@ykdz/template 0.0.22 → 0.0.24

package/node_modules/@ykdz/template-core/dist/module-graph.js

@@ -1,3 +1,26 @@
+export function rustToolchainEnvironmentNeed(owner) {
+    return {
+        kind: "rust-toolchain",
+        owner,
+        toolchain: "stable",
+        nextStep: {
+            id: "install-rust-toolchain",
+            label: "Install Rust toolchain",
+            command: "rustup",
+            args: [
+                "toolchain",
+                "install",
+                "stable",
+                "--component",
+                "rustfmt",
+                "--component",
+                "clippy",
+            ],
+            display: "rustup toolchain install stable --component rustfmt --component clippy",
+            machineVerifiable: false,
+        },
+    };
+}
 function renderTurboPackageFilter(owner) {
     if (owner.kind !== "package-boundary") {
         throw new Error("Turbo package tasks require a Package Boundary owner.");
@@ -119,6 +142,24 @@ export function renderRootCheckCommand(plan) {
         "check:run",
     ]));
 }
+export function deploymentCheckEnvironmentNeeds(check) {
+    switch (check.kind) {
+        case "deployment-image":
+            return [{ kind: "docker-engine" }];
+    }
+}
+export function deploymentCheckTaskName(check) {
+    switch (check.kind) {
+        case "deployment-image":
+            return "check:deployment";
+    }
+}
+export function renderDeploymentCheckLeafCommand(check) {
+    return `pnpm --filter './${check.owner.path}' run ${deploymentCheckTaskName(check)}`;
+}
+export function renderDeploymentCheckCommand(plan) {
+    return uniqueTaskNames((plan.deploymentChecks ?? []).map(renderDeploymentCheckLeafCommand)).join(" && ");
+}
 export function renderFixCommand(plan) {
     return renderTurboRunCommand(uniqueTaskNames([
         ...plan.components.flatMap(fixComponentTaskNames),
@@ -139,6 +180,9 @@ function playwrightBrowserInstallArgs(need, options = {}) {
     return installArgs;
 }
 export function renderPlaywrightBrowserInstallCommand(need, options = {}) {
+    if (need.kind !== "playwright-browser-assets") {
+        throw new Error("Playwright install requires browser assets.");
+    }
     return ["pnpm", ...playwrightBrowserInstallArgs(need, options)].join(" ");
 }
 export function playwrightBrowserAssetsNextStepDescriptor(owner) {
@@ -170,3 +214,17 @@ export function playwrightBrowserAssetsEnvironmentNeed(options) {
         },
     };
 }
+export function shellCheckEnvironmentNeed(owner) {
+    return {
+        kind: "shellcheck-command",
+        owner,
+        nextStep: {
+            id: "install-shellcheck",
+            label: "Install ShellCheck",
+            command: "sudo",
+            args: ["sh", "-c", "apt-get update && apt-get install -y shellcheck"],
+            display: "sudo apt-get update && sudo apt-get install -y shellcheck",
+            machineVerifiable: false,
+        },
+    };
+}

