mfeflow 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Sanjeev Sharma
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,127 @@
-# Temporary Holding Version
+# mfeflow
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Part of [mfeflow](https://github.com/mfeflow/mfeflow), the React micro-frontend boilerplate and platform kit.
+
+Pre-1.0: commands and flags may change in minor versions. To run it from a checkout of the repo, see
+[Try it from a checkout](#try-it-from-a-checkout).
+
+```sh
+npm create mfeflow@latest my-app -- --yes
+cd my-app
+pnpm dev                                    # shell on :4300, remotes on :4311, :4312
+```
+
+## Commands
+
+| Command                               | Does                                                                                 |
+| ------------------------------------- | ------------------------------------------------------------------------------------ |
+| `mfeflow init [dir]`                  | New project: a shell, remotes (default `catalog`, `cart`), pnpm workspace, Turborepo |
+| `mfeflow add remote <name>`           | New remote with its registry entries and a route in every shell                      |
+| `mfeflow add shell <name>`            | New shell that routes to every existing remote                                       |
+| `mfeflow add <feature...>`            | Add features, or `@namespace/feature` from a registry in `mfeflow.json`              |
+| `mfeflow add env-key <KEY>`           | Add a typed env key: `--scope server` (env.ts) or `runtime`, with `--schema <expr>`  |
+| `mfeflow features [search]`           | List the features you can add                                                        |
+| `mfeflow dev`                         | Run the shell and every remote, one prefixed log each; follows `add remote`          |
+| `mfeflow doctor`                      | Singletons, compatibility, config health, drift; `--fix` repairs the safe ones       |
+| `mfeflow validate`                    | `mfeflow.json`, every `mfe.json` and every registry entry against their schemas      |
+| `mfeflow check-compat`                | Each remote's shared ranges against the shells it runs in                            |
+| `mfeflow budget`                      | Built first-load JS of the shell and each remote against the cost-model budget       |
+| `mfeflow --version`, `mfeflow --help` | Version, and help with examples (`mfeflow <command> --help` for one command)         |
+
+Features that ship with it: `core` and `tsconfig` (always), `lint-oxlint`, `url-factory`, `env-t3` and `testing`
+(default), `ci-github` and `git-hooks` (opt-in). `init` takes `--scope`, `--remotes a,b`, `--features a,b` and
+`--option feature.key=value`; every prompt has a flag.
+
+## dev, doctor and the CI checks
+
+`mfeflow dev` starts every app with `pnpm run dev` in its folder and writes the dev registry the shell reads to
+`.mfeflow/dev-registry.json` (apps from `mfeflow.json`, entries from `registry/envs/dev`). When `mfeflow.json` or
+`registry/envs/dev` changes it rewrites the file, the shell restarts itself, and a new remote is started. `--only a,b`
+runs part of the project; `--remote name=url` uses a server you run yourself (the name must be a remote; the URL must be on
+localhost unless `--allow-origin <origin>` names it); Ctrl+C stops every app, process trees included, on Windows too.
+It exits 130 after Ctrl+C.
+
+`doctor` runs these checks, each with a code and a docs page (`https://mfeflow.github.io/mfeflow/errors/<code>`). It exits with 0
+when there are no errors, else with the lowest exit code among the errors' ranges (project 3 before build 5).
+
+| Check                                 | Code           | Fixed by `--fix`              |
+| ------------------------------------- | -------------- | ----------------------------- |
+| every app in mfeflow.json is on disk  | E112           |                               |
+| valid `mfe.json`, name matches        | E113, E116     |                               |
+| no shared port                        | E115           |                               |
+| no route claimed twice                | E116           |                               |
+| registry entry per remote and env     | E114           | writes the missing ones       |
+| linked checkout is built              | E110           |                               |
+| one version of each singleton         | E301           |                               |
+| every workspace package has a version | E111           | adds `0.0.0`                  |
+| remote ranges fit the shell           | E302           |                               |
