@bensandee/tooling 0.87.0 → 0.87.1

package/dist/bin.mjs

@@ -269,7 +269,7 @@ function loadEnvFileForBin(rawArgs, bin, io = processIo) {
 */
 const envFileLoad = loadEnvFileForBin(process.argv.slice(2), {
 	name: "bst",
-	version: "0.87.0"
+	version: "0.87.1"
 });
 //#endregion
 //#region ../cli-kit/src/logger.ts
@@ -3050,57 +3050,6 @@ function loadRegistryHostOverride(cwd) {
 	}
 }
 //#endregion
-//#region src/utils/generated-header.ts
-/**
-* Leading comment headers for fully generated files.
-*
-* These mark a file as managed by `@bensandee/tooling` so a reader knows that
-* `bst repo:sync` may overwrite it, and points at the supported ways to keep
-* custom content. Only used for files that are largely (re)generated wholesale
-* -- not for files that are merged into (package.json, tsconfig.json, etc.).
-*/
-/**
-* Stable substring present in every managed-file header. Used to detect whether an
-* existing file already carries the *current* header -- a comment-only difference is
-* invisible to `normalizeWorkflow()` (it strips comments before comparing), so generators
-* check for this marker to know a one-time header upgrade is still needed.
-*
-* The trailing `--` is load-bearing: it is what made the 2026-07-27 ASCII fix reach files
-* that were already synced. Widen this marker whenever the header's leading text changes,
-* or the change lands in the template and never in anyone's repo.
-*/
-const MANAGED_HEADER_MARKER = "Managed by @bensandee/tooling --";
-/** Render a comment block: each line is prefixed with `comment`; empty lines stay bare. */
-function managedFileHeader(comment, lines) {
-	return lines.map((line) => line === "" ? comment : `${comment} ${line}`).join("\n") + "\n";
-}
-/**
-* Header for generated CI workflow files (`ci.yml`, `release.yml`).
-*
-* The literal `@bensandee/tooling:ignore` directive is kept mid-line on purpose so
-* `isToolingIgnored()` (which looks for the directive at the start of a comment) does
-* not mistake this header for an opt-out.
-*/
-const WORKFLOW_MANAGED_HEADER = managedFileHeader("#", [
-	"Managed by @bensandee/tooling -- `bst repo:sync` regenerates this workflow,",
-	"so direct edits are overwritten on the next sync.",
-	"To preserve changes, wrap them between `# @tooling:custom` and",
-	"`# @tooling:endcustom` markers, or stop managing this file by making",
-	"`# @bensandee/tooling:ignore` the first line."
-]);
-/** Header for the generated `lefthook.yml` pre-commit config. */
-const LEFTHOOK_MANAGED_HEADER = managedFileHeader("#", [
-	"Managed by @bensandee/tooling -- `bst repo:sync` keeps the `lint` and",
-	"`format` pre-commit commands current. Other commands you add are preserved.",
-	"To stop managing this file, make `# @bensandee/tooling:ignore` the first line."
-]);
-/**
-* Header for a generated agent guide (`.agent/guides/*.md`). One line, because guide ownership
-* is decided by the marker on the first line alone. It spells the ignore directive out in words
-* rather than as the literal comment, which would close this one early.
-*/
-const GUIDE_MANAGED_HEADER = "<!-- Managed by @bensandee/tooling -- `bst repo:sync` rewrites this guide and archives local edits. To keep your own version, make the first line an HTML comment reading @bensandee/tooling:ignore. -->\n";
-//#endregion
 //#region src/utils/debug.ts
 const verboseLogger = createLogger({ level: "trace" });
 /** Check if verbose/debug mode is enabled via environment variables. */
@@ -5684,6 +5633,136 @@ function contextAsDockerReader(ctx) {
 	};
 }
 //#endregion
+//#region src/release/publish/publish-config-lint.ts
+const FIX = `add "publishConfig": { "registry": "<your registry URL>" } to its package.json`;
+/**
+* Whether a value can serve as a publish destination: an absolute http(s) URL.
