@ykdz/template 0.0.32 → 0.0.33

package/node_modules/@ykdz/template-builtin-presets/dist/src/foundation.d.ts

@@ -1,3 +1,4 @@
+import type { CiDiagnosticArtifactDeclaration } from "#template-core/ci-diagnostic-artifact";
 import { type DevelopmentContainerToolLayerBuildArgument, type DevelopmentContainerToolLayerMount, type DevelopmentContainerToolLayerProbe, type PlannedDevelopmentContainerToolLayer } from "#template-core/development-container-tool-layer";
 import type { CheckEnvironmentNeed, DeploymentEnvironmentNeed } from "#template-core/module-graph";
 import { type PackageContribution } from "#template-core/package-contribution";
@@ -42,6 +43,7 @@ export type GeneratedRepositoryPlan = {
     };
     readonly environmentNeeds: readonly CheckEnvironmentNeed[];
     readonly deploymentEnvironmentNeeds: readonly DeploymentEnvironmentNeed[];
+    readonly ciDiagnosticArtifacts: readonly CiDiagnosticArtifactDeclaration[];
     /** Structured manifests used to derive the generated Dependency Catalog. */
     readonly manifests: readonly Readonly<Record<string, unknown>>[];
     readonly dependencyCatalog: Readonly<Record<string, string>>;

package/node_modules/@ykdz/template-builtin-presets/dist/src/foundation.js

@@ -1,13 +1,14 @@
 import { existsSync, readFileSync } from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
+import { composeCiDiagnosticArtifacts } from "#template-core/ci-diagnostic-artifact";
 import { collectGeneratedManifestCatalogReferences, selectTemplateDependencyCatalogEntries, } from "#template-core/dependency-catalog";
 import { planDevelopmentContainerToolLayersSync, } from "#template-core/development-container-tool-layer";
 import { editorCustomizationForCapabilities, loadEditorCustomizationDeclarations, } from "#template-core/editor-customization";
 import { checkEnvironmentNeedFact, checkEnvironmentNeedFromFact, deploymentEnvironmentNeedFact, deploymentEnvironmentNeedFromFact, renderDeploymentCheckCommand, renderFixCommand, renderRootCheckCommand, } from "#template-core/module-graph";
 import { assertPackageContribution, } from "#template-core/package-contribution";
 import { assertProjectBlueprintV2, validateProjectBlueprintV2 as validateCoreProjectBlueprintV2, } from "#template-core/project-blueprint-v2";
-import { projectCheckWorkflowTemplateReplacements, projectDependabotTemplateReplacements, } from "#template-core/project-github";
+import { projectCheckWorkflowTemplateSource, projectCheckWorkflowTemplateReplacements, projectDependabotTemplateReplacements, } from "#template-core/project-github";
 import { planExplicitProjectLinks } from "#template-core/project-linking-v2";
 import { resolveTemplateSource, } from "#template-core/renderer";
 import { rustBinDefinition } from "./rust-bin/definition.js";
@@ -720,12 +721,22 @@ function foundationPlan(options) {
             scripts !== null &&
             typeof scripts.deployment === "string");
     });
-    const packagePaths = contributions.map((contribution) => contribution.definition.path);
-    if (new Set(packagePaths).size !== packagePaths.length)
+    const contributionPackagePaths = contributions.map((contribution) => contribution.definition.path);
+    if (new Set(contributionPackagePaths).size !== contributionPackagePaths.length)
         throw new Error("Package Contributions must have unique Package Paths");
+    const blueprintPackagePaths = options.blueprint.packages.map((definition) => definition.path);
+    if (contributionPackagePaths.length !== blueprintPackagePaths.length ||
+        contributionPackagePaths.some((packagePath) => !blueprintPackagePaths.includes(packagePath))) {
+        throw new Error("Package Contributions must exactly match Project Blueprint Package Paths");
+    }
     const packageNames = contributions.map((contribution) => contribution.definition.name);
     if (new Set(packageNames).size !== packageNames.length)
         throw new Error("Package Contributions must have unique package names");
+    const ciDiagnosticArtifactDeclarations = contributions.flatMap((contribution) => contribution.ciDiagnosticArtifacts ?? []);
+    const ciDiagnosticArtifacts = composeCiDiagnosticArtifacts({
+        packagePaths: blueprintPackagePaths,
+        declarations: ciDiagnosticArtifactDeclarations,
+    });
     assertCompatibleRustToolchainFacts(contributions);
     const contributedToolLayers = contributions.flatMap((contribution) => contribution.foundation.developmentContainerToolLayers ?? []);
     const developmentContainer = contributedDevcontainerComposition({
@@ -810,16 +821,29 @@ function foundationPlan(options) {
                 ].join("\n"),
         },
     };
-    const workflowOperation = {
-        kind: "writeTextTemplate",
-        source: templateSources.foundation,
-        from: ".github/workflows/check.dynamic.template",
-        to: ".github/workflows/check.yml",
-        replacements: projectCheckWorkflowTemplateReplacements({
-            deploymentEnvironmentNeeds,
-            hasDeploymentTask,
-        }),
-    };
+    const workflowTemplateSource = projectCheckWorkflowTemplateSource({
+        packagePaths: blueprintPackagePaths,
+        deploymentEnvironmentNeeds,
+        hasDeploymentTask,
+        diagnosticArtifacts: ciDiagnosticArtifacts,
+    });
+    const workflowOperation = ciDiagnosticArtifacts.length === 0
+        ? {
+            kind: "copyFile",
+            source: templateSources.foundation,
+            from: workflowTemplateSource,
+            to: ".github/workflows/check.yml",
+        }
+        : {
+            kind: "writeTextTemplate",
+            source: templateSources.foundation,
+            from: workflowTemplateSource,
+            to: ".github/workflows/check.yml",
+            replacements: projectCheckWorkflowTemplateReplacements({
+                packagePaths: blueprintPackagePaths,
+                diagnosticArtifacts: ciDiagnosticArtifacts,
+            }),
+        };
     const workflowOperations = [
         workflowOperation,
         {
@@ -1021,6 +1045,7 @@ function foundationPlan(options) {
         },
         environmentNeeds,
         deploymentEnvironmentNeeds,
+        ciDiagnosticArtifacts,
         manifests: [...contributions.map((item) => item.manifest), rootManifest],
         dependencyCatalog,
         dependencyMaintenancePolicy,

