feat: run orphaned checks — template-standard CI validation and scripts/ type-checking (#483) - #491

… RTL direction, CI hardening

- MFE screens: re-read theme/language when the host swaps the bridge
  instance (lazy initializers only run on mount), via render-time
  adjustment; extracted readBridgeProperty helper.
- Set the Shadow-DOM host dir from an effect keyed by language instead
  of inside the subscription callback — the initial language (e.g. an
  MFE first rendered in ar/he/fa/ur) never fires a callback, so RTL was
  only applied after a language change.
- template-validate job: permissions contents:read and
  persist-credentials:false on checkout.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Vuk D. <davydowiktor@gmail.com>

… comment and marker fixes (review round 1 on constructorfabric#491)

- useApiStream: pin the new status contract with tests — first render
  reports 'connecting' when enabled (no idle flash), and disable→re-enable
  clears stale data and reconnects through 'connecting'.
- HomeScreen: test the bridge-swap path — current properties are re-read
  during render when the host swaps the bridge instance, old subscriptions
  torn down and re-registered on the new one.
- useCanAccess: hoist the no-auth-runtime denial to a module-level
  DENIED_NO_AUTH constant so the result keeps a stable identity across
  renders instead of allocating a fresh object each time.
- template-validate workflow: correct the file:-link depths in the comment
  (../packages/* from the template root, ../../../packages/* from nested
  template packages — not ../../packages/*).
- useCanAccess: add an inst-pending-effect marker region around the
  render-time re-pessimization so the relocated half of that instruction
  stays traced; cfs validate passes before and after.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…ts/ type-checking (constructorfabric#483)

Part 1: new template-validate CI job builds the ecosystem packages the
templates file:-link, then globs template-*/ and runs each template's own
npm ci + build + arch:deps + lint + test:unit. Fixes the two breakages the
newly-enforced checks surfaced: template imports of FRONTX_ACTION_* re-pointed
from @gears-frontx/mfes to @gears-frontx/gts-plugin, and 15 react-hooks v6
lint errors fixed with behavior-preserving restructures.

Part 2: scripts/ is now type-checked via tsconfig.scripts.json wired into
type-check:all; the ~48-error backlog fixed with type-only changes. Also
widens the check-json pre-commit exclude to tsconfig*.json (JSONC).

Review round 1 (constructorfabric#491): tests pinning the useApiStream status contract and
the bridge-swap re-read path, stable DENIED_NO_AUTH identity in useCanAccess,
corrected file:-link depths in the workflow comment, and an added
inst-pending-effect marker region over the render-time re-pessimization.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Vuk D. <davydowiktor@gmail.com>

Review follow-ups on constructorfabric#491.

1. scripts/ has 183 vitest tests across 4 files that nothing ran. test:unit
   fans out to the npm workspaces via run-monorepo-unit-tests.mjs and scripts/
   is not a workspace, so no project ever collected them — including the tests
   this very PR adds to three of those files. Added vitest.scripts.config.ts
   and chained test:unit:scripts into test:unit, so CI picks it up with no
   workflow change. All 183 pass as-is.

2. Removed the dead "Install MFE dependencies" step. It looped over
   src/mfe_packages/*/, a path that has not existed since the MFEs moved under
   the templates, and fed a root type-check:mfe script that no longer exists.
   Deleted rather than repointed — the MFE packages are template content and
   template-validate now installs and checks them. (gs-layer)

3. template-validate now classifies templates by what their manifest claims
   rather than by a -f package.json test. constructorfabric#489 adds a root package.json to
   template-mfe as a monorepo-only build harness, deliberately undeclared so it
   never ships; the disk test would route the overlay down the self-contained
   path and fail on scripts a harness has no reason to define. Verified both
   ways: with a stub harness in place the old guard calls template-mfe
   self-contained, the manifest classifier still calls it an overlay.

   This is gs-layer's option (1) problem solved without option (1)'s cost —
   no --if-present on arch:deps/lint/test:unit, so a real template that loses
   a script still fails loudly instead of going quietly unchecked.

4. Added `npm run type-check` to both template paths — it was the one script
   the job left orphaned, which itechmeat flagged as contradicting the PR's own
   premise. It ends in type-check:mfe, vacuous standalone and real in the
   composed run.

5. Comment corrections: the data-table eslint-disable no longer claims the rule
   only means "skipped by compilation" — it also covers passing `table` to
   DataTablePagination, now stated with why that is accepted (gs-layer); and
   UIKitElementsScreen no longer says direction comes from useScreenTranslations
   when the effect below owns it (itechmeat).

Verified: root type-check:all, lint, test:unit (now incl. 183 scripts tests),
arch:check; and the full template-validate job step by step — classify, the
self-contained run, and the composed run (4 MFEs type-checked, both
test-bearing MFEs run).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

The last two orphaned template scripts itechmeat asked about on constructorfabric#491. Both
template paths now run `npm run build` instead of just build:package plus
build:packages, which additionally chains build:mfes, generate:mfe-manifests
and vite build — none of which anything in CI ran. It runs first so the later
checks see the generated manifests.

