@crossdelta/platform-sdk 0.26.0 → 0.26.2

package/bin/templates/workspace/.github/actions/generate-scope-matrix/scope-tree.js

@@ -0,0 +1,148 @@
+/**
+ * Pure functions behind a scope's checksum: which workspaces of a pruned tree the scope reaches,
+ * and how the remaining files hash into the image tag.
+ *
+ * `turbo prune` also copies every workspace the root package.json depends on (tool packages such
+ * as a CLI), so without this a release of such a package changed every scope's tag.
+ */
+
+const { createHash } = require('node:crypto')
+
+/**
+ * @typedef {{name: string, dependencies: string[]}} WorkspaceManifest
+ */
+
+const DEPENDENCY_FIELDS = ['dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies']
+const PRUNED_TREES = ['json', 'full']
+const WORKSPACE_BLOCK_INDENT = '    '
+
+/**
+ * Reduces a parsed package.json to its name and the names of everything it depends on. Every
+ * dependency field counts and the version spec does not matter, so a workspace linked by version
+ * instead of `workspace:` stays in the closure.
+ * @param {Object} packageJson - Parsed package.json
+ * @returns {WorkspaceManifest}
+ */
+const workspaceManifest = (packageJson) => ({
+  name: packageJson.name,
+  dependencies: DEPENDENCY_FIELDS.flatMap((field) => Object.keys(packageJson[field] ?? {})),
+})
+
+/**
+ * Collects the workspaces a scope reaches through its own dependencies, transitively, itself included.
+ * @param {string} scopeDir - The scope's workspace directory, e.g. 'apps/web'
+ * @param {Map<string, WorkspaceManifest>} manifestsByDir - Every workspace of the pruned tree by directory
+ * @returns {Set<string>} Workspace directories
+ */
+const dependencyClosure = (scopeDir, manifestsByDir) => {
+  if (!manifestsByDir.has(scopeDir)) {
+    throw new Error(`No manifest for ${scopeDir} in the pruned tree`)
+  }
+
+  const dirsByName = new Map([...manifestsByDir].map(([dir, manifest]) => [manifest.name, dir]))
+  const reached = new Set()
+  const pending = [scopeDir]
+
+  while (pending.length > 0) {
+    const dir = pending.pop()
+    if (reached.has(dir)) continue
+    reached.add(dir)
+    for (const name of manifestsByDir.get(dir).dependencies) {
+      const dependencyDir = dirsByName.get(name)
+      if (dependencyDir) pending.push(dependencyDir)
+    }
+  }
+
+  return reached
+}
+
+/**
+ * Lists the workspaces of a pruned tree the scope does not reach.
+ * @param {string} scopeDir - The scope's workspace directory
+ * @param {Map<string, WorkspaceManifest>} manifestsByDir - Every workspace of the pruned tree by directory
+ * @returns {string[]} Workspace directories, sorted
+ */
+const foreignWorkspaces = (scopeDir, manifestsByDir) => {
+  const closure = dependencyClosure(scopeDir, manifestsByDir)
+  return [...manifestsByDir.keys()].filter((dir) => !closure.has(dir)).sort()
+}
+
+/**
+ * Checks if a path of the pruned tree belongs to a foreign workspace.