+* Presence alone is not the test -- a relative or empty registry is as silently
+* wrong as an absent one, and npm resolves neither to the place the author meant.
+*/
+function isUsableRegistry(value) {
+	if (typeof value !== "string" || value.trim() === "") return false;
+	try {
+		const url = new URL(value);
+		return url.protocol === "https:" || url.protocol === "http:";
+	} catch {
+		return false;
+	}
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* Require every package this repo would publish to declare where it publishes.
+*
+* npm and pnpm use one `registry` key for reads and writes alike, so a project
+* `.npmrc` aimed at an install cache silently repoints `pnpm publish` too. A
+* package that never declares its destination inherits one, and an inherited
+* destination can be changed by a file that never mentions publishing.
+*
+* Reports rather than repairs: the correct registry is not derivable here, and
+* writing a guess would redirect a working release exactly the way this gate
+* exists to prevent.
+*/
+function lintPublishConfig(targetDir, structure) {
+	const issues = [];
+	for (const pkg of getPublishablePackages(targetDir, structure)) {
+		const manifest = readPackageJson(pkg.dir);
+		if (!manifest) continue;
+		const file = path.relative(targetDir, path.join(pkg.dir, "package.json"));
+		const pc = manifest.publishConfig;
+		const registry = isRecord(pc) ? pc["registry"] : void 0;
+		if (registry === void 0) {
+			issues.push({
+				kind: "missing",
+				package: pkg.name,
+				file,
+				message: `${pkg.name} is published from this repo but declares no publishConfig.registry, so its release destination is inherited -- a project .npmrc can repoint it silently. In ${file}, ${FIX}.`
+			});
+			continue;
+		}
+		if (!isUsableRegistry(registry)) issues.push({
+			kind: "malformed",
+			package: pkg.name,
+			file,
+			message: `${pkg.name} declares publishConfig.registry as ${JSON.stringify(registry)}, which is not an absolute http(s) URL and cannot be published to. In ${file}, ${FIX}.`
+		});
+	}
+	return issues;
+}
+/**
+* The registries this repo's publishable packages actually declare, distinct and in
+* first-seen order.
+*
+* Reuses the same "absolute http(s) URL" narrowing as {@link lintPublishConfig} rather
+* than re-deriving it -- a registry this misses here would fail that gate first, so
+* `repo:sync` never reaches a generator with an undeclared or malformed registry. A
+* caller that invokes a generator directly (or a repo whose publishable set is empty,
+* e.g. every package private) still gets a safe empty result.
+*/
+function declaredPublishRegistries(targetDir, structure, rootPackageJson) {
+	const registries = [];
+	for (const pkg of getPublishablePackages(targetDir, structure, rootPackageJson)) {
+		const manifest = structure === "single" ? rootPackageJson ?? readPackageJson(pkg.dir) : readPackageJson(pkg.dir);
+		if (!manifest) continue;
+		const pc = manifest.publishConfig;
+		const registry = isRecord(pc) ? pc["registry"] : void 0;
+		if (typeof registry === "string" && isUsableRegistry(registry) && !registries.includes(registry)) registries.push(registry);
+	}
+	return registries;
+}
+//#endregion
+//#region src/utils/generated-header.ts
+/**
+* Leading comment headers for fully generated files.
+*
+* These mark a file as managed by `@bensandee/tooling` so a reader knows that
+* `bst repo:sync` may overwrite it, and points at the supported ways to keep
+* custom content. Only used for files that are largely (re)generated wholesale
+* -- not for files that are merged into (package.json, tsconfig.json, etc.).
+*/
+/**
+* Stable substring present in every managed-file header. Used to detect whether an
+* existing file already carries the *current* header -- a comment-only difference is
+* invisible to `normalizeWorkflow()` (it strips comments before comparing), so generators
+* check for this marker to know a one-time header upgrade is still needed.
