@ykdz/template 0.0.32 → 0.0.35

package/node_modules/@ykdz/template-core/dist/project-github.js

@@ -1,73 +1,109 @@
+import { composeCiDiagnosticArtifacts, } from "./ci-diagnostic-artifact.js";
+function validatedDiagnosticArtifacts(options) {
+    return composeCiDiagnosticArtifacts({
+        packagePaths: options.packagePaths,
+        declarations: options.artifacts,
+    });
+}
 const defaultCiCapability = {
     workflowName: "Check",
     jobName: "check",
+    jobDisplayName: "Root Check",
     runner: "ubuntu-latest",
+    timeoutMinutes: 30,
 };
 const pnpmTaskLayer = {
-    installCommand: "pnpm install",
+    installCommand: "pnpm install --frozen-lockfile",
     checkCommand: "pnpm run check",
 };
-export function projectCheckWorkflow(options) {
+/** Capability facts for the Foundation-owned GitHub Actions Template Source. */
+export function projectCheckWorkflowPlan(options) {
     const capability = options.capability ?? defaultCiCapability;
     const environmentPreparation = {
         nodeFromPackageMetadata: true,
+        packageManagerFromPackageMetadata: true,
+        pnpmStoreCache: true,
         ...options.environmentPreparation,
     };
     const taskLayer = options.taskLayer ?? pnpmTaskLayer;
     const hasDeploymentTask = options.hasDeploymentTask === true;
     const needsDocker = (options.deploymentEnvironmentNeeds ?? []).some((need) => need.kind === "docker-engine");
-    const lines = [
-        `name: ${capability.workflowName}`,
-        "",
-        "on:",
-        "  pull_request:",
-        "  push:",
-        "    branches:",
-        "      - main",
-        "",
-        "jobs:",
-        `  ${capability.jobName}:`,
-        `    runs-on: ${capability.runner}`,
-        ...(hasDeploymentTask
-            ? ["    strategy:", "      matrix:", "        check: [root, deployment]"]
-            : []),
-        "    steps:",
-        "      - uses: actions/checkout@v7",
-    ];
-    if (environmentPreparation.nodeFromPackageMetadata) {
-        lines.push("      - uses: actions/setup-node@v7", "        with:", "          node-version-file: package.json", "      - run: corepack enable");
-    }
-    if (hasDeploymentTask && needsDocker) {
-        lines.push("      - uses: docker/setup-buildx-action@v3", "        if: matrix.check == 'deployment'");
+    if (hasDeploymentTask && !needsDocker) {
+        throw new Error("Deployment Check requires a Docker environment need");
     }
-    lines.push(`      - run: ${taskLayer.installCommand}`);
-    lines.push(`      - run: ${taskLayer.checkCommand}`);
-    if (hasDeploymentTask) {
-        lines.push("        if: matrix.check == 'root'");
+    const packagePaths = [...options.packagePaths];
+    const diagnosticArtifacts = validatedDiagnosticArtifacts({
+        packagePaths,
+        artifacts: options.diagnosticArtifacts ?? [],
+    });
+    return {
+        workflowName: capability.workflowName,
+        triggers: { pullRequest: true, pushBranches: ["main"] },
+        permissions: { contents: "read" },
+        concurrency: {
+            group: "${{ github.workflow }}-${{ github.ref }}",
+            cancelInProgress: true,
+        },
+        rootCheck: capability,
+        matrix: hasDeploymentTask
+            ? {
+                failFast: false,
+                include: [
+                    {
+                        capability: "root",
+                        jobDisplayName: capability.jobDisplayName,
+                        taskEntrypoint: taskLayer.checkCommand,
+                        timeoutMinutes: capability.timeoutMinutes,
+                        requiresDocker: false,
+                    },
+                    {
+                        capability: "deployment",
+                        jobDisplayName: "Deployment Check",
+                        taskEntrypoint: "pnpm run check:deployment",
+                        timeoutMinutes: 45,
+                        requiresDocker: true,
+                    },
+                ],
+            }
+            : undefined,
+        environmentPreparation,
+        taskLayer,
+        packagePaths,
+        diagnosticArtifacts,
+    };
+}
+/** Selects a complete Foundation-owned workflow Template Source. */
+export function projectCheckWorkflowTemplateSource(options) {
+    const hasDeploymentTask = options.hasDeploymentTask === true;
+    const needsDocker = (options.deploymentEnvironmentNeeds ?? []).some((need) => need.kind === "docker-engine");
+    if (hasDeploymentTask && !needsDocker) {
+        throw new Error("Deployment Check requires a Docker environment need");
     }
+    const hasDiagnostics = validatedDiagnosticArtifacts({
+        packagePaths: options.packagePaths,
+        artifacts: options.diagnosticArtifacts ?? [],
+    }).length > 0;
     if (hasDeploymentTask) {
-        lines.push("      - run: pnpm run check:deployment", "        if: matrix.check == 'deployment'");
+        return hasDiagnostics
+            ? ".github/workflows/check-deployment-diagnostics.yml"
+            : ".github/workflows/check-deployment.yml";
     }
-    lines.push("");
-    return lines.join("\n");
+    return hasDiagnostics
+        ? ".github/workflows/check-diagnostics.yml"
+        : ".github/workflows/check.yml";
 }
-/** Limited substitutions for the Foundation-owned workflow Template Source. */
+/** Limited, validated facts for static Foundation diagnostic staging. */
 export function projectCheckWorkflowTemplateReplacements(options) {
-    const hasDeploymentTask = options.hasDeploymentTask === true;
-    const needsDocker = (options.deploymentEnvironmentNeeds ?? []).some((need) => need.kind === "docker-engine");
+    const declarations = validatedDiagnosticArtifacts({
+        packagePaths: options.packagePaths,
+        artifacts: options.diagnosticArtifacts ?? [],
+    });
+    if (declarations.length === 0)
+        return {};
     return {
-        DEPLOYMENT_MATRIX: hasDeploymentTask
-            ? "\n    strategy:\n      matrix:\n        check: [root, deployment]"
-            : "",
-        DEPLOYMENT_DOCKER_PREPARATION: hasDeploymentTask && needsDocker
-            ? "\n      - uses: docker/setup-buildx-action@v3\n        if: matrix.check == 'deployment'"
-            : "",
-        ROOT_CHECK_CONDITION: hasDeploymentTask
-            ? "\n        if: matrix.check == 'root'"
-            : "",
-        DEPLOYMENT_CHECK: hasDeploymentTask
-            ? "\n      - run: pnpm run check:deployment\n        if: matrix.check == 'deployment'"
-            : "",
+        DIAGNOSTIC_OWNER_PATHS: declarations
+            .map((declaration) => declaration.owner.path)
+            .join("\n            "),
     };
 }
 export function projectDependabotConfig(policy) {