package/node_modules/@ykdz/template-core/dist/package-contribution.d.ts

@@ -0,0 +1,43 @@
+import type { EditorCustomizationCapability } from "./editor-customization.ts";
+import type { CheckComponent, CheckEnvironmentNeed, DeploymentCheckComponent, FixComponent } from "./module-graph.ts";
+import type { PackageDefinition } from "./project-blueprint-v2.ts";
+import type { DependencyMaintenancePolicy } from "./project-github.ts";
+import type { RenderOperation } from "./renderer.ts";
+export type FoundationContribution = {
+    /** Toolchains the Foundation must install and project into coordinated root files. */
+    readonly toolchains: {
+        readonly rust?: {
+            readonly toolchain: string;
+            readonly components: readonly ("rustfmt" | "clippy")[];
+        };
+    };
+    /** Editor capabilities the Foundation must project into its coordinated editor files. */
+    readonly editorCapabilities: readonly EditorCustomizationCapability[];
+    /** Ecosystems and paths whose maintenance belongs in the coordinated root policy. */
+    readonly dependencyMaintenance: DependencyMaintenancePolicy;
+    /** Workspace membership patterns contributed by package boundaries. */
+    readonly workspacePackageGlobs?: readonly string[];
+    /** Dependency Catalog entries required by package-owned manifests. */
+    readonly dependencyCatalog?: Readonly<Record<string, string>>;
+};
+/** A preset-agnostic package-sized part of a Generated Repository Plan. */
+export type PackageContribution = {
+    readonly definition: PackageDefinition;
+    readonly manifest: Readonly<Record<string, unknown>>;
+    readonly exposure: {
+        readonly exports: Readonly<Record<string, unknown>>;
+        readonly imports: Readonly<Record<string, unknown>>;
+    };
+    readonly operations: readonly RenderOperation[];
+    /** Typed requirements consumed by the Foundation for coordinated root outputs. */
+    readonly foundation: FoundationContribution;
+    readonly checks: readonly CheckComponent[];
+    readonly fixes: readonly FixComponent[];
+    readonly environmentNeeds: readonly CheckEnvironmentNeed[];
+    /** Deployment checks are package-owned and composed by the Foundation. */
+    readonly deploymentChecks?: readonly DeploymentCheckComponent[];
+};
+export declare function assertPackageContribution(contribution: PackageContribution, provenance?: {
+    readonly definitionName?: string;
+    readonly planner?: string;
+}): PackageContribution;

package/node_modules/@ykdz/template-core/dist/package-contribution.js

@@ -0,0 +1,24 @@
+export function assertPackageContribution(contribution, provenance = {}) {
+    if (contribution.definition.name !== contribution.manifest.name) {
+        throw new Error("Package Contribution manifest name must match its Package Definition");
+    }
+    const operationPath = (operation) => {
+        if ("to" in operation)
+            return operation.to;
+        if ("path" in operation)
+            return operation.path;
+        return "";
+    };
+    const outsideOperation = contribution.operations.find((operation) => !operationPath(operation).startsWith(`${contribution.definition.path}/`));
+    if (outsideOperation) {
+        const target = operationPath(outsideOperation);
+        const rule = target.includes("/")
+            ? "Package Contribution may not write a sibling Package Boundary"
+            : "Package Contribution may not write a coordinated root output";
+        const owner = provenance.definitionName === undefined
+            ? ""
+            : `${provenance.definitionName}: ${provenance.planner ?? "Package Contribution"} `;
+        throw new Error(`${owner}${rule}; ${contribution.definition.path} attempted ${target}`);
+    }
+    return contribution;
+}

package/node_modules/@ykdz/template-core/dist/pnpm-workspace.yaml

@@ -1,13 +1,32 @@
 packages:
   - packages/*
 
-nodeLinker: hoisted
+nodeLinker: isolated
+
+autoInstallPeers: false
+
+injectWorkspacePackages: true
+
+dedupeInjectedDeps: false
+
+syncInjectedDepsAfterScripts:
+  - build
+  - build:run
+
+minimumReleaseAge: 1440
+
+minimumReleaseAgeStrict: true
+
+overrides:
+  "pinia>typescript": "-"
+  "valibot>typescript": "-"
+  "vue>typescript": "-"
 
 catalog:
   "@hono/node-server": ^2.0.6
   "@playwright/test": ^1.61.1
   "@tailwindcss/vite": ^4.3.2
-  "@types/node": ^24.0.0
+  "@types/node": ^24.13.3
   "@types/web-bluetooth": ^0.0.21
   "@vitejs/plugin-vue": ^6.0.7
   "@vikejs/hono": ^0.2.1
@@ -17,17 +36,20 @@ catalog:
   execa: ^9.6.1
   hono: ^4.12.27
   oxfmt: ^0.58.0
-  oxlint: ^1.72.0
+  oxlint: ^1.73.0
   oxlint-tsgolint: ^0.24.0
+  semver: ^7.8.5
+  "@types/semver": ^7.7.1
   pinia: ^3.0.4
+  srvx: ^0.11.21
   tailwindcss: ^4.3.2
   telefunc: ^0.2.22
   tsc-alias: ^1.8.17
-  tsx: ^4.22.4
   turbo: 2.10.2
-  typescript: ^6.0.3
+  typescript: npm:@typescript/typescript6@^6.0.2
+  typescript-7: npm:typescript@^7.0.2
   valibot: ^1.4.2
-  vite: ^8.1.2
+  vite: ^8.1.4
   vike: ^0.4.260
   vike-vue: ^0.9.12
   vitest: ^4.1.10
@@ -37,6 +59,3 @@ catalog:
 