Not a scope cut after all: I had assumed a full vite build was too expensive to
add, and measuring said otherwise — 1:12 for the standalone template, 2:03 for
the composed one, and both were already green.

Standalone degrades cleanly (build-mfes.ts and generate-mfe-manifests.ts both
report zero packages and skip); the composed run builds all four MFEs and the
host bundle.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…tructorfabric#483)

Several checks in this repo existed but nothing ran them. Each is a script or
suite someone wrote deliberately, wired to nothing, quietly rotting.

Templates. Each template tree carries its own arch:deps / lint / test:unit /
type-check / build, and no workflow entered those trees, so they were enforced
only by hand. The new template-validate job covers both halves of the constructorfabric#470
split, classifying templates by what their manifests claim rather than by what
sits on disk:

  - self-contained (template-shell, which declares package.json among its
    ownership boundaries) is validated standalone;
  - add-only overlays (template-mfe) are composed onto the shell the way
    `frontx add` does and validated as the union. They cannot be checked in
    place: their file:../../../packages/* links resolve to a template-mfe/
    packages/ that does not exist, their vitest configs import the shell's
    src-app/vitest.mfe.base, and template-mfe has no eslint config of its own.

Reading manifests rather than testing for a file on disk matters because constructorfabric#489
adds a root package.json to template-mfe as a monorepo-only build harness,
deliberately undeclared so it never ships into a seeded project. A -f test
would route the overlay down the self-contained path and fail on scripts a
harness has no reason to define. The alternative — relaxing arch:deps / lint /
test:unit to --if-present — would let a real template lose a script and go
quietly unchecked, which is the failure this job exists to prevent.

Composition subtrees come from each overlay's own exclusiveSubtrees, mirroring
the assembler (packages/cli/src/scaffold/assembler.ts). Every check is a silent
no-op if the overlay fails to land, so the step asserts a non-zero MFE package
count before running anything.

Newly-enforced template lint surfaced 15 react-hooks v6 errors, fixed here with
behaviour-preserving restructures across the MFE screens and the react package.

scripts/. Two separate gaps. The tooling is now type-checked via
tsconfig.scripts.json wired into type-check:all — it runs under tsx, which
strips types without checking them, so a type error in an architecture guard
surfaced only as a runtime failure; the ~48-error backlog is fixed with
type-only changes. Separately, scripts/ ships 183 vitest tests across 4 files
that no project collected, because test:unit fans out to the npm workspaces and
scripts/ is not one. vitest.scripts.config.ts gives them a home, chained into
test:unit; all 183 pass unchanged.

Also removed the "Install MFE dependencies" step, which looped over
src/mfe_packages/*/ — a path gone since the MFEs moved under the templates —
feeding a root type-check:mfe script that no longer exists. And widened the
check-json pre-commit exclude to tsconfig*.json, which is JSONC.

Review rounds on constructorfabric#491: tests pinning the useApiStream status contract and the
bridge-swap re-read path; stable DENIED_NO_AUTH identity in useCanAccess; an
inst-pending-effect marker over the render-time re-pessimization; the template's
own type-check and full build (build:mfes, generate:mfe-manifests, vite build)
added to both paths after measuring the cost at 1:12 standalone and 2:03
composed; and corrected justifications on the data-table eslint-disable and the
UIKitElementsScreen direction comment.

Follow-up on the bridge/RTL logic duplicated across five screens: constructorfabric#502.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Signed-off-by: Vuk D. <davydowiktor@gmail.com>

…tructorfabric#483)

Several checks in this repo existed but nothing ran them. Each is a script or
suite someone wrote deliberately, wired to nothing, quietly rotting.

Templates. Each template tree carries its own arch:deps / lint / test:unit /
type-check / build, and no workflow entered those trees, so they were enforced
only by hand. The new template-validate job covers both halves of the constructorfabric#470
split, classifying templates by what their manifests claim rather than by what
sits on disk:

  - self-contained (template-shell, which declares package.json among its
    ownership boundaries) is validated standalone;
  - add-only overlays (template-mfe) are composed onto the shell the way
    `frontx add` does and validated as the union. They cannot be checked in
    place: their file:../../../packages/* links resolve to a template-mfe/
    packages/ that does not exist, their vitest configs import the shell's
    src-app/vitest.mfe.base, and template-mfe has no eslint config of its own.

Reading manifests rather than testing for a file on disk matters because constructorfabric#489
adds a root package.json to template-mfe as a monorepo-only build harness,
deliberately undeclared so it never ships into a seeded project. A -f test
would route the overlay down the self-contained path and fail on scripts a
harness has no reason to define. The alternative — relaxing arch:deps / lint /
test:unit to --if-present — would let a real template lose a script and go
quietly unchecked, which is the failure this job exists to prevent.

Composition subtrees come from each overlay's own exclusiveSubtrees, mirroring
the assembler (packages/cli/src/scaffold/assembler.ts). Every check is a silent
no-op if the overlay fails to land, so the step asserts a non-zero MFE package
count before running anything.