package/node_modules/@ykdz/template-core/dist/template-boundary-check.d.ts

@@ -1,3 +1,4 @@
+import type { ProjectBlueprintV2 } from "./project-blueprint-v2.ts";
 import { type RenderOperation } from "./renderer.ts";
 export type TemplateBoundaryViolation = {
     readonly preset: string;
@@ -34,6 +35,19 @@ export type CheckTemplateSourceBoundaryOptions = {
     readonly projections: readonly TemplateBoundaryCheckProjection[];
     readonly templateSourceContexts?: readonly TemplateSourceContext[];
     readonly manifestReferencedSourceFiles?: readonly string[];
+    /** Complete Built-in plans whose Foundation workflow is a protected output. */
+    readonly protectedWorkflowPlans?: readonly {
+        readonly name: string;
+        readonly sourceFilePath: string;
+        readonly definitionName?: string;
+        readonly planningContribution?: string;
+        readonly generatedPath: ".github/workflows/check.yml";
+        /** The original Blueprint, before Foundation composes workflow facts. */
+        readonly blueprint: ProjectBlueprintV2;
+        /** Raw Package Contribution declarations, not the composed plan field. */
+        readonly diagnosticArtifactDeclarations: readonly unknown[];
+        readonly operations: readonly RenderOperation[];
+    }[];
 };
 /**
  * Reads each registered Template Source context before any plan is inspected.
@@ -41,4 +55,4 @@ export type CheckTemplateSourceBoundaryOptions = {
  */
 export declare function checkTemplateSourceContexts(contexts: readonly Omit<TemplateSourceContext, "checkedFiles">[]): Promise<readonly TemplateSourceContext[]>;
 export declare function isProtectedGeneratedPath(generatedPath: string): boolean;
-export declare function checkTemplateSourceBoundary({ projections, templateSourceContexts, manifestReferencedSourceFiles, }: CheckTemplateSourceBoundaryOptions): Promise<TemplateBoundaryCheckResult>;
+export declare function checkTemplateSourceBoundary({ projections, templateSourceContexts, manifestReferencedSourceFiles, protectedWorkflowPlans, }: CheckTemplateSourceBoundaryOptions): Promise<TemplateBoundaryCheckResult>;