+ * @param {string} path - Path relative to out/<scope>, without './'
+ * @param {string[]} foreignDirs - Foreign workspace directories
+ * @returns {boolean}
+ */
+const isForeignPath = (path, foreignDirs) =>
+  PRUNED_TREES.some((tree) => foreignDirs.some((dir) => path.startsWith(`${tree}/${dir}/`)))
+
+/**
+ * Checks if a file of the pruned tree is a copy of a git-tracked source file. `turbo prune` also
+ * copies ignored files such as `dist/` and `.turbo/` logs, which the CI's `bun install` builds anew
+ * on every run; hashing them changed every scope's tag on every run. Files outside json/ and full/
+ * (the pruned bun.lock) are turbo's own output and always count.
+ * @param {string} path - Path relative to out/<scope>, without './'
+ * @param {Set<string>} trackedPaths - `git ls-files` of the workspace root
+ * @returns {boolean}
+ */
+const isSourcePath = (path, trackedPaths) => {
+  const tree = PRUNED_TREES.find((name) => path.startsWith(`${name}/`))
+  return tree === undefined || trackedPaths.has(path.slice(tree.length + 1))
+}
+
+/**
+ * Removes the blocks of the given workspaces from the `workspaces` section of a bun.lock. The rest
+ * of the file is returned byte for byte.
+ * @param {string} lockText - bun.lock content
+ * @param {string[]} foreignDirs - Workspace directories whose blocks go
+ * @returns {string}
+ */
+const stripLockWorkspaces = (lockText, foreignDirs) => {
+  const blockStarts = new Set(foreignDirs.map((dir) => `${WORKSPACE_BLOCK_INDENT}"${dir}": {`))
+  const blockEnd = new RegExp(`^${WORKSPACE_BLOCK_INDENT}},?$`)
+  const kept = []
+  let inWorkspaces = false
+  let skipping = false
+
+  for (const line of lockText.split('\n')) {
+    if (line === '  "workspaces": {') inWorkspaces = true
+    else if (inWorkspaces && /^ {2}},?$/.test(line)) inWorkspaces = false
+
+    if (skipping) {
+      if (blockEnd.test(line)) skipping = false
+      continue
+    }
+    if (inWorkspaces && blockStarts.has(line)) {
+      skipping = true
+      continue
+    }
+    kept.push(line)
+  }
+
+  return kept.join('\n')
+}
+
+/**
+ * Hashes file digests the way `find . -type f | sort | xargs sha256sum | sha256sum` does, with the
+ * paths sorted by bytes so the order does not depend on the runner's locale.
+ * @param {Array<{path: string, digest: string}>} entries - Paths relative to out/<scope>, without './'
+ * @returns {string} Hex sha256
+ */
+const checksumOf = (entries) => {
+  const listing = entries
+    .map(({ path, digest }) => ({ path: `./${path}`, digest }))
+    .sort((a, b) => Buffer.compare(Buffer.from(a.path), Buffer.from(b.path)))
+    .map(({ path, digest }) => `${digest}  ${path}\n`)
+    .join('')
+  return createHash('sha256').update(listing).digest('hex')
+}
+
+module.exports = {
+  checksumOf,
+  dependencyClosure,
+  foreignWorkspaces,
+  isForeignPath,
+  isSourcePath,
+  stripLockWorkspaces,
+  workspaceManifest,
+}