Newly-enforced template lint surfaced 15 react-hooks v6 errors, fixed here with
behaviour-preserving restructures across the MFE screens and the react package.

scripts/. Two separate gaps. The tooling is now type-checked via
tsconfig.scripts.json wired into type-check:all — it runs under tsx, which
strips types without checking them, so a type error in an architecture guard
surfaced only as a runtime failure; the ~48-error backlog is fixed with
type-only changes. Separately, scripts/ ships 183 vitest tests across 4 files
that no project collected, because test:unit fans out to the npm workspaces and
scripts/ is not one. vitest.scripts.config.ts gives them a home, chained into
test:unit; all 183 pass unchanged.

Also removed the "Install MFE dependencies" step, which looped over
src/mfe_packages/*/ — a path gone since the MFEs moved under the templates —
feeding a root type-check:mfe script that no longer exists. And widened the
check-json pre-commit exclude to tsconfig*.json, which is JSONC.

Review rounds on constructorfabric#491: tests pinning the useApiStream status contract and the
bridge-swap re-read path; stable DENIED_NO_AUTH identity in useCanAccess; an
inst-pending-effect marker over the render-time re-pessimization; the template's
own type-check and full build (build:mfes, generate:mfe-manifests, vite build)
added to both paths after measuring the cost at 1:12 standalone and 2:03
composed; and corrected justifications on the data-table eslint-disable and the
UIKitElementsScreen direction comment.

Follow-up on the bridge/RTL logic duplicated across five screens: constructorfabric#502.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Signed-off-by: Vuk D. <davydowiktor@gmail.com>

…ryFactory exists on the registry

6a50d21 renamed packages/mfes's public factory export from
DefaultMfeRegistryFactory to createMfeRegistryFactory (keeping the
concrete factory off the public surface per ADR-0003) but never bumped
the package version, so the published 0.3.0-alpha.1 tarball still only
has the old export. template-shell/packages/framework/src/mfe/registry.ts
already imports the new name, so any template build that installs the
pinned registry version (not this repo's local workspace source) fails
with "has no exported member named 'createMfeRegistryFactory'" — caught
by the Template Validate job PR constructorfabric#491 wires up.

gts-plugin exactly pins @gears-frontx/mfes and is force-sorted right
after it in the publish workflow, so it bumps in lockstep here too,
mirroring the original 0.3.0-alpha.1 pair (constructorfabric#492).

Every site pinning the pair to the exact registry version moves onto
0.3.0-alpha.2 in the same commit, keeping policy:template-pin-drift
green: template-shell/package.json,
template-shell/packages/framework/package.json, and the three
template-mfe fixture manifests that declare the pair directly
(_blank-mfe, widgets-fixture-a, widgets-fixture-b).

Also bumps template-shell's own version (package.json +
frontx-template.json) since detect-template in publish-packages.yml
only builds/validates a template when its own version changes between
pushes — and cascades that bump into the four template-mfe fixtures
(_blank-mfe, demo-mfe, widgets-fixture-a, widgets-fixture-b) that pin
@gears-frontx/frontx-template-shell exactly, which would otherwise
drift the moment the shell's version moves.

NOT included: template-shell/package-lock.json. Its node_modules
entries for @gears-frontx/mfes and @gears-frontx/gts-plugin carry a
real resolved tarball URL and integrity hash that only exist once
0.3.0-alpha.2 is actually published — hand-editing them now would
either fabricate a wrong integrity (npm ci refuses on mismatch) or
leave stale alpha.1 data that contradicts the manifest (npm ci refuses
on drift either way). Regenerate via a real `npm install` against the
live registry once this merges and publishes (the same two-merge
sequence constructorfabric#485/constructorfabric#492 needed), then commit the result.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Vuk D. <davydowiktor@gmail.com>

…torfabric#531)

.github/workflows/main.yml: drop the "Install MFE dependencies" step —
its src/mfe_packages/*/ glob predates constructorfabric#470's split and never matches;
root package.json only workspaces packages/* and internal/*, so the
step never fed any downstream root check anyway. MFE package deps are
installed by each template's own npm ci inside the template-validate
job (constructorfabric#491), which already covers this.

knip.json: repoint the root workspace's entry/project/ignore globs from
the pre-split src/ tree at scripts/**, the only thing knip's root scope
still owns; drop ignoreDependencies and ignoreIssues entries that named
now-removed src/ paths. Clears arch:check's three "no matches"/"remove
from ignoreDependencies" configuration hints.

Signed-off-by: G S <grigoriis.dev@gmail.com>

…ryFactory exists on the registry

6a50d21 renamed packages/mfes's public factory export from
DefaultMfeRegistryFactory to createMfeRegistryFactory (keeping the
concrete factory off the public surface per ADR-0003) but never bumped
the package version, so the published 0.3.0-alpha.1 tarball still only
has the old export. template-shell/packages/framework/src/mfe/registry.ts
already imports the new name, so any template build that installs the
pinned registry version (not this repo's local workspace source) fails
with "has no exported member named 'createMfeRegistryFactory'" — caught
by the Template Validate job PR #491 wires up.

gts-plugin exactly pins @gears-frontx/mfes and is force-sorted right
after it in the publish workflow, so it bumps in lockstep here too,
mirroring the original 0.3.0-alpha.1 pair (#492).