package/node_modules/@ykdz/template-builtin-presets/dist/src/vike-app/definition.js

@@ -315,6 +315,7 @@ function webContribution(context) {
             playwrightBrowserAssetsEnvironmentNeed({ browser: "chromium", owner }),
             shellCheckEnvironmentNeed(owner),
         ],
+        ciDiagnosticArtifacts: [{ kind: "playwright", owner }],
         deploymentEnvironmentNeeds: [dockerEngineEnvironmentNeed()],
         foundation: {
             ...foundation(),

package/node_modules/@ykdz/template-builtin-presets/dist/src/vue-app/definition.js

@@ -44,6 +44,12 @@ function appContribution(options) {
         }),
         operations,
         environmentNeeds: vueApplicationEnvironmentNeeds(definition.path),
+        ciDiagnosticArtifacts: [
+            {
+                kind: "playwright",
+                owner: { kind: "package-boundary", path: definition.path },
+            },
+        ],
         foundation: {
             toolchains: {},
             editorCapabilities: ["oxc-format-lint", "vue", "tailwind", "vitest"],

package/node_modules/@ykdz/template-builtin-presets/dist/src/vue-hono-app/definition.js

@@ -140,6 +140,12 @@ function webContribution(context) {
         }),
         operations,
         environmentNeeds: vueApplicationEnvironmentNeeds(definition.path),
+        ciDiagnosticArtifacts: [
+            {
+                kind: "playwright",
+                owner: { kind: "package-boundary", path: definition.path },
+            },
+        ],
         foundation: {
             ...packageFoundation(),
             developmentContainerToolLayers: vueApplicationDevelopmentContainerToolLayers(),

package/node_modules/@ykdz/template-builtin-presets/templates/foundation/.github/workflows/check-deployment-diagnostics.yml

@@ -0,0 +1,81 @@
+name: Check
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  check:
+    name: ${{ matrix.job_name }}
+    runs-on: ubuntu-latest
+    timeout-minutes: ${{ matrix.timeout_minutes }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - capability: root
+            job_name: Root Check
+            task_entrypoint: pnpm run check
+            timeout_minutes: 30
+            requires_docker: false
+          - capability: deployment
+            job_name: Deployment Check
+            task_entrypoint: pnpm run check:deployment
+            timeout_minutes: 45
+            requires_docker: true
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+        with:
+          persist-credentials: false
+          fetch-depth: 1
+      - name: Set up Node.js
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
+        with:
+          node-version-file: package.json
+      - name: Set up pnpm
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0
+        with:
+          cache: true
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+        if: matrix.requires_docker
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+      - name: Run selected Check
+        run: ${{ matrix.task_entrypoint }}
+      - name: Stage Root Check diagnostics
+        if: failure() && matrix.capability == 'root'
+        env:
+          DIAGNOSTIC_OWNER_PATHS: |-
+            {{DIAGNOSTIC_OWNER_PATHS}}
+        run: |
+          rm -rf .template-ci-diagnostics
+          mkdir -p .template-ci-diagnostics
+          printf '%s\n' "$DIAGNOSTIC_OWNER_PATHS" | while IFS= read -r owner_path; do
+            for diagnostic_directory in test-results playwright-report; do
+              source_path="$owner_path/$diagnostic_directory"
+              destination_path=".template-ci-diagnostics/$owner_path/$diagnostic_directory"
+              if [ -d "$source_path" ]; then
+                mkdir -p "$(dirname "$destination_path")"
+                cp -R "$source_path" "$destination_path"
+              fi
+            done
+          done
+      - name: Upload Root Check diagnostics
+        if: failure() && matrix.capability == 'root'
+        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4
+        with:
+          name: root-check-diagnostics
+          path: .template-ci-diagnostics
+          if-no-files-found: ignore
+          retention-days: 7

package/node_modules/@ykdz/template-builtin-presets/templates/foundation/.github/workflows/check-deployment.yml

@@ -0,0 +1,55 @@
+name: Check
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  check:
+    name: ${{ matrix.job_name }}
+    runs-on: ubuntu-latest
+    timeout-minutes: ${{ matrix.timeout_minutes }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - capability: root
+            job_name: Root Check
+            task_entrypoint: pnpm run check
+            timeout_minutes: 30
+            requires_docker: false
+          - capability: deployment
+            job_name: Deployment Check
+            task_entrypoint: pnpm run check:deployment
+            timeout_minutes: 45
+            requires_docker: true
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+        with:
+          persist-credentials: false
+          fetch-depth: 1
+      - name: Set up Node.js
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
+        with:
+          node-version-file: package.json
+      - name: Set up pnpm
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0
+        with:
+          cache: true
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+        if: matrix.requires_docker
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+      - name: Run selected Check
+        run: ${{ matrix.task_entrypoint }}

package/node_modules/@ykdz/template-builtin-presets/templates/foundation/.github/workflows/check-diagnostics.yml