 allowBuilds:
   esbuild: true
-
-onlyBuiltDependencies:
-  - esbuild

package/node_modules/@ykdz/template-core/dist/preset-definition.d.ts

@@ -0,0 +1,42 @@
+import type { PackageContribution } from "./package-contribution.ts";
+import type { ProjectBlueprintV2 } from "./project-blueprint-v2.ts";
+import type { TemplateSourceHandle } from "./renderer.ts";
+/** Stable, preset-agnostic input supplied after toolchain resolution. */
+export type GenerationContext = {
+    readonly targetDir: string;
+    readonly projectName: string;
+    readonly scope: string;
+    readonly toolchain: {
+        readonly nodeLtsMajor: string;
+        readonly packageManagerPin: string;
+    };
+};
+/** A side-effect-free Built-in Preset planner. */
+export type BuiltInPresetDefinition = {
+    readonly metadata: {
+        readonly name: string;
+        readonly title: string;
+        readonly description: string;
+    };
+    /** The Definition owns its Preset-local Self-Checking Template Source. */
+    readonly source: TemplateSourceHandle;
+    /** The owned planner source inspected by the Template Boundary Check. */
+    readonly plannerSourceFile: string;
+    blueprint(context: GenerationContext): ProjectBlueprintV2;
+    planInitialization(context: GenerationContext): PackageContribution;
+    /**
+     * Multi-package Definitions expose their complete owned topology directly,
+     * while single-package Definitions keep the compact tracer interface.
+     */
+    planInitializationContributions?(context: GenerationContext): readonly PackageContribution[];
+    /** Package layout is Preset-owned even when callers omit --path. */
+    defaultPackagePath?(options: {
+        readonly context: GenerationContext;
+        readonly packageLeafName: string;
+    }): string;
+    planPackageAddition?(options: {
+        readonly context: GenerationContext;
+        readonly packageLeafName: string;
+        readonly packagePath: string;
+    }): PackageContribution;
+};

package/node_modules/@ykdz/template-core/dist/preset-definition.js

@@ -0,0 +1 @@
+export {};

package/node_modules/@ykdz/template-core/dist/project-blueprint-v2.d.ts

@@ -0,0 +1,33 @@
+/**
+ * The durable, preset-agnostic topology used by local template follow-up
+ * operations. Preset provenance deliberately belongs in Generation Record.
+ */
+export type PackageRole = "runtime-service" | "shared-library" | "native-package";
+export type PackageDefinition = {
+    readonly name: string;
+    readonly path: string;
+    readonly role: PackageRole;
+};
+export type PackageLinkIntent = {
+    readonly consumerPackagePath: string;
+    readonly providerPackagePath: string;
+};
+export type ProjectBlueprintV2 = {
+    readonly schemaVersion: 2;
+    readonly packages: readonly PackageDefinition[];
+    readonly packageLinkIntents?: readonly PackageLinkIntent[];
+};
+export type BlueprintV2ValidationIssue = {
+    readonly path: string;
+    readonly message: string;
+};
+export type BlueprintV2ValidationResult = {
+    readonly ok: true;
+    readonly value: ProjectBlueprintV2;
+} | {
+    readonly ok: false;
+    readonly issues: readonly BlueprintV2ValidationIssue[];
+};
+/** Validates persisted metadata before it is used to plan or render changes. */
+export declare function validateProjectBlueprintV2(value: unknown): BlueprintV2ValidationResult;
+export declare function assertProjectBlueprintV2(value: unknown): ProjectBlueprintV2;

