@bensandee/tooling 0.28.0 → 0.28.1

package/dist/bin.mjs

@@ -280,14 +280,18 @@ function getMonorepoPackages(targetDir) {
 function isCancelled(value) {
 	return clack.isCancel(value);
 }
+function detectProjectInfo(targetDir) {
+	const existingPkg = readPackageJson(targetDir);
+	return {
+		detected: detectProject(targetDir),
+		defaults: computeDefaults(targetDir),
+		name: existingPkg?.name ?? path.basename(targetDir)
+	};
+}
 async function runInitPrompts(targetDir, saved) {
 	clack.intro("@bensandee/tooling repo:sync");
-	const existingPkg = readPackageJson(targetDir);
-	const detected = detectProject(targetDir);
-	const defaults = computeDefaults(targetDir);
-	const isExisting = detected.hasPackageJson;
+	const { detected, defaults, name } = detectProjectInfo(targetDir);
 	const isFirstInit = !saved;
-	const name = existingPkg?.name ?? path.basename(targetDir);
 	const structure = saved?.structure ?? defaults.structure;
 	const useEslintPlugin = saved?.useEslintPlugin ?? defaults.useEslintPlugin;
 	let formatter = saved?.formatter ?? defaults.formatter;
@@ -406,7 +410,6 @@ async function runInitPrompts(targetDir, saved) {
 	clack.outro("Configuration complete!");
 	return {
 		name,
-		isNew: !isExisting,
 		structure,
 		useEslintPlugin,
 		formatter,
@@ -423,12 +426,9 @@ async function runInitPrompts(targetDir, saved) {
 }
 /** Build a ProjectConfig from CLI flags for non-interactive mode. */
 function buildDefaultConfig(targetDir, flags) {
-	const existingPkg = readPackageJson(targetDir);
-	const detected = detectProject(targetDir);
-	const defaults = computeDefaults(targetDir);
+	const { defaults, name } = detectProjectInfo(targetDir);
 	return {
-		name: existingPkg?.name ?? path.basename(targetDir),
-		isNew: !detected.hasPackageJson,
+		name,
 		...defaults,
 		...flags.eslintPlugin !== void 0 && { useEslintPlugin: flags.eslintPlugin },
 		...flags.noCi && { ci: "none" },
@@ -574,7 +574,6 @@ const ToolingConfigSchema = z.strictObject({
 		"library"
 	]).optional().meta({ description: "Project type (determines tsconfig base)" }),
 	detectPackageTypes: z.boolean().optional().meta({ description: "Auto-detect project types for monorepo packages" }),
-	setupDocker: z.boolean().optional().meta({ description: "Generate Docker build/check scripts" }),
 	docker: z.record(z.string(), z.object({
 		dockerfile: z.string().meta({ description: "Path to Dockerfile relative to package" }),
 		context: z.string().default(".").meta({ description: "Docker build context relative to package" })
@@ -637,7 +636,6 @@ function saveToolingConfig(ctx, config) {
 function mergeWithSavedConfig(detected, saved) {
 	return {
 		name: detected.name,
-		isNew: detected.isNew,
 		targetDir: detected.targetDir,
 		structure: saved.structure ?? detected.structure,
 		useEslintPlugin: saved.useEslintPlugin ?? detected.useEslintPlugin,
@@ -653,1624 +651,1281 @@ function mergeWithSavedConfig(detected, saved) {
 	};
 }
 //#endregion
-//#region src/utils/yaml-merge.ts
-const IGNORE_PATTERN = "@bensandee/tooling:ignore";
-const FORGEJO_SCHEMA_COMMENT = "# yaml-language-server: $schema=../../.vscode/forgejo-workflow.schema.json\n";
-/** Returns a yaml-language-server schema comment for Forgejo workflows, empty string otherwise. */
-function workflowSchemaComment(ci) {
-	return ci === "forgejo" ? FORGEJO_SCHEMA_COMMENT : "";
-}
-/** Prepend the Forgejo schema comment if it's not already present. No-op for GitHub. */
-function ensureSchemaComment(content, ci) {
-	if (ci !== "forgejo") return content;
-	if (content.includes("yaml-language-server")) return content;
-	return FORGEJO_SCHEMA_COMMENT + content;
-}
-/** Migrate content from old tooling binary name to new. */
-function migrateToolingBinary(content) {
-	return content.replaceAll("pnpm exec tooling ", "pnpm exec bst ");
-}
-/** Check if a YAML file has an opt-out comment in the first 10 lines. */
-function isToolingIgnored(content) {
-	return content.split("\n", 10).some((line) => line.includes(IGNORE_PATTERN));
+//#region src/release/docker.ts
+const ToolingDockerMapSchema = z.record(z.string(), z.object({
+	dockerfile: z.string(),
+	context: z.string().default(".")
+}));
+const ToolingConfigDockerSchema = z.object({ docker: ToolingDockerMapSchema.optional() });
+const PackageInfoSchema = z.object({
+	name: z.string().optional(),
+	version: z.string().optional()
+});
+/** Read the docker map from .tooling.json. Returns empty record if missing or invalid. */
+function loadDockerMap(executor, cwd) {
+	const configPath = path.join(cwd, ".tooling.json");
+	const raw = executor.readFile(configPath);
+	if (!raw) return {};
+	try {
+		const result = ToolingConfigDockerSchema.safeParse(JSON.parse(raw));
+		if (!result.success || !result.data.docker) return {};
+		return result.data.docker;
+	} catch (_error) {
+		return {};
+	}
 }
-/**
-* Ensure required commands exist under `pre-commit.commands` in a lefthook config.
-* Only adds missing commands — never modifies existing ones.
-* Returns unchanged content if the file has an opt-out comment or can't be parsed.
-*/
-function mergeLefthookCommands(existing, requiredCommands) {
-	if (isToolingIgnored(existing)) return {
-		content: existing,
-		changed: false
+/** Read name and version from a package's package.json. */
+function readPackageInfo(executor, packageJsonPath) {
+	const raw = executor.readFile(packageJsonPath);
+	if (!raw) return {
+		name: void 0,
+		version: void 0
 	};
 	try {
-		const doc = parseDocument(existing);
-		let changed = false;
-		if (!doc.hasIn(["pre-commit", "commands"])) {
-			doc.setIn(["pre-commit", "commands"], requiredCommands);
-			return {
-				content: doc.toString(),
-				changed: true
-			};
-		}
-		const commands = doc.getIn(["pre-commit", "commands"]);
-		if (!isMap(commands)) return {
-			content: existing,
-			changed: false
+		const result = PackageInfoSchema.safeParse(JSON.parse(raw));
+		if (!result.success) return {
+			name: void 0,
+			version: void 0
 		};
-		for (const [name, config] of Object.entries(requiredCommands)) if (!commands.has(name)) {
-			commands.set(name, config);
-			changed = true;
-		}
 		return {
-			content: changed ? doc.toString() : existing,
-			changed
+			name: result.data.name,
+			version: result.data.version
 		};
-	} catch {
+	} catch (_error) {
 		return {
-			content: existing,
-			changed: false
+			name: void 0,
+			version: void 0
 		};
 	}
 }
+/** Strip npm scope from a package name: "@scope/foo" → "foo", "foo" → "foo". */
+function stripScope(name) {
+	const slashIndex = name.indexOf("/");
+	return name.startsWith("@") && slashIndex !== -1 ? name.slice(slashIndex + 1) : name;
+}
+/** Convention paths to check for Dockerfiles in a package directory. */
+const CONVENTION_DOCKERFILE_PATHS = ["Dockerfile", "docker/Dockerfile"];
 /**
-* Ensure required steps exist in a workflow job's steps array.
-* Only adds missing steps at the end — never modifies existing ones.
-* Returns unchanged content if the file has an opt-out comment or can't be parsed.
+* Find a Dockerfile at convention paths for a monorepo package.
+* Checks packages/{dir}/Dockerfile and packages/{dir}/docker/Dockerfile.
 */
-function mergeWorkflowSteps(existing, jobName, requiredSteps) {
-	if (isToolingIgnored(existing)) return {
-		content: existing,
-		changed: false
-	};
-	try {
-		const doc = parseDocument(existing);
-		const steps = doc.getIn([
-			"jobs",
-			jobName,
-			"steps"
-		]);
-		if (!isSeq(steps)) return {
-			content: existing,
-			changed: false
-		};
-		let changed = false;
-		for (const { match, step } of requiredSteps) if (!steps.items.some((item) => {
-			if (!isMap(item)) return false;
-			if (match.run) {
-				const run = item.get("run");
-				return typeof run === "string" && run.includes(match.run);
-			}
-			if (match.uses) {
-				const uses = item.get("uses");
-				return typeof uses === "string" && uses.startsWith(match.uses);
-			}
-			return false;
-		})) {
-			steps.add(doc.createNode(step));
-			changed = true;
-		}
-		return {
-			content: changed ? doc.toString() : existing,
-			changed
-		};
-	} catch {
-		return {
-			content: existing,
-			changed: false
+function findConventionDockerfile(executor, cwd, dir) {
+	for (const rel of CONVENTION_DOCKERFILE_PATHS) {
+		const dockerfilePath = `packages/${dir}/${rel}`;
+		if (executor.readFile(path.join(cwd, dockerfilePath)) !== null) return {
+			dockerfile: dockerfilePath,
+			context: "."
 		};
 	}
 }
 /**
-* Add a job to an existing workflow YAML if it doesn't already exist.
-* Returns unchanged content if the job already exists, the file has an opt-out comment,
-* or the document can't be parsed.
+* Find a Dockerfile at convention paths for a single-package repo.
+* Checks Dockerfile and docker/Dockerfile at the project root.
 */
+function findRootDockerfile(executor, cwd) {
+	for (const rel of CONVENTION_DOCKERFILE_PATHS) if (executor.readFile(path.join(cwd, rel)) !== null) return {
+		dockerfile: rel,
+		context: "."
+	};
+}
 /**
-* Ensure a `concurrency` block exists at the workflow top level.
-* Adds it if missing — never modifies an existing one.
-* Returns unchanged content if the file has an opt-out comment or can't be parsed.
+* Discover Docker packages by convention and merge with .tooling.json overrides.
+*
+* Convention: any package with a Dockerfile or docker/Dockerfile is a Docker package.
+* For monorepos, scans packages/{name}/. For single-package repos, scans the root.
+* The docker map in .tooling.json overrides convention-discovered config and can add
+* packages at non-standard locations.
+*
+* Image names are derived from {root-name}-{package-name} using each package's package.json name.
+* Versions are read from each package's own package.json.
 */
-function ensureWorkflowConcurrency(existing, concurrency) {
-	if (isToolingIgnored(existing)) return {
-		content: existing,
-		changed: false
-	};
-	try {
-		const doc = parseDocument(existing);
-		if (doc.has("concurrency")) return {
-			content: existing,
-			changed: false
-		};
-		doc.set("concurrency", concurrency);
-		const contents = doc.contents;
-		if (isMap(contents)) {
-			const items = contents.items;
-			const nameIdx = items.findIndex((p) => isScalar(p.key) && p.key.value === "name");
-			const concPair = items.pop();
-			if (concPair) items.splice(nameIdx + 1, 0, concPair);
+function detectDockerPackages(executor, cwd, repoName) {
+	const overrides = loadDockerMap(executor, cwd);
+	const packageDirs = executor.listPackageDirs(cwd);
+	const packages = [];
+	const seen = /* @__PURE__ */ new Set();
+	if (packageDirs.length > 0) {
+		for (const dir of packageDirs) {
+			const convention = findConventionDockerfile(executor, cwd, dir);
+			const docker = overrides[dir] ?? convention;
+			if (docker) {
+				const { name, version } = readPackageInfo(executor, path.join(cwd, "packages", dir, "package.json"));
+				packages.push({
+					dir,
+					imageName: `${repoName}-${stripScope(name ?? dir)}`,
+					version,
+					docker
+				});
+				seen.add(dir);
+			}
+		}
+		for (const [dir, docker] of Object.entries(overrides)) if (!seen.has(dir)) {
+			const { name, version } = readPackageInfo(executor, path.join(cwd, "packages", dir, "package.json"));
+			packages.push({
+				dir,
+				imageName: `${repoName}-${stripScope(name ?? dir)}`,
+				version,
+				docker
+			});
+		}
+	} else {
+		const convention = findRootDockerfile(executor, cwd);
+		const docker = overrides["."] ?? convention;
+		if (docker) {
+			const { name, version } = readPackageInfo(executor, path.join(cwd, "package.json"));
+			packages.push({
+				dir: ".",
+				imageName: stripScope(name ?? repoName),
+				version,
+				docker
+			});
 		}
-		return {
-			content: doc.toString(),
-			changed: true
-		};
-	} catch {
-		return {
-			content: existing,
-			changed: false
-		};
 	}
+	return packages;
 }
-//#endregion
-//#region src/generators/publish-ci.ts
-/** Build a GitHub Actions expression like `${{ expr }}` without triggering no-template-curly-in-string. */
-function actionsExpr$2(expr) {
-	return `\${{ ${expr} }}`;
-}
-function hasEnginesNode$2(ctx) {
-	return typeof ctx.packageJson?.["engines"]?.["node"] === "string";
-}
-function deployWorkflow(ci, nodeVersionYaml) {
-	return `${workflowSchemaComment(ci)}name: Publish
-on:
-  push:
-    tags:
-      - "v[0-9]+.[0-9]+.[0-9]+"
-
-jobs:
-  publish:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
-        with:
-          ${nodeVersionYaml}
-      - run: pnpm install --frozen-lockfile
-      - name: Publish Docker images
-        env:
-          DOCKER_REGISTRY_HOST: ${actionsExpr$2("vars.DOCKER_REGISTRY_HOST")}
-          DOCKER_REGISTRY_NAMESPACE: ${actionsExpr$2("vars.DOCKER_REGISTRY_NAMESPACE")}
-          DOCKER_USERNAME: ${actionsExpr$2("secrets.DOCKER_USERNAME")}
-          DOCKER_PASSWORD: ${actionsExpr$2("secrets.DOCKER_PASSWORD")}
-        run: pnpm exec bst docker:publish
-`;
+/**
+* Read docker config for a single package, checking convention paths first,
+* then .tooling.json overrides. Used by the per-package image:build script.
+*/
+function readSinglePackageDocker(executor, cwd, packageDir, repoName) {
+	const dir = path.basename(path.resolve(cwd, packageDir));
+	const convention = findConventionDockerfile(executor, cwd, dir);
+	const docker = loadDockerMap(executor, cwd)[dir] ?? convention;
+	if (!docker) throw new FatalError(`No Dockerfile found for package "${dir}" (checked convention paths and .tooling.json)`);
+	const { name, version } = readPackageInfo(executor, path.join(cwd, "packages", dir, "package.json"));
+	return {
+		dir,
+		imageName: `${repoName}-${stripScope(name ?? dir)}`,
+		version,
+		docker
+	};
 }
-function requiredDeploySteps() {
+/** Parse semver version string into major, minor, patch components. */
+function parseSemver(version) {
+	const clean = version.replace(/^v/, "");
+	const match = /^(\d+)\.(\d+)\.(\d+)/.exec(clean);
+	if (!match?.[1] || !match[2] || !match[3]) throw new FatalError(`Invalid semver version: ${version}`);
+	return {
+		major: Number(match[1]),
+		minor: Number(match[2]),
+		patch: Number(match[3])
+	};
+}
+/** Generate semver tag variants: latest, vX.Y.Z, vX.Y, vX */
+function generateTags(version) {
+	const { major, minor, patch } = parseSemver(version);
 	return [
-		{
-			match: { uses: "actions/checkout" },
-			step: { uses: "actions/checkout@v4" }
-		},
-		{
-			match: { uses: "pnpm/action-setup" },
-			step: { uses: "pnpm/action-setup@v4" }
-		},
-		{
-			match: { uses: "actions/setup-node" },
-			step: { uses: "actions/setup-node@v4" }
-		},
-		{
-			match: { run: "pnpm install" },
-			step: { run: "pnpm install --frozen-lockfile" }
-		},
-		{
-			match: { run: "docker:publish" },
-			step: { run: "pnpm exec bst docker:publish" }
-		}
+		"latest",
+		`v${major}.${minor}.${patch}`,
+		`v${major}.${minor}`,
+		`v${major}`
 	];
 }
-/** Convention paths to check for Dockerfiles. */
-const CONVENTION_DOCKERFILE_PATHS$1 = ["Dockerfile", "docker/Dockerfile"];
-const DockerMapSchema = z.object({ docker: z.record(z.string(), z.unknown()).optional() });
-/** Get names of packages that have Docker builds (by convention or .tooling.json config). */
-function getDockerPackageNames(ctx) {
-	const names = [];
-	const configRaw = ctx.read(".tooling.json");
-	if (configRaw) {
-		const result = DockerMapSchema.safeParse(JSON.parse(configRaw));
-		if (result.success && result.data.docker) names.push(...Object.keys(result.data.docker));
+/** Build the full image reference: namespace/imageName:tag */
+function imageRef(namespace, imageName, tag) {
+	return `${namespace}/${imageName}:${tag}`;
+}
+function log$1(message) {
+	console.log(message);
+}
+/** Read the repo name from root package.json. */
+function readRepoName(executor, cwd) {
+	const rootPkgRaw = executor.readFile(path.join(cwd, "package.json"));
+	if (!rootPkgRaw) throw new FatalError("No package.json found in project root");
+	const repoName = parsePackageJson(rootPkgRaw)?.name;
+	if (!repoName) throw new FatalError("Root package.json must have a name field");
+	return repoName;
+}
+/** Build a single docker image from its config. Paths are resolved relative to cwd. */
+function buildImage(executor, pkg, cwd, extraArgs) {
+	const dockerfilePath = path.resolve(cwd, pkg.docker.dockerfile);
+	const contextPath = path.resolve(cwd, pkg.docker.context);
+	const command = [
+		"docker build",
+		`-f ${dockerfilePath}`,
+		`-t ${pkg.imageName}:latest`,
+		...extraArgs,
+		contextPath
+	].join(" ");
+	executor.execInherit(command);
+}
+/**
+* Detect packages with docker config in .tooling.json and build each one.
+* Runs `docker build -f <dockerfile> -t <image-name>:latest <context>` for each package.
+* Dockerfile and context paths are resolved relative to the project root.
+*
+* When `packageDir` is set, builds only that single package (for use as an image:build script).