package/bin/templates/workspace/.github/actions/generate-scope-matrix/select.js

@@ -0,0 +1,47 @@
+/**
+ * Pure selection for the only-unbuilt matrix: which scopes still need an image.
+ */
+
+/**
+ * @typedef {{name: string, dir: string, shortName: string}} Scope
+ * @typedef {{scope: Scope, imageTag: string, exists: boolean}} TagLookup
+ * @typedef {Scope & {run: true, imageTag: string}} MatrixEntry
+ */
+
+/**
+ * Keeps the scopes whose checksum tag GHCR does not hold yet, plus every forced scope.
+ * Each entry carries the `imageTag` it looked up, so the build job can warn when its own checksum differs.
+ * @param {TagLookup[]} lookups - One entry per discovered scope; `exists` is false when GHCR could not answer
+ * @param {string[]} [forcedShortNames=[]] - Short names included even when their image exists
+ * @returns {MatrixEntry[]} Matrix entries sorted by scope name
+ */
+const selectUnbuilt = (lookups, forcedShortNames = []) => {
+  const forced = new Set(forcedShortNames)
+  return lookups
+    .filter(({ scope, exists }) => !exists || forced.has(scope.shortName))
+    .map(({ scope, imageTag }) => ({ ...scope, run: true, imageTag }))
+    .sort((a, b) => a.name.localeCompare(b.name))
+}
+
+/**
+ * Maps every scope's short name to the tag computed for this commit, whether it was built or not.
+ * The deploy reads it for scopes without a build marker, so an image that already existed (after a
+ * revert, say) deploys by this commit's tag instead of by GHCR's newest checksum tag.
+ * @param {TagLookup[]} lookups - One entry per discovered scope
+ * @returns {Record<string, string>} Short name → image tag
+ */
+const scopeTagMap = (lookups) => Object.fromEntries(lookups.map(({ scope, imageTag }) => [scope.shortName, imageTag]))
+
+/**
+ * Lists the scopes whose tag differs from the one computed at the diff base. A revert lands on an
+ * image GHCR already holds, so the matrix stays empty; this list is what still makes it deploy.
+ * @param {Record<string, string>} scopeTags - Short name → tag at this commit
+ * @param {Record<string, string>} baseScopeTags - Short name → tag at the base; a scope missing here counts as changed
+ * @returns {string[]} Short names, sorted
+ */
+const changedScopeTags = (scopeTags, baseScopeTags) =>
+  Object.keys(scopeTags)
+    .filter((shortName) => scopeTags[shortName] !== baseScopeTags[shortName])
+    .sort()
+
+module.exports = { changedScopeTags, scopeTagMap, selectUnbuilt }

package/bin/templates/workspace/.github/workflows/build-and-deploy.yml.hbs

@@ -95,22 +95,71 @@ jobs:
     needs: gate
     if: needs.gate.outputs.proceed == 'true'
     runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      packages: read
     outputs:
       scopes: $\{{ steps.scope-generator.outputs.scopes }}
       scope_count: $\{{ steps.scope-generator.outputs.scopes_count }}
+      scope_tags: $\{{ steps.scope-generator.outputs.scope_tags }}
+      tags_changed: $\{{ steps.scope-generator.outputs.tags_changed }}
       infrastructure_changed: $\{{ steps.infra-eval.outputs.changed }}
+      force_deploy: $\{{ steps.commit-range.outputs.force_deploy }}
     steps:
       - uses: actions/checkout@v6
         with:
           fetch-depth: 0
           ref: $\{{ env.WORKFLOW_HEAD_SHA }}
 
