@bensandee/tooling 0.86.1 → 0.87.0

package/dist/bin.mjs

@@ -269,7 +269,7 @@ function loadEnvFileForBin(rawArgs, bin, io = processIo) {
 */
 const envFileLoad = loadEnvFileForBin(process.argv.slice(2), {
 	name: "bst",
-	version: "0.86.1"
+	version: "0.87.0"
 });
 //#endregion
 //#region ../cli-kit/src/logger.ts
@@ -1132,7 +1132,7 @@ const AsciiConfigSchema = z.strictObject({
 	allow: z.array(z.string()).optional().meta({ description: "Codepoints (as U+XXXX) to drop from the effective deny-list" }),
 	treatAsProse: z.array(z.string()).optional().meta({ description: "Path globs (matched the same way as exclude) whose files --fix classifies as prose wholesale regardless of extension, flattening rather than flagging. The opt-back-in for an extension with no dedicated lexical-context classifier where blind flattening is known safe. No built-in defaults." })
 });
-const LintConfigSchema = z.strictObject({ strictTypeAware: z.boolean().optional().meta({ description: "Make `bst lint:types` (the type-aware oxlint gate, backed by oxlint-tsgolint) exit non-zero on any finding while the tooling is still in its report phase (default false; the enforce phase, a later tooling release, exits non-zero unconditionally). A missing oxlint-tsgolint binary is also a hard failure rather than a notice while this is set: arming the gate is what turns a platform gap into a build break, deliberately, because the repo that armed it is the one that asked for it." }) });
+const LintConfigSchema = z.strictObject({ strictTypeAware: z.boolean().optional().meta({ description: "Make a missing oxlint-tsgolint binary a hard failure for `bst lint:types` (the type-aware oxlint gate) rather than a notice (default false): arming it is what turns a platform gap into a build break, deliberately, because the repo that armed it is the one that asked for it. Findings block in every repo regardless of this setting." }) });
 const ChecksConfigSchema = z.strictObject({
 	add: z.array(z.string()).optional().meta({ description: "Extra package.json scripts to run as first-class check steps, appended to the built-in list (e.g. ['lint:php']). An added step with no matching script is a hard failure." }),
 	skip: z.array(z.string()).optional().meta({ description: "Check steps to skip, unioned with the built-in CI defaults (never replacing them). Supports glob patterns." }),
@@ -2310,6 +2310,18 @@ const LintSweepConfigSchema = z.strictObject({
 	minWarnings: z.number().int().nonnegative().optional().meta({ description: "How many oxlint warnings the default branch must carry before the sweep opens a pull request (default 5). Below the floor the warn marker on checks:run is the whole response." }),
 	cooldownDays: z.number().int().nonnegative().optional().meta({ description: "Days after a lint-sweep pull request merged or closed before the sweep may open another (default 7): a merged sweep whose declined warnings survive must not re-file them the next morning." })
 });
+/**
+* `.tooling.json#agent.egress`: the extra egress hosts this repo's agent containers may reach.
+*
+* Only the browse lane (GET and HEAD) is repo-declarable. The passthrough allows every method,
+* so it stays agent-owned -- see the non-goals of the per-repo egress spec.
+*
+* The list is validated as a list of non-empty strings here, not against the pattern grammar:
+* that grammar lives in the agent package and the dependency edge runs agent -> tooling, never
+* back. The agent checks every pattern when it reads the key and refuses the run with the bad
+* pattern named, so `repo:sync` deliberately accepts a malformed pattern.
+*/
+const AgentEgressConfigSchema = z.strictObject({ browseHosts: z.array(z.string().min(1)).optional().meta({ description: "Host patterns this repo's agent containers may fetch from, on top of the hosts every run needs: an exact host (`fastdl.mongodb.org`) or a wildcard over its leftmost label (`*.example.com`). No ports. These join the browse lane, which serves GET and HEAD only." }) });
 const AgentConfigSchema = z.strictObject({
 	autonomy: z.boolean().optional().meta({ description: "Opt into interior autonomy (default false). When a phase's latest rationale reports readiness \"ready\" with an empty openQuestions[] and the review phase is clean, the agent applies the existing plan -> implement -> review -> park-at-mergeable advance itself instead of parking for a human. Never applies to the design/spec gate or the final merge from the mergeable terminal -- those always wait on a human. Also arms the trunk-red detector: when this repo's default branch combined status settles red, the agent files a tracking issue naming the failing checks and labels it agent/spec, starting the fix through the ordinary spec/plan/implement/review pipeline. It also closes that issue, with a comment, if the default branch recovers on its own before a human acts on it. Also arms the world-changed retrigger sweep: a pull request labelled agent-flags/autopilot that is parked at a -stuck or -failed terminal is re-queued when the fact its park recorded stops being true (the default branch went green, or moved past a conflicted base)." }),
 	preRunRebase: z.boolean().optional().meta({ description: "Merge the current default branch into the work branch before the implement (execute) phase's container starts (default true). A clean merge or an already-up-to-date branch runs the container as is; a conflicting merge is aborted, recorded on the run's status comment, and the run proceeds on the un-synced branch -- it never fails the run. Two consecutive conflicting attempts hand the unit to agent/repair before any container runs; a timeout or a failed merge never counts toward that pair. Set false to skip the attempt entirely for this repo: no fetch, no merge, no abort, and the branch is worked exactly as cloned." }),
@@ -2322,6 +2334,7 @@ const AgentConfigSchema = z.strictObject({
 		"low"
 	])).optional().meta({ description: "Map this repo's own issue-label names onto the agent's four priority levels, e.g. {\"P1\": \"critical\", \"P4\": \"low\"}. The map UNIONS with the built-in priority/<level> names rather than replacing them, and the agent does not create aliased labels -- the repo owns names the agent did not choose. Priority affects claim order only: it never changes a run's model, effort, or any budget." }),
 	triageAnalysis: z.boolean().optional().meta({ description: "Whether the agent may route its own agent-note/human-triage-needed issues through the agent/analyze stage (default: off). Unlike agent.backlog, which defaults on, this defaults off: a backlog run batches every pending finding into one container, while triage routing spends one container per issue -- arming it is the reversible direction, not disarming it." }),
+	egress: AgentEgressConfigSchema.optional().meta({ description: "Extra egress hosts this repo's agent containers may reach. `browseHosts` joins the agent's browse lane (GET and HEAD only) on top of the hosts every run needs; the passthrough lane stays agent-owned. Each entry is a host pattern -- an exact host or a *.host wildcard, never a port. Read from the repo's DEFAULT BRANCH, never off a pull request's own tree, so a run can never widen its own egress: the declaration takes effect on the first container started after a human merges it. An entry whose pattern the agent cannot parse refuses the run rather than being dropped. Changing this block holds the pull request from automerge." }),
 	findingHolds: FindingHoldsConfigSchema.optional().meta({ description: "Which of a pull request's linked open findings withhold its unattended merge. `rules` is ordered and the first `when` that matches decides; no match falls through to `default`; an absent block is { rules: [], default: true }, so every open linked finding holds by default. Read off the repo's DEFAULT BRANCH, never off the pull request's own tree -- a pull request cannot edit the rule deciding whether it is held. In a `mentions` entry a /.../flags pattern is a regular expression, a literal:<text> pattern is the substring <text> (how to name a path such as /src/utils), and anything else is a case-insensitive substring." })
 });
 /**
@@ -2345,7 +2358,8 @@ const AgentConfigSchema = z.strictObject({
 const TolerantAgentConfigSchema = z.object({
 	...AgentConfigSchema.shape,
 	lintSweep: tolerantBlock(LintSweepConfigSchema).optional(),
-	findingHolds: z.unknown().optional()
+	findingHolds: z.unknown().optional(),
+	egress: z.unknown().optional()
 });
 const BranchPruneConfigSchema = z.strictObject({
 	mergedDays: z.number().int().nonnegative().optional().meta({ description: "Days after a work branch's PR merged before bst branch:prune deletes it (default 7). Zero is valid on purpose (an explicit 'delete everything merged already'), matching the --merged-days CLI flag's contract." }),
@@ -3061,7 +3075,7 @@ function managedFileHeader(comment, lines) {
 	return lines.map((line) => line === "" ? comment : `${comment} ${line}`).join("\n") + "\n";
 }
 /**
-* Header for generated CI workflow files (`ci.yml`, `release.yml`, `publish.yml`).
+* Header for generated CI workflow files (`ci.yml`, `release.yml`).
 *
 * The literal `@bensandee/tooling:ignore` directive is kept mid-line on purpose so
 * `isToolingIgnored()` (which looks for the directive at the start of a comment) does
@@ -4077,6 +4091,77 @@ function tracedRunners(logger) {
 function fileErrorCode(error) {
 	if (error instanceof Error && "code" in error && typeof error.code === "string") return error.code;
 }
+function listWorkspacePackages(cwd) {
+	const packagesDir = path.join(cwd, "packages");
+	const packages = [];
+	try {
+		for (const entry of readdirSync(packagesDir)) {
+			const pkgPath = path.join(packagesDir, entry, "package.json");
+			try {
+				const pkg = parsePackageJson(readFileSync(pkgPath, "utf-8"));
+				if (pkg?.name && pkg.version) packages.push({
+					name: pkg.name,
+					version: pkg.version,
+					dir: entry
+				});
+			} catch (_error) {}
+		}
+	} catch (_error) {}
+	return packages;
+}
+function readRegularFile(filePath, maxBytes) {
+	let fd;
+	try {
+		fd = openSync(filePath, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+	} catch (error) {
+		const code = fileErrorCode(error);
+		if (code === "ENOENT") return { kind: "absent" };
+		if (code === "ELOOP") return {
+			kind: "refused",
+			reason: "symlink"
+		};
+		return {
+			kind: "refused",
+			reason: "unreadable"
+		};
+	}
+	try {
+		const stat = fstatSync(fd);
+		if (!stat.isFile()) return {
+			kind: "refused",
+			reason: "not-regular"
+		};
+		if (stat.size > maxBytes) return {
+			kind: "refused",
+			reason: "too-large"
+		};
+		const buffer = Buffer.alloc(maxBytes + 1);
+		let bytesRead;
+		try {
+			bytesRead = readSync(fd, buffer, 0, buffer.length, 0);
+		} catch {
+			return {
+				kind: "refused",
+				reason: "unreadable"
+			};
+		}
+		if (bytesRead > maxBytes) return {
+			kind: "refused",
+			reason: "too-large"
+		};
+		return {
+			kind: "ok",
+			content: buffer.toString("utf8", 0, bytesRead)
+		};
+	} catch {
+		return {
+			kind: "refused",
+			reason: "unreadable"
+		};
+	} finally {
+		closeSync(fd);
+	}
+}
 /**
 * Create an executor that runs real commands, fetches, and reads the filesystem. Subprocess and
 * network calls are traced through `logger` (default: the {@link rootLogger}); see
@@ -4093,24 +4178,7 @@ function createRealExecutor$1(logger = rootLogger) {
 				return [];
 			}
 		},
-		listWorkspacePackages(cwd) {
-			const packagesDir = path.join(cwd, "packages");
-			const packages = [];
-			try {
-				for (const entry of readdirSync(packagesDir)) {
-					const pkgPath = path.join(packagesDir, entry, "package.json");
-					try {
-						const pkg = parsePackageJson(readFileSync(pkgPath, "utf-8"));
-						if (pkg?.name && pkg.version) packages.push({
-							name: pkg.name,
-							version: pkg.version,
-							dir: entry
-						});
-					} catch (_error) {}
-				}
-			} catch (_error) {}
-			return packages;
-		},
+		listWorkspacePackages,
 		listPackageDirs(cwd) {
 			const packagesDir = path.join(cwd, "packages");
 			try {
@@ -4140,59 +4208,7 @@ function createRealExecutor$1(logger = rootLogger) {
 				return null;
 			}
 		},
-		readRegularFile(filePath, maxBytes) {
-			let fd;
-			try {
-				fd = openSync(filePath, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
-			} catch (error) {
-				const code = fileErrorCode(error);
-				if (code === "ENOENT") return { kind: "absent" };
-				if (code === "ELOOP") return {
-					kind: "refused",
-					reason: "symlink"
-				};
-				return {
-					kind: "refused",
-					reason: "unreadable"
-				};
-			}
-			try {
-				const stat = fstatSync(fd);
-				if (!stat.isFile()) return {
-					kind: "refused",
-					reason: "not-regular"
-				};
-				if (stat.size > maxBytes) return {
-					kind: "refused",
-					reason: "too-large"
-				};
-				const buffer = Buffer.alloc(maxBytes + 1);
-				let bytesRead;
-				try {
-					bytesRead = readSync(fd, buffer, 0, buffer.length, 0);
-				} catch {
-					return {
-						kind: "refused",
-						reason: "unreadable"
-					};
-				}
-				if (bytesRead > maxBytes) return {
-					kind: "refused",
-					reason: "too-large"
-				};
-				return {
-					kind: "ok",
-					content: buffer.toString("utf8", 0, bytesRead)
-				};
-			} catch {
-				return {
-					kind: "refused",
-					reason: "unreadable"
-				};
-			} finally {
-				closeSync(fd);
-			}
-		},
+		readRegularFile,
 		writeFile(filePath, content) {
 			mkdirSync(path.dirname(filePath), { recursive: true });
 			writeFileSync(filePath, content);
@@ -5536,6 +5552,24 @@ function readPublishedImageVersion(executor, config, ref) {
 	debug(config, `Unexpected manifest shape for ${ref}; no version label read`);
 }
 /**
+* Name every check-only image this run is about to publish or has just left out -- one line
+* per image with no explicit `publish` setting, since an explicit value either way is the
+* repo having answered the question already. Under `warn` the image still goes out and the
+* line is the notice that a later tooling release stops doing that; under `enforce` it did
+* not go out and the line says so. A dry run takes both lines verbatim: it is the run a
+* release rehearses, so a rehearsed phase has to read like the real one.
+*/
+function reportCheckOnlyImages(packages, phase) {
+	for (const pkg of packages) {
+		if (pkg.checkOnlyIn === void 0 || pkg.docker.publish !== void 0) continue;
+		if (phase === "warn") {
+			log$1.warn(`Image "${pkg.imageName}" is declared only in ${pkg.checkOnlyIn}, the check overlay, so a later tooling release stops publishing it by default. Keep it: set publish to true for "${pkg.imageName}" under .tooling.json#docker. Settle it: set publish to false there, or move the service into a base compose file.`);
+			continue;
+		}
+		log$1.info(`Skipped "${pkg.imageName}": it is declared only in ${pkg.checkOnlyIn}, the check overlay, so it was not pushed. Set publish to true for "${pkg.imageName}" under .tooling.json#docker to publish it anyway.`);
+	}
+}
+/**
 * Run the full Docker publish pipeline:
 * 1. Build all images via runDockerBuild
 * 2. Login to registry
@@ -5555,24 +5589,6 @@ function readPublishedImageVersion(executor, config, ref) {
 * overlapping runs that both read a ref before either writes can still finish in the wrong order --
 * seconds wide, where an unconditional push was open for a whole run.
