feat(create,tools,ci): qualify create/starter/examples as external consumer paths (#1228, B2.5)

[SisyphusZheng]

Problem

#1228 (B2.5, stage #1288, umbrella #1155): a new external user must be able to create → install → dev → check → test → build → start/preview → deploy from packed/published artifacts, without monorepo-only assumptions. Before this PR the packed-starter gate (consumer:packaged) only ran check + build; dev/start/preview/deploy were unqualified from packed artifacts, the create CLI's name validation predated npm-name rules and unexpected failures vomited stack traces, Bun support was claimed in docs with local-only evidence (carried risk #7), and the desktop examples' OEC9008 build failure was an open carried risk (#1).

Contract override (authoritative, recorded per dispatch): B2.5 qualifies fresh v0.44 consumption only. The issue text's "migration guidance from v0.43.3" requirement is removed by stage ruling (stage #1288 body: "B2.5 has NO 0.43.3→0.44 migration-guide requirement — no meaningful external 0.43 consumer base"). No migration guide is written in this PR.

Owner

Single implementer executor (kimi-code, .agents/v044-kimi-implementer.md), one branch, one PR.

Before

• tools/consumer-packaged-starter.ts ran the packed create CLI, then only deno task check and deno task build in the scratch starter.
• packages/create/src/cli.ts: name regex ^[a-zA-Z0-9_-]+$ (allowed uppercase, leading _/-, unbounded length); write-loop and template failures escaped as unhandled rejections with stack traces.
• Bun support for dist/server/serve.mjs claimed by www/content/guide/deployment.md (+ zh), docs/current/PACKAGE_SURFACE.md, README — evidence local-only (Beta.1 closure, Bun 1.4.0), no CI leg.
• Desktop examples fail closed OEC9008 on full npm:vite build (carried risk Bug: serializeAttributes() missing camelToKebab - Lit attribute observer cannot recognize camelCase props #1).
• examples/open-element-in-fresh pinned npm:@openelement/ui@^0.42.0 while its README claimed maintenance against 0.44.0-beta.1.

After

• The packed-starter walkthrough exercises the full consumer lifecycle from the five pack:dry-run tarballs in a hermetic scratch outside the workspace: dev → check → test → build → start → deploy (dist/server/serve.mjs) → preview (fail-closed assertion). Gated in CI as the existing consumer:packaged autoflow gate (ci + release tiers).
• L9: create CLI wraps all failure modes in a top-level catch; every error is one actionable line (error: …), exit 1, no stack trace. Existing-dir errors now carry resolution guidance; permission/write failures name the target and advise removing the partial directory.
• L11: validateProjectName() enforces npm package-name rules (lowercase, starts [a-z0-9], charset [a-z0-9._-], 214-char ceiling) and rejects .. segments, ahead of the retained resolve-based traversal defense. Unit + subprocess tests.
• Bun verdict: SUPPORTED and now CI-gated. New required bun-serve-smoke job in autoflow-ci builds the request-time fixture and boots dist/server/serve.mjs under pinned Bun 1.4.1 (SHA-256 pinned download, verified against oven-sh/bun SHASUMS256.txt), asserting / and /live over HTTP — the same probes as the Node 24 leg. Added to the pr-full-ci-evidence needs list (workflow contract test updated). The doc claims stand because they are now true and gated. Scope note: the create/build toolchain is Deno-hosted by contract (PACKAGE_SURFACE.md ownership rules), so the Bun claim covers generated artifacts only — which is exactly what the leg qualifies.
• OEC9008 verdict: EXCLUDED with documented carry to Beta.3 (B3.8). A bounded-repair probe (route-wiring extraction into sibling plain modules, mastodon) immediately cascaded into OEC9007 (multi-statement/early-return render()) and OEC9006 (undecorated fields) — i.e. a full re-authoring of nine large renders against the compiled grammar with no browser E2E safety net. Not provably cheap; documented in docs/current/DENO_DESKTOP_TARGET.md + both example READMEs. deno task check/smoke for both examples stay green and CI-gated via examples:check.
• examples/open-element-in-fresh now consumes the published @openelement/ui@0.44.0-beta.1 (exact pin; deno task check green against it), closing the README/truth gap.

Why not second owner

One bounded slice, one coherent qualification surface (create/starter/examples + their gates); splitting ownership across the walkthrough, the Bun leg and the examples adjudication would only add handoff cost. No architecture, public-API or release-lane changes required a second role.

Evidence

Lifecycle walkthrough (deno task consumer:packaged, local macOS arm64, Deno 2.9.0, tarballs from deno task pack:dry-run, scratch under $TMPDIR outside the workspace):

Packed starter dev server passed (port 50656).                                  # deno task dev   — vite dev, SSR / probe
Packed starter typecheck passed for 0.44.0-beta.1.                              # deno task check
Packed starter test task passed.                                                # deno task test
Packed starter SSG build passed for 0.44.0-beta.1.                              # deno task build — emits dist/server/index.js
Packed starter start server passed (port 50905).                                # deno task start — /, /contact, /api/health
Packed starter standalone deploy entry (dist/server/serve.mjs) passed (51113).  # deploy leg      — same probes
Packed starter preview fail-closed guidance passed.                             # deno task preview refuses dynamic app, points at start (#601)
Packaged starter import-map smoke passed.
exit 0

Per runtime: Deno 2.9.0 hosts the toolchain legs (by contract); Bun 1.3.5 local probe bun dist/server/serve.mjs → / and /live 200 with expected markers (exit 0), Bun 1.4.1 is the pinned CI leg; Node 24 serving remains gated by the existing node-serve-smoke job.

Checks run locally (all exit 0): root deno task test (1866 passed + supabase 150 passed), consumer:packaged, examples:check, publish:npm:dry-run (all five packages pack; registry skip at 0.44.0-beta.1), package-surface:check, interface:snapshot, typecheck, freeze:semantics:check, actions:check-pins, workflow:check-slimming, docs:check-current, deno fmt --check, deno lint, markdownlint (changed files), actionlint. Create suite: 18/18 including 4 new L9/L11 tests (RED proven first: TS2305 … no exported member 'validateProjectName').

Scope

Touched: packages/create/** (L9/L11), tools/consumer-packaged-starter.ts (lifecycle), .github/workflows/autoflow-ci.yml + tools/autoflow/__tests__/pr-ci-workflow.test.ts (Bun leg), docs/current/DENO_DESKTOP_TARGET.md, desktop example READMEs (OEC9008 carry), examples/open-element-in-fresh/deno.json + lock (published-line pin). No frozen paths touched; no new packages; no architecture changes.

Risk

• The Bun CI leg downloads a release binary from GitHub (version + SHA-256 pinned, same pattern as actionlint/gitleaks); a network outage fails the leg loudly, never silently.
• The desktop examples remain non-consumer evidence until B3.8 re-authoring; their check/smoke gates prevent further drift.
• Dev/start/deploy legs use OS-assigned ephemeral ports to avoid parallel-CI collisions (same rationale as consumer-local.ts).

Closes #1228

[github-actions]

APIError: Insufficient Balance

opencode session  |  github run

[cloudflare-workers-and-pages]

Deploying openelement with    Cloudflare Pages

Latest commit:	27123d9
Status:	✅  Deploy successful!
Preview URL:	https://9cd765af.lessjs.pages.dev
Branch Preview URL:	https://kimi-v044-b2-5-consumer-qual.lessjs.pages.dev

View logs