+      # A workflow_run event carries no `before`. Its base is the head of the last successful run on
+      # main whose Prepare Scopes job ran, so a push of several commits or a commit whose publish run
+      # failed still shows its changes. A run the gate stopped does not count: it never looked at the
+      # diff. Manual dispatches do not count either: they may have targeted another environment.
+      #
+      # An image in GHCR is not an image on stage: a failed run since that base may have pushed images
+      # it never deployed, and the next run would find them built and skip the deploy. Any failed or
+      # cancelled run since the base, or no base at all (HEAD^ fallback), therefore forces a deploy.
       - name: Set commit range
+        id: commit-range
+        env:
+          GH_TOKEN: $\{{ github.token }}
+          EVENT_NAME: $\{{ github.event_name }}
+          WORKFLOW_FILE: build-and-deploy.yml
+          PREPARE_JOB_NAME: 🧪 Prepare Scopes
         run: |
           set -euo pipefail
           HEAD_SHA="${WORKFLOW_HEAD_SHA}"
           BASE_SHA="${WORKFLOW_BASE_SHA_INPUT}"
           NULL_SHA="0000000000000000000000000000000000000000"
+          FORCE_DEPLOY=false
+          if [ "$EVENT_NAME" = "workflow_run" ]; then
+            RUNS=$(gh run list -R "$GITHUB_REPOSITORY" --workflow "$WORKFLOW_FILE" --branch main --status completed --limit 30 \
+              --json databaseId,headSha,conclusion,event --jq '.[] | "\(.databaseId) \(.headSha) \(.conclusion) \(.event)"' \
+              || echo "::warning::Could not list earlier runs.")
+            while read -r RUN_ID RUN_SHA RUN_CONCLUSION RUN_EVENT; do
+              [ -n "$RUN_ID" ] || continue
+              [ "$RUN_EVENT" != "workflow_dispatch" ] || continue
+              git merge-base --is-ancestor "$RUN_SHA" "$HEAD_SHA" 2>/dev/null || continue
+              if [ "$RUN_CONCLUSION" != "success" ]; then
+                FORCE_DEPLOY=true
+                echo "Run $RUN_ID at $RUN_SHA ended $RUN_CONCLUSION: deploying regardless of the matrix"
+                continue
+              fi
+              PREPARED=$(gh run view "$RUN_ID" -R "$GITHUB_REPOSITORY" --json jobs \
+                --jq "[.jobs[] | select(.name == \"$PREPARE_JOB_NAME\" and .conclusion == \"success\")] | length" || echo 0)
+              if [ "$PREPARED" != "0" ]; then
+                BASE_SHA="$RUN_SHA"
+                echo "Base: last prepared run $RUN_ID at $RUN_SHA"
+                break
+              fi
+            done <<< "$RUNS"
+            if [ -z "$BASE_SHA" ]; then
+              FORCE_DEPLOY=true
+              echo "::warning::No earlier prepared run on main found; diffing against HEAD^ and deploying."
+            fi
+          fi
+          echo "force_deploy=$FORCE_DEPLOY" >> "$GITHUB_OUTPUT"
           if [ -z "$BASE_SHA" ] || [ "$BASE_SHA" = "$NULL_SHA" ]; then
             if git rev-parse "${HEAD_SHA}^" >/dev/null 2>&1; then
               BASE_SHA=$(git rev-parse "${HEAD_SHA}^")
@@ -121,10 +170,15 @@ jobs:
           echo "GITHUB_SHA=$HEAD_SHA" >> "$GITHUB_ENV"
           echo "GITHUB_EVENT_BEFORE=$BASE_SHA" >> "$GITHUB_ENV"
 
+      # The stack's own directory plus the workspace packages it imports. Those packages only ever
+      # change on the workflow_run path: a push touching packages/ is handed to the publish run.
       - name: Check for infrastructure changes
         id: infra-check
+        env:
+          INFRA_PATHS: infra/ packages/infrastructure/ packages/contracts/ packages/cloudevents/
         run: |
-          CHANGED=$(git diff --name-only "$GITHUB_EVENT_BEFORE" "$GITHUB_SHA" -- infra/ | head -1)
+          # shellcheck disable=SC2086 # INFRA_PATHS is a space-separated pathspec list
+          CHANGED=$(git diff --name-only "$GITHUB_EVENT_BEFORE" "$GITHUB_SHA" -- $INFRA_PATHS | head -1)
           if [ -n "$CHANGED" ]; then
             echo "changed=true" >> "$GITHUB_OUTPUT"
           else
@@ -134,18 +188,44 @@ jobs:
       - name: Evaluate infrastructure change
         id: infra-eval
         run: |
-          if [ "$\{{ github.event_name }}" = "workflow_run" ] || [ "$\{{ github.event_name }}" = "workflow_dispatch" ] || [ "$\{{ steps.infra-check.outputs.changed }}" = "true" ]; then
+          if [ "$\{{ github.event_name }}" = "workflow_dispatch" ] || [ "$\{{ steps.infra-check.outputs.changed }}" = "true" ]; then
             echo "changed=true" >> "$GITHUB_OUTPUT"
           else
             echo "changed=false" >> "$GITHUB_OUTPUT"
           fi
 
