/cli/v11/configuring-npm/package-json#peerdependenciesmeta)
+
+---
+
+*Example*
+
+```typescript
+{ "aws-cdk-lib": { optional: true } }
+```
+
+
 ##### `peerDependencyOptions`<sup>Optional</sup> <a name="peerDependencyOptions" id="@taimos/projen.MonorepoProjectOptions.property.peerDependencyOptions"></a>
 
 ```typescript
@@ -15346,6 +15903,28 @@ Enable Node.js package cache in GitHub workflows.
 
 ---
 
+##### `workflowPermissions`<sup>Optional</sup> <a name="workflowPermissions" id="@taimos/projen.MonorepoProjectOptions.property.workflowPermissions"></a>
+
+```typescript
+public readonly workflowPermissions: JobPermissions;
+```
+
+- *Type:* projen.github.workflows.JobPermissions
+- *Default:* Use the job defaults and automatically inferred permissions.
+
+Permissions for the main build, release and dependency upgrade jobs.
+
+Defined scopes override the job defaults and automatically inferred permissions,
+including CodeArtifact and Codecov OIDC. Undefined scopes keep their defaults.
+Use `JobPermission.NONE` to explicitly remove a permission.
+
+`buildWorkflowOptions.permissions` replaces this entire set, including automatic
+permissions. `depsUpgradeOptions.workflowOptions.permissions` overrides individual
+scopes. Applies to all release branches, but not to separate package, publishing,
+self-mutation or pull request creation jobs, or unrelated workflows.
+
+---
+
 ##### `disableTsconfig`<sup>Optional</sup> <a name="disableTsconfig" id="@taimos/projen.MonorepoProjectOptions.property.disableTsconfig"></a>
 
 ```typescript
@@ -15715,6 +16294,34 @@ Only used when `assignApprover` is enabled.
 
 ---
 
+##### `gitHooks`<sup>Optional</sup> <a name="gitHooks" id="@taimos/projen.MonorepoProjectOptions.property.gitHooks"></a>
+
+```typescript
+public readonly gitHooks: boolean;
+```
+
+- *Type:* boolean
+- *Default:* false
+
+Whether to add local git hooks managed by Lefthook: a `lefthook.yml`, a root `prepare` script and a pinned `lefthook` devDependency (see `GitHooks`).
+
+---
+
+##### `gitHooksOptions`<sup>Optional</sup> <a name="gitHooksOptions" id="@taimos/projen.MonorepoProjectOptions.property.gitHooksOptions"></a>
+
+```typescript
+public readonly gitHooksOptions: GitHooksOptions;
+```
+
+- *Type:* <a href="#@taimos/projen.GitHooksOptions">GitHooksOptions</a>
+- *Default:* all checks enabled, first-commit types feat, fix, chore, docs, ci, spec
+
+Options for the git hooks component.
+
+Only used when `gitHooks` is enabled.
+
+---
+
 ##### `gitleaks`<sup>Optional</sup> <a name="gitleaks" id="@taimos/projen.MonorepoProjectOptions.property.gitleaks"></a>
 
 ```typescript
@@ -16006,8 +16613,11 @@ const privateTaimosCdkAppOptions: PrivateTaimosCdkAppOptions = { ... }
 | <code><a href="#@taimos/projen.PrivateTaimosCdkAppOptions.property.npmRegistryUrl">npmRegistryUrl</a></code> | <code>string</code> | The base URL of the npm package registry. |
 | <code><a href="#@taimos/projen.PrivateTaimosCdkAppOptions.property.npmTokenSecret">npmTokenSecret</a></code> | <code>string</code> | GitHub secret which contains the NPM token to use when publishing packages. |
 | <code><a href="#@taimos/projen.PrivateTaimosCdkAppOptions.property.npmTrustedPublishing">npmTrustedPublishing</a></code> | <code>boolean</code> | Use trusted publishing for publishing to npmjs.com Needs to be pre-configured on npm.js to work. |
+| <code><a href="#@taimos/projen.PrivateTaimosCdkAppOptions.property.npmVerifyPublished">npmVerifyPublished</a></code> | <code>boolean</code> | Wait until the published package version is available from the npm registry before the publish job completes. |
+| <code><a href="#@taimos/projen.PrivateTaimosCdkAppOptions.property.npmVerifyPublishedTimeoutSeconds">npmVerifyPublishedTimeoutSeconds</a></code> | <code>number</code> | How long to wait, in seconds, for the published package version to be available. |
 | <code><a href="#@taimos/projen.PrivateTaimosCdkAppOptions.property.packageManager">packageManager</a></code> | <code>projen.javascript.NodePackageManager</code> | The Node Package Manager used to execute scripts. |
 | <code><a href="#@taimos/projen.PrivateTaimosCdkAppOptions.property.packageName">packageName</a></code> | <code>string</code> | The "name" in package.json. |
+| <code><a href="#@taimos/projen.PrivateTaimosCdkAppOptions.property.peerDependenciesMeta">peerDependenciesMeta</a></code> | <code>{[ key: string ]: projen.javascript.PeerDependencyMeta}</code> | Additional information about how peer dependencies are used, rendered as `peerDependenciesMeta` in `package.json`. For example, this can mark peer dependencies as optional. |
 | <code><a href="#@taimos/projen.PrivateTaimosCdkAppOptions.property.peerDependencyOptions">peerDependencyOptions</a></code> | <code>projen.javascript.PeerDependencyOptions</code> | Options for `peerDeps`. |
 | <code><a href="#@taimos/projen.PrivateTaimosCdkAppOptions.property.peerDeps">peerDeps</a></code> | <code>string[]</code> | Peer dependencies for this module. |
 | <code><a href="#@taimos/projen.PrivateTaimosCdkAppOptions.property.pnpmOptions">pnpmOptions</a></code> | <code>projen.javascript.PnpmOptions</code> | Options for pnpm. |
@@ -16081,6 +16691,7 @@ const privateTaimosCdkAppOptions: PrivateTaimosCdkAppOptions = { ... }
 | <code><a href="#@taimos/projen.PrivateTaimosCdkAppOptions.property.workflowGitIdentity">workflowGitIdentity</a></code> | <code>projen.github.GitIdentity</code> | The git identity to use in workflows. |
 | <code><a href="#@taimos/projen.PrivateTaimosCdkAppOptions.property.workflowNodeVersion">workflowNodeVersion</a></code> | <code>string</code> | The node version used in GitHub Actions workflows. |
 | <code><a href="#@taimos/projen.PrivateTaimosCdkAppOptions.property.workflowPackageCache">workflowPackageCache</a></code> | <code>boolean</code> | Enable Node.js package cache in GitHub workflows. |
+| <code><a href="#@taimos/projen.PrivateTaimosCdkAppOptions.property.workflowPermissions">workflowPermissions</a></code> | <code>projen.github.workflows.JobPermissions</code> | Permissions for the main build, release and dependency upgrade jobs. |
 | <code><a href="#@taimos/projen.PrivateTaimosCdkAppOptions.property.disableTsconfig">disableTsconfig</a></code> | <code>boolean</code> | Do not generate a `tsconfig.json` file (used by jsii projects since tsconfig.json is generated by the jsii compiler). |
 | <code><a href="#@taimos/projen.PrivateTaimosCdkAppOptions.property.disableTsconfigDev">disableTsconfigDev</a></code> | <code>boolean</code> | Do not generate a development tsconfig file. |
 | <code><a href="#@taimos/projen.PrivateTaimosCdkAppOptions.property.docgen">docgen</a></code> | <code>boolean</code> | Docgen by Typedoc. |
@@ -16106,6 +16717,7 @@ const privateTaimosCdkAppOptions: PrivateTaimosCdkAppOptions = { ... }
 | <code><a href="#@taimos/projen.PrivateTaimosCdkAppOptions.property.context">context</a></code> | <code>{[ key: string ]: any}</code> | Additional context to include in `cdk.json`. |
 | <code><a href="#@taimos/projen.PrivateTaimosCdkAppOptions.property.featureFlags">featureFlags</a></code> | <code>projen.awscdk.ICdkFeatureFlags</code> | Feature flags that should be enabled in `cdk.json`. |
 | <code><a href="#@taimos/projen.PrivateTaimosCdkAppOptions.property.requireApproval">requireApproval</a></code> | <code>projen.awscdk.ApprovalLevel</code> | To protect you against unintended changes that affect your security posture, the AWS CDK Toolkit prompts you to approve security-related changes before deploying them. |
+| <code><a href="#@taimos/projen.PrivateTaimosCdkAppOptions.property.versionReporting">versionReporting</a></code> | <code>boolean</code> | Enable AWS CDK library version reporting. |
 | <code><a href="#@taimos/projen.PrivateTaimosCdkAppOptions.property.watchExcludes">watchExcludes</a></code> | <code>string[]</code> | Glob patterns to exclude from `cdk watch`. |
 | <code><a href="#@taimos/projen.PrivateTaimosCdkAppOptions.property.watchIncludes">watchIncludes</a></code> | <code>string[]</code> | Glob patterns to include in `cdk watch`. |
 | <code><a href="#@taimos/projen.PrivateTaimosCdkAppOptions.property.cdkVersion">cdkVersion</a></code> | <code>string</code> | Minimum version of the AWS CDK to depend on. |
@@ -17022,7 +17634,8 @@ public readonly npmRegistryUrl: string;
 
 The base URL of the npm package registry.
 
-Must be a URL (e.g. start with "https://" or "http://")
+Must be a URL (e.g. start with "https://" or "http://").
+A trailing slash is added if missing.
 
 ---
 
@@ -17052,6 +17665,36 @@ Use trusted publishing for publishing to npmjs.com Needs to be pre-configured on
 
 ---
 
+##### `npmVerifyPublished`<sup>Optional</sup> <a name="npmVerifyPublished" id="@taimos/projen.PrivateTaimosCdkAppOptions.property.npmVerifyPublished"></a>
+
+```typescript
+public readonly npmVerifyPublished: boolean;
+```
+
+- *Type:* boolean
+- *Default:* false
+
+Wait until the published package version is available from the npm registry before the publish job completes.
+
+Enable this when packages that depend on the published package are released right after.
+
+---
+
+##### `npmVerifyPublishedTimeoutSeconds`<sup>Optional</sup> <a name="npmVerifyPublishedTimeoutSeconds" id="@taimos/projen.PrivateTaimosCdkAppOptions.property.npmVerifyPublishedTimeoutSeconds"></a>
+
+```typescript
+public readonly npmVerifyPublishedTimeoutSeconds: number;
+```
+
+- *Type:* number
+- *Default:* 3600
+
+How long to wait, in seconds, for the published package version to be available.
+
+Requires `npmVerifyPublished` to be enabled.
+
+---
+
 ##### `packageManager`<sup>Optional</sup> <a name="packageManager" id="@taimos/projen.PrivateTaimosCdkAppOptions.property.packageManager"></a>
 
