Replace legacy presets with trusted definitions

.github/workflows/check.yml

@@ -41,7 +41,7 @@ jobs:
         run: sudo apt-get update && sudo apt-get install -y shellcheck
 
       - name: Prepare browser checks
-        run: pnpm --filter @ykdz/template-builtin-source exec playwright install --with-deps chromium
+        run: pnpm --filter @ykdz/template-builtin-presets exec playwright install --with-deps chromium
 
       - name: Check package
         run: pnpm run check
@@ -57,6 +57,9 @@ jobs:
           TEMPLATE_FIXTURE_REPLAY_CACHE_READ: "1"
           TEMPLATE_FIXTURE_REPLAY_CACHE_WRITE: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' && '1' || '0' }}
 
+      - name: Check deployment artifacts
+        run: pnpm run check:deployment
+
       - name: Save fixture replay cache
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'
         uses: actions/cache/save@v6

.gitignore

@@ -14,3 +14,5 @@ CONTEXT.md
 packages/**/.turbo/
 coverage
 target
+.template-boundary-check
+generated-repository

Cargo.toml

@@ -6,7 +6,7 @@ publish = false
 
 [[bin]]
 name = "template-cargo-dependencies"
-path = "packages/builtin-source/templates/rust-bin/src/main.rs"
+path = "packages/builtin-presets/templates/rust-bin/src/main.rs"
 
 [dependencies]
 anyhow = "1.0.100"

package.json

@@ -5,11 +5,12 @@
   "type": "module",
   "scripts": {
     "build": "turbo run build --output-logs=errors-only --log-order=grouped",
-    "check": "pnpm run build && pnpm run check:boundaries && turbo run format:check lint typecheck test check:generated check:templates format:check:root lint:root typecheck:root --output-logs=errors-only --log-order=grouped",
+    "check": "pnpm run build && pnpm run check:boundaries && turbo run format:check lint typecheck test check:generated check:templates check:templates:boundary check:templates:github-yaml format:check:root lint:root typecheck:root --output-logs=errors-only --log-order=grouped",
     "check:boundaries": "turbo boundaries --no-color",
     "check:fixtures": "turbo run check:fixtures --output-logs=errors-only --log-order=grouped",
     "check:format": "pnpm run format:check",
     "check:generated": "turbo run check:generated --output-logs=errors-only --log-order=grouped",
+    "check:deployment": "turbo run check:deployment --output-logs=errors-only --log-order=grouped",
     "check:lint": "pnpm run lint",
     "check:templates": "turbo run check:templates --output-logs=errors-only --log-order=grouped",
     "check:templates:boundary": "turbo run check:templates:boundary --output-logs=errors-only --log-order=grouped",
@@ -21,20 +22,20 @@
     "resolve:toolchain:update": "node packages/checks/src/update-toolchain-baseline.ts --print-workflow-outputs",
     "fix": "pnpm run build",
     "format:check": "turbo run format:check format:check:root --output-logs=errors-only --log-order=grouped",
-    "format:check:root": "oxfmt --list-different --config oxfmt.config.ts package.json pnpm-workspace.yaml turbo.json tsconfig.base.json tsconfig.build.json tsconfig.json vitest.config.ts oxfmt.config.ts oxlint.config.ts test packages/builtin-source/templates/*/behavior.test.ts",
+    "format:check:root": "oxfmt --list-different --config oxfmt.config.ts package.json pnpm-workspace.yaml turbo.json tsconfig.base.json tsconfig.build.json tsconfig.json vitest.config.ts oxfmt.config.ts oxlint.config.ts test packages/builtin-presets/src/*/behavior.test.ts",
     "format:write": "turbo run format:write format:write:root --output-logs=errors-only --log-order=grouped",
-    "format:write:root": "oxfmt --write --config oxfmt.config.ts package.json pnpm-workspace.yaml turbo.json tsconfig.base.json tsconfig.build.json tsconfig.json vitest.config.ts oxfmt.config.ts oxlint.config.ts test packages/builtin-source/templates/*/behavior.test.ts",
+    "format:write:root": "oxfmt --write --config oxfmt.config.ts package.json pnpm-workspace.yaml turbo.json tsconfig.base.json tsconfig.build.json tsconfig.json vitest.config.ts oxfmt.config.ts oxlint.config.ts test packages/builtin-presets/src/*/behavior.test.ts",
     "lint": "turbo run lint lint:root --output-logs=errors-only --log-order=grouped",
     "lint:fix": "turbo run lint:fix lint:fix:root --output-logs=errors-only --log-order=grouped",
-    "lint:fix:root": "oxlint --format=unix --config oxlint.config.ts oxlint.config.ts oxfmt.config.ts vitest.config.ts test packages/builtin-source/templates/*/behavior.test.ts --fix",
-    "lint:root": "oxlint --quiet --format=unix --config oxlint.config.ts oxlint.config.ts oxfmt.config.ts vitest.config.ts test packages/builtin-source/templates/*/behavior.test.ts",
+    "lint:fix:root": "oxlint --format=unix --config oxlint.config.ts oxlint.config.ts oxfmt.config.ts vitest.config.ts test packages/builtin-presets/src/*/behavior.test.ts --fix",
+    "lint:root": "oxlint --quiet --format=unix --config oxlint.config.ts oxlint.config.ts oxfmt.config.ts vitest.config.ts test packages/builtin-presets/src/*/behavior.test.ts",
     "test": "vitest run --reporter=agent --silent=passed-only",
     "typecheck": "turbo run typecheck typecheck:root --output-logs=errors-only --log-order=grouped",
     "typecheck:root": "tsc -p tsconfig.json --noEmit --pretty false"
   },
   "devDependencies": {
     "@types/node": "catalog:",
-    "@ykdz/template-builtin-source": "workspace:*",
+    "@ykdz/template-builtin-presets": "workspace:*",
     "@ykdz/template-checks": "workspace:*",
     "@ykdz/template-core": "workspace:*",
     "@ykdz/template-shared": "workspace:*",
@@ -52,5 +53,10 @@
   "engines": {
     "node": ">=24.0.0"
   },
-  "packageManager": "pnpm@11.11.0"
+  "packageManager": "pnpm@11.11.0",
+  "turbo": {
+    "tags": [
+      "template-root"
+    ]
+  }
 }