+      # A private workspace package or a lockfile line reaches a scope without
+      # touching its directory. On those paths the matrix asks GHCR whether each scope's checksum
+      # tag exists instead of diffing directories; a tool-package bump that changes no scope's
+      # pruned tree then builds and deploys nothing. A manual dispatch keeps building every scope.
+      - name: Decide matrix mode
+        id: matrix-mode
+        run: |
+          EVENT="$\{{ github.event_name }}"
+          LOCK_CHANGED=$(git diff --name-only "$GITHUB_EVENT_BEFORE" "$GITHUB_SHA" -- bun.lock | head -1)
+          if [ "$EVENT" != "workflow_dispatch" ] && { [ "$EVENT" = "workflow_run" ] || [ -n "$LOCK_CHANGED" ]; }; then
+            echo "only_unbuilt=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "only_unbuilt=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Setup Bun and install dependencies
+        if: steps.matrix-mode.outputs.only_unbuilt == 'true'
+        uses: ./.github/actions/setup-bun-install
+        with:
+          enable-cache: 'true'
+          cache-key: bun-v4-$\{{ runner.os }}-$\{{ hashFiles('bun.lock', 'bunfig.toml') }}
+          cache-restore-keys: bun-v4-$\{{ runner.os }}-
+          npm-token: $\{{ github.token }}
+
       - name: Generate scope matrix
         id: scope-generator
         uses: ./.github/actions/generate-scope-matrix
         with:
           scope-roots: $\{{ env.SCOPE_ROOTS }}
-          force-all: $\{{ github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_run' }}
+          force-all: $\{{ github.event_name == 'workflow_dispatch' }}
+          only-unbuilt: $\{{ steps.matrix-mode.outputs.only_unbuilt }}
+          github-token: $\{{ secrets.GITHUB_TOKEN }}
 
   build:
     if: needs.prepare-scopes.outputs.scope_count && needs.prepare-scopes.outputs.scope_count != '0'
@@ -182,27 +262,30 @@ jobs:
           cache-restore-keys: bun-v4-$\{{ runner.os }}-
           npm-token: $\{{ github.token }}
 
-      - name: Prune
-        run: |
-          bunx turbo prune --scope=$\{{ matrix.scope.name }} --docker --out-dir out/$\{{ matrix.scope.shortName }}
-          # turbo prune omits the bun patchedDependencies patch files. Copy them into the
-          # pruned context so `bun install` can apply them (rxdb patch for studio/storefront).
-          # Done before the scope checksum so a patch change busts the image tag.
-          if [ -d patches ]; then
-            cp -rT patches "out/$\{{ matrix.scope.shortName }}/full/patches"
-          fi
-
-      - name: Compute scope checksum
+      # The same script computes the tag prepare-scopes looked up (only-unbuilt), so both agree. It
+      # also leaves the pruned tree in out/<short-name>, which the Docker build below uses.
+      - name: Prune and compute scope checksum
         id: scope-checksum
+        env:
+          SCOPE_NAME: $\{{ matrix.scope.name }}
+          SCOPE_SHORT_NAME: $\{{ matrix.scope.shortName }}
+          SCOPE_DIR: $\{{ matrix.scope.dir }}
         run: |
           set -euo pipefail
-          cd "out/$\{{ matrix.scope.shortName }}"
-          HASH=$(find . -type f -print0 | sort -z | xargs -0 sha256sum | sha256sum)
-          HASH=${HASH%% *}
+          HASH=$(bash .github/actions/generate-scope-matrix/scope-checksum.sh "$SCOPE_NAME" "$SCOPE_SHORT_NAME" "$SCOPE_DIR")
           echo "scope_hash=$HASH" >> $GITHUB_OUTPUT
 
+      # The tag names what this job built. A matrix tag that differs means the pruned tree changed
+      # between the two jobs; the image then carries this job's tag, never the looked-up one.
       - name: Use scope checksum as image tag
-        run: echo "IMAGE_TAG=$\{{ steps.scope-checksum.outputs.scope_hash }}" >> $GITHUB_ENV
+        env:
+          MATRIX_TAG: $\{{ matrix.scope.imageTag }}
+          SCOPE_HASH: $\{{ steps.scope-checksum.outputs.scope_hash }}
+        run: |
+          if [ -n "$MATRIX_TAG" ] && [ "$MATRIX_TAG" != "$SCOPE_HASH" ]; then
+            echo "::warning::$\{{ matrix.scope.shortName }}: checksum $SCOPE_HASH differs from the matrix tag $MATRIX_TAG"
+          fi
+          echo "IMAGE_TAG=$SCOPE_HASH" >> $GITHUB_ENV
 