 ```typescript
@@ -17078,6 +17721,30 @@ The "name" in package.json.
 
 ---
 
+##### `peerDependenciesMeta`<sup>Optional</sup> <a name="peerDependenciesMeta" id="@taimos/projen.PrivateTaimosCdkAppOptions.property.peerDependenciesMeta"></a>
+
+```typescript
+public readonly peerDependenciesMeta: {[ key: string ]: PeerDependencyMeta};
+```
+
+- *Type:* {[ key: string ]: projen.javascript.PeerDependencyMeta}
+- *Default:* no `peerDependenciesMeta`
+
+Additional information about how peer dependencies are used, rendered as `peerDependenciesMeta` in `package.json`. For example, this can mark peer dependencies as optional.
+
+Each key must also be declared as a peer dependency.
+
+> [https://docs.npmjs.com/cli/v11/configuring-npm/package-json#peerdependenciesmeta](https://docs.npmjs.com/cli/v11/configuring-npm/package-json#peerdependenciesmeta)
+
+---
+
+*Example*
+
+```typescript
+{ "aws-cdk-lib": { optional: true } }
+```
+
+
 ##### `peerDependencyOptions`<sup>Optional</sup> <a name="peerDependencyOptions" id="@taimos/projen.PrivateTaimosCdkAppOptions.property.peerDependencyOptions"></a>
 
 ```typescript
@@ -18122,6 +18789,28 @@ Enable Node.js package cache in GitHub workflows.
 
 ---
 
+##### `workflowPermissions`<sup>Optional</sup> <a name="workflowPermissions" id="@taimos/projen.PrivateTaimosCdkAppOptions.property.workflowPermissions"></a>
+
+```typescript
+public readonly workflowPermissions: JobPermissions;
+```
+
+- *Type:* projen.github.workflows.JobPermissions
+- *Default:* Use the job defaults and automatically inferred permissions.
+
+Permissions for the main build, release and dependency upgrade jobs.
+
+Defined scopes override the job defaults and automatically inferred permissions,
+including CodeArtifact and Codecov OIDC. Undefined scopes keep their defaults.
+Use `JobPermission.NONE` to explicitly remove a permission.
+
+`buildWorkflowOptions.permissions` replaces this entire set, including automatic
+permissions. `depsUpgradeOptions.workflowOptions.permissions` overrides individual
+scopes. Applies to all release branches, but not to separate package, publishing,
+self-mutation or pull request creation jobs, or unrelated workflows.
+
+---
+
 ##### `disableTsconfig`<sup>Optional</sup> <a name="disableTsconfig" id="@taimos/projen.PrivateTaimosCdkAppOptions.property.disableTsconfig"></a>
 
 ```typescript
@@ -18479,6 +19168,21 @@ To protect you against unintended changes that affect your security posture, the
 
 ---
 
+##### `versionReporting`<sup>Optional</sup> <a name="versionReporting" id="@taimos/projen.PrivateTaimosCdkAppOptions.property.versionReporting"></a>
+
+```typescript
+public readonly versionReporting: boolean;
+```
+
+- *Type:* boolean
+- *Default:* use the AWS CDK default
+
+Enable AWS CDK library version reporting.
+
+> [https://docs.aws.amazon.com/cdk/v2/guide/usage-data.html](https://docs.aws.amazon.com/cdk/v2/guide/usage-data.html)
+
+---
+
 ##### `watchExcludes`<sup>Optional</sup> <a name="watchExcludes" id="@taimos/projen.PrivateTaimosCdkAppOptions.property.watchExcludes"></a>
 
 ```typescript
@@ -18779,8 +19483,11 @@ const productionTaimosCdkAppOptions: ProductionTaimosCdkAppOptions = { ... }
 | <code><a href="#@taimos/projen.ProductionTaimosCdkAppOptions.property.npmRegistryUrl">npmRegistryUrl</a></code> | <code>string</code> | The base URL of the npm package registry. |
 | <code><a href="#@taimos/projen.ProductionTaimosCdkAppOptions.property.npmTokenSecret">npmTokenSecret</a></code> | <code>string</code> | GitHub secret which contains the NPM token to use when publishing packages. |
 | <code><a href="#@taimos/projen.ProductionTaimosCdkAppOptions.property.npmTrustedPublishing">npmTrustedPublishing</a></code> | <code>boolean</code> | Use trusted publishing for publishing to npmjs.com Needs to be pre-configured on npm.js to work. |
+| <code><a href="#@taimos/projen.ProductionTaimosCdkAppOptions.property.npmVerifyPublished">npmVerifyPublished</a></code> | <code>boolean</code> | Wait until the published package version is available from the npm registry before the publish job completes. |
+| <code><a href="#@taimos/projen.ProductionTaimosCdkAppOptions.property.npmVerifyPublishedTimeoutSeconds">npmVerifyPublishedTimeoutSeconds</a></code> | <code>number</code> | How long to wait, in seconds, for the published package version to be available. |
 | <code><a href="#@taimos/projen.ProductionTaimosCdkAppOptions.property.packageManager">packageManager</a></code> | <code>projen.javascript.NodePackageManager</code> | The Node Package Manager used to execute scripts. |
 | <code><a href="#@taimos/projen.ProductionTaimosCdkAppOptions.property.packageName">packageName</a></code> | <code>string</code> | The "name" in package.json. |
+| <code><a href="#@taimos/projen.ProductionTaimosCdkAppOptions.property.peerDependenciesMeta">peerDependenciesMeta</a></code> | <code>{[ key: string ]: projen.javascript.PeerDependencyMeta}</code> | Additional information about how peer dependencies are used, rendered as `peerDependenciesMeta` in `package.json`. For example, this can mark peer dependencies as optional. |
 | <code><a href="#@taimos/projen.ProductionTaimosCdkAppOptions.property.peerDependencyOptions">peerDependencyOptions</a></code> | <code>projen.javascript.PeerDependencyOptions</code> | Options for `peerDeps`. |
 | <code><a href="#@taimos/projen.ProductionTaimosCdkAppOptions.property.peerDeps">peerDeps</a></code> | <code>string[]</code> | Peer dependencies for this module. |
 | <code><a href="#@taimos/projen.ProductionTaimosCdkAppOptions.property.pnpmOptions">pnpmOptions</a></code> | <code>projen.javascript.PnpmOptions</code> | Options for pnpm. |
@@ -18854,6 +19561,7 @@ const productionTaimosCdkAppOptions: ProductionTaimosCdkAppOptions = { ... }
 | <code><a href="#@taimos/projen.ProductionTaimosCdkAppOptions.property.workflowGitIdentity">workflowGitIdentity</a></code> | <code>projen.github.GitIdentity</code> | The git identity to use in workflows. |
 | <code><a href="#@taimos/projen.ProductionTaimosCdkAppOptions.property.workflowNodeVersion">workflowNodeVersion</a></code> | <code>string</code> | The node version used in GitHub Actions workflows. |
 | <code><a href="#@taimos/projen.ProductionTaimosCdkAppOptions.property.workflowPackageCache">workflowPackageCache</a></code> | <code>boolean</code> | Enable Node.js package cache in GitHub workflows. |
+| <code><a href="#@taimos/projen.ProductionTaimosCdkAppOptions.property.workflowPermissions">workflowPermissions</a></code> | <code>projen.github.workflows.JobPermissions</code> | Permissions for the main build, release and dependency upgrade jobs. |
 | <code><a href="#@taimos/projen.ProductionTaimosCdkAppOptions.property.disableTsconfig">disableTsconfig</a></code> | <code>boolean</code> | Do not generate a `tsconfig.json` file (used by jsii projects since tsconfig.json is generated by the jsii compiler). |
 | <code><a href="#@taimos/projen.ProductionTaimosCdkAppOptions.property.disableTsconfigDev">disableTsconfigDev</a></code> | <code>boolean</code> | Do not generate a development tsconfig file. |
 | <code><a href="#@taimos/projen.ProductionTaimosCdkAppOptions.property.docgen">docgen</a></code> | <code>boolean</code> | Docgen by Typedoc. |
@@ -18879,6 +19587,7 @@ const productionTaimosCdkAppOptions: ProductionTaimosCdkAppOptions = { ... }
 | <code><a href="#@taimos/projen.ProductionTaimosCdkAppOptions.property.context">context</a></code> | <code>{[ key: string ]: any}</code> | Additional context to include in `cdk.json`. |
 | <code><a href="#@taimos/projen.ProductionTaimosCdkAppOptions.property.featureFlags">featureFlags</a></code> | <code>projen.awscdk.ICdkFeatureFlags</code> | Feature flags that should be enabled in `cdk.json`. |
 | <code><a href="#@taimos/projen.ProductionTaimosCdkAppOptions.property.requireApproval">requireApproval</a></code> | <code>projen.awscdk.ApprovalLevel</code> | To protect you against unintended changes that affect your security posture, the AWS CDK Toolkit prompts you to approve security-related changes before deploying them. |
+| <code><a href="#@taimos/projen.ProductionTaimosCdkAppOptions.property.versionReporting">versionReporting</a></code> | <code>boolean</code> | Enable AWS CDK library version reporting. |
 | <code><a href="#@taimos/projen.ProductionTaimosCdkAppOptions.property.watchExcludes">watchExcludes</a></code> | <code>string[]</code> | Glob patterns to exclude from `cdk watch`. |
 | <code><a href="#@taimos/projen.ProductionTaimosCdkAppOptions.property.watchIncludes">watchIncludes</a></code> | <code>string[]</code> | Glob patterns to include in `cdk watch`. |
 | <code><a href="#@taimos/projen.ProductionTaimosCdkAppOptions.property.cdkVersion">cdkVersion</a></code> | <code>string</code> | Minimum version of the AWS CDK to depend on. |
@@ -19799,7 +20508,8 @@ public readonly npmRegistryUrl: string;
 
 The base URL of the npm package registry.
 
-Must be a URL (e.g. start with "https://" or "http://")
+Must be a URL (e.g. start with "https://" or "http://").
+A trailing slash is added if missing.
 
 ---
 
@@ -19829,6 +20539,36 @@ Use trusted publishing for publishing to npmjs.com Needs to be pre-configured on
 
 ---
 
+##### `npmVerifyPublished`<sup>Optional</sup> <a name="npmVerifyPublished" id="@taimos/projen.ProductionTaimosCdkAppOptions.property.npmVerifyPublished"></a>
+
+```typescript
+public readonly npmVerifyPublished: boolean;
+```
+
+- *Type:* boolean
+- *Default:* false
+
+Wait until the published package version is available from the npm registry before the publish job completes.
+
+Enable this when packages that depend on the published package are released right after.
+
+---
+
+##### `npmVerifyPublishedTimeoutSeconds`<sup>Optional</sup> <a name="npmVerifyPublishedTimeoutSeconds" id="@taimos/projen.ProductionTaimosCdkAppOptions.property.npmVerifyPublishedTimeoutSeconds"></a>
+
+```typescript
+public readonly npmVerifyPublishedTimeoutSeconds: number;
+```
+
+- *Type:* number
+- *Default:* 3600
+
+How long to wait, in seconds, for the published package version to be available.
+
+Requires `npmVerifyPublished` to be enabled.
+
+---
+
 ##### `packageManager`<sup>Optional</sup> <a name="packageManager" id="@taimos/projen.ProductionTaimosCdkAppOptions.property.packageManager"></a>
 