 */
-/**
-* Name every check-only image this run is about to publish or has just left out -- one line
-* per image with no explicit `publish` setting, since an explicit value either way is the
-* repo having answered the question already. Under `warn` the image still goes out and the
-* line is the notice that a later tooling release stops doing that; under `enforce` it did
-* not go out and the line says so. A dry run takes both lines verbatim: it is the run a
-* release rehearses, so a rehearsed phase has to read like the real one.
-*/
-function reportCheckOnlyImages(packages, phase) {
-	for (const pkg of packages) {
-		if (pkg.checkOnlyIn === void 0 || pkg.docker.publish !== void 0) continue;
-		if (phase === "warn") {
-			log$1.warn(`Image "${pkg.imageName}" is declared only in ${pkg.checkOnlyIn}, the check overlay, so a later tooling release stops publishing it by default. Keep it: set publish to true for "${pkg.imageName}" under .tooling.json#docker. Settle it: set publish to false there, or move the service into a base compose file.`);
-			continue;
-		}
-		log$1.info(`Skipped "${pkg.imageName}": it is declared only in ${pkg.checkOnlyIn}, the check overlay, so it was not pushed. Set publish to true for "${pkg.imageName}" under .tooling.json#docker to publish it anyway.`);
-	}
-}
 function runDockerPublish(executor, config) {
 	const checkOnlyPhase = config.checkOnlyPhase ?? "warn";
 	const { packages } = runDockerBuild(executor, {
@@ -5976,433 +5992,92 @@ function buildWorkflowYaml(options) {
 	return ensureSchemaComment(WORKFLOW_MANAGED_HEADER + "\n" + readable, options.ci);
 }
 //#endregion
-//#region src/release/publish/publish-config-lint.ts
-const FIX = `add "publishConfig": { "registry": "<your registry URL>" } to its package.json`;
+//#region src/generators/publish-ci.ts
+const RegistryHostSchema = z.object({ registryHost: z.string().optional() });
 /**
-* Whether a value can serve as a publish destination: an absolute http(s) URL.
-* Presence alone is not the test -- a relative or empty registry is as silently
-* wrong as an absent one, and npm resolves neither to the place the author meant.
+* Resolve the docker-registry host at gen time so the workflow generator can
+* pick registry-specific secret names. Honors `.tooling.json#registryHost`
+* first, then git remote `origin` (the operational host, not a mirror-pointed
+* package.json), then derives from `package.json#repository` using the same
+* parser as the runtime (`parseGitUrl` handles https, git+https, and ssh shapes).
+* Returns null if neither source yields a host -- in that case the generator
+* falls back to neutral `REGISTRY_USERNAME` / `REGISTRY_PASSWORD` secrets and
+* lets the runtime resolve the host from `DOCKER_REGISTRY_HOST` (still emitted
+* into the step).
 */
-function isUsableRegistry(value) {
-	if (typeof value !== "string" || value.trim() === "") return false;
-	try {
-		const url = new URL(value);
-		return url.protocol === "https:" || url.protocol === "http:";
-	} catch {
-		return false;
+function resolveGenTimeHost(ctx) {
+	const toolingRaw = ctx.read(".tooling.json");
+	if (toolingRaw) try {
+		const parsed = RegistryHostSchema.safeParse(JSON.parse(toolingRaw));
+		if (parsed.success && parsed.data.registryHost && parsed.data.registryHost.length > 0) return parsed.data.registryHost;
+	} catch (error) {
+		log$1.warn(`Failed to parse .tooling.json: ${error instanceof Error ? error.message : error}`);
 	}
+	const originUrl = detectGitRemoteUrl(ctx.targetDir);
+	if (originUrl !== null) {
+		const parsedOrigin = parseGitUrl(originUrl);
+		if (parsedOrigin) return registryHostFromHostname(parsedOrigin.hostname);
+	}
+	const raw = ctx.read("package.json");
+	if (!raw) return null;
+	const repo = parsePackageJson(raw)?.repository;
+	let urlStr = null;
+	if (typeof repo === "string") urlStr = repo;
+	else if (repo && typeof repo === "object") urlStr = repo.url;
+	if (typeof urlStr !== "string") return null;
+	const parsed = parseGitUrl(urlStr);
+	if (!parsed) return null;
+	return registryHostFromHostname(parsed.hostname);
 }
-function isRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
+const PostReleaseHookSchema = z.object({
+	postReleaseHook: z.string().optional(),
+	postReleaseHookSecrets: z.array(z.string()).optional()
+});
+const ReleaseAssetsSchema = z.object({ releaseAssets: z.array(ReleaseAssetSchema).optional() });
+const VersionStampConfigSchema = z.object({ versionStamp: z.array(VersionStampSchema).optional() });
+const DeploySchema = z.object({ deploy: DeployConfigSchema.optional() });
 /**
-* Require every package this repo would publish to declare where it publishes.
-*
-* npm and pnpm use one `registry` key for reads and writes alike, so a project
-* `.npmrc` aimed at an install cache silently repoints `pnpm publish` too. A
-* package that never declares its destination inherits one, and an inherited
-* destination can be changed by a file that never mentions publishing.
+* Read the `deploy` block from .tooling.json, if configured.
 *
-* Reports rather than repairs: the correct registry is not derivable here, and
-* writing a guess would redirect a working release exactly the way this gate
-* exists to prevent.
+* The full file is already validated against ToolingConfigSchema at sync time,
+* so an invalid `deploy` block fails earlier -- undefined here means "not set".
 */
-function lintPublishConfig(targetDir, structure) {
-	const issues = [];
-	for (const pkg of getPublishablePackages(targetDir, structure)) {
-		const manifest = readPackageJson(pkg.dir);
-		if (!manifest) continue;
-		const file = path.relative(targetDir, path.join(pkg.dir, "package.json"));
-		const pc = manifest.publishConfig;
-		const registry = isRecord(pc) ? pc["registry"] : void 0;
-		if (registry === void 0) {
-			issues.push({
-				kind: "missing",
-				package: pkg.name,
-				file,
-				message: `${pkg.name} is published from this repo but declares no publishConfig.registry, so its release destination is inherited -- a project .npmrc can repoint it silently. In ${file}, ${FIX}.`
-			});
-			continue;
-		}
-		if (!isUsableRegistry(registry)) issues.push({
-			kind: "malformed",
-			package: pkg.name,
-			file,
-			message: `${pkg.name} declares publishConfig.registry as ${JSON.stringify(registry)}, which is not an absolute http(s) URL and cannot be published to. In ${file}, ${FIX}.`
-		});
+function getDeployConfig(ctx) {
+	const raw = ctx.read(".tooling.json");
+	if (!raw) return void 0;
+	try {
+		const result = DeploySchema.safeParse(JSON.parse(raw));
+		if (!result.success) return void 0;
+		return result.data.deploy;
+	} catch (error) {
+		log$1.warn(`Failed to parse .tooling.json: ${error instanceof Error ? error.message : error}`);
+		return;
 	}
-	return issues;
 }
-/**
-* The registries this repo's publishable packages actually declare, distinct and in
-* first-seen order.
-*
-* Reuses the same "absolute http(s) URL" narrowing as {@link lintPublishConfig} rather
-* than re-deriving it -- a registry this misses here would fail that gate first, so
-* `repo:sync` never reaches a generator with an undeclared or malformed registry. A
-* caller that invokes a generator directly (or a repo whose publishable set is empty,
-* e.g. every package private) still gets a safe empty result.
-*/
-function declaredPublishRegistries(targetDir, structure, rootPackageJson) {
-	const registries = [];
-	for (const pkg of getPublishablePackages(targetDir, structure, rootPackageJson)) {
-		const manifest = structure === "single" ? rootPackageJson ?? readPackageJson(pkg.dir) : readPackageJson(pkg.dir);
-		if (!manifest) continue;
-		const pc = manifest.publishConfig;
-		const registry = isRecord(pc) ? pc["registry"] : void 0;
-		if (typeof registry === "string" && isUsableRegistry(registry) && !registries.includes(registry)) registries.push(registry);
-	}
-	return registries;
-}
-//#endregion
-//#region src/generators/mise-pin.ts
-/**
-* The mise version and release-asset digest the fleet's CI and the agent runner base image agree
-* to run. This is the one place that agreement is recorded; `packages/agent/test/runner-base-image-dockerfile.test.ts`
-* (task 8 of the mise-toolchain-provisioning plan) reads both constants back through
-* `readRepoFile` and asserts the base image's own `ARG MISE_VERSION` and `mise.sha256` manifest
-* agree with them, so the two packages cannot drift without a failing test on either side.
-*
-* Each constant sits under its own `// renovate:` marker comment, in the three-line grammar
-* `packages/agent/docker/agent-goose-image/goose.sha256` uses for its own digest line, so the same
-* shape of custom regex manager in the root `renovate.json` can rewrite both this version and this
-* digest (`customManagers` entries scoped to this file).
-*/
-const MISE_VERSION = "2026.10.2";
-const MISE_LINUX_X64_SHA256 = "8f5f6660336f572830e33cd9b378d3131e529a0d4c4f0c553776be90a1ba302a";
-/** Where generated Forgejo workflows fetch the shared mise setup action: a composite action in
-* `bensandee/common`, on the forge every fleet repo lives on. GitHub cannot reach it; the
-* generators keep inline steps there. */
-const SETUP_MISE_ACTION_URL = "https://code.orangebikelabs.com/bensandee/common/actions/setup-mise";
-/** The tag in `bensandee/common` that marks the current release of the action. Generated `uses:`
-* lines carry it as their comment, and Renovate moves the SHA below to wherever it points. */
-const SETUP_MISE_ACTION_TAG = "setup-mise@latest";
-const SETUP_MISE_ACTION_SHA = "13f60e0f19ad57b5616f94c9bc18bf214bbe91fe";
-//#endregion
-//#region src/generators/ci-utils.ts
-/** Build a GitHub Actions expression like `${{ expr }}` without triggering no-template-curly-in-string. */
-function actionsExpr(expr) {
-	return `\${{ ${expr} }}`;
-}
-const MAIN_BRANCH_REF = "refs/heads/main";
-/** `if:` condition that gates a step to push events on the default branch. */
-const IS_MAIN_BRANCH = `github.ref == '${MAIN_BRANCH_REF}'`;
-/**
-* Negated form for concurrency `cancel-in-progress` and similar uses.
-*
-* Main is exempt from cancellation on purpose, and the exemption stays: a main run publishes and
-* pushes tags, and cancelling one mid-flight can leave a partial publish -- some packages on the
-* registry, no matching tags, and no run left alive to finish. A superseded feature-branch run
-* wastes minutes; a half-published release costs a manual unwind.
-*
-* So several main runs can be in flight at once, each versioning from its own triggering commit.
-* Overlap safety rests on one invariant: **main advances solely via commits that trigger a CI
-* run.** The `[skip ci]` coverage, health, and egress records go to `bst/*` orphan branches and
-* never to main; a `[skip ci]` commit pushed straight to main would leave a superseded run skipping
-* and its changesets stranded until the next push, which is why the supersession guard skips rather
-* than fails. Three guards carry the overlap itself: supersession plus a `--force-with-lease`
-* version push (`release/publish/version.ts`), the `headBumpedVersion` publish guard plus reading
-* remote tags and releases before acting (`commands/release-changesets.ts`,
-* `release/publish/publish.ts`), and floating git and Docker tags that only move forward
-* (`release/publish/floating-tags.ts`, `release/docker.ts`). Such a run may also version pending
-* changesets after it publishes -- the stale version-PR merge -- under the same supersession guard
-* and push lease as any other version run. A later commit publishes a bump only when its tag is
-* missing and every main run since the package's last release tag has settled
-* (`release/publish/unpublished-bump.ts`), so no run that could still publish it is in flight; a
-* manual re-run of one of those runs is the overlap left. On Forgejo the concurrency block is
-* only a PR-run cancellation mechanism -- it holds a main run in its group and, in Forgejo 16,
-* intermittently fails to release it, which is why main runs get a group of their own there. GitHub's shape stays shared
-* because its queue works: one run, one pending, a newer arrival replacing the pending, so
-* `changesets/action@v1` never needs a guard of its own. Any new side effect in a main run must be
-* idempotent under overlap or be listed here with the guard that makes it so.
-*/
-const IS_NOT_MAIN_BRANCH = `github.ref != '${MAIN_BRANCH_REF}'`;
-/**
-* Job-level `env:` block that evaluates the default-branch check once, so steps
-* can gate on `env.IS_MAIN` instead of repeating the `github.ref` expression.
-*/
-const IS_MAIN_JOB_ENV = { IS_MAIN: actionsExpr(IS_MAIN_BRANCH) };
-/** `if:` condition referencing the job-level `IS_MAIN` env var (see {@link IS_MAIN_JOB_ENV}). */
-const IS_MAIN_ENV_GUARD = "env.IS_MAIN == 'true'";
-/**
-* Job-level default for the npm auth token, declared as the empty string.
-*
-* This repo's own `Configure npm auth` step (see {@link npmAuthWiring}) appends
-* `//<registry>/:_authToken=${NODE_AUTH_TOKEN}` lines to `~/.npmrc` for each
-* declared `publishConfig.registry`. Only the publishing step defines that
-* variable, so every earlier pnpm invocation -- install, and each nested pnpm
-* inside `ci:check` -- hits an undefined var and prints
-* `[WARN] Failed to replace env in config: ${NODE_AUTH_TOKEN}`. Declaring it
-* empty at job level makes the interpolation succeed and the warning vanish; an
-* empty token is not sent as credentials, so anonymous registry reads are
-* unaffected.
-*
-* Deliberately empty rather than the real secret: the publishing step overrides
-* it with `secrets.NPM_TOKEN` via step-level `env`, which keeps the token out of
-* `pnpm install` (and any dependency's postinstall script) the way it is today.
-* The empty default also has to survive steps *after* the publish step
-* (`release:assets`, `docker:publish`, deploy dispatch): those shell out to pnpm
-* again without the secret in scope, so without this default they would warn too.
-*
-* Emit this in lockstep with the `Configure npm auth` step -- both come from the
-* same {@link npmAuthWiring} call, so a job that gets one gets the other.
-*/
-const NPM_AUTH_JOB_ENV = { NODE_AUTH_TOKEN: "" };
-/**
-* npm's own registry-key rule for an `.npmrc` auth line: strip the scheme, keep
-* host/port/path, and end with exactly one slash. `actions/setup-node` derives the
-* same key from a registry URL; this mirrors that so a hand-written line matches
-* what npm looks up at publish time -- npm-registry-fetch walks the request path
-* upward through ancestor keys until one matches.