       - name: Check if image tag exists
         id: tag-check
@@ -275,12 +358,17 @@ jobs:
     # deploy the newest checksum image GHCR holds for them — an older commit, possibly a stage
     # build. That happened on 2026-09-17 (run 35254568199): four app builds cancelled, deploy
     # went ahead on the previous commit's images.
+    # `tags_changed` covers a revert: its tag is an older image GHCR still holds, so nothing is
+    # built, but stage runs the reverted one.
     if: |
       always() &&
       needs.gate.outputs.proceed == 'true' &&
       needs.prepare-scopes.result == 'success' &&
       (needs.build.result == 'success' || needs.build.result == 'skipped') &&
-      (needs.prepare-scopes.outputs.scope_count != '0' || needs.prepare-scopes.outputs.infrastructure_changed == 'true')
+      (needs.prepare-scopes.outputs.scope_count != '0' ||
+        needs.prepare-scopes.outputs.tags_changed == 'true' ||
+        needs.prepare-scopes.outputs.force_deploy == 'true' ||
+        needs.prepare-scopes.outputs.infrastructure_changed == 'true')
     name: 🌍 Deploy ($\{{ github.event.inputs.environment || 'stage' }})
     environment: $\{{ github.event.inputs.environment || 'stage' }}
     steps:
@@ -295,6 +383,20 @@ jobs:
           pattern: changed-*
           path: .artifacts
 
+      # download-artifact puts each matching artifact into its own `changed-<scope>/` directory only
+      # when it matches several. A single match is extracted straight into `.artifacts/`, where no
+      # later step looks for it: the scope's image tag then came from GHCR instead of its marker, and
+      # the Studio smoke check and client broadcast were skipped (stage run 38151120673, 11.10.2026).
+      - name: Normalize change marker layout
+        run: |
+          if [ -f .artifacts/metadata.json ]; then
+            SHORT=$(jq -er '.shortName' .artifacts/metadata.json)
+            mkdir -p ".artifacts/changed-${SHORT}"
+            for marker_file in metadata.json scope.txt; do
+              if [ -f ".artifacts/${marker_file}" ]; then mv ".artifacts/${marker_file}" ".artifacts/changed-${SHORT}/"; fi
+            done
+          fi
+
       - name: Resolve scope image tags
         id: resolve_scope_tags
         shell: bash
@@ -303,6 +405,7 @@ jobs:
           GH_TOKEN: $\{{ secrets.GITHUB_TOKEN }}
           REPO_OWNER: $\{{ github.repository_owner }}
           REPO_PREFIX: $\{{ github.event.repository.name }}
+          COMPUTED_TAGS: $\{{ needs.prepare-scopes.outputs.scope_tags || '{}' }}
         run: |
           set -euo pipefail
           RESULT="{}"
@@ -318,13 +421,22 @@ jobs:
             done
           fi
 
-          # 2. For scopes without markers, query GHCR for latest checksum tag
+          # 2. For scopes without markers: this commit's computed tag, else GHCR's latest checksum tag
           MISSING=""
           for scope_dir in apps/*/Dockerfile services/*/Dockerfile; do
             [ -f "$scope_dir" ] || continue
             SHORT=$(basename "$(dirname "$scope_dir")")
             echo "$RESULT" | jq -e --arg k "$SHORT" '.[$k]' >/dev/null 2>&1 && continue
 