packages/builtin-presets/package.json

@@ -0,0 +1,67 @@
+{
+  "name": "@ykdz/template-builtin-presets",
+  "version": "0.0.0",
+  "private": true,
+  "files": [
+    "dist",
+    "templates",
+    "!dist/src/check-*.js",
+    "!dist/src/check-*.d.ts",
+    "!dist/src/registry-checks.js",
+    "!dist/src/registry-checks.d.ts"
+  ],
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/src/index.d.ts",
+      "default": "./dist/src/index.js"
+    }
+  },
+  "scripts": {
+    "build": "rm -rf dist && tsc -p tsconfig.build.json",
+    "check:templates": "pnpm run check:templates:boundary && node src/check-template-source.ts && node src/check-registry-contract.ts && node src/check-publication-source.ts",
+    "check:templates:boundary": "node src/check-template-boundary.ts",
+    "format:check": "oxfmt --list-different --config ../../oxfmt.config.ts .",
+    "format:write": "oxfmt --write --config ../../oxfmt.config.ts .",
+    "lint": "oxlint --quiet --format=unix --config ../../oxlint.config.ts --ignore-pattern dist --ignore-pattern templates .",
+    "lint:fix": "oxlint --format=unix --config ../../oxlint.config.ts --ignore-pattern dist --ignore-pattern templates . --fix",
+    "typecheck": "tsc -p tsconfig.json --noEmit --pretty false"
+  },
+  "dependencies": {
+    "@ykdz/template-core": "workspace:*",
+    "valibot": "catalog:"
+  },
+  "devDependencies": {
+    "@hono/node-server": "catalog:",
+    "@playwright/test": "catalog:",
+    "@tailwindcss/vite": "catalog:",
+    "@types/node": "catalog:",
+    "@types/web-bluetooth": "catalog:",
+    "@vikejs/hono": "catalog:",
+    "@vitejs/plugin-vue": "catalog:",
+    "@vue/tsconfig": "catalog:",
+    "drizzle-kit": "catalog:",
+    "drizzle-orm": "catalog:",
+    "execa": "catalog:",
+    "hono": "catalog:",
+    "oxfmt": "catalog:",
+    "oxlint": "catalog:",
+    "oxlint-tsgolint": "catalog:",
+    "pinia": "catalog:",
+    "tailwindcss": "catalog:",
+    "telefunc": "catalog:",
+    "typescript": "catalog:",
+    "typescript-7": "catalog:",
+    "vike": "catalog:",
+    "vike-vue": "catalog:",
+    "vite": "catalog:",
+    "vitest": "catalog:",
+    "vue": "catalog:",
+    "vue-tsc": "catalog:"
+  },
+  "turbo": {
+    "tags": [
+      "template-builtin-presets"
+    ]
+  }
+}