-*/
-function npmrcAuthKey(registryUrl) {
-	return `${registryUrl.replace(/^https?:/i, "").replace(/\/+$/, "")}/`;
-}
-const NODE_AUTH_TOKEN_VAR = ["$", "{NODE_AUTH_TOKEN}"].join("");
-/**
-* Build every half of a job's npm auth wiring together, so one value decides all
-* three: the `Configure npm auth` step, the job-level `NODE_AUTH_TOKEN` default,
-* and the step-level `NODE_AUTH_TOKEN` the publish step should carry. A job that
-* gets none of the declared registries gets none of the three -- including a
-* `publishes: true` job whose publishable set is empty (every package private),
-* since there is then no npmrc line for a real secret to pair with.
-*/
-function npmAuthWiring(ctx, publishes) {
-	const registries = publishes ? declaredPublishRegistries(ctx.targetDir, ctx.config.structure, ctx.packageJson) : [];
-	if (registries.length === 0) return {
-		steps: [],
-		jobEnv: {},
-		tokenEnv: {}
-	};
-	return {
-		steps: [{ step: {
-			name: "Configure npm auth",
-			run: registries.map((registry) => `printf '\\n%s\\n' '${npmrcAuthKey(registry)}:_authToken=${NODE_AUTH_TOKEN_VAR}' >> ~/.npmrc`).join("\n")
-		} }],
-		jobEnv: NPM_AUTH_JOB_ENV,
-		tokenEnv: { NODE_AUTH_TOKEN: actionsExpr("secrets.NPM_TOKEN") }
-	};
-}
-const MISE_RELEASE_URL = `https://github.com/jdx/mise/releases/download/v${MISE_VERSION}/mise-v${MISE_VERSION}-linux-x64`;
-/**
-* The node script `inlineMiseSteps` pipes `mise env --json` into, run under the mise it just
-* installed. Reads the env map off stdin (mise exec passes it straight through) and exports every
-* key except `PATH` into `$GITHUB_ENV` in heredoc form -- the form that survives any value,
-* including one containing `$` or quotes -- then appends mise's shim directory and the
-* `~/.local/bin` install location to `$GITHUB_PATH` so every later step sees node, pnpm, and any
-* other declared tool on PATH with no prefix.
-*/
-const MISE_ENV_EXPORT_SCRIPT = [
-	"const fs = require(\"fs\");",
-	"const env = JSON.parse(fs.readFileSync(0, \"utf8\"));",
-	"let out = \"\";",
-	"for (const [key, value] of Object.entries(env)) {",
-	"  if (key === \"PATH\") continue;",
-	"  out += key + \"<<BST_MISE_ENV_EOF\\n\" + value + \"\\nBST_MISE_ENV_EOF\\n\";",
-	"}",
-	"fs.appendFileSync(process.env.GITHUB_ENV, out);",
-	"fs.appendFileSync(",
-	"  process.env.GITHUB_PATH,",
-	"  process.env.HOME + \"/.local/share/mise/shims\\n\" + process.env.HOME + \"/.local/bin\\n\",",
-	");"
-].join("\n");
-/** A fresh object per call: one shared object in two jobs would serialize as a YAML alias. */
-function pnpmStoreCacheStep() {
-	return { step: {
-		name: "Cache pnpm store",
-		uses: "actions/cache@v4",
-		with: {
-			path: "~/.local/share/pnpm/store",
-			key: `pnpm-${actionsExpr("runner.os")}-${actionsExpr("hashFiles('pnpm-lock.yaml')")}`
-		}
-	} };
-}
-/** Actions whose ref the generator pins itself, so `preservePinnedActions` must not keep a
-* repo's older ref for them. */
-const GENERATOR_OWNED_ACTIONS = [{
-	name: SETUP_MISE_ACTION_URL,
-	comment: SETUP_MISE_ACTION_TAG
-}];
-/**
-* The steps every workflow generator uses in place of `pnpm/action-setup` + `actions/setup-node`:
-* install the pinned `mise`, `mise install` the repo's `mise.toml` toolchain, export its env into
-* the rest of the job, and cache the pnpm store. `MISE_VERSION`/`MISE_LINUX_X64_SHA256`
-* (`mise-pin.ts`) are the same pin the agent runner's base image installs, checked by
-* `runner-base-image-dockerfile.test.ts`.
-*
-* On Forgejo the mise half is the shared composite action in `bensandee/common`, pinned by commit.
-* GitHub resolves actions only from github.com, so it keeps the same steps inline.
-*/
-function miseSetupSteps(ci) {
-	if (ci !== "forgejo") return inlineMiseSteps();
-	return [{ step: {
-		name: "Set up mise",
-		uses: `${SETUP_MISE_ACTION_URL}@${SETUP_MISE_ACTION_SHA}`,
-		with: {
-			version: MISE_VERSION,
-			sha256: MISE_LINUX_X64_SHA256
-		}
-	} }, pnpmStoreCacheStep()];
-}
-/**
-* The inline form of the shared action, for GitHub. Uses `mise env --json` piped into the
-* just-installed mise's own `node -e`, not `mise env --shell bash`: the JSON form is
-* shell-independent and the interpreter reading it is guaranteed to exist (mise just installed
-* it), so this needs no assumption about which shell the runner's `run:` steps use.
-*/
-function inlineMiseSteps() {
-	const installScript = [
-		"curl -fsSL -o \"$RUNNER_TEMP/mise\" " + MISE_RELEASE_URL,
-		`echo "${MISE_LINUX_X64_SHA256}  $RUNNER_TEMP/mise" | sha256sum -c`,
-		"mkdir -p \"$HOME/.local/bin\" && install -m 0755 \"$RUNNER_TEMP/mise\" \"$HOME/.local/bin/mise\"",
-		"export MISE_TRUSTED_CONFIG_PATHS=\"$GITHUB_WORKSPACE\"",
-		"export MISE_YES=1",
-		"\"$HOME/.local/bin/mise\" install",
-		`"$HOME/.local/bin/mise" env --json | "$HOME/.local/bin/mise" exec -- node -e '${MISE_ENV_EXPORT_SCRIPT}'`
-	].join("\n");
-	return [
-		{ step: {
-			name: "Cache mise tools",
-			uses: "actions/cache@v4",
-			with: {
-				path: "~/.local/share/mise",
-				key: `mise-${actionsExpr("runner.os")}-${actionsExpr("hashFiles('mise.toml')")}`
-			}
-		} },
-		pnpmStoreCacheStep(),
-		{ step: {
-			name: "Install mise",
-			env: { GITHUB_TOKEN: "" },
-			run: installScript
-		} }
-	];
-}
-/**
-* Build the docker publish env block.
-*
-* The LHS env-var names (`DOCKER_USERNAME` / `DOCKER_PASSWORD`) match what
-* publish-docker.ts reads at runtime. The RHS secret references are
-* registry-specific (see {@link dockerSecretNames}) so downstream repos can
-* stop relying on the user/org-level `DOCKER_USERNAME` / `DOCKER_PASSWORD`
-* secrets -- which the Forgejo act fork auto-injects into every `container:`
-* image pull regardless of the target registry.
-*
-* When `host` is `null` (couldn't be derived at gen time), the secret references
-* fall back to neutral `REGISTRY_USERNAME` / `REGISTRY_PASSWORD` and the
-* workflow keeps `DOCKER_REGISTRY_HOST` / `DOCKER_REGISTRY_NAMESPACE` so the CLI
-* resolves the registry at runtime.
-*/
-function dockerPublishEnv(host) {
-	const { username, password } = dockerSecretNames(host);
-	return {
-		...host === null ? {
-			DOCKER_REGISTRY_HOST: actionsExpr("vars.DOCKER_REGISTRY_HOST"),
-			DOCKER_REGISTRY_NAMESPACE: actionsExpr("vars.DOCKER_REGISTRY_NAMESPACE")
-		} : {},
-		DOCKER_USERNAME: actionsExpr(`secrets.${username}`),
-		DOCKER_PASSWORD: actionsExpr(`secrets.${password}`),
-		RELEASE_DEBUG: actionsExpr("vars.RELEASE_DEBUG || 'false'")
-	};
-}
-//#endregion
-//#region src/generators/publish-ci.ts
-const RegistryHostSchema = z.object({ registryHost: z.string().optional() });
-/**
-* Resolve the docker-registry host at gen time so the workflow generator can
-* pick registry-specific secret names. Honors `.tooling.json#registryHost`
-* first, then git remote `origin` (the operational host, not a mirror-pointed
-* package.json), then derives from `package.json#repository` using the same
-* parser as the runtime (`parseGitUrl` handles https, git+https, and ssh shapes).
-* Returns null if neither source yields a host -- in that case the generator
-* falls back to neutral `REGISTRY_USERNAME` / `REGISTRY_PASSWORD` secrets and
-* lets the runtime resolve the host from `DOCKER_REGISTRY_HOST` (still emitted
-* into the step).
-*/
-function resolveGenTimeHost(ctx) {
-	const toolingRaw = ctx.read(".tooling.json");
-	if (toolingRaw) try {
-		const parsed = RegistryHostSchema.safeParse(JSON.parse(toolingRaw));
-		if (parsed.success && parsed.data.registryHost && parsed.data.registryHost.length > 0) return parsed.data.registryHost;
-	} catch (error) {
-		log$1.warn(`Failed to parse .tooling.json: ${error instanceof Error ? error.message : error}`);
-	}
-	const originUrl = detectGitRemoteUrl(ctx.targetDir);
-	if (originUrl !== null) {
-		const parsedOrigin = parseGitUrl(originUrl);
-		if (parsedOrigin) return registryHostFromHostname(parsedOrigin.hostname);
-	}
-	const raw = ctx.read("package.json");
-	if (!raw) return null;
-	const repo = parsePackageJson(raw)?.repository;
-	let urlStr = null;
-	if (typeof repo === "string") urlStr = repo;
-	else if (repo && typeof repo === "object") urlStr = repo.url;
-	if (typeof urlStr !== "string") return null;
-	const parsed = parseGitUrl(urlStr);
-	if (!parsed) return null;
-	return registryHostFromHostname(parsed.hostname);
-}
-function publishSteps(ci, host) {
-	return [
-		{ step: { uses: "actions/checkout@v6" } },
-		...miseSetupSteps(ci),
-		{ step: { run: "pnpm install --frozen-lockfile" } },
-		{ step: {
-			name: "Publish Docker images",
-			env: dockerPublishEnv(host),
-			run: "pnpm exec bst docker:publish"
-		} }
-	];
-}
-const PostReleaseHookSchema = z.object({
-	postReleaseHook: z.string().optional(),
-	postReleaseHookSecrets: z.array(z.string()).optional()
-});
-const ReleaseAssetsSchema = z.object({ releaseAssets: z.array(ReleaseAssetSchema).optional() });
-const VersionStampConfigSchema = z.object({ versionStamp: z.array(VersionStampSchema).optional() });
-const DeploySchema = z.object({ deploy: DeployConfigSchema.optional() });
-/**
-* Read the `deploy` block from .tooling.json, if configured.
-*
-* The full file is already validated against ToolingConfigSchema at sync time,
-* so an invalid `deploy` block fails earlier -- undefined here means "not set".
-*/
-function getDeployConfig(ctx) {
-	const raw = ctx.read(".tooling.json");
-	if (!raw) return void 0;
-	try {
-		const result = DeploySchema.safeParse(JSON.parse(raw));
-		if (!result.success) return void 0;
-		return result.data.deploy;
-	} catch (error) {
-		log$1.warn(`Failed to parse .tooling.json: ${error instanceof Error ? error.message : error}`);
-		return;
-	}
-}
-/** Read the postReleaseHook command override from .tooling.json, if configured. */
-function getPostReleaseHookCommand(ctx) {
-	const raw = ctx.read(".tooling.json");
-	if (!raw) return void 0;
-	try {
-		const result = PostReleaseHookSchema.safeParse(JSON.parse(raw));
-		if (!result.success) return void 0;
-		return result.data.postReleaseHook;
-	} catch (error) {
-		log$1.warn(`Failed to parse .tooling.json: ${error instanceof Error ? error.message : error}`);
-		return;
-	}
-}
-/** Read the postReleaseHookSecrets array from .tooling.json, if configured. */
-function getPostReleaseHookSecrets(ctx) {
-	const raw = ctx.read(".tooling.json");
-	if (!raw) return void 0;
-	try {
-		const result = PostReleaseHookSchema.safeParse(JSON.parse(raw));
-		if (!result.success) return void 0;
-		return result.data.postReleaseHookSecrets;
-	} catch (error) {
-		log$1.warn(`Failed to parse .tooling.json: ${error instanceof Error ? error.message : error}`);
-		return;
+/** Read the postReleaseHook command override from .tooling.json, if configured. */
+function getPostReleaseHookCommand(ctx) {
+	const raw = ctx.read(".tooling.json");
+	if (!raw) return void 0;
+	try {
+		const result = PostReleaseHookSchema.safeParse(JSON.parse(raw));
+		if (!result.success) return void 0;
+		return result.data.postReleaseHook;
+	} catch (error) {
+		log$1.warn(`Failed to parse .tooling.json: ${error instanceof Error ? error.message : error}`);
+		return;
+	}
+}
+/** Read the postReleaseHookSecrets array from .tooling.json, if configured. */
+function getPostReleaseHookSecrets(ctx) {
+	const raw = ctx.read(".tooling.json");
+	if (!raw) return void 0;
+	try {
+		const result = PostReleaseHookSchema.safeParse(JSON.parse(raw));
+		if (!result.success) return void 0;
+		return result.data.postReleaseHookSecrets;
+	} catch (error) {
+		log$1.warn(`Failed to parse .tooling.json: ${error instanceof Error ? error.message : error}`);
+		return;
 	}
 }
 /**
@@ -6474,61 +6149,37 @@ function hasVersionStamp(ctx) {
 }
 /** Where `ctx.remove()` puts what it archives. Named here only to describe it to the user. */
 const ARCHIVE_DIR$2 = ".tooling-archived";
+/**
+* Archive the manual `publish.yml` this generator used to write; it writes nothing. Docker
+* images publish from the release workflow, and the manual workflow was a thin wrapper around
+* `bst docker:publish` that nobody ran -- run that command instead. Only a file carrying the
+* managed header is removed: a hand-written `publish.yml`, or one opted out with the ignore
+* comment, belongs to the repo.