+*
+* The trailing `--` is load-bearing: it is what made the 2026-07-27 ASCII fix reach files
+* that were already synced. Widen this marker whenever the header's leading text changes,
+* or the change lands in the template and never in anyone's repo.
+*/
+const MANAGED_HEADER_MARKER = "Managed by @bensandee/tooling --";
+/** Render a comment block: each line is prefixed with `comment`; empty lines stay bare. */
+function managedFileHeader(comment, lines) {
+	return lines.map((line) => line === "" ? comment : `${comment} ${line}`).join("\n") + "\n";
+}
+/**
+* Header for generated CI workflow files (`ci.yml`, `release.yml`).
+*
+* The literal `@bensandee/tooling:ignore` directive is kept mid-line on purpose so
+* `isToolingIgnored()` (which looks for the directive at the start of a comment) does
+* not mistake this header for an opt-out.
+*/
+const WORKFLOW_MANAGED_HEADER = managedFileHeader("#", [
+	"Managed by @bensandee/tooling -- `bst repo:sync` regenerates this workflow,",
+	"so direct edits are overwritten on the next sync.",
+	"To preserve changes, wrap them between `# @tooling:custom` and",
+	"`# @tooling:endcustom` markers, or stop managing this file by making",
+	"`# @bensandee/tooling:ignore` the first line."
+]);
+/** Header for the generated `lefthook.yml` pre-commit config. */
+const LEFTHOOK_MANAGED_HEADER = managedFileHeader("#", [
+	"Managed by @bensandee/tooling -- `bst repo:sync` keeps the `lint` and",
+	"`format` pre-commit commands current. Other commands you add are preserved.",
+	"To stop managing this file, make `# @bensandee/tooling:ignore` the first line."
+]);
+/**
+* Header for a generated agent guide (`.agent/guides/*.md`). One line, because guide ownership
+* is decided by the marker on the first line alone. It spells the ignore directive out in words
+* rather than as the literal comment, which would close this one early.
+*/
+const GUIDE_MANAGED_HEADER = "<!-- Managed by @bensandee/tooling -- `bst repo:sync` rewrites this guide and archives local edits. To keep your own version, make the first line an HTML comment reading @bensandee/tooling:ignore. -->\n";
+//#endregion
 //#region src/utils/yaml-merge.ts
 const IGNORE_PATTERN = "@bensandee/tooling:ignore";
 const CUSTOM_START = "# @tooling:custom";
@@ -5992,535 +6071,790 @@ function buildWorkflowYaml(options) {
 	return ensureSchemaComment(WORKFLOW_MANAGED_HEADER + "\n" + readable, options.ci);
 }
 //#endregion
-//#region src/generators/publish-ci.ts
-const RegistryHostSchema = z.object({ registryHost: z.string().optional() });
+//#region src/generators/mise-pin.ts
 /**
-* Resolve the docker-registry host at gen time so the workflow generator can
-* pick registry-specific secret names. Honors `.tooling.json#registryHost`
-* first, then git remote `origin` (the operational host, not a mirror-pointed
-* package.json), then derives from `package.json#repository` using the same
-* parser as the runtime (`parseGitUrl` handles https, git+https, and ssh shapes).
-* Returns null if neither source yields a host -- in that case the generator
-* falls back to neutral `REGISTRY_USERNAME` / `REGISTRY_PASSWORD` secrets and
-* lets the runtime resolve the host from `DOCKER_REGISTRY_HOST` (still emitted
-* into the step).
+* The mise version and release-asset digest the fleet's CI and the agent runner base image agree
+* to run. This is the one place that agreement is recorded; `packages/agent/test/runner-base-image-dockerfile.test.ts`
+* (task 8 of the mise-toolchain-provisioning plan) reads both constants back through
+* `readRepoFile` and asserts the base image's own `ARG MISE_VERSION` and `mise.sha256` manifest
+* agree with them, so the two packages cannot drift without a failing test on either side.