+*/
+function runDockerBuild(executor, config) {
+	const repoName = readRepoName(executor, config.cwd);
+	if (config.packageDir) {
+		const pkg = readSinglePackageDocker(executor, config.cwd, config.packageDir, repoName);
+		log$1(`Building image for ${pkg.dir} (${pkg.imageName}:latest)...`);
+		buildImage(executor, pkg, config.cwd, config.extraArgs);
+		log$1(`Built ${pkg.imageName}:latest`);
+		return { packages: [pkg] };
 	}
-	if (ctx.config.structure === "monorepo") {
-		const packages = getMonorepoPackages(ctx.targetDir);
-		for (const pkg of packages) {
-			const dirName = pkg.name.split("/").pop() ?? pkg.name;
-			if (names.includes(dirName)) continue;
-			for (const rel of CONVENTION_DOCKERFILE_PATHS$1) if (ctx.exists(`packages/${dirName}/${rel}`)) {
-				names.push(dirName);
-				break;
-			}
-		}
-	} else for (const rel of CONVENTION_DOCKERFILE_PATHS$1) if (ctx.exists(rel)) {
-		if (!names.includes(ctx.config.name)) names.push(ctx.config.name);
-		break;
+	const packages = detectDockerPackages(executor, config.cwd, repoName);
+	if (packages.length === 0) {
+		log$1("No packages with docker config found");
+		return { packages: [] };
 	}
-	return names;
-}
-/** Check whether any Docker packages exist by convention or .tooling.json config. */
-function hasDockerPackages(ctx) {
-	return getDockerPackageNames(ctx).length > 0;
+	log$1(`Found ${packages.length} Docker package(s): ${packages.map((p) => p.dir).join(", ")}`);
+	for (const pkg of packages) {
+		log$1(`Building image for ${pkg.dir} (${pkg.imageName}:latest)...`);
+		buildImage(executor, pkg, config.cwd, config.extraArgs);
+	}
+	log$1(`Built ${packages.length} image(s)`);
+	return { packages };
 }
-async function generateDeployCi(ctx) {
-	const filePath = "deploy-ci";
-	if (!ctx.config.publishDocker || ctx.config.ci === "none") return {
-		filePath,
-		action: "skipped",
-		description: "Deploy CI workflow not applicable"
+/**
+* Run the full Docker publish pipeline:
+* 1. Build all images via runDockerBuild
+* 2. Login to registry
+* 3. Tag each image with semver variants from its own package.json version
+* 4. Push all tags
+* 5. Logout from registry
+*/
+function runDockerPublish(executor, config) {
+	const { packages } = runDockerBuild(executor, {
+		cwd: config.cwd,
+		packageDir: void 0,
+		extraArgs: []
+	});
+	if (packages.length === 0) return {
+		packages: [],
+		tags: []
 	};
-	const isGitHub = ctx.config.ci === "github";
-	const workflowPath = isGitHub ? ".github/workflows/publish.yml" : ".forgejo/workflows/publish.yml";
-	const nodeVersionYaml = hasEnginesNode$2(ctx) ? "node-version-file: package.json" : "node-version: \"24\"";
-	const content = deployWorkflow(ctx.config.ci, nodeVersionYaml);
-	if (ctx.exists(workflowPath)) {
-		const raw = ctx.read(workflowPath);
-		if (raw) {
-			const existing = migrateToolingBinary(raw);
-			if (existing === content || ensureSchemaComment(existing, ctx.config.ci) === content) {
-				if (existing !== raw) {
-					ctx.write(workflowPath, ensureSchemaComment(existing, ctx.config.ci));
-					return {
-						filePath: workflowPath,
-						action: "updated",
-						description: "Migrated tooling binary name in publish workflow"
-					};
-				}
-				return {
-					filePath: workflowPath,
-					action: "skipped",
-					description: "Publish workflow already up to date"
-				};
-			}
-			const merged = mergeWorkflowSteps(existing, "publish", requiredDeploySteps());
-			const withComment = ensureSchemaComment(merged.content, ctx.config.ci);
-			if (!merged.changed) {
-				if (withComment !== raw) {
-					ctx.write(workflowPath, withComment);
-					return {
-						filePath: workflowPath,
-						action: "updated",
-						description: existing !== raw ? "Migrated tooling binary name in publish workflow" : "Added schema comment to publish workflow"
-					};
-				}
-				return {
-					filePath: workflowPath,
-					action: "skipped",
-					description: "Existing publish workflow preserved"
-				};
+	for (const pkg of packages) if (!pkg.version) throw new FatalError(`Package ${pkg.dir} has docker config but no version in package.json`);
+	if (!config.dryRun) {
+		log$1(`Logging in to ${config.registryHost}...`);
+		const loginResult = executor.exec(`echo "${config.password}" | docker login ${config.registryHost} -u ${config.username} --password-stdin`);
+		if (loginResult.exitCode !== 0) throw new FatalError(`Docker login failed: ${loginResult.stderr}`);
+	} else log$1("[dry-run] Skipping docker login");
+	const allTags = [];
+	try {
+		for (const pkg of packages) {
+			const tags = generateTags(pkg.version ?? "");
+			log$1(`${pkg.dir} v${pkg.version} → tags: ${tags.join(", ")}`);
+			for (const tag of tags) {
+				const ref = imageRef(config.registryNamespace, pkg.imageName, tag);
+				allTags.push(ref);
+				log$1(`Tagging ${pkg.imageName} → ${ref}`);
+				const tagResult = executor.exec(`docker tag ${pkg.imageName} ${ref}`);
+				if (tagResult.exitCode !== 0) throw new FatalError(`docker tag failed: ${tagResult.stderr}`);
+				if (!config.dryRun) {
+					log$1(`Pushing ${ref}...`);
+					const pushResult = executor.exec(`docker push ${ref}`);
+					if (pushResult.exitCode !== 0) throw new FatalError(`docker push failed: ${pushResult.stderr}`);
+				} else log$1(`[dry-run] Skipping push for ${ref}`);
 			}
-			ctx.write(workflowPath, withComment);
-			return {
-				filePath: workflowPath,
-				action: "updated",
-				description: "Added missing steps to publish workflow"
-			};
 		}
-		return {
-			filePath: workflowPath,
-			action: "skipped",
-			description: "Publish workflow already up to date"
-		};
+	} finally {
+		if (!config.dryRun) {
+			log$1(`Logging out from ${config.registryHost}...`);
+			executor.exec(`docker logout ${config.registryHost}`);
+		}
 	}
-	ctx.write(workflowPath, content);
+	log$1(`Published ${allTags.length} image tag(s)`);
 	return {
-		filePath: workflowPath,
-		action: "created",
-		description: `Generated ${isGitHub ? "GitHub" : "Forgejo"} Actions publish workflow`
+		packages,
+		tags: allTags
 	};
 }
 //#endregion
-//#region src/generators/package-json.ts
-const STANDARD_SCRIPTS_SINGLE = {
-	build: "tsdown",
-	dev: "tsdown --watch",
-	typecheck: "tsc --noEmit",
-	test: "vitest run",
-	lint: "oxlint",
-	knip: "knip",
-	check: "bst checks:run",
-	"ci:check": "pnpm check --skip 'docker:*'",
-	"tooling:check": "bst repo:sync --check",
-	"tooling:sync": "bst repo:sync"
-};
-const STANDARD_SCRIPTS_MONOREPO = {
-	build: "pnpm -r build",
-	test: "pnpm -r test",
-	typecheck: "pnpm -r --parallel run typecheck",
-	lint: "oxlint",
-	knip: "knip",
-	check: "bst checks:run",
-	"ci:check": "pnpm check --skip 'docker:*'",
-	"tooling:check": "bst repo:sync --check",
-	"tooling:sync": "bst repo:sync"
-};
-/** Scripts that tooling owns — map from script name to keyword that must appear in the value. */
-const MANAGED_SCRIPTS = {
-	check: "bst checks:run",
-	"ci:check": "pnpm check",
-	"tooling:check": "bst repo:sync --check",
-	"tooling:sync": "bst repo:sync",
-	"trigger-release": "bst release:trigger",
-	"docker:build": "bst docker:build",
-	"docker:check": "bst docker:check"
-};
-/** Check if an existing script value satisfies a managed script requirement.
-* Accepts both `bst <cmd>` and `bin.mjs <cmd>` (used in the tooling repo itself). */
-function matchesManagedScript(scriptValue, expectedFragment) {
-	if (scriptValue.includes(expectedFragment)) return true;
-	const binMjsFragment = expectedFragment.replace(/^bst /, "bin.mjs ");
-	return scriptValue.includes(binMjsFragment);
+//#region src/utils/yaml-merge.ts
+const IGNORE_PATTERN = "@bensandee/tooling:ignore";
+const FORGEJO_SCHEMA_COMMENT = "# yaml-language-server: $schema=../../.vscode/forgejo-workflow.schema.json\n";
+/** Returns a yaml-language-server schema comment for Forgejo workflows, empty string otherwise. */
+function workflowSchemaComment(ci) {
+	return ci === "forgejo" ? FORGEJO_SCHEMA_COMMENT : "";
 }
-/** Deprecated scripts to remove during migration. */
-const DEPRECATED_SCRIPTS = ["tooling:init", "tooling:update"];
-/** DevDeps that belong in every project (single repo) or per-package (monorepo). */
-const PER_PACKAGE_DEV_DEPS = {
-	"@types/node": "25.3.2",
-	tsdown: "0.20.3",
-	typescript: "5.9.3",
-	vitest: "4.0.18"
-};
-/** DevDeps that belong at the root regardless of structure. */
-const ROOT_DEV_DEPS = {
-	knip: "5.85.0",
-	lefthook: "2.1.2",
-	oxlint: "1.50.0"
-};
-/**
-* Check if a package name is available as a workspace dependency.
-* Looks for a matching package in the packages/ directory.
-*/
-function isWorkspacePackage(ctx, packageName) {
-	if (ctx.config.structure !== "monorepo") return false;
-	const packagesDir = path.join(ctx.targetDir, "packages");
-	if (!existsSync(packagesDir)) return false;
-	try {
-		for (const entry of readdirSync(packagesDir, { withFileTypes: true })) {
-			if (!entry.isDirectory()) continue;
-			const pkgJsonPath = path.join(packagesDir, entry.name, "package.json");
-			if (!existsSync(pkgJsonPath)) continue;
-			try {
-				if (parsePackageJson(readFileSync(pkgJsonPath, "utf-8"))?.name === packageName) return true;
-			} catch (_error) {}
-		}
-	} catch (_error) {}
-	return false;
+/** Prepend the Forgejo schema comment if it's not already present. No-op for GitHub. */
+function ensureSchemaComment(content, ci) {
+	if (ci !== "forgejo") return content;
+	if (content.includes("yaml-language-server")) return content;
+	return FORGEJO_SCHEMA_COMMENT + content;
 }
-/** Deps that should not be blindly bumped to latest (version-sensitive). */
-const UPDATE_EXCLUDE = new Set(["@types/node"]);
-/** Add release-strategy-specific devDeps to a deps record. */
-function addReleaseDeps(deps, config) {
-	switch (config.releaseStrategy) {
-		case "release-it":
-			deps["release-it"] = "18.1.2";
-			if (config.structure === "monorepo") deps["@release-it/bumper"] = "7.0.2";
-			break;
-		case "simple": break;
-		case "changesets":
-			deps["@changesets/cli"] = "2.29.4";
-			break;
-	}
+/** Migrate content from old tooling binary name to new. */
+function migrateToolingBinary(content) {
+	return content.replaceAll("pnpm exec tooling ", "pnpm exec bst ");
 }
-/** Returns the list of pinned devDependency names that the tool would add for a given config. */
-function getAddedDevDepNames(config) {
-	const deps = { ...ROOT_DEV_DEPS };
-	if (config.structure !== "monorepo") Object.assign(deps, PER_PACKAGE_DEV_DEPS);
-	deps["@bensandee/config"] = "0.9.1";
-	deps["@bensandee/tooling"] = "0.28.0";
-	if (config.formatter === "oxfmt") deps["oxfmt"] = "0.35.0";
-	if (config.formatter === "prettier") deps["prettier"] = "3.8.1";
-	addReleaseDeps(deps, config);
-	return Object.keys(deps).filter((name) => !UPDATE_EXCLUDE.has(name));
+/** Check if a YAML file has an opt-out comment in the first 10 lines. */
+function isToolingIgnored(content) {
+	return content.split("\n", 10).some((line) => line.includes(IGNORE_PATTERN));
 }
-async function generatePackageJson(ctx) {
-	const filePath = "package.json";
-	const existing = ctx.read(filePath);
-	const isMonorepo = ctx.config.structure === "monorepo";
-	const scripts = isMonorepo ? STANDARD_SCRIPTS_MONOREPO : STANDARD_SCRIPTS_SINGLE;
-	const formatScript = ctx.config.formatter === "oxfmt" ? "oxfmt ." : "prettier --write .";
-	const allScripts = {
-		...scripts,
-		format: formatScript
+/**
+* Ensure required commands exist under `pre-commit.commands` in a lefthook config.
+* Only adds missing commands — never modifies existing ones.
+* Returns unchanged content if the file has an opt-out comment or can't be parsed.
+*/
+function mergeLefthookCommands(existing, requiredCommands) {
+	if (isToolingIgnored(existing)) return {
+		content: existing,
+		changed: false
 	};
-	if (ctx.config.releaseStrategy === "changesets") allScripts["changeset"] = "changeset";
-	if (ctx.config.releaseStrategy !== "none" && ctx.config.releaseStrategy !== "changesets") allScripts["trigger-release"] = "bst release:trigger";
-	if (hasDockerPackages(ctx)) {
-		allScripts["docker:build"] = "bst docker:build";
-		allScripts["docker:check"] = "bst docker:check";
-	}
-	const devDeps = { ...ROOT_DEV_DEPS };
-	if (!isMonorepo) Object.assign(devDeps, PER_PACKAGE_DEV_DEPS);
-	devDeps["@bensandee/config"] = isWorkspacePackage(ctx, "@bensandee/config") ? "workspace:*" : "0.9.1";
-	devDeps["@bensandee/tooling"] = isWorkspacePackage(ctx, "@bensandee/tooling") ? "workspace:*" : "0.28.0";
-	if (ctx.config.useEslintPlugin) devDeps["@bensandee/eslint-plugin"] = isWorkspacePackage(ctx, "@bensandee/eslint-plugin") ? "workspace:*" : "0.9.2";
-	if (ctx.config.formatter === "oxfmt") devDeps["oxfmt"] = "0.35.0";
-	if (ctx.config.formatter === "prettier") devDeps["prettier"] = "3.8.1";
-	addReleaseDeps(devDeps, ctx.config);
-	if (existing) {
-		const pkg = parsePackageJson(existing);
-		if (!pkg) return {
-			filePath,
-			action: "skipped",
-			description: "Could not parse existing package.json"
-		};
-		const changes = [];
-		if (pkg.type !== "module") {
-			pkg.type = "module";
-			changes.push("set type: \"module\"");
-		}
-		const existingScripts = pkg.scripts ?? {};
-		for (const [key, value] of Object.entries(existingScripts)) if (typeof value === "string" && value.includes("pnpm exec tooling ")) {
-			existingScripts[key] = migrateToolingBinary(value);
-			changes.push(`migrated script: ${key}`);
-		}
-		for (const [key, value] of Object.entries(allScripts)) if (!(key in existingScripts)) {
-			existingScripts[key] = value;
-			changes.push(`added script: ${key}`);
-		} else if (key in MANAGED_SCRIPTS && !matchesManagedScript(existingScripts[key] ?? "", MANAGED_SCRIPTS[key] ?? "")) {
-			existingScripts[key] = value;
-			changes.push(`updated script: ${key}`);
-		}
-		for (const key of DEPRECATED_SCRIPTS) if (key in existingScripts) {
-			delete existingScripts[key];
-			changes.push(`removed deprecated script: ${key}`);
-		}
-		pkg.scripts = existingScripts;
-		const existingDevDeps = pkg.devDependencies ?? {};
-		for (const [key, value] of Object.entries(devDeps)) if (!(key in existingDevDeps)) {
-			existingDevDeps[key] = value;
-			changes.push(`added devDependency: ${key}`);
-		} else if (key.startsWith("@bensandee/") && existingDevDeps[key] !== value && existingDevDeps[key] !== "workspace:*") {
-			existingDevDeps[key] = value;
-			changes.push(`updated devDependency: ${key} to ${value}`);
+	try {
+		const doc = parseDocument(existing);
+		let changed = false;
+		if (!doc.hasIn(["pre-commit", "commands"])) {
+			doc.setIn(["pre-commit", "commands"], requiredCommands);
+			return {
+				content: doc.toString(),
+				changed: true
+			};
 		}
-		pkg.devDependencies = existingDevDeps;
-		if (!pkg["engines"]) {
-			pkg["engines"] = { node: ">=24.13.0" };
-			changes.push("set engines.node >= 24.13.0");
+		const commands = doc.getIn(["pre-commit", "commands"]);
+		if (!isMap(commands)) return {
+			content: existing,
+			changed: false
+		};
+		for (const [name, config] of Object.entries(requiredCommands)) if (!commands.has(name)) {
+			commands.set(name, config);
+			changed = true;
 		}
-		if (changes.length === 0) return {
-			filePath,
-			action: "skipped",
-			description: "Already up to spec"
+		return {
+			content: changed ? doc.toString() : existing,
+			changed
 		};
-		ctx.write(filePath, JSON.stringify(pkg, null, 2) + "\n");
+	} catch {
 		return {
-			filePath,
-			action: "updated",
-			description: changes.join(", ")
+			content: existing,
+			changed: false
 		};
 	}
-	const pkg = {
-		name: ctx.config.name,
-		version: "0.1.0",
-		private: true,
-		type: "module",
-		scripts: allScripts,
-		devDependencies: devDeps,
-		engines: { node: ">=24.13.0" },
-		packageManager: "pnpm@10.29.3"
-	};
-	ctx.write(filePath, JSON.stringify(pkg, null, 2) + "\n");
-	return {
-		filePath,
-		action: "created",
-		description: "Generated package.json"
-	};
 }
-//#endregion
-//#region src/generators/tsconfig.ts
-async function generateTsconfig(ctx) {
-	const filePath = "tsconfig.json";
-	const existing = ctx.read(filePath);
-	if (ctx.config.structure === "monorepo") return [generateMonorepoRootTsconfig(ctx), ...ctx.config.detectPackageTypes ? generateMonorepoPackageTsconfigs(ctx) : []];
-	const extendsValue = `@bensandee/config/tsconfig/${ctx.config.projectType}`;
-	if (!existing) {
-		const config = {
-			extends: extendsValue,
-			...ctx.exists("src") ? { include: ["src"] } : {}
-		};
-		ctx.write(filePath, JSON.stringify(config, null, 2) + "\n");
-		return [{
-			filePath,
-			action: "created",
-			description: `Generated tsconfig.json with ${extendsValue}`
-		}];
-	}
-	if (existing.includes("// @bensandee/tooling:ignore")) return [{
-		filePath,
-		action: "skipped",
-		description: "Ignored via tooling:ignore comment"
-	}];
-	const parsed = parseTsconfig(existing);
-	if (isSolutionStyle(parsed)) {
-		const results = [{
-			filePath,
-			action: "skipped",
-			description: "Solution-style tsconfig — traversing references"
-		}];
-		for (const ref of parsed.references ?? []) {
-			const refPath = resolveReferencePath(ref.path);
-			results.push(mergeSingleTsconfig(ctx, refPath, extendsValue));
+/**
+* Ensure required steps exist in a workflow job's steps array.
+* Only adds missing steps at the end — never modifies existing ones.
+* Returns unchanged content if the file has an opt-out comment or can't be parsed.
+*/
+function mergeWorkflowSteps(existing, jobName, requiredSteps) {
+	if (isToolingIgnored(existing)) return {
+		content: existing,
+		changed: false
+	};
+	try {
+		const doc = parseDocument(existing);
+		const steps = doc.getIn([
+			"jobs",
+			jobName,
+			"steps"
+		]);
+		if (!isSeq(steps)) return {
+			content: existing,
+			changed: false
+		};
+		let changed = false;
+		for (const { match, step } of requiredSteps) if (!steps.items.some((item) => {
+			if (!isMap(item)) return false;
+			if (match.run) {
+				const run = item.get("run");
+				return typeof run === "string" && run.includes(match.run);
+			}
+			if (match.uses) {
+				const uses = item.get("uses");
+				return typeof uses === "string" && uses.startsWith(match.uses);
+			}
+			return false;
+		})) {
+			steps.add(doc.createNode(step));
+			changed = true;
 		}
-		return results;
+		return {
+			content: changed ? doc.toString() : existing,
+			changed
+		};
+	} catch {
+		return {
+			content: existing,
+			changed: false
+		};
 	}
-	return [mergeSingleTsconfig(ctx, filePath, extendsValue)];
-}
-function isSolutionStyle(parsed) {
-	return Array.isArray(parsed.references) && parsed.references.length > 0 && Array.isArray(parsed.files) && parsed.files.length === 0;
-}
-function resolveReferencePath(refPath) {
-	const resolved = refPath.endsWith(".json") ? refPath : path.join(refPath, "tsconfig.json");
-	return path.normalize(resolved);
 }
-function mergeSingleTsconfig(ctx, filePath, extendsValue) {
-	const existing = ctx.read(filePath);
-	if (!existing) return {
-		filePath,
-		action: "skipped",
-		description: "File not found"
+/**
+* Add a job to an existing workflow YAML if it doesn't already exist.
+* Returns unchanged content if the job already exists, the file has an opt-out comment,
+* or the document can't be parsed.
+*/
+/**
+* Ensure a `concurrency` block exists at the workflow top level.
+* Adds it if missing — never modifies an existing one.
+* Returns unchanged content if the file has an opt-out comment or can't be parsed.
+*/
+/**
+* Ensure `on.push` has `tags-ignore: ["**"]` so tag pushes don't trigger CI.
+* Only adds the filter when `on.push` exists and `tags-ignore` is absent.