+| copied files match their hash         | E117 (warning) |                               |
+| runtime plugins import nothing shared | E303           |                               |
+| `.env.example` matches `env.ts`       | E118 (warning) | skipped until `env-t3` exists |
+| runtime-config files match the schema | E119           |                               |
+| no `PUBLIC_*` variable but constants  | E120 (warning) |                               |
+| server keys listed in `turbo.json`    | E121 (warning) |                               |
+
+`validate` runs the schema and registry checks, `check-compat` the compatibility check, `budget` reads the build output
+(`dist/`): each remote's entry against `budget.remoteKb` (10), a route against `mfe.json` `budgets.initialJsKb`, and the
+shell against `budget.baselineKb + budget.shellKb` (32) when a baseline is set. All four take `--json` and exit non-zero on
+errors. LCP is measured by the perf job, not by `budget`.
+
+## Flags on every command
+
+| Flag                   | Does                                                                                                |
+| ---------------------- | --------------------------------------------------------------------------------------------------- |
+| `--yes`, `-y`          | Take the defaults, never prompt                                                                     |
+| `--preset <file\|url>` | Replay options from a JSON file or https URL (`scope`, `remotes`, `features`, `options`); flags win |
+| `--json`               | One JSON document on stdout, nothing else; errors come as `{ ok: false, error }`                    |
+| `--dry-run`            | Print the summary and a unified diff, write nothing, run nothing                                    |
+| `--cwd <dir>`          | Run as if started in that folder                                                                    |
+| `--no-install`         | Do not run the package manager                                                                      |
+| `--verbose`            | Show the diff, package manager output and stack traces                                              |
+| `--local <path>`       | Link `@mfeflow/*` from a built checkout (env `MFEFLOW_LOCAL`)                                       |
+
+Every write is a plan first: the summary (and with `--dry-run` the diff) is shown, then the files are
+written all or nothing, and the install runs inside the same transaction. If the install fails, the
+files are put back.
+
+## Errors and exit codes
+
+Errors print the code, one line of fix and a docs link:
+
+```
+MFEFLOW_E108 The target folder is not empty: /work/app already has notes.txt
+  Fix: Pick a new or empty folder, or move what is in the way.
+  https://mfeflow.github.io/mfeflow/errors/E108
+```
+
+| Exit | Meaning                                                                 |
+| ---- | ----------------------------------------------------------------------- |
+| 0    | success                                                                 |
+| 1    | unexpected error (`--verbose` prints the stack)                         |
+| 2    | bad command line: `MFEFLOW_E107`, `MFEFLOW_E215`                        |
+| 3    | project or config problem: `MFEFLOW_E1xx`                               |
+| 4    | feature problem: `MFEFLOW_E2xx`                                         |
+| 5    | build or runtime problem: `MFEFLOW_E3xx`                                |
+| 6    | registry problem: `MFEFLOW_E4xx`                                        |
+| 7    | upgrade problem: `MFEFLOW_E5xx`                                         |
+| 130  | cancelled at a prompt (nothing was written), or Ctrl+C in `mfeflow dev` |
+
+## Try it from a checkout
+
+Before `@mfeflow/*` is on npm, `--local` writes the dependencies as `link:` to the packages of a clone.
+Without it, they are `^<the CLI's version>`.
+
+```sh
+git clone https://github.com/mfeflow/mfeflow && cd mfeflow
+pnpm install && pnpm build
+
+node packages/cli/bin/mfeflow.js init ../my-app --yes --local .
+cd ../my-app
+pnpm dev        # http://localhost:4300 renders the shell with both remotes
+```
+
+`--local` needs the checkout built (`pnpm build`); it says so (`MFEFLOW_E110`) if a package has no `dist/`.
+`MFEFLOW_LOCAL=/path/to/mfeflow` does the same for `init`.
+The checkout is recorded in `mfeflow.json` as `"local"` (a path relative to the project), so later `mfeflow add` commands keep writing `link:` without the flag. `--local none` removes it; dependencies already written stay as they are.
+
+MIT licensed.