@@ -0,0 +1,64 @@
+name: Check
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  check:
+    name: Root Check
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+        with:
+          persist-credentials: false
+          fetch-depth: 1
+      - name: Set up Node.js
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
+        with:
+          node-version-file: package.json
+      - name: Set up pnpm
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0
+        with:
+          cache: true
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+      - name: Run Root Check
+        run: pnpm run check
+      - name: Stage Root Check diagnostics
+        if: failure()
+        env:
+          DIAGNOSTIC_OWNER_PATHS: |-
+            {{DIAGNOSTIC_OWNER_PATHS}}
+        run: |
+          rm -rf .template-ci-diagnostics
+          mkdir -p .template-ci-diagnostics
+          printf '%s\n' "$DIAGNOSTIC_OWNER_PATHS" | while IFS= read -r owner_path; do
+            for diagnostic_directory in test-results playwright-report; do
+              source_path="$owner_path/$diagnostic_directory"
+              destination_path=".template-ci-diagnostics/$owner_path/$diagnostic_directory"
+              if [ -d "$source_path" ]; then
+                mkdir -p "$(dirname "$destination_path")"
+                cp -R "$source_path" "$destination_path"
+              fi
+            done
+          done
+      - name: Upload Root Check diagnostics
+        if: failure()
+        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4
+        with:
+          name: root-check-diagnostics
+          path: .template-ci-diagnostics
+          if-no-files-found: ignore
+          retention-days: 7

package/node_modules/@ykdz/template-builtin-presets/templates/foundation/.github/workflows/check.yml

@@ -6,14 +6,33 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   check:
+    name: Root Check
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v7
+      - name: Checkout source
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+        with:
+          persist-credentials: false
+          fetch-depth: 1
+      - name: Set up Node.js
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
           node-version-file: package.json
-      - run: corepack enable
-      - run: pnpm install
-      - run: pnpm run check
+      - name: Set up pnpm
+        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0
+        with:
+          cache: true
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+      - name: Run Root Check
+        run: pnpm run check

package/node_modules/@ykdz/template-builtin-presets/templates/vike-app/web/playwright.config.ts

@@ -60,6 +60,7 @@ export default defineConfig({
     baseURL: previewUrl,
     trace: "retain-on-failure",
   },
+  reporter: [["list"], ["html"]],
   ...(externalServiceUrl
     ? {}
     : {

package/node_modules/@ykdz/template-builtin-presets/templates/vue-app/playwright.config.ts

@@ -17,8 +17,9 @@ export default defineConfig({
   testDir: "./test/e2e",
   use: {
     baseURL: previewUrl,
-    trace: "on-first-retry",
+    trace: "retain-on-failure",
   },
+  reporter: [["list"], ["html"]],
   webServer: {
     command: `pnpm run preview --host 127.0.0.1 --port ${previewPort}`,
     reuseExistingServer: !process.env.CI,

package/node_modules/@ykdz/template-builtin-presets/templates/vue-hono-app/web/playwright.config.ts

@@ -20,8 +20,10 @@ export default defineConfig({
   testDir: "./test/e2e",
   use: {
     baseURL: webBaseUrl,
+    trace: "retain-on-failure",
     ...devices["Desktop Chrome"],
   },
+  reporter: [["list"], ["html"]],
   webServer: [
     {
       command: `PORT=${apiPort} pnpm --dir ../api run start`,

package/node_modules/@ykdz/template-core/dist/ci-diagnostic-artifact.d.ts

@@ -0,0 +1,19 @@
+import type { PackageBoundaryOwner } from "./module-graph.ts";
+/** Closed, owner-scoped native evidence a Package Contribution may retain in CI. */
+export type CiDiagnosticArtifactDeclaration = {
+    readonly kind: "playwright";
+    readonly owner: PackageBoundaryOwner;
+};
+/**
+ * Validates the intentionally closed diagnostic declaration surface.  It does
+ * not accept paths: native paths are derived only after the owner is known.
+ */
+export declare function assertCiDiagnosticArtifactDeclaration(value: unknown): CiDiagnosticArtifactDeclaration;
+/**
+ * Composes closed native diagnostics independently of presets and environment
+ * preparation. Equivalent declarations collapse into stable owner order.
+ */
+export declare function composeCiDiagnosticArtifacts(options: {
+    readonly packagePaths: readonly string[];
+    readonly declarations: readonly unknown[];
+}): readonly CiDiagnosticArtifactDeclaration[];