+*/
 async function generateDeployCi(ctx) {
 	const filePath = "deploy-ci";
-	if (!ctx.config.publishDocker || ctx.config.ci === "none") return {
+	if (ctx.config.ci === "none") return {
 		filePath,
 		action: "skipped",
-		description: "Deploy CI workflow not applicable"
+		description: "Publish workflow not applicable"
 	};
-	const isGitHub = ctx.config.ci === "github";
-	const workflowPath = isGitHub ? ".github/workflows/publish.yml" : ".forgejo/workflows/publish.yml";
-	if (ctx.config.releaseStrategy === "simple") {
-		if (ctx.read(workflowPath) !== void 0) {
-			ctx.remove(workflowPath);
-			return {
-				filePath: workflowPath,
-				action: "archived",
-				description: `Moved to ${ARCHIVE_DIR$2}/${workflowPath} (docker publish runs in release.yml for simple strategy)`
-			};
-		}
-		return {
-			filePath,
-			action: "skipped",
-			description: "Publish workflow not generated for simple release strategy"
-		};
-	}
-	const host = resolveGenTimeHost(ctx);
-	const steps = publishSteps(ctx.config.ci, host);
-	const content = buildWorkflowYaml({
-		ci: ctx.config.ci,
-		name: "Publish",
-		on: { workflow_dispatch: null },
-		jobName: "publish",
-		steps
-	});
-	const alreadyExists = ctx.exists(workflowPath);
-	const existing = alreadyExists ? ctx.read(workflowPath) : void 0;
-	const withDevPath = applyWorkspaceToolingBuild(content, ctx.packageJson);
-	if (existing) {
-		if (isToolingIgnored(existing)) return {
-			filePath: workflowPath,
-			action: "skipped",
-			description: "Publish workflow has ignore comment"
-		};
-		if (existing.includes("Managed by @bensandee/tooling --") && normalizeWorkflow(existing) === normalizeWorkflow(withDevPath)) return {
-			filePath: workflowPath,
-			action: "skipped",
-			description: "Publish workflow already up to date"
-		};
-	}
-	const withPinnedActions = preservePinnedActions(withDevPath, existing, GENERATOR_OWNED_ACTIONS);
-	const final = existing ? insertCustomBlocks(withPinnedActions, extractCustomBlocks(existing)) : withPinnedActions;
-	ctx.write(workflowPath, final);
+	const workflowPath = ctx.config.ci === "github" ? ".github/workflows/publish.yml" : ".forgejo/workflows/publish.yml";
+	const existing = ctx.read(workflowPath);
+	if (existing === void 0) return {
+		filePath,
+		action: "skipped",
+		description: "No publish workflow to retire"
+	};
+	if (isToolingIgnored(existing) || !existing.includes("Managed by @bensandee/tooling --")) return {
+		filePath: workflowPath,
+		action: "skipped",
+		description: "Publish workflow is not managed by tooling"
+	};
+	ctx.remove(workflowPath);
 	return {
 		filePath: workflowPath,
-		action: alreadyExists ? "updated" : "created",
-		description: `Generated ${isGitHub ? "GitHub" : "Forgejo"} Actions publish workflow`
+		action: "removed",
+		description: `Moved to ${ARCHIVE_DIR$2}/${workflowPath} (run \`bst docker:publish\` to publish by hand)`
 	};
 }
 //#endregion
@@ -6923,7 +6574,7 @@ function perPackageDevDeps(config) {
 		deps["typescript"] = {
 			"@changesets/cli": "3.0.3",
 			"@release-it/bumper": "8.0.1",
-			"@types/node": "24.13.5",
+			"@types/node": "24.19.1",
 			"@vitest/coverage-v8": "5.0.3",
 			"commit-and-tag-version": "13.2.1",
 			"knip": "6.39.0",
@@ -6937,12 +6588,12 @@ function perPackageDevDeps(config) {
 			"tsdown": "0.23.0",
 			"typescript": "6.0.3",
 			"vitest": "5.0.3",
-			"pnpm": "11.27.1"
+			"pnpm": "11.28.3"
 		}["typescript"];
 		deps["@types/node"] = {
 			"@changesets/cli": "3.0.3",
 			"@release-it/bumper": "8.0.1",
-			"@types/node": "24.13.5",
+			"@types/node": "24.19.1",
 			"@vitest/coverage-v8": "5.0.3",
 			"commit-and-tag-version": "13.2.1",
 			"knip": "6.39.0",
@@ -6956,13 +6607,13 @@ function perPackageDevDeps(config) {
 			"tsdown": "0.23.0",
 			"typescript": "6.0.3",
 			"vitest": "5.0.3",
-			"pnpm": "11.27.1"
+			"pnpm": "11.28.3"
 		}["@types/node"];
 	}
 	if (config.builder === "tsdown") deps["tsdown"] = {
 		"@changesets/cli": "3.0.3",
 		"@release-it/bumper": "8.0.1",
-		"@types/node": "24.13.5",
+		"@types/node": "24.19.1",
 		"@vitest/coverage-v8": "5.0.3",
 		"commit-and-tag-version": "13.2.1",
 		"knip": "6.39.0",
@@ -6976,7 +6627,7 @@ function perPackageDevDeps(config) {
 		"tsdown": "0.23.0",
 		"typescript": "6.0.3",
 		"vitest": "5.0.3",
-		"pnpm": "11.27.1"
+		"pnpm": "11.28.3"
 	}["tsdown"];
 	return deps;
 }
@@ -6993,7 +6644,7 @@ function vitestDevDeps() {
 		vitest: {
 			"@changesets/cli": "3.0.3",
 			"@release-it/bumper": "8.0.1",
-			"@types/node": "24.13.5",
+			"@types/node": "24.19.1",
 			"@vitest/coverage-v8": "5.0.3",
 			"commit-and-tag-version": "13.2.1",
 			"knip": "6.39.0",
@@ -7007,12 +6658,12 @@ function vitestDevDeps() {
 			"tsdown": "0.23.0",
 			"typescript": "6.0.3",
 			"vitest": "5.0.3",
-			"pnpm": "11.27.1"
+			"pnpm": "11.28.3"
 		}["vitest"],
 		"@vitest/coverage-v8": {
 			"@changesets/cli": "3.0.3",
 			"@release-it/bumper": "8.0.1",
-			"@types/node": "24.13.5",
+			"@types/node": "24.19.1",
 			"@vitest/coverage-v8": "5.0.3",
 			"commit-and-tag-version": "13.2.1",
 			"knip": "6.39.0",
@@ -7026,7 +6677,7 @@ function vitestDevDeps() {
 			"tsdown": "0.23.0",
 			"typescript": "6.0.3",
 			"vitest": "5.0.3",
-			"pnpm": "11.27.1"
+			"pnpm": "11.28.3"
 		}["@vitest/coverage-v8"]
 	};
 }
@@ -7040,7 +6691,7 @@ function rootDevDeps(config) {
 	const deps = { lefthook: {
 		"@changesets/cli": "3.0.3",
 		"@release-it/bumper": "8.0.1",
-		"@types/node": "24.13.5",
+		"@types/node": "24.19.1",
 		"@vitest/coverage-v8": "5.0.3",
 		"commit-and-tag-version": "13.2.1",
 		"knip": "6.39.0",
@@ -7054,13 +6705,13 @@ function rootDevDeps(config) {
 		"tsdown": "0.23.0",
 		"typescript": "6.0.3",
 		"vitest": "5.0.3",
-		"pnpm": "11.27.1"
+		"pnpm": "11.28.3"
 	}["lefthook"] };
 	if (config.stack !== "none") {
 		deps["knip"] = {
 			"@changesets/cli": "3.0.3",
 			"@release-it/bumper": "8.0.1",
-			"@types/node": "24.13.5",
+			"@types/node": "24.19.1",
 			"@vitest/coverage-v8": "5.0.3",
 			"commit-and-tag-version": "13.2.1",
 			"knip": "6.39.0",
@@ -7074,12 +6725,12 @@ function rootDevDeps(config) {
 			"tsdown": "0.23.0",
 			"typescript": "6.0.3",
 			"vitest": "5.0.3",
-			"pnpm": "11.27.1"
+			"pnpm": "11.28.3"
 		}["knip"];
 		deps["oxlint"] = {
 			"@changesets/cli": "3.0.3",
 			"@release-it/bumper": "8.0.1",
-			"@types/node": "24.13.5",
+			"@types/node": "24.19.1",
 			"@vitest/coverage-v8": "5.0.3",
 			"commit-and-tag-version": "13.2.1",
 			"knip": "6.39.0",
@@ -7093,14 +6744,14 @@ function rootDevDeps(config) {
 			"tsdown": "0.23.0",
 			"typescript": "6.0.3",
 			"vitest": "5.0.3",
-			"pnpm": "11.27.1"
+			"pnpm": "11.28.3"
 		}["oxlint"];
 		Object.assign(deps, vitestDevDeps());
 	}
 	if (config.stack === "typescript") deps["oxlint-tsgolint"] = {
 		"@changesets/cli": "3.0.3",
 		"@release-it/bumper": "8.0.1",
-		"@types/node": "24.13.5",
+		"@types/node": "24.19.1",
 		"@vitest/coverage-v8": "5.0.3",
 		"commit-and-tag-version": "13.2.1",
 		"knip": "6.39.0",
@@ -7114,7 +6765,7 @@ function rootDevDeps(config) {
 		"tsdown": "0.23.0",
 		"typescript": "6.0.3",
 		"vitest": "5.0.3",
-		"pnpm": "11.27.1"
+		"pnpm": "11.28.3"
 	}["oxlint-tsgolint"];
 	return deps;
 }
@@ -7145,7 +6796,7 @@ function addReleaseDeps(deps, config) {
 			deps["release-it"] = {
 				"@changesets/cli": "3.0.3",
 				"@release-it/bumper": "8.0.1",
-				"@types/node": "24.13.5",
+				"@types/node": "24.19.1",
 				"@vitest/coverage-v8": "5.0.3",
 				"commit-and-tag-version": "13.2.1",
 				"knip": "6.39.0",
@@ -7159,12 +6810,12 @@ function addReleaseDeps(deps, config) {
 				"tsdown": "0.23.0",
 				"typescript": "6.0.3",
 				"vitest": "5.0.3",
-				"pnpm": "11.27.1"
+				"pnpm": "11.28.3"
 			}["release-it"];
 			if (config.structure === "monorepo") deps["@release-it/bumper"] = {
 				"@changesets/cli": "3.0.3",
 				"@release-it/bumper": "8.0.1",
-				"@types/node": "24.13.5",
+				"@types/node": "24.19.1",
 				"@vitest/coverage-v8": "5.0.3",
 				"commit-and-tag-version": "13.2.1",
 				"knip": "6.39.0",
@@ -7178,14 +6829,14 @@ function addReleaseDeps(deps, config) {
 				"tsdown": "0.23.0",
 				"typescript": "6.0.3",
 				"vitest": "5.0.3",
-				"pnpm": "11.27.1"
+				"pnpm": "11.28.3"
 			}["@release-it/bumper"];
 			break;
 		case "simple":
 			deps["commit-and-tag-version"] = {
 				"@changesets/cli": "3.0.3",
 				"@release-it/bumper": "8.0.1",
-				"@types/node": "24.13.5",
+				"@types/node": "24.19.1",
 				"@vitest/coverage-v8": "5.0.3",
 				"commit-and-tag-version": "13.2.1",
 				"knip": "6.39.0",
@@ -7199,13 +6850,13 @@ function addReleaseDeps(deps, config) {
 				"tsdown": "0.23.0",
 				"typescript": "6.0.3",
 				"vitest": "5.0.3",
-				"pnpm": "11.27.1"
+				"pnpm": "11.28.3"
 			}["commit-and-tag-version"];
 			break;
 		case "changesets": deps["@changesets/cli"] = {
 			"@changesets/cli": "3.0.3",
 			"@release-it/bumper": "8.0.1",
-			"@types/node": "24.13.5",
+			"@types/node": "24.19.1",
 			"@vitest/coverage-v8": "5.0.3",
 			"commit-and-tag-version": "13.2.1",
 			"knip": "6.39.0",
@@ -7219,7 +6870,7 @@ function addReleaseDeps(deps, config) {
 			"tsdown": "0.23.0",
 			"typescript": "6.0.3",
 			"vitest": "5.0.3",
-			"pnpm": "11.27.1"
+			"pnpm": "11.28.3"
 		}["@changesets/cli"];
 	}
 }
@@ -7413,7 +7064,7 @@ function applyMetadataDefaults(pkg, ctx, changes) {
 	const pinnedPnpm = {
 		"@changesets/cli": "3.0.3",
 		"@release-it/bumper": "8.0.1",
-		"@types/node": "24.13.5",
+		"@types/node": "24.19.1",
 		"@vitest/coverage-v8": "5.0.3",
 		"commit-and-tag-version": "13.2.1",
 		"knip": "6.39.0",
@@ -7427,7 +7078,7 @@ function applyMetadataDefaults(pkg, ctx, changes) {
 		"tsdown": "0.23.0",
 		"typescript": "6.0.3",
 		"vitest": "5.0.3",
-		"pnpm": "11.27.1"
+		"pnpm": "11.28.3"
 	}["pnpm"];
 	const desiredPm = pinnedPnpm ? `pnpm@${pinnedPnpm}` : void 0;
 	if (desiredPm) {
@@ -7468,12 +7119,12 @@ function buildManagedDevDeps(ctx) {
 	const devDeps = { ...rootDevDeps(ctx.config) };
 	if (!isMonorepo) Object.assign(devDeps, perPackageDevDeps(ctx.config));
 	if (ctx.config.stack !== "none" || ctx.config.ci === "forgejo") devDeps["@bensandee/config"] = isWorkspacePackage(ctx, "@bensandee/config") ? "workspace:*" : "0.14.5";
-	if (!isWorkspacePackage(ctx, "@bensandee/tooling")) devDeps["@bensandee/tooling"] = "0.86.1";
-	if (ctx.config.useEslintPlugin && ctx.config.stack !== "none") devDeps["@bensandee/eslint-plugin"] = isWorkspacePackage(ctx, "@bensandee/eslint-plugin") ? "workspace:*" : "0.15.2";
+	if (!isWorkspacePackage(ctx, "@bensandee/tooling")) devDeps["@bensandee/tooling"] = "0.87.0";
+	if (ctx.config.useEslintPlugin && ctx.config.stack !== "none") devDeps["@bensandee/eslint-plugin"] = isWorkspacePackage(ctx, "@bensandee/eslint-plugin") ? "workspace:*" : "0.16.0";
 	if (ctx.config.formatter === "oxfmt") devDeps["oxfmt"] = {
 		"@changesets/cli": "3.0.3",
 		"@release-it/bumper": "8.0.1",
-		"@types/node": "24.13.5",
+		"@types/node": "24.19.1",
 		"@vitest/coverage-v8": "5.0.3",
 		"commit-and-tag-version": "13.2.1",
 		"knip": "6.39.0",
@@ -7487,12 +7138,12 @@ function buildManagedDevDeps(ctx) {
 		"tsdown": "0.23.0",
 		"typescript": "6.0.3",
 		"vitest": "5.0.3",
-		"pnpm": "11.27.1"
+		"pnpm": "11.28.3"
 	}["oxfmt"];
 	if (ctx.config.formatter === "prettier") devDeps["prettier"] = {
 		"@changesets/cli": "3.0.3",
 		"@release-it/bumper": "8.0.1",
-		"@types/node": "24.13.5",
+		"@types/node": "24.19.1",
 		"@vitest/coverage-v8": "5.0.3",
 		"commit-and-tag-version": "13.2.1",
 		"knip": "6.39.0",
@@ -7506,7 +7157,7 @@ function buildManagedDevDeps(ctx) {
 		"tsdown": "0.23.0",
 		"typescript": "6.0.3",
 		"vitest": "5.0.3",
-		"pnpm": "11.27.1"
+		"pnpm": "11.28.3"
 	}["prettier"];
 	addReleaseDeps(devDeps, ctx.config);
 	return devDeps;
@@ -7562,7 +7213,7 @@ async function generatePackageJson(ctx) {
 		packageManager: `pnpm@${{
 			"@changesets/cli": "3.0.3",
 			"@release-it/bumper": "8.0.1",
-			"@types/node": "24.13.5",
+			"@types/node": "24.19.1",
 			"@vitest/coverage-v8": "5.0.3",
 			"commit-and-tag-version": "13.2.1",
 			"knip": "6.39.0",