+*
+* Each constant sits under its own `// renovate:` marker comment, in the three-line grammar
+* `packages/agent/docker/agent-goose-image/goose.sha256` uses for its own digest line, so the same
+* shape of custom regex manager in the root `renovate.json` can rewrite both this version and this
+* digest (`customManagers` entries scoped to this file).
 */
-function resolveGenTimeHost(ctx) {
-	const toolingRaw = ctx.read(".tooling.json");
-	if (toolingRaw) try {
-		const parsed = RegistryHostSchema.safeParse(JSON.parse(toolingRaw));
-		if (parsed.success && parsed.data.registryHost && parsed.data.registryHost.length > 0) return parsed.data.registryHost;
-	} catch (error) {
-		log$1.warn(`Failed to parse .tooling.json: ${error instanceof Error ? error.message : error}`);
-	}
-	const originUrl = detectGitRemoteUrl(ctx.targetDir);
-	if (originUrl !== null) {
-		const parsedOrigin = parseGitUrl(originUrl);
-		if (parsedOrigin) return registryHostFromHostname(parsedOrigin.hostname);
-	}
-	const raw = ctx.read("package.json");
-	if (!raw) return null;
-	const repo = parsePackageJson(raw)?.repository;
-	let urlStr = null;
-	if (typeof repo === "string") urlStr = repo;
-	else if (repo && typeof repo === "object") urlStr = repo.url;
-	if (typeof urlStr !== "string") return null;
-	const parsed = parseGitUrl(urlStr);
-	if (!parsed) return null;
-	return registryHostFromHostname(parsed.hostname);
+const MISE_VERSION = "2026.10.3";
+const MISE_LINUX_X64_SHA256 = "8d48bc510b7d844fad0bc7156c0855c2a1e7230c51e498a7f6b63b021f8b57c5";
+/** Where generated Forgejo workflows fetch the shared mise setup action: a composite action in
+* `bensandee/common`, on the forge every fleet repo lives on. GitHub cannot reach it; the
+* generators keep inline steps there. */
+const SETUP_MISE_ACTION_URL = "https://code.orangebikelabs.com/bensandee/common/actions/setup-mise";
+/** The tag in `bensandee/common` that marks the current release of the action. Generated `uses:`
+* lines carry it as their comment, and Renovate moves the SHA below to wherever it points. */
+const SETUP_MISE_ACTION_TAG = "setup-mise@latest";
+const SETUP_MISE_ACTION_SHA = "db99e4e9ee46bfeaca2146e7ae55cc700b4c23bf";
+//#endregion
+//#region src/generators/ci-utils.ts
+/** Build a GitHub Actions expression like `${{ expr }}` without triggering no-template-curly-in-string. */
+function actionsExpr(expr) {
+	return `\${{ ${expr} }}`;
 }
-const PostReleaseHookSchema = z.object({
-	postReleaseHook: z.string().optional(),
-	postReleaseHookSecrets: z.array(z.string()).optional()
-});
-const ReleaseAssetsSchema = z.object({ releaseAssets: z.array(ReleaseAssetSchema).optional() });
-const VersionStampConfigSchema = z.object({ versionStamp: z.array(VersionStampSchema).optional() });
-const DeploySchema = z.object({ deploy: DeployConfigSchema.optional() });
+const MAIN_BRANCH_REF = "refs/heads/main";
+/** `if:` condition that gates a step to push events on the default branch. */
+const IS_MAIN_BRANCH = `github.ref == '${MAIN_BRANCH_REF}'`;
 /**
-* Read the `deploy` block from .tooling.json, if configured.
+* Negated form for concurrency `cancel-in-progress` and similar uses.
 *
-* The full file is already validated against ToolingConfigSchema at sync time,
-* so an invalid `deploy` block fails earlier -- undefined here means "not set".