package/node_modules/@ykdz/template-core/dist/project-blueprint-v2.js

@@ -0,0 +1,161 @@
+const packageName = /^@[a-z0-9][a-z0-9-]*\/[a-z0-9][a-z0-9-]*$/;
+const packagePath = /^[a-z0-9][a-z0-9-]*\/[a-z0-9][a-z0-9-]*$/;
+const roles = new Set([
+    "runtime-service",
+    "shared-library",
+    "native-package",
+]);
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function reportUnknownKeys(value, allowed, path, issues) {
+    for (const key of Object.keys(value)) {
+        if (!allowed.includes(key)) {
+            issues.push({
+                path: `${path}.${key}`,
+                message: "Unknown Blueprint v2 field",
+            });
+        }
+    }
+}
+/** Validates persisted metadata before it is used to plan or render changes. */
+export function validateProjectBlueprintV2(value) {
+    const issues = [];
+    if (!isRecord(value)) {
+        return {
+            ok: false,
+            issues: [
+                { path: ".", message: "Local Template Metadata must be an object" },
+            ],
+        };
+    }
+    reportUnknownKeys(value, ["schemaVersion", "packages", "packageLinkIntents"], ".", issues);
+    if (value.schemaVersion !== 2) {
+        issues.push({
+            path: ".schemaVersion",
+            message: `Unsupported Local Template Metadata schema version ${String(value.schemaVersion)}; expected 2`,
+        });
+    }
+    if (!Array.isArray(value.packages)) {
+        issues.push({
+            path: ".packages",
+            message: "Package Definitions must be an array",
+        });
+    }
+    const definitions = [];
+    if (Array.isArray(value.packages)) {
+        for (const [index, item] of value.packages.entries()) {
+            const itemPath = `.packages[${index}]`;
+            if (!isRecord(item)) {
+                issues.push({
+                    path: itemPath,
+                    message: "Package Definition must be an object",
+                });
+                continue;
+            }
+            reportUnknownKeys(item, ["name", "path", "role"], itemPath, issues);
+            if (typeof item.name !== "string" || !packageName.test(item.name)) {
+                issues.push({
+                    path: `${itemPath}.name`,
+                    message: "Package name must be a scoped lowercase package name",
+                });
+            }
+            if (typeof item.path !== "string" || !packagePath.test(item.path)) {
+                issues.push({
+                    path: `${itemPath}.path`,
+                    message: "Package Path must be exactly two safe path segments",
+                });
+            }
+            if (typeof item.role !== "string" ||
+                !roles.has(item.role)) {
+                issues.push({
+                    path: `${itemPath}.role`,
+                    message: "Package Role must be runtime-service, shared-library, or native-package",
+                });
+            }
+            if (typeof item.name === "string" &&
+                typeof item.path === "string" &&
+                typeof item.role === "string" &&
+                packageName.test(item.name) &&
+                packagePath.test(item.path) &&
+                roles.has(item.role)) {
+                definitions.push(item);
+            }
+        }
+    }
+    for (const [property, label] of [
+        ["name", "Package name"],
+        ["path", "Package Path"],
+    ]) {
+        const seen = new Set();
+        for (const definition of definitions) {
+            const member = definition[property];
+            if (seen.has(member))
+                issues.push({
+                    path: ".packages",
+                    message: `${label} must be unique: ${member}`,
+                });
+            seen.add(member);
+        }
+    }
+    if (value.packageLinkIntents !== undefined &&
+        !Array.isArray(value.packageLinkIntents)) {
+        issues.push({
+            path: ".packageLinkIntents",
+            message: "Package Link Intents must be an array",
+        });
+    }
+    const paths = new Set(definitions.map((definition) => definition.path));
+    const links = new Set();
+    if (Array.isArray(value.packageLinkIntents)) {
+        for (const [index, item] of value.packageLinkIntents.entries()) {
+            const itemPath = `.packageLinkIntents[${index}]`;
+            if (!isRecord(item)) {
+                issues.push({
+                    path: itemPath,
+                    message: "Package Link Intent must be an object",
+                });
+                continue;
+            }
+            reportUnknownKeys(item, ["consumerPackagePath", "providerPackagePath"], itemPath, issues);
+            const consumer = item.consumerPackagePath;
+            const provider = item.providerPackagePath;
+            if (typeof consumer !== "string" || !paths.has(consumer))
+                issues.push({
+                    path: `${itemPath}.consumerPackagePath`,
+                    message: "Package Link Intent references an unknown consumer package",
+                });
+            if (typeof provider !== "string" || !paths.has(provider))
+                issues.push({
+                    path: `${itemPath}.providerPackagePath`,
+                    message: "Package Link Intent references an unknown provider package",
+                });
+            if (consumer === provider && typeof consumer === "string")
+                issues.push({
+                    path: itemPath,
+                    message: "Package Link Intent cannot link a package to itself",
+                });
+            if (typeof consumer === "string" && typeof provider === "string") {
+                const key = `${consumer}\u0000${provider}`;
+                if (links.has(key))
+                    issues.push({
+                        path: itemPath,
+                        message: "Package Link Intent must be unique",
+                    });
+                links.add(key);
+            }
+        }
+    }
+    return issues.length === 0
+        ? { ok: true, value: value }
+        : { ok: false, issues };
+}
+export function assertProjectBlueprintV2(value) {
+    const result = validateProjectBlueprintV2(value);
+    if (!result.ok) {
+        throw new Error(result.issues
+            .map((issue) => `${issue.path}: ${issue.message}`)
+            .join("\n"));
+    }
+    return result.value;
+}