+*/
+function ensureWorkflowTagsIgnore(existing) {
+	if (isToolingIgnored(existing)) return {
+		content: existing,
+		changed: false
 	};
-	if (existing.includes("// @bensandee/tooling:ignore")) return {
-		filePath,
-		action: "skipped",
-		description: "Ignored via tooling:ignore comment"
+	try {
+		const doc = parseDocument(existing);
+		const on = doc.get("on");
+		if (!isMap(on)) return {
+			content: existing,
+			changed: false
+		};
+		const push = on.get("push");
+		if (!isMap(push)) return {
+			content: existing,
+			changed: false
+		};
+		if (push.has("tags-ignore")) return {
+			content: existing,
+			changed: false
+		};
+		push.set("tags-ignore", ["**"]);
+		return {
+			content: doc.toString(),
+			changed: true
+		};
+	} catch {
+		return {
+			content: existing,
+			changed: false
+		};
+	}
+}
+function ensureWorkflowConcurrency(existing, concurrency) {
+	if (isToolingIgnored(existing)) return {
+		content: existing,
+		changed: false
 	};
-	const parsed = parseTsconfig(existing);
-	const changes = [];
-	if (!parsed.extends) {
-		parsed.extends = extendsValue;
-		changes.push(`added extends: ${extendsValue}`);
+	try {
+		const doc = parseDocument(existing);
+		if (doc.has("concurrency")) return {
+			content: existing,
+			changed: false
+		};
+		doc.set("concurrency", concurrency);
+		const contents = doc.contents;
+		if (isMap(contents)) {
+			const items = contents.items;
+			const nameIdx = items.findIndex((p) => isScalar(p.key) && p.key.value === "name");
+			const concPair = items.pop();
+			if (concPair) items.splice(nameIdx + 1, 0, concPair);
+		}
+		return {
+			content: doc.toString(),
+			changed: true
+		};
+	} catch {
+		return {
+			content: existing,
+			changed: false
+		};
 	}
-	if (!parsed.include) {
-		const tsconfigDir = path.dirname(filePath);
-		const srcDir = tsconfigDir === "." ? "src" : path.join(tsconfigDir, "src");
-		if (ctx.exists(srcDir)) {
-			parsed.include = ["src"];
-			changes.push("added include: [\"src\"]");
+}
+//#endregion
+//#region src/generators/ci-utils.ts
+/** Build a GitHub Actions expression like `${{ expr }}` without triggering no-template-curly-in-string. */
+function actionsExpr(expr) {
+	return `\${{ ${expr} }}`;
+}
+function hasEnginesNode(ctx) {
+	const raw = ctx.read("package.json");
+	if (!raw) return false;
+	return typeof parsePackageJson(raw)?.engines?.["node"] === "string";
+}
+function computeNodeVersionYaml(ctx) {
+	return hasEnginesNode(ctx) ? "node-version-file: package.json" : "node-version: \"24\"";
+}
+//#endregion
+//#region src/generators/publish-ci.ts
+function deployWorkflow(ci, nodeVersionYaml) {
+	return `${workflowSchemaComment(ci)}name: Publish
+on:
+  push:
+    tags:
+      - "v[0-9]+.[0-9]+.[0-9]+"
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          ${nodeVersionYaml}
+      - run: pnpm install --frozen-lockfile
+      - name: Publish Docker images
+        env:
+          DOCKER_REGISTRY_HOST: ${actionsExpr("vars.DOCKER_REGISTRY_HOST")}
+          DOCKER_REGISTRY_NAMESPACE: ${actionsExpr("vars.DOCKER_REGISTRY_NAMESPACE")}
+          DOCKER_USERNAME: ${actionsExpr("secrets.DOCKER_USERNAME")}
+          DOCKER_PASSWORD: ${actionsExpr("secrets.DOCKER_PASSWORD")}
+        run: pnpm exec bst docker:publish
+`;
+}
+function requiredDeploySteps() {
+	return [
+		{
+			match: { uses: "actions/checkout" },
+			step: { uses: "actions/checkout@v4" }
+		},
+		{
+			match: { uses: "pnpm/action-setup" },
+			step: { uses: "pnpm/action-setup@v4" }
+		},
+		{
+			match: { uses: "actions/setup-node" },
+			step: { uses: "actions/setup-node@v4" }
+		},
+		{
+			match: { run: "pnpm install" },
+			step: { run: "pnpm install --frozen-lockfile" }
+		},
+		{
+			match: { run: "docker:publish" },
+			step: { run: "pnpm exec bst docker:publish" }
 		}
+	];
+}
+const DockerMapSchema = z.object({ docker: z.record(z.string(), z.unknown()).optional() });
+/** Get names of packages that have Docker builds (by convention or .tooling.json config). */
+function getDockerPackageNames(ctx) {
+	const names = [];
+	const configRaw = ctx.read(".tooling.json");
+	if (configRaw) {
+		const result = DockerMapSchema.safeParse(JSON.parse(configRaw));
+		if (result.success && result.data.docker) names.push(...Object.keys(result.data.docker));
 	}
-	if (changes.length === 0) return {
-		filePath,
-		action: "skipped",
-		description: "Already up to spec"
-	};
-	ctx.write(filePath, JSON.stringify(parsed, null, 2) + "\n");
-	return {
-		filePath,
-		action: "updated",
-		description: changes.join(", ")
-	};
+	if (ctx.config.structure === "monorepo") {
+		const packages = getMonorepoPackages(ctx.targetDir);
+		for (const pkg of packages) {
+			const dirName = pkg.name.split("/").pop() ?? pkg.name;
+			if (names.includes(dirName)) continue;
+			for (const rel of CONVENTION_DOCKERFILE_PATHS) if (ctx.exists(`packages/${dirName}/${rel}`)) {
+				names.push(dirName);
+				break;
+			}
+		}
+	} else for (const rel of CONVENTION_DOCKERFILE_PATHS) if (ctx.exists(rel)) {
+		if (!names.includes(ctx.config.name)) names.push(ctx.config.name);
+		break;
+	}
+	return names;
 }
-function generateMonorepoRootTsconfig(ctx) {
-	const filePath = "tsconfig.json";
-	if (!ctx.read(filePath)) return {
+/** Check whether any Docker packages exist by convention or .tooling.json config. */
+function hasDockerPackages(ctx) {
+	return getDockerPackageNames(ctx).length > 0;
+}
+async function generateDeployCi(ctx) {
+	const filePath = "deploy-ci";
+	if (!ctx.config.publishDocker || ctx.config.ci === "none") return {
 		filePath,
 		action: "skipped",
-		description: "No tsconfig.json found"
+		description: "Deploy CI workflow not applicable"
 	};
-	return {
-		filePath,
-		action: "skipped",
-		description: "Root tsconfig left as-is"
-	};
-}
-function generateMonorepoPackageTsconfigs(ctx) {
-	const packages = getMonorepoPackages(ctx.targetDir);
-	const results = [];
-	for (const pkg of packages) {
-		const relDir = path.relative(ctx.targetDir, pkg.dir);
-		const filePath = path.join(relDir, "tsconfig.json");
-		const existing = ctx.read(filePath);
-		const projectType = detectProjectType(pkg.dir);
-		const extendsValue = `@bensandee/config/tsconfig/${projectType}`;
-		if (existing) {
-			if (existing.includes("// @bensandee/tooling:ignore")) {
-				results.push({
-					filePath,
+	const isGitHub = ctx.config.ci === "github";
+	const workflowPath = isGitHub ? ".github/workflows/publish.yml" : ".forgejo/workflows/publish.yml";
+	const nodeVersionYaml = computeNodeVersionYaml(ctx);
+	const content = deployWorkflow(ctx.config.ci, nodeVersionYaml);
+	if (ctx.exists(workflowPath)) {
+		const raw = ctx.read(workflowPath);
+		if (raw) {
+			const existing = migrateToolingBinary(raw);
+			if (existing === content || ensureSchemaComment(existing, ctx.config.ci) === content) {
+				if (existing !== raw) {
+					ctx.write(workflowPath, ensureSchemaComment(existing, ctx.config.ci));
+					return {
+						filePath: workflowPath,
+						action: "updated",
+						description: "Migrated tooling binary name in publish workflow"
+					};
+				}
+				return {
+					filePath: workflowPath,
 					action: "skipped",
-					description: "Ignored via tooling:ignore comment"
-				});
-				continue;
+					description: "Publish workflow already up to date"
+				};
 			}
-			const parsed = parseTsconfig(existing);
-			if (isSolutionStyle(parsed)) {
-				results.push({
-					filePath,
-					action: "skipped",
-					description: "Solution-style tsconfig — traversing references"
-				});
-				for (const ref of parsed.references ?? []) {
-					const refPath = path.join(relDir, resolveReferencePath(ref.path));
-					results.push(mergeSingleTsconfig(ctx, refPath, extendsValue));
+			const merged = mergeWorkflowSteps(existing, "publish", requiredDeploySteps());
+			const withComment = ensureSchemaComment(merged.content, ctx.config.ci);
+			if (!merged.changed) {
+				if (withComment !== raw) {
+					ctx.write(workflowPath, withComment);
+					return {
+						filePath: workflowPath,
+						action: "updated",
+						description: existing !== raw ? "Migrated tooling binary name in publish workflow" : "Added schema comment to publish workflow"
+					};
 				}
-				continue;
-			}
-			const changes = [];
-			if (parsed.extends !== extendsValue) {
-				const prev = parsed.extends;
-				parsed.extends = extendsValue;
-				changes.push(prev ? `changed extends: ${String(prev)} → ${extendsValue}` : `added extends: ${extendsValue}`);
-			}
-			if (!parsed.include && ctx.exists(path.join(relDir, "src"))) {
-				parsed.include = ["src"];
-				changes.push("added include: [\"src\"]");
-			}
-			if (changes.length === 0) {
-				results.push({
-					filePath,
+				return {
+					filePath: workflowPath,
 					action: "skipped",
-					description: `Already up to spec (${projectType})`
-				});
-				continue;
+					description: "Existing publish workflow preserved"
+				};
 			}
-			ctx.write(filePath, JSON.stringify(parsed, null, 2) + "\n");
-			results.push({
-				filePath,
+			ctx.write(workflowPath, withComment);
+			return {
+				filePath: workflowPath,
 				action: "updated",
-				description: changes.join(", ")
-			});
-		} else {
-			const config = {
-				extends: extendsValue,
-				...ctx.exists(path.join(relDir, "src")) ? { include: ["src"] } : {}
+				description: "Added missing steps to publish workflow"
 			};
-			ctx.write(filePath, JSON.stringify(config, null, 2) + "\n");
-			results.push({
-				filePath,
-				action: "created",
-				description: `Generated tsconfig.json with @bensandee/config/tsconfig/${projectType} (detected ${projectType})`
-			});
 		}
-	}
-	return results;
-}
-//#endregion
-//#region src/generators/vitest.ts
-const VITEST_CONFIG = `import { defineConfig } from "vitest/config";
-
-export default defineConfig({
-  test: {
-    include: ["test/**/*.test.ts"],
-  },
-});
-`;
-const STARTER_TEST = `import { describe, it, expect } from "vitest";
-
-describe("example", () => {
-  it("should pass a basic assertion", () => {
-    expect(1 + 1).toBe(2);
-  });
-});
-`;
-async function generateVitest(ctx) {
-	const results = [];
-	if (!ctx.config.setupVitest) return [{
-		filePath: "vitest.config.ts",
-		action: "skipped",
-		description: "Vitest setup not requested"
-	}];
-	if (ctx.config.structure === "monorepo") return [{
-		filePath: "vitest.config.ts",
-		action: "skipped",
-		description: "Monorepo: vitest config belongs in individual packages"
-	}];
-	const configPath = "vitest.config.ts";
-	if (ctx.exists(configPath)) if (ctx.read(configPath) === VITEST_CONFIG) results.push({
-		filePath: configPath,
-		action: "skipped",
-		description: "Config already up to date"
-	});
-	else if (await ctx.confirmOverwrite(configPath) === "skip") results.push({
-		filePath: configPath,
-		action: "skipped",
-		description: "Existing config preserved"
-	});
-	else {
-		ctx.write(configPath, VITEST_CONFIG);
-		results.push({
-			filePath: configPath,
-			action: "updated",
-			description: "Replaced vitest config"
-		});
-	}
-	else {
-		ctx.write(configPath, VITEST_CONFIG);
-		results.push({
-			filePath: configPath,
-			action: "created",
-			description: "Generated vitest.config.ts"
-		});
-	}
-	const testPath = "test/example.test.ts";
-	if (!ctx.exists("test")) {
-		ctx.write(testPath, STARTER_TEST);
-		results.push({
-			filePath: testPath,
-			action: "created",
-			description: "Generated starter test file"
-		});
-	}
-	return results;
-}
-//#endregion
-//#region src/generators/oxlint.ts
-const CONFIG_WITH_LINT_RULES = `import recommended from "@bensandee/config/oxlint/recommended";
-import { defineConfig } from "oxlint";
-
-export default defineConfig({
-  extends: [recommended],
-});
-`;
-const CONFIG_PRESET_ONLY = `import { presetRules } from "@bensandee/config/oxlint";
-import { defineConfig } from "oxlint";
-
-export default defineConfig({
-  rules: presetRules,
-});
-`;
-async function generateOxlint(ctx) {
-	const filePath = "oxlint.config.ts";
-	const content = ctx.config.useEslintPlugin ? CONFIG_WITH_LINT_RULES : CONFIG_PRESET_ONLY;
-	const existing = ctx.read(filePath);
-	if (existing) {
-		if (existing === content || existing.includes("@bensandee/config/oxlint")) return {
-			filePath,
-			action: "skipped",
-			description: "Already configured"
-		};
-		if (await ctx.confirmOverwrite(filePath) === "skip") return {
-			filePath,
+		return {
+			filePath: workflowPath,
 			action: "skipped",
-			description: "User chose to keep existing"
+			description: "Publish workflow already up to date"
 		};
 	}
-	ctx.write(filePath, content);
-	return {
-		filePath,
-		action: existing ? "updated" : "created",
-		description: "Generated oxlint.config.ts"
-	};
-}
-//#endregion
-//#region src/generators/formatter.ts
-const OXFMT_CONFIG = `{}\n`;
-const PRETTIER_CONFIG = `{
-  "semi": true,
-  "singleQuote": false,
-  "trailingComma": "all",
-  "tabWidth": 2,
-  "printWidth": 120
-}
-`;
-async function generateFormatter(ctx) {
-	if (ctx.config.formatter === "oxfmt") return generateOxfmt(ctx);
-	return generatePrettier(ctx);
-}
-async function generateOxfmt(ctx) {
-	const filePath = ".oxfmtrc.json";
-	if (ctx.exists(filePath)) return {
-		filePath,
-		action: "skipped",
-		description: "Existing oxfmt config preserved"
-	};
-	ctx.write(filePath, OXFMT_CONFIG);
-	return {
-		filePath,
-		action: "created",
-		description: "Generated .oxfmtrc.json"
-	};
-}
-async function generatePrettier(ctx) {
-	const filePath = ".prettierrc";
-	if (ctx.exists(filePath)) return {
-		filePath,
-		action: "skipped",
-		description: "Existing prettier config preserved"
-	};
-	ctx.write(filePath, PRETTIER_CONFIG);
+	ctx.write(workflowPath, content);
 	return {
-		filePath,
+		filePath: workflowPath,
 		action: "created",
-		description: "Generated .prettierrc"
+		description: `Generated ${isGitHub ? "GitHub" : "Forgejo"} Actions publish workflow`
 	};
 }
 //#endregion
-//#region src/generators/tsdown.ts
-const TSDOWN_CONFIG = `import { defineConfig } from "tsdown";
-
-export default defineConfig({
-  entry: ["src/index.ts"],
-});
-`;
-async function generateTsdown(ctx) {
-	const filePath = "tsdown.config.ts";
-	if (ctx.config.structure === "monorepo") return {
-		filePath,
-		action: "skipped",
-		description: "Monorepo: tsdown config belongs in individual packages"
-	};
-	const existing = ctx.read(filePath);
-	if (existing) {
-		if (existing === TSDOWN_CONFIG) return {
-			filePath,
-			action: "skipped",
-			description: "Already configured"
-		};
-		if (await ctx.confirmOverwrite(filePath) === "skip") return {
-			filePath,
-			action: "skipped",
-			description: "Existing tsdown config preserved"
-		};
+//#region src/generators/package-json.ts
+const STANDARD_SCRIPTS_SINGLE = {
+	build: "tsdown",
+	dev: "tsdown --watch",
+	typecheck: "tsc --noEmit",
+	test: "vitest run",
+	lint: "oxlint",
+	knip: "knip",
+	check: "bst checks:run",
+	"ci:check": "pnpm check --skip 'docker:*'",
+	"tooling:check": "bst repo:sync --check",
+	"tooling:sync": "bst repo:sync"
+};
+const STANDARD_SCRIPTS_MONOREPO = {
+	build: "pnpm -r build",
+	test: "pnpm -r test",
+	typecheck: "pnpm -r --parallel run typecheck",
+	lint: "oxlint",
+	knip: "knip",
+	check: "bst checks:run",
+	"ci:check": "pnpm check --skip 'docker:*'",
+	"tooling:check": "bst repo:sync --check",
+	"tooling:sync": "bst repo:sync"
+};
+/** Scripts that tooling owns — map from script name to keyword that must appear in the value. */
+const MANAGED_SCRIPTS = {
+	check: "bst checks:run",
+	"ci:check": "pnpm check",
+	"tooling:check": "bst repo:sync --check",
+	"tooling:sync": "bst repo:sync",
+	"trigger-release": "bst release:trigger",
+	"docker:build": "bst docker:build",
+	"docker:check": "bst docker:check"
+};
+/** Check if an existing script value satisfies a managed script requirement.
+* Accepts both `bst <cmd>` and `bin.mjs <cmd>` (used in the tooling repo itself). */
+function matchesManagedScript(scriptValue, expectedFragment) {
+	if (scriptValue.includes(expectedFragment)) return true;
+	const binMjsFragment = expectedFragment.replace(/^bst /, "bin.mjs ");
+	return scriptValue.includes(binMjsFragment);
+}
+/** Deprecated scripts to remove during migration. */
+const DEPRECATED_SCRIPTS = ["tooling:init", "tooling:update"];
+/** DevDeps that belong in every project (single repo) or per-package (monorepo). */
+const PER_PACKAGE_DEV_DEPS = {
+	"@types/node": "25.3.2",
+	tsdown: "0.20.3",
+	typescript: "5.9.3",
+	vitest: "4.0.18"
+};
+/** DevDeps that belong at the root regardless of structure. */
+const ROOT_DEV_DEPS = {
+	knip: "5.85.0",
+	lefthook: "2.1.2",
+	oxlint: "1.50.0"
+};
+/**
+* Check if a package name is available as a workspace dependency.
+* Looks for a matching package in the packages/ directory.
+*/
+function isWorkspacePackage(ctx, packageName) {
+	if (ctx.config.structure !== "monorepo") return false;
+	const packagesDir = path.join(ctx.targetDir, "packages");
+	if (!existsSync(packagesDir)) return false;
+	try {
+		for (const entry of readdirSync(packagesDir, { withFileTypes: true })) {
+			if (!entry.isDirectory()) continue;
+			const pkgJsonPath = path.join(packagesDir, entry.name, "package.json");
+			if (!existsSync(pkgJsonPath)) continue;
+			try {
+				if (parsePackageJson(readFileSync(pkgJsonPath, "utf-8"))?.name === packageName) return true;
+			} catch (_error) {}
+		}
+	} catch (_error) {}
+	return false;
+}
+/** Deps that should not be blindly bumped to latest (version-sensitive). */
+const UPDATE_EXCLUDE = new Set(["@types/node"]);
+/** Add release-strategy-specific devDeps to a deps record. */
+function addReleaseDeps(deps, config) {
+	switch (config.releaseStrategy) {
+		case "release-it":
+			deps["release-it"] = "18.1.2";
+			if (config.structure === "monorepo") deps["@release-it/bumper"] = "7.0.2";
+			break;
+		case "simple": break;
+		case "changesets":
+			deps["@changesets/cli"] = "2.29.4";
+			break;
 	}
-	ctx.write(filePath, TSDOWN_CONFIG);
-	return {
-		filePath,
-		action: existing ? "updated" : "created",
-		description: "Generated tsdown.config.ts"
-	};
 }
-//#endregion
-//#region src/generators/gitignore.ts
-/** Entries that every project should have — repo:sync --check flags these as missing. */
-const REQUIRED_ENTRIES = [
-	"node_modules/",
-	".pnpm-store/",
-	"dist/",
-	"*.tsbuildinfo",
-	".env",
-	".env.*",
-	"!.env.example"
-];
-/** Tooling-specific entries added during init/update but not required for repo:sync --check. */
-const OPTIONAL_ENTRIES = [".tooling-migrate.md", ".tooling-archived/"];
-const ALL_ENTRIES = [...REQUIRED_ENTRIES, ...OPTIONAL_ENTRIES];
-/** Normalize a gitignore entry for comparison: strip leading `/` and trailing `/`. */
-function normalizeEntry(entry) {
-	let s = entry.trim();
-	if (s.startsWith("/")) s = s.slice(1);
-	if (s.endsWith("/")) s = s.slice(0, -1);
-	return s;
+/** Returns the list of pinned devDependency names that the tool would add for a given config. */
+function getAddedDevDepNames(config) {
+	const deps = { ...ROOT_DEV_DEPS };
+	if (config.structure !== "monorepo") Object.assign(deps, PER_PACKAGE_DEV_DEPS);
+	deps["@bensandee/config"] = "0.9.1";
+	deps["@bensandee/tooling"] = "0.28.1";
+	if (config.formatter === "oxfmt") deps["oxfmt"] = "0.35.0";
+	if (config.formatter === "prettier") deps["prettier"] = "3.8.1";
+	addReleaseDeps(deps, config);
+	return Object.keys(deps).filter((name) => !UPDATE_EXCLUDE.has(name));
 }
-async function generateGitignore(ctx) {
-	const filePath = ".gitignore";
+async function generatePackageJson(ctx) {
+	const filePath = "package.json";
 	const existing = ctx.read(filePath);
+	const isMonorepo = ctx.config.structure === "monorepo";
+	const scripts = isMonorepo ? STANDARD_SCRIPTS_MONOREPO : STANDARD_SCRIPTS_SINGLE;
+	const formatScript = ctx.config.formatter === "oxfmt" ? "oxfmt ." : "prettier --write .";
+	const allScripts = {
+		...scripts,
+		format: formatScript
+	};
+	if (ctx.config.releaseStrategy === "changesets") allScripts["changeset"] = "changeset";
+	if (ctx.config.releaseStrategy !== "none" && ctx.config.releaseStrategy !== "changesets") allScripts["trigger-release"] = "bst release:trigger";
+	if (hasDockerPackages(ctx)) {
+		allScripts["docker:build"] = "bst docker:build";
+		allScripts["docker:check"] = "bst docker:check";
+	}
+	const devDeps = { ...ROOT_DEV_DEPS };
+	if (!isMonorepo) Object.assign(devDeps, PER_PACKAGE_DEV_DEPS);
+	devDeps["@bensandee/config"] = isWorkspacePackage(ctx, "@bensandee/config") ? "workspace:*" : "0.9.1";
+	devDeps["@bensandee/tooling"] = isWorkspacePackage(ctx, "@bensandee/tooling") ? "workspace:*" : "0.28.1";
+	if (ctx.config.useEslintPlugin) devDeps["@bensandee/eslint-plugin"] = isWorkspacePackage(ctx, "@bensandee/eslint-plugin") ? "workspace:*" : "0.9.2";
+	if (ctx.config.formatter === "oxfmt") devDeps["oxfmt"] = "0.35.0";
+	if (ctx.config.formatter === "prettier") devDeps["prettier"] = "3.8.1";
+	addReleaseDeps(devDeps, ctx.config);
 	if (existing) {
-		const existingNormalized = new Set(existing.split("\n").map(normalizeEntry).filter((line) => line.length > 0));
-		const missing = ALL_ENTRIES.filter((entry) => !existingNormalized.has(normalizeEntry(entry)));
-		if (missing.length === 0) return {
+		const pkg = parsePackageJson(existing);
+		if (!pkg) return {
 			filePath,
 			action: "skipped",
-			description: "Already has all standard entries"
+			description: "Could not parse existing package.json"
 		};
-		const missingRequired = REQUIRED_ENTRIES.filter((entry) => !existingNormalized.has(normalizeEntry(entry)));
-		const updated = existing.trimEnd() + "\n\n# Added by @bensandee/tooling\n" + missing.join("\n") + "\n";
-		ctx.write(filePath, updated);
-		if (missingRequired.length === 0) return {
+		const changes = [];
+		if (pkg.type !== "module") {
+			pkg.type = "module";
+			changes.push("set type: \"module\"");
+		}
+		const existingScripts = pkg.scripts ?? {};
+		for (const [key, value] of Object.entries(existingScripts)) if (typeof value === "string" && value.includes("pnpm exec tooling ")) {
+			existingScripts[key] = migrateToolingBinary(value);
+			changes.push(`migrated script: ${key}`);
+		}
+		for (const [key, value] of Object.entries(allScripts)) if (!(key in existingScripts)) {
+			existingScripts[key] = value;
+			changes.push(`added script: ${key}`);
+		} else if (key in MANAGED_SCRIPTS && !matchesManagedScript(existingScripts[key] ?? "", MANAGED_SCRIPTS[key] ?? "")) {
+			existingScripts[key] = value;
+			changes.push(`updated script: ${key}`);
+		}
+		for (const key of DEPRECATED_SCRIPTS) if (key in existingScripts) {
+			delete existingScripts[key];
+			changes.push(`removed deprecated script: ${key}`);
+		}
+		pkg.scripts = existingScripts;
+		const existingDevDeps = pkg.devDependencies ?? {};
+		for (const [key, value] of Object.entries(devDeps)) if (!(key in existingDevDeps)) {
+			existingDevDeps[key] = value;
+			changes.push(`added devDependency: ${key}`);
+		} else if (key.startsWith("@bensandee/") && existingDevDeps[key] !== value && existingDevDeps[key] !== "workspace:*") {
+			existingDevDeps[key] = value;
