RevoTale · l-you · Aug 27, 2026 · Aug 27, 2026 · Aug 27, 2026 · Aug 27, 2026
diff --git a/TODO b/TODO
@@ -1,25 +1,5 @@
 - Add https://github.com/RevoTale/no-js as a required way to do the non complex UI
 - Maybe replace graphql client gen with gqlgo/gqlgenc
-- Dont use synamic variables for the Dockerfile/docker compose versioning to make Renovate and other tool better detect latest version
-- Prefer explicit versioning locking (e.g go-1.26.2-trixie over go-1.26)
-- Migrate to the https://pnpm.io as a default package manager back because they fix the speed issue by rewriting in RUst on v12
-- add the proper codex devcontainer mounting exmaple
-```
-{
-  "name": "project",
-  "image": "mcr.microsoft.com/devcontainers/base:debian-13",
-
-  "remoteUser": "vscode",
-
-  "containerEnv": {
-    "CODEX_HOME": "/home/vscode/.codex"
-  },
-
-  "mounts": [
-    "source=codex-home,target=/home/vscode/.codex,type=volume"
-  ]
-}
-```
 - Add the priority for the techonogies usage for the UI. try to use the pure htmkl first. -> not enoung -> try to achieve it with the html+css -> not enough? -> try to achieve it with html+css + htmx -> not enough? try to achieve it with html+css+htmx+alpine.js->not enough? use NextJs. 
 - Reivew the ability to use pattern when `no-js` global class stylesheet defined:
 ```templ
@@ -39,13 +19,10 @@ css cardRoot() {
   Example: `class={ DisplayHeading(), cardTitle() }` is preferred over repeating `font-family: var(--font-display)` and the same heading tracking in every card, board, and footer title rule.
 
 -  I want rules regarding artchitecture, that abstraction should be created as a reusable module, and being deteministic, even if there is littl ebut more code repeated for the same featue.
-- https://chatgpt.com/share/69eca650-3328-832e-b017-382f1d3fc5ab
-- DO NOT INstall any third party package version younger than 1 week and maintaned not by RevoTale or `l-you`
 -----
 - ## Translation rules
 - Translate UI copy by meaning and page context, not word-for-word.
 - Prefer natural product language in the target language over literal technical terms.
 - For Ukrainian, translate software “utility/utilities” as “інструмент/інструменти” unless the context specifically means a low-level system utility.
 - Avoid infinitive fragments for section descriptions when the English source implies an active subject. Example: “We are sharing code…” -> “Ми ділимося кодом…”, not “Ділитися кодом…”.
 - If an English source string is grammatically ambiguous, rewrite the English source first before translating other locales.
-
diff --git a/awesome/index.md b/awesome/index.md
@@ -9,6 +9,7 @@ Rules:
 | key | awesome_file | scope |
 | --- | --- | --- |
 | go | ./go.md | Go runtime, backend services, Go templating, and Go GraphQL client |
+| javascript | ./javascript.md | JavaScript and TypeScript libraries published to npm |
 | auth | ./auth.md | Authentication, authorization, identity, OAuth2, OIDC, and policy enforcement |
 | react | ./react.md | React repositories and applications |
 | nextjs | ./nextjs.md | Next.js repositories and applications |
diff --git a/awesome/javascript.md b/awesome/javascript.md
@@ -0,0 +1,6 @@
+# Awesome: JavaScript
+Enforced utility choices for JavaScript and TypeScript packages.
+
+| capability | status | package | source | notes |
+| --- | --- | --- | --- | --- |
+| npm-library-bundler | required | tsdown | https://tsdown.dev/ | Default bundler for TypeScript or JavaScript libraries published to npm. |
diff --git a/doc.md b/doc.md
@@ -9,6 +9,7 @@ Use this table as the single source of truth for module routing.
 | --- | --- | --- | --- |
 | common | Common baseline rules | modules/common/doc.md | always |
 | taskfile | Taskfile (go-task) workflows | modules/taskfile/doc.md | always |
+| nodejs | Node.js runtime and pnpm package manager | modules/nodejs/doc.md | `.node-version`, `.nvmrc`, or `pnpm-lock.yaml` exists, or `package.json` declares Node.js or pnpm tooling |
 | typescript | TypeScript | modules/typescript/doc.md | `tsconfig.json`, `tsconfig.*.json`, `*.ts`, or `*.tsx` exist |
 | react | React | modules/react/doc.md | `package.json` includes `react`, or `*.jsx` / `*.tsx` files exist |
 | nextjs | Next.js | modules/nextjs/doc.md | `next.config.js|mjs|ts`, `package.json` includes `next`, or `app/` route files exist |

diff --git a/modules/bun/doc.md b/modules/bun/doc.md
@@ -11,8 +11,10 @@ This module defines baseline engineering rules for Bun-based repositories and ap
 ```
 