@@ -7576,7 +7227,7 @@ async function generatePackageJson(ctx) {
 			"tsdown": "0.23.0",
 			"typescript": "6.0.3",
 			"vitest": "5.0.3",
-			"pnpm": "11.27.1"
+			"pnpm": "11.28.3"
 		}["pnpm"]}`
 	};
 	ctx.write(filePath, JSON.stringify(pkg, null, 2) + "\n");
@@ -8394,6 +8045,17 @@ const CONFIG_WITH_LINT_RULES = `import recommended from "@bensandee/config/oxlin
 import bensandee from "@bensandee/eslint-plugin/recommended";
 import { defineConfig } from "oxlint";
 
+export default defineConfig({
+  extends: [recommended],
+  jsPlugins: bensandee.jsPlugins ?? [],
+  rules: bensandee.rules ?? {},
+  ignorePatterns: [${IGNORE_PATTERNS_SPREAD}],
+});
+`;
+const LEGACY_CONFIG_WITH_LINT_RULES = `import recommended from "@bensandee/config/oxlint/recommended";
+import bensandee from "@bensandee/eslint-plugin/recommended";
+import { defineConfig } from "oxlint";
+
 // Report phase: every plugin rule runs and reports, none blocks. The severities are derived
 // from the plugin's own rule names rather than listed, so a rule the plugin adds arrives the
 // day it publishes -- enumerating them is how the plugin came to be installed and never
@@ -8426,7 +8088,11 @@ function addIgnorePatterns(content) {
 	return content.slice(0, insertPos) + `  ignorePatterns: [${IGNORE_PATTERNS_SPREAD}],\n` + content.slice(insertPos);
 }
 const PLUGIN_IMPORT = "import bensandee from \"@bensandee/eslint-plugin/recommended\";\n";
-const REPORT_SPREAD = "    ...Object.fromEntries(Object.keys(bensandee.rules ?? {}).map((name) => [name, \"warn\"])),\n";
+const TIER_SPREAD = "    ...bensandee.rules,\n";
+const LEGACY_REPORT_SPREAD = "    ...Object.fromEntries(Object.keys(bensandee.rules ?? {}).map((name) => [name, \"warn\"])),\n";
+/** The text every report-phase severity map carries, whatever its shape -- in either quote
+* style, since the merged spread went through the repo's own formatter. */
+const REPORT_PHASE_MARKER = /\[name, (["'])warn\1\]/;
 const RULES_KEY = /^ {2}"?rules"?: \{/m;
 const RULES_KEY_INLINE = /^ {2}"?rules"?\s*[,:]/m;
 const JS_PLUGINS_KEY = /^ {2}"?jsPlugins"?: \[/m;
@@ -8473,28 +8139,29 @@ function addBensandeePlugin(content) {
 	const rulesKey = RULES_KEY.exec(rulesRegion);
 	if (rulesKey) {
 		const at = insertPos + rulesKey.index + rulesKey[0].length;
-		return withPlugins.slice(0, at) + `\n${REPORT_SPREAD}` + withPlugins.slice(at);
+		return withPlugins.slice(0, at) + `\n${TIER_SPREAD}` + withPlugins.slice(at);
 	}
 	if (RULES_KEY_INLINE.test(rulesRegion)) return UNRECOGNIZED_SHAPE;
-	return withPlugins.slice(0, afterJsPlugins) + `  rules: {\n${REPORT_SPREAD}  },\n` + withPlugins.slice(afterJsPlugins);
-}
-/** The exact literal `addBensandeePlugin` splices in when it creates a `rules` key from
-* scratch -- checked before {@link REPORT_SPREAD}'s own merged-in-place form below, since that
-* one is a substring of this one and would otherwise match first and leave the empty `rules: {
-* },` shell behind. */
-const CREATED_RULES_BLOCK = `  rules: {\n${REPORT_SPREAD}  },\n`;
+	return withPlugins.slice(0, afterJsPlugins) + `  rules: {\n${TIER_SPREAD}  },\n` + withPlugins.slice(afterJsPlugins);
+}
+/** The exact literals `addBensandeePlugin` splices in when it creates a `rules` key from
+* scratch, current and legacy -- checked before the merged-in-place spreads below, since each
+* spread is a substring of its block and would otherwise match first and leave the empty `rules:
+* { },` shell behind. */
+const CREATED_RULES_BLOCKS = [`  rules: {\n${TIER_SPREAD}  },\n`, `  rules: {\n${LEGACY_REPORT_SPREAD}  },\n`];
+const MERGED_RULES_SPREADS = [`\n${TIER_SPREAD}`, `\n${LEGACY_REPORT_SPREAD}`];
 const CREATED_JS_PLUGINS_LINE = "  jsPlugins: bensandee.jsPlugins ?? [],\n";
 const MERGED_JS_PLUGINS_SPREAD = /\.\.\.\(bensandee\.jsPlugins \?\? \[\]\),\s+/;
 /**
 * The exact inverse of {@link addBensandeePlugin}: strips the import line and whichever of the
-* two `jsPlugins` and two `rules` shapes it spliced in, by removing those same literals rather
-* than re-deriving positions. Returns `undefined` when there is nothing to remove (the content
-* does not name the plugin -- keeps a re-sync a no-op), and {@link UNRECOGNIZED_SHAPE} when it
-* does but none of the expected literals are present -- a hand-edit since injection, a shape
-* this tool never injected, or (for the merged `jsPlugins` spread only) a formatter reflow
-* wider than {@link MERGED_JS_PLUGINS_SPREAD} tolerates -- declined whole, the same rule
-* `addBensandeePlugin` itself follows, rather than guessing at a partial removal that could
-* corrupt the file.
+* two `jsPlugins` and two `rules` shapes it spliced in, the legacy `rules` literals included, by
+* removing those same literals rather than re-deriving positions. Returns `undefined` when
+* there is nothing to remove (the content does not name the plugin -- keeps a re-sync a no-op),
+* and {@link UNRECOGNIZED_SHAPE} when it does but none of the expected literals are present --
+* a hand-edit since injection, a shape this tool never injected, or (for the merged
+* `jsPlugins` spread only) a formatter reflow wider than {@link MERGED_JS_PLUGINS_SPREAD}
+* tolerates -- declined whole, the same rule `addBensandeePlugin` itself follows, rather than
+* guessing at a partial removal that could corrupt the file.
 */
 function removeBensandeePlugin(content) {
 	if (!content.includes("@bensandee/eslint-plugin")) return void 0;
@@ -8503,10 +8170,17 @@ function removeBensandeePlugin(content) {
 	if (result.includes(CREATED_JS_PLUGINS_LINE)) result = result.replace(CREATED_JS_PLUGINS_LINE, "");
 	else if (MERGED_JS_PLUGINS_SPREAD.test(result)) result = result.replace(MERGED_JS_PLUGINS_SPREAD, "");
 	else return UNRECOGNIZED_SHAPE;
-	if (result.includes(CREATED_RULES_BLOCK)) result = result.replace(CREATED_RULES_BLOCK, "");
-	else if (result.includes(`\n${REPORT_SPREAD}`)) result = result.replace(`\n${REPORT_SPREAD}`, "");
-	else return UNRECOGNIZED_SHAPE;
-	return result;
+	const rulesLiteral = CREATED_RULES_BLOCKS.find((block) => result.includes(block)) ?? MERGED_RULES_SPREADS.find((spread) => result.includes(spread));
+	if (rulesLiteral === void 0) return UNRECOGNIZED_SHAPE;
+	return result.replace(rulesLiteral, "");
+}
+/**
+* Swap the report-phase spread an earlier release merged in for {@link TIER_SPREAD}. Only the
+* byte-exact literal is replaced: a map the repo has reflowed or edited is left for the caller
+* to report, since rewriting a shape this tool did not write could drop the repo's own rules.
+*/
+function migrateReportSpread(content) {
+	return content.replace(`\n${LEGACY_REPORT_SPREAD}`, `\n${TIER_SPREAD}`);
 }
 async function generateOxlint(ctx) {
 	const filePath = "oxlint.config.ts";
@@ -8524,7 +8198,7 @@ async function generateOxlint(ctx) {
 			action: "skipped",
 			description: "Already configured"
 		};
-		if (isGeneratedTemplate(ctx, filePath, ctx.config.useEslintPlugin ? CONFIG_PRESET_ONLY : CONFIG_WITH_LINT_RULES)) {
+		if ((ctx.config.useEslintPlugin ? [CONFIG_PRESET_ONLY, LEGACY_CONFIG_WITH_LINT_RULES] : [CONFIG_WITH_LINT_RULES, LEGACY_CONFIG_WITH_LINT_RULES]).some((template) => isGeneratedTemplate(ctx, filePath, template))) {
 			ctx.write(filePath, content);
 			return {
 				filePath,
@@ -8537,8 +8211,14 @@ async function generateOxlint(ctx) {
 			let pluginResult;
 			let withPlugin;
 			if (ctx.config.useEslintPlugin) {
-				pluginResult = addBensandeePlugin(withIgnores);
-				withPlugin = typeof pluginResult === "string" ? pluginResult : withIgnores;
+				const migrated = migrateReportSpread(withIgnores);
+				pluginResult = addBensandeePlugin(migrated);
+				withPlugin = typeof pluginResult === "string" ? pluginResult : migrated;
+				if (pluginResult === void 0 && REPORT_PHASE_MARKER.test(migrated)) return {
+					filePath,
+					action: "failed",
+					description: "Plugin severities not migrated: unrecognized config shape -- replace the all-\"warn\" rule map with \"...bensandee.rules,\""
+				};
 			} else {
 				pluginResult = removeBensandeePlugin(withIgnores);
 				withPlugin = typeof pluginResult === "string" ? pluginResult : withIgnores;
@@ -9676,89 +9356,406 @@ async function generateGitignore(ctx) {
 		...OPTIONAL_ENTRIES,
 		...conditionalEntries(ctx)
 	];
-	const existing = ctx.read(filePath);
-	if (existing) {
-		const existingNormalized = new Set(existing.split("\n").map(normalizeEntry).filter((line) => line.length > 0));
-		const missing = allEntries.filter((entry) => !existingNormalized.has(normalizeEntry(entry)));
-		if (missing.length === 0) return {
-			filePath,
-			action: "skipped",
-			description: "Already has all standard entries"
-		};
-		const missingRequired = REQUIRED_ENTRIES.filter((entry) => !existingNormalized.has(normalizeEntry(entry)));
-		const updated = existing.trimEnd() + "\n\n# Added by @bensandee/tooling\n" + missing.join("\n") + "\n";
-		ctx.write(filePath, updated);
-		if (missingRequired.length === 0) return {
-			filePath,
-			action: "skipped",
-			description: "Only optional entries missing"
-		};
-		return {
-			filePath,
-			action: "updated",
-			description: `Appended ${String(missing.length)} missing entries`
-		};
-	}
-	ctx.write(filePath, allEntries.join("\n") + "\n");
+	const existing = ctx.read(filePath);
+	if (existing) {
+		const existingNormalized = new Set(existing.split("\n").map(normalizeEntry).filter((line) => line.length > 0));
+		const missing = allEntries.filter((entry) => !existingNormalized.has(normalizeEntry(entry)));
+		if (missing.length === 0) return {
+			filePath,
+			action: "skipped",
+			description: "Already has all standard entries"
+		};
+		const missingRequired = REQUIRED_ENTRIES.filter((entry) => !existingNormalized.has(normalizeEntry(entry)));
+		const updated = existing.trimEnd() + "\n\n# Added by @bensandee/tooling\n" + missing.join("\n") + "\n";
+		ctx.write(filePath, updated);
+		if (missingRequired.length === 0) return {
+			filePath,
+			action: "skipped",
+			description: "Only optional entries missing"
+		};
+		return {
+			filePath,
+			action: "updated",
+			description: `Appended ${String(missing.length)} missing entries`
+		};
+	}
+	ctx.write(filePath, allEntries.join("\n") + "\n");
+	return {
+		filePath,
+		action: "created",
+		description: "Generated .gitignore"
+	};
+}
+//#endregion
+//#region src/generators/gitattributes.ts
+const MANAGED_HEADER = ["# Managed by @bensandee/tooling: LF working tree on every platform, overriding", "# core.autocrlf/core.eol at checkout. Rules below this line win over it."].join("\n");
+/** Placed only when prepending above a consumer's existing content -- explains, in the file
+* itself, why the rule goes first rather than last (the code has no other way to show it). */
+const PREPEND_REASON = ["# Prepended above your existing rules: .gitattributes is last-match-wins, so a rule", "# placed below would override any binary/-text marks you already have."].join("\n");
+const RULE_LINE = "* text=auto eol=lf";
+/**
+* True when `content` already carries a rule equivalent to `* text=auto eol=lf`: a
+* non-comment line whose first whitespace-separated token is exactly `*` and whose
+* remaining tokens include both `text=auto` and `eol=lf`, in either order. Token-based so
+* reordered or extra-whitespace variants still count, but a narrower pattern (`*.ts ...`)
+* or a commented-out line does not.
+*/
+function hasLfRule(content) {
+	return content.split("\n").some((line) => {
+		const trimmed = line.trim();
+		if (trimmed.startsWith("#")) return false;
+		const tokens = trimmed.split(/\s+/).filter(Boolean);
+		if (tokens[0] !== "*") return false;
+		const rest = new Set(tokens.slice(1));
+		return rest.has("text=auto") && rest.has("eol=lf");
+	});
+}
+/**
+* Scaffold `.gitattributes` with `* text=auto eol=lf`, the rule that makes the working tree
+* LF regardless of a developer's global `core.autocrlf`/`core.eol`. No managed-file header
+* from `utils/generated-header.ts` -- this file is merged into like `.gitignore`, not
+* wholesale-regenerated. The rule is required, not optional: a missing rule is
+* created/updated and fails `repo:sync --check` like any other drift.