+			changes.push(`updated devDependency: ${key} to ${value}`);
+		}
+		pkg.devDependencies = existingDevDeps;
+		if (!pkg["engines"]) {
+			pkg["engines"] = { node: ">=24.13.0" };
+			changes.push("set engines.node >= 24.13.0");
+		}
+		if (changes.length === 0) return {
 			filePath,
 			action: "skipped",
-			description: "Only optional entries missing"
+			description: "Already up to spec"
 		};
+		ctx.write(filePath, JSON.stringify(pkg, null, 2) + "\n");
 		return {
 			filePath,
 			action: "updated",
-			description: `Appended ${String(missing.length)} missing entries`
+			description: changes.join(", ")
 		};
 	}
-	ctx.write(filePath, ALL_ENTRIES.join("\n") + "\n");
+	const pkg = {
+		name: ctx.config.name,
+		version: "0.1.0",
+		private: true,
+		type: "module",
+		scripts: allScripts,
+		devDependencies: devDeps,
+		engines: { node: ">=24.13.0" },
+		packageManager: "pnpm@10.29.3"
+	};
+	ctx.write(filePath, JSON.stringify(pkg, null, 2) + "\n");
 	return {
 		filePath,
 		action: "created",
-		description: "Generated .gitignore"
+		description: "Generated package.json"
 	};
 }
 //#endregion
-//#region src/generators/ci.ts
-/** Build a GitHub Actions expression like `${{ expr }}` without triggering no-template-curly-in-string. */
-function actionsExpr$1(expr) {
-	return `\${{ ${expr} }}`;
-}
-const CI_CONCURRENCY = {
-	group: `ci-${actionsExpr$1("github.ref")}`,
-	"cancel-in-progress": actionsExpr$1("github.ref != 'refs/heads/main'")
-};
-function hasEnginesNode$1(ctx) {
-	const raw = ctx.read("package.json");
-	if (!raw) return false;
-	return typeof parsePackageJson(raw)?.engines?.["node"] === "string";
-}
-function ciWorkflow(nodeVersionYaml, isForgejo, isChangesets) {
-	const emailNotifications = isForgejo ? "\nenable-email-notifications: true\n" : "";
-	const concurrencyBlock = isChangesets ? `
-concurrency:
-  group: ci-${actionsExpr$1("github.ref")}
-  cancel-in-progress: ${actionsExpr$1("github.ref != 'refs/heads/main'")}
-` : "";
-	return `${workflowSchemaComment(isForgejo ? "forgejo" : "github")}name: CI
-${emailNotifications}on:
-  push:
-    branches: [main]
-  pull_request:
-${concurrencyBlock}
-jobs:
-  check:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
-        with:
-          ${nodeVersionYaml}
-          cache: pnpm
-      - run: pnpm install --frozen-lockfile
-      - name: Run all checks
-        run: pnpm ci:check
-`;
-}
-function requiredCheckSteps(nodeVersionYaml) {
-	return [
-		{
-			match: { uses: "actions/checkout" },
-			step: { uses: "actions/checkout@v4" }
-		},
-		{
-			match: { uses: "pnpm/action-setup" },
-			step: { uses: "pnpm/action-setup@v4" }
-		},
-		{
-			match: { uses: "actions/setup-node" },
-			step: {
-				uses: "actions/setup-node@v4",
-				with: {
-					...nodeVersionYaml.startsWith("node-version-file") ? { "node-version-file": "package.json" } : { "node-version": "24" },
-					cache: "pnpm"
-				}
-			}
-		},
-		{
-			match: { run: "pnpm install" },
-			step: { run: "pnpm install --frozen-lockfile" }
-		},
-		{
-			match: { run: "check" },
-			step: {
-				name: "Run all checks",
-				run: "pnpm ci:check"
-			}
+//#region src/generators/tsconfig.ts
+async function generateTsconfig(ctx) {
+	const filePath = "tsconfig.json";
+	const existing = ctx.read(filePath);
+	if (ctx.config.structure === "monorepo") return [generateMonorepoRootTsconfig(ctx), ...ctx.config.detectPackageTypes ? generateMonorepoPackageTsconfigs(ctx) : []];
+	const extendsValue = `@bensandee/config/tsconfig/${ctx.config.projectType}`;
+	if (!existing) {
+		const config = {
+			extends: extendsValue,
+			...ctx.exists("src") ? { include: ["src"] } : {}
+		};
+		ctx.write(filePath, JSON.stringify(config, null, 2) + "\n");
+		return [{
+			filePath,
+			action: "created",
+			description: `Generated tsconfig.json with ${extendsValue}`
+		}];
+	}
+	if (existing.includes("// @bensandee/tooling:ignore")) return [{
+		filePath,
+		action: "skipped",
+		description: "Ignored via tooling:ignore comment"
+	}];
+	const parsed = parseTsconfig(existing);
+	if (isSolutionStyle(parsed)) {
+		const results = [{
+			filePath,
+			action: "skipped",
+			description: "Solution-style tsconfig — traversing references"
+		}];
+		for (const ref of parsed.references ?? []) {
+			const refPath = resolveReferencePath(ref.path);
+			results.push(mergeSingleTsconfig(ctx, refPath, extendsValue));
 		}
-	];
+		return results;
+	}
+	return [mergeSingleTsconfig(ctx, filePath, extendsValue)];
 }
-/** Resolve the CI workflow filename based on release strategy. */
-function ciWorkflowPath(ci, releaseStrategy) {
-	return `${ci === "github" ? ".github/workflows" : ".forgejo/workflows"}/${releaseStrategy === "changesets" ? "ci.yml" : "check.yml"}`;
+function isSolutionStyle(parsed) {
+	return Array.isArray(parsed.references) && parsed.references.length > 0 && Array.isArray(parsed.files) && parsed.files.length === 0;
 }
-async function generateCi(ctx) {
-	if (ctx.config.ci === "none") return {
-		filePath: "ci",
+function resolveReferencePath(refPath) {
+	const resolved = refPath.endsWith(".json") ? refPath : path.join(refPath, "tsconfig.json");
+	return path.normalize(resolved);
+}
+function mergeSingleTsconfig(ctx, filePath, extendsValue) {
+	const existing = ctx.read(filePath);
+	if (!existing) return {
+		filePath,
 		action: "skipped",
-		description: "CI workflow not requested"
+		description: "File not found"
 	};
-	const isGitHub = ctx.config.ci === "github";
-	const isChangesets = ctx.config.releaseStrategy === "changesets";
-	const nodeVersionYaml = hasEnginesNode$1(ctx) ? "node-version-file: package.json" : "node-version: \"24\"";
-	const filePath = ciWorkflowPath(ctx.config.ci, ctx.config.releaseStrategy);
-	const content = ciWorkflow(nodeVersionYaml, !isGitHub, isChangesets);
-	if (ctx.exists(filePath)) {
-		const existing = ctx.read(filePath);
-		if (existing) {
-			let result = mergeWorkflowSteps(existing, "check", requiredCheckSteps(nodeVersionYaml));
-			if (isChangesets) {
-				const withConcurrency = ensureWorkflowConcurrency(result.content, CI_CONCURRENCY);
-				result = {
-					content: withConcurrency.content,
-					changed: result.changed || withConcurrency.changed
-				};
-			}
-			const withComment = ensureSchemaComment(result.content, isGitHub ? "github" : "forgejo");
-			if (result.changed || withComment !== result.content) {
-				ctx.write(filePath, withComment);
-				return {
-					filePath,
-					action: "updated",
-					description: "Added missing steps to CI workflow"
-				};
-			}
+	if (existing.includes("// @bensandee/tooling:ignore")) return {
+		filePath,
+		action: "skipped",
+		description: "Ignored via tooling:ignore comment"
+	};
+	const parsed = parseTsconfig(existing);
+	const changes = [];
+	if (!parsed.extends) {
+		parsed.extends = extendsValue;
+		changes.push(`added extends: ${extendsValue}`);
+	}
+	if (!parsed.include) {
+		const tsconfigDir = path.dirname(filePath);
+		const srcDir = tsconfigDir === "." ? "src" : path.join(tsconfigDir, "src");
+		if (ctx.exists(srcDir)) {
+			parsed.include = ["src"];
+			changes.push("added include: [\"src\"]");
 		}
-		return {
-			filePath,
-			action: "skipped",
-			description: "CI workflow already up to date"
-		};
 	}
-	ctx.write(filePath, content);
+	if (changes.length === 0) return {
+		filePath,
+		action: "skipped",
+		description: "Already up to spec"
+	};
+	ctx.write(filePath, JSON.stringify(parsed, null, 2) + "\n");
 	return {
 		filePath,
-		action: "created",
-		description: `Generated ${isGitHub ? "GitHub" : "Forgejo"} Actions CI workflow`
+		action: "updated",
+		description: changes.join(", ")
 	};
 }
-//#endregion
-//#region src/generators/knip.ts
-const KNIP_CONFIG_SINGLE = `import type { KnipConfig } from "knip";
-
-export default {
-  entry: ["src/index.ts"],
-  project: ["src/**/*.ts"],
-  ignore: ["dist/**"],
-} satisfies KnipConfig;
-`;
-const KNIP_CONFIG_MONOREPO = `import type { KnipConfig } from "knip";
-
-export default {
-  workspaces: {
-    ".": {
-      entry: [],
-      project: [],
-    },
-    "packages/*": {
-      entry: ["src/index.ts", "src/bin.ts"],
-      project: ["src/**/*.ts"],
-      ignore: ["dist/**"],
-    },
-  },
-} satisfies KnipConfig;
-`;
-/** All known knip config file locations, in priority order. */
-const KNIP_CONFIG_PATHS = [
-	"knip.config.ts",
-	"knip.config.mts",
-	"knip.json",
-	"knip.jsonc",
-	"knip.ts",
-	"knip.mts"
-];
-async function generateKnip(ctx) {
-	const filePath = "knip.config.ts";
-	const isMonorepo = ctx.config.structure === "monorepo";
-	const existingPath = KNIP_CONFIG_PATHS.find((p) => ctx.exists(p));
-	if (existingPath) return {
-		filePath: existingPath,
+function generateMonorepoRootTsconfig(ctx) {
+	const filePath = "tsconfig.json";
+	if (!ctx.read(filePath)) return {
+		filePath,
 		action: "skipped",
-		description: existingPath === filePath ? "Already configured" : `Existing config found at ${existingPath}`
+		description: "No tsconfig.json found"
 	};
-	const config = isMonorepo ? KNIP_CONFIG_MONOREPO : KNIP_CONFIG_SINGLE;
-	ctx.write(filePath, config);
 	return {
 		filePath,
-		action: "created",
-		description: "Generated knip.config.ts for dead code analysis"
-	};
-}
-//#endregion
-//#region src/generators/renovate.ts
-const SHARED_PRESET = "local>bensandee/tooling";
-/** Deprecated npm-based preset to migrate away from. */
-const LEGACY_PRESET = "@bensandee/config";
-/** All known renovate config file locations, in priority order. */
-const RENOVATE_CONFIG_PATHS = [
-	"renovate.json",
-	"renovate.json5",
-	".renovaterc",
-	".renovaterc.json",
-	".github/renovate.json",
-	".github/renovate.json5"
-];
-async function generateRenovate(ctx) {
-	const defaultPath = "renovate.json";
-	if (!ctx.config.setupRenovate) return {
-		filePath: defaultPath,
 		action: "skipped",
-		description: "Renovate not requested"
+		description: "Root tsconfig left as-is"
 	};
-	const existingPath = RENOVATE_CONFIG_PATHS.find((p) => ctx.exists(p));
-	if (existingPath) {
-		const existing = ctx.read(existingPath);
+}
+function generateMonorepoPackageTsconfigs(ctx) {
+	const packages = getMonorepoPackages(ctx.targetDir);
+	const results = [];
+	for (const pkg of packages) {
+		const relDir = path.relative(ctx.targetDir, pkg.dir);
+		const filePath = path.join(relDir, "tsconfig.json");
+		const existing = ctx.read(filePath);
+		const projectType = detectProjectType(pkg.dir);
+		const extendsValue = `@bensandee/config/tsconfig/${projectType}`;
 		if (existing) {
-			const parsed = parseRenovateJson(existing);
-			const existingExtends = parsed.extends ?? [];
-			const legacyIndex = existingExtends.indexOf(LEGACY_PRESET);
-			if (legacyIndex !== -1) {
-				existingExtends[legacyIndex] = SHARED_PRESET;
-				parsed.extends = existingExtends;
-				ctx.write(existingPath, JSON.stringify(parsed, null, 2) + "\n");
-				return {
-					filePath: existingPath,
-					action: "updated",
-					description: `Migrated extends: ${LEGACY_PRESET} → ${SHARED_PRESET}`
-				};
+			if (existing.includes("// @bensandee/tooling:ignore")) {
+				results.push({
+					filePath,
+					action: "skipped",
+					description: "Ignored via tooling:ignore comment"
+				});
+				continue;
 			}
-			if (!existingExtends.includes(SHARED_PRESET)) {
-				existingExtends.unshift(SHARED_PRESET);
-				parsed.extends = existingExtends;
-				ctx.write(existingPath, JSON.stringify(parsed, null, 2) + "\n");
-				return {
-					filePath: existingPath,
-					action: "updated",
-					description: `Added extends: ${SHARED_PRESET}`
-				};
+			const parsed = parseTsconfig(existing);
+			if (isSolutionStyle(parsed)) {
+				results.push({
+					filePath,
+					action: "skipped",
+					description: "Solution-style tsconfig — traversing references"
+				});
+				for (const ref of parsed.references ?? []) {
+					const refPath = path.join(relDir, resolveReferencePath(ref.path));
+					results.push(mergeSingleTsconfig(ctx, refPath, extendsValue));
+				}
+				continue;
 			}
-			return {
-				filePath: existingPath,
-				action: "skipped",
-				description: "Already extends shared config"
+			const changes = [];
+			if (parsed.extends !== extendsValue) {
+				const prev = parsed.extends;
+				parsed.extends = extendsValue;
+				changes.push(prev ? `changed extends: ${String(prev)} → ${extendsValue}` : `added extends: ${extendsValue}`);
+			}
+			if (!parsed.include && ctx.exists(path.join(relDir, "src"))) {
+				parsed.include = ["src"];
+				changes.push("added include: [\"src\"]");
+			}
+			if (changes.length === 0) {
+				results.push({
+					filePath,
+					action: "skipped",
+					description: `Already up to spec (${projectType})`
+				});
+				continue;
+			}
+			ctx.write(filePath, JSON.stringify(parsed, null, 2) + "\n");
+			results.push({
+				filePath,
+				action: "updated",
+				description: changes.join(", ")
+			});
+		} else {
+			const config = {
+				extends: extendsValue,
+				...ctx.exists(path.join(relDir, "src")) ? { include: ["src"] } : {}
 			};
+			ctx.write(filePath, JSON.stringify(config, null, 2) + "\n");
+			results.push({
+				filePath,
+				action: "created",
+				description: `Generated tsconfig.json with @bensandee/config/tsconfig/${projectType} (detected ${projectType})`
+			});
 		}
 	}
-	const config = {
-		$schema: "https://docs.renovatebot.com/renovate-schema.json",
-		extends: [SHARED_PRESET]
-	};
-	ctx.write(defaultPath, JSON.stringify(config, null, 2) + "\n");
+	return results;
+}
+//#endregion
+//#region src/generators/vitest.ts
+const VITEST_CONFIG = `import { defineConfig } from "vitest/config";
+
+export default defineConfig({
+  test: {
+    include: ["test/**/*.test.ts"],
+  },
+});
+`;
+const STARTER_TEST = `import { describe, it, expect } from "vitest";
+
+describe("example", () => {
+  it("should pass a basic assertion", () => {
+    expect(1 + 1).toBe(2);
+  });
+});
+`;
+async function generateVitest(ctx) {
+	const results = [];
+	if (!ctx.config.setupVitest) return [{
+		filePath: "vitest.config.ts",
+		action: "skipped",
+		description: "Vitest setup not requested"
+	}];
+	if (ctx.config.structure === "monorepo") return [{
+		filePath: "vitest.config.ts",
+		action: "skipped",
+		description: "Monorepo: vitest config belongs in individual packages"
+	}];
+	const configPath = "vitest.config.ts";
+	if (ctx.exists(configPath)) if (ctx.read(configPath) === VITEST_CONFIG) results.push({
+		filePath: configPath,
+		action: "skipped",
+		description: "Config already up to date"
+	});
+	else if (await ctx.confirmOverwrite(configPath) === "skip") results.push({
+		filePath: configPath,
+		action: "skipped",
+		description: "Existing config preserved"
+	});
+	else {
+		ctx.write(configPath, VITEST_CONFIG);
+		results.push({
+			filePath: configPath,
+			action: "updated",
+			description: "Replaced vitest config"
+		});
+	}
+	else {
+		ctx.write(configPath, VITEST_CONFIG);
+		results.push({
+			filePath: configPath,
+			action: "created",
+			description: "Generated vitest.config.ts"
+		});
+	}
+	const testPath = "test/example.test.ts";
+	if (!ctx.exists("test")) {
+		ctx.write(testPath, STARTER_TEST);
+		results.push({
+			filePath: testPath,
+			action: "created",
+			description: "Generated starter test file"
+		});
+	}
+	return results;
+}
+//#endregion
+//#region src/generators/oxlint.ts
+const CONFIG_WITH_LINT_RULES = `import recommended from "@bensandee/config/oxlint/recommended";
+import { defineConfig } from "oxlint";
+
+export default defineConfig({
+  extends: [recommended],
+});
+`;
+const CONFIG_PRESET_ONLY = `import { presetRules } from "@bensandee/config/oxlint";
+import { defineConfig } from "oxlint";
+
+export default defineConfig({
+  rules: presetRules,
+});
+`;
+async function generateOxlint(ctx) {
+	const filePath = "oxlint.config.ts";
+	const content = ctx.config.useEslintPlugin ? CONFIG_WITH_LINT_RULES : CONFIG_PRESET_ONLY;
+	const existing = ctx.read(filePath);
+	if (existing) {
+		if (existing === content || existing.includes("@bensandee/config/oxlint")) return {
+			filePath,
+			action: "skipped",
+			description: "Already configured"
+		};
+		if (await ctx.confirmOverwrite(filePath) === "skip") return {
+			filePath,
+			action: "skipped",
+			description: "User chose to keep existing"
+		};
+	}
+	ctx.write(filePath, content);
 	return {
-		filePath: defaultPath,
-		action: "created",
-		description: "Generated renovate.json extending shared config"
+		filePath,
+		action: existing ? "updated" : "created",
+		description: "Generated oxlint.config.ts"
 	};
 }
 //#endregion
-//#region src/generators/pnpm-workspace.ts
-const WORKSPACE_YAML = `packages:
-  - "packages/*"
+//#region src/generators/formatter.ts
+const OXFMT_CONFIG = `{}\n`;
+const PRETTIER_CONFIG = `{
+  "semi": true,
+  "singleQuote": false,
+  "trailingComma": "all",
+  "tabWidth": 2,
+  "printWidth": 120
+}
 `;
-async function generatePnpmWorkspace(ctx) {
-	const filePath = "pnpm-workspace.yaml";
-	if (ctx.config.structure !== "monorepo") return {
+async function generateFormatter(ctx) {
+	if (ctx.config.formatter === "oxfmt") return generateOxfmt(ctx);
+	return generatePrettier(ctx);
+}
+async function generateOxfmt(ctx) {
+	const filePath = ".oxfmtrc.json";
+	if (ctx.exists(filePath)) return {
 		filePath,
 		action: "skipped",
-		description: "Not a monorepo"
+		description: "Existing oxfmt config preserved"
+	};
+	ctx.write(filePath, OXFMT_CONFIG);
+	return {
+		filePath,
+		action: "created",
+		description: "Generated .oxfmtrc.json"
 	};
+}
+async function generatePrettier(ctx) {
+	const filePath = ".prettierrc";
 	if (ctx.exists(filePath)) return {
 		filePath,
 		action: "skipped",
-		description: "pnpm-workspace.yaml already exists"
+		description: "Existing prettier config preserved"
 	};
-	ctx.write(filePath, WORKSPACE_YAML);
+	ctx.write(filePath, PRETTIER_CONFIG);
 	return {
 		filePath,
 		action: "created",
-		description: "Generated pnpm-workspace.yaml"
+		description: "Generated .prettierrc"
 	};
 }
 //#endregion
-//#region src/generators/claude-settings.ts
-const ClaudeSettingsSchema = z.object({
-	permissions: z.object({
-		allow: z.array(z.string()).default([]),
-		deny: z.array(z.string()).default([])
-	}).default({
-		allow: [],
-		deny: []
-	}),
-	instructions: z.array(z.string()).default([]),
-	enabledPlugins: z.record(z.string(), z.boolean()).default({}),
-	extraKnownMarketplaces: z.record(z.string(), z.record(z.string(), z.unknown())).default({})
+//#region src/generators/tsdown.ts
+const TSDOWN_CONFIG = `import { defineConfig } from "tsdown";
+
+export default defineConfig({
+  entry: ["src/index.ts"],
 });
-function parseClaudeSettings(raw) {
-	try {
-		const json = JSON.parse(raw);
-		const rawResult = z.record(z.string(), z.unknown()).safeParse(json);
-		const settingsResult = ClaudeSettingsSchema.safeParse(json);
-		if (!rawResult.success || !settingsResult.success) return void 0;
-		return {
-			settings: settingsResult.data,
-			rawJson: rawResult.data
-		};
-	} catch {
-		return;
-	}
-}
-function buildSettings(ctx) {
-	const pm = "pnpm";
-	const allow = [
-		`Bash(${pm} install)`,
-		`Bash(${pm} install *)`,
-		`Bash(${pm} add *)`,
-		`Bash(${pm} update *)`,
-		`Bash(${pm} view *)`,
-		`Bash(${pm} why *)`,
-		`Bash(${pm} list)`,
-		`Bash(${pm} list *)`,
-		`Bash(${pm} ls)`,
-		`Bash(${pm} ls *)`,
-		"Bash(npm view *)",
-		"Bash(npm info *)",
-		"Bash(npm show *)",
-		`Bash(${pm} build)`,
-		`Bash(${pm} -r build)`,
-		`Bash(${pm} dev)`,
-		`Bash(${pm} test)`,
-		`Bash(${pm} test *)`,
-		`Bash(${pm} -r test)`,
-		`Bash(${pm} vitest)`,
-		`Bash(${pm} vitest *)`,
-		`Bash(${pm} exec vitest)`,
-		`Bash(${pm} exec vitest *)`,
-		`Bash(${pm} exec oxfmt)`,
-		`Bash(${pm} exec oxfmt *)`,
-		`Bash(${pm} typecheck)`,
-		`Bash(${pm} -r --parallel run typecheck)`,
-		`Bash(${pm} tsc *)`,
-		`Bash(${pm} exec tsc *)`,
-		`Bash(${pm} lint)`,
-		`Bash(${pm} lint *)`,
-		`Bash(${pm} format)`,
-		`Bash(${pm} format *)`,
-		`Bash(${pm} knip)`,
-		`Bash(${pm} knip *)`,
-		`Bash(${pm} check)`,
-		`Bash(${pm} exec oxlint *)`,
-		`Bash(${pm} exec knip *)`,
-		"Bash(git status *)",
-		"Bash(git log *)",
-		"Bash(git diff *)",
-		"Bash(git branch *)",
-		"Bash(git show *)",
-		"Bash(git rev-parse *)",
-		"Bash(ls *)",
-		"Bash(cat *)",
-		"Bash(head *)",
-		"Bash(tail *)",
-		"Bash(wc *)",
-		"Bash(test *)",
-		"Bash([ *)",
-		"Bash(grep *)",
-		"Bash(which *)",
-		"Bash(node -e *)",
-		"Bash(node -p *)"
-	];
-	if (ctx.config.structure === "monorepo") allow.push(`Bash(${pm} --filter *)`, `Bash(${pm} -r *)`);
-	const enabledPlugins = { "code-simplifier@claude-plugins-official": true };
-	const extraKnownMarketplaces = {};
-	if (ctx.config.structure !== "monorepo") {
-		if (ctx.packageJson ? packageHasWebUIDeps(ctx.packageJson) : false) enabledPlugins["frontend-design@claude-plugins-official"] = true;
+`;
+async function generateTsdown(ctx) {
+	const filePath = "tsdown.config.ts";
+	if (ctx.config.structure === "monorepo") return {
+		filePath,
+		action: "skipped",
+		description: "Monorepo: tsdown config belongs in individual packages"
+	};
+	const existing = ctx.read(filePath);
+	if (existing) {
+		if (existing === TSDOWN_CONFIG) return {
+			filePath,
+			action: "skipped",
+			description: "Already configured"
+		};
+		if (await ctx.confirmOverwrite(filePath) === "skip") return {
+			filePath,
+			action: "skipped",
+			description: "Existing tsdown config preserved"
+		};
 	}
+	ctx.write(filePath, TSDOWN_CONFIG);
 	return {
-		permissions: {
-			allow,
-			deny: [
-				"Bash(npx *)",
-				"Bash(git push *)",
-				"Bash(git push)",
-				"Bash(git add *)",
-				"Bash(git add)",
-				"Bash(git commit *)",
-				"Bash(git commit)",
-				"Bash(git reset *)",
-				"Bash(git merge *)",
-				"Bash(git rebase *)",
-				"Bash(git cherry-pick *)",
-				"Bash(git checkout *)",
-				"Bash(git switch *)",
-				"Bash(git stash *)",
-				"Bash(git tag *)",
-				"Bash(git revert *)",
-				"Bash(git clean *)",
-				"Bash(git rm *)",
-				"Bash(git mv *)",
-				"Bash(rm -rf *)",
-				"Bash(cat *.env)",
-				"Bash(cat *.env.*)",
-				"Bash(cat .env)",
-				"Bash(cat .env.*)",
-				"Bash(head *.env)",
-				"Bash(head *.env.*)",
-				"Bash(head .env)",
-				"Bash(head .env.*)",
-				"Bash(tail *.env)",
-				"Bash(tail *.env.*)",
-				"Bash(tail .env)",
-				"Bash(tail .env.*)",
-				"Bash(less *.env)",
-				"Bash(less *.env.*)",
-				"Bash(less .env)",
-				"Bash(less .env.*)",
-				"Bash(more *.env)",
-				"Bash(more *.env.*)",
-				"Bash(more .env)",
-				"Bash(more .env.*)",
-				"Bash(grep * .env)",
-				"Bash(grep * .env.*)",
-				"Read(.env)",
-				"Read(.env.*)",
-				"Read(*.env)",
-				"Read(*.env.*)"
-			]
-		},
-		instructions: [
-			"Use pnpm, not npm/yarn/npx. Run binaries with `pnpm exec`.",
-			"No typecasts (as/any). Use zod schemas, type guards, or narrowing instead.",
-			"Fix lint violations instead of suppressing them. Only add disable comments when suppression is genuinely the best option. For no-empty-function: add a `{ /* no-op */ }` comment body instead of a disable comment.",
-			"Prefer extensionless imports; if an extension is required, use .ts over .js."