-*/
-function getDeployConfig(ctx) {
-	const raw = ctx.read(".tooling.json");
-	if (!raw) return void 0;
-	try {
-		const result = DeploySchema.safeParse(JSON.parse(raw));
-		if (!result.success) return void 0;
-		return result.data.deploy;
-	} catch (error) {
-		log$1.warn(`Failed to parse .tooling.json: ${error instanceof Error ? error.message : error}`);
-		return;
-	}
-}
-/** Read the postReleaseHook command override from .tooling.json, if configured. */
-function getPostReleaseHookCommand(ctx) {
-	const raw = ctx.read(".tooling.json");
-	if (!raw) return void 0;
-	try {
-		const result = PostReleaseHookSchema.safeParse(JSON.parse(raw));
-		if (!result.success) return void 0;
-		return result.data.postReleaseHook;
-	} catch (error) {
-		log$1.warn(`Failed to parse .tooling.json: ${error instanceof Error ? error.message : error}`);
-		return;
-	}
-}
-/** Read the postReleaseHookSecrets array from .tooling.json, if configured. */
-function getPostReleaseHookSecrets(ctx) {
-	const raw = ctx.read(".tooling.json");
-	if (!raw) return void 0;
-	try {
-		const result = PostReleaseHookSchema.safeParse(JSON.parse(raw));
-		if (!result.success) return void 0;
-		return result.data.postReleaseHookSecrets;
-	} catch (error) {
-		log$1.warn(`Failed to parse .tooling.json: ${error instanceof Error ? error.message : error}`);
-		return;
-	}
-}
+* Main is exempt from cancellation on purpose, and the exemption stays: a main run publishes and
+* pushes tags, and cancelling one mid-flight can leave a partial publish -- some packages on the
+* registry, no matching tags, and no run left alive to finish. A superseded feature-branch run
+* wastes minutes; a half-published release costs a manual unwind.
+*
+* So several main runs can be in flight at once, each versioning from its own triggering commit.
+* Overlap safety rests on one invariant: **main advances solely via commits that trigger a CI
+* run.** The `[skip ci]` coverage, health, and egress records go to `bst/*` orphan branches and
+* never to main; a `[skip ci]` commit pushed straight to main would leave a superseded run skipping
+* and its changesets stranded until the next push, which is why the supersession guard skips rather
+* than fails. Three guards carry the overlap itself: supersession plus a `--force-with-lease`
+* version push (`release/publish/version.ts`), the `headBumpedVersion` publish guard plus reading
+* remote tags and releases before acting (`commands/release-changesets.ts`,
+* `release/publish/publish.ts`), and floating git and Docker tags that only move forward
+* (`release/publish/floating-tags.ts`, `release/docker.ts`). Such a run may also version pending
+* changesets after it publishes -- the stale version-PR merge -- under the same supersession guard
+* and push lease as any other version run. A later commit publishes a bump only when its tag is
+* missing and every main run since the package's last release tag has settled
+* (`release/publish/unpublished-bump.ts`), so no run that could still publish it is in flight; a
+* manual re-run of one of those runs is the overlap left. On Forgejo the concurrency block is
+* only a PR-run cancellation mechanism -- it holds a main run in its group and, in Forgejo 16,
+* intermittently fails to release it, which is why main runs get a group of their own there. GitHub's shape stays shared
+* because its queue works: one run, one pending, a newer arrival replacing the pending, so
+* `changesets/action@v1` never needs a guard of its own. Any new side effect in a main run must be
+* idempotent under overlap or be listed here with the guard that makes it so.
+*/
+const IS_NOT_MAIN_BRANCH = `github.ref != '${MAIN_BRANCH_REF}'`;
 /**
-* Names of the Docker images `detectDockerPackages` discovers for this repo --
-* by package convention, compose service, or `.tooling.json#docker` override.
-* Routed through the same chokepoint every other Docker consumer uses, so a
-* compose-only image (no convention Dockerfile, no override) still gates the
-* scripts and workflow steps below instead of silently dropping them.
+* Job-level `env:` block that evaluates the default-branch check once, so steps
+* can gate on `env.IS_MAIN` instead of repeating the `github.ref` expression.