+            # A scope prepare-scopes found already built carries this commit's tag: after a revert
+            # that is an older image, and GHCR's newest checksum tag would roll out the reverted one.
+            COMPUTED_TAG=$(jq -r --arg k "$SHORT" '.[$k] // empty' <<<"$COMPUTED_TAGS")
+            if [ -n "$COMPUTED_TAG" ]; then
+              RESULT=$(echo "$RESULT" | jq --arg k "$SHORT" --arg v "$REGISTRY/$SHORT:$COMPUTED_TAG" '. + {($k): $v}')
+              echo "  $SHORT → $COMPUTED_TAG (computed for this commit)"
+              continue
+            fi
+
             # Query GHCR for the latest version with a checksum tag (retry transient API errors)
             CHECKSUM_TAG=""
             for attempt in 1 2 3; do
@@ -371,6 +483,7 @@ jobs:
       # mid-update: DigitalOcean finishes the resize server-side anyway, while Pulumi never writes
       # the result back and leaves a stack lock and a pending operation behind.
       - name: Pulumi up
+        id: pulumi-up
         uses: pulumi/actions@v7
         timeout-minutes: 15
         with:
@@ -417,3 +530,8 @@ jobs:
           done
           curl "${curl_opts[@]}" "${STUDIO_URL}/health" || exit 1
 
+      # The topic carries no `realtime:` prefix: the REST endpoint adds it, and a client subscribed to
+      # `system:deploy` listens on `realtime:system:deploy`. With the prefix spelled out the message
+      # went to `realtime:realtime:system:deploy`, a channel nobody listened on (listener log, stage,
+      # 11.10.2026). `-f` makes a refused broadcast fail the command, so the warning below can fire.
+

package/bin/templates/workspace/.github/workflows/lint-and-tests.yml.hbs

@@ -12,6 +12,7 @@ concurrency:
 jobs:
   lint:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Checkout code
         uses: actions/checkout@v6
@@ -26,8 +27,17 @@ jobs:
       - name: Run Linter
         run: bun run --if-present lint
 
+      - name: Component manifest
+        run: |
+          git fetch --depth=1 origin main
+          bun run --if-present manifest:check
+
+      - name: Pattern manifest
+        run: bun run --if-present patterns:check
+
   test:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     env:
     steps:
       - name: Checkout code
@@ -45,6 +55,7 @@ jobs:
 
   e2e:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     needs: test
     if: false # disabled until E2E tests are stable
     env:

package/bin/templates/workspace/.github/workflows/publish-packages.yml

@@ -16,9 +16,9 @@ on:
         default: all
         required: true
 
+# id-token: write only where it is used: the publish job sets it itself.
 permissions:
   contents: read
-  id-token: write
 
 jobs:
   determine-packages:
@@ -211,6 +211,25 @@ jobs:
           fi
           echo "✅ Workspace template complete"
 
+      # The kit is published for other people's repositories: nothing of this one may ride along. The check packs
+      # the package as npm receives it and scans every text file against the kit's built-in patterns.
+      - name: Setup Bun for the leak check
+        if: matrix.package.name == 'jackherd' || matrix.package.name == '@crossdelta/agent-kit'
+        # Pinned to a commit: this job holds id-token: write, which npm Trusted Publishing accepts.
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version-file: package.json
+
+      - name: Leak check on the jackherd tarball
+        if: matrix.package.name == 'jackherd'
+        working-directory: ${{ matrix.package.dir }}
+        run: bun scripts/check-package-leaks.ts
+
+      - name: Leak check on the agent-kit shell tarball
+        if: matrix.package.name == '@crossdelta/agent-kit'
+        working-directory: ${{ matrix.package.dir }}
+        run: bun ../jackherd/scripts/check-package-leaks.ts .
+
       - name: Publish to npm
         working-directory: ${{ matrix.package.dir }}
         run: |

package/bin/templates/workspace/CLAUDE.md

@@ -52,9 +52,9 @@ regardless of which file is open, because that cost is paid on every turn.
 Code style and testing conventions are not rules here: the `pf` generators carry their own, and they
 load whenever the generator writes code.
 