-		],
-		enabledPlugins,
-		extraKnownMarketplaces
+		filePath,
+		action: existing ? "updated" : "created",
+		description: "Generated tsdown.config.ts"
 	};
 }
-/** Remove enabledPlugins/extraKnownMarketplaces when empty to keep the file clean. */
-function serializeSettings$1(settings) {
-	const { enabledPlugins, extraKnownMarketplaces, ...rest } = settings;
-	const out = { ...rest };
-	if (Object.keys(enabledPlugins).length > 0) out["enabledPlugins"] = enabledPlugins;
-	if (Object.keys(extraKnownMarketplaces).length > 0) out["extraKnownMarketplaces"] = extraKnownMarketplaces;
-	return JSON.stringify(out, null, 2) + "\n";
+//#endregion
+//#region src/generators/gitignore.ts
+/** Entries that every project should have — repo:sync --check flags these as missing. */
+const REQUIRED_ENTRIES = [
+	"node_modules/",
+	".pnpm-store/",
+	"dist/",
+	"*.tsbuildinfo",
+	".env",
+	".env.*",
+	"!.env.example"
+];
+/** Tooling-specific entries added during init/update but not required for repo:sync --check. */
+const OPTIONAL_ENTRIES = [".tooling-migrate.md", ".tooling-archived/"];
+const ALL_ENTRIES = [...REQUIRED_ENTRIES, ...OPTIONAL_ENTRIES];
+/** Normalize a gitignore entry for comparison: strip leading `/` and trailing `/`. */
+function normalizeEntry(entry) {
+	let s = entry.trim();
+	if (s.startsWith("/")) s = s.slice(1);
+	if (s.endsWith("/")) s = s.slice(0, -1);
+	return s;
 }
-function writeOrMergeSettings(ctx, filePath, generated) {
+async function generateGitignore(ctx) {
+	const filePath = ".gitignore";
 	const existing = ctx.read(filePath);
 	if (existing) {
-		const parsed = parseClaudeSettings(existing);
-		if (!parsed) return {
+		const existingNormalized = new Set(existing.split("\n").map(normalizeEntry).filter((line) => line.length > 0));
+		const missing = ALL_ENTRIES.filter((entry) => !existingNormalized.has(normalizeEntry(entry)));
+		if (missing.length === 0) return {
 			filePath,
 			action: "skipped",
-			description: "Could not parse existing settings"
+			description: "Already has all standard entries"
 		};
-		const { settings, rawJson } = parsed;
-		const missingAllow = generated.permissions.allow.filter((rule) => !settings.permissions.allow.includes(rule));
-		const missingDeny = generated.permissions.deny.filter((rule) => !settings.permissions.deny.includes(rule));
-		const mergedInstructions = [...settings.instructions];
-		let instructionChanges = 0;
-		for (const inst of generated.instructions) {
-			if (mergedInstructions.includes(inst)) continue;
-			const prefixIdx = mergedInstructions.findIndex((e) => inst.startsWith(e) || e.startsWith(inst));
-			if (prefixIdx !== -1) mergedInstructions[prefixIdx] = inst;
-			else mergedInstructions.push(inst);
-			instructionChanges++;
-		}
-		const missingPlugins = Object.entries(generated.enabledPlugins).filter(([key]) => !(key in settings.enabledPlugins));
-		const missingMarketplaces = Object.entries(generated.extraKnownMarketplaces).filter(([key]) => !(key in settings.extraKnownMarketplaces));
-		const changed = missingAllow.length + missingDeny.length + instructionChanges + missingPlugins.length + missingMarketplaces.length;
-		if (changed === 0) return {
+		const missingRequired = REQUIRED_ENTRIES.filter((entry) => !existingNormalized.has(normalizeEntry(entry)));
+		const updated = existing.trimEnd() + "\n\n# Added by @bensandee/tooling\n" + missing.join("\n") + "\n";
+		ctx.write(filePath, updated);
+		if (missingRequired.length === 0) return {
 			filePath,
 			action: "skipped",
-			description: "Already has all rules and instructions"
-		};
-		rawJson["permissions"] = {
-			allow: [...settings.permissions.allow, ...missingAllow],
-			deny: [...settings.permissions.deny, ...missingDeny]
+			description: "Only optional entries missing"
 		};
-		rawJson["instructions"] = mergedInstructions;
-		const updatedPlugins = { ...settings.enabledPlugins };
-		for (const [key, value] of missingPlugins) updatedPlugins[key] = value;
-		const updatedMarketplaces = { ...settings.extraKnownMarketplaces };
-		for (const [key, value] of missingMarketplaces) updatedMarketplaces[key] = value;
-		if (Object.keys(updatedPlugins).length > 0) rawJson["enabledPlugins"] = updatedPlugins;
-		else delete rawJson["enabledPlugins"];
-		if (Object.keys(updatedMarketplaces).length > 0) rawJson["extraKnownMarketplaces"] = updatedMarketplaces;
-		else delete rawJson["extraKnownMarketplaces"];
-		ctx.write(filePath, JSON.stringify(rawJson, null, 2) + "\n");
 		return {
 			filePath,
 			action: "updated",
-			description: `Updated ${String(changed)} rules/instructions`
+			description: `Appended ${String(missing.length)} missing entries`
 		};
 	}
-	ctx.write(filePath, serializeSettings$1(generated));
+	ctx.write(filePath, ALL_ENTRIES.join("\n") + "\n");
 	return {
 		filePath,
 		action: "created",
-		description: `Generated ${filePath}`
+		description: "Generated .gitignore"
 	};
 }
-async function generateClaudeSettings(ctx) {
-	const results = [];
-	results.push(writeOrMergeSettings(ctx, ".claude/settings.json", buildSettings(ctx)));
-	if (ctx.config.structure === "monorepo") for (const pkg of getMonorepoPackages(ctx.targetDir)) {
-		if (!hasWebUIDeps(pkg.dir)) continue;
-		const pkgRelDir = path.relative(ctx.targetDir, pkg.dir);
-		const pkgSettingsPath = path.join(pkgRelDir, ".claude/settings.json");
-		results.push(writeOrMergeSettings(ctx, pkgSettingsPath, {
-			permissions: {
-				allow: [],
-				deny: []
-			},
-			instructions: [],
-			enabledPlugins: { "frontend-design@claude-plugins-official": true },
-			extraKnownMarketplaces: {}
-		}));
-	}
-	return results;
-}
 //#endregion
-//#region src/generators/release-it.ts
-function buildConfig$2(ci, isMonorepo) {
-	const config = {
-		$schema: "https://unpkg.com/release-it/schema/release-it.json",
-		git: {
-			commitMessage: "chore: release v${version}",
-			tagName: "v${version}"
-		},
-		npm: { publish: true }
-	};
-	if (ci === "github") config["github"] = { release: true };
-	const plugins = {};
-	if (isMonorepo) {
-		config["npm"] = {
-			publish: true,
-			allowSameVersion: true
-		};
-		plugins["@release-it/bumper"] = { out: "packages/*/package.json" };
-	}
-	if (Object.keys(plugins).length > 0) config["plugins"] = plugins;
-	return config;
-}
-async function generateReleaseIt(ctx) {
-	const filePath = ".release-it.json";
-	if (ctx.config.releaseStrategy !== "release-it") return {
-		filePath,
-		action: "skipped",
-		description: "release-it not requested"
-	};
-	const content = JSON.stringify(buildConfig$2(ctx.config.ci, ctx.config.structure === "monorepo"), null, 2) + "\n";
-	const existing = ctx.read(filePath);
-	if (existing) {
-		if (contentEqual(filePath, existing, content)) return {
-			filePath,
-			action: "skipped",
-			description: "Already configured"
-		};
-		if (await ctx.confirmOverwrite(filePath) === "skip") return {
-			filePath,
-			action: "skipped",
-			description: "Existing release-it config preserved"
-		};
-	}
-	ctx.write(filePath, content);
-	return {
-		filePath,
-		action: existing ? "updated" : "created",
-		description: "Generated .release-it.json"
-	};
-}
-//#endregion
-//#region src/generators/changesets.ts
-function buildConfig$1() {
-	return {
-		$schema: "https://unpkg.com/@changesets/config@3.1.1/schema.json",
-		changelog: "@changesets/cli/changelog",
-		commit: false,
-		fixed: [],
-		linked: [],
-		access: "public",
-		baseBranch: "main",
-		updateInternalDependencies: "patch",
-		ignore: []
-	};
-}
-async function generateChangesets(ctx) {
-	const filePath = ".changeset/config.json";
-	if (ctx.config.releaseStrategy !== "changesets") return {
-		filePath,
-		action: "skipped",
-		description: "Changesets not requested"
-	};
-	const content = JSON.stringify(buildConfig$1(), null, 2) + "\n";
-	const existing = ctx.read(filePath);
-	if (existing) return {
-		filePath,
-		action: "skipped",
-		description: "Existing changesets config preserved"
-	};
-	ctx.write(filePath, content);
-	return {
-		filePath,
-		action: existing ? "updated" : "created",
-		description: "Generated .changeset/config.json"
-	};
-}
-//#endregion
-//#region src/generators/release-ci.ts
-/** Build a GitHub Actions expression like `${{ expr }}` without triggering no-template-curly-in-string. */
-function actionsExpr(expr) {
-	return `\${{ ${expr} }}`;
-}
-function hasEnginesNode(ctx) {
-	return typeof ctx.packageJson?.["engines"]?.["node"] === "string";
-}
-function commonSteps(nodeVersionYaml, publishesNpm, { build = true } = {}) {
-	return `      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
-        with:
-          ${nodeVersionYaml}
-          cache: pnpm${publishesNpm ? `\n          registry-url: "https://registry.npmjs.org"` : ""}
-      - run: pnpm install --frozen-lockfile${build ? `\n      - run: pnpm build` : ""}`;
-}
-function releaseItWorkflow(ci, nodeVersionYaml, publishesNpm) {
-	const isGitHub = ci === "github";
-	const permissions = isGitHub ? `
-permissions:
-  contents: write
-` : "";
-	const tokenEnv = isGitHub ? `GITHUB_TOKEN: \${{ github.token }}` : `FORGEJO_TOKEN: \${{ secrets.FORGEJO_TOKEN }}`;
-	const npmEnv = publishesNpm ? `\n          NODE_AUTH_TOKEN: \${{ secrets.NPM_TOKEN }}` : "";
-	return `${workflowSchemaComment(ci)}name: Release
-on:
-  workflow_dispatch:
-${permissions}
-jobs:
-  release:
-    runs-on: ubuntu-latest
-    steps:
-${commonSteps(nodeVersionYaml, publishesNpm)}
-      - run: pnpm release-it --ci
-        env:
-          ${tokenEnv}${npmEnv}
-`;
-}
-function commitAndTagVersionWorkflow(ci, nodeVersionYaml, publishesNpm) {
-	const isGitHub = ci === "github";
-	const permissions = isGitHub ? `
-permissions:
-  contents: write
+//#region src/generators/ci.ts
+const CI_CONCURRENCY = {
+	group: `ci-${actionsExpr("github.ref")}`,
+	"cancel-in-progress": actionsExpr("github.ref != 'refs/heads/main'")
+};
+function ciWorkflow(nodeVersionYaml, isForgejo, isChangesets) {
+	const emailNotifications = isForgejo ? "\nenable-email-notifications: true\n" : "";
+	const concurrencyBlock = isChangesets ? `
+concurrency:
+  group: ci-${actionsExpr("github.ref")}
+  cancel-in-progress: ${actionsExpr("github.ref != 'refs/heads/main'")}
 ` : "";
-	const gitConfigStep = `
-      - name: Configure git
-        run: |
-          git config user.name "${isGitHub ? "github-actions[bot]" : "forgejo-actions[bot]"}"
-          git config user.email "${isGitHub ? "github-actions[bot]@users.noreply.github.com" : "forgejo-actions[bot]@noreply.localhost"}"`;
-	const releaseStep = isGitHub ? `
-      - name: Release
-        env:
-          GITHUB_TOKEN: \${{ github.token }}
-        run: pnpm exec bst release:simple` : `
-      - name: Release
-        env:
-          FORGEJO_SERVER_URL: \${{ github.server_url }}
-          FORGEJO_REPOSITORY: \${{ github.repository }}
-          FORGEJO_TOKEN: \${{ secrets.FORGEJO_TOKEN }}
-        run: pnpm exec bst release:simple`;
-	return `${workflowSchemaComment(ci)}name: Release
-on:
-  workflow_dispatch:
-${permissions}
+	return `${workflowSchemaComment(isForgejo ? "forgejo" : "github")}name: CI
+${emailNotifications}on:
+  push:
+    branches: [main]
+    tags-ignore:
+      - "**"
+  pull_request:
+${concurrencyBlock}
 jobs:
-  release:
+  check:
     runs-on: ubuntu-latest
     steps:
-${commonSteps(nodeVersionYaml, publishesNpm, { build: false })}${gitConfigStep}${releaseStep}
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          ${nodeVersionYaml}
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - name: Run all checks
+        run: pnpm ci:check
 `;
 }
-/** Build the required release step for the check job (changesets). */
-function changesetsReleaseStep(ci, publishesNpm) {
-	if (ci === "github") return {
-		match: { uses: "changesets/action" },
-		step: {
-			uses: "changesets/action@v1",
-			if: "github.ref == 'refs/heads/main'",
-			with: {
-				publish: "pnpm changeset publish",
-				version: "pnpm changeset version"
-			},
-			env: {
-				GITHUB_TOKEN: actionsExpr("github.token"),
-				...publishesNpm && { NPM_TOKEN: actionsExpr("secrets.NPM_TOKEN") }
-			}
-		}
-	};
-	return {
-		match: { run: "release:changesets" },
-		step: {
-			name: "Release",
-			if: "github.ref == 'refs/heads/main'",
-			env: {
-				FORGEJO_SERVER_URL: actionsExpr("github.server_url"),
-				FORGEJO_REPOSITORY: actionsExpr("github.repository"),
-				FORGEJO_TOKEN: actionsExpr("secrets.FORGEJO_TOKEN"),
-				...publishesNpm && { NODE_AUTH_TOKEN: actionsExpr("secrets.NPM_TOKEN") }
-			},
-			run: "pnpm exec bst release:changesets"
-		}
-	};
-}
-function requiredReleaseSteps(strategy, nodeVersionYaml, publishesNpm) {
-	const isNodeVersionFile = nodeVersionYaml.startsWith("node-version-file");
-	const steps = [
+function requiredCheckSteps(nodeVersionYaml) {
+	return [
 		{
 			match: { uses: "actions/checkout" },
-			step: {
-				uses: "actions/checkout@v4",
-				with: { "fetch-depth": 0 }
-			}
+			step: { uses: "actions/checkout@v4" }
 		},
 		{
 			match: { uses: "pnpm/action-setup" },
@@ -2281,9 +1936,8 @@ function requiredReleaseSteps(strategy, nodeVersionYaml, publishesNpm) {
 			step: {
 				uses: "actions/setup-node@v4",
 				with: {
-					...isNodeVersionFile ? { "node-version-file": "package.json" } : { "node-version": "24" },
-					cache: "pnpm",
-					...publishesNpm && { "registry-url": "https://registry.npmjs.org" }
+					...nodeVersionYaml.startsWith("node-version-file") ? { "node-version-file": "package.json" } : { "node-version": "24" },
+					cache: "pnpm"
 				}
 			}
 		},
@@ -2291,710 +1945,1083 @@ function requiredReleaseSteps(strategy, nodeVersionYaml, publishesNpm) {
 			match: { run: "pnpm install" },
 			step: { run: "pnpm install --frozen-lockfile" }
 		},
-		...strategy !== "simple" ? [{
-			match: { run: "build" },
-			step: { run: "pnpm build" }
-		}] : []
+		{
+			match: { run: "check" },
+			step: {
+				name: "Run all checks",
+				run: "pnpm ci:check"
+			}
+		}
 	];
-	switch (strategy) {
-		case "release-it":
-			steps.push({
-				match: { run: "release-it" },
-				step: { run: "pnpm release-it --ci" }
-			});
-			break;
-		case "simple":
-			steps.push({
-				match: { run: "release:simple" },
-				step: { run: "pnpm exec bst release:simple" }
-			});
-			break;
-		case "changesets":
-			steps.push({
-				match: { run: "changeset" },
-				step: { run: "pnpm exec bst release:changesets" }
-			});
-			break;
-	}
-	return steps;
 }
-function buildWorkflow(strategy, ci, nodeVersionYaml, publishesNpm) {
-	switch (strategy) {
-		case "release-it": return releaseItWorkflow(ci, nodeVersionYaml, publishesNpm);
-		case "simple": return commitAndTagVersionWorkflow(ci, nodeVersionYaml, publishesNpm);
-		default: return null;
-	}
+/** Resolve the CI workflow filename based on release strategy. */
+function ciWorkflowPath(ci, releaseStrategy) {
+	return `${ci === "github" ? ".github/workflows" : ".forgejo/workflows"}/${releaseStrategy === "changesets" ? "ci.yml" : "check.yml"}`;
 }
-function generateChangesetsReleaseCi(ctx, publishesNpm) {
-	const ciPath = ciWorkflowPath(ctx.config.ci, ctx.config.releaseStrategy);
-	const raw = ctx.read(ciPath);
-	if (!raw) return {
-		filePath: ciPath,
+async function generateCi(ctx) {
+	if (ctx.config.ci === "none") return {
+		filePath: "ci",
 		action: "skipped",