 # Strict rules
-- MUST reuse shared baseline rules: [../../shared/js-biome-bun-core.md](../../shared/js-biome-bun-core.md).
+- MUST reuse shared baseline rules: [../../shared/js-biome-core.md](../../shared/js-biome-core.md).
 - MUST reuse shared conventions: [../../shared/biome-conventions.md](../../shared/biome-conventions.md).
+- MUST treat Bun as an explicit alternative to the default Node.js and pnpm stack.
+- MUST use Bun only when an existing repository already requires it or maintainers explicitly select it.
 - MUST use Bun as the only runtime and package manager.
 - MUST use `bun install` for dependency management.
 - MUST use `bun run` for project scripts.
@@ -22,4 +24,4 @@ This module defines baseline engineering rules for Bun-based repositories and ap
 
 # Working Agreements
 - MUST follow root interaction protocol from [../../AGENTS.md](../../AGENTS.md) before finalizing policy changes.
-- MUST ask for explicit `Accept` before allowing non-Bun runtime or package-manager exceptions.
+- MUST ask for explicit `Accept` before migrating an existing Bun repository to another runtime or package manager.
diff --git a/modules/common/doc.md b/modules/common/doc.md
@@ -5,11 +5,13 @@ This module defines baseline rules that apply to every repository regardless of
 ```text
 <repo-root>/
   AGENTS.md
+  renovate.json
 ```
 
 # Strict rules
 - MUST reuse Taskfile workflow rules for all projects: [../taskfile/doc.md](../taskfile/doc.md).
 - MUST follow the organization-wide OS and base image selection policy: [shared/os-and-base-images.md](../../shared/os-and-base-images.md).
+- MUST follow the organization-wide dependency and Renovate policy: [shared/dependency-management.md](../../shared/dependency-management.md).
 - MUST use Taskfile as the default workflow runner across modules.
 - MUST keep this module scoped to repository-wide baseline rules only; stack-specific rules belong in stack modules.
 - MUST require `task validate` to pass before merge.

diff --git a/modules/go/doc.md b/modules/go/doc.md
@@ -12,6 +12,8 @@ This module defines baseline engineering rules for Go repositories and services.
 - MUST read enforced utility/library choices from [../../awesome/index.md](../../awesome/index.md), [../../awesome/go.md](../../awesome/go.md), and any matching capability awesome files before introducing, replacing, or removing Go libraries.
 - MUST enforce `required` entries from matching awesome files for corresponding Go capabilities.
 - MUST use `golangci-lint` as the Go linter: https://github.com/golangci/golangci-lint.
+- MUST use the latest [golangci-lint configuration format](https://golangci-lint.run/docs/configuration/file/) supported by the pinned golangci-lint version.
+- MUST pin the golangci-lint version in CI and shared development tooling.
 - MUST enforce a maximum line length of 120 characters through golangci-lint configuration.
 - SHOULD prefer patterns from `100 Go Mistakes and How to Avoid Them`: https://github.com/teivah/100-go-mistakes.
 - MUST configure the `lll` linter in golangci-lint with line length set to 120.