Every site pinning the pair to the exact registry version moves onto
0.3.0-alpha.2 in the same commit, keeping policy:template-pin-drift
green: template-shell/package.json,
template-shell/packages/framework/package.json, and the three
template-mfe fixture manifests that declare the pair directly
(_blank-mfe, widgets-fixture-a, widgets-fixture-b).

Also bumps template-shell's own version (package.json +
frontx-template.json) since detect-template in publish-packages.yml
only builds/validates a template when its own version changes between
pushes — and cascades that bump into the four template-mfe fixtures
(_blank-mfe, demo-mfe, widgets-fixture-a, widgets-fixture-b) that pin
@gears-frontx/frontx-template-shell exactly, which would otherwise
drift the moment the shell's version moves.

NOT included: template-shell/package-lock.json. Its node_modules
entries for @gears-frontx/mfes and @gears-frontx/gts-plugin carry a
real resolved tarball URL and integrity hash that only exist once
0.3.0-alpha.2 is actually published — hand-editing them now would
either fabricate a wrong integrity (npm ci refuses on mismatch) or
leave stale alpha.1 data that contradicts the manifest (npm ci refuses
on drift either way). Regenerate via a real `npm install` against the
live registry once this merges and publishes (the same two-merge
sequence #485/#492 needed), then commit the result.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Vuk D. <davydowiktor@gmail.com>

…ts/ type-checking (constructorfabric#483)

Adds two CI gates that previously ran only by hand:

- `template-validate` job: validates template-shell standalone and
  template-mfe composed onto template-shell (build, type-check,
  arch:deps, lint, test:unit for both), classifying templates by what
  their manifest CLAIMS rather than disk presence.
- `type-check:scripts` (tsconfig.scripts.json), wired into
  `type-check:all` and CI's TypeScript validation step, so `scripts/`
  gets the same type coverage as the rest of the monorepo.

Includes fixes from @itechmeat's review of constructorfabric#491:
- Structural FileSystemLike typing for link-template-ecosystem.mjs's
  injected fs, needed once type-check:scripts started covering it —
  re-ported onto constructorfabric#518's rewrite of the script during rebase. The gate
  paid for itself immediately: it caught the rewrite's rollback message
  printing a literal "undefined" recovery line when every package was
  restored (recoveryLine assigned in two of three branches), fixed here.
- JSDoc annotations for constructorfabric#493's new scripts (validate-templates,
  template-discovery, template-ecosystem-packages, template-pin-drift)
  and their tests, which predate the type-check:scripts gate.
- template-shell's ecosystem pins moved to 0.3.0-alpha.1 (the
  FRONTX_ACTION_*/DomainContext.typeSystem move constructorfabric#485 recorded), and a
  lockfile self-link entry corrupted independently in develop, fixed.
  Also synced the lockfile to develop's api alpha.1 pin bump (309d77f
  updated package.json only — nothing on develop runs `npm ci` inside
  the template, so the desync was green there and red on this job's
  first standalone install).
- Classify/compose steps refuse a non-empty ownershipBoundaries.sharedFiles
  instead of half-implementing the merge-strategy contract; the overlay
  MFE-package count is per-overlay (from the manifest's own subtree paths)
  instead of one aggregate that could mask a broken overlay behind a
  working one; the composed lockfile cleanup reads the same subtree paths
  instead of hardcoding mfe_packages.
- Workflow-level `permissions: contents: read` and
  `persist-credentials: false` on every checkout, not just
  template-validate's.
- template-validate drops `npm run build:packages`: with the pins on
  registry tarballs, nothing in the job reads the workspace packages'
  dist/ output.
- useCanAccess.ts/useScreenTranslations.ts @cpt- marker regions no
  longer duplicate or drop the behavior they're supposed to trace;
  inst-pending-effect marks the one render-time re-pessimize site.
- Shared DirEntryLike typedef (scripts/fs-types.mjs) instead of two
  independently-drifting copies.
- Comment sweep: change-history framing ("used to", "previously",
  constructorfabric#485's alpha.0-to-alpha.1 story told twice) rewritten as present-tense
  descriptions of the code that is there.

- template-shell's .dependency-cruiser.cjs matches node_modules at any
  depth in doNotFollow, not just the root: the composed tree nests a
  node_modules under each overlaid src-app/mfe_packages/* workspace, and
  the anchored pattern let dependency-cruiser traverse the entire
  installed dependency universe — OOM at the default heap. Standalone
  370 modules, composed 532, both green.

Version bumps (alpha) for the packages this change touches:
frontx-template-shell 0.1.0-alpha.2 (develop took alpha.1 for the constructorfabric#476
pin fix); framework, react, blank-mfe, demo-mfe 0.2.0-alpha.1.

Deferred to follow-ups, tracked in constructorfabric#502, constructorfabric#515, constructorfabric#516: the RTL/bridge-resync
duplication across five MFE screens, a shared useLatest helper for three
deps-less ref-write effects (blocked on eslint-plugin-react-hooks not
recognizing custom-hook-returned refs), and documenting useApiStream's
status lifecycle against architecture/.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Vuk D. <davydowiktor@gmail.com>

… deferred

#535 bumped @gears-frontx/mfes and @gears-frontx/gts-plugin to
0.3.0-alpha.2 (and template-shell's own version to 0.1.0-alpha.2)
across the template manifests, but deliberately left both template
lockfiles untouched: the alpha.2 tarball URL and integrity hash did
not exist until that PR merged and published. Its commit message asks
for exactly this follow-up. Until it lands, npm ci in template-shell
fails with 'lock file's @gears-frontx/gts-plugin@0.3.0-alpha.1 does
not satisfy 0.3.0-alpha.2', which is what currently fails the
Template Validate job on PR #491's rebase.