-		description: "CI workflow not found — run check generator first"
+		description: "CI workflow not requested"
 	};
-	const existing = migrateToolingBinary(raw);
-	const merged = mergeWorkflowSteps(existing, "check", [changesetsReleaseStep(ctx.config.ci, publishesNpm)]);
-	if (!merged.changed) {
-		if (existing !== raw) {
-			const withComment = ensureSchemaComment(existing, ctx.config.ci);
-			ctx.write(ciPath, withComment);
-			return {
-				filePath: ciPath,
-				action: "updated",
-				description: "Migrated tooling binary name in CI workflow"
+	const isGitHub = ctx.config.ci === "github";
+	const isChangesets = ctx.config.releaseStrategy === "changesets";
+	const nodeVersionYaml = computeNodeVersionYaml(ctx);
+	const filePath = ciWorkflowPath(ctx.config.ci, ctx.config.releaseStrategy);
+	const content = ciWorkflow(nodeVersionYaml, !isGitHub, isChangesets);
+	if (ctx.exists(filePath)) {
+		const existing = ctx.read(filePath);
+		if (existing) {
+			let result = mergeWorkflowSteps(existing, "check", requiredCheckSteps(nodeVersionYaml));
+			const withTagsIgnore = ensureWorkflowTagsIgnore(result.content);
+			result = {
+				content: withTagsIgnore.content,
+				changed: result.changed || withTagsIgnore.changed
 			};
+			if (isChangesets) {
+				const withConcurrency = ensureWorkflowConcurrency(result.content, CI_CONCURRENCY);
+				result = {
+					content: withConcurrency.content,
+					changed: result.changed || withConcurrency.changed
+				};
+			}
+			const withComment = ensureSchemaComment(result.content, isGitHub ? "github" : "forgejo");
+			if (result.changed || withComment !== result.content) {
+				ctx.write(filePath, withComment);
+				return {
+					filePath,
+					action: "updated",
+					description: "Added missing steps to CI workflow"
+				};
+			}
 		}
 		return {
-			filePath: ciPath,
+			filePath,
 			action: "skipped",
-			description: "Release step in CI workflow already up to date"
+			description: "CI workflow already up to date"
 		};
 	}
-	const withComment = ensureSchemaComment(merged.content, ctx.config.ci);
-	ctx.write(ciPath, withComment);
+	ctx.write(filePath, content);
 	return {
-		filePath: ciPath,
-		action: "updated",
-		description: "Added release step to CI workflow"
+		filePath,
+		action: "created",
+		description: `Generated ${isGitHub ? "GitHub" : "Forgejo"} Actions CI workflow`
 	};
 }
-async function generateReleaseCi(ctx) {
-	const filePath = "release-ci";
-	if (ctx.config.releaseStrategy === "none" || ctx.config.ci === "none") return {
-		filePath,
+//#endregion
+//#region src/generators/knip.ts
+const KNIP_CONFIG_SINGLE = `import type { KnipConfig } from "knip";
+
+export default {
+  entry: ["src/index.ts"],
+  project: ["src/**/*.ts"],
+  ignore: ["dist/**"],
+} satisfies KnipConfig;
+`;
+const KNIP_CONFIG_MONOREPO = `import type { KnipConfig } from "knip";
+
+export default {
+  workspaces: {
+    ".": {
+      entry: [],
+      project: [],
+    },
+    "packages/*": {
+      entry: ["src/index.ts", "src/bin.ts"],
+      project: ["src/**/*.ts"],
+      ignore: ["dist/**"],
+    },
+  },
+} satisfies KnipConfig;
+`;
+/** All known knip config file locations, in priority order. */
+const KNIP_CONFIG_PATHS = [
+	"knip.config.ts",
+	"knip.config.mts",
+	"knip.json",
+	"knip.jsonc",
+	"knip.ts",
+	"knip.mts"
+];
+async function generateKnip(ctx) {
+	const filePath = "knip.config.ts";
+	const isMonorepo = ctx.config.structure === "monorepo";
+	const existingPath = KNIP_CONFIG_PATHS.find((p) => ctx.exists(p));
+	if (existingPath) return {
+		filePath: existingPath,
 		action: "skipped",
-		description: "Release CI workflow not applicable"
+		description: existingPath === filePath ? "Already configured" : `Existing config found at ${existingPath}`
 	};
-	const publishesNpm = ctx.config.publishNpm === true;
-	if (ctx.config.releaseStrategy === "changesets") return generateChangesetsReleaseCi(ctx, publishesNpm);
-	const isGitHub = ctx.config.ci === "github";
-	const workflowPath = isGitHub ? ".github/workflows/release.yml" : ".forgejo/workflows/release.yml";
-	const nodeVersionYaml = hasEnginesNode(ctx) ? "node-version-file: package.json" : "node-version: \"24\"";
-	const content = buildWorkflow(ctx.config.releaseStrategy, ctx.config.ci, nodeVersionYaml, publishesNpm);
-	if (!content) return {
+	const config = isMonorepo ? KNIP_CONFIG_MONOREPO : KNIP_CONFIG_SINGLE;
+	ctx.write(filePath, config);
+	return {
 		filePath,
+		action: "created",
+		description: "Generated knip.config.ts for dead code analysis"
+	};
+}
+//#endregion
+//#region src/generators/renovate.ts
+const SHARED_PRESET = "local>bensandee/tooling";
+/** Deprecated npm-based preset to migrate away from. */
+const LEGACY_PRESET = "@bensandee/config";
+/** All known renovate config file locations, in priority order. */
+const RENOVATE_CONFIG_PATHS = [
+	"renovate.json",
+	"renovate.json5",
+	".renovaterc",
+	".renovaterc.json",
+	".github/renovate.json",
+	".github/renovate.json5"
+];
+async function generateRenovate(ctx) {
+	const defaultPath = "renovate.json";
+	if (!ctx.config.setupRenovate) return {
+		filePath: defaultPath,
 		action: "skipped",
-		description: "Release CI workflow not applicable"
+		description: "Renovate not requested"
 	};
-	if (ctx.exists(workflowPath)) {
-		const raw = ctx.read(workflowPath);
-		if (raw) {
-			const existing = migrateToolingBinary(raw);
-			if (existing === content || ensureSchemaComment(existing, ctx.config.ci) === content) {
-				if (existing !== raw) {
-					ctx.write(workflowPath, ensureSchemaComment(existing, ctx.config.ci));
-					return {
-						filePath: workflowPath,
-						action: "updated",
-						description: "Migrated tooling binary name in release workflow"
-					};
-				}
+	const existingPath = RENOVATE_CONFIG_PATHS.find((p) => ctx.exists(p));
+	if (existingPath) {
+		const existing = ctx.read(existingPath);
+		if (existing) {
+			const parsed = parseRenovateJson(existing);
+			const existingExtends = parsed.extends ?? [];
+			const legacyIndex = existingExtends.indexOf(LEGACY_PRESET);
+			if (legacyIndex !== -1) {
+				existingExtends[legacyIndex] = SHARED_PRESET;
+				parsed.extends = existingExtends;
+				ctx.write(existingPath, JSON.stringify(parsed, null, 2) + "\n");
 				return {
-					filePath: workflowPath,
-					action: "skipped",
-					description: "Release workflow already up to date"
+					filePath: existingPath,
+					action: "updated",
+					description: `Migrated extends: ${LEGACY_PRESET} → ${SHARED_PRESET}`
 				};
 			}
-			const merged = mergeWorkflowSteps(existing, "release", requiredReleaseSteps(ctx.config.releaseStrategy, nodeVersionYaml, publishesNpm));
-			const withComment = ensureSchemaComment(merged.content, ctx.config.ci);
-			if (!merged.changed) {
-				if (withComment !== raw) {
-					ctx.write(workflowPath, withComment);
-					return {
-						filePath: workflowPath,
-						action: "updated",
-						description: existing !== raw ? "Migrated tooling binary name in release workflow" : "Added schema comment to release workflow"
-					};
-				}
+			if (!existingExtends.includes(SHARED_PRESET)) {
+				existingExtends.unshift(SHARED_PRESET);
+				parsed.extends = existingExtends;
+				ctx.write(existingPath, JSON.stringify(parsed, null, 2) + "\n");
 				return {
-					filePath: workflowPath,
-					action: "skipped",
-					description: "Existing release workflow preserved"
+					filePath: existingPath,
+					action: "updated",
+					description: `Added extends: ${SHARED_PRESET}`
 				};
 			}
-			ctx.write(workflowPath, withComment);
 			return {
-				filePath: workflowPath,
-				action: "updated",
-				description: "Added missing steps to release workflow"
+				filePath: existingPath,
+				action: "skipped",
+				description: "Already extends shared config"
 			};
 		}
-		return {
-			filePath: workflowPath,
-			action: "skipped",
-			description: "Release workflow already up to date"
-		};
 	}
-	ctx.write(workflowPath, content);
+	const config = {
+		$schema: "https://docs.renovatebot.com/renovate-schema.json",
+		extends: [SHARED_PRESET]
+	};
+	ctx.write(defaultPath, JSON.stringify(config, null, 2) + "\n");
 	return {
-		filePath: workflowPath,
+		filePath: defaultPath,
 		action: "created",
-		description: `Generated ${isGitHub ? "GitHub" : "Forgejo"} Actions release workflow`
+		description: "Generated renovate.json extending shared config"
 	};
 }
 //#endregion
-//#region src/generators/lefthook.ts
-function requiredCommands(formatter) {
+//#region src/generators/pnpm-workspace.ts
+const WORKSPACE_YAML = `packages:
+  - "packages/*"
+`;
+async function generatePnpmWorkspace(ctx) {
+	const filePath = "pnpm-workspace.yaml";
+	if (ctx.config.structure !== "monorepo") return {
+		filePath,
+		action: "skipped",
+		description: "Not a monorepo"
+	};
+	if (ctx.exists(filePath)) return {
+		filePath,
+		action: "skipped",
+		description: "pnpm-workspace.yaml already exists"
+	};
+	ctx.write(filePath, WORKSPACE_YAML);
 	return {
-		lint: { run: "pnpm exec oxlint {staged_files}" },
-		format: {
-			run: formatter === "prettier" ? "pnpm exec prettier --write {staged_files}" : "pnpm exec oxfmt --no-error-on-unmatched-pattern {staged_files}",
-			stage_fixed: true
-		}
+		filePath,
+		action: "created",
+		description: "Generated pnpm-workspace.yaml"
 	};
 }
-function buildConfig(formatter) {
-	return [
-		"pre-commit:",
-		"  commands:",
-		"    lint:",
-		"      run: pnpm exec oxlint {staged_files}",
-		"    format:",
-		`      run: ${formatter === "prettier" ? "pnpm exec prettier --write {staged_files}" : "pnpm exec oxfmt --no-error-on-unmatched-pattern {staged_files}"}`,
-		"      stage_fixed: true",
-		""
-	].join("\n");
-}
-const ARCHIVE_DIR = ".tooling-archived";
-/** Common client-side git hooks that husky may have configured. */
-const HUSKY_HOOK_NAMES = [
-	"pre-commit",
-	"commit-msg",
-	"pre-push",
-	"post-merge",
-	"post-checkout",
-	"prepare-commit-msg"
-];
-/** All known lint-staged config file locations to archive. */
-const LINT_STAGED_CONFIG_PATHS = [
-	"lint-staged.config.mjs",
-	"lint-staged.config.js",
-	"lint-staged.config.cjs",
-	".lintstagedrc",
-	".lintstagedrc.json",
-	".lintstagedrc.yaml",
-	".lintstagedrc.yml",
-	".lintstagedrc.mjs",
-	".lintstagedrc.cjs"
-];
-/** All known lefthook config file locations, in priority order. */
-const LEFTHOOK_CONFIG_PATHS = ["lefthook.yml", ".lefthook.yml"];
-/** Archive all husky hook files found in .husky/ */
-function archiveHuskyHooks(ctx, results) {
-	let found = false;
-	for (const hook of HUSKY_HOOK_NAMES) {
-		const huskyPath = `.husky/${hook}`;
-		const existing = ctx.read(huskyPath);
-		if (existing !== void 0) {
-			ctx.write(`${ARCHIVE_DIR}/${huskyPath}`, existing);
-			ctx.remove(huskyPath);
-			results.push({
-				filePath: huskyPath,
-				action: "archived",
-				description: `Moved to ${ARCHIVE_DIR}/${huskyPath}`
-			});
-			found = true;
+//#endregion
+//#region src/generators/claude-settings.ts
+const ClaudeSettingsSchema = z.object({
+	permissions: z.object({
+		allow: z.array(z.string()).default([]),
+		deny: z.array(z.string()).default([])
+	}).default({
+		allow: [],
+		deny: []
+	}),
+	instructions: z.array(z.string()).default([]),
+	enabledPlugins: z.record(z.string(), z.boolean()).default({}),
+	extraKnownMarketplaces: z.record(z.string(), z.record(z.string(), z.unknown())).default({})
+});
+function parseClaudeSettings(raw) {
+	try {
+		const json = JSON.parse(raw);
+		const rawResult = z.record(z.string(), z.unknown()).safeParse(json);
+		const settingsResult = ClaudeSettingsSchema.safeParse(json);
+		if (!rawResult.success || !settingsResult.success) return void 0;
+		return {
+			settings: settingsResult.data,
+			rawJson: rawResult.data
+		};
+	} catch {
+		return;
+	}
+}
+function buildSettings(ctx) {
+	const pm = "pnpm";
+	const allow = [
+		`Bash(${pm} install)`,
+		`Bash(${pm} install *)`,
+		`Bash(${pm} add *)`,
+		`Bash(${pm} update *)`,
+		`Bash(${pm} view *)`,
+		`Bash(${pm} why *)`,
+		`Bash(${pm} list)`,
+		`Bash(${pm} list *)`,
+		`Bash(${pm} ls)`,
+		`Bash(${pm} ls *)`,
+		"Bash(npm view *)",
+		"Bash(npm info *)",
+		"Bash(npm show *)",
+		`Bash(${pm} build)`,
+		`Bash(${pm} -r build)`,
+		`Bash(${pm} dev)`,
+		`Bash(${pm} test)`,
+		`Bash(${pm} test *)`,
+		`Bash(${pm} -r test)`,
+		`Bash(${pm} vitest)`,
+		`Bash(${pm} vitest *)`,
+		`Bash(${pm} exec vitest)`,
+		`Bash(${pm} exec vitest *)`,
+		`Bash(${pm} exec oxfmt)`,
+		`Bash(${pm} exec oxfmt *)`,
+		`Bash(${pm} typecheck)`,
+		`Bash(${pm} -r --parallel run typecheck)`,
+		`Bash(${pm} tsc *)`,
+		`Bash(${pm} exec tsc *)`,
+		`Bash(${pm} lint)`,
+		`Bash(${pm} lint *)`,
+		`Bash(${pm} format)`,
+		`Bash(${pm} format *)`,
+		`Bash(${pm} knip)`,
+		`Bash(${pm} knip *)`,
+		`Bash(${pm} check)`,
+		`Bash(${pm} exec oxlint *)`,
+		`Bash(${pm} exec knip *)`,
+		"Bash(git status *)",
+		"Bash(git log *)",
+		"Bash(git diff *)",
+		"Bash(git branch *)",
+		"Bash(git show *)",
+		"Bash(git rev-parse *)",
+		"Bash(ls *)",
+		"Bash(cat *)",
+		"Bash(head *)",
+		"Bash(tail *)",
+		"Bash(wc *)",
+		"Bash(test *)",
+		"Bash([ *)",
+		"Bash(grep *)",
+		"Bash(which *)",
+		"Bash(node -e *)",
+		"Bash(node -p *)"
+	];
+	if (ctx.config.structure === "monorepo") allow.push(`Bash(${pm} --filter *)`, `Bash(${pm} -r *)`);
+	const enabledPlugins = { "code-simplifier@claude-plugins-official": true };
+	const extraKnownMarketplaces = {};
+	if (ctx.config.structure !== "monorepo") {
+		if (ctx.packageJson ? packageHasWebUIDeps(ctx.packageJson) : false) enabledPlugins["frontend-design@claude-plugins-official"] = true;
+	}
+	return {
+		permissions: {
+			allow,
+			deny: [
+				"Bash(npx *)",
+				"Bash(git push *)",
+				"Bash(git push)",
+				"Bash(git add *)",
+				"Bash(git add)",
+				"Bash(git commit *)",
+				"Bash(git commit)",
+				"Bash(git reset *)",
+				"Bash(git merge *)",
+				"Bash(git rebase *)",
+				"Bash(git cherry-pick *)",
+				"Bash(git checkout *)",
+				"Bash(git switch *)",
+				"Bash(git stash *)",
+				"Bash(git tag *)",
+				"Bash(git revert *)",
+				"Bash(git clean *)",
+				"Bash(git rm *)",
+				"Bash(git mv *)",
+				"Bash(rm -rf *)",
+				"Bash(cat *.env)",
+				"Bash(cat *.env.*)",
+				"Bash(cat .env)",
+				"Bash(cat .env.*)",
+				"Bash(head *.env)",
+				"Bash(head *.env.*)",
+				"Bash(head .env)",
+				"Bash(head .env.*)",
+				"Bash(tail *.env)",
+				"Bash(tail *.env.*)",
+				"Bash(tail .env)",
+				"Bash(tail .env.*)",
+				"Bash(less *.env)",
+				"Bash(less *.env.*)",
+				"Bash(less .env)",
+				"Bash(less .env.*)",
+				"Bash(more *.env)",
+				"Bash(more *.env.*)",
+				"Bash(more .env)",
+				"Bash(more .env.*)",
+				"Bash(grep * .env)",
+				"Bash(grep * .env.*)",
+				"Read(.env)",
+				"Read(.env.*)",
+				"Read(*.env)",
+				"Read(*.env.*)"
+			]
+		},
+		instructions: [
+			"Use pnpm, not npm/yarn/npx. Run binaries with `pnpm exec`.",
+			"No typecasts (as/any). Use zod schemas, type guards, or narrowing instead.",
+			"Fix lint violations instead of suppressing them. Only add disable comments when suppression is genuinely the best option. For no-empty-function: add a `{ /* no-op */ }` comment body instead of a disable comment.",
+			"Prefer extensionless imports; if an extension is required, use .ts over .js."