+*/
+async function generateGitattributes(ctx) {
+	const filePath = ".gitattributes";
+	const existing = ctx.read(filePath);
+	if (existing === void 0 || existing.trim() === "") {
+		ctx.write(filePath, `${MANAGED_HEADER}\n${RULE_LINE}\n`);
+		return {
+			filePath,
+			action: existing === void 0 ? "created" : "updated",
+			description: "Generated .gitattributes"
+		};
+	}
+	if (hasLfRule(existing)) return {
+		filePath,
+		action: "skipped",
+		description: "Already has the LF rule"
+	};
+	const updated = `${MANAGED_HEADER}\n${PREPEND_REASON}\n${RULE_LINE}\n\n${existing}`;
+	ctx.write(filePath, updated);
+	return {
+		filePath,
+		action: "updated",
+		description: "Prepended the LF rule"
+	};
+}
+//#endregion
+//#region src/release/publish/publish-config-lint.ts
+const FIX = `add "publishConfig": { "registry": "<your registry URL>" } to its package.json`;
+/**
+* Whether a value can serve as a publish destination: an absolute http(s) URL.
+* Presence alone is not the test -- a relative or empty registry is as silently
+* wrong as an absent one, and npm resolves neither to the place the author meant.
+*/
+function isUsableRegistry(value) {
+	if (typeof value !== "string" || value.trim() === "") return false;
+	try {
+		const url = new URL(value);
+		return url.protocol === "https:" || url.protocol === "http:";
+	} catch {
+		return false;
+	}
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* Require every package this repo would publish to declare where it publishes.
+*
+* npm and pnpm use one `registry` key for reads and writes alike, so a project
+* `.npmrc` aimed at an install cache silently repoints `pnpm publish` too. A
+* package that never declares its destination inherits one, and an inherited
+* destination can be changed by a file that never mentions publishing.
+*
+* Reports rather than repairs: the correct registry is not derivable here, and
+* writing a guess would redirect a working release exactly the way this gate
+* exists to prevent.
+*/
+function lintPublishConfig(targetDir, structure) {
+	const issues = [];
+	for (const pkg of getPublishablePackages(targetDir, structure)) {
+		const manifest = readPackageJson(pkg.dir);
+		if (!manifest) continue;
+		const file = path.relative(targetDir, path.join(pkg.dir, "package.json"));
+		const pc = manifest.publishConfig;
+		const registry = isRecord(pc) ? pc["registry"] : void 0;
+		if (registry === void 0) {
+			issues.push({
+				kind: "missing",
+				package: pkg.name,
+				file,
+				message: `${pkg.name} is published from this repo but declares no publishConfig.registry, so its release destination is inherited -- a project .npmrc can repoint it silently. In ${file}, ${FIX}.`
+			});
+			continue;
+		}
+		if (!isUsableRegistry(registry)) issues.push({
+			kind: "malformed",
+			package: pkg.name,
+			file,
+			message: `${pkg.name} declares publishConfig.registry as ${JSON.stringify(registry)}, which is not an absolute http(s) URL and cannot be published to. In ${file}, ${FIX}.`
+		});
+	}
+	return issues;
+}
+/**
+* The registries this repo's publishable packages actually declare, distinct and in
+* first-seen order.
+*
+* Reuses the same "absolute http(s) URL" narrowing as {@link lintPublishConfig} rather
+* than re-deriving it -- a registry this misses here would fail that gate first, so
+* `repo:sync` never reaches a generator with an undeclared or malformed registry. A
+* caller that invokes a generator directly (or a repo whose publishable set is empty,
+* e.g. every package private) still gets a safe empty result.
+*/
+function declaredPublishRegistries(targetDir, structure, rootPackageJson) {
+	const registries = [];
+	for (const pkg of getPublishablePackages(targetDir, structure, rootPackageJson)) {
+		const manifest = structure === "single" ? rootPackageJson ?? readPackageJson(pkg.dir) : readPackageJson(pkg.dir);
+		if (!manifest) continue;
+		const pc = manifest.publishConfig;
+		const registry = isRecord(pc) ? pc["registry"] : void 0;
+		if (typeof registry === "string" && isUsableRegistry(registry) && !registries.includes(registry)) registries.push(registry);
+	}
+	return registries;
+}
+//#endregion
+//#region src/generators/mise-pin.ts
+/**
+* The mise version and release-asset digest the fleet's CI and the agent runner base image agree
+* to run. This is the one place that agreement is recorded; `packages/agent/test/runner-base-image-dockerfile.test.ts`
+* (task 8 of the mise-toolchain-provisioning plan) reads both constants back through
+* `readRepoFile` and asserts the base image's own `ARG MISE_VERSION` and `mise.sha256` manifest
+* agree with them, so the two packages cannot drift without a failing test on either side.
+*
+* Each constant sits under its own `// renovate:` marker comment, in the three-line grammar
+* `packages/agent/docker/agent-goose-image/goose.sha256` uses for its own digest line, so the same
+* shape of custom regex manager in the root `renovate.json` can rewrite both this version and this
+* digest (`customManagers` entries scoped to this file).
+*/
+const MISE_VERSION = "2026.10.2";
+const MISE_LINUX_X64_SHA256 = "8f5f6660336f572830e33cd9b378d3131e529a0d4c4f0c553776be90a1ba302a";
+/** Where generated Forgejo workflows fetch the shared mise setup action: a composite action in
+* `bensandee/common`, on the forge every fleet repo lives on. GitHub cannot reach it; the
+* generators keep inline steps there. */
+const SETUP_MISE_ACTION_URL = "https://code.orangebikelabs.com/bensandee/common/actions/setup-mise";
+/** The tag in `bensandee/common` that marks the current release of the action. Generated `uses:`
+* lines carry it as their comment, and Renovate moves the SHA below to wherever it points. */
+const SETUP_MISE_ACTION_TAG = "setup-mise@latest";
+const SETUP_MISE_ACTION_SHA = "db99e4e9ee46bfeaca2146e7ae55cc700b4c23bf";
+//#endregion
+//#region src/generators/ci-utils.ts
+/** Build a GitHub Actions expression like `${{ expr }}` without triggering no-template-curly-in-string. */
+function actionsExpr(expr) {
+	return `\${{ ${expr} }}`;
+}
+const MAIN_BRANCH_REF = "refs/heads/main";
+/** `if:` condition that gates a step to push events on the default branch. */
+const IS_MAIN_BRANCH = `github.ref == '${MAIN_BRANCH_REF}'`;
+/**
+* Negated form for concurrency `cancel-in-progress` and similar uses.
+*
+* Main is exempt from cancellation on purpose, and the exemption stays: a main run publishes and
+* pushes tags, and cancelling one mid-flight can leave a partial publish -- some packages on the
+* registry, no matching tags, and no run left alive to finish. A superseded feature-branch run
+* wastes minutes; a half-published release costs a manual unwind.
+*
+* So several main runs can be in flight at once, each versioning from its own triggering commit.
+* Overlap safety rests on one invariant: **main advances solely via commits that trigger a CI
+* run.** The `[skip ci]` coverage, health, and egress records go to `bst/*` orphan branches and
+* never to main; a `[skip ci]` commit pushed straight to main would leave a superseded run skipping
+* and its changesets stranded until the next push, which is why the supersession guard skips rather
+* than fails. Three guards carry the overlap itself: supersession plus a `--force-with-lease`
+* version push (`release/publish/version.ts`), the `headBumpedVersion` publish guard plus reading
+* remote tags and releases before acting (`commands/release-changesets.ts`,
+* `release/publish/publish.ts`), and floating git and Docker tags that only move forward
+* (`release/publish/floating-tags.ts`, `release/docker.ts`). Such a run may also version pending
+* changesets after it publishes -- the stale version-PR merge -- under the same supersession guard
+* and push lease as any other version run. A later commit publishes a bump only when its tag is
+* missing and every main run since the package's last release tag has settled
+* (`release/publish/unpublished-bump.ts`), so no run that could still publish it is in flight; a
+* manual re-run of one of those runs is the overlap left. On Forgejo the concurrency block is
+* only a PR-run cancellation mechanism -- it holds a main run in its group and, in Forgejo 16,
+* intermittently fails to release it, which is why main runs get a group of their own there. GitHub's shape stays shared
+* because its queue works: one run, one pending, a newer arrival replacing the pending, so
+* `changesets/action@v1` never needs a guard of its own. Any new side effect in a main run must be
+* idempotent under overlap or be listed here with the guard that makes it so.
+*/
+const IS_NOT_MAIN_BRANCH = `github.ref != '${MAIN_BRANCH_REF}'`;
+/**
+* Job-level `env:` block that evaluates the default-branch check once, so steps
+* can gate on `env.IS_MAIN` instead of repeating the `github.ref` expression.
+*/
+const IS_MAIN_JOB_ENV = { IS_MAIN: actionsExpr(IS_MAIN_BRANCH) };
+/** `if:` condition referencing the job-level `IS_MAIN` env var (see {@link IS_MAIN_JOB_ENV}). */
+const IS_MAIN_ENV_GUARD = "env.IS_MAIN == 'true'";
+/**
+* npm's own registry-key rule for an `.npmrc` auth line: strip the scheme, keep
+* host/port/path, and end with exactly one slash. `actions/setup-node` derives the
+* same key from a registry URL; this mirrors that so a hand-written line matches
+* what npm looks up at publish time -- npm-registry-fetch walks the request path
+* upward through ancestor keys until one matches.
+*/
+function npmrcAuthKey(registryUrl) {
+	return `${registryUrl.replace(/^https?:/i, "").replace(/\/+$/, "")}/`;
+}
+const NODE_AUTH_TOKEN_VAR = ["$", "{NODE_AUTH_TOKEN}"].join("");
+/**
+* Build both halves of a job's npm auth wiring together, so one value decides
+* them: the auth lines the publishing step writes, and the step-level
+* `NODE_AUTH_TOKEN` it carries. A job that gets none of the declared registries
+* gets neither -- including a `publishes: true` job whose publishable set is
+* empty (every package private), since there is then no npmrc line for a real
+* secret to pair with.
+*
+* The lines go into a temp userconfig exported only inside the publishing
+* step's shell, never `~/.npmrc` or `$GITHUB_ENV`: pnpm 11 warns
+* `Failed to replace env in config` on every call that reads the placeholder
+* while the token is unset or empty, so a line in a shared file makes install, `ci:check`,
+* and every step after the publish warn. An empty job-level default does not
+* silence it, and `${NODE_AUTH_TOKEN:-}` is rejected as an empty fallback and
+* warns in every case. The `-n` guard keeps a run without the secret quiet; the
+* single quotes keep the token itself off disk, since npm expands it at read time.
+*/
+function npmAuthWiring(ctx, publishes) {
+	const registries = publishes ? declaredPublishRegistries(ctx.targetDir, ctx.config.structure, ctx.packageJson) : [];
+	if (registries.length === 0) return {
+		publishRun: (command) => command,
+		tokenEnv: {}
+	};
+	const setup = [
+		"if [ -n \"$NODE_AUTH_TOKEN\" ]; then",
+		"  NPM_CONFIG_USERCONFIG=\"$(mktemp)\"",
+		"  export NPM_CONFIG_USERCONFIG",
+		"  if [ -f ~/.npmrc ]; then cat ~/.npmrc > \"$NPM_CONFIG_USERCONFIG\"; fi",
+		...registries.map((registry) => `  printf '\\n%s\\n' '${npmrcAuthKey(registry)}:_authToken=${NODE_AUTH_TOKEN_VAR}' >> "$NPM_CONFIG_USERCONFIG"`),
+		"fi"
+	];
 	return {
-		filePath,
-		action: "created",
-		description: "Generated .gitignore"
+		publishRun: (command) => [...setup, command].join("\n"),
+		tokenEnv: { NODE_AUTH_TOKEN: actionsExpr("secrets.NPM_TOKEN") }
 	};
 }
-//#endregion
-//#region src/generators/gitattributes.ts
-const MANAGED_HEADER = ["# Managed by @bensandee/tooling: LF working tree on every platform, overriding", "# core.autocrlf/core.eol at checkout. Rules below this line win over it."].join("\n");
-/** Placed only when prepending above a consumer's existing content -- explains, in the file
-* itself, why the rule goes first rather than last (the code has no other way to show it). */
-const PREPEND_REASON = ["# Prepended above your existing rules: .gitattributes is last-match-wins, so a rule", "# placed below would override any binary/-text marks you already have."].join("\n");
-const RULE_LINE = "* text=auto eol=lf";
+const MISE_RELEASE_URL = `https://github.com/jdx/mise/releases/download/v${MISE_VERSION}/mise-v${MISE_VERSION}-linux-x64`;
 /**
-* True when `content` already carries a rule equivalent to `* text=auto eol=lf`: a
-* non-comment line whose first whitespace-separated token is exactly `*` and whose
-* remaining tokens include both `text=auto` and `eol=lf`, in either order. Token-based so
-* reordered or extra-whitespace variants still count, but a narrower pattern (`*.ts ...`)
-* or a commented-out line does not.
+* The node script `inlineMiseSteps` pipes `mise env --json` into, run under the mise it just
+* installed. Reads the env map off stdin (mise exec passes it straight through) and exports every
+* key except `PATH` into `$GITHUB_ENV` in heredoc form -- the form that survives any value,
+* including one containing `$` or quotes -- then appends mise's shim directory and the
+* `~/.local/bin` install location to `$GITHUB_PATH` so every later step sees node, pnpm, and any
+* other declared tool on PATH with no prefix.
 */
-function hasLfRule(content) {
-	return content.split("\n").some((line) => {
-		const trimmed = line.trim();
-		if (trimmed.startsWith("#")) return false;
-		const tokens = trimmed.split(/\s+/).filter(Boolean);
-		if (tokens[0] !== "*") return false;
-		const rest = new Set(tokens.slice(1));
-		return rest.has("text=auto") && rest.has("eol=lf");
-	});
+const MISE_ENV_EXPORT_SCRIPT = [
+	"const fs = require(\"fs\");",
+	"const env = JSON.parse(fs.readFileSync(0, \"utf8\"));",
+	"let out = \"\";",
+	"for (const [key, value] of Object.entries(env)) {",
+	"  if (key === \"PATH\") continue;",
+	"  out += key + \"<<BST_MISE_ENV_EOF\\n\" + value + \"\\nBST_MISE_ENV_EOF\\n\";",
+	"}",
+	"fs.appendFileSync(process.env.GITHUB_ENV, out);",
+	"fs.appendFileSync(",
+	"  process.env.GITHUB_PATH,",
+	"  process.env.HOME + \"/.local/share/mise/shims\\n\" + process.env.HOME + \"/.local/bin\\n\",",
+	");"
+].join("\n");
+/** A fresh object per call: one shared object in two jobs would serialize as a YAML alias. */
+function pnpmStoreCacheStep() {
+	return { step: {
+		name: "Cache pnpm store",
+		uses: "actions/cache@v4",
+		with: {
+			path: "~/.local/share/pnpm/store",
+			key: `pnpm-${actionsExpr("runner.os")}-${actionsExpr("hashFiles('pnpm-lock.yaml')")}`
+		}
+	} };
 }
+/** Actions whose ref the generator pins itself, so `preservePinnedActions` must not keep a
+* repo's older ref for them. */
+const GENERATOR_OWNED_ACTIONS = [{
+	name: SETUP_MISE_ACTION_URL,
+	comment: SETUP_MISE_ACTION_TAG
+}];
 /**
-* Scaffold `.gitattributes` with `* text=auto eol=lf`, the rule that makes the working tree
-* LF regardless of a developer's global `core.autocrlf`/`core.eol`. No managed-file header
-* from `utils/generated-header.ts` -- this file is merged into like `.gitignore`, not
-* wholesale-regenerated. The rule is required, not optional: a missing rule is
-* created/updated and fails `repo:sync --check` like any other drift.
