feat: add r2-backed website template packages

[bingjiez666]

Summary

• Add 9 website template entries to the built-in website picker catalog with static preview URLs.
• Register each template package as a private R2-backed template:<slug> resource with archive SHA256 metadata and API download version IDs.
• Update CLI/core/API tests to cover the expanded website template catalog and registry download allowlist.

Storage notes

• Template .tar.gz packages were uploaded to R2 and verified by round-trip download SHA256 against the Drive manifest values.
• The Drive manifest.json was used only as source metadata; it was not uploaded to R2.
• Static preview HTML lives in companion static-files PR: https://github.com/vm0-ai/static-files/pull/24

Verification

• pnpm format
• DATABASE_URL="postgresql://user@localhost:5432/vm0_test" pnpm exec vitest run packages/core/src/__tests__/website-template-items.spec.ts apps/cli/src/commands/zero/generate/__tests__/website.test.ts apps/cli/src/commands/zero/resource/__tests__/index.test.ts apps/api/src/signals/routes/__tests__/registry-resources-download.test.ts apps/api/src/signals/routes/__tests__/generation-template-prompt.test.ts
• R2 archive upload verification: all 9 uploaded archives round-trip matched the Drive manifest SHA256 values.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!

[github-actions]

API preview: https://pr-20700-api.vm6.ai

[bingjiez666]

LGTM

PR_AUTO_REVIEW_COMMIT: 83099b9
PR_AUTO_REVIEW_VERDICT: LGTM

Summary

This PR expands the built-in website template picker from one template to nine R2-backed website packages, wires their private archive SHA/version mappings, and moves preview URLs to the new static preview path. The API allowlist, core registry, CLI selection behavior, and picker catalog all stay aligned through updated tests.

Findings

Critical (P0)

• None.

High Priority (P1)

• None.

Testing

• Coverage: Adequate. The changed tests cover the full website template catalog order, R2 package/resource resolution, generic template exclusion, website-targeted generation exposure, CLI template selection/resource lookup, and the private registry download allowlist for all nine template:<slug> resources.
• Conventions: Compliant. The changed tests exercise public CLI/core/API behavior and do not introduce internal vi.mock() usage, direct fetch mocking, fake timers, or mocked database access.
• Author verification in the PR body includes pnpm format, targeted Vitest coverage across core/CLI/API, and R2 round-trip SHA256 checks for all uploaded archives.

[bingjiez666]

LGTM

PR_AUTO_REVIEW_COMMIT: 31db573
PR_AUTO_REVIEW_VERDICT: LGTM

Summary

This PR expands the built-in website template picker from one template to nine R2-backed website packages, keeps their preview URLs under the static preview path, and aligns the core registry/API allowlist with the uploaded archive SHA/version metadata. The latest merge from main does not change the PR-scoped diff beyond these target files.

Findings

Critical (P0)

• None.

High Priority (P1)

• None.

Testing

• Coverage: Adequate. The changed tests cover catalog order, private R2 package/resource resolution, generic template exclusion, website-targeted generation exposure, CLI template selection/resource lookup, and API private registry download allowlisting for all nine template:<slug> resources.
• Conventions: Compliant. The changed tests exercise public CLI/core/API behavior and do not introduce internal vi.mock() usage, direct fetch mocking, fake timers, or mocked database access.
• Author verification in the PR body includes pnpm format, targeted Vitest coverage across core/CLI/API, and R2 round-trip SHA256 checks for all uploaded archives.

[bingjiez666]

LGTM

PR_AUTO_REVIEW_COMMIT: 49c908c
PR_AUTO_REVIEW_VERDICT: LGTM

Summary

This PR expands the built-in website template picker from one template to nine R2-backed website packages, keeps preview URLs under the static preview path, and aligns the core registry/API allowlist with uploaded archive SHA/version metadata. The current head only changes the intended catalog, registry, API allowlist, and related tests.

Findings

Critical (P0)

• None.

High Priority (P1)

• None.

Testing

• Coverage: Adequate. The changed tests cover catalog order, private R2 package/resource resolution, generic template exclusion, website-targeted generation exposure, CLI template selection/resource lookup, and API private registry download allowlisting for all nine template:<slug> resources.
• Conventions: Compliant. The changed tests exercise public CLI/core/API behavior and do not introduce internal vi.mock() usage, direct fetch mocking, fake timers, or mocked database access.
• Author verification in the PR body includes pnpm format, targeted Vitest coverage across core/CLI/API, and R2 round-trip SHA256 checks for all uploaded archives.

[bingjiez666]

LGTM

PR_AUTO_REVIEW_COMMIT: 239d259
PR_AUTO_REVIEW_VERDICT: LGTM

Summary

This PR expands the built-in website template picker from one template to nine R2-backed website packages, keeps preview URLs under the static preview path, and aligns the core registry/API allowlist with uploaded archive SHA/version metadata. The current head stays scoped to the intended catalog, registry, API allowlist, and test updates.