 ```typescript
@@ -19855,6 +20595,30 @@ The "name" in package.json.
 
 ---
 
+##### `peerDependenciesMeta`<sup>Optional</sup> <a name="peerDependenciesMeta" id="@taimos/projen.ProductionTaimosCdkAppOptions.property.peerDependenciesMeta"></a>
+
+```typescript
+public readonly peerDependenciesMeta: {[ key: string ]: PeerDependencyMeta};
+```
+
+- *Type:* {[ key: string ]: projen.javascript.PeerDependencyMeta}
+- *Default:* no `peerDependenciesMeta`
+
+Additional information about how peer dependencies are used, rendered as `peerDependenciesMeta` in `package.json`. For example, this can mark peer dependencies as optional.
+
+Each key must also be declared as a peer dependency.
+
+> [https://docs.npmjs.com/cli/v11/configuring-npm/package-json#peerdependenciesmeta](https://docs.npmjs.com/cli/v11/configuring-npm/package-json#peerdependenciesmeta)
+
+---
+
+*Example*
+
+```typescript
+{ "aws-cdk-lib": { optional: true } }
+```
+
+
 ##### `peerDependencyOptions`<sup>Optional</sup> <a name="peerDependencyOptions" id="@taimos/projen.ProductionTaimosCdkAppOptions.property.peerDependencyOptions"></a>
 
 ```typescript
@@ -20899,6 +21663,28 @@ Enable Node.js package cache in GitHub workflows.
 
 ---
 
+##### `workflowPermissions`<sup>Optional</sup> <a name="workflowPermissions" id="@taimos/projen.ProductionTaimosCdkAppOptions.property.workflowPermissions"></a>
+
+```typescript
+public readonly workflowPermissions: JobPermissions;
+```
+
+- *Type:* projen.github.workflows.JobPermissions
+- *Default:* Use the job defaults and automatically inferred permissions.
+
+Permissions for the main build, release and dependency upgrade jobs.
+
+Defined scopes override the job defaults and automatically inferred permissions,
+including CodeArtifact and Codecov OIDC. Undefined scopes keep their defaults.
+Use `JobPermission.NONE` to explicitly remove a permission.
+
+`buildWorkflowOptions.permissions` replaces this entire set, including automatic
+permissions. `depsUpgradeOptions.workflowOptions.permissions` overrides individual
+scopes. Applies to all release branches, but not to separate package, publishing,
+self-mutation or pull request creation jobs, or unrelated workflows.
+
+---
+
 ##### `disableTsconfig`<sup>Optional</sup> <a name="disableTsconfig" id="@taimos/projen.ProductionTaimosCdkAppOptions.property.disableTsconfig"></a>
 
 ```typescript
@@ -21256,6 +22042,21 @@ To protect you against unintended changes that affect your security posture, the
 