+* The steps every workflow generator uses in place of `pnpm/action-setup` + `actions/setup-node`:
+* install the pinned `mise`, `mise install` the repo's `mise.toml` toolchain, export its env into
+* the rest of the job, and cache the pnpm store. `MISE_VERSION`/`MISE_LINUX_X64_SHA256`
+* (`mise-pin.ts`) are the same pin the agent runner's base image installs, checked by
+* `runner-base-image-dockerfile.test.ts`.
+*
+* On Forgejo the mise half is the shared composite action in `bensandee/common`, pinned by commit.
+* GitHub resolves actions only from github.com, so it keeps the same steps inline.
 */
-async function generateGitattributes(ctx) {
-	const filePath = ".gitattributes";
-	const existing = ctx.read(filePath);
-	if (existing === void 0 || existing.trim() === "") {
-		ctx.write(filePath, `${MANAGED_HEADER}\n${RULE_LINE}\n`);
-		return {
-			filePath,
-			action: existing === void 0 ? "created" : "updated",
-			description: "Generated .gitattributes"
-		};
-	}
-	if (hasLfRule(existing)) return {
-		filePath,
-		action: "skipped",
-		description: "Already has the LF rule"
-	};
-	const updated = `${MANAGED_HEADER}\n${PREPEND_REASON}\n${RULE_LINE}\n\n${existing}`;
-	ctx.write(filePath, updated);
+function miseSetupSteps(ci) {
+	if (ci !== "forgejo") return inlineMiseSteps();
+	return [{ step: {
+		name: "Set up mise",
+		uses: `${SETUP_MISE_ACTION_URL}@${SETUP_MISE_ACTION_SHA}`,
+		with: {
+			version: MISE_VERSION,
+			sha256: MISE_LINUX_X64_SHA256
+		}
+	} }, pnpmStoreCacheStep()];
+}
+/**
+* The inline form of the shared action, for GitHub. Uses `mise env --json` piped into the
+* just-installed mise's own `node -e`, not `mise env --shell bash`: the JSON form is
+* shell-independent and the interpreter reading it is guaranteed to exist (mise just installed
+* it), so this needs no assumption about which shell the runner's `run:` steps use.
+*/
+function inlineMiseSteps() {
+	const installScript = [
+		"curl -fsSL -o \"$RUNNER_TEMP/mise\" " + MISE_RELEASE_URL,
+		`echo "${MISE_LINUX_X64_SHA256}  $RUNNER_TEMP/mise" | sha256sum -c`,
+		"mkdir -p \"$HOME/.local/bin\" && install -m 0755 \"$RUNNER_TEMP/mise\" \"$HOME/.local/bin/mise\"",
+		"export MISE_TRUSTED_CONFIG_PATHS=\"$GITHUB_WORKSPACE\"",
+		"export MISE_YES=1",
+		"\"$HOME/.local/bin/mise\" install",
+		`"$HOME/.local/bin/mise" env --json | "$HOME/.local/bin/mise" exec -- node -e '${MISE_ENV_EXPORT_SCRIPT}'`
+	].join("\n");
+	return [
+		{ step: {
+			name: "Cache mise tools",
+			uses: "actions/cache@v4",
+			with: {
+				path: "~/.local/share/mise",
+				key: `mise-${actionsExpr("runner.os")}-${actionsExpr("hashFiles('mise.toml')")}`
+			}
+		} },
+		pnpmStoreCacheStep(),
+		{ step: {
+			name: "Install mise",
+			env: { GITHUB_TOKEN: "" },
+			run: installScript
+		} }
+	];
+}
+/**
+* Build the docker publish env block.
+*
+* The LHS env-var names (`DOCKER_USERNAME` / `DOCKER_PASSWORD`) match what
+* publish-docker.ts reads at runtime. The RHS secret references are
+* registry-specific (see {@link dockerSecretNames}) so downstream repos can
+* stop relying on the user/org-level `DOCKER_USERNAME` / `DOCKER_PASSWORD`
+* secrets -- which the Forgejo act fork auto-injects into every `container:`
+* image pull regardless of the target registry.
+*
+* When `host` is `null` (couldn't be derived at gen time), the secret references
+* fall back to neutral `REGISTRY_USERNAME` / `REGISTRY_PASSWORD` and the
+* workflow keeps `DOCKER_REGISTRY_HOST` / `DOCKER_REGISTRY_NAMESPACE` so the CLI
+* resolves the registry at runtime.
+*/
+function dockerPublishEnv(host) {
+	const { username, password } = dockerSecretNames(host);
 	return {
-		filePath,
-		action: "updated",
-		description: "Prepended the LF rule"
+		...host === null ? {
+			DOCKER_REGISTRY_HOST: actionsExpr("vars.DOCKER_REGISTRY_HOST"),
+			DOCKER_REGISTRY_NAMESPACE: actionsExpr("vars.DOCKER_REGISTRY_NAMESPACE")
+		} : {},
+		DOCKER_USERNAME: actionsExpr(`secrets.${username}`),
+		DOCKER_PASSWORD: actionsExpr(`secrets.${password}`),
+		RELEASE_DEBUG: actionsExpr("vars.RELEASE_DEBUG || 'false'")
 	};
 }
 //#endregion
@@ -9813,7 +9810,7 @@ function postReleaseHookJob(opts) {
 		needs: opts.needsJob,
 		if: opts.publishCondition,
 		"continue-on-error": true,
-		steps: [...commonSteps(opts.ci, []), { step: {
+		steps: [...commonSteps(opts.ci), { step: {
 			name: "Post-release hook",
 			env: {
 				...hookSecretEnv(opts.secrets),
@@ -9852,21 +9849,20 @@ function deployDispatchStep(opts) {
 	} };
 }
 /** Common setup steps shared by release-it and simple strategies. */
-function commonSteps(ci, authSteps) {
+function commonSteps(ci) {
 	return [
 		{ step: {
 			uses: "actions/checkout@v6",
 			with: { "fetch-depth": 0 }
 		} },
 		...miseSetupSteps(ci),
-		...authSteps,
 		{ step: { run: "pnpm install --frozen-lockfile" } }
 	];
 }
 function releaseItSteps(ci, npmAuth) {
 	const tokenEnv = ci === "github" ? { GITHUB_TOKEN: actionsExpr("secrets.RELEASE_TOKEN") } : { RELEASE_TOKEN: actionsExpr("secrets.RELEASE_TOKEN") };
-	return [...commonSteps(ci, npmAuth.steps), { step: {
-		run: "pnpm release-it --ci",
+	return [...commonSteps(ci), { step: {
+		run: npmAuth.publishRun("pnpm release-it --ci"),
 		env: {
 			...tokenEnv,
 			...npmAuth.tokenEnv,
@@ -9917,7 +9913,7 @@ function simpleReleaseEnv() {
 	};
 }
 function simpleReleaseSteps(ctx) {
-	const { ci, npmAuth, hasDocker, hasAssets, host } = ctx;
+	const { ci, hasDocker, hasAssets, host } = ctx;
 	const releaseEnv = connectionEnv(ci);
 	const pushedIf = "steps.release.outputs.pushed == 'true'";
 	const releaseStep = { step: {
@@ -9943,7 +9939,7 @@ function simpleReleaseSteps(ctx) {
 		run: "pnpm exec bst docker:publish"
 	} };
 	return [
-		...commonSteps(ci, npmAuth.steps),
+		...commonSteps(ci),
 		releaseStep,
 		...hasAssets ? [assetsStep] : [],
 		...hasDocker ? [dockerStep] : []
@@ -10026,7 +10022,6 @@ async function generateReleaseCi(ctx) {
 		on,
 		...isGitHub && { permissions: { contents: "write" } },
 		jobName: "release",
-		...Object.keys(npmAuth.jobEnv).length > 0 && { jobEnv: npmAuth.jobEnv },
 		...jobOutputs && { jobOutputs },
 		steps,
 		...extraJobs && { extraJobs }
@@ -10099,7 +10094,7 @@ function healthSteps(includeHistory) {
 	} }];
 }
 /** Build the release step for the check job (changesets strategy). */
-function changesetsReleaseStep(ci, publishesNpm, tokenEnv) {
+function changesetsReleaseStep(ci, publishesNpm, npmAuth) {
 	if (ci === "github") {
 		const changesetsEnv = {
 			GITHUB_TOKEN: actionsExpr("secrets.RELEASE_TOKEN"),
@@ -10123,10 +10118,10 @@ function changesetsReleaseStep(ci, publishesNpm, tokenEnv) {
 			FORGEJO_SERVER_URL: actionsExpr("github.server_url"),
 			FORGEJO_REPOSITORY: actionsExpr("github.repository"),
 			RELEASE_TOKEN: actionsExpr("secrets.RELEASE_TOKEN"),
-			...tokenEnv,
+			...npmAuth.tokenEnv,
 			RELEASE_DEBUG: actionsExpr("vars.RELEASE_DEBUG || 'false'")
 		},
-		run: "pnpm exec bst release:changesets"
+		run: npmAuth.publishRun("pnpm exec bst release:changesets")
 	} };
 }
 /**
@@ -10159,7 +10154,7 @@ function ciConcurrency(ci) {
 		"cancel-in-progress": actionsExpr(IS_NOT_MAIN_BRANCH)
 	};
 }
-function checkSteps(ci, authSteps, coverageEnabled, emitDockerSweepStep) {
+function checkSteps(ci, coverageEnabled, emitDockerSweepStep) {
 	const checkCommand = coverageEnabled ? "pnpm ci:check" : "pnpm ci:check --no-coverage";
 	return [
 		{ step: {
@@ -10167,7 +10162,6 @@ function checkSteps(ci, authSteps, coverageEnabled, emitDockerSweepStep) {
 			with: { "fetch-depth": 0 }
 		} },
 		...miseSetupSteps(ci),
-		...authSteps,
 		{ step: { run: "pnpm install --frozen-lockfile" } },
 		...emitDockerSweepStep ? [{ step: {
 			name: "Sweep leaked Docker resources",
@@ -10220,10 +10214,10 @@ async function generateCi(ctx) {
 	}
 	const npmAuth = npmAuthWiring(ctx, isChangesets && publishesNpm && !isGitHub);
 	const steps = [
-		...checkSteps(ctx.config.ci, npmAuth.steps, coverage.enabled, hasDockerPackages(ctx)),
+		...checkSteps(ctx.config.ci, coverage.enabled, hasDockerPackages(ctx)),
 		...emitCoverageSteps ? coverageHistorySteps() : [],
 		...healthSteps(emitHealthHistory),
-		...isChangesets ? [changesetsReleaseStep(ctx.config.ci, publishesNpm, npmAuth.tokenEnv)] : [],
+		...isChangesets ? [changesetsReleaseStep(ctx.config.ci, publishesNpm, npmAuth)] : [],
 		...isChangesets && isGitHub ? [githubChangesetsDeriveTagStep] : [],
 		...hasAssets ? [{ step: {
 			name: "Upload Release Assets",
@@ -10261,10 +10255,7 @@ async function generateCi(ctx) {
 			secrets: hookSecrets
 		}) };
 	}
-	const checkJobEnv = {
-		...emitCoverageSteps || emitHealthHistory ? IS_MAIN_JOB_ENV : {},
-		...npmAuth.jobEnv
-	};
+	const checkJobEnv = emitCoverageSteps || emitHealthHistory ? IS_MAIN_JOB_ENV : {};
 	const checksSlice = parseToolingConfigSlice(ctx.read(".tooling.json"), z.object({ checks: ChecksConfigSchema.optional() }), { block: "checks" });
 	const skipOnVersionPr = isChangesets && checksSlice?.checks?.runOnVersionPr !== true;
 	const content = buildWorkflowYaml({
@@ -12381,7 +12372,7 @@ function webUiGuideBody() {
 	const mwg = `pnpm dlx modern-web-guidance@${{
 		"@changesets/cli": "3.0.3",
 		"@release-it/bumper": "8.0.1",
-		"@types/node": "24.13.5",
+		"@types/node": "24.19.1",
 		"@vitest/coverage-v8": "5.0.3",
 		"commit-and-tag-version": "13.2.1",
 		"knip": "6.39.0",
@@ -12395,7 +12386,7 @@ function webUiGuideBody() {
 		"tsdown": "0.23.0",
 		"typescript": "6.0.3",
 		"vitest": "5.0.3",
-		"pnpm": "11.27.1"
+		"pnpm": "11.28.3"
 	}["modern-web-guidance"]}`;
 	return [
 		"# Web UI",
@@ -13002,7 +12993,7 @@ function reportFailures(failed, command) {
 function generateMigratePrompt(results, config, detected) {
 	const sections = [];
 	const timestamp = (/* @__PURE__ */ new Date()).toISOString();
-	sections.push(`# Migration Prompt\n\n_Generated by \`@bensandee/tooling@0.86.1 repo:sync\` on ${timestamp}_\n`);
+	sections.push(`# Migration Prompt\n\n_Generated by \`@bensandee/tooling@0.87.0 repo:sync\` on ${timestamp}_\n`);
 	const changed = results.filter((r) => r.action === "created" || r.action === "updated" || r.action === "archived");
 	if (changed.length > 0) {
 		const items = changed.map((r) => {
@@ -13988,7 +13979,9 @@ function createFileReader() {
 * (`commands/sync-gates.ts`) -- see that gate's doc comment for why an absent mise warns rather
 * than fails -- plus, when `publishDocker` is on, one more per image only the check overlay
 * declares (`runCheckOnlyImageGate`, same file): an advisory that a later tooling release stops
-* publishing it, counted rather than failed for the same reason the other two are.
+* publishing it, counted rather than failed for the same reason the other two are -- plus one
+* more per workflow file whose custom block installs packages with apt (`runWorkflowAptGate`,
+* same file), which the agent's containers cannot run.
 */
 const CHECKS_MARKER = "::bst-checks::";
 const WARN_LINE = new RegExp(`^${CHECKS_MARKER} warn (\\d+)\\s*$`);
@@ -15560,6 +15553,113 @@ const runChecksCommand = defineCommand({
 	}
 });
 //#endregion
+//#region src/utils/workflow-paths.ts
+/**
+* The single definition of "workflow dir", shared by `repo:sync --check`'s advisory
+* classification and the workflow sync sweep's path allowlist -- so the two halves cannot
+* disagree about what counts as workflow output. Each prefix carries its trailing slash so a
+* file named e.g. `.github/workflowsX` never matches.