Rather than regenerating with npm install (which drops the file:
self-link entry — the trap bab4fec documented), this patches the
lockfiles surgically:

- template-shell/package-lock.json: the mfes and gts-plugin
  node_modules entries get the alpha.2 version, resolved URL, and the
  registry's real integrity hashes (from npm view dist.integrity),
  plus the two manifest-mirror blocks (root and packages/framework).
- template-mfe/package-lock.json: mirror-only — mfes/gts-plugin pins
  to 0.3.0-alpha.2 and frontx-template-shell to 0.1.0-alpha.2 in the
  four fixture mirror blocks; the packages themselves resolve to
  local links there.

Verified: rm -rf node_modules && npm ci exits 0 in template-shell
with the self-link intact and alpha.2 installed; npm ci --dry-run
passes in template-mfe; npm run build -w packages/framework (the DTS
build Template Validate died on) passes; policy:version-check and
policy:template-pin-drift both pass.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Vuk D. <davydowiktor@gmail.com>

…ts/ type-checking (constructorfabric#483)

Adds two CI gates that previously ran only by hand:

- `template-validate` job: validates template-shell standalone and
  template-mfe composed onto template-shell (build, type-check,
  arch:deps, lint, test:unit for both), classifying templates by what
  their manifest CLAIMS rather than disk presence.
- `type-check:scripts` (tsconfig.scripts.json), wired into
  `type-check:all` and CI's TypeScript validation step, so `scripts/`
  gets the same type coverage as the rest of the monorepo.

Includes fixes from @itechmeat's review of constructorfabric#491:
- Structural FileSystemLike typing for link-template-ecosystem.mjs's
  injected fs, needed once type-check:scripts started covering it —
  re-ported onto constructorfabric#518's rewrite of the script during rebase. The gate
  paid for itself immediately: it caught the rewrite's rollback message
  printing a literal "undefined" recovery line when every package was
  restored (recoveryLine assigned in two of three branches), fixed here.
- JSDoc annotations for constructorfabric#493's new scripts (validate-templates,
  template-discovery, template-ecosystem-packages, template-pin-drift)
  and their tests, which predate the type-check:scripts gate.
- template-shell's ecosystem pins moved to 0.3.0-alpha.1 (the
  FRONTX_ACTION_*/DomainContext.typeSystem move constructorfabric#485 recorded), and a
  lockfile self-link entry corrupted independently in develop, fixed.
  Also synced the lockfile to develop's api alpha.1 pin bump (309d77f
  updated package.json only — nothing on develop runs `npm ci` inside
  the template, so the desync was green there and red on this job's
  first standalone install).
- Classify/compose steps refuse a non-empty ownershipBoundaries.sharedFiles
  instead of half-implementing the merge-strategy contract; the overlay
  MFE-package count is per-overlay (from the manifest's own subtree paths)
  instead of one aggregate that could mask a broken overlay behind a
  working one; the composed lockfile cleanup reads the same subtree paths
  instead of hardcoding mfe_packages.
- Workflow-level `permissions: contents: read` and
  `persist-credentials: false` on every checkout, not just
  template-validate's.
- template-validate drops `npm run build:packages`: with the pins on
  registry tarballs, nothing in the job reads the workspace packages'
  dist/ output.
- useCanAccess.ts/useScreenTranslations.ts @cpt- marker regions no
  longer duplicate or drop the behavior they're supposed to trace;
  inst-pending-effect marks the one render-time re-pessimize site.
- Shared DirEntryLike typedef (scripts/fs-types.mjs) instead of two
  independently-drifting copies.
- Comment sweep: change-history framing ("used to", "previously",
  constructorfabric#485's alpha.0-to-alpha.1 story told twice) rewritten as present-tense
  descriptions of the code that is there.

- template-shell's .dependency-cruiser.cjs matches node_modules at any
  depth in doNotFollow, not just the root: the composed tree nests a
  node_modules under each overlaid src-app/mfe_packages/* workspace, and
  the anchored pattern let dependency-cruiser traverse the entire
  installed dependency universe — OOM at the default heap. Standalone
  370 modules, composed 532, both green.

Version bumps (alpha) for the packages this change touches:
frontx-template-shell 0.1.0-alpha.2 (develop took alpha.1 for the constructorfabric#476
pin fix); framework, react, blank-mfe, demo-mfe 0.2.0-alpha.1.