+		],
+		enabledPlugins,
+		extraKnownMarketplaces
+	};
+}
+/** Remove enabledPlugins/extraKnownMarketplaces when empty to keep the file clean. */
+function serializeSettings$1(settings) {
+	const { enabledPlugins, extraKnownMarketplaces, ...rest } = settings;
+	const out = { ...rest };
+	if (Object.keys(enabledPlugins).length > 0) out["enabledPlugins"] = enabledPlugins;
+	if (Object.keys(extraKnownMarketplaces).length > 0) out["extraKnownMarketplaces"] = extraKnownMarketplaces;
+	return JSON.stringify(out, null, 2) + "\n";
+}
+function writeOrMergeSettings(ctx, filePath, generated) {
+	const existing = ctx.read(filePath);
+	if (existing) {
+		const parsed = parseClaudeSettings(existing);
+		if (!parsed) return {
+			filePath,
+			action: "skipped",
+			description: "Could not parse existing settings"
+		};
+		const { settings, rawJson } = parsed;
+		const missingAllow = generated.permissions.allow.filter((rule) => !settings.permissions.allow.includes(rule));
+		const missingDeny = generated.permissions.deny.filter((rule) => !settings.permissions.deny.includes(rule));
+		const mergedInstructions = [...settings.instructions];
+		let instructionChanges = 0;
+		for (const inst of generated.instructions) {
+			if (mergedInstructions.includes(inst)) continue;
+			const prefixIdx = mergedInstructions.findIndex((e) => inst.startsWith(e) || e.startsWith(inst));
+			if (prefixIdx !== -1) mergedInstructions[prefixIdx] = inst;
+			else mergedInstructions.push(inst);
+			instructionChanges++;
 		}
+		const missingPlugins = Object.entries(generated.enabledPlugins).filter(([key]) => !(key in settings.enabledPlugins));
+		const missingMarketplaces = Object.entries(generated.extraKnownMarketplaces).filter(([key]) => !(key in settings.extraKnownMarketplaces));
+		const changed = missingAllow.length + missingDeny.length + instructionChanges + missingPlugins.length + missingMarketplaces.length;
+		if (changed === 0) return {
+			filePath,
+			action: "skipped",
+			description: "Already has all rules and instructions"
+		};
+		rawJson["permissions"] = {
+			allow: [...settings.permissions.allow, ...missingAllow],
+			deny: [...settings.permissions.deny, ...missingDeny]
+		};
+		rawJson["instructions"] = mergedInstructions;
+		const updatedPlugins = { ...settings.enabledPlugins };
+		for (const [key, value] of missingPlugins) updatedPlugins[key] = value;
+		const updatedMarketplaces = { ...settings.extraKnownMarketplaces };
+		for (const [key, value] of missingMarketplaces) updatedMarketplaces[key] = value;
+		if (Object.keys(updatedPlugins).length > 0) rawJson["enabledPlugins"] = updatedPlugins;
+		else delete rawJson["enabledPlugins"];
+		if (Object.keys(updatedMarketplaces).length > 0) rawJson["extraKnownMarketplaces"] = updatedMarketplaces;
+		else delete rawJson["extraKnownMarketplaces"];
+		ctx.write(filePath, JSON.stringify(rawJson, null, 2) + "\n");
+		return {
+			filePath,
+			action: "updated",
+			description: `Updated ${String(changed)} rules/instructions`
+		};
+	}
+	ctx.write(filePath, serializeSettings$1(generated));
+	return {
+		filePath,
+		action: "created",
+		description: `Generated ${filePath}`
+	};
+}
+async function generateClaudeSettings(ctx) {
+	const results = [];
+	results.push(writeOrMergeSettings(ctx, ".claude/settings.json", buildSettings(ctx)));
+	if (ctx.config.structure === "monorepo") for (const pkg of getMonorepoPackages(ctx.targetDir)) {
+		if (!hasWebUIDeps(pkg.dir)) continue;
+		const pkgRelDir = path.relative(ctx.targetDir, pkg.dir);
+		const pkgSettingsPath = path.join(pkgRelDir, ".claude/settings.json");
+		results.push(writeOrMergeSettings(ctx, pkgSettingsPath, {
+			permissions: {
+				allow: [],
+				deny: []
+			},
+			instructions: [],
+			enabledPlugins: { "frontend-design@claude-plugins-official": true },
+			extraKnownMarketplaces: {}
+		}));
+	}
+	return results;
+}
+//#endregion
+//#region src/generators/release-it.ts
+function buildConfig$2(ci, isMonorepo) {
+	const config = {
+		$schema: "https://unpkg.com/release-it/schema/release-it.json",
+		git: {
+			commitMessage: "chore: release v${version}",
+			tagName: "v${version}"
+		},
+		npm: { publish: true }
+	};
+	if (ci === "github") config["github"] = { release: true };
+	const plugins = {};
+	if (isMonorepo) {
+		config["npm"] = {
+			publish: true,
+			allowSameVersion: true
+		};
+		plugins["@release-it/bumper"] = { out: "packages/*/package.json" };
 	}
-	return found;
+	if (Object.keys(plugins).length > 0) config["plugins"] = plugins;
+	return config;
 }
-/** Archive all lint-staged config files. */
-function archiveLintStagedConfigs(ctx, results) {
-	let found = false;
-	for (const lsPath of LINT_STAGED_CONFIG_PATHS) {
-		const existing = ctx.read(lsPath);
-		if (existing !== void 0) {
-			ctx.write(`${ARCHIVE_DIR}/${lsPath}`, existing);
-			ctx.remove(lsPath);
-			results.push({
-				filePath: lsPath,
-				action: "archived",
-				description: `Moved to ${ARCHIVE_DIR}/${lsPath}`
-			});
-			found = true;
-		}
+async function generateReleaseIt(ctx) {
+	const filePath = ".release-it.json";
+	if (ctx.config.releaseStrategy !== "release-it") return {
+		filePath,
+		action: "skipped",
+		description: "release-it not requested"
+	};
+	const content = JSON.stringify(buildConfig$2(ctx.config.ci, ctx.config.structure === "monorepo"), null, 2) + "\n";
+	const existing = ctx.read(filePath);
+	if (existing) {
+		if (contentEqual(filePath, existing, content)) return {
+			filePath,
+			action: "skipped",
+			description: "Already configured"
+		};
+		if (await ctx.confirmOverwrite(filePath) === "skip") return {
+			filePath,
+			action: "skipped",
+			description: "Existing release-it config preserved"
+		};
 	}
-	return found;
+	ctx.write(filePath, content);
+	return {
+		filePath,
+		action: existing ? "updated" : "created",
+		description: "Generated .release-it.json"
+	};
 }
-/** Remove husky/lint-staged from package.json devDependencies and fix prepare script. */
-function cleanPackageJson(ctx, results) {
-	const raw = ctx.read("package.json");
-	if (!raw) return;
-	const pkg = parsePackageJson(raw);
-	if (!pkg) return;
-	const changes = [];
-	if (pkg.devDependencies) {
-		if ("husky" in pkg.devDependencies) {
-			delete pkg.devDependencies["husky"];
-			changes.push("removed devDependency: husky");
+//#endregion
+//#region src/generators/changesets.ts
+function buildConfig$1() {
+	return {
+		$schema: "https://unpkg.com/@changesets/config@3.1.1/schema.json",
+		changelog: "@changesets/cli/changelog",
+		commit: false,
+		fixed: [],
+		linked: [],
+		access: "public",
+		baseBranch: "main",
+		updateInternalDependencies: "patch",
+		ignore: []
+	};
+}
+async function generateChangesets(ctx) {
+	const filePath = ".changeset/config.json";
+	if (ctx.config.releaseStrategy !== "changesets") return {
+		filePath,
+		action: "skipped",
+		description: "Changesets not requested"
+	};
+	const content = JSON.stringify(buildConfig$1(), null, 2) + "\n";
+	const existing = ctx.read(filePath);
+	if (existing) return {
+		filePath,
+		action: "skipped",
+		description: "Existing changesets config preserved"
+	};
+	ctx.write(filePath, content);
+	return {
+		filePath,
+		action: existing ? "updated" : "created",
+		description: "Generated .changeset/config.json"
+	};
+}
+//#endregion
+//#region src/generators/release-ci.ts
+function commonSteps(nodeVersionYaml, publishesNpm) {
+	return `      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
+        with:
+          ${nodeVersionYaml}
+          cache: pnpm${publishesNpm ? `\n          registry-url: "https://registry.npmjs.org"` : ""}
+      - run: pnpm install --frozen-lockfile`;
+}
+function releaseItWorkflow(ci, nodeVersionYaml, publishesNpm) {
+	const isGitHub = ci === "github";
+	const permissions = isGitHub ? `
+permissions:
+  contents: write
+` : "";
+	const tokenEnv = isGitHub ? `GITHUB_TOKEN: \${{ github.token }}` : `FORGEJO_TOKEN: \${{ secrets.FORGEJO_TOKEN }}`;
+	const npmEnv = publishesNpm ? `\n          NODE_AUTH_TOKEN: \${{ secrets.NPM_TOKEN }}` : "";
+	return `${workflowSchemaComment(ci)}name: Release
+on:
+  workflow_dispatch:
+${permissions}
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+${commonSteps(nodeVersionYaml, publishesNpm)}
+      - run: pnpm release-it --ci
+        env:
+          ${tokenEnv}${npmEnv}
+`;
+}
+function commitAndTagVersionWorkflow(ci, nodeVersionYaml, publishesNpm) {
+	const isGitHub = ci === "github";
+	const permissions = isGitHub ? `
+permissions:
+  contents: write
+` : "";
+	const gitConfigStep = `
+      - name: Configure git
+        run: |
+          git config user.name "${isGitHub ? "github-actions[bot]" : "forgejo-actions[bot]"}"
+          git config user.email "${isGitHub ? "github-actions[bot]@users.noreply.github.com" : "forgejo-actions[bot]@noreply.localhost"}"`;
+	const releaseStep = isGitHub ? `
+      - name: Release
+        env:
+          GITHUB_TOKEN: \${{ github.token }}
+        run: pnpm exec bst release:simple` : `
+      - name: Release
+        env:
+          FORGEJO_SERVER_URL: \${{ github.server_url }}
+          FORGEJO_REPOSITORY: \${{ github.repository }}
+          FORGEJO_TOKEN: \${{ secrets.FORGEJO_TOKEN }}
+        run: pnpm exec bst release:simple`;
+	return `${workflowSchemaComment(ci)}name: Release
+on:
+  workflow_dispatch:
+${permissions}
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+${commonSteps(nodeVersionYaml, publishesNpm)}${gitConfigStep}${releaseStep}
+`;
+}
+/** Build the required release step for the check job (changesets). */
+function changesetsReleaseStep(ci, publishesNpm) {
+	if (ci === "github") return {
+		match: { uses: "changesets/action" },
+		step: {
+			uses: "changesets/action@v1",
+			if: "github.ref == 'refs/heads/main'",
+			with: {
+				publish: "pnpm changeset publish",
+				version: "pnpm changeset version"
+			},
+			env: {
+				GITHUB_TOKEN: actionsExpr("github.token"),
+				...publishesNpm && { NPM_TOKEN: actionsExpr("secrets.NPM_TOKEN") }
+			}
 		}
-		if ("lint-staged" in pkg.devDependencies) {
-			delete pkg.devDependencies["lint-staged"];
-			changes.push("removed devDependency: lint-staged");
+	};
+	return {
+		match: { run: "release:changesets" },
+		step: {
+			name: "Release",
+			if: "github.ref == 'refs/heads/main'",
+			env: {
+				FORGEJO_SERVER_URL: actionsExpr("github.server_url"),
+				FORGEJO_REPOSITORY: actionsExpr("github.repository"),
+				FORGEJO_TOKEN: actionsExpr("secrets.FORGEJO_TOKEN"),
+				...publishesNpm && { NODE_AUTH_TOKEN: actionsExpr("secrets.NPM_TOKEN") }
+			},
+			run: "pnpm exec bst release:changesets"
 		}
-	}
-	if (pkg.scripts?.["prepare"] && /\bhusky\b/.test(pkg.scripts["prepare"])) {
-		delete pkg.scripts["prepare"];
-		changes.push("removed husky prepare script");
-	}
-	if (changes.length === 0) return;
-	ctx.write("package.json", JSON.stringify(pkg, null, 2) + "\n");
-	results.push({
-		filePath: "package.json",
-		action: "updated",
-		description: changes.join(", ")
-	});
+	};
 }
-async function generateLefthook(ctx) {
-	const filePath = "lefthook.yml";
-	const content = buildConfig(ctx.config.formatter);
-	const results = [];
-	archiveHuskyHooks(ctx, results);
-	archiveLintStagedConfigs(ctx, results);
-	cleanPackageJson(ctx, results);
-	const existingPath = LEFTHOOK_CONFIG_PATHS.find((p) => ctx.exists(p));
-	if (existingPath) {
-		const existing = ctx.read(existingPath);
-		if (existing) {
-			const merged = mergeLefthookCommands(existing, requiredCommands(ctx.config.formatter));
-			if (merged.changed) {
-				ctx.write(existingPath, merged.content);
-				results.push({
-					filePath: existingPath,
-					action: "updated",
-					description: "Added missing pre-commit commands"
-				});
-			} else results.push({
-				filePath: existingPath,
-				action: "skipped",
-				description: "Lefthook config already up to date"
+function requiredReleaseSteps(strategy, nodeVersionYaml, publishesNpm) {
+	const isNodeVersionFile = nodeVersionYaml.startsWith("node-version-file");
+	const steps = [
+		{
+			match: { uses: "actions/checkout" },
+			step: {
+				uses: "actions/checkout@v4",
+				with: { "fetch-depth": 0 }
+			}
+		},
+		{
+			match: { uses: "pnpm/action-setup" },
+			step: { uses: "pnpm/action-setup@v4" }
+		},
+		{
+			match: { uses: "actions/setup-node" },
+			step: {
+				uses: "actions/setup-node@v4",
+				with: {
+					...isNodeVersionFile ? { "node-version-file": "package.json" } : { "node-version": "24" },
+					cache: "pnpm",
+					...publishesNpm && { "registry-url": "https://registry.npmjs.org" }
+				}
+			}
+		},
+		{
+			match: { run: "pnpm install" },
+			step: { run: "pnpm install --frozen-lockfile" }
+		}
+	];
+	switch (strategy) {
+		case "release-it":
+			steps.push({
+				match: { run: "release-it" },
+				step: { run: "pnpm release-it --ci" }
 			});
-		} else results.push({
-			filePath: existingPath,
-			action: "skipped",
-			description: "Could not read existing lefthook config"
-		});
-		return results;
+			break;
+		case "simple":
+			steps.push({
+				match: { run: "release:simple" },
+				step: { run: "pnpm exec bst release:simple" }
+			});
+			break;
+		case "changesets":
+			steps.push({
+				match: { run: "changeset" },
+				step: { run: "pnpm exec bst release:changesets" }
+			});
+			break;
 	}
-	ctx.write(filePath, content);
-	results.push({
-		filePath,
-		action: "created",
-		description: "Generated lefthook pre-commit config"
-	});
-	return results;
-}
-//#endregion
-//#region src/generators/vscode-settings.ts
-const SCHEMA_NPM_PATH = "@bensandee/config/schemas/forgejo-workflow.schema.json";
-const SCHEMA_LOCAL_PATH = ".vscode/forgejo-workflow.schema.json";
-const SETTINGS_PATH = ".vscode/settings.json";
-const SCHEMA_GLOB = ".forgejo/workflows/*.{yml,yaml}";
-const VscodeSettingsSchema = z.looseObject({ "yaml.schemas": z.record(z.string(), z.unknown()).default({}) });
-function readSchemaFromNodeModules(targetDir) {
-	const candidate = path.join(targetDir, "node_modules", SCHEMA_NPM_PATH);
-	if (!existsSync(candidate)) return void 0;
-	return readFileSync(candidate, "utf-8");
+	return steps;
 }
-function serializeSettings(settings) {
-	return JSON.stringify(settings, null, 2) + "\n";
+function buildWorkflow(strategy, ci, nodeVersionYaml, publishesNpm) {
+	switch (strategy) {
+		case "release-it": return releaseItWorkflow(ci, nodeVersionYaml, publishesNpm);
+		case "simple": return commitAndTagVersionWorkflow(ci, nodeVersionYaml, publishesNpm);
+		default: return null;
+	}
 }
-const YamlSchemasSchema = z.record(z.string(), z.unknown());
-/** Merge yaml.schemas into a settings object. Returns the result and whether anything changed. */
-function mergeYamlSchemas(settings) {
-	const parsed = YamlSchemasSchema.safeParse(settings["yaml.schemas"]);
-	const yamlSchemas = parsed.success ? { ...parsed.data } : {};
-	if (SCHEMA_LOCAL_PATH in yamlSchemas) return {
-		merged: settings,
-		changed: false
-	};
-	yamlSchemas[SCHEMA_LOCAL_PATH] = SCHEMA_GLOB;
-	return {
-		merged: {
-			...settings,
-			"yaml.schemas": yamlSchemas
-		},
-		changed: true
+function generateChangesetsReleaseCi(ctx, publishesNpm) {
+	const ciPath = ciWorkflowPath(ctx.config.ci, ctx.config.releaseStrategy);
+	const raw = ctx.read(ciPath);
+	if (!raw) return {
+		filePath: ciPath,
+		action: "skipped",
+		description: "CI workflow not found — run check generator first"
 	};
-}
-function writeSchemaToSettings(ctx) {
-	if (ctx.exists(SETTINGS_PATH)) {
-		const raw = ctx.read(SETTINGS_PATH);
-		if (!raw) return {
-			filePath: SETTINGS_PATH,
-			action: "skipped",
-			description: "Could not read existing settings"
-		};
-		const parsed = VscodeSettingsSchema.safeParse(parse(raw));
-		if (!parsed.success) return {
-			filePath: SETTINGS_PATH,
-			action: "skipped",
-			description: "Could not parse existing settings"
-		};
-		const { merged, changed } = mergeYamlSchemas(parsed.data);
-		if (!changed) return {
-			filePath: SETTINGS_PATH,
-			action: "skipped",
-			description: "Already has Forgejo schema mapping"
-		};
-		ctx.write(SETTINGS_PATH, serializeSettings(merged));
+	const existing = migrateToolingBinary(raw);
+	const merged = mergeWorkflowSteps(existing, "check", [changesetsReleaseStep(ctx.config.ci, publishesNpm)]);
+	if (!merged.changed) {
+		if (existing !== raw) {
+			const withComment = ensureSchemaComment(existing, ctx.config.ci);
+			ctx.write(ciPath, withComment);
+			return {
+				filePath: ciPath,
+				action: "updated",
+				description: "Migrated tooling binary name in CI workflow"
+			};
+		}
 		return {
-			filePath: SETTINGS_PATH,
-			action: "updated",
-			description: "Added Forgejo workflow schema mapping"
+			filePath: ciPath,
+			action: "skipped",
+			description: "Release step in CI workflow already up to date"
 		};
 	}
-	ctx.write(SETTINGS_PATH, serializeSettings({ "yaml.schemas": { [SCHEMA_LOCAL_PATH]: SCHEMA_GLOB } }));
+	const withComment = ensureSchemaComment(merged.content, ctx.config.ci);
+	ctx.write(ciPath, withComment);
 	return {
-		filePath: SETTINGS_PATH,
-		action: "created",
-		description: "Generated .vscode/settings.json with Forgejo workflow schema"
+		filePath: ciPath,
+		action: "updated",
+		description: "Added release step to CI workflow"
 	};
 }
-async function generateVscodeSettings(ctx) {
-	const results = [];
-	if (ctx.config.ci !== "forgejo") {
-		results.push({
-			filePath: SETTINGS_PATH,
-			action: "skipped",
-			description: "Not a Forgejo project"
-		});
-		return results;
-	}
-	const schemaContent = readSchemaFromNodeModules(ctx.targetDir);
-	if (!schemaContent) {
-		results.push({
-			filePath: SCHEMA_LOCAL_PATH,
-			action: "skipped",
-			description: "Could not find @bensandee/config schema in node_modules"
-		});
-		return results;
-	}
-	const existingSchema = ctx.read(SCHEMA_LOCAL_PATH);
-	if (existingSchema !== void 0 && contentEqual(SCHEMA_LOCAL_PATH, existingSchema, schemaContent)) results.push({
-		filePath: SCHEMA_LOCAL_PATH,
+async function generateReleaseCi(ctx) {
+	const filePath = "release-ci";
+	if (ctx.config.releaseStrategy === "none" || ctx.config.ci === "none") return {
+		filePath,
 		action: "skipped",
-		description: "Schema already up to date"
-	});
-	else {
-		ctx.write(SCHEMA_LOCAL_PATH, schemaContent);
-		results.push({
-			filePath: SCHEMA_LOCAL_PATH,
-			action: existingSchema ? "updated" : "created",
-			description: "Copied Forgejo workflow schema from @bensandee/config"
-		});
-	}
-	results.push(writeSchemaToSettings(ctx));
-	return results;
-}
-//#endregion
-//#region src/generators/pipeline.ts
-/** Run all generators sequentially and return their results. */
-async function runGenerators(ctx) {
-	const results = [];
-	results.push(await generatePackageJson(ctx));
-	results.push(await generatePnpmWorkspace(ctx));
-	results.push(...await generateTsconfig(ctx));
-	results.push(await generateTsdown(ctx));
-	results.push(await generateOxlint(ctx));
-	results.push(await generateFormatter(ctx));
-	results.push(...await generateLefthook(ctx));
-	results.push(await generateGitignore(ctx));
-	results.push(await generateKnip(ctx));
-	results.push(await generateRenovate(ctx));
-	results.push(await generateCi(ctx));
-	results.push(...await generateClaudeSettings(ctx));
-	results.push(await generateReleaseIt(ctx));
-	results.push(await generateChangesets(ctx));
-	results.push(await generateReleaseCi(ctx));
-	results.push(await generateDeployCi(ctx));
-	results.push(...await generateVitest(ctx));
-	results.push(...await generateVscodeSettings(ctx));
-	results.push(saveToolingConfig(ctx, ctx.config));
-	return results;
-}
-//#endregion
-//#region src/release/docker.ts
-const ToolingDockerMapSchema = z.record(z.string(), z.object({
-	dockerfile: z.string(),
-	context: z.string().default(".")
-}));
-const ToolingConfigDockerSchema = z.object({ docker: ToolingDockerMapSchema.optional() });
-const PackageInfoSchema = z.object({
-	name: z.string().optional(),
-	version: z.string().optional()
-});
-/** Read the docker map from .tooling.json. Returns empty record if missing or invalid. */
-function loadDockerMap(executor, cwd) {
-	const configPath = path.join(cwd, ".tooling.json");
-	const raw = executor.readFile(configPath);
-	if (!raw) return {};
-	try {
-		const result = ToolingConfigDockerSchema.safeParse(JSON.parse(raw));
-		if (!result.success || !result.data.docker) return {};
-		return result.data.docker;
-	} catch (_error) {
-		return {};
-	}
-}
-/** Read name and version from a package's package.json. */
-function readPackageInfo(executor, packageJsonPath) {
-	const raw = executor.readFile(packageJsonPath);
-	if (!raw) return {
-		name: void 0,
-		version: void 0
+		description: "Release CI workflow not applicable"
 	};
-	try {
-		const result = PackageInfoSchema.safeParse(JSON.parse(raw));
-		if (!result.success) return {
-			name: void 0,
-			version: void 0
-		};
-		return {
-			name: result.data.name,
-			version: result.data.version
-		};
-	} catch (_error) {
+	const publishesNpm = ctx.config.publishNpm === true;
+	if (ctx.config.releaseStrategy === "changesets") return generateChangesetsReleaseCi(ctx, publishesNpm);
+	const isGitHub = ctx.config.ci === "github";
+	const workflowPath = isGitHub ? ".github/workflows/release.yml" : ".forgejo/workflows/release.yml";
+	const nodeVersionYaml = computeNodeVersionYaml(ctx);
+	const content = buildWorkflow(ctx.config.releaseStrategy, ctx.config.ci, nodeVersionYaml, publishesNpm);
+	if (!content) return {
+		filePath,
+		action: "skipped",
+		description: "Release CI workflow not applicable"
+	};
+	if (ctx.exists(workflowPath)) {
+		const raw = ctx.read(workflowPath);
+		if (raw) {
+			const existing = migrateToolingBinary(raw);
+			if (existing === content || ensureSchemaComment(existing, ctx.config.ci) === content) {
+				if (existing !== raw) {
+					ctx.write(workflowPath, ensureSchemaComment(existing, ctx.config.ci));
+					return {
+						filePath: workflowPath,
+						action: "updated",
+						description: "Migrated tooling binary name in release workflow"
+					};
+				}
+				return {
+					filePath: workflowPath,
+					action: "skipped",
+					description: "Release workflow already up to date"
+				};
+			}
+			const merged = mergeWorkflowSteps(existing, "release", requiredReleaseSteps(ctx.config.releaseStrategy, nodeVersionYaml, publishesNpm));
+			const withComment = ensureSchemaComment(merged.content, ctx.config.ci);
+			if (!merged.changed) {
+				if (withComment !== raw) {
+					ctx.write(workflowPath, withComment);
+					return {
+						filePath: workflowPath,
+						action: "updated",
+						description: existing !== raw ? "Migrated tooling binary name in release workflow" : "Added schema comment to release workflow"
+					};
+				}
+				return {
+					filePath: workflowPath,
+					action: "skipped",
+					description: "Existing release workflow preserved"
+				};
+			}
+			ctx.write(workflowPath, withComment);
+			return {
+				filePath: workflowPath,
+				action: "updated",
+				description: "Added missing steps to release workflow"
+			};
+		}
 		return {
-			name: void 0,
-			version: void 0
+			filePath: workflowPath,
+			action: "skipped",
+			description: "Release workflow already up to date"
 		};
 	}
+	ctx.write(workflowPath, content);
+	return {
+		filePath: workflowPath,
+		action: "created",
+		description: `Generated ${isGitHub ? "GitHub" : "Forgejo"} Actions release workflow`
+	};
 }
-/** Strip npm scope from a package name: "@scope/foo" → "foo", "foo" → "foo". */
-function stripScope(name) {
-	const slashIndex = name.indexOf("/");
-	return name.startsWith("@") && slashIndex !== -1 ? name.slice(slashIndex + 1) : name;
+//#endregion
+//#region src/generators/lefthook.ts
+function requiredCommands(formatter) {
+	return {
+		lint: { run: "pnpm exec oxlint {staged_files}" },
+		format: {
+			run: formatter === "prettier" ? "pnpm exec prettier --write {staged_files}" : "pnpm exec oxfmt --no-error-on-unmatched-pattern {staged_files}",
+			stage_fixed: true
+		}
+	};
 }
-/** Convention paths to check for Dockerfiles in a package directory. */
-const CONVENTION_DOCKERFILE_PATHS = ["Dockerfile", "docker/Dockerfile"];
-/**
-* Find a Dockerfile at convention paths for a monorepo package.