package/node_modules/@ykdz/template-core/dist/ci-diagnostic-artifact.js

@@ -0,0 +1,68 @@
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function hasExactKeys(value, keys) {
+    const actual = Object.keys(value).toSorted();
+    const expected = [...keys].toSorted();
+    return (actual.length === expected.length &&
+        actual.every((key, index) => key === expected[index]));
+}
+const reservedWorkspaceCollections = new Set([
+    ".git",
+    ".github",
+    ".devcontainer",
+    ".template",
+    "node_modules",
+    "dist",
+    "target",
+]);
+function isSafePackagePath(value) {
+    return (/^[a-z0-9][a-z0-9-]*\/[a-z0-9][a-z0-9-]*$/u.test(value) &&
+        !reservedWorkspaceCollections.has(value.split("/", 1)[0]));
+}
+/**
+ * Validates the intentionally closed diagnostic declaration surface.  It does
+ * not accept paths: native paths are derived only after the owner is known.
+ */
+export function assertCiDiagnosticArtifactDeclaration(value) {
+    if (!isRecord(value) || !hasExactKeys(value, ["kind", "owner"])) {
+        throw new Error("CI Diagnostic Artifact declarations may contain only kind and owner");
+    }
+    if (value.kind !== "playwright") {
+        throw new Error("Unsupported CI Diagnostic Artifact kind");
+    }
+    if (!isRecord(value.owner) || !hasExactKeys(value.owner, ["kind", "path"])) {
+        throw new Error("CI Diagnostic Artifact requires a Package Boundary owner");
+    }
+    if (value.owner.kind !== "package-boundary" ||
+        typeof value.owner.path !== "string" ||
+        !isSafePackagePath(value.owner.path)) {
+        throw new Error("CI Diagnostic Artifact owner has an unsafe Package Boundary path");
+    }
+    return {
+        kind: "playwright",
+        owner: { kind: "package-boundary", path: value.owner.path },
+    };
+}
+/**
+ * Composes closed native diagnostics independently of presets and environment
+ * preparation. Equivalent declarations collapse into stable owner order.
+ */
+export function composeCiDiagnosticArtifacts(options) {
+    for (const packagePath of options.packagePaths) {
+        if (!isSafePackagePath(packagePath)) {
+            throw new Error(`CI Diagnostic Artifact Package Boundary path is unsafe: ${packagePath}`);
+        }
+    }
+    const owners = new Set(options.packagePaths);
+    const artifacts = new Map();
+    for (const value of options.declarations) {
+        const declaration = assertCiDiagnosticArtifactDeclaration(value);
+        if (!owners.has(declaration.owner.path)) {
+            throw new Error(`CI Diagnostic Artifact owner is not a declared Package Boundary: ${declaration.owner.path}`);
+        }
+        const key = `${declaration.kind}:${declaration.owner.path}`;
+        artifacts.set(key, declaration);
+    }
+    return [...artifacts.values()].toSorted((left, right) => left.owner.path.localeCompare(right.owner.path));
+}

package/node_modules/@ykdz/template-core/dist/package-contribution.d.ts

@@ -1,3 +1,4 @@
+import { type CiDiagnosticArtifactDeclaration } from "./ci-diagnostic-artifact.ts";
 import type { DevelopmentContainerToolLayer } from "./development-container-tool-layer.ts";
 import type { EditorCustomizationCapability } from "./editor-customization.ts";
 import type { CheckEnvironmentNeed, DeploymentEnvironmentNeed } from "./module-graph.ts";
@@ -43,6 +44,8 @@ export type PackageContribution = {
     /** Typed requirements consumed by the Foundation for coordinated root outputs. */
     readonly foundation: FoundationContribution;
     readonly environmentNeeds: readonly CheckEnvironmentNeed[];
+    /** Closed native CI evidence owned by this Package Boundary. */
+    readonly ciDiagnosticArtifacts?: readonly CiDiagnosticArtifactDeclaration[];
     /** Requirements prepared only by a focused deployment entrypoint. */
     readonly deploymentEnvironmentNeeds?: readonly DeploymentEnvironmentNeed[];
 };

package/node_modules/@ykdz/template-core/dist/package-contribution.js

@@ -1,3 +1,4 @@
+import { assertCiDiagnosticArtifactDeclaration, } from "./ci-diagnostic-artifact.js";
 const operationPath = (operation) => {
     if ("to" in operation)
         return operation.to;
@@ -20,5 +21,11 @@ export function assertPackageContribution(contribution, provenance = {}) {
             : `${provenance.definitionName}: ${provenance.planner ?? "Package Contribution"} `;
         throw new Error(`${owner}${rule}; ${contribution.definition.path} attempted ${target}`);
     }
+    for (const artifact of contribution.ciDiagnosticArtifacts ?? []) {
+        const declaration = assertCiDiagnosticArtifactDeclaration(artifact);
+        if (declaration.owner.path !== contribution.definition.path) {
+            throw new Error(`CI Diagnostic Artifact owner must match its Package Contribution: ${contribution.definition.path}`);
+        }
+    }
     return contribution;
 }