Deferred to follow-ups, tracked in constructorfabric#502, constructorfabric#515, constructorfabric#516: the RTL/bridge-resync
duplication across five MFE screens, a shared useLatest helper for three
deps-less ref-write effects (blocked on eslint-plugin-react-hooks not
recognizing custom-hook-returned refs), and documenting useApiStream's
status lifecycle against architecture/.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Vuk D. <davydowiktor@gmail.com>

…torfabric#531)

.github/workflows/main.yml: drop the "Install MFE dependencies" step.
Its src/mfe_packages/*/ glob predates constructorfabric#470's split and matches nothing
at base or head. Independent of the dead glob: the type-check:mfe
script the deleted comment named lives only in template-shell's own
package.json now, not root's, and neither template-mfe/src-app/
mfe_packages/* nor template-shell/src-app/mfe_packages/* carries a
per-package package-lock.json — so even a correctly repointed loop's
`-f package-lock.json` guard would skip every directory. Nothing in
the root `validate` job installs or consumes MFE package deps today,
so deleting is safe on develop as it stands, independent of constructorfabric#491's
still-unmerged template-validate job (once merged, that job's
per-template npm ci is where MFE deps actually get installed).

knip.json: repoint the root workspace's entry/project/ignore globs from
the pre-split src/ tree at scripts/**, the only thing knip's root scope
still owns. Also drop ignoreDependencies (@types/*,
@gears-frontx/depcruise-config/*) and the ignoreIssues entry for
*Screen.tsx, plus three dead global ignore globs (eslint-plugin-local/**,
vite.config.ts, .eslintrc.cjs) naming removed src/-era paths. Verified
no regression: `npm run arch:unused`'s finding set is byte-identical
before and after — dropping ignoreDependencies does not surface
@gears-frontx/depcruise-config (knip's dependency-cruiser plugin
already resolves packages/api/.dependency-cruiser.cjs's require() of
it) or @types/lodash (unused either way) as new findings. Clears
arch:check's three "no matches"/"remove from ignoreDependencies"
configuration hints.

Signed-off-by: G S <grigoriis.dev@gmail.com>

…int rules

Two develop-side changes broke template-mfe under the composed template
validation that PR constructorfabric#491 wires up (nothing on develop runs it, so both
drifted silently):

- 3ea1ee9 moved template-shell to @types/react 19.2.18 (useEffectEvent
  needs it) while the four MFE fixture manifests still pinned 19.0.8.
  Composed, the tree installs both copies and _blank-mfe's type-check
  dies in button.tsx with TS2786/TS2322 (Radix Slot typed against one
  copy, the component's ref against the other). All four manifests and
  the template-mfe lockfile (mirrors + hoisted entry, registry
  integrity) move to 19.2.18.

- The composed eslint run resolves eslint-plugin-react-hooks 7.1.1
  upward from the repo root, and its recommended set flags the MFE
  screens' bridge-resync pattern (set-state-in-effect) — the same
  violations constructorfabric#491 fixed in the shell's own hooks and deferred for the
  five MFE screens. Fixed with the same patterns the shell uses:

  - HomeScreen (_blank), HelloWorldScreen, CurrentThemeScreen,
    ProfileScreen, UIKitElementsScreen: initial theme/language read in
    lazy useState initializers (first paint now reflects the host's
    shared properties) with the effect reduced to subscriptions.
  - ProfileDetailsCard, date-picker: 'adjusting state during render'
    (react.dev) with a prev-key comparison instead of a sync-with-props
    effect.
  - data-table: targeted eslint-disable for
    react-hooks/incompatible-library — TanStack Table's useReactTable
    is documented as uncompilable, and the composed lint runs with
    --max-warnings 0.

CodeRabbit's review then flagged that the four bridge-synced screens
never apply the text direction for the initial language — only the
subscription callbacks set dir, so an initially-RTL host renders LTR
until the next language event. That gap predates this PR, but with
language now correct from the first render the fix is natural: each
screen gets one effect keyed on the language state that applies the
shadow-host dir after commit, covering the initial value and every
later change. That effect subsumes the per-callback dir duplication
(callbacks shrink to setLanguage) and collapses UIKitElementsScreen's
separate initial-dir bridge read into the same shared shape.

Verified on a locally composed shell+overlay tree (the same copy,
lockfile-drop, npm install sequence as the CI job): npm run build,
type-check, and lint on src-app/mfe_packages are clean, and test:unit
passes 627 tests across all workspaces including the four MFEs.
npm ci --dry-run passes in template-mfe; policy:version-check and
policy:template-pin-drift stay green.

Unblocks the composed half of Template Validate on constructorfabric#491.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Vuk D. <davydowiktor@gmail.com>

…int rules

Two develop-side changes broke template-mfe under the composed template
validation that PR #491 wires up (nothing on develop runs it, so both
drifted silently):

- 3ea1ee9 moved template-shell to @types/react 19.2.18 (useEffectEvent
  needs it) while the four MFE fixture manifests still pinned 19.0.8.
  Composed, the tree installs both copies and _blank-mfe's type-check
  dies in button.tsx with TS2786/TS2322 (Radix Slot typed against one
  copy, the component's ref against the other). All four manifests and
  the template-mfe lockfile (mirrors + hoisted entry, registry
  integrity) move to 19.2.18.