 */
-function getDockerPackageNames(ctx) {
-	return detectContextDockerPackages(ctx).map((pkg) => pkg.imageName);
-}
-/** Check whether any Docker packages exist by convention or .tooling.json config. */
-function hasDockerPackages(ctx) {
-	return getDockerPackageNames(ctx).length > 0;
-}
-/** Paths (relative to repo root) of packages whose package.json has a `build:release-assets` script. */
-function detectReleaseAssetsConventionDirs(ctx) {
-	const dirs = [];
-	if (ctx.config.structure === "monorepo") {
-		const packages = getMonorepoPackages(ctx.targetDir);
-		for (const pkg of packages) {
-			const dirName = pkg.name.split("/").pop() ?? pkg.name;
-			const pkgRaw = ctx.read(`packages/${dirName}/package.json`);
-			if (!pkgRaw) continue;
-			if (parsePackageJson(pkgRaw)?.scripts?.["build:release-assets"]) dirs.push(`packages/${dirName}`);
-		}
-	} else {
-		const pkgRaw = ctx.read("package.json");
-		if (pkgRaw) {
-			if (parsePackageJson(pkgRaw)?.scripts?.["build:release-assets"]) dirs.push(".");
-		}
-	}
-	return dirs;
-}
-/** Check whether release assets are configured by convention or in .tooling.json. */
-function hasReleaseAssets(ctx) {
-	if (detectReleaseAssetsConventionDirs(ctx).length > 0) return true;
-	const raw = ctx.read(".tooling.json");
-	if (!raw) return false;
-	try {
-		const result = ReleaseAssetsSchema.safeParse(JSON.parse(raw));
-		if (!result.success) return false;
-		return !!result.data.releaseAssets && result.data.releaseAssets.length > 0;
-	} catch (error) {
-		log$1.warn(`Failed to parse .tooling.json: ${error instanceof Error ? error.message : error}`);
-		return false;
-	}
-}
+const IS_MAIN_JOB_ENV = { IS_MAIN: actionsExpr(IS_MAIN_BRANCH) };
+/** `if:` condition referencing the job-level `IS_MAIN` env var (see {@link IS_MAIN_JOB_ENV}). */
+const IS_MAIN_ENV_GUARD = "env.IS_MAIN == 'true'";
 /**
-* Check whether the repo configures `versionStamp`. A repo with a `versionStamp` block but no
-* `releaseAssets` and no `build:release-assets` script would otherwise get no assets step, and
-* nothing would ever run the stamp -- see the two `hasReleaseAssets(ctx) || hasVersionStamp(ctx)`
-* call sites in `ci.ts` and `release-ci.ts`. Deliberately not folded into `hasReleaseAssets`
-* itself: `gitignore.ts` shares that predicate to decide whether to ignore `release-assets/`, and
-* a stamp-only repo produces no such directory.
+* npm's own registry-key rule for an `.npmrc` auth line: strip the scheme, keep
+* host/port/path, and end with exactly one slash. `actions/setup-node` derives the
+* same key from a registry URL; this mirrors that so a hand-written line matches
+* what npm looks up at publish time -- npm-registry-fetch walks the request path
+* upward through ancestor keys until one matches.
 */
-function hasVersionStamp(ctx) {
-	const raw = ctx.read(".tooling.json");
-	if (!raw) return false;
-	try {
-		const result = VersionStampConfigSchema.safeParse(JSON.parse(raw));
-		if (!result.success) return false;
-		return !!result.data.versionStamp && result.data.versionStamp.length > 0;
-	} catch (error) {
-		log$1.warn(`Failed to parse .tooling.json: ${error instanceof Error ? error.message : error}`);
-		return false;
-	}
+function npmrcAuthKey(registryUrl) {
+	return `${registryUrl.replace(/^https?:/i, "").replace(/\/+$/, "")}/`;
 }
-/** Where `ctx.remove()` puts what it archives. Named here only to describe it to the user. */
-const ARCHIVE_DIR$2 = ".tooling-archived";
+const NODE_AUTH_TOKEN_VAR = ["$", "{NODE_AUTH_TOKEN}"].join("");
 /**
-* Archive the manual `publish.yml` this generator used to write; it writes nothing. Docker
-* images publish from the release workflow, and the manual workflow was a thin wrapper around
-* `bst docker:publish` that nobody ran -- run that command instead. Only a file carrying the
-* managed header is removed: a hand-written `publish.yml`, or one opted out with the ignore
-* comment, belongs to the repo.