package/node_modules/@ykdz/template-core/dist/project-github.d.ts

@@ -1,16 +1,52 @@
+import { type CiDiagnosticArtifactDeclaration } from "./ci-diagnostic-artifact.ts";
 import type { DeploymentEnvironmentNeed } from "./module-graph.ts";
 export type CiCapability = {
     readonly workflowName: "Check";
     readonly jobName: "check";
+    readonly jobDisplayName: "Root Check";
     readonly runner: "ubuntu-latest";
+    readonly timeoutMinutes: 30;
 };
 export type CiEnvironmentPreparation = {
     readonly nodeFromPackageMetadata: boolean;
+    readonly packageManagerFromPackageMetadata: boolean;
+    readonly pnpmStoreCache: boolean;
 };
 export type PnpmTaskLayer = {
-    readonly installCommand: "pnpm install";
+    readonly installCommand: "pnpm install --frozen-lockfile";
     readonly checkCommand: "pnpm run check";
 };
+export type CiCheckMatrixEntry = {
+    readonly capability: "root" | "deployment";
+    readonly jobDisplayName: "Root Check" | "Deployment Check";
+    readonly taskEntrypoint: "pnpm run check" | "pnpm run check:deployment";
+    readonly timeoutMinutes: 30 | 45;
+    readonly requiresDocker: boolean;
+};
+export type ProjectCheckWorkflowPlan = {
+    readonly workflowName: "Check";
+    readonly triggers: {
+        readonly pullRequest: true;
+        readonly pushBranches: readonly ["main"];
+    };
+    readonly permissions: {
+        readonly contents: "read";
+    };
+    readonly concurrency: {
+        readonly group: "${{ github.workflow }}-${{ github.ref }}";
+        readonly cancelInProgress: true;
+    };
+    readonly rootCheck: CiCapability;
+    readonly matrix: {
+        readonly failFast: false;
+        readonly include: readonly CiCheckMatrixEntry[];
+    } | undefined;
+    readonly environmentPreparation: CiEnvironmentPreparation;
+    readonly taskLayer: PnpmTaskLayer;
+    /** Actual Package Boundaries allowed to own retained native diagnostics. */
+    readonly packagePaths: readonly string[];
+    readonly diagnosticArtifacts: readonly CiDiagnosticArtifactDeclaration[];
+};
 export type DependencyEcosystem = "npm" | "cargo" | "github-actions" | "docker" | "rust-toolchain";
 export type DependabotDirectory = `/${string}`;
 export type DependencyMaintenancePolicy = {
@@ -19,19 +55,27 @@ export type DependencyMaintenancePolicy = {
     readonly extraDirectories?: Partial<Record<DependencyEcosystem, readonly DependabotDirectory[]>>;
     readonly interval: "weekly";
 };
-type ProjectCheckWorkflowOptions = {
+export type ProjectCheckWorkflowDiagnosticOptions = {
+    /** Package Paths from the real Project Blueprint or Package Contributions. */
+    readonly packagePaths: readonly string[];
+    readonly diagnosticArtifacts?: readonly unknown[] | undefined;
+};
+type ProjectCheckWorkflowOptions = ProjectCheckWorkflowDiagnosticOptions & {
     readonly deploymentEnvironmentNeeds?: readonly DeploymentEnvironmentNeed[];
     readonly hasDeploymentTask?: boolean | undefined;
     readonly capability?: CiCapability | undefined;
     readonly environmentPreparation?: Partial<CiEnvironmentPreparation> | undefined;
     readonly taskLayer?: PnpmTaskLayer | undefined;
 };
-export declare function projectCheckWorkflow(options: ProjectCheckWorkflowOptions): string;
-/** Limited substitutions for the Foundation-owned workflow Template Source. */
-export declare function projectCheckWorkflowTemplateReplacements(options: {
+/** Capability facts for the Foundation-owned GitHub Actions Template Source. */
+export declare function projectCheckWorkflowPlan(options: ProjectCheckWorkflowOptions): ProjectCheckWorkflowPlan;
+/** Selects a complete Foundation-owned workflow Template Source. */
+export declare function projectCheckWorkflowTemplateSource(options: ProjectCheckWorkflowDiagnosticOptions & {
     readonly deploymentEnvironmentNeeds?: readonly DeploymentEnvironmentNeed[];
     readonly hasDeploymentTask?: boolean | undefined;
-}): Record<string, string>;
+}): ".github/workflows/check.yml" | ".github/workflows/check-diagnostics.yml" | ".github/workflows/check-deployment.yml" | ".github/workflows/check-deployment-diagnostics.yml";
+/** Limited, validated facts for static Foundation diagnostic staging. */
+export declare function projectCheckWorkflowTemplateReplacements(options: ProjectCheckWorkflowDiagnosticOptions): Record<string, string>;
 export declare function projectDependabotConfig(policy: DependencyMaintenancePolicy): string;
 /** Limited substitution for the Foundation-owned Dependabot Template Source. */
 export declare function projectDependabotTemplateReplacements(policy: DependencyMaintenancePolicy): Record<string, string>;