- The composed eslint run resolves eslint-plugin-react-hooks 7.1.1
  upward from the repo root, and its recommended set flags the MFE
  screens' bridge-resync pattern (set-state-in-effect) — the same
  violations #491 fixed in the shell's own hooks and deferred for the
  five MFE screens. Fixed with the same patterns the shell uses:

  - HomeScreen (_blank), HelloWorldScreen, CurrentThemeScreen,
    ProfileScreen, UIKitElementsScreen: initial theme/language read in
    lazy useState initializers (first paint now reflects the host's
    shared properties) with the effect reduced to subscriptions.
  - ProfileDetailsCard, date-picker: 'adjusting state during render'
    (react.dev) with a prev-key comparison instead of a sync-with-props
    effect.
  - data-table: targeted eslint-disable for
    react-hooks/incompatible-library — TanStack Table's useReactTable
    is documented as uncompilable, and the composed lint runs with
    --max-warnings 0.

CodeRabbit's review then flagged that the four bridge-synced screens
never apply the text direction for the initial language — only the
subscription callbacks set dir, so an initially-RTL host renders LTR
until the next language event. That gap predates this PR, but with
language now correct from the first render the fix is natural: each
screen gets one effect keyed on the language state that applies the
shadow-host dir after commit, covering the initial value and every
later change. That effect subsumes the per-callback dir duplication
(callbacks shrink to setLanguage) and collapses UIKitElementsScreen's
separate initial-dir bridge read into the same shared shape.

Verified on a locally composed shell+overlay tree (the same copy,
lockfile-drop, npm install sequence as the CI job): npm run build,
type-check, and lint on src-app/mfe_packages are clean, and test:unit
passes 627 tests across all workspaces including the four MFEs.
npm ci --dry-run passes in template-mfe; policy:version-check and
policy:template-pin-drift stay green.

Unblocks the composed half of Template Validate on #491.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Vuk D. <davydowiktor@gmail.com>

…ts/ type-checking (constructorfabric#483)

Adds two CI gates that previously ran only by hand:

- `template-validate` job: validates template-shell standalone and
  template-mfe composed onto template-shell (build, type-check,
  arch:deps, lint, test:unit for both), classifying templates by what
  their manifest CLAIMS rather than disk presence.
- `type-check:scripts` (tsconfig.scripts.json), wired into
  `type-check:all` and CI's TypeScript validation step, so `scripts/`
  gets the same type coverage as the rest of the monorepo.

Includes fixes from @itechmeat's review of constructorfabric#491:
- Structural FileSystemLike typing for link-template-ecosystem.mjs's
  injected fs, needed once type-check:scripts started covering it —
  re-ported onto constructorfabric#518's rewrite of the script during rebase. The gate
  paid for itself immediately: it caught the rewrite's rollback message
  printing a literal "undefined" recovery line when every package was
  restored (recoveryLine assigned in two of three branches), fixed here.
- JSDoc annotations for constructorfabric#493's new scripts (validate-templates,
  template-discovery, template-ecosystem-packages, template-pin-drift)
  and their tests, which predate the type-check:scripts gate.
- template-shell's ecosystem pins moved to 0.3.0-alpha.1 (the
  FRONTX_ACTION_*/DomainContext.typeSystem move constructorfabric#485 recorded), and a
  lockfile self-link entry corrupted independently in develop, fixed.
  Also synced the lockfile to develop's api alpha.1 pin bump (309d77f
  updated package.json only — nothing on develop runs `npm ci` inside
  the template, so the desync was green there and red on this job's
  first standalone install).
- Classify/compose steps refuse a non-empty ownershipBoundaries.sharedFiles
  instead of half-implementing the merge-strategy contract; the overlay
  MFE-package count is per-overlay (from the manifest's own subtree paths)
  instead of one aggregate that could mask a broken overlay behind a
  working one; the composed lockfile cleanup reads the same subtree paths
  instead of hardcoding mfe_packages.
- Workflow-level `permissions: contents: read` and
  `persist-credentials: false` on every checkout, not just
  template-validate's.
- template-validate drops `npm run build:packages`: with the pins on
  registry tarballs, nothing in the job reads the workspace packages'
  dist/ output.
- useCanAccess.ts/useScreenTranslations.ts @cpt- marker regions no
  longer duplicate or drop the behavior they're supposed to trace;
  inst-pending-effect marks the one render-time re-pessimize site.
- Shared DirEntryLike typedef (scripts/fs-types.mjs) instead of two
  independently-drifting copies.
- Comment sweep: change-history framing ("used to", "previously",
  constructorfabric#485's alpha.0-to-alpha.1 story told twice) rewritten as present-tense
  descriptions of the code that is there.

- template-shell's .dependency-cruiser.cjs matches node_modules at any
  depth in doNotFollow, not just the root: the composed tree nests a
  node_modules under each overlaid src-app/mfe_packages/* workspace, and
  the anchored pattern let dependency-cruiser traverse the entire
  installed dependency universe — OOM at the default heap. Standalone
  370 modules, composed 532, both green.

Version bumps (alpha) for the packages this change touches:
frontx-template-shell 0.1.0-alpha.2 (develop took alpha.1 for the constructorfabric#476
pin fix); framework, react, blank-mfe, demo-mfe 0.2.0-alpha.1.