packages/builtin-presets/src/check-publication-source.ts

@@ -0,0 +1,45 @@
+#!/usr/bin/env node
+import { mkdtemp, readdir, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+import { execa } from "execa";
+
+import { validatePlanPublicationSources } from "./registry-checks.ts";
+
+/** Packs the Built-in Presets package and verifies plan-referenced source ships. */
+export async function checkPresetPublicationSources(): Promise<void> {
+  const packageRoot = path.resolve(
+    path.dirname(fileURLToPath(import.meta.url)),
+    "..",
+  );
+  const destination = await mkdtemp(
+    path.join(tmpdir(), "template-builtin-pack-"),
+  );
+  try {
+    await execa("pnpm", ["pack", "--pack-destination", destination], {
+      cwd: packageRoot,
+    });
+    const archive = (await readdir(destination)).find((file) =>
+      file.endsWith(".tgz"),
+    );
+    if (archive === undefined) {
+      throw new Error("Built-in Presets pack produced no tarball");
+    }
+    const contents = await execa("tar", [
+      "-tf",
+      path.join(destination, archive),
+    ]);
+    validatePlanPublicationSources({
+      packageRoot,
+      packedPaths: contents.stdout.split("\n").filter(Boolean),
+    });
+  } finally {
+    await rm(destination, { recursive: true, force: true });
+  }
+}
+
+if (import.meta.url === `file://${process.argv[1]}`) {
+  await checkPresetPublicationSources();
+}

packages/builtin-presets/src/check-registry-contract.ts

@@ -0,0 +1,20 @@
+#!/usr/bin/env node
+import {
+  deriveVerificationPlans,
+  discoverPresetLocalBehaviorTests,
+  validatePlanDependencyCatalog,
+  validatePlanSources,
+} from "./registry-checks.ts";
+
+/** Registry-only checks; Definition planners are the only catalog input. */
+export async function checkPresetRegistryContract(): Promise<void> {
+  await discoverPresetLocalBehaviorTests();
+  for (const { definition, plan } of deriveVerificationPlans()) {
+    await validatePlanSources({ definition, plan });
+    validatePlanDependencyCatalog(plan);
+  }
+}
+
+if (import.meta.url === `file://${process.argv[1]}`) {
+  await checkPresetRegistryContract();
+}

packages/builtin-presets/src/check-template-boundary.ts

@@ -0,0 +1,55 @@
+#!/usr/bin/env node
+import {
+  checkTemplateSourceBoundary,
+  checkTemplateSourceContexts,
+} from "@ykdz/template-core/template-boundary-check";
+
+import {
+  builtInPresetTemplateSourceContexts,
+  type GeneratedRepositoryPlan,
+} from "./foundation.ts";
+import { deriveVerificationPlans } from "./registry-checks.ts";
+
+/** Checks every real registry initialization and Package Addition plan. */
+export async function checkBuiltInPresetTemplateBoundary(): Promise<void> {
+  const result = await checkTemplateSourceBoundary({
+    templateSourceContexts: await checkTemplateSourceContexts(
+      builtInPresetTemplateSourceContexts(),
+    ),
+    projections: deriveVerificationPlans().flatMap(({ definition, plan }) => {
+      const operationsByPlanner = new Map<
+        string,
+        GeneratedRepositoryPlan["operations"][number][]
+      >();
+      for (const operation of plan.operations) {
+        const planner =
+          operation.provenance?.plannerSourceFile ?? plan.plannerSourceFile;
+        const operations = operationsByPlanner.get(planner) ?? [];
+        operations.push(operation);
+        operationsByPlanner.set(planner, operations);
+      }
+      return [...operationsByPlanner].map(([sourceFilePath, operations]) => ({
+        name: `${definition.metadata.name}:${plan.planningContribution}:${sourceFilePath}`,
+        definitionName: definition.metadata.name,
+        planningContribution: plan.planningContribution,
+        sourceFilePath,
+        plan: { operations },
+      }));
+    }),
+  });
+  if (!result.ok) {
+    throw new Error(
+      [
+        "Template Source Boundary violations:",
+        ...result.violations.map(
+          (violation) =>
+            `- ${violation.owningFunction} generated ${violation.generatedPath} from ${violation.sourceFilePath}`,
+        ),
+      ].join("\n"),
+    );
+  }
+}
+
+if (import.meta.url === `file://${process.argv[1]}`) {
+  await checkBuiltInPresetTemplateBoundary();
+}