+* Build both halves of a job's npm auth wiring together, so one value decides
+* them: the auth lines the publishing step writes, and the step-level
+* `NODE_AUTH_TOKEN` it carries. A job that gets none of the declared registries
+* gets neither -- including a `publishes: true` job whose publishable set is
+* empty (every package private), since there is then no npmrc line for a real
+* secret to pair with.
+*
+* The lines go into a temp userconfig exported only inside the publishing
+* step's shell, never `~/.npmrc` or `$GITHUB_ENV`: pnpm 11 warns
+* `Failed to replace env in config` on every call that reads the placeholder
+* while the token is unset or empty, so a line in a shared file makes install, `ci:check`,
+* and every step after the publish warn. An empty job-level default does not
+* silence it, and `${NODE_AUTH_TOKEN:-}` is rejected as an empty fallback and
+* warns in every case. The `-n` guard keeps a run without the secret quiet; the
+* single quotes keep the token itself off disk, since npm expands it at read time.
 */
-async function generateDeployCi(ctx) {
-	const filePath = "deploy-ci";
-	if (ctx.config.ci === "none") return {
-		filePath,
-		action: "skipped",
-		description: "Publish workflow not applicable"
-	};
-	const workflowPath = ctx.config.ci === "github" ? ".github/workflows/publish.yml" : ".forgejo/workflows/publish.yml";
-	const existing = ctx.read(workflowPath);
-	if (existing === void 0) return {
-		filePath,
-		action: "skipped",
-		description: "No publish workflow to retire"
-	};
-	if (isToolingIgnored(existing) || !existing.includes("Managed by @bensandee/tooling --")) return {
-		filePath: workflowPath,
-		action: "skipped",
-		description: "Publish workflow is not managed by tooling"
-	};
-	ctx.remove(workflowPath);
-	return {
-		filePath: workflowPath,
-		action: "removed",
-		description: `Moved to ${ARCHIVE_DIR$2}/${workflowPath} (run \`bst docker:publish\` to publish by hand)`
+function npmAuthWiring(ctx, publishes) {
+	const registries = publishes ? declaredPublishRegistries(ctx.targetDir, ctx.config.structure, ctx.packageJson) : [];
+	if (registries.length === 0) return {
+		publishRun: (command) => command,
+		tokenEnv: {}
 	};
-}
-//#endregion
-//#region src/codebase-health/config.ts
-const DEFAULT_HEALTH_HISTORY_BRANCH = "bst/health-metrics";
-const TS_EXTENSIONS = [".ts", ".tsx"];
-const JS_EXTENSIONS = [
-	".js",
-	".jsx",
-	".mjs",
-	".cjs"
-];
-const DEFAULT_DIRECTORY_FILE_LIMIT = 20;
-const DEFAULT_FAN_LIMIT = 10;
-const DEFAULT_MODULE_SIZE_LIMIT = 200;
-/** The extensions dependency-cruiser should glob for a given stack. */
-function defaultExtensions(stack) {
-	if (stack === "typescript") return TS_EXTENSIONS;
-	if (stack === "javascript") return JS_EXTENSIONS;
-	return [];
-}
-/** Tolerant of a key `health` does not declare, shared by both entry points below:
-* `resolveHealthConfig` (the CLI) and `resolveHealthConfigFromContext` (the generator). The
-* generator's own caller runs behind `repo:sync`'s strict root read, which has already
-* rejected the document, so leniency here is unreachable there rather than a semantic change
-* for that path. */