package/node_modules/@ykdz/template-core/dist/template-boundary-check.js

@@ -589,9 +589,170 @@ function pushSourceBackedOperationViolations(options) {
         });
     }
 }
-export async function checkTemplateSourceBoundary({ projections, templateSourceContexts = [], manifestReferencedSourceFiles = [], }) {
+const workflowTemplateVariants = new Map([
+    [
+        ".github/workflows/check.yml",
+        { operationKind: "copyFile", replacementKeys: [] },
+    ],
+    [
+        ".github/workflows/check-deployment.yml",
+        { operationKind: "copyFile", replacementKeys: [] },
+    ],
+    [
+        ".github/workflows/check-diagnostics.yml",
+        {
+            operationKind: "writeTextTemplate",
+            replacementKeys: ["DIAGNOSTIC_OWNER_PATHS"],
+        },
+    ],
+    [
+        ".github/workflows/check-deployment-diagnostics.yml",
+        {
+            operationKind: "writeTextTemplate",
+            replacementKeys: ["DIAGNOSTIC_OWNER_PATHS"],
+        },
+    ],
+]);
+function hasExactReplacementKeys(replacements, expectedKeys) {
+    const keys = Object.keys(replacements).toSorted();
+    const expected = [...expectedKeys].toSorted();
+    return (keys.length === expected.length &&
+        keys.every((key, index) => key === expected[index]));
+}
+const reservedWorkspaceCollections = new Set([
+    ".git",
+    ".github",
+    ".devcontainer",
+    ".template",
+    "node_modules",
+    "dist",
+    "target",
+]);
+function isSafePackageBoundaryPath(value) {
+    return (/^[a-z0-9][a-z0-9-]*\/[a-z0-9][a-z0-9-]*$/u.test(value) &&
+        !reservedWorkspaceCollections.has(value.split("/", 1)[0]));
+}
+/**
+ * Independent oracle for the Foundation workflow's limited substitution.
+ * It deliberately consumes raw Blueprint and Package Contribution facts rather
+ * than the production CI artifact composer or its composed plan output.
+ */
+function expectedDiagnosticOwnerPaths(options) {
+    const blueprintPackagePaths = options.blueprint.packages.map((packageDefinition) => packageDefinition.path);
+    if (!blueprintPackagePaths.every(isSafePackageBoundaryPath)) {
+        return { valid: false, value: "" };
+    }
+    const blueprintOwners = new Set(blueprintPackagePaths);
+    const owners = new Set();
+    for (const declaration of options.diagnosticArtifactDeclarations) {
+        if (!isRecord(declaration) ||
+            !hasExactKeys(declaration, ["kind", "owner"])) {
+            return { valid: false, value: "" };
+        }
+        if (declaration.kind !== "playwright" || !isRecord(declaration.owner)) {
+            return { valid: false, value: "" };
+        }
+        if (!hasExactKeys(declaration.owner, ["kind", "path"])) {
+            return { valid: false, value: "" };
+        }
+        const ownerPath = declaration.owner.path;
+        if (declaration.owner.kind !== "package-boundary" ||
+            typeof ownerPath !== "string" ||
+            !isSafePackageBoundaryPath(ownerPath) ||
+            !blueprintOwners.has(ownerPath)) {
+            return { valid: false, value: "" };
+        }
+        owners.add(ownerPath);
+    }
+    return {
+        valid: true,
+        value: [...owners].toSorted().join("\n            "),
+    };
+}
+function sourceFileForWorkflowOperation(options) {
+    return options.operation?.provenance?.plannerSourceFile ?? options.fallback;
+}
+function findWorkflowOperationOwners(sourceFile, operation) {
+    if (operation === undefined)
+        return ["<unknown>"];
+    const targetPath = operationTarget(operation);
+    if (targetPath === undefined)
+        return ["<unknown>"];
+    const expectedTargetPath = targetPath;
+    const operationKind = operation.kind;
+    const owners = new Set();
+    function visit(node) {
+        if (ts.isObjectLiteralExpression(node)) {
+            if (propertyStringValue(node, "kind") === operationKind &&
+                propertyPathMatches(node, "to", expectedTargetPath)) {
+                owners.add(owningFunctionName(node));
+            }
+        }
+        ts.forEachChild(node, visit);