package/assets/features/analytics-gtm/feature.json

@@ -0,0 +1,117 @@
+{
+  "name": "analytics-gtm",
+  "version": "0.1.0",
+  "description": "Google Tag Manager with Consent Mode v2 behind @mfeflow/analytics: consent defaults before gtm.js, a consent banner hook, page views on route changes, and a typed tracker per remote. The container id comes from the runtime config.",
+  "requires": ["core", "tsconfig"],
+  "files": [
+    {
+      "to": "src/analytics/init.ts",
+      "target": "shell",
+      "from": "files/init.ts"
+    },
+    {
+      "to": "src/analytics/Analytics.tsx",
+      "target": "shell",
+      "from": "files/Analytics.tsx"
+    },
+    {
+      "to": "src/analytics/ConsentBanner.tsx",
+      "target": "shell",
+      "from": "files/ConsentBanner.tsx"
+    },
+    {
+      "to": "src/analytics/init.test.ts",
+      "target": "shell",
+      "from": "files/shell-init-test.ts",
+      "when": {
+        "feature:testing": true
+      }
+    },
+    {
+      "to": "src/analytics/ConsentBanner.test.tsx",
+      "target": "shell",
+      "from": "files/consent-banner-test.tsx",
+      "when": {
+        "feature:testing": true
+      }
+    },
+    {
+      "to": "src/analytics.ts",
+      "target": "remotes",
+      "from": "files/remote-analytics.ts.eta",
+      "template": true
+    },
+    {
+      "to": "src/analytics.test.ts",
+      "target": "remotes",
+      "from": "files/remote-analytics-test.ts.eta",
+      "template": true,
+      "when": {
+        "feature:testing": true
+      }
+    }
+  ],
+  "dependencies": [
+    {
+      "name": "@mfeflow/analytics",
+      "range": "latest",
+      "target": "shell"
+    },
+    {
+      "name": "@mfeflow/analytics",
+      "range": "latest",
+      "target": "remotes"
+    }
+  ],
+  "transforms": [
+    {
+      "op": "add-boot-step",
+      "file": "src/bootstrap.tsx",
+      "target": "shell",
+      "call": "initAnalyticsFromConfig",
+      "from": "./analytics/init",
+      "await": false
+    },
+    {
+      "op": "wrap-provider",
+      "file": "src/App.tsx",
+      "target": "shell",
+      "component": "Analytics",
+      "from": "./analytics/Analytics",
+      "function": "App"
+    },
+    {
+      "op": "add-env-key",
+      "file": "src/config/schema.ts",
+      "target": "shell",
+      "key": "gtmId",
+      "scope": "runtime",
+      "schema": {
+        "zod": "z.string().regex(/^(GTM-[A-Z0-9]{4,12})?$/)",
+        "valibot": "v.pipe(v.string(), v.regex(/^(GTM-[A-Z0-9]{4,12})?$/))",
+        "arktype": "'/^(GTM-[A-Z0-9]{4,12})?$/'"
+      },
+      "value": "",
+      "configFiles": [
+        "public/config/runtime-config.dev.json",
+        "public/config/runtime-config.staging.json",
+        "public/config/runtime-config.prod.json"
+      ],
+      "when": {
+        "feature:env-t3": true
+      }
+    },
+    {
+      "op": "add-env-key",
+      "file": "public/config/runtime-config.json",
+      "target": "shell",
+      "key": "gtmId",
+      "scope": "runtime",
+      "schema": "z.string().regex(/^(GTM-[A-Z0-9]{4,12})?$/)",
+      "value": "",
+      "when": {
+        "feature:env-t3": false
+      }
+    }
+  ]
+}

package/assets/features/analytics-gtm/files/Analytics.tsx

@@ -0,0 +1,13 @@
+import type { ReactNode } from 'react';
+import { AnalyticsProvider } from '@mfeflow/analytics/react';
+import { ConsentBanner } from './ConsentBanner';
+
+/** Wraps the shell. Sends a page_view on every route change and shows the consent banner. */
+export function Analytics({ children }: { children: ReactNode }) {
+  return (
+    <AnalyticsProvider>
+      {children}
+      <ConsentBanner />
+    </AnalyticsProvider>
+  );
+}