-* Checks packages/{dir}/Dockerfile and packages/{dir}/docker/Dockerfile.
-*/
-function findConventionDockerfile(executor, cwd, dir) {
-	for (const rel of CONVENTION_DOCKERFILE_PATHS) {
-		const dockerfilePath = `packages/${dir}/${rel}`;
-		if (executor.readFile(path.join(cwd, dockerfilePath)) !== null) return {
-			dockerfile: dockerfilePath,
-			context: "."
-		};
+function buildConfig(formatter) {
+	return [
+		"pre-commit:",
+		"  commands:",
+		"    lint:",
+		"      run: pnpm exec oxlint {staged_files}",
+		"    format:",
+		`      run: ${formatter === "prettier" ? "pnpm exec prettier --write {staged_files}" : "pnpm exec oxfmt --no-error-on-unmatched-pattern {staged_files}"}`,
+		"      stage_fixed: true",
+		""
+	].join("\n");
+}
+const ARCHIVE_DIR = ".tooling-archived";
+/** Common client-side git hooks that husky may have configured. */
+const HUSKY_HOOK_NAMES = [
+	"pre-commit",
+	"commit-msg",
+	"pre-push",
+	"post-merge",
+	"post-checkout",
+	"prepare-commit-msg"
+];
+/** All known lint-staged config file locations to archive. */
+const LINT_STAGED_CONFIG_PATHS = [
+	"lint-staged.config.mjs",
+	"lint-staged.config.js",
+	"lint-staged.config.cjs",
+	".lintstagedrc",
+	".lintstagedrc.json",
+	".lintstagedrc.yaml",
+	".lintstagedrc.yml",
+	".lintstagedrc.mjs",
+	".lintstagedrc.cjs"
+];
+/** All known lefthook config file locations, in priority order. */
+const LEFTHOOK_CONFIG_PATHS = ["lefthook.yml", ".lefthook.yml"];
+/** Archive all husky hook files found in .husky/ */
+function archiveHuskyHooks(ctx, results) {
+	let found = false;
+	for (const hook of HUSKY_HOOK_NAMES) {
+		const huskyPath = `.husky/${hook}`;
+		const existing = ctx.read(huskyPath);
+		if (existing !== void 0) {
+			ctx.write(`${ARCHIVE_DIR}/${huskyPath}`, existing);
+			ctx.remove(huskyPath);
+			results.push({
+				filePath: huskyPath,
+				action: "archived",
+				description: `Moved to ${ARCHIVE_DIR}/${huskyPath}`
+			});
+			found = true;
+		}
 	}
+	return found;
 }
-/**
-* Find a Dockerfile at convention paths for a single-package repo.
-* Checks Dockerfile and docker/Dockerfile at the project root.
-*/
-function findRootDockerfile(executor, cwd) {
-	for (const rel of CONVENTION_DOCKERFILE_PATHS) if (executor.readFile(path.join(cwd, rel)) !== null) return {
-		dockerfile: rel,
-		context: "."
-	};
+/** Archive all lint-staged config files. */
+function archiveLintStagedConfigs(ctx, results) {
+	let found = false;
+	for (const lsPath of LINT_STAGED_CONFIG_PATHS) {
+		const existing = ctx.read(lsPath);
+		if (existing !== void 0) {
+			ctx.write(`${ARCHIVE_DIR}/${lsPath}`, existing);
+			ctx.remove(lsPath);
+			results.push({
+				filePath: lsPath,
+				action: "archived",
+				description: `Moved to ${ARCHIVE_DIR}/${lsPath}`
+			});
+			found = true;
+		}
+	}
+	return found;
 }
-/**
-* Discover Docker packages by convention and merge with .tooling.json overrides.
-*
-* Convention: any package with a Dockerfile or docker/Dockerfile is a Docker package.
-* For monorepos, scans packages/{name}/. For single-package repos, scans the root.
-* The docker map in .tooling.json overrides convention-discovered config and can add
-* packages at non-standard locations.
-*
-* Image names are derived from {root-name}-{package-name} using each package's package.json name.
-* Versions are read from each package's own package.json.
-*/
-function detectDockerPackages(executor, cwd, repoName) {
-	const overrides = loadDockerMap(executor, cwd);
-	const packageDirs = executor.listPackageDirs(cwd);
-	const packages = [];
-	const seen = /* @__PURE__ */ new Set();
-	if (packageDirs.length > 0) {
-		for (const dir of packageDirs) {
-			const convention = findConventionDockerfile(executor, cwd, dir);
-			const docker = overrides[dir] ?? convention;
-			if (docker) {
-				const { name, version } = readPackageInfo(executor, path.join(cwd, "packages", dir, "package.json"));
-				packages.push({
-					dir,
-					imageName: `${repoName}-${stripScope(name ?? dir)}`,
-					version,
-					docker
-				});
-				seen.add(dir);
-			}
+/** Remove husky/lint-staged from package.json devDependencies and fix prepare script. */
+function cleanPackageJson(ctx, results) {
+	const raw = ctx.read("package.json");
+	if (!raw) return;
+	const pkg = parsePackageJson(raw);
+	if (!pkg) return;
+	const changes = [];
+	if (pkg.devDependencies) {
+		if ("husky" in pkg.devDependencies) {
+			delete pkg.devDependencies["husky"];
+			changes.push("removed devDependency: husky");
 		}
-		for (const [dir, docker] of Object.entries(overrides)) if (!seen.has(dir)) {
-			const { name, version } = readPackageInfo(executor, path.join(cwd, "packages", dir, "package.json"));
-			packages.push({
-				dir,
-				imageName: `${repoName}-${stripScope(name ?? dir)}`,
-				version,
-				docker
-			});
+		if ("lint-staged" in pkg.devDependencies) {
+			delete pkg.devDependencies["lint-staged"];
+			changes.push("removed devDependency: lint-staged");
 		}
-	} else {
-		const convention = findRootDockerfile(executor, cwd);
-		const docker = overrides["."] ?? convention;
-		if (docker) {
-			const { name, version } = readPackageInfo(executor, path.join(cwd, "package.json"));
-			packages.push({
-				dir: ".",
-				imageName: stripScope(name ?? repoName),
-				version,
-				docker
+	}
+	if (pkg.scripts?.["prepare"] && /\bhusky\b/.test(pkg.scripts["prepare"])) {
+		delete pkg.scripts["prepare"];
+		changes.push("removed husky prepare script");
+	}
+	if (changes.length === 0) return;
+	ctx.write("package.json", JSON.stringify(pkg, null, 2) + "\n");
+	results.push({
+		filePath: "package.json",
+		action: "updated",
+		description: changes.join(", ")
+	});
+}
+async function generateLefthook(ctx) {
+	const filePath = "lefthook.yml";
+	const content = buildConfig(ctx.config.formatter);
+	const results = [];
+	archiveHuskyHooks(ctx, results);
+	archiveLintStagedConfigs(ctx, results);
+	cleanPackageJson(ctx, results);
+	const existingPath = LEFTHOOK_CONFIG_PATHS.find((p) => ctx.exists(p));
+	if (existingPath) {
+		const existing = ctx.read(existingPath);
+		if (existing) {
+			const merged = mergeLefthookCommands(existing, requiredCommands(ctx.config.formatter));
+			if (merged.changed) {
+				ctx.write(existingPath, merged.content);
+				results.push({
+					filePath: existingPath,
+					action: "updated",
+					description: "Added missing pre-commit commands"
+				});
+			} else results.push({
+				filePath: existingPath,
+				action: "skipped",
+				description: "Lefthook config already up to date"
 			});
-		}
+		} else results.push({
+			filePath: existingPath,
+			action: "skipped",
+			description: "Could not read existing lefthook config"
+		});
+		return results;
 	}
-	return packages;
+	ctx.write(filePath, content);
+	results.push({
+		filePath,
+		action: "created",
+		description: "Generated lefthook pre-commit config"
+	});
+	return results;
 }
-/**
-* Read docker config for a single package, checking convention paths first,
-* then .tooling.json overrides. Used by the per-package image:build script.
-*/
-function readSinglePackageDocker(executor, cwd, packageDir, repoName) {
-	const dir = path.basename(path.resolve(cwd, packageDir));
-	const convention = findConventionDockerfile(executor, cwd, dir);
-	const docker = loadDockerMap(executor, cwd)[dir] ?? convention;
-	if (!docker) throw new FatalError(`No Dockerfile found for package "${dir}" (checked convention paths and .tooling.json)`);
-	const { name, version } = readPackageInfo(executor, path.join(cwd, "packages", dir, "package.json"));
+//#endregion
+//#region src/generators/vscode-settings.ts
+const SCHEMA_NPM_PATH = "@bensandee/config/schemas/forgejo-workflow.schema.json";
+const SCHEMA_LOCAL_PATH = ".vscode/forgejo-workflow.schema.json";
+const SETTINGS_PATH = ".vscode/settings.json";
+const SCHEMA_GLOB = ".forgejo/workflows/*.{yml,yaml}";
+const VscodeSettingsSchema = z.looseObject({ "yaml.schemas": z.record(z.string(), z.unknown()).default({}) });
+function readSchemaFromNodeModules(targetDir) {
+	const candidate = path.join(targetDir, "node_modules", SCHEMA_NPM_PATH);
+	if (!existsSync(candidate)) return void 0;
+	return readFileSync(candidate, "utf-8");
+}
+function serializeSettings(settings) {
+	return JSON.stringify(settings, null, 2) + "\n";
+}
+const YamlSchemasSchema = z.record(z.string(), z.unknown());
+/** Merge yaml.schemas into a settings object. Returns the result and whether anything changed. */
+function mergeYamlSchemas(settings) {
+	const parsed = YamlSchemasSchema.safeParse(settings["yaml.schemas"]);
+	const yamlSchemas = parsed.success ? { ...parsed.data } : {};
+	if (SCHEMA_LOCAL_PATH in yamlSchemas) return {
+		merged: settings,
+		changed: false
+	};
+	yamlSchemas[SCHEMA_LOCAL_PATH] = SCHEMA_GLOB;
 	return {
-		dir,
-		imageName: `${repoName}-${stripScope(name ?? dir)}`,
-		version,
-		docker
+		merged: {
+			...settings,
+			"yaml.schemas": yamlSchemas
+		},
+		changed: true
 	};
 }
-/** Parse semver version string into major, minor, patch components. */
-function parseSemver(version) {
-	const clean = version.replace(/^v/, "");
-	const match = /^(\d+)\.(\d+)\.(\d+)/.exec(clean);
-	if (!match?.[1] || !match[2] || !match[3]) throw new FatalError(`Invalid semver version: ${version}`);
+function writeSchemaToSettings(ctx) {
+	if (ctx.exists(SETTINGS_PATH)) {
+		const raw = ctx.read(SETTINGS_PATH);
+		if (!raw) return {
+			filePath: SETTINGS_PATH,
+			action: "skipped",
+			description: "Could not read existing settings"
+		};
+		const parsed = VscodeSettingsSchema.safeParse(parse(raw));
+		if (!parsed.success) return {
+			filePath: SETTINGS_PATH,
+			action: "skipped",
+			description: "Could not parse existing settings"
+		};
+		const { merged, changed } = mergeYamlSchemas(parsed.data);
+		if (!changed) return {
+			filePath: SETTINGS_PATH,
+			action: "skipped",
+			description: "Already has Forgejo schema mapping"
+		};
+		ctx.write(SETTINGS_PATH, serializeSettings(merged));
+		return {
+			filePath: SETTINGS_PATH,
+			action: "updated",
+			description: "Added Forgejo workflow schema mapping"
+		};
+	}
+	ctx.write(SETTINGS_PATH, serializeSettings({ "yaml.schemas": { [SCHEMA_LOCAL_PATH]: SCHEMA_GLOB } }));
 	return {
-		major: Number(match[1]),
-		minor: Number(match[2]),
-		patch: Number(match[3])
+		filePath: SETTINGS_PATH,
+		action: "created",
+		description: "Generated .vscode/settings.json with Forgejo workflow schema"
 	};
 }
-/** Generate semver tag variants: latest, vX.Y.Z, vX.Y, vX */
-function generateTags(version) {
-	const { major, minor, patch } = parseSemver(version);
-	return [
-		"latest",
-		`v${major}.${minor}.${patch}`,
-		`v${major}.${minor}`,
-		`v${major}`
-	];
-}
-/** Build the full image reference: namespace/imageName:tag */
-function imageRef(namespace, imageName, tag) {
-	return `${namespace}/${imageName}:${tag}`;
-}
-function log$1(message) {
-	console.log(message);
-}
-/** Read the repo name from root package.json. */
-function readRepoName(executor, cwd) {
-	const rootPkgRaw = executor.readFile(path.join(cwd, "package.json"));
-	if (!rootPkgRaw) throw new FatalError("No package.json found in project root");
-	const repoName = parsePackageJson(rootPkgRaw)?.name;
-	if (!repoName) throw new FatalError("Root package.json must have a name field");
-	return repoName;
-}
-/** Build a single docker image from its config. Paths are resolved relative to cwd. */
-function buildImage(executor, pkg, cwd, extraArgs) {
-	const dockerfilePath = path.resolve(cwd, pkg.docker.dockerfile);
-	const contextPath = path.resolve(cwd, pkg.docker.context);
-	const command = [
-		"docker build",
-		`-f ${dockerfilePath}`,
-		`-t ${pkg.imageName}:latest`,
-		...extraArgs,
-		contextPath
-	].join(" ");
-	executor.execInherit(command);
-}
-/**
-* Detect packages with docker config in .tooling.json and build each one.
-* Runs `docker build -f <dockerfile> -t <image-name>:latest <context>` for each package.
-* Dockerfile and context paths are resolved relative to the project root.
-*
-* When `packageDir` is set, builds only that single package (for use as an image:build script).
-*/
-function runDockerBuild(executor, config) {
-	const repoName = readRepoName(executor, config.cwd);
-	if (config.packageDir) {
-		const pkg = readSinglePackageDocker(executor, config.cwd, config.packageDir, repoName);
-		log$1(`Building image for ${pkg.dir} (${pkg.imageName}:latest)...`);
-		buildImage(executor, pkg, config.cwd, config.extraArgs);
-		log$1(`Built ${pkg.imageName}:latest`);
-		return { packages: [pkg] };
-	}
-	const packages = detectDockerPackages(executor, config.cwd, repoName);
-	if (packages.length === 0) {
-		log$1("No packages with docker config found");
-		return { packages: [] };
+async function generateVscodeSettings(ctx) {
+	const results = [];
+	if (ctx.config.ci !== "forgejo") {
+		results.push({
+			filePath: SETTINGS_PATH,
+			action: "skipped",
+			description: "Not a Forgejo project"
+		});
+		return results;
 	}
-	log$1(`Found ${packages.length} Docker package(s): ${packages.map((p) => p.dir).join(", ")}`);
-	for (const pkg of packages) {
-		log$1(`Building image for ${pkg.dir} (${pkg.imageName}:latest)...`);
-		buildImage(executor, pkg, config.cwd, config.extraArgs);
+	const schemaContent = readSchemaFromNodeModules(ctx.targetDir);
+	if (!schemaContent) {
+		results.push({
+			filePath: SCHEMA_LOCAL_PATH,
+			action: "skipped",
+			description: "Could not find @bensandee/config schema in node_modules"
+		});
+		return results;
 	}
-	log$1(`Built ${packages.length} image(s)`);
-	return { packages };
-}
-/**
-* Run the full Docker publish pipeline:
-* 1. Build all images via runDockerBuild
-* 2. Login to registry
-* 3. Tag each image with semver variants from its own package.json version
-* 4. Push all tags
-* 5. Logout from registry
-*/
-function runDockerPublish(executor, config) {
-	const { packages } = runDockerBuild(executor, {
-		cwd: config.cwd,
-		packageDir: void 0,
-		extraArgs: []
+	const existingSchema = ctx.read(SCHEMA_LOCAL_PATH);
+	if (existingSchema !== void 0 && contentEqual(SCHEMA_LOCAL_PATH, existingSchema, schemaContent)) results.push({
+		filePath: SCHEMA_LOCAL_PATH,
+		action: "skipped",
+		description: "Schema already up to date"
 	});
-	if (packages.length === 0) return {
-		packages: [],
-		tags: []
-	};
-	for (const pkg of packages) if (!pkg.version) throw new FatalError(`Package ${pkg.dir} has docker config but no version in package.json`);
-	if (!config.dryRun) {
-		log$1(`Logging in to ${config.registryHost}...`);
-		const loginResult = executor.exec(`echo "${config.password}" | docker login ${config.registryHost} -u ${config.username} --password-stdin`);
-		if (loginResult.exitCode !== 0) throw new FatalError(`Docker login failed: ${loginResult.stderr}`);
-	} else log$1("[dry-run] Skipping docker login");
-	const allTags = [];
-	try {
-		for (const pkg of packages) {
-			const tags = generateTags(pkg.version ?? "");
-			log$1(`${pkg.dir} v${pkg.version} → tags: ${tags.join(", ")}`);
-			for (const tag of tags) {
-				const ref = imageRef(config.registryNamespace, pkg.imageName, tag);
-				allTags.push(ref);
-				log$1(`Tagging ${pkg.imageName} → ${ref}`);
-				const tagResult = executor.exec(`docker tag ${pkg.imageName} ${ref}`);
-				if (tagResult.exitCode !== 0) throw new FatalError(`docker tag failed: ${tagResult.stderr}`);
-				if (!config.dryRun) {
-					log$1(`Pushing ${ref}...`);
-					const pushResult = executor.exec(`docker push ${ref}`);
-					if (pushResult.exitCode !== 0) throw new FatalError(`docker push failed: ${pushResult.stderr}`);
-				} else log$1(`[dry-run] Skipping push for ${ref}`);
-			}
-		}
-	} finally {
-		if (!config.dryRun) {
-			log$1(`Logging out from ${config.registryHost}...`);
-			executor.exec(`docker logout ${config.registryHost}`);
-		}
+	else {
+		ctx.write(SCHEMA_LOCAL_PATH, schemaContent);
+		results.push({
+			filePath: SCHEMA_LOCAL_PATH,
+			action: existingSchema ? "updated" : "created",
+			description: "Copied Forgejo workflow schema from @bensandee/config"
+		});
 	}
-	log$1(`Published ${allTags.length} image tag(s)`);
-	return {
-		packages,
-		tags: allTags
-	};
+	results.push(writeSchemaToSettings(ctx));
+	return results;
+}
+//#endregion
+//#region src/generators/pipeline.ts
+/** Run all generators sequentially and return their results. */
+async function runGenerators(ctx) {
+	const results = [];
+	results.push(await generatePackageJson(ctx));
+	results.push(await generatePnpmWorkspace(ctx));
+	results.push(...await generateTsconfig(ctx));
+	results.push(await generateTsdown(ctx));
+	results.push(await generateOxlint(ctx));
+	results.push(await generateFormatter(ctx));
+	results.push(...await generateLefthook(ctx));
+	results.push(await generateGitignore(ctx));
+	results.push(await generateKnip(ctx));
+	results.push(await generateRenovate(ctx));
+	results.push(await generateCi(ctx));
+	results.push(...await generateClaudeSettings(ctx));
+	results.push(await generateReleaseIt(ctx));
+	results.push(await generateChangesets(ctx));
+	results.push(await generateReleaseCi(ctx));
+	results.push(await generateDeployCi(ctx));
+	results.push(...await generateVitest(ctx));
+	results.push(...await generateVscodeSettings(ctx));
+	results.push(saveToolingConfig(ctx, ctx.config));
+	return results;
 }
 //#endregion
 //#region src/generators/migrate-prompt.ts
@@ -3007,7 +3034,7 @@ function generateMigratePrompt(results, config, detected) {
 	const timestamp = (/* @__PURE__ */ new Date()).toISOString();
 	sections.push("# Migration Prompt");
 	sections.push("");
-	sections.push(`_Generated by \`@bensandee/tooling@0.28.0 repo:sync\` on ${timestamp}_`);
+	sections.push(`_Generated by \`@bensandee/tooling@0.28.1 repo:sync\` on ${timestamp}_`);
 	sections.push("");
 	sections.push("The following prompt was generated by `@bensandee/tooling repo:sync`. Paste it into Claude Code or another AI assistant to finish migrating this repository.");
 	sections.push("");
@@ -4820,7 +4847,7 @@ const dockerCheckCommand = defineCommand({
 const main = defineCommand({
 	meta: {
 		name: "bst",
-		version: "0.28.0",
+		version: "0.28.1",
 		description: "Bootstrap and maintain standardized TypeScript project tooling"
 	},
 	subCommands: {
@@ -4836,7 +4863,7 @@ const main = defineCommand({
 		"docker:check": dockerCheckCommand
 	}
 });
-console.log(`@bensandee/tooling v0.28.0`);
+console.log(`@bensandee/tooling v0.28.1`);
 async function run() {
 	await runMain(main);
 	process.exit(process.exitCode ?? 0);