+    }
+    visit(sourceFile);
+    return owners.size === 0 ? ["<unknown>"] : [...owners];
+}
+async function protectedWorkflowProjectionViolations(plans) {
+    const violations = [];
+    for (const plan of plans) {
+        const matchingOperations = plan.operations.filter((operation) => operationTarget(operation) === plan.generatedPath);
+        const operation = matchingOperations[0];
+        const sourceFilePath = sourceFileForWorkflowOperation({
+            operation,
+            fallback: plan.sourceFilePath,
+        });
+        const sourceText = await readFile(sourceFilePath, "utf8");
+        const sourceFile = ts.createSourceFile(sourceFilePath, sourceText, ts.ScriptTarget.Latest, true, ts.ScriptKind.TS);
+        const expectedDiagnosticOwners = expectedDiagnosticOwnerPaths(plan);
+        const variant = operation !== undefined &&
+            (operation.kind === "copyFile" || operation.kind === "writeTextTemplate")
+            ? workflowTemplateVariants.get(operation.from)
+            : undefined;
+        const replacementValid = operation?.kind === "writeTextTemplate" &&
+            hasExactReplacementKeys(operation.replacements, [
+                "DIAGNOSTIC_OWNER_PATHS",
+            ]) &&
+            operation.replacements.DIAGNOSTIC_OWNER_PATHS ===
+                expectedDiagnosticOwners.value;
+        const sourceBackedExactlyOnce = matchingOperations.length === 1 &&
+            operation !== undefined &&
+            (operation.kind === "copyFile" || operation.kind === "writeTextTemplate");
+        const diagnosticsExpected = expectedDiagnosticOwners.value !== "";
+        const operationValid = expectedDiagnosticOwners.valid &&
+            sourceBackedExactlyOnce &&
+            variant !== undefined &&
+            operation?.kind === variant.operationKind &&
+            (operation.kind === "copyFile"
+                ? variant.replacementKeys.length === 0 && !diagnosticsExpected
+                : variant.replacementKeys.length === 1 &&
+                    diagnosticsExpected &&
+                    replacementValid);
+        if (operationValid)
+            continue;
+        for (const owningFunction of findWorkflowOperationOwners(sourceFile, operation)) {
+            violations.push({
+                preset: plan.name,
+                generatedPath: plan.generatedPath,
+                owningFunction,
+                operationKind: operation?.kind ?? "writeTextTemplate",
+                sourceFilePath,
+                ...(plan.definitionName === undefined
+                    ? {}
+                    : { definitionName: plan.definitionName }),
+                ...(plan.planningContribution === undefined
+                    ? {}
+                    : { planningContribution: plan.planningContribution }),
+                ownershipRule: "Foundation workflow projections require exactly one source-backed template operation with closed diagnostic owner facts",
+            });
+        }
+    }
+    return violations;
+}
+export async function checkTemplateSourceBoundary({ projections, templateSourceContexts = [], manifestReferencedSourceFiles = [], protectedWorkflowPlans = [], }) {
     const manifestReferencedSourceFileSet = new Set(manifestReferencedSourceFiles.map((sourceFile) => path.resolve(sourceFile)));
     const violations = [];
+    violations.push(...(await protectedWorkflowProjectionViolations(protectedWorkflowPlans)));
     for (const projection of projections) {
         const sourceText = await readFile(projection.sourceFilePath, "utf8");
         const sourceFile = ts.createSourceFile(projection.sourceFilePath, sourceText, ts.ScriptTarget.Latest, true, ts.ScriptKind.TS);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ykdz/template",
-  "version": "0.0.32",
+  "version": "0.0.35",
   "private": false,
   "description": "Project template generator for YKDZ starter projects.",
   "keywords": [

package/node_modules/@ykdz/template-builtin-presets/templates/foundation/.github/workflows/check-playwright.yml