 ---
 
+##### `versionReporting`<sup>Optional</sup> <a name="versionReporting" id="@taimos/projen.ProductionTaimosCdkAppOptions.property.versionReporting"></a>
+
+```typescript
+public readonly versionReporting: boolean;
+```
+
+- *Type:* boolean
+- *Default:* use the AWS CDK default
+
+Enable AWS CDK library version reporting.
+
+> [https://docs.aws.amazon.com/cdk/v2/guide/usage-data.html](https://docs.aws.amazon.com/cdk/v2/guide/usage-data.html)
+
+---
+
 ##### `watchExcludes`<sup>Optional</sup> <a name="watchExcludes" id="@taimos/projen.ProductionTaimosCdkAppOptions.property.watchExcludes"></a>
 
 ```typescript
@@ -21650,8 +22451,11 @@ const taimosApiLibraryOptions: TaimosApiLibraryOptions = { ... }
 | <code><a href="#@taimos/projen.TaimosApiLibraryOptions.property.npmRegistryUrl">npmRegistryUrl</a></code> | <code>string</code> | The base URL of the npm package registry. |
 | <code><a href="#@taimos/projen.TaimosApiLibraryOptions.property.npmTokenSecret">npmTokenSecret</a></code> | <code>string</code> | GitHub secret which contains the NPM token to use when publishing packages. |
 | <code><a href="#@taimos/projen.TaimosApiLibraryOptions.property.npmTrustedPublishing">npmTrustedPublishing</a></code> | <code>boolean</code> | Use trusted publishing for publishing to npmjs.com Needs to be pre-configured on npm.js to work. |
+| <code><a href="#@taimos/projen.TaimosApiLibraryOptions.property.npmVerifyPublished">npmVerifyPublished</a></code> | <code>boolean</code> | Wait until the published package version is available from the npm registry before the publish job completes. |
+| <code><a href="#@taimos/projen.TaimosApiLibraryOptions.property.npmVerifyPublishedTimeoutSeconds">npmVerifyPublishedTimeoutSeconds</a></code> | <code>number</code> | How long to wait, in seconds, for the published package version to be available. |
 | <code><a href="#@taimos/projen.TaimosApiLibraryOptions.property.packageManager">packageManager</a></code> | <code>projen.javascript.NodePackageManager</code> | The Node Package Manager used to execute scripts. |
 | <code><a href="#@taimos/projen.TaimosApiLibraryOptions.property.packageName">packageName</a></code> | <code>string</code> | The "name" in package.json. |
+| <code><a href="#@taimos/projen.TaimosApiLibraryOptions.property.peerDependenciesMeta">peerDependenciesMeta</a></code> | <code>{[ key: string ]: projen.javascript.PeerDependencyMeta}</code> | Additional information about how peer dependencies are used, rendered as `peerDependenciesMeta` in `package.json`. For example, this can mark peer dependencies as optional. |
 | <code><a href="#@taimos/projen.TaimosApiLibraryOptions.property.peerDependencyOptions">peerDependencyOptions</a></code> | <code>projen.javascript.PeerDependencyOptions</code> | Options for `peerDeps`. |
 | <code><a href="#@taimos/projen.TaimosApiLibraryOptions.property.peerDeps">peerDeps</a></code> | <code>string[]</code> | Peer dependencies for this module. |
 | <code><a href="#@taimos/projen.TaimosApiLibraryOptions.property.pnpmOptions">pnpmOptions</a></code> | <code>projen.javascript.PnpmOptions</code> | Options for pnpm. |
@@ -21725,6 +22529,7 @@ const taimosApiLibraryOptions: TaimosApiLibraryOptions = { ... }
 | <code><a href="#@taimos/projen.TaimosApiLibraryOptions.property.workflowGitIdentity">workflowGitIdentity</a></code> | <code>projen.github.GitIdentity</code> | The git identity to use in workflows. |
 | <code><a href="#@taimos/projen.TaimosApiLibraryOptions.property.workflowNodeVersion">workflowNodeVersion</a></code> | <code>string</code> | The node version used in GitHub Actions workflows. |
 | <code><a href="#@taimos/projen.TaimosApiLibraryOptions.property.workflowPackageCache">workflowPackageCache</a></code> | <code>boolean</code> | Enable Node.js package cache in GitHub workflows. |
+| <code><a href="#@taimos/projen.TaimosApiLibraryOptions.property.workflowPermissions">workflowPermissions</a></code> | <code>projen.github.workflows.JobPermissions</code> | Permissions for the main build, release and dependency upgrade jobs. |
 | <code><a href="#@taimos/projen.TaimosApiLibraryOptions.property.disableTsconfig">disableTsconfig</a></code> | <code>boolean</code> | Do not generate a `tsconfig.json` file (used by jsii projects since tsconfig.json is generated by the jsii compiler). |
 | <code><a href="#@taimos/projen.TaimosApiLibraryOptions.property.disableTsconfigDev">disableTsconfigDev</a></code> | <code>boolean</code> | Do not generate a development tsconfig file. |
 | <code><a href="#@taimos/projen.TaimosApiLibraryOptions.property.docgen">docgen</a></code> | <code>boolean</code> | Docgen by Typedoc. |
@@ -22648,7 +23453,8 @@ public readonly npmRegistryUrl: string;
 
 The base URL of the npm package registry.
 
-Must be a URL (e.g. start with "https://" or "http://")
+Must be a URL (e.g. start with "https://" or "http://").
+A trailing slash is added if missing.
 
 ---
 
@@ -22678,6 +23484,36 @@ Use trusted publishing for publishing to npmjs.com Needs to be pre-configured on
 
 ---
 
+##### `npmVerifyPublished`<sup>Optional</sup> <a name="npmVerifyPublished" id="@taimos/projen.TaimosApiLibraryOptions.property.npmVerifyPublished"></a>
+
+```typescript
+public readonly npmVerifyPublished: boolean;
+```
+
+- *Type:* boolean
+- *Default:* false
+
+Wait until the published package version is available from the npm registry before the publish job completes.
+
+Enable this when packages that depend on the published package are released right after.
+
+---
+
+##### `npmVerifyPublishedTimeoutSeconds`<sup>Optional</sup> <a name="npmVerifyPublishedTimeoutSeconds" id="@taimos/projen.TaimosApiLibraryOptions.property.npmVerifyPublishedTimeoutSeconds"></a>
+
+```typescript
+public readonly npmVerifyPublishedTimeoutSeconds: number;
+```
+
+- *Type:* number
+- *Default:* 3600
+
+How long to wait, in seconds, for the published package version to be available.
+
+Requires `npmVerifyPublished` to be enabled.
+
+---
+
 ##### `packageManager`<sup>Optional</sup> <a name="packageManager" id="@taimos/projen.TaimosApiLibraryOptions.property.packageManager"></a>
 
 ```typescript
@@ -22704,6 +23540,30 @@ The "name" in package.json.
 
 ---
 
+##### `peerDependenciesMeta`<sup>Optional</sup> <a name="peerDependenciesMeta" id="@taimos/projen.TaimosApiLibraryOptions.property.peerDependenciesMeta"></a>
+
+```typescript
+public readonly peerDependenciesMeta: {[ key: string ]: PeerDependencyMeta};
+```
+
+- *Type:* {[ key: string ]: projen.javascript.PeerDependencyMeta}
+- *Default:* no `peerDependenciesMeta`
+
+Additional information about how peer dependencies are used, rendered as `peerDependenciesMeta` in `package.json`. For example, this can mark peer dependencies as optional.
+
+Each key must also be declared as a peer dependency.
+
+> [https://docs.npmjs.com/cli/v11/configuring-npm/package-json#peerdependenciesmeta](https://docs.npmjs.com/cli/v11/configuring-npm/package-json#peerdependenciesmeta)
+
+---
+
+*Example*
+
+```typescript
+{ "aws-cdk-lib": { optional: true } }
+```
+
+
 ##### `peerDependencyOptions`<sup>Optional</sup> <a name="peerDependencyOptions" id="@taimos/projen.TaimosApiLibraryOptions.property.peerDependencyOptions"></a>
 
 ```typescript
@@ -23748,6 +24608,28 @@ Enable Node.js package cache in GitHub workflows.
 
 ---
 
+##### `workflowPermissions`<sup>Optional</sup> <a name="workflowPermissions" id="@taimos/projen.TaimosApiLibraryOptions.property.workflowPermissions"></a>
+
+```typescript
+public readonly workflowPermissions: JobPermissions;
+```
+
+- *Type:* projen.github.workflows.JobPermissions
+- *Default:* Use the job defaults and automatically inferred permissions.
+
+Permissions for the main build, release and dependency upgrade jobs.
+
+Defined scopes override the job defaults and automatically inferred permissions,
+including CodeArtifact and Codecov OIDC. Undefined scopes keep their defaults.
+Use `JobPermission.NONE` to explicitly remove a permission.
+
+`buildWorkflowOptions.permissions` replaces this entire set, including automatic
+permissions. `depsUpgradeOptions.workflowOptions.permissions` overrides individual
+scopes. Applies to all release branches, but not to separate package, publishing,
+self-mutation or pull request creation jobs, or unrelated workflows.
+
+---
+
 ##### `disableTsconfig`<sup>Optional</sup> <a name="disableTsconfig" id="@taimos/projen.TaimosApiLibraryOptions.property.disableTsconfig"></a>
 