package/assets/features/analytics-gtm/files/ConsentBanner.tsx

@@ -0,0 +1,47 @@
+import { useConsent } from '@mfeflow/analytics/react';
+
+// Yours to restyle or replace. Until the visitor chooses, every consent signal stays denied, and
+// each button grants only what its label says.
+export function ConsentBanner() {
+  const { decided, update, rejectAll } = useConsent();
+  if (decided) return null;
+  return (
+    <section aria-label="Cookie consent" data-testid="consent-banner">
+      <p>
+        We use analytics cookies to measure how the site is used. Advertising cookies are optional
+        and stay off unless you allow them.
+      </p>
+      <button
+        type="button"
+        data-testid="consent-accept-analytics"
+        onClick={() => {
+          update({
+            analytics_storage: 'granted',
+            ad_storage: 'denied',
+            ad_user_data: 'denied',
+            ad_personalization: 'denied',
+          });
+        }}
+      >
+        Accept analytics
+      </button>
+      <button
+        type="button"
+        data-testid="consent-accept-ads"
+        onClick={() => {
+          update({
+            analytics_storage: 'granted',
+            ad_storage: 'granted',
+            ad_user_data: 'granted',
+            ad_personalization: 'granted',
+          });
+        }}
+      >
+        Accept analytics and advertising
+      </button>
+      <button type="button" data-testid="consent-reject" onClick={rejectAll}>
+        Reject
+      </button>
+    </section>
+  );
+}

package/assets/features/analytics-gtm/files/consent-banner-test.tsx

@@ -0,0 +1,36 @@
+import { getConsent, resetAnalyticsForTests } from '@mfeflow/analytics';
+import { cleanup, fireEvent, render, screen } from '@testing-library/react';
+import { afterEach, describe, expect, it } from 'vitest';
+import { ConsentBanner } from './ConsentBanner';
+
+afterEach(() => {
+  cleanup();
+  localStorage.clear();
+  resetAnalyticsForTests();
+});
+
+describe('ConsentBanner', () => {
+  it('grants analytics only, and denies advertising, on "Accept analytics"', () => {
+    render(<ConsentBanner />);
+    fireEvent.click(screen.getByText('Accept analytics'));
+    expect(getConsent()).toEqual({
+      analytics_storage: 'granted',
+      ad_storage: 'denied',
+      ad_user_data: 'denied',
+      ad_personalization: 'denied',
+    });
+    expect(screen.queryByTestId('consent-banner')).toBeNull();
+  });
+
+  it('grants advertising too only on its own button', () => {
+    render(<ConsentBanner />);
+    fireEvent.click(screen.getByText('Accept analytics and advertising'));
+    expect(getConsent()).toMatchObject({ analytics_storage: 'granted', ad_storage: 'granted' });
+  });
+
+  it('denies everything on Reject', () => {
+    render(<ConsentBanner />);
+    fireEvent.click(screen.getByText('Reject'));
+    expect(Object.values(getConsent())).toEqual(['denied', 'denied', 'denied', 'denied']);
+  });
+});

package/assets/features/analytics-gtm/files/init.ts

@@ -0,0 +1,26 @@
+import { initAnalytics } from '@mfeflow/analytics';
+import { createGtmProvider } from '@mfeflow/analytics/gtm';
+import { fetchRuntimeConfig } from '@mfeflow/runtime';
+
+/**
+ * Starts analytics from the runtime config's `gtmId`. With no id, analytics stays off and every
+ * tracker call is dropped. Safe to call twice: the first start wins.
+ */
+export async function startAnalytics(): Promise<void> {
+  const config = await fetchRuntimeConfig().catch((error: unknown) => {
+    console.warn('[analytics] the runtime config did not load, so analytics stays off', error);
+    return undefined;
+  });
+  const gtmId = config?.gtmId;
+  if (typeof gtmId !== 'string' || gtmId === '') return;
+  try {
+    initAnalytics(createGtmProvider({ containerId: gtmId }));
+  } catch (error) {
+    console.warn('[analytics] not started', error);
+  }
+}
+
+/** The boot step: starts analytics without holding up first render. */
+export function initAnalyticsFromConfig(): void {
+  void startAnalytics();
+}