package/node_modules/@ykdz/template-core/dist/project-github.js

@@ -1,73 +1,109 @@
+import { composeCiDiagnosticArtifacts, } from "./ci-diagnostic-artifact.js";
+function validatedDiagnosticArtifacts(options) {
+    return composeCiDiagnosticArtifacts({
+        packagePaths: options.packagePaths,
+        declarations: options.artifacts,
+    });
+}
 const defaultCiCapability = {
     workflowName: "Check",
     jobName: "check",
+    jobDisplayName: "Root Check",
     runner: "ubuntu-latest",
+    timeoutMinutes: 30,
 };
 const pnpmTaskLayer = {
-    installCommand: "pnpm install",
+    installCommand: "pnpm install --frozen-lockfile",
     checkCommand: "pnpm run check",
 };
-export function projectCheckWorkflow(options) {
+/** Capability facts for the Foundation-owned GitHub Actions Template Source. */
+export function projectCheckWorkflowPlan(options) {
     const capability = options.capability ?? defaultCiCapability;
     const environmentPreparation = {
         nodeFromPackageMetadata: true,
+        packageManagerFromPackageMetadata: true,
+        pnpmStoreCache: true,
         ...options.environmentPreparation,
     };
     const taskLayer = options.taskLayer ?? pnpmTaskLayer;
     const hasDeploymentTask = options.hasDeploymentTask === true;
     const needsDocker = (options.deploymentEnvironmentNeeds ?? []).some((need) => need.kind === "docker-engine");
-    const lines = [
-        `name: ${capability.workflowName}`,
-        "",
-        "on:",
-        "  pull_request:",
-        "  push:",
-        "    branches:",
-        "      - main",
-        "",
-        "jobs:",
-        `  ${capability.jobName}:`,
-        `    runs-on: ${capability.runner}`,
-        ...(hasDeploymentTask
-            ? ["    strategy:", "      matrix:", "        check: [root, deployment]"]
-            : []),
-        "    steps:",
-        "      - uses: actions/checkout@v7",
-    ];
-    if (environmentPreparation.nodeFromPackageMetadata) {
-        lines.push("      - uses: actions/setup-node@v7", "        with:", "          node-version-file: package.json", "      - run: corepack enable");
-    }
-    if (hasDeploymentTask && needsDocker) {
-        lines.push("      - uses: docker/setup-buildx-action@v3", "        if: matrix.check == 'deployment'");
+    if (hasDeploymentTask && !needsDocker) {
+        throw new Error("Deployment Check requires a Docker environment need");
     }
-    lines.push(`      - run: ${taskLayer.installCommand}`);
-    lines.push(`      - run: ${taskLayer.checkCommand}`);
-    if (hasDeploymentTask) {
-        lines.push("        if: matrix.check == 'root'");
+    const packagePaths = [...options.packagePaths];
+    const diagnosticArtifacts = validatedDiagnosticArtifacts({
+        packagePaths,
+        artifacts: options.diagnosticArtifacts ?? [],
+    });
+    return {
+        workflowName: capability.workflowName,
+        triggers: { pullRequest: true, pushBranches: ["main"] },
+        permissions: { contents: "read" },
+        concurrency: {
+            group: "${{ github.workflow }}-${{ github.ref }}",
+            cancelInProgress: true,
+        },
+        rootCheck: capability,
+        matrix: hasDeploymentTask
+            ? {
+                failFast: false,
+                include: [
+                    {
+                        capability: "root",
+                        jobDisplayName: capability.jobDisplayName,
+                        taskEntrypoint: taskLayer.checkCommand,
+                        timeoutMinutes: capability.timeoutMinutes,
+                        requiresDocker: false,
+                    },
+                    {
+                        capability: "deployment",
+                        jobDisplayName: "Deployment Check",
+                        taskEntrypoint: "pnpm run check:deployment",
+                        timeoutMinutes: 45,
+                        requiresDocker: true,
+                    },
+                ],
+            }
+            : undefined,
+        environmentPreparation,
+        taskLayer,
+        packagePaths,
+        diagnosticArtifacts,
+    };
+}
+/** Selects a complete Foundation-owned workflow Template Source. */
+export function projectCheckWorkflowTemplateSource(options) {
+    const hasDeploymentTask = options.hasDeploymentTask === true;
+    const needsDocker = (options.deploymentEnvironmentNeeds ?? []).some((need) => need.kind === "docker-engine");
+    if (hasDeploymentTask && !needsDocker) {
+        throw new Error("Deployment Check requires a Docker environment need");
     }
+    const hasDiagnostics = validatedDiagnosticArtifacts({
+        packagePaths: options.packagePaths,
+        artifacts: options.diagnosticArtifacts ?? [],
+    }).length > 0;
     if (hasDeploymentTask) {
-        lines.push("      - run: pnpm run check:deployment", "        if: matrix.check == 'deployment'");
+        return hasDiagnostics
+            ? ".github/workflows/check-deployment-diagnostics.yml"
+            : ".github/workflows/check-deployment.yml";
     }
-    lines.push("");
-    return lines.join("\n");
+    return hasDiagnostics
+        ? ".github/workflows/check-diagnostics.yml"
+        : ".github/workflows/check.yml";
 }
-/** Limited substitutions for the Foundation-owned workflow Template Source. */
+/** Limited, validated facts for static Foundation diagnostic staging. */
 export function projectCheckWorkflowTemplateReplacements(options) {
-    const hasDeploymentTask = options.hasDeploymentTask === true;
-    const needsDocker = (options.deploymentEnvironmentNeeds ?? []).some((need) => need.kind === "docker-engine");
+    const declarations = validatedDiagnosticArtifacts({
+        packagePaths: options.packagePaths,
+        artifacts: options.diagnosticArtifacts ?? [],
+    });
+    if (declarations.length === 0)
+        return {};
     return {
-        DEPLOYMENT_MATRIX: hasDeploymentTask
-            ? "\n    strategy:\n      matrix:\n        check: [root, deployment]"
-            : "",
-        DEPLOYMENT_DOCKER_PREPARATION: hasDeploymentTask && needsDocker
-            ? "\n      - uses: docker/setup-buildx-action@v3\n        if: matrix.check == 'deployment'"
-            : "",
-        ROOT_CHECK_CONDITION: hasDeploymentTask
-            ? "\n        if: matrix.check == 'root'"
-            : "",
-        DEPLOYMENT_CHECK: hasDeploymentTask
-            ? "\n      - run: pnpm run check:deployment\n        if: matrix.check == 'deployment'"
-            : "",
+        DIAGNOSTIC_OWNER_PATHS: declarations
+            .map((declaration) => declaration.owner.path)
+            .join("\n            "),
     };
 }
 export function projectDependabotConfig(policy) {