 ```typescript
@@ -24159,8 +25041,11 @@ const taimosCdkAppOptions: TaimosCdkAppOptions = { ... }
 | <code><a href="#@taimos/projen.TaimosCdkAppOptions.property.npmRegistryUrl">npmRegistryUrl</a></code> | <code>string</code> | The base URL of the npm package registry. |
 | <code><a href="#@taimos/projen.TaimosCdkAppOptions.property.npmTokenSecret">npmTokenSecret</a></code> | <code>string</code> | GitHub secret which contains the NPM token to use when publishing packages. |
 | <code><a href="#@taimos/projen.TaimosCdkAppOptions.property.npmTrustedPublishing">npmTrustedPublishing</a></code> | <code>boolean</code> | Use trusted publishing for publishing to npmjs.com Needs to be pre-configured on npm.js to work. |
+| <code><a href="#@taimos/projen.TaimosCdkAppOptions.property.npmVerifyPublished">npmVerifyPublished</a></code> | <code>boolean</code> | Wait until the published package version is available from the npm registry before the publish job completes. |
+| <code><a href="#@taimos/projen.TaimosCdkAppOptions.property.npmVerifyPublishedTimeoutSeconds">npmVerifyPublishedTimeoutSeconds</a></code> | <code>number</code> | How long to wait, in seconds, for the published package version to be available. |
 | <code><a href="#@taimos/projen.TaimosCdkAppOptions.property.packageManager">packageManager</a></code> | <code>projen.javascript.NodePackageManager</code> | The Node Package Manager used to execute scripts. |
 | <code><a href="#@taimos/projen.TaimosCdkAppOptions.property.packageName">packageName</a></code> | <code>string</code> | The "name" in package.json. |
+| <code><a href="#@taimos/projen.TaimosCdkAppOptions.property.peerDependenciesMeta">peerDependenciesMeta</a></code> | <code>{[ key: string ]: projen.javascript.PeerDependencyMeta}</code> | Additional information about how peer dependencies are used, rendered as `peerDependenciesMeta` in `package.json`. For example, this can mark peer dependencies as optional. |
 | <code><a href="#@taimos/projen.TaimosCdkAppOptions.property.peerDependencyOptions">peerDependencyOptions</a></code> | <code>projen.javascript.PeerDependencyOptions</code> | Options for `peerDeps`. |
 | <code><a href="#@taimos/projen.TaimosCdkAppOptions.property.peerDeps">peerDeps</a></code> | <code>string[]</code> | Peer dependencies for this module. |
 | <code><a href="#@taimos/projen.TaimosCdkAppOptions.property.pnpmOptions">pnpmOptions</a></code> | <code>projen.javascript.PnpmOptions</code> | Options for pnpm. |
@@ -24234,6 +25119,7 @@ const taimosCdkAppOptions: TaimosCdkAppOptions = { ... }
 | <code><a href="#@taimos/projen.TaimosCdkAppOptions.property.workflowGitIdentity">workflowGitIdentity</a></code> | <code>projen.github.GitIdentity</code> | The git identity to use in workflows. |
 | <code><a href="#@taimos/projen.TaimosCdkAppOptions.property.workflowNodeVersion">workflowNodeVersion</a></code> | <code>string</code> | The node version used in GitHub Actions workflows. |
 | <code><a href="#@taimos/projen.TaimosCdkAppOptions.property.workflowPackageCache">workflowPackageCache</a></code> | <code>boolean</code> | Enable Node.js package cache in GitHub workflows. |
+| <code><a href="#@taimos/projen.TaimosCdkAppOptions.property.workflowPermissions">workflowPermissions</a></code> | <code>projen.github.workflows.JobPermissions</code> | Permissions for the main build, release and dependency upgrade jobs. |
 | <code><a href="#@taimos/projen.TaimosCdkAppOptions.property.disableTsconfig">disableTsconfig</a></code> | <code>boolean</code> | Do not generate a `tsconfig.json` file (used by jsii projects since tsconfig.json is generated by the jsii compiler). |
 | <code><a href="#@taimos/projen.TaimosCdkAppOptions.property.disableTsconfigDev">disableTsconfigDev</a></code> | <code>boolean</code> | Do not generate a development tsconfig file. |
 | <code><a href="#@taimos/projen.TaimosCdkAppOptions.property.docgen">docgen</a></code> | <code>boolean</code> | Docgen by Typedoc. |
@@ -24259,6 +25145,7 @@ const taimosCdkAppOptions: TaimosCdkAppOptions = { ... }
 | <code><a href="#@taimos/projen.TaimosCdkAppOptions.property.context">context</a></code> | <code>{[ key: string ]: any}</code> | Additional context to include in `cdk.json`. |
 | <code><a href="#@taimos/projen.TaimosCdkAppOptions.property.featureFlags">featureFlags</a></code> | <code>projen.awscdk.ICdkFeatureFlags</code> | Feature flags that should be enabled in `cdk.json`. |
 | <code><a href="#@taimos/projen.TaimosCdkAppOptions.property.requireApproval">requireApproval</a></code> | <code>projen.awscdk.ApprovalLevel</code> | To protect you against unintended changes that affect your security posture, the AWS CDK Toolkit prompts you to approve security-related changes before deploying them. |
+| <code><a href="#@taimos/projen.TaimosCdkAppOptions.property.versionReporting">versionReporting</a></code> | <code>boolean</code> | Enable AWS CDK library version reporting. |
 | <code><a href="#@taimos/projen.TaimosCdkAppOptions.property.watchExcludes">watchExcludes</a></code> | <code>string[]</code> | Glob patterns to exclude from `cdk watch`. |
 | <code><a href="#@taimos/projen.TaimosCdkAppOptions.property.watchIncludes">watchIncludes</a></code> | <code>string[]</code> | Glob patterns to include in `cdk watch`. |
 | <code><a href="#@taimos/projen.TaimosCdkAppOptions.property.cdkVersion">cdkVersion</a></code> | <code>string</code> | Minimum version of the AWS CDK to depend on. |
@@ -25175,7 +26062,8 @@ public readonly npmRegistryUrl: string;
 
 The base URL of the npm package registry.
 
-Must be a URL (e.g. start with "https://" or "http://")
+Must be a URL (e.g. start with "https://" or "http://").
+A trailing slash is added if missing.
 
 ---
 
@@ -25205,6 +26093,36 @@ Use trusted publishing for publishing to npmjs.com Needs to be pre-configured on
 
 ---
 
+##### `npmVerifyPublished`<sup>Optional</sup> <a name="npmVerifyPublished" id="@taimos/projen.TaimosCdkAppOptions.property.npmVerifyPublished"></a>
+
+```typescript
+public readonly npmVerifyPublished: boolean;
+```
+
+- *Type:* boolean
+- *Default:* false
+
+Wait until the published package version is available from the npm registry before the publish job completes.
+
+Enable this when packages that depend on the published package are released right after.
+
+---
+
+##### `npmVerifyPublishedTimeoutSeconds`<sup>Optional</sup> <a name="npmVerifyPublishedTimeoutSeconds" id="@taimos/projen.TaimosCdkAppOptions.property.npmVerifyPublishedTimeoutSeconds"></a>
+
+```typescript
+public readonly npmVerifyPublishedTimeoutSeconds: number;
+```
+
+- *Type:* number
+- *Default:* 3600
+
+How long to wait, in seconds, for the published package version to be available.
+
+Requires `npmVerifyPublished` to be enabled.
+
+---
+
 ##### `packageManager`<sup>Optional</sup> <a name="packageManager" id="@taimos/projen.TaimosCdkAppOptions.property.packageManager"></a>
 
 ```typescript
@@ -25231,6 +26149,30 @@ The "name" in package.json.
 
 ---
 
+##### `peerDependenciesMeta`<sup>Optional</sup> <a name="peerDependenciesMeta" id="@taimos/projen.TaimosCdkAppOptions.property.peerDependenciesMeta"></a>
+
+```typescript
+public readonly peerDependenciesMeta: {[ key: string ]: PeerDependencyMeta};
+```
+
+- *Type:* {[ key: string ]: projen.javascript.PeerDependencyMeta}
+- *Default:* no `peerDependenciesMeta`
+
+Additional information about how peer dependencies are used, rendered as `peerDependenciesMeta` in `package.json`. For example, this can mark peer dependencies as optional.
+
+Each key must also be declared as a peer dependency.
+
+> [https://docs.npmjs.com/cli/v11/configuring-npm/package-json#peerdependenciesmeta](https://docs.npmjs.com/cli/v11/configuring-npm/package-json#peerdependenciesmeta)
+
+---
+
+*Example*
+
+```typescript
+{ "aws-cdk-lib": { optional: true } }
+```
+
+
 ##### `peerDependencyOptions`<sup>Optional</sup> <a name="peerDependencyOptions" id="@taimos/projen.TaimosCdkAppOptions.property.peerDependencyOptions"></a>
 
 ```typescript
@@ -26275,6 +27217,28 @@ Enable Node.js package cache in GitHub workflows.
 
 ---
 
+##### `workflowPermissions`<sup>Optional</sup> <a name="workflowPermissions" id="@taimos/projen.TaimosCdkAppOptions.property.workflowPermissions"></a>
+
+```typescript
+public readonly workflowPermissions: JobPermissions;
+```
+
+- *Type:* projen.github.workflows.JobPermissions
+- *Default:* Use the job defaults and automatically inferred permissions.
+
+Permissions for the main build, release and dependency upgrade jobs.
+
+Defined scopes override the job defaults and automatically inferred permissions,
+including CodeArtifact and Codecov OIDC. Undefined scopes keep their defaults.
+Use `JobPermission.NONE` to explicitly remove a permission.
+
+`buildWorkflowOptions.permissions` replaces this entire set, including automatic
+permissions. `depsUpgradeOptions.workflowOptions.permissions` overrides individual
+scopes. Applies to all release branches, but not to separate package, publishing,
+self-mutation or pull request creation jobs, or unrelated workflows.
+
+---
+
 ##### `disableTsconfig`<sup>Optional</sup> <a name="disableTsconfig" id="@taimos/projen.TaimosCdkAppOptions.property.disableTsconfig"></a>
 
 ```typescript
@@ -26632,6 +27596,21 @@ To protect you against unintended changes that affect your security posture, the
 
 ---
 
+##### `versionReporting`<sup>Optional</sup> <a name="versionReporting" id="@taimos/projen.TaimosCdkAppOptions.property.versionReporting"></a>
+
+```typescript
+public readonly versionReporting: boolean;
+```
+
+- *Type:* boolean
+- *Default:* use the AWS CDK default
+
+Enable AWS CDK library version reporting.
+
+> [https://docs.aws.amazon.com/cdk/v2/guide/usage-data.html](https://docs.aws.amazon.com/cdk/v2/guide/usage-data.html)
+
+---
+
 ##### `watchExcludes`<sup>Optional</sup> <a name="watchExcludes" id="@taimos/projen.TaimosCdkAppOptions.property.watchExcludes"></a>
 