package/node_modules/@ykdz/template-core/dist/project-github.d.ts

@@ -1,4 +1,4 @@
-import { type CheckPlan } from "./module-graph.js";
+import { type CheckPlan } from "./module-graph.ts";
 export type CiCapability = {
     readonly workflowName: "Check";
     readonly jobName: "check";
@@ -12,13 +12,6 @@ export type PnpmTaskLayer = {
     readonly installCommand: "pnpm install";
     readonly checkCommand: "pnpm run check";
 };
-export type CiDockerImageBuild = {
-    readonly dockerfile: string;
-    readonly targets: readonly {
-        readonly name: string;
-        readonly tag: string;
-    }[];
-};
 export type DependencyEcosystem = "npm" | "cargo" | "github-actions" | "docker" | "rust-toolchain";
 export type DependabotDirectory = `/${string}`;
 export type DependencyMaintenancePolicy = {
@@ -32,8 +25,14 @@ type ProjectCheckWorkflowOptions = {
     readonly capability?: CiCapability | undefined;
     readonly environmentPreparation?: Partial<CiEnvironmentPreparation> | undefined;
     readonly taskLayer?: PnpmTaskLayer | undefined;
-    readonly dockerImageBuild?: CiDockerImageBuild | undefined;
 };
 export declare function projectCheckWorkflow(options: ProjectCheckWorkflowOptions): string;
+/** Limited substitutions for the Foundation-owned workflow Template Source. */
+export declare function projectCheckWorkflowTemplateReplacements(options: {
+    readonly checkPlan: CheckPlan;
+    readonly environmentPreparation?: Partial<CiEnvironmentPreparation>;
+}): Record<string, string>;
 export declare function projectDependabotConfig(policy: DependencyMaintenancePolicy): string;
+/** Limited substitution for the Foundation-owned Dependabot Template Source. */
+export declare function projectDependabotTemplateReplacements(policy: DependencyMaintenancePolicy): Record<string, string>;
 export {};