-## Agent Kit
+## jackherd
 
-Skills, agents and general rules under `.claude/` come from `@crossdelta/agent-kit` and are listed in `.claude/agent-kit.lock.json`. Project values (languages, plan directory, models, checks) live in `.claude/agent-kit.json`. Update with `pf agents sync`; a conflicting local edit lands as `<file>.kit-new`. Put project knowledge into `.claude/project/<skill>.md` or a rule beside `.claude/rules/kit/`, so the kit files stay updatable. `pf plans` shows the plan progress of the current sprint.
+Skills, agents and general rules under `.claude/` come from `jackherd` and are listed in `.jackherd/lock.json`. Project values (languages, plan directory, models, checks) live in `.jackherd/config.json`. Update with `pf agents sync`; a conflicting local edit lands as `<file>.kit-new`. Put project knowledge into `.claude/project/<skill>.md` or a rule beside `.claude/rules/kit/`, so the kit files stay updatable. `pf plans` shows the plan progress of the current sprint.
 
 ## Key Packages
 

package/bin/templates/workspace/infra/package.json.hbs

@@ -8,7 +8,7 @@
   },
   "dependencies": {
     "@crossdelta/cloudevents": "^0.10.0",
-    "@crossdelta/infrastructure": "^0.16.0",
+    "@crossdelta/infrastructure": "^0.18.1",
     "{{scope}}/contracts": "workspace:*",
     "@pulumi/digitalocean": "^4.55.0",
     "@pulumi/kubernetes": "^4.21.0",

package/bin/templates/workspace/package.json.hbs

@@ -19,11 +19,11 @@
         "cwd": "infra"
       },
       "agents": {
-        "command": "bunx @crossdelta/agent-kit",
-        "description": "Agent kit: init, sync, check, plans"
+        "command": "bunx jackherd",
+        "description": "jackherd: init, sync, check, plans"
       },
       "plans": {
-        "command": "bunx @crossdelta/agent-kit plans",
+        "command": "bunx jackherd plans",
         "description": "Live view of the sprint's lanes and their plan progress"
       }
     },
@@ -51,9 +51,9 @@
   },
   "devDependencies": {
     "@biomejs/biome": "2.3.7",
-    "@crossdelta/agent-kit": "latest",
     "@crossdelta/platform-sdk": "latest",
     "dotenv-cli": "^8.0.0",
+    "jackherd": "latest",
     "turbo": "^2.5.6"
   },
   "packageManager": "{{packageManagerVersion}}",

package/bin/templates/workspace/packages/contracts/package.json.hbs

@@ -20,7 +20,7 @@
   },
   "dependencies": {
     "@crossdelta/cloudevents": "^0.10.0",
-    "@crossdelta/infrastructure": "^0.16.0",
+    "@crossdelta/infrastructure": "^0.18.1",
     "zod": "^4.0.0"
   },
   "devDependencies": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crossdelta/platform-sdk",
-  "version": "0.26.0",
+  "version": "0.26.2",
   "description": "Platform toolkit for event-driven microservices — keeping code and infrastructure in lockstep.",
   "keywords": [
     "cli",
@@ -88,7 +88,6 @@
     "chokidar": "^5.0.0",
     "cli-table3": "^0.6.5",
     "commander": "^13.1.0",
-    "dotenv": "^17.2.3",
     "enquirer": "^2.4.1",
     "execa": "^9.5.2",
     "fs-extra": "^11.3.0",
@@ -100,7 +99,7 @@
     "rimraf": "^6.1.2",
     "terminal-link": "^4.0.0",
     "zod": "^4.0.0",
-    "@crossdelta/infrastructure": "^0.16.0"
+    "@crossdelta/infrastructure": "^0.18.1"
   },
   "peerDependencies": {
     "@nestjs/schematics": "^11.0.5",