 ```typescript
@@ -26932,8 +27911,11 @@ const taimosCdkConstructLibraryOptions: TaimosCdkConstructLibraryOptions = { ...
 | <code><a href="#@taimos/projen.TaimosCdkConstructLibraryOptions.property.npmRegistryUrl">npmRegistryUrl</a></code> | <code>string</code> | The base URL of the npm package registry. |
 | <code><a href="#@taimos/projen.TaimosCdkConstructLibraryOptions.property.npmTokenSecret">npmTokenSecret</a></code> | <code>string</code> | GitHub secret which contains the NPM token to use when publishing packages. |
 | <code><a href="#@taimos/projen.TaimosCdkConstructLibraryOptions.property.npmTrustedPublishing">npmTrustedPublishing</a></code> | <code>boolean</code> | Use trusted publishing for publishing to npmjs.com Needs to be pre-configured on npm.js to work. |
+| <code><a href="#@taimos/projen.TaimosCdkConstructLibraryOptions.property.npmVerifyPublished">npmVerifyPublished</a></code> | <code>boolean</code> | Wait until the published package version is available from the npm registry before the publish job completes. |
+| <code><a href="#@taimos/projen.TaimosCdkConstructLibraryOptions.property.npmVerifyPublishedTimeoutSeconds">npmVerifyPublishedTimeoutSeconds</a></code> | <code>number</code> | How long to wait, in seconds, for the published package version to be available. |
 | <code><a href="#@taimos/projen.TaimosCdkConstructLibraryOptions.property.packageManager">packageManager</a></code> | <code>projen.javascript.NodePackageManager</code> | The Node Package Manager used to execute scripts. |
 | <code><a href="#@taimos/projen.TaimosCdkConstructLibraryOptions.property.packageName">packageName</a></code> | <code>string</code> | The "name" in package.json. |
+| <code><a href="#@taimos/projen.TaimosCdkConstructLibraryOptions.property.peerDependenciesMeta">peerDependenciesMeta</a></code> | <code>{[ key: string ]: projen.javascript.PeerDependencyMeta}</code> | Additional information about how peer dependencies are used, rendered as `peerDependenciesMeta` in `package.json`. For example, this can mark peer dependencies as optional. |
 | <code><a href="#@taimos/projen.TaimosCdkConstructLibraryOptions.property.peerDependencyOptions">peerDependencyOptions</a></code> | <code>projen.javascript.PeerDependencyOptions</code> | Options for `peerDeps`. |
 | <code><a href="#@taimos/projen.TaimosCdkConstructLibraryOptions.property.peerDeps">peerDeps</a></code> | <code>string[]</code> | Peer dependencies for this module. |
 | <code><a href="#@taimos/projen.TaimosCdkConstructLibraryOptions.property.pnpmOptions">pnpmOptions</a></code> | <code>projen.javascript.PnpmOptions</code> | Options for pnpm. |
@@ -27007,6 +27989,7 @@ const taimosCdkConstructLibraryOptions: TaimosCdkConstructLibraryOptions = { ...
 | <code><a href="#@taimos/projen.TaimosCdkConstructLibraryOptions.property.workflowGitIdentity">workflowGitIdentity</a></code> | <code>projen.github.GitIdentity</code> | The git identity to use in workflows. |
 | <code><a href="#@taimos/projen.TaimosCdkConstructLibraryOptions.property.workflowNodeVersion">workflowNodeVersion</a></code> | <code>string</code> | The node version used in GitHub Actions workflows. |
 | <code><a href="#@taimos/projen.TaimosCdkConstructLibraryOptions.property.workflowPackageCache">workflowPackageCache</a></code> | <code>boolean</code> | Enable Node.js package cache in GitHub workflows. |
+| <code><a href="#@taimos/projen.TaimosCdkConstructLibraryOptions.property.workflowPermissions">workflowPermissions</a></code> | <code>projen.github.workflows.JobPermissions</code> | Permissions for the main build, release and dependency upgrade jobs. |
 | <code><a href="#@taimos/projen.TaimosCdkConstructLibraryOptions.property.disableTsconfig">disableTsconfig</a></code> | <code>boolean</code> | Do not generate a `tsconfig.json` file (used by jsii projects since tsconfig.json is generated by the jsii compiler). |
 | <code><a href="#@taimos/projen.TaimosCdkConstructLibraryOptions.property.disableTsconfigDev">disableTsconfigDev</a></code> | <code>boolean</code> | Do not generate a development tsconfig file. |
 | <code><a href="#@taimos/projen.TaimosCdkConstructLibraryOptions.property.docgen">docgen</a></code> | <code>boolean</code> | Docgen by Typedoc. |
@@ -27955,7 +28938,8 @@ public readonly npmRegistryUrl: string;
 
 The base URL of the npm package registry.
 
-Must be a URL (e.g. start with "https://" or "http://")
+Must be a URL (e.g. start with "https://" or "http://").
+A trailing slash is added if missing.
 
 ---
 
@@ -27985,6 +28969,36 @@ Use trusted publishing for publishing to npmjs.com Needs to be pre-configured on
 
 ---
 
+##### `npmVerifyPublished`<sup>Optional</sup> <a name="npmVerifyPublished" id="@taimos/projen.TaimosCdkConstructLibraryOptions.property.npmVerifyPublished"></a>
+
+```typescript
+public readonly npmVerifyPublished: boolean;
+```
+
+- *Type:* boolean
+- *Default:* false
+
+Wait until the published package version is available from the npm registry before the publish job completes.
+
+Enable this when packages that depend on the published package are released right after.
+
+---
+
+##### `npmVerifyPublishedTimeoutSeconds`<sup>Optional</sup> <a name="npmVerifyPublishedTimeoutSeconds" id="@taimos/projen.TaimosCdkConstructLibraryOptions.property.npmVerifyPublishedTimeoutSeconds"></a>
+
+```typescript
+public readonly npmVerifyPublishedTimeoutSeconds: number;
+```
+
+- *Type:* number
+- *Default:* 3600
+
+How long to wait, in seconds, for the published package version to be available.
+
+Requires `npmVerifyPublished` to be enabled.
+
+---
+
 ##### `packageManager`<sup>Optional</sup> <a name="packageManager" id="@taimos/projen.TaimosCdkConstructLibraryOptions.property.packageManager"></a>
 
 ```typescript
@@ -28011,6 +29025,30 @@ The "name" in package.json.
 
 ---
 
+##### `peerDependenciesMeta`<sup>Optional</sup> <a name="peerDependenciesMeta" id="@taimos/projen.TaimosCdkConstructLibraryOptions.property.peerDependenciesMeta"></a>
+
+```typescript
+public readonly peerDependenciesMeta: {[ key: string ]: PeerDependencyMeta};
+```
+
+- *Type:* {[ key: string ]: projen.javascript.PeerDependencyMeta}
+- *Default:* no `peerDependenciesMeta`
+
+Additional information about how peer dependencies are used, rendered as `peerDependenciesMeta` in `package.json`. For example, this can mark peer dependencies as optional.
+
+Each key must also be declared as a peer dependency.
+
+> [https://docs.npmjs.com/cli/v11/configuring-npm/package-json#peerdependenciesmeta](https://docs.npmjs.com/cli/v11/configuring-npm/package-json#peerdependenciesmeta)
+
+---
+
+*Example*
+
+```typescript
+{ "aws-cdk-lib": { optional: true } }
+```
+
+
 ##### `peerDependencyOptions`<sup>Optional</sup> <a name="peerDependencyOptions" id="@taimos/projen.TaimosCdkConstructLibraryOptions.property.peerDependencyOptions"></a>
 
 ```typescript
@@ -29055,6 +30093,28 @@ Enable Node.js package cache in GitHub workflows.
 