package/node_modules/@ykdz/template-core/dist/template-boundary-check.d.ts

@@ -1,3 +1,4 @@
+import type { ProjectBlueprintV2 } from "./project-blueprint-v2.ts";
 import { type RenderOperation } from "./renderer.ts";
 export type TemplateBoundaryViolation = {
     readonly preset: string;
@@ -34,6 +35,19 @@ export type CheckTemplateSourceBoundaryOptions = {
     readonly projections: readonly TemplateBoundaryCheckProjection[];
     readonly templateSourceContexts?: readonly TemplateSourceContext[];
     readonly manifestReferencedSourceFiles?: readonly string[];
+    /** Complete Built-in plans whose Foundation workflow is a protected output. */
+    readonly protectedWorkflowPlans?: readonly {
+        readonly name: string;
+        readonly sourceFilePath: string;
+        readonly definitionName?: string;
+        readonly planningContribution?: string;
+        readonly generatedPath: ".github/workflows/check.yml";
+        /** The original Blueprint, before Foundation composes workflow facts. */
+        readonly blueprint: ProjectBlueprintV2;
+        /** Raw Package Contribution declarations, not the composed plan field. */
+        readonly diagnosticArtifactDeclarations: readonly unknown[];
+        readonly operations: readonly RenderOperation[];
+    }[];
 };
 /**
  * Reads each registered Template Source context before any plan is inspected.
@@ -41,4 +55,4 @@ export type CheckTemplateSourceBoundaryOptions = {
  */
 export declare function checkTemplateSourceContexts(contexts: readonly Omit<TemplateSourceContext, "checkedFiles">[]): Promise<readonly TemplateSourceContext[]>;
 export declare function isProtectedGeneratedPath(generatedPath: string): boolean;
-export declare function checkTemplateSourceBoundary({ projections, templateSourceContexts, manifestReferencedSourceFiles, }: CheckTemplateSourceBoundaryOptions): Promise<TemplateBoundaryCheckResult>;
+export declare function checkTemplateSourceBoundary({ projections, templateSourceContexts, manifestReferencedSourceFiles, protectedWorkflowPlans, }: CheckTemplateSourceBoundaryOptions): Promise<TemplateBoundaryCheckResult>;

package/node_modules/@ykdz/template-core/dist/template-boundary-check.js

@@ -589,9 +589,170 @@ function pushSourceBackedOperationViolations(options) {
         });
     }
 }
-export async function checkTemplateSourceBoundary({ projections, templateSourceContexts = [], manifestReferencedSourceFiles = [], }) {
+const workflowTemplateVariants = new Map([
+    [
+        ".github/workflows/check.yml",
+        { operationKind: "copyFile", replacementKeys: [] },
+    ],
+    [
+        ".github/workflows/check-deployment.yml",
+        { operationKind: "copyFile", replacementKeys: [] },
+    ],
+    [
+        ".github/workflows/check-diagnostics.yml",
+        {
+            operationKind: "writeTextTemplate",
+            replacementKeys: ["DIAGNOSTIC_OWNER_PATHS"],
+        },
+    ],
+    [
+        ".github/workflows/check-deployment-diagnostics.yml",
+        {
+            operationKind: "writeTextTemplate",
+            replacementKeys: ["DIAGNOSTIC_OWNER_PATHS"],
+        },
+    ],
+]);
+function hasExactReplacementKeys(replacements, expectedKeys) {
+    const keys = Object.keys(replacements).toSorted();
+    const expected = [...expectedKeys].toSorted();
+    return (keys.length === expected.length &&
+        keys.every((key, index) => key === expected[index]));
+}
+const reservedWorkspaceCollections = new Set([
+    ".git",
+    ".github",
+    ".devcontainer",
+    ".template",
+    "node_modules",
+    "dist",
+    "target",
+]);
+function isSafePackageBoundaryPath(value) {
+    return (/^[a-z0-9][a-z0-9-]*\/[a-z0-9][a-z0-9-]*$/u.test(value) &&
+        !reservedWorkspaceCollections.has(value.split("/", 1)[0]));
+}
+/**
+ * Independent oracle for the Foundation workflow's limited substitution.
+ * It deliberately consumes raw Blueprint and Package Contribution facts rather
+ * than the production CI artifact composer or its composed plan output.
+ */
+function expectedDiagnosticOwnerPaths(options) {
+    const blueprintPackagePaths = options.blueprint.packages.map((packageDefinition) => packageDefinition.path);
+    if (!blueprintPackagePaths.every(isSafePackageBoundaryPath)) {
+        return { valid: false, value: "" };
+    }
+    const blueprintOwners = new Set(blueprintPackagePaths);
+    const owners = new Set();
+    for (const declaration of options.diagnosticArtifactDeclarations) {
+        if (!isRecord(declaration) ||
+            !hasExactKeys(declaration, ["kind", "owner"])) {
+            return { valid: false, value: "" };
+        }
+        if (declaration.kind !== "playwright" || !isRecord(declaration.owner)) {
+            return { valid: false, value: "" };
+        }
+        if (!hasExactKeys(declaration.owner, ["kind", "path"])) {
+            return { valid: false, value: "" };
+        }
+        const ownerPath = declaration.owner.path;
+        if (declaration.owner.kind !== "package-boundary" ||
+            typeof ownerPath !== "string" ||
+            !isSafePackageBoundaryPath(ownerPath) ||
+            !blueprintOwners.has(ownerPath)) {
+            return { valid: false, value: "" };
+        }
+        owners.add(ownerPath);
+    }
+    return {
+        valid: true,
+        value: [...owners].toSorted().join("\n            "),
+    };
+}
+function sourceFileForWorkflowOperation(options) {
+    return options.operation?.provenance?.plannerSourceFile ?? options.fallback;
+}
+function findWorkflowOperationOwners(sourceFile, operation) {
+    if (operation === undefined)
+        return ["<unknown>"];
+    const targetPath = operationTarget(operation);
+    if (targetPath === undefined)
+        return ["<unknown>"];
+    const expectedTargetPath = targetPath;
+    const operationKind = operation.kind;
+    const owners = new Set();
+    function visit(node) {
+        if (ts.isObjectLiteralExpression(node)) {
+            if (propertyStringValue(node, "kind") === operationKind &&
+                propertyPathMatches(node, "to", expectedTargetPath)) {
+                owners.add(owningFunctionName(node));
+            }
+        }
+        ts.forEachChild(node, visit);
+    }
+    visit(sourceFile);
+    return owners.size === 0 ? ["<unknown>"] : [...owners];
+}
+async function protectedWorkflowProjectionViolations(plans) {
+    const violations = [];
+    for (const plan of plans) {
+        const matchingOperations = plan.operations.filter((operation) => operationTarget(operation) === plan.generatedPath);
+        const operation = matchingOperations[0];
+        const sourceFilePath = sourceFileForWorkflowOperation({
+            operation,
+            fallback: plan.sourceFilePath,
+        });
+        const sourceText = await readFile(sourceFilePath, "utf8");
+        const sourceFile = ts.createSourceFile(sourceFilePath, sourceText, ts.ScriptTarget.Latest, true, ts.ScriptKind.TS);
+        const expectedDiagnosticOwners = expectedDiagnosticOwnerPaths(plan);
+        const variant = operation !== undefined &&
+            (operation.kind === "copyFile" || operation.kind === "writeTextTemplate")
+            ? workflowTemplateVariants.get(operation.from)
+            : undefined;
+        const replacementValid = operation?.kind === "writeTextTemplate" &&
+            hasExactReplacementKeys(operation.replacements, [
+                "DIAGNOSTIC_OWNER_PATHS",
+            ]) &&
+            operation.replacements.DIAGNOSTIC_OWNER_PATHS ===
+                expectedDiagnosticOwners.value;
+        const sourceBackedExactlyOnce = matchingOperations.length === 1 &&
+            operation !== undefined &&
+            (operation.kind === "copyFile" || operation.kind === "writeTextTemplate");
+        const diagnosticsExpected = expectedDiagnosticOwners.value !== "";
+        const operationValid = expectedDiagnosticOwners.valid &&
+            sourceBackedExactlyOnce &&
+            variant !== undefined &&
+            operation?.kind === variant.operationKind &&
+            (operation.kind === "copyFile"
+                ? variant.replacementKeys.length === 0 && !diagnosticsExpected
+                : variant.replacementKeys.length === 1 &&
+                    diagnosticsExpected &&
+                    replacementValid);
+        if (operationValid)
+            continue;
+        for (const owningFunction of findWorkflowOperationOwners(sourceFile, operation)) {
+            violations.push({
+                preset: plan.name,
+                generatedPath: plan.generatedPath,
+                owningFunction,
+                operationKind: operation?.kind ?? "writeTextTemplate",
+                sourceFilePath,
+                ...(plan.definitionName === undefined
+                    ? {}
+                    : { definitionName: plan.definitionName }),
+                ...(plan.planningContribution === undefined
+                    ? {}
+                    : { planningContribution: plan.planningContribution }),
+                ownershipRule: "Foundation workflow projections require exactly one source-backed template operation with closed diagnostic owner facts",
+            });
+        }
+    }
+    return violations;
+}
+export async function checkTemplateSourceBoundary({ projections, templateSourceContexts = [], manifestReferencedSourceFiles = [], protectedWorkflowPlans = [], }) {
     const manifestReferencedSourceFileSet = new Set(manifestReferencedSourceFiles.map((sourceFile) => path.resolve(sourceFile)));
     const violations = [];
+    violations.push(...(await protectedWorkflowProjectionViolations(protectedWorkflowPlans)));
     for (const projection of projections) {
         const sourceText = await readFile(projection.sourceFilePath, "utf8");
         const sourceFile = ts.createSourceFile(projection.sourceFilePath, sourceText, ts.ScriptTarget.Latest, true, ts.ScriptKind.TS);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ykdz/template",
-  "version": "0.0.32",
+  "version": "0.0.33",
   "private": false,
   "description": "Project template generator for YKDZ starter projects.",
   "keywords": [
@@ -60,8 +60,8 @@
     "semver": "^7.8.5",
     "typescript": "npm:typescript@^6.0.3",
     "valibot": "^1.4.2",
-    "@ykdz/template-core": "0.0.0",
-    "@ykdz/template-builtin-presets": "0.0.0"
+    "@ykdz/template-builtin-presets": "0.0.0",
+    "@ykdz/template-core": "0.0.0"
   },
   "devDependencies": {
     "@types/node": "^24.13.3",