-const ToolingShallowSchema$2 = z.object({ health: tolerantBlock(HealthConfigSchema).optional() });
-function defaultSrc(isMonorepo) {
-	return isMonorepo ? ["packages/*/src"] : ["src"];
-}
-function resolveFromOverrides(overrides, isMonorepo, stack) {
-	const o = overrides ?? {};
-	const enabled = o.enabled === true;
+	const setup = [
+		"if [ -n \"$NODE_AUTH_TOKEN\" ]; then",
+		"  NPM_CONFIG_USERCONFIG=\"$(mktemp)\"",
+		"  export NPM_CONFIG_USERCONFIG",
+		"  if [ -f ~/.npmrc ]; then cat ~/.npmrc > \"$NPM_CONFIG_USERCONFIG\"; fi",
+		...registries.map((registry) => `  printf '\\n%s\\n' '${npmrcAuthKey(registry)}:_authToken=${NODE_AUTH_TOKEN_VAR}' >> "$NPM_CONFIG_USERCONFIG"`),
+		"fi"
+	];
 	return {
-		enabled,
-		src: o.src ?? defaultSrc(isMonorepo),
-		exclude: o.exclude ?? [],
-		extensions: o.extensions ?? defaultExtensions(stack),
-		directoryFileLimit: o.directoryFileLimit ?? DEFAULT_DIRECTORY_FILE_LIMIT,
-		fanInLimit: o.fanInLimit ?? DEFAULT_FAN_LIMIT,
-		fanOutLimit: o.fanOutLimit ?? DEFAULT_FAN_LIMIT,
-		moduleSizeLimit: o.moduleSizeLimit ?? DEFAULT_MODULE_SIZE_LIMIT,
-		crossPackage: o.crossPackage ?? true,
-		historyEnabled: enabled && o.history !== "none",
-		historyBranch: o.historyBranch ?? DEFAULT_HEALTH_HISTORY_BRANCH,
-		tolerance: o.tolerance ?? 0,
-		graphMetricsEnabled: stack !== "none",
-		exempt: o.exempt ?? {}
+		publishRun: (command) => [...setup, command].join("\n"),
+		tokenEnv: { NODE_AUTH_TOKEN: actionsExpr("secrets.NPM_TOKEN") }
 	};
 }
-function resolveHealthConfigFromContext(reader, opts) {
-	return resolveFromOverrides(parseToolingConfigSlice(reader.read(".tooling.json"), ToolingShallowSchema$2, { block: "health" })?.health, opts.isMonorepo, reader.config.stack);
-}
+const MISE_RELEASE_URL = `https://github.com/jdx/mise/releases/download/v${MISE_VERSION}/mise-v${MISE_VERSION}-linux-x64`;
 /**
-* The two facts about a tree that `resolveHealthConfig` detects but does not return: the stack and
-* whether it is a monorepo. Exported for `health:check`'s reference read, which must resolve the
-* default branch's `health` block with the *same* context the working tree's block was resolved
-* with -- and which therefore has to come out of this module rather than a fresh import, because
-* the command that needs it sits at its fan-out ceiling.
+* The node script `inlineMiseSteps` pipes `mise env --json` into, run under the mise it just
+* installed. Reads the env map off stdin (mise exec passes it straight through) and exports every
+* key except `PATH` into `$GITHUB_ENV` in heredoc form -- the form that survives any value,
+* including one containing `$` or quotes -- then appends mise's shim directory and the
+* `~/.local/bin` install location to `$GITHUB_PATH` so every later step sees node, pnpm, and any
+* other declared tool on PATH with no prefix.
 */
-function detectHealthContext(targetDir) {
-	return {
-		stack: resolveStack(targetDir),
-		isMonorepo: existsSync(path.join(targetDir, "packages"))
-	};
-}
-/** Resolve from the real filesystem (used by CLI commands). */
-function resolveHealthConfig(targetDir) {
-	const { stack, isMonorepo } = detectHealthContext(targetDir);
-	return