 ---
 
+##### `workflowPermissions`<sup>Optional</sup> <a name="workflowPermissions" id="@taimos/projen.TaimosCdkConstructLibraryOptions.property.workflowPermissions"></a>
+
+```typescript
+public readonly workflowPermissions: JobPermissions;
+```
+
+- *Type:* projen.github.workflows.JobPermissions
+- *Default:* Use the job defaults and automatically inferred permissions.
+
+Permissions for the main build, release and dependency upgrade jobs.
+
+Defined scopes override the job defaults and automatically inferred permissions,
+including CodeArtifact and Codecov OIDC. Undefined scopes keep their defaults.
+Use `JobPermission.NONE` to explicitly remove a permission.
+
+`buildWorkflowOptions.permissions` replaces this entire set, including automatic
+permissions. `depsUpgradeOptions.workflowOptions.permissions` overrides individual
+scopes. Applies to all release branches, but not to separate package, publishing,
+self-mutation or pull request creation jobs, or unrelated workflows.
+
+---
+
 ##### `disableTsconfig`<sup>Optional</sup> <a name="disableTsconfig" id="@taimos/projen.TaimosCdkConstructLibraryOptions.property.disableTsconfig"></a>
 
 ```typescript
@@ -29445,6 +30505,8 @@ By default, jsii will include all *.ts files (except .d.ts files) in the TypeScr
 This can be problematic for example when the package's build or test procedure generates .ts files
 that cannot be compiled with jsii's compiler settings.
 
+When ESLint is enabled, these patterns are also added to its ignore patterns.
+
 ---
 
 ##### `jsiiVersion`<sup>Optional</sup> <a name="jsiiVersion" id="@taimos/projen.TaimosCdkConstructLibraryOptions.property.jsiiVersion"></a>
@@ -29478,6 +30540,9 @@ public readonly publishToGo: JsiiGoTarget;
 
 Publish Go bindings to a git repository.
 
+A separate repository is recommended. If `moduleName` refers to the source
+repository, set `publishToSourceRepository` to `true`.
+
 ---
 
 ##### `publishToMaven`<sup>Optional</sup> <a name="publishToMaven" id="@taimos/projen.TaimosCdkConstructLibraryOptions.property.publishToMaven"></a>
@@ -29821,8 +30886,11 @@ const taimosPrivateTypescriptLibraryOptions: TaimosPrivateTypescriptLibraryOptio
 | <code><a href="#@taimos/projen.TaimosPrivateTypescriptLibraryOptions.property.npmRegistryUrl">npmRegistryUrl</a></code> | <code>string</code> | The base URL of the npm package registry. |
 | <code><a href="#@taimos/projen.TaimosPrivateTypescriptLibraryOptions.property.npmTokenSecret">npmTokenSecret</a></code> | <code>string</code> | GitHub secret which contains the NPM token to use when publishing packages. |
 | <code><a href="#@taimos/projen.TaimosPrivateTypescriptLibraryOptions.property.npmTrustedPublishing">npmTrustedPublishing</a></code> | <code>boolean</code> | Use trusted publishing for publishing to npmjs.com Needs to be pre-configured on npm.js to work. |
+| <code><a href="#@taimos/projen.TaimosPrivateTypescriptLibraryOptions.property.npmVerifyPublished">npmVerifyPublished</a></code> | <code>boolean</code> | Wait until the published package version is available from the npm registry before the publish job completes. |
+| <code><a href="#@taimos/projen.TaimosPrivateTypescriptLibraryOptions.property.npmVerifyPublishedTimeoutSeconds">npmVerifyPublishedTimeoutSeconds</a></code> | <code>number</code> | How long to wait, in seconds, for the published package version to be available. |
 | <code><a href="#@taimos/projen.TaimosPrivateTypescriptLibraryOptions.property.packageManager">packageManager</a></code> | <code>projen.javascript.NodePackageManager</code> | The Node Package Manager used to execute scripts. |
 | <code><a href="#@taimos/projen.TaimosPrivateTypescriptLibraryOptions.property.packageName">packageName</a></code> | <code>string</code> | The "name" in package.json. |
+| <code><a href="#@taimos/projen.TaimosPrivateTypescriptLibraryOptions.property.peerDependenciesMeta">peerDependenciesMeta</a></code> | <code>{[ key: string ]: projen.javascript.PeerDependencyMeta}</code> | Additional information about how peer dependencies are used, rendered as `peerDependenciesMeta` in `package.json`. For example, this can mark peer dependencies as optional. |
 | <code><a href="#@taimos/projen.TaimosPrivateTypescriptLibraryOptions.property.peerDependencyOptions">peerDependencyOptions</a></code> | <code>projen.javascript.PeerDependencyOptions</code> | Options for `peerDeps`. |
 | <code><a href="#@taimos/projen.TaimosPrivateTypescriptLibraryOptions.property.peerDeps">peerDeps</a></code> | <code>string[]</code> | Peer dependencies for this module. |
 | <code><a href="#@taimos/projen.TaimosPrivateTypescriptLibraryOptions.property.pnpmOptions">pnpmOptions</a></code> | <code>projen.javascript.PnpmOptions</code> | Options for pnpm. |
@@ -29896,6 +30964,7 @@ const taimosPrivateTypescriptLibraryOptions: TaimosPrivateTypescriptLibraryOptio
 | <code><a href="#@taimos/projen.TaimosPrivateTypescriptLibraryOptions.property.workflowGitIdentity">workflowGitIdentity</a></code> | <code>projen.github.GitIdentity</code> | The git identity to use in workflows. |
 | <code><a href="#@taimos/projen.TaimosPrivateTypescriptLibraryOptions.property.workflowNodeVersion">workflowNodeVersion</a></code> | <code>string</code> | The node version used in GitHub Actions workflows. |
 | <code><a href="#@taimos/projen.TaimosPrivateTypescriptLibraryOptions.property.workflowPackageCache">workflowPackageCache</a></code> | <code>boolean</code> | Enable Node.js package cache in GitHub workflows. |
+| <code><a href="#@taimos/projen.TaimosPrivateTypescriptLibraryOptions.property.workflowPermissions">workflowPermissions</a></code> | <code>projen.github.workflows.JobPermissions</code> | Permissions for the main build, release and dependency upgrade jobs. |
 | <code><a href="#@taimos/projen.TaimosPrivateTypescriptLibraryOptions.property.disableTsconfig">disableTsconfig</a></code> | <code>boolean</code> | Do not generate a `tsconfig.json` file (used by jsii projects since tsconfig.json is generated by the jsii compiler). |
 | <code><a href="#@taimos/projen.TaimosPrivateTypescriptLibraryOptions.property.disableTsconfigDev">disableTsconfigDev</a></code> | <code>boolean</code> | Do not generate a development tsconfig file. |
 | <code><a href="#@taimos/projen.TaimosPrivateTypescriptLibraryOptions.property.docgen">docgen</a></code> | <code>boolean</code> | Docgen by Typedoc. |
@@ -30817,7 +31886,8 @@ public readonly npmRegistryUrl: string;
 
 The base URL of the npm package registry.
 
-Must be a URL (e.g. start with "https://" or "http://")
+Must be a URL (e.g. start with "https://" or "http://").
+A trailing slash is added if missing.
 
 ---
 
@@ -30847,6 +31917,36 @@ Use trusted publishing for publishing to npmjs.com Needs to be pre-configured on
 
 ---
 
+##### `npmVerifyPublished`<sup>Optional</sup> <a name="npmVerifyPublished" id="@taimos/projen.TaimosPrivateTypescriptLibraryOptions.property.npmVerifyPublished"></a>
+
+```typescript
+public readonly npmVerifyPublished: boolean;
+```
+
+- *Type:* boolean
+- *Default:* false
+
+Wait until the published package version is available from the npm registry before the publish job completes.
+
+Enable this when packages that depend on the published package are released right after.
+
+---
+
+##### `npmVerifyPublishedTimeoutSeconds`<sup>Optional</sup> <a name="npmVerifyPublishedTimeoutSeconds" id="@taimos/projen.TaimosPrivateTypescriptLibraryOptions.property.npmVerifyPublishedTimeoutSeconds"></a>
+
+```typescript
+public readonly npmVerifyPublishedTimeoutSeconds: number;
+```
+
+- *Type:* number
+- *Default:* 3600
+
+How long to wait, in seconds, for the published package version to be available.
+
+Requires `npmVerifyPublished` to be enabled.
+
+---
+
 ##### `packageManager`<sup>Optional</sup> <a name="packageManager" id="@taimos/projen.TaimosPrivateTypescriptLibraryOptions.property.packageManager"></a>
 
 ```typescript
@@ -30873,6 +31973,30 @@ The "name" in package.json.
 
 ---
 
+##### `peerDependenciesMeta`<sup>Optional</sup> <a name="peerDependenciesMeta" id="@taimos/projen.TaimosPrivateTypescriptLibraryOptions.property.peerDependenciesMeta"></a>
+
+```typescript
+public readonly peerDependenciesMeta: {[ key: string ]: PeerDependencyMeta};
+```
+
+- *Type:* {[ key: string ]: projen.javascript.PeerDependencyMeta}
+- *Default:* no `peerDependenciesMeta`
+
+Additional information about how peer dependencies are used, rendered as `peerDependenciesMeta` in `package.json`. For example, this can mark peer dependencies as optional.
+
+Each key must also be declared as a peer dependency.
+
+> [https://docs.npmjs.com/cli/v11/configuring-npm/package-json#peerdependenciesmeta](https://docs.npmjs.com/cli/v11/configuring-npm/package-json#peerdependenciesmeta)
+
+---
+
+*Example*
+
+```typescript
+{ "aws-cdk-lib": { optional: true } }
+```
+
+
 ##### `peerDependencyOptions`<sup>Optional</sup> <a name="peerDependencyOptions" id="@taimos/projen.TaimosPrivateTypescriptLibraryOptions.property.peerDependencyOptions"></a>
 
 ```typescript
@@ -31917,6 +33041,28 @@ Enable Node.js package cache in GitHub workflows.
 
 ---
 
+##### `workflowPermissions`<sup>Optional</sup> <a name="workflowPermissions" id="@taimos/projen.TaimosPrivateTypescriptLibraryOptions.property.workflowPermissions"></a>
+
+```typescript
+public readonly workflowPermissions: JobPermissions;
+```
+
+- *Type:* projen.github.workflows.JobPermissions
+- *Default:* Use the job defaults and automatically inferred permissions.
+
+Permissions for the main build, release and dependency upgrade jobs.
+
+Defined scopes override the job defaults and automatically inferred permissions,
+including CodeArtifact and Codecov OIDC. Undefined scopes keep their defaults.
+Use `JobPermission.NONE` to explicitly remove a permission.
+
+`buildWorkflowOptions.permissions` replaces this entire set, including automatic
+permissions. `depsUpgradeOptions.workflowOptions.permissions` overrides individual
+scopes. Applies to all release branches, but not to separate package, publishing,
+self-mutation or pull request creation jobs, or unrelated workflows.
+
+---
+
 ##### `disableTsconfig`<sup>Optional</sup> <a name="disableTsconfig" id="@taimos/projen.TaimosPrivateTypescriptLibraryOptions.property.disableTsconfig"></a>
 