diff --git a/modules/nextjs/doc.md b/modules/nextjs/doc.md
@@ -8,19 +8,20 @@ This module defines baseline engineering rules for Next.js repositories and appl
   app/
   next.config.ts
   biome.json|biome.jsonc
-  bun.lock|bun.lockb
+  pnpm-lock.yaml
 ```
 
 # Strict rules
 - MUST read enforced utility/library choices from [../../awesome/nextjs.md](../../awesome/nextjs.md) before introducing, replacing, or removing Next.js libraries.
 - MUST enforce `required` entries from [../../awesome/nextjs.md](../../awesome/nextjs.md) for matching capabilities.
 - MUST apply React-specific rules from [../react/doc.md](../react/doc.md).
-- MUST reuse shared baseline rules: [../../shared/js-biome-bun-core.md](../../shared/js-biome-bun-core.md).
+- MUST apply the Node.js and pnpm defaults from [../nodejs/doc.md](../nodejs/doc.md) unless a more specific runtime module applies.
+- MUST reuse shared baseline rules: [../../shared/js-biome-core.md](../../shared/js-biome-core.md).
 - MUST reuse shared conventions: [../../shared/biome-conventions.md](../../shared/biome-conventions.md).
-- MUST keep Next.js scripts executable through Bun (`bun run next dev`, `bun run next build`, `bun run next start`) because Dockerfile builds depend on them.
+- MUST keep Next.js scripts executable through pnpm by default (`pnpm exec next dev`, `pnpm exec next build`, `pnpm exec next start`); a more specific runtime module MAY provide equivalent commands.
 - SHOULD allow Taskfile workflows to wrap Next.js scripts for repository-level orchestration.
 - MUST keep `task validate` limited to Biome checks for Next.js repositories.
-- MUST keep Bun lockfiles in source control.
+- MUST keep the selected package manager's lockfile in source control; use `pnpm-lock.yaml` for the default pnpm stack.
 - MUST avoid plain `.js` files and use `.ts` / `.tsx` instead, including configs when possible.
 - MUST use App Router (`app/`) and MUST NOT introduce `pages/`.
 - MUST ensure Next.js changes pass `task validate` before merge.

diff --git a/modules/nodejs/doc.md b/modules/nodejs/doc.md
@@ -0,0 +1,28 @@
+# Overview
+This module defines the default Node.js runtime and pnpm package-management rules.
+
+# Project structure
+```text
+<nodejs-repo-root>/
+  AGENTS.md
+  package.json
+  pnpm-lock.yaml
+  pnpm-workspace.yaml
+```
+
+# Strict rules
+- MUST read and enforce matching choices from [../../awesome/javascript.md](../../awesome/javascript.md).
+- MUST prefer the [Current Node.js release](https://nodejs.org/en/about/previous-releases) when project dependencies, tooling, and runtime environments support it.
+- MUST use a supported LTS release when Current compatibility is not established or production stability requirements favor LTS.
+- MUST NOT use an end-of-life Node.js release.
+- MUST use [pnpm](https://pnpm.io/) as the default package manager and pin its exact version in a `package.json` field natively managed by Renovate.
+- MUST use the top-level [`packageManager`](https://docs.renovatebot.com/modules/manager/npm/) field until Renovate natively manages pnpm's preferred [`devEngines.packageManager`](https://pnpm.io/package_json#devenginespackagemanager) field.
+- MUST commit `pnpm-lock.yaml` and use a frozen lockfile in CI.
+- MUST run package scripts through pnpm and expose repository workflows through Taskfile.
+- MUST use `tsdown` for JavaScript or TypeScript libraries published to npm.
+- MUST validate publishable npm libraries with `publint`; MUST also use [`attw`](https://tsdown.dev/options/package-validation) when the package publishes TypeScript declarations.
+- MUST NOT migrate a working project from another runtime or package manager unless migration is explicitly in scope.
+
+# Working Agreements
+- MUST follow root interaction protocol from [../../AGENTS.md](../../AGENTS.md) before finalizing policy changes.
+- MUST request explicit `Accept` before selecting a non-Node.js runtime or non-pnpm package manager for a new JavaScript-family project.
diff --git a/modules/react/doc.md b/modules/react/doc.md
@@ -8,19 +8,20 @@ This module defines baseline engineering rules for React repositories and applic
   package.json
   src/
   biome.json|biome.jsonc
-  bun.lock|bun.lockb
+  pnpm-lock.yaml
 ```
 
 # Strict rules
 - MUST read enforced utility/library choices from [../../awesome/react.md](../../awesome/react.md) before introducing, replacing, or removing React libraries.
 - MUST enforce `required` entries from [../../awesome/react.md](../../awesome/react.md) for matching capabilities.
-- MUST reuse shared baseline rules: [../../shared/js-biome-bun-core.md](../../shared/js-biome-bun-core.md).
+- MUST apply the Node.js and pnpm defaults from [../nodejs/doc.md](../nodejs/doc.md) unless a more specific runtime module applies.
+- MUST reuse shared baseline rules: [../../shared/js-biome-core.md](../../shared/js-biome-core.md).
 - MUST reuse shared conventions: [../../shared/biome-conventions.md](../../shared/biome-conventions.md).
 - MUST avoid plain `.js` files and use `.ts` / `.tsx` instead, including configs when possible.
-- MUST run React build, test, and development workflows through Bun or Taskfile (if there is some). 
+- MUST run React build, test, and development workflows through Taskfile and pnpm by default; a more specific runtime module MAY override the package-manager command.
 - SHOULD define components using functional component patterns.
 - SHOULD prefer one file per component.
-- MUST keep Bun lockfiles in source control.
+- MUST keep the selected package manager's lockfile in source control; use `pnpm-lock.yaml` for the default pnpm stack.
 - MUST ensure React changes pass `task validate` before merge.
 - MUST ensure React changes pass `task test` when the task exists.
 - SHOULD colocate component-specific helpers with their component when helpers are not shared.