package/node_modules/@ykdz/template-core/dist/project-github.js

@@ -1,4 +1,4 @@
-import { renderPlaywrightBrowserInstallCommand, } from "./module-graph.js";
+import { deploymentCheckEnvironmentNeeds, deploymentCheckTaskName, renderPlaywrightBrowserInstallCommand, } from "./module-graph.js";
 const defaultCiCapability = {
     workflowName: "Check",
     jobName: "check",
@@ -15,7 +15,11 @@ export function projectCheckWorkflow(options) {
         rustToolchain: false,
         ...options.environmentPreparation,
     };
+    const requiresRustToolchain = environmentPreparation.rustToolchain ||
+        options.checkPlan.environmentNeeds.some((need) => need.kind === "rust-toolchain");
     const taskLayer = options.taskLayer ?? pnpmTaskLayer;
+    const deploymentChecks = options.checkPlan.deploymentChecks ?? [];
+    const needsDocker = deploymentChecks.some((check) => deploymentCheckEnvironmentNeeds(check).some((need) => need.kind === "docker-engine"));
     const lines = [
         `name: ${capability.workflowName}`,
         "",
@@ -28,23 +32,88 @@ export function projectCheckWorkflow(options) {
         "jobs:",
         `  ${capability.jobName}:`,
         `    runs-on: ${capability.runner}`,
+        ...(deploymentChecks.length === 0
+            ? []
+            : [
+                "    strategy:",
+                "      matrix:",
+                "        check: [root, deployment]",
+            ]),
         "    steps:",
         "      - uses: actions/checkout@v7",
     ];
     if (environmentPreparation.nodeFromPackageMetadata) {
         lines.push("      - uses: actions/setup-node@v6", "        with:", "          node-version-file: package.json", "      - run: corepack enable");
     }
-    if (environmentPreparation.rustToolchain) {
-        lines.push("      - uses: dtolnay/rust-toolchain@stable", "        with:", "          components: rustfmt, clippy", "      - uses: Swatinem/rust-cache@v2");
+    if (needsDocker) {
+        lines.push("      - uses: docker/setup-buildx-action@v3", "        if: matrix.check == 'deployment'");
     }
+    if (requiresRustToolchain)
+        lines.push(...rustCiPreparationLines());
     lines.push(`      - run: ${taskLayer.installCommand}`);
-    lines.push(...options.checkPlan.environmentNeeds.map((need) => `      - run: ${renderCiEnvironmentNeedCommand(need)}`));
-    lines.push(`      - run: ${taskLayer.checkCommand}`, "");
-    if (options.dockerImageBuild !== undefined) {
-        lines.push("  docker-image:", `    runs-on: ${capability.runner}`, "    steps:", "      - uses: actions/checkout@v7", "      - uses: docker/setup-buildx-action@v3", ...options.dockerImageBuild.targets.map((target) => `      - run: docker buildx build --load --file ${options.dockerImageBuild.dockerfile} --target ${target.name} --tag ${target.tag} .`), "");
+    const checkEnvironmentLines = [];
+    for (const need of options.checkPlan.environmentNeeds) {
+        if (need.kind === "rust-toolchain")
+            continue;
+        checkEnvironmentLines.push(`      - run: ${renderCiEnvironmentNeedCommand(need)}`);
+        if (deploymentChecks.length > 0 && need.kind === "shellcheck-command") {
+            checkEnvironmentLines.push("        if: matrix.check == 'root'");
+        }
     }
+    lines.push(...checkEnvironmentLines);
+    lines.push(`      - run: ${taskLayer.checkCommand}`);
+    if (deploymentChecks.length > 0) {
+        lines.push("        if: matrix.check == 'root'");
+    }
+    const deploymentCheck = deploymentChecks[0];
+    if (deploymentCheck !== undefined) {
+        lines.push(`      - run: pnpm run ${deploymentCheckTaskName(deploymentCheck)}`, "        if: matrix.check == 'deployment'");
+    }
+    lines.push("");
     return lines.join("\n");
 }
+function rustCiPreparationLines() {
+    return [
+        "      - uses: dtolnay/rust-toolchain@stable",
+        "        with:",
+        "          components: rustfmt, clippy",
+        "      - uses: Swatinem/rust-cache@v2",
+    ];
+}
+/** Limited substitutions for the Foundation-owned workflow Template Source. */
+export function projectCheckWorkflowTemplateReplacements(options) {
+    const requiresRustToolchain = options.environmentPreparation?.rustToolchain === true ||
+        options.checkPlan.environmentNeeds.some((need) => need.kind === "rust-toolchain");
+    const deploymentChecks = options.checkPlan.deploymentChecks ?? [];
+    const needsDocker = deploymentChecks.some((check) => deploymentCheckEnvironmentNeeds(check).some((need) => need.kind === "docker-engine"));
+    const deploymentCheck = deploymentChecks[0];
+    const environmentSteps = options.checkPlan.environmentNeeds
+        .filter((need) => need.kind !== "rust-toolchain")