package/assets/features/analytics-gtm/files/remote-analytics-test.ts.eta

@@ -0,0 +1,18 @@
+import { createRecordingProvider, initAnalytics, resetAnalyticsForTests } from '@mfeflow/analytics';
+import { afterEach, describe, expect, it } from 'vitest';
+import { tracker } from './analytics';
+
+afterEach(resetAnalyticsForTests);
+
+describe('the <%= it.app.name %> tracker', () => {
+  it('stamps its events with the remote name', () => {
+    const provider = createRecordingProvider();
+    initAnalytics(provider);
+    tracker.track('<%= it.app.name %>_viewed');
+    expect(provider.calls.at(-1)).toMatchObject({
+      type: 'track',
+      event: '<%= it.app.name %>_viewed',
+      params: { mfe_name: '<%= it.app.name %>', mfe_version: null },
+    });
+  });
+});

package/assets/features/analytics-gtm/files/remote-analytics.ts.eta

@@ -0,0 +1,13 @@
+import { createTracker } from '@mfeflow/analytics';
+
+// Every event this remote sends, with its parameters. The map is merged into the platform's, so
+// tracker.track('<%= it.app.name %>_viewed') is checked here and nowhere else.
+declare module '@mfeflow/analytics' {
+  interface AnalyticsEvents {
+    <%= it.app.name %>_viewed: undefined;
+  }
+}
+
+export const events = ['<%= it.app.name %>_viewed'] as const;
+
+export const tracker = createTracker('<%= it.app.name %>', { events });

package/assets/features/analytics-gtm/files/shell-init-test.ts

@@ -0,0 +1,42 @@
+import { resetAnalyticsForTests } from '@mfeflow/analytics';
+import { afterEach, describe, expect, it } from 'vitest';
+import { startAnalytics } from './init';
+
+function dataLayer(): unknown[] | undefined {
+  const layer: unknown = Reflect.get(globalThis, 'dataLayer');
+  return Array.isArray(layer) ? layer : undefined;
+}
+
+// gtag pushes the `arguments` object, which GTM reads and an array would not be.
+const argumentsOf = (entry: unknown): unknown[] =>
+  typeof entry === 'object' && entry !== null ? Object.values(entry) : [];
+
+afterEach(() => {
+  Reflect.deleteProperty(globalThis, '__MFE_RUNTIME_CONFIG__');
+  Reflect.deleteProperty(globalThis, 'dataLayer');
+  document.head.innerHTML = '';
+  resetAnalyticsForTests();
+});
+
+describe('startAnalytics', () => {
+  it('stays off without a gtmId', async () => {
+    Reflect.set(globalThis, '__MFE_RUNTIME_CONFIG__', { gtmId: '' });
+    await startAnalytics();
+    expect(dataLayer()).toBeUndefined();
+    expect(document.querySelector('script[src*="gtm.js"]')).toBeNull();
+  });
+
+  it('pushes the consent defaults, then loads gtm.js once, however often it runs', async () => {
+    Reflect.set(globalThis, '__MFE_RUNTIME_CONFIG__', { gtmId: 'GTM-TEST123' });
+    await startAnalytics();
+    await startAnalytics();
+    expect(argumentsOf(dataLayer()?.[0]).slice(0, 2)).toEqual(['consent', 'default']);
+    expect(document.querySelectorAll('script[src*="gtm.js?id=GTM-TEST123"]')).toHaveLength(1);
+  });
+
+  it('stays off when the id is not a container id', async () => {
+    Reflect.set(globalThis, '__MFE_RUNTIME_CONFIG__', { gtmId: 'oops' });
+    await startAnalytics();
+    expect(dataLayer()).toBeUndefined();
+  });
+});

package/assets/features/ci-github/feature.json

@@ -0,0 +1,26 @@
+{
+  "name": "ci-github",
+  "version": "0.1.0",
+  "description": "GitHub Actions workflow for pull requests: lint, typecheck, test, build, doctor, validate, check-compat, budget, runtime-config check and the Playwright smoke test. Opt-in.",
+  "requires": ["core"],
+  "files": [
+    {
+      "to": ".github/workflows/ci.yml",
+      "target": "root",
+      "from": "files/ci.yml"
+    },
+    {
+      "to": "docs/ci.md",
+      "target": "root",
+      "from": "files/ci.md"
+    }
+  ],
+  "dependencies": [
+    {
+      "name": "mfeflow",
+      "range": "latest",
+      "target": "root",
+      "dev": true
+    }
+  ]
+}