Findings

Critical (P0)

• None.

High Priority (P1)

• None.

Testing

• Coverage: Adequate. The changed tests cover catalog order, private R2 package/resource resolution, generic template exclusion, website-targeted generation exposure, CLI template selection/resource lookup, and API private registry download allowlisting for all nine template:<slug> resources.
• Conventions: Compliant. The changed tests exercise public CLI/core/API behavior and do not introduce internal vi.mock() usage, direct fetch mocking, fake timers, or mocked database access.
• Author verification in the PR body includes pnpm format, targeted Vitest coverage across core/CLI/API, and R2 round-trip SHA256 checks for all uploaded archives.

[bingjiez666]

Changes Requested

PR_AUTO_REVIEW_COMMIT: 8e3a367
PR_AUTO_REVIEW_VERDICT: Changes Requested

Summary

This PR expands the built-in website picker catalog to 9 R2-backed website template packages, wires their archive SHA metadata into the core registry, and allowlists the corresponding private R2 archive version IDs in the API download route.

Findings

Critical (P0)

• None found.

High Priority (P1) - should fix before merge

• turbo/packages/core/src/website-template-items.ts:17: The shared preview base URL currently resolves all 9 configured iframe preview HTML files to 404 on static.vm0.io (black-slabs, blueprint-grid, coastal-hotel, frame-stack, gallery-wall, glass-bloom, serif-stack, sticker-pop, and warm-cards). Since these URLs are user-facing picker previews, merging this before the static preview assets are live would ship broken iframe previews. Please make the referenced static files available at this path, or update the PR to point at a live static preview path before merge.

Testing

• Coverage: Adequate for the registry/catalog/API behavior; the PR includes core, CLI, and API-route integration coverage for resolving website template packages and the private archive allowlist.
• Conventions: Compliant. The changed tests use public CLI/API/core entry points and I did not find internal relative-path vi.mock, direct fetch stubbing, fake timers, or mocked DB access in the changed test files.
• Reviewer checks: git diff --check origin/main...HEAD; HTTP availability probe for each configured preview URL with curl -L -s -o /dev/null -w '%{http_code}', which returned 404 for all 9 preview HTML files.

[bingjiez666]

Changes Requested

PR_AUTO_REVIEW_COMMIT: 62d2b99
PR_AUTO_REVIEW_VERDICT: Changes Requested

Summary

This PR expands the built-in website picker catalog to 9 R2-backed website template packages, wires the archive SHA metadata into the core registry, and allowlists the corresponding private R2 archive version IDs in the API download route.

Findings

Critical (P0)

• None found.

High Priority (P1) - should fix before merge

• turbo/packages/core/src/website-template-items.ts:17: The configured shared preview base URL still resolves all 9 iframe preview HTML files to 404 on static.vm0.io (black-slabs, blueprint-grid, coastal-hotel, frame-stack, gallery-wall, glass-bloom, serif-stack, sticker-pop, and warm-cards). These URLs are user-facing picker previews, so merging this before the static preview assets are live would ship broken iframe previews. Please make the referenced static files available at this path, or update the PR to point at a live static preview path before merge.

Testing

• Coverage: Adequate for the catalog/registry/API behavior; the PR includes core, CLI, and API-route integration coverage for resolving website template packages and the private archive allowlist.
• Conventions: Compliant. The changed tests use public CLI/API/core entry points and I did not find internal relative-path vi.mock, direct fetch stubbing, fake timers, or mocked DB access in the changed test files.
• Reviewer checks: git diff --check origin/main...origin/feat/add-website-template-packages; HTTP availability probe for each configured preview URL with curl -L -s -o /dev/null -w '%{http_code}', which returned 404 for all 9 preview HTML files.

[bingjiez666]

Superseded by #20700 (comment)

This previous pr-auto review marker was superseded after the static preview files were published via vm0-ai/static-files#24 and all 9 configured preview URLs returned 200. The original blocker was the static.vm0.io preview URLs returning 404; that condition is no longer present.

[bingjiez666]

LGTM

PR_AUTO_REVIEW_COMMIT: 57e4ae9
PR_AUTO_REVIEW_VERDICT: LGTM

Summary

This PR expands the built-in website template picker catalog to 9 R2-backed website templates, registers the matching private template archive metadata, and updates CLI/core/API/platform coverage for the expanded catalog. The earlier preview availability blocker is now resolved after publishing the corresponding append-only static preview files.

Findings

Critical (P0)

• None found.

High Priority (P1)

• None found.

Testing

• Coverage: Adequate. The PR includes catalog/resource/API allowlist coverage plus the platform picker regression test update for the first website template.
• Conventions: Compliant. No internal relative vi.mock() additions, direct fetch stubs, fake timers, mocked DB access, or whitespace issues found in the PR diff.
• Review checks: git diff --check origin/main...origin/pr-20700 passed; all 9 configured static preview URLs now return 200 from static.vm0.io.