 ```typescript
@@ -32296,8 +33442,11 @@ const taimosTypescriptLibraryOptions: TaimosTypescriptLibraryOptions = { ... }
 | <code><a href="#@taimos/projen.TaimosTypescriptLibraryOptions.property.npmRegistryUrl">npmRegistryUrl</a></code> | <code>string</code> | The base URL of the npm package registry. |
 | <code><a href="#@taimos/projen.TaimosTypescriptLibraryOptions.property.npmTokenSecret">npmTokenSecret</a></code> | <code>string</code> | GitHub secret which contains the NPM token to use when publishing packages. |
 | <code><a href="#@taimos/projen.TaimosTypescriptLibraryOptions.property.npmTrustedPublishing">npmTrustedPublishing</a></code> | <code>boolean</code> | Use trusted publishing for publishing to npmjs.com Needs to be pre-configured on npm.js to work. |
+| <code><a href="#@taimos/projen.TaimosTypescriptLibraryOptions.property.npmVerifyPublished">npmVerifyPublished</a></code> | <code>boolean</code> | Wait until the published package version is available from the npm registry before the publish job completes. |
+| <code><a href="#@taimos/projen.TaimosTypescriptLibraryOptions.property.npmVerifyPublishedTimeoutSeconds">npmVerifyPublishedTimeoutSeconds</a></code> | <code>number</code> | How long to wait, in seconds, for the published package version to be available. |
 | <code><a href="#@taimos/projen.TaimosTypescriptLibraryOptions.property.packageManager">packageManager</a></code> | <code>projen.javascript.NodePackageManager</code> | The Node Package Manager used to execute scripts. |
 | <code><a href="#@taimos/projen.TaimosTypescriptLibraryOptions.property.packageName">packageName</a></code> | <code>string</code> | The "name" in package.json. |
+| <code><a href="#@taimos/projen.TaimosTypescriptLibraryOptions.property.peerDependenciesMeta">peerDependenciesMeta</a></code> | <code>{[ key: string ]: projen.javascript.PeerDependencyMeta}</code> | Additional information about how peer dependencies are used, rendered as `peerDependenciesMeta` in `package.json`. For example, this can mark peer dependencies as optional. |
 | <code><a href="#@taimos/projen.TaimosTypescriptLibraryOptions.property.peerDependencyOptions">peerDependencyOptions</a></code> | <code>projen.javascript.PeerDependencyOptions</code> | Options for `peerDeps`. |
 | <code><a href="#@taimos/projen.TaimosTypescriptLibraryOptions.property.peerDeps">peerDeps</a></code> | <code>string[]</code> | Peer dependencies for this module. |
 | <code><a href="#@taimos/projen.TaimosTypescriptLibraryOptions.property.pnpmOptions">pnpmOptions</a></code> | <code>projen.javascript.PnpmOptions</code> | Options for pnpm. |
@@ -32371,6 +33520,7 @@ const taimosTypescriptLibraryOptions: TaimosTypescriptLibraryOptions = { ... }
 | <code><a href="#@taimos/projen.TaimosTypescriptLibraryOptions.property.workflowGitIdentity">workflowGitIdentity</a></code> | <code>projen.github.GitIdentity</code> | The git identity to use in workflows. |
 | <code><a href="#@taimos/projen.TaimosTypescriptLibraryOptions.property.workflowNodeVersion">workflowNodeVersion</a></code> | <code>string</code> | The node version used in GitHub Actions workflows. |
 | <code><a href="#@taimos/projen.TaimosTypescriptLibraryOptions.property.workflowPackageCache">workflowPackageCache</a></code> | <code>boolean</code> | Enable Node.js package cache in GitHub workflows. |
+| <code><a href="#@taimos/projen.TaimosTypescriptLibraryOptions.property.workflowPermissions">workflowPermissions</a></code> | <code>projen.github.workflows.JobPermissions</code> | Permissions for the main build, release and dependency upgrade jobs. |
 | <code><a href="#@taimos/projen.TaimosTypescriptLibraryOptions.property.disableTsconfig">disableTsconfig</a></code> | <code>boolean</code> | Do not generate a `tsconfig.json` file (used by jsii projects since tsconfig.json is generated by the jsii compiler). |
 | <code><a href="#@taimos/projen.TaimosTypescriptLibraryOptions.property.disableTsconfigDev">disableTsconfigDev</a></code> | <code>boolean</code> | Do not generate a development tsconfig file. |
 | <code><a href="#@taimos/projen.TaimosTypescriptLibraryOptions.property.docgen">docgen</a></code> | <code>boolean</code> | Docgen by Typedoc. |
@@ -33292,7 +34442,8 @@ public readonly npmRegistryUrl: string;
 
 The base URL of the npm package registry.
 
-Must be a URL (e.g. start with "https://" or "http://")
+Must be a URL (e.g. start with "https://" or "http://").
+A trailing slash is added if missing.
 
 ---
 
@@ -33322,6 +34473,36 @@ Use trusted publishing for publishing to npmjs.com Needs to be pre-configured on
 
 ---
 
+##### `npmVerifyPublished`<sup>Optional</sup> <a name="npmVerifyPublished" id="@taimos/projen.TaimosTypescriptLibraryOptions.property.npmVerifyPublished"></a>
+
+```typescript
+public readonly npmVerifyPublished: boolean;
+```
+
+- *Type:* boolean
+- *Default:* false
+
+Wait until the published package version is available from the npm registry before the publish job completes.
+
+Enable this when packages that depend on the published package are released right after.
+
+---
+
+##### `npmVerifyPublishedTimeoutSeconds`<sup>Optional</sup> <a name="npmVerifyPublishedTimeoutSeconds" id="@taimos/projen.TaimosTypescriptLibraryOptions.property.npmVerifyPublishedTimeoutSeconds"></a>
+
+```typescript
+public readonly npmVerifyPublishedTimeoutSeconds: number;
+```
+
+- *Type:* number
+- *Default:* 3600
+
+How long to wait, in seconds, for the published package version to be available.
+
+Requires `npmVerifyPublished` to be enabled.
+
+---
+
 ##### `packageManager`<sup>Optional</sup> <a name="packageManager" id="@taimos/projen.TaimosTypescriptLibraryOptions.property.packageManager"></a>
 
 ```typescript
@@ -33348,6 +34529,30 @@ The "name" in package.json.
 
 ---
 
+##### `peerDependenciesMeta`<sup>Optional</sup> <a name="peerDependenciesMeta" id="@taimos/projen.TaimosTypescriptLibraryOptions.property.peerDependenciesMeta"></a>
+
+```typescript
+public readonly peerDependenciesMeta: {[ key: string ]: PeerDependencyMeta};
+```
+
+- *Type:* {[ key: string ]: projen.javascript.PeerDependencyMeta}
+- *Default:* no `peerDependenciesMeta`
+
+Additional information about how peer dependencies are used, rendered as `peerDependenciesMeta` in `package.json`. For example, this can mark peer dependencies as optional.
+
+Each key must also be declared as a peer dependency.
+
+> [https://docs.npmjs.com/cli/v11/configuring-npm/package-json#peerdependenciesmeta](https://docs.npmjs.com/cli/v11/configuring-npm/package-json#peerdependenciesmeta)
+
+---
+
+*Example*
+
+```typescript
+{ "aws-cdk-lib": { optional: true } }
+```
+
+
 ##### `peerDependencyOptions`<sup>Optional</sup> <a name="peerDependencyOptions" id="@taimos/projen.TaimosTypescriptLibraryOptions.property.peerDependencyOptions"></a>
 
 ```typescript
@@ -34392,6 +35597,28 @@ Enable Node.js package cache in GitHub workflows.
 
 ---
 
+##### `workflowPermissions`<sup>Optional</sup> <a name="workflowPermissions" id="@taimos/projen.TaimosTypescriptLibraryOptions.property.workflowPermissions"></a>
+
+```typescript
+public readonly workflowPermissions: JobPermissions;
+```
+
+- *Type:* projen.github.workflows.JobPermissions
+- *Default:* Use the job defaults and automatically inferred permissions.
+
+Permissions for the main build, release and dependency upgrade jobs.
+
+Defined scopes override the job defaults and automatically inferred permissions,
+including CodeArtifact and Codecov OIDC. Undefined scopes keep their defaults.
+Use `JobPermission.NONE` to explicitly remove a permission.
+
+`buildWorkflowOptions.permissions` replaces this entire set, including automatic
+permissions. `depsUpgradeOptions.workflowOptions.permissions` overrides individual
+scopes. Applies to all release branches, but not to separate package, publishing,
+self-mutation or pull request creation jobs, or unrelated workflows.
+
+---
+
 ##### `disableTsconfig`<sup>Optional</sup> <a name="disableTsconfig" id="@taimos/projen.TaimosTypescriptLibraryOptions.property.disableTsconfig"></a>
 
 ```typescript