package/node_modules/@ykdz/template-builtin-presets/templates/foundation/.github/workflows/check-playwright.yml

@@ -1,20 +0,0 @@
-name: Check
-
-on:
-  pull_request:
-  push:
-    branches:
-      - main
-
-jobs:
-  check:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v7
-        with:
-          node-version-file: package.json
-      - run: corepack enable
-      - run: pnpm install
-      - run: pnpm --filter ./apps/web exec playwright install --with-deps chromium
-      - run: pnpm run check

package/node_modules/@ykdz/template-builtin-presets/templates/foundation/.github/workflows/check-rust.yml

@@ -1,23 +0,0 @@
-name: Check
-
-on:
-  pull_request:
-  push:
-    branches:
-      - main
-
-jobs:
-  check:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v7
-        with:
-          node-version-file: package.json
-      - run: corepack enable
-      - uses: dtolnay/rust-toolchain@stable
-        with:
-          components: rustfmt, clippy
-      - uses: Swatinem/rust-cache@v2
-      - run: pnpm install
-      - run: pnpm run check

package/node_modules/@ykdz/template-builtin-presets/templates/foundation/.github/workflows/check.dynamic.template

@@ -1,19 +0,0 @@
-name: Check
-
-on:
-  pull_request:
-  push:
-    branches:
-      - main
-
-jobs:
-  check:
-    runs-on: ubuntu-latest{{DEPLOYMENT_MATRIX}}
-    steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v7
-        with:
-          node-version-file: package.json
-      - run: corepack enable{{DEPLOYMENT_DOCKER_PREPARATION}}
-      - run: pnpm install
-      - run: pnpm run check{{ROOT_CHECK_CONDITION}}{{DEPLOYMENT_CHECK}}