+        .map((need) => [
+        `      - run: ${renderCiEnvironmentNeedCommand(need)}`,
+        ...(deploymentChecks.length > 0 && need.kind === "shellcheck-command"
+            ? ["        if: matrix.check == 'root'"]
+            : []),
+    ].join("\n"));
+    return {
+        RUST_CI_PREPARATION: requiresRustToolchain
+            ? `\n${rustCiPreparationLines().join("\n")}`
+            : "",
+        CHECK_ENVIRONMENT_PREPARATION: environmentSteps.length === 0 ? "" : `\n${environmentSteps.join("\n")}`,
+        DEPLOYMENT_MATRIX: deploymentChecks.length === 0
+            ? ""
+            : "\n    strategy:\n      matrix:\n        check: [root, deployment]",
+        DEPLOYMENT_DOCKER_PREPARATION: needsDocker
+            ? "\n      - uses: docker/setup-buildx-action@v3\n        if: matrix.check == 'deployment'"
+            : "",
+        ROOT_CHECK_CONDITION: deploymentChecks.length === 0
+            ? ""
+            : "\n        if: matrix.check == 'root'",
+        DEPLOYMENT_CHECK: deploymentCheck === undefined
+            ? ""
+            : `\n      - run: pnpm run ${deploymentCheckTaskName(deploymentCheck)}\n        if: matrix.check == 'deployment'`,
+    };
+}
 export function projectDependabotConfig(policy) {
     return [
         "version: 2",
@@ -58,6 +127,15 @@ export function projectDependabotConfig(policy) {
         "",
     ].join("\n");
 }
+/** Limited substitution for the Foundation-owned Dependabot Template Source. */
+export function projectDependabotTemplateReplacements(policy) {
+    const header = "version: 2\n\nupdates:\n";
+    const configuration = projectDependabotConfig(policy);
+    if (!configuration.startsWith(header)) {
+        throw new Error("Dependabot configuration must retain its Template Source header");
+    }
+    return { DEPENDABOT_UPDATES: configuration.slice(header.length).trimEnd() };
+}
 function renderDependabotUpdate(ecosystem, directory, interval) {
     const lines = [
         `  - package-ecosystem: ${ecosystem}`,
@@ -66,7 +144,7 @@ function renderDependabotUpdate(ecosystem, directory, interval) {
         `      interval: ${interval}`,
     ];
     if (ecosystem === "npm") {
-        lines.push("    groups:", "      drizzle:", "        patterns:", '          - "drizzle-*"', '          - "drizzle-orm"', "    ignore:", '      - dependency-name: "@types/node"', "        update-types:", "          - version-update:semver-major");
+        lines.push("    groups:", "      drizzle:", "        patterns:", '          - "drizzle-*"', '          - "drizzle-orm"', "    ignore:", '      - dependency-name: "@types/node"', "        update-types:", "          - version-update:semver-major", '      - dependency-name: "pnpm"', "        update-types:", "          - version-update:semver-major", "          - version-update:semver-minor", "          - version-update:semver-patch");
     }
     if (ecosystem === "docker" && directory === "/.devcontainer") {
         lines.push("    ignore:", "      - dependency-name: mcr.microsoft.com/devcontainers/typescript-node", "        update-types:", "          - version-update:semver-major");
@@ -80,5 +158,12 @@ function defaultDependabotDirectory(ecosystem) {
     return ecosystem === "docker" ? "/.devcontainer" : "/";
 }
 function renderCiEnvironmentNeedCommand(need) {
-    return renderPlaywrightBrowserInstallCommand(need, { withDeps: true });
+    switch (need.kind) {
+        case "playwright-browser-assets":
+            return renderPlaywrightBrowserInstallCommand(need, { withDeps: true });
+        case "shellcheck-command":
+            return need.nextStep.display;
+        case "rust-toolchain":
+            return need.nextStep.display;
+    }
 }

package/node_modules/@ykdz/template-core/dist/project-linking-v2.d.ts

@@ -0,0 +1,20 @@
+import type { PackageContribution } from "./package-contribution.ts";
+import { type ProjectBlueprintV2 } from "./project-blueprint-v2.ts";
+export type ExplicitProjectLinkPlan = {
+    readonly manifestDependenciesByPackagePath: ReadonlyMap<string, Readonly<Record<string, "workspace:*">>>;
+    /**
+     * Build ordering follows the same explicit package relationships as manifest
+     * dependencies.  Turbo resolves ^build:run through the derived workspace
+     * dependency rather than through Preset or framework vocabulary.
+     */
+    readonly hasBuildOrdering: boolean;
+};
+/**
+ * Resolves durable Link Intents using the explicit exposures supplied by
+ * Package Contributions. No Preset identity or string resource protocol is
+ * involved.
+ */
+export declare function planExplicitProjectLinks(options: {
+    readonly blueprint: ProjectBlueprintV2;
+    readonly contributions: readonly PackageContribution[];
+}): ExplicitProjectLinkPlan;