package/assets/features/ci-github/files/ci.md

@@ -0,0 +1,41 @@
+# CI
+
+`.github/workflows/ci.yml` runs on every pull request: lint, formatting, typecheck, tests, build, then
+`mfeflow doctor`, `validate`, `check-compat` and `budget`, the runtime-config check and the Playwright smoke test.
+A step for a feature the project does not have is skipped, so adding `testing` or `env-t3` later needs no edit to the
+workflow. Every action is pinned to a commit SHA, the workflow starts from `permissions: {}`, and the job gets
+`contents: read` only. Dependabot or Renovate can keep the pins current.
+
+Make the `check` job a required status check on your default branch (Settings, Rules, Rulesets).
+
+## Preview deploys (not generated yet)
+
+mfeflow does not generate a deploy workflow in this release: pushing remotes to a registry comes with the registry
+features. When you add a deploy job, keep to this shape.
+
+- Run it on `pull_request` with `contents: read` and `id-token: write`, and no repository secrets.
+- Upload the build of one remote to its own path, for example `preview/<remote>/<pr-number>/`, never to the
+  path production reads.
+- Comment the override link on the pull request. `?mfe-override=<remote>@<url of its mf-manifest.json>` on the
+  staging shell loads that build instead of the registered one (the shell honours it outside production only).
+- Pull requests from forks get no `id-token`, so they cannot deploy; build them without a preview.
+
+## OIDC instead of stored cloud keys
+
+Let the job ask GitHub for a short-lived token and exchange it for cloud credentials; no access key sits in the
+repository settings.
+
+```yaml
+permissions:
+  id-token: write
+  contents: read
+steps:
+  - uses: aws-actions/configure-aws-credentials@<sha>
+    with:
+      role-to-assume: arn:aws:iam::<account>:role/<team>-deploy
+      aws-region: eu-west-1
+```
+
+Give each team a role that can write only its own prefixes (`mfe/<remote>/*` and `preview/<remote>/*`), and restrict the
+role's trust policy to this repository, the `pull_request` or `main` ref, and the workflow file. The same pattern
+works with Google Cloud (`google-github-actions/auth`) and Azure (`azure/login`).

package/assets/features/ci-github/files/ci.yml

@@ -0,0 +1,63 @@
+name: ci
+
+on:
+  pull_request:
+
+permissions: {}
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+# Steps for a feature you have not added (lint, tests, runtime config, Playwright) are skipped
+# by their `if`, so this file stays the same as the project grows.
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: lts/*
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - name: Lint
+        if: hashFiles('.oxlintrc.json') != ''
+        run: pnpm lint
+      - name: Check formatting
+        if: hashFiles('.prettierrc.json') != ''
+        run: pnpm format:check
+      - run: pnpm typecheck
+      - run: pnpm run --if-present typecheck:tooling
+      - name: Test
+        run: pnpm run --if-present test
+      - run: pnpm build
+      - name: mfeflow doctor
+        run: pnpm exec mfeflow doctor
+      - name: mfeflow validate
+        run: pnpm exec mfeflow validate
+      - name: mfeflow check-compat
+        run: pnpm exec mfeflow check-compat
+      - name: mfeflow budget
+        run: pnpm exec mfeflow budget
+      - name: Check runtime config
+        run: pnpm run --if-present check:runtime-config
+      - name: Install Playwright browser
+        if: hashFiles('playwright.config.ts') != ''
+        run: pnpm exec playwright install --with-deps chromium
+      - name: Playwright smoke test
+        if: hashFiles('playwright.config.ts') != ''
+        run: pnpm run test:e2e
+      - name: Upload Playwright report
+        if: failure() && hashFiles('playwright.config.ts') != ''
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: playwright-report
+          path: node_modules/.cache/playwright/report
+          retention-days: 7