+*/
+const WORKFLOW_DIR_PREFIXES = [".forgejo/workflows/", ".github/workflows/"];
+/** True when `filePath` (repo-relative) lives under one of the workflow directories. */
+function isWorkflowDirPath(filePath) {
+	return WORKFLOW_DIR_PREFIXES.some((prefix) => filePath.startsWith(prefix));
+}
+//#endregion
+//#region src/commands/workflow-apt-steps.ts
+/** `apt-get install`, `apt install`, and either with options before the verb (`apt-get -y
+* install`). */
+const APT_INSTALL = /\bapt(?:-get)?(?:\s+-\S+)*\s+install\b/g;
+const COMMAND_END = /&&|\|\||;|\|/;
+/** Every readable `.yml`/`.yaml` file in the two workflow directories, as repo-relative paths. */
+function workflowFiles(targetDir) {
+	const files = [];
+	for (const prefix of WORKFLOW_DIR_PREFIXES) {
+		let names;
+		try {
+			names = readdirSync(path.join(targetDir, prefix));
+		} catch {
+			continue;
+		}
+		for (const name of names) {
+			if (!/\.ya?ml$/.test(name)) continue;
+			const relative = `${prefix}${name}`;
+			if (isReadableFile$1(path.join(targetDir, relative))) files.push(relative);
+		}
+	}
+	return files;
+}
+/** False for a directory, a dangling symlink, or anything `stat` refuses: an advisory never fails
+* the run it advises, so a file it cannot look at is skipped, not thrown on. */
+function isReadableFile$1(file) {
+	try {
+		return statSync(file).isFile();
+	} catch {
+		return false;
+	}
+}
+/** A file's text, or null when it cannot be read -- skipped for the same reason. */
+function readText(file) {
+	try {
+		return readFileSync(file, "utf8");
+	} catch {
+		return null;
+	}
+}
+/** A custom block's content lines, with the markers and every other comment line dropped (a
+* commented-out apt step has been removed) and `\`-continued lines joined. */
+function logicalLines(blockLines) {
+	const lines = [];
+	let pending = "";
+	for (const line of blockLines) {
+		if (line.trim().startsWith("#")) continue;
+		const trimmed = line.trimEnd();
+		if (trimmed.endsWith("\\")) {
+			pending += `${trimmed.slice(0, -1)} `;
+			continue;
+		}
+		lines.push(pending + line);
+		pending = "";
+	}
+	if (pending !== "") lines.push(pending);
+	return lines;
+}
+/** The packages one line installs, or none when it runs no apt install. */
+function packagesIn(line) {
+	const packages = [];
+	for (const match of line.matchAll(APT_INSTALL)) {
+		const command = line.slice(match.index + match[0].length).split(COMMAND_END)[0] ?? "";
+		for (const token of command.split(/\s+/)) {
+			if (token === "" || token.startsWith("-")) continue;
+			packages.push(token);
+		}
+	}
+	return packages;
+}
+/** True when `line` runs an apt install at all, packages or not. */
+function installsWithApt(line) {
+	return line.search(APT_INSTALL) !== -1;
+}
+function findWorkflowAptSteps(targetDir) {
+	const steps = [];
+	for (const file of workflowFiles(targetDir)) {
+		const content = readText(path.join(targetDir, file));
+		if (content === null || isToolingIgnored(content)) continue;
+		let matched = false;
+		const packages = /* @__PURE__ */ new Set();
+		for (const block of extractCustomBlocks(content)) for (const line of logicalLines(block.lines)) {
+			if (!installsWithApt(line)) continue;
+			matched = true;
+			for (const name of packagesIn(line)) packages.add(name);
+		}
+		if (matched) steps.push({
+			file,
+			packages: [...packages]
+		});
+	}
+	return steps.toSorted((a, b) => a.file.localeCompare(b.file));
+}
+//#endregion
 //#region src/commands/sync-gates.ts
 /**
 * The pre-generator gates and config diagnostics every `repo:sync` mode runs -- split out of
@@ -15619,6 +15719,23 @@ function runCheckOnlyImageGate(config, targetDir) {
 	return images;
 }
 /**
+* Warn, once per workflow file, when a `@tooling:custom` block installs packages with apt. CI's
+* job runs as root and can do that; the agent's containers run without root and cannot, so the
+* package is present in CI and missing in the agent's measurement of the same tree. Advisory like
+* {@link runCheckOnlyImageGate}, and for the same reason it returns the entries: `repo:sync
+* --check` folds their count into the `::bst-checks:: warn` marker. It never fails a run and never
+* edits the block -- not every Debian package has a conda equivalent under the same name, so moving
+* it is a human's call.
+*/
+function runWorkflowAptGate(targetDir) {
+	const steps = findWorkflowAptSteps(targetDir);
+	for (const step of steps) {
+		const packages = step.packages.length > 0 ? step.packages.join(", ") : "packages";
+		log$1.warn(`${step.file} installs ${packages} with apt in a custom block. The agent's containers cannot run that step, so its runs lack what CI has. Declare each tool in mise.toml as conda:<name> (both CI and the agent install from it), then remove the apt step.`);
+	}
+	return steps;
+}
+/**
 * Require a declared publish destination before any generator or apply step runs.
 * Returns the number of offenders (0 = clean). Each is emitted via `log.error` so
 * the user sees the full message and the fix.
@@ -15906,19 +16023,6 @@ function runToolchainGate(targetDir) {
 	};
 }
 //#endregion
-//#region src/utils/workflow-paths.ts
-/**
-* The single definition of "workflow dir", shared by `repo:sync --check`'s advisory
-* classification and the workflow sync sweep's path allowlist -- so the two halves cannot
-* disagree about what counts as workflow output. Each prefix carries its trailing slash so a
-* file named e.g. `.github/workflowsX` never matches.
-*/
-const WORKFLOW_DIR_PREFIXES = [".forgejo/workflows/", ".github/workflows/"];
-/** True when `filePath` (repo-relative) lives under one of the workflow directories. */
-function isWorkflowDirPath(filePath) {
-	return WORKFLOW_DIR_PREFIXES.some((prefix) => filePath.startsWith(prefix));
-}
-//#endregion
 //#region src/commands/repo-sync.ts
 const rawLog$1 = (msg) => console.log(msg);
 const syncCommand = defineCommand({
@@ -15958,7 +16062,7 @@ const syncCommand = defineCommand({
 		},
 		json: {
 			type: "boolean",
-			description: "Emit one JSON document: status (up-to-date | drift | workflow-drift | failed), actionable, failed, toolchain, checkOnlyImages, warnCount, exitCode. --check only: the write mode prompts and inherits child streams."
+			description: "Emit one JSON document: status (up-to-date | drift | workflow-drift | failed), actionable, failed, toolchain, checkOnlyImages, aptSteps, warnCount, exitCode. --check only: the write mode prompts and inherits child streams."
 		}
 	},
 	async run({ args }) {
@@ -16035,6 +16139,7 @@ function gateFailure(toolchainWarned = false) {
 		failed: [],
 		toolchain: { warned: toolchainWarned },
 		checkOnlyImages: [],
+		aptSteps: [],
 		warnCount: 0,
 		exitCode: 1
 	};
@@ -16045,8 +16150,8 @@ function gateFailure(toolchainWarned = false) {
 * withheld -- the same number rides in `warnCount`, and printing both would put a second thing on
 * the stream beside the payload.
 */
-function upToDateReport(toolchain, checkOnlyImages) {
-	const warnCount = (toolchain.warned ? 1 : 0) + checkOnlyImages.length;
+function upToDateReport(toolchain, checkOnlyImages, aptSteps) {
+	const warnCount = (toolchain.warned ? 1 : 0) + checkOnlyImages.length + aptSteps.length;
 	if (warnCount > 0) {
 		if (!isJsonMode()) rawLog$1(formatWarnMarker(warnCount));
 	} else log$1.success("Repository is up to date.");
@@ -16056,6 +16161,7 @@ function upToDateReport(toolchain, checkOnlyImages) {
 		failed: [],
 		toolchain,
 		checkOnlyImages,
+		aptSteps,
 		warnCount,
 		exitCode: 0
 	};
@@ -16091,28 +16197,30 @@ async function runCheckReport(targetDir) {
 		toolchain: { warned: toolchain.warned }
 	};
 	const checkOnlyImages = runCheckOnlyImageGate(config, targetDir);
+	const aptSteps = runWorkflowAptGate(targetDir);
 	const { ctx, pendingWrites } = createDryRunContext(config);
 	logDetectionSummary(ctx);
 	const results = await runGenerators(ctx);
 	const failed = failedResults(results);
 	reportFailures(failed, "repo:sync");
 	const actionable = actionableResults(results, pendingWrites, targetDir);
-	const toolchainWarnCount = (toolchain.warned ? 1 : 0) + checkOnlyImages.length;
+	const advisoryWarnCount = (toolchain.warned ? 1 : 0) + checkOnlyImages.length + aptSteps.length;
 	const toolchainState = { warned: toolchain.warned };
-	if (actionable.length === 0 && failed.length === 0) return upToDateReport(toolchainState, checkOnlyImages);
+	if (actionable.length === 0 && failed.length === 0) return upToDateReport(toolchainState, checkOnlyImages, aptSteps);
 	if (actionable.length === 0) return {
 		status: "failed",
 		actionable: [],
 		failed,
 		toolchain: toolchainState,
 		checkOnlyImages: [],
+		aptSteps: [],
 		warnCount: 0,
 		exitCode: 1
 	};
 	log$1.warn(`${actionable.length} file(s) would be changed by repo:sync`);
 	for (const r of actionable) logActionableChange(r, targetDir, pendingWrites);
 	if (failed.length === 0 && actionable.every((r) => isWorkflowDirPath(r.filePath))) {
-		const warnCount = actionable.length + toolchainWarnCount;
+		const warnCount = actionable.length + advisoryWarnCount;
 		if (!isJsonMode()) rawLog$1(formatWarnMarker(warnCount));
 		return {
 			status: "workflow-drift",
@@ -16120,6 +16228,7 @@ async function runCheckReport(targetDir) {
 			failed: [],
 			toolchain: toolchainState,
 			checkOnlyImages,
+			aptSteps,
 			warnCount,
 			exitCode: 0
 		};
@@ -16130,6 +16239,7 @@ async function runCheckReport(targetDir) {
 		failed,
 		toolchain: toolchainState,
 		checkOnlyImages: [],
+		aptSteps: [],
 		warnCount: 0,
 		exitCode: 1
 	};
@@ -16324,6 +16434,9 @@ const PullListItemSchema = z.object({
 	updated_at: z.string().nullish(),
 	labels: z.array(z.object({ name: z.string() })).nullish()
 });
+function updatedBefore(since) {
+	return (pr) => pr.updatedAt !== null && Date.parse(pr.updatedAt) < since;
+}
 /**
 * Every pull request -- open, merged, and closed-unmerged -- by default, via `state=all`; a caller
 * may narrow the read with {@link ListPullsOptions.state}. Paged to an empty page or to
@@ -16351,7 +16464,9 @@ async function listPulls(executor, conn, options = {}) {
 			limit: String(PULLS_PAGE_SIZE),
 			page: String(page)
 		});
-		if (options.sort !== void 0) params.set("sort", options.sort);
+		const sort = options.updatedSince === void 0 ? options.sort : "recentupdate";
+		if (sort !== void 0) params.set("sort", sort);
+		for (const id of options.labelIds ?? []) params.append("labels", String(id));
 		const url = `${conn.serverUrl}/api/v1/repos/${conn.repository}/pulls?${params.toString()}`;
 		const res = await executor.fetch(url, {
 			headers,
@@ -16380,6 +16495,7 @@ async function listPulls(executor, conn, options = {}) {
 		pulls.push(...items);
 		if (items.length === 0) break;
 		if (options.stopWhen !== void 0 && items.some(options.stopWhen)) break;
+		if (options.updatedSince !== void 0 && items.some(updatedBefore(options.updatedSince))) break;
 		if (options.limit !== void 0 && pulls.length >= options.limit) break;
 		if (page === PULLS_MAX_PAGES) {
 			log.warn(`PR listing on ${conn.repository} hit the ${String(PULLS_MAX_PAGES)}-page cap without an empty page; results may be truncated`);
@@ -21137,7 +21253,7 @@ function createRealLintTypesExecutor() {
 }
 //#endregion
 //#region src/lint-types/phase.ts
-const LINT_TYPES_PHASE = "report";
+const LINT_TYPES_PHASE = "enforce";
 //#endregion
 //#region src/lint-types/report.ts
 /** oxlint spells a rule code `plugin(rule)` (e.g. `typescript(no-base-to-string)`); the escape
@@ -21158,8 +21274,8 @@ function formatFindingLine(diagnostic) {
 	return `${span?.line !== void 0 && span.column !== void 0 ? `${diagnostic.filename}:${String(span.line)}:${String(span.column)}` : diagnostic.filename}  ${formatRuleCode(diagnostic.code)}  ${diagnostic.message}`;
 }
 /**
-* Names no date: the enforce release has none, and inventing one the fleet cannot meet is
-* worse than naming none.
+* Prints only when the phase is pinned to "report". Names no date: inventing one the fleet
+* cannot meet is worse than naming none.
 */
 const CONSEQUENCE_LINE = "These will block once a future release of the tooling flips lint:types from the report phase to the enforce phase.";
 const ESCAPE_HATCHES = ["  - Turn a rule off in this repo's own oxlint.config.ts (e.g. \"typescript/<rule>\": \"off\") -- plain `pnpm lint` ignores type-aware rules entirely, so this never weakens it.", "  - Skip the step entirely with .tooling.json#checks.skip: [\"lint:types\"]."];
@@ -21363,7 +21479,7 @@ function runLintTypes(executor, targetDir, extraArgs = []) {
 const lintTypesCommand = defineCommand({
 	meta: {
 		name: "lint:types",
-		description: "Run oxlint --type-aware (backed by oxlint-tsgolint) and report every type-aware finding, selected by subtracting a plain oxlint run. Report phase: prints findings, states they will block once a future tooling release flips to the enforce phase, exits 0 unless .tooling.json#lint.strictTypeAware is set. When findings do not block, the last stdout line is the ::bst-checks:: warn marker."
+		description: "Run oxlint --type-aware (backed by oxlint-tsgolint) and report every type-aware finding, selected by subtracting a plain oxlint run. Enforce phase: prints findings and exits 1 when there are any. .tooling.json#lint.strictTypeAware makes a missing oxlint-tsgolint binary a failure instead of a notice."
 	},
 	args: {
 		dir: {
@@ -32843,7 +32959,7 @@ setForgejoLogger(log$1);
 * `local <sha>[-dirty]` otherwise -- so an artifact built from the working tree
 * can't pass itself off as the published release whose version it carries.
 */
-const displayVersion = "0.86.1";
+const displayVersion = "0.87.0";
 /**
 * The registered `bst` subcommand map, exported so both the JSON entry path below (resolving a
 * command name before citty parses anything) and the coverage test (enumerating every