diff --git a/modules/taskfile/doc.md b/modules/taskfile/doc.md
@@ -28,7 +28,7 @@ tasks:
   fix:
     desc: Auto-fix lint issues
     cmds:
-      - bunx biome check --write --unsafe .
+      - pnpm exec biome check --write --unsafe .
 ```
 
 Example of correct composition:
@@ -38,7 +38,7 @@ tasks:
   biome:fix:
     desc: Fix files with Biome
     cmds:
-      - bunx biome check --write --unsafe .
+      - pnpm exec biome check --write --unsafe .
   fix:
     desc: Auto-fix all code quality issues
     cmds:

diff --git a/modules/typescript/doc.md b/modules/typescript/doc.md
@@ -8,18 +8,21 @@ This module defines baseline engineering rules for TypeScript repositories and a
   package.json
   tsconfig.json|tsconfig.*.json
   biome.json|biome.jsonc
-  bun.lock|bun.lockb
+  pnpm-lock.yaml
 ```
 
 # Strict rules
-- MUST reuse shared baseline rules: [../../shared/js-biome-bun-core.md](../../shared/js-biome-bun-core.md).
+- MUST read and enforce matching choices from [../../awesome/javascript.md](../../awesome/javascript.md).
+- MUST apply the Node.js and pnpm defaults from [../nodejs/doc.md](../nodejs/doc.md) unless a more specific runtime module applies.
+- MUST reuse shared baseline rules: [../../shared/js-biome-core.md](../../shared/js-biome-core.md).
 - MUST reuse shared conventions: [../../shared/biome-conventions.md](../../shared/biome-conventions.md).
 - MUST keep TypeScript compiler options in `tsconfig.json` or `tsconfig.*.json`.
 - SHOULD use a single, universal `tsconfig.json` unless tooling requires multiple configs.
 - MUST configure strict compiler options, including `noUncheckedIndexedAccess`.
 - MUST avoid plain `.js` files and use `.ts` / `.tsx` instead, including configs when possible.
-- MUST run scripts and tooling through Bun via Taskfile tasks.
-- MUST require `task validate` to include TypeScript typechecking (`bun run tsc --noEmit` or equivalent) and pass before merge.
+- MUST use pnpm for scripts and tooling by default; a more specific runtime module MAY override the package-manager command.
+- MUST require `task validate` to include TypeScript typechecking (`pnpm exec tsc --noEmit` or the selected runtime's equivalent) and pass before merge.
+- MUST generate declaration files for npm libraries that expose TypeScript types.
 - SHOULD keep TypeScript configuration centralized unless tooling constraints require multiple configs.
 
 # Working Agreements

diff --git a/shared/dependency-management.md b/shared/dependency-management.md
@@ -0,0 +1,23 @@
+# Overview
+This policy defines dependency freshness, Renovate configuration, and directly discoverable container image versions.
+
+# Strict rules
+- MUST NOT install a third-party dependency release until seven days after publication.
+- MAY use releases maintained by RevoTale or `l-you` without the seven-day delay.
+- MUST obtain explicit user `Accept` and document the reason before any other quarantine exception.
+- MUST configure package-manager enforcement when supported. For pnpm, set [`minimumReleaseAge: 10080`](https://pnpm.io/settings/dependency-resolution#minimumreleaseage) and `minimumReleaseAgeIgnoreMissingTime: false` in `pnpm-workspace.yaml`; add only verified RevoTale and `l-you` packages or scopes to `minimumReleaseAgeExclude`.
+- MUST keep a root `renovate.json` in every target repository with [`extends: ["local>RevoTale/.github:renovate-config"]`](https://docs.renovatebot.com/config-presets/).
+- MUST NOT duplicate organization-wide Renovate rules locally without a repository-specific reason.
+- MUST write container image tags or digests directly in Dockerfiles, Compose files, devcontainer configuration, and CI configuration so standard dependency managers can discover them.
+- MUST prefer the most specific supported image tag with its digest instead of a floating tag, for example `<image>:1.2.3@sha256:<digest>`.
+- MUST NOT hide container image versions behind build arguments or environment variables.
+- MUST NOT add custom Renovate managers or annotations solely to update an indirect container image version.
+
+Use this minimal target-repository configuration:
+
+```json
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["local>RevoTale/.github:renovate-config"]
+}
+```
diff --git a/shared/js-biome-bun-core.md b/shared/js-biome-bun-core.md
diff --git a/shared/js-biome-core.md b/shared/js-biome-core.md
@@ -0,0 +1,10 @@
+# Overview
+Reusable Biome baseline for JavaScript-family stacks.
+
+# Core Behaviors & Patterns
+- MUST use Biome as the linter and formatter: https://biomejs.dev/.
+- MUST set `linter.rules.preset` to `all` so every stable rule is enabled.
+- MUST NOT enable nursery rules globally because they are not covered by Biome semantic-versioning guarantees.
+- MUST make Biome warnings fail validation, for example with `biome check --error-on-warnings .`.
+- MUST keep suppressions local and explain why the rule does not apply.
+- MUST NOT use ESLint or Prettier.