@@ -1,20 +0,0 @@
-name: Check
-
-on:
-  pull_request:
-  push:
-    branches:
-      - main
-
-jobs:
-  check:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v7
-        with:
-          node-version-file: package.json
-      - run: corepack enable
-      - run: pnpm install
-      - run: pnpm --filter ./apps/web exec playwright install --with-deps chromium
-      - run: pnpm run check

package/node_modules/@ykdz/template-builtin-presets/templates/foundation/.github/workflows/check-rust.yml

@@ -1,23 +0,0 @@
-name: Check
-
-on:
-  pull_request:
-  push:
-    branches:
-      - main
-
-jobs:
-  check:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v7
-        with:
-          node-version-file: package.json
-      - run: corepack enable
-      - uses: dtolnay/rust-toolchain@stable
-        with:
-          components: rustfmt, clippy
-      - uses: Swatinem/rust-cache@v2
-      - run: pnpm install
-      - run: pnpm run check

package/node_modules/@ykdz/template-builtin-presets/templates/foundation/.github/workflows/check.dynamic.template

@@ -1,19 +0,0 @@
-name: Check
-
-on:
-  pull_request:
-  push:
-    branches:
-      - main
-
-jobs:
-  check:
-    runs-on: ubuntu-latest{{DEPLOYMENT_MATRIX}}
-    steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v7
-        with:
-          node-version-file: package.json
-      - run: corepack enable{{DEPLOYMENT_DOCKER_PREPARATION}}
-      - run: pnpm install
-      - run: pnpm run check{{ROOT_CHECK_CONDITION}}{{DEPLOYMENT_CHECK}}

package/node_modules/@ykdz/template-builtin-presets/templates/vike-app/db-migrations/scripts/prepare-database.ts

@@ -1,45 +0,0 @@
-import { execFileSync } from "node:child_process";
-import { mkdirSync, rmSync } from "node:fs";
-import path from "node:path";
-
-const mode = process.argv[2];
-
-if (mode !== "dev" && mode !== "test") {
-  throw new Error("Usage: node scripts/prepare-database.ts <dev|test>");
-}
-
-const packageDirectory = process.cwd();
-const databaseFile = process.env.DATABASE_FILE
-  ? path.resolve(
-      process.env.INIT_CWD ?? packageDirectory,
-      process.env.DATABASE_FILE,
-    )
-  : path.resolve(packageDirectory, "../../apps/web/data/app.sqlite");
-const environment = { ...process.env, DATABASE_FILE: databaseFile };
-
-mkdirSync(path.dirname(databaseFile), { recursive: true });
-if (mode === "test") {
-  rmSync(databaseFile, { force: true });
-}
-
-execFileSync("pnpm", ["run", "db:push"], {
-  cwd: packageDirectory,
-  env: environment,
-  stdio: "inherit",
-});
-const databasePackageName = process.env.DATABASE_PACKAGE_NAME;
-if (!databasePackageName) {
-  throw new Error(
-    "DATABASE_PACKAGE_NAME must name the database Package Boundary",
-  );
-}
-
-execFileSync(
-  "pnpm",
-  ["--filter", databasePackageName, "run", "db:seed:example"],
-  {
-    cwd: packageDirectory,
-    env: environment,
-    stdio: "inherit",
-  },
-);

package/node_modules/@ykdz/template-builtin-presets/templates/vike-app/web/scripts/run-playwright.ts