Deferred to follow-ups, tracked in constructorfabric#502, constructorfabric#515, constructorfabric#516: the RTL/bridge-resync
duplication across five MFE screens, a shared useLatest helper for three
deps-less ref-write effects (blocked on eslint-plugin-react-hooks not
recognizing custom-hook-returned refs), and documenting useApiStream's
status lifecycle against architecture/.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Vuk D. <davydowiktor@gmail.com>

…ed hooks (constructorfabric#502)

Extract the RTL_LANGUAGES const, the readBridgeProperty helper, the
prevBridge render-time re-read block, and the host dir effect — pasted
verbatim into four demo-mfe screens by constructorfabric#491 — into two shared hooks:

- useBridgeProperty(bridge, propertyId, fallback): lazy initial read,
  bridge-swap resync during render, and change subscription. The module
  doc explains why it is not useSyncExternalStore (non-string updates
  keep the last string value), how it differs from useSharedProperty in
  @gears-frontx/react, and that propertyId must stay constant.
- useHostDirection(containerRef, language): Shadow DOM host dir sync,
  with a readonly RTL_LANGUAGES and the reason for the forced
  HTMLElement cast.

The bridge-swap behaviour is now pinned once by useBridgeProperty's own
tests instead of per-screen; the tests are split per behaviour and cover
the truly-unset and non-string-value inputs, and useHostDirection's tests
use a real shadow root with afterEach host cleanup. The _blank-mfe copy
stays inline per the issue: no-cross-mfe-imports forbids importing from
demo-mfe, and the per-MFE src/shared/ duplication is the existing
convention.

Residue @cpt- markers are stripped from the modified template screens
(ADR-0033: template-territory markers are non-authoritative residue
removed when a file is otherwise modified).

Closes constructorfabric#502

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Signed-off-by: Vuk D. <davydowiktor@gmail.com>

…ared hooks (constructorfabric#502)

Extract the RTL_LANGUAGES const, the readBridgeProperty helper, the
property subscription, and the host dir effect — pasted verbatim into
four demo-mfe screens by constructorfabric#491 — into two shared hooks:

- useBridgeProperty<T>(bridge, propertyId, fallback): lazy initial read
  and change subscription with cleanup. The value is passed through as
  the caller's T; schema validation belongs to the type-system plugin,
  so the hook does no runtime type filtering. The module doc explains
  how it differs from useSharedProperty in @gears-frontx/react.
- useHostDirection(containerRef, language): Shadow DOM host dir sync,
  with a readonly RTL_LANGUAGES and the reason for the forced
  HTMLElement cast.

The prevBridge render-time resync the screens carried is dropped rather
than extracted: the runtime retains one bridge per extension across
every mount/unmount cycle (MfeBridge contract in @gears-frontx/mfes
handler types) and ThemeAwareReactLifecycle renders a fresh root per
mount, so a mounted screen never sees a different bridge instance. The
four screen tests pinning that swap are removed with it.

useBridgeProperty's tests cover initial read, fallback when the
property is not yet published, non-string pass-through, update
propagation, and unsubscribe on unmount; useHostDirection's tests use a
real shadow root with afterEach host cleanup. The _blank-mfe copy stays
inline per the issue: no-cross-mfe-imports forbids importing from
demo-mfe, and the per-MFE src/shared/ duplication is the existing
convention.

Residue @cpt- markers are stripped from the modified template screens
(ADR-0033: template-territory markers are non-authoritative residue
removed when a file is otherwise modified).

Closes constructorfabric#502

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Signed-off-by: Vuk D. <davydowiktor@gmail.com>

…ared hooks (#502)

Extract the RTL_LANGUAGES const, the readBridgeProperty helper, the
property subscription, and the host dir effect — pasted verbatim into
four demo-mfe screens by #491 — into two shared hooks:

- useBridgeProperty<T>(bridge, propertyId, fallback): lazy initial read
  and change subscription with cleanup. The value is passed through as
  the caller's T; schema validation belongs to the type-system plugin,
  so the hook does no runtime type filtering. The module doc explains
  how it differs from useSharedProperty in @gears-frontx/react.
- useHostDirection(containerRef, language): Shadow DOM host dir sync,
  with a readonly RTL_LANGUAGES and the reason for the forced
  HTMLElement cast.

The prevBridge render-time resync the screens carried is dropped rather
than extracted: the runtime retains one bridge per extension across
every mount/unmount cycle (MfeBridge contract in @gears-frontx/mfes
handler types) and ThemeAwareReactLifecycle renders a fresh root per
mount, so a mounted screen never sees a different bridge instance. The
four screen tests pinning that swap are removed with it.

useBridgeProperty's tests cover initial read, fallback when the
property is not yet published, non-string pass-through, update
propagation, and unsubscribe on unmount; useHostDirection's tests use a
real shadow root with afterEach host cleanup. The _blank-mfe copy stays
inline per the issue: no-cross-mfe-imports forbids importing from
demo-mfe, and the per-MFE src/shared/ duplication is the existing
convention.

Residue @cpt- markers are stripped from the modified template screens
(ADR-0033: template-territory markers are non-authoritative residue
removed when a file is otherwise modified).

Closes #502

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Signed-off-by: Vuk D. <davydowiktor@gmail.com>