@@ -1,151 +0,0 @@
-import { spawn } from "node:child_process";
-import { mkdir, rm } from "node:fs/promises";
-import { createServer } from "node:net";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-
-const databaseFile = fileURLToPath(
-  new URL("../node_modules/.tmp/e2e.sqlite", import.meta.url),
-);
-const externalBaseUrlName = "PLAYWRIGHT_EXTERNAL_BASE_URL";
-const externalReadinessTimeoutMs = 30_000;
-
-function externalBaseUrl(): string | undefined {
-  if (!Object.hasOwn(process.env, externalBaseUrlName)) {
-    return undefined;
-  }
-
-  const value = process.env[externalBaseUrlName]?.trim();
-  if (!value) {
-    throw new Error(`${externalBaseUrlName} must be a non-empty HTTP(S) URL`);
-  }
-
-  let url: URL;
-  try {
-    url = new URL(value);
-  } catch {
-    throw new Error(`${externalBaseUrlName} must be a valid HTTP(S) URL`);
-  }
-
-  if (url.protocol !== "http:" && url.protocol !== "https:") {
-    throw new Error(`${externalBaseUrlName} must use HTTP or HTTPS`);
-  }
-
-  return url.toString();
-}
-
-async function availablePort(): Promise<string> {
-  return await new Promise((resolve, reject) => {
-    const server = createServer();
-
-    server.once("error", reject);
-    server.listen(0, "127.0.0.1", () => {
-      const address = server.address();
-
-      if (typeof address !== "object" || address === null) {
-        server.close(() => {
-          reject(new Error("Could not allocate a Playwright web port"));
-        });
-        return;
-      }
-
-      const port = String(address.port);
-      server.close((error) => {
-        if (error) {
-          reject(error);
-          return;
-        }
-
-        resolve(port);
-      });
-    });
-  });
-}
-
-async function awaitExternalService(baseUrl: string): Promise<void> {
-  const deadline = Date.now() + externalReadinessTimeoutMs;
-
-  while (Date.now() < deadline) {
-    try {
-      const response = await fetch(baseUrl, {
-        signal: AbortSignal.timeout(2_000),
-      });
-      if (response.ok) {
-        return;
-      }
-    } catch {
-      // The externally managed service may still be starting.
-    }
-
-    await new Promise((resolve) => setTimeout(resolve, 250));
-  }
-
-  throw new Error(
-    `External Playwright service at ${baseUrl} was not ready within ${externalReadinessTimeoutMs}ms`,
-  );
-}
-
-async function localPlaywrightEnv(): Promise<NodeJS.ProcessEnv> {
-  return {
-    ...process.env,
-    DATABASE_FILE: process.env.DATABASE_FILE ?? databaseFile,
-    PLAYWRIGHT_WEB_PORT:
-      process.env.PLAYWRIGHT_WEB_PORT ?? (await availablePort()),
-  };
-}
-
-const externalServiceUrl = externalBaseUrl();
-const env = externalServiceUrl
-  ? { ...process.env }
-  : await localPlaywrightEnv();
-const localDatabaseFile = externalServiceUrl ? undefined : env.DATABASE_FILE;
-delete env.NO_COLOR;
-
-if (externalServiceUrl) {
-  await awaitExternalService(externalServiceUrl);
-} else {
-  await mkdir(path.dirname(localDatabaseFile!), { recursive: true });
-  await rm(localDatabaseFile!, { force: true });
-}
-
-const command = process.platform === "win32" ? "playwright.cmd" : "playwright";
-const child = spawn(command, ["test", ...process.argv.slice(2)], {
-  env,
-  stdio: "inherit",
-});
-
-const forwardedSignals = ["SIGINT", "SIGTERM"] as const;
-const forwardSignal = (signal: NodeJS.Signals): void => {
-  child.kill(signal);
-};
-for (const signal of forwardedSignals) {
-  process.once(signal, forwardSignal);
-}
-
-try {
-  const result = await new Promise<{
-    code: number | null;
-    signal: NodeJS.Signals | null;
-  }>((resolve, reject) => {
-    child.once("error", reject);
-    child.once("exit", (code, signal) => resolve({ code, signal }));
-  });
-
-  if (result.signal) {
-    console.error(`Playwright exited with signal ${result.signal}`);
-    process.exitCode = 1;
-  } else {
-    process.exitCode = result.code ?? 1;
-  }
-} catch (error) {
-  console.error(error);
-  process.exitCode = 1;
-} finally {
-  for (const signal of forwardedSignals) {
-    process.removeListener(signal, forwardSignal);
-  }
-
-  if (localDatabaseFile) {
-    await rm(localDatabaseFile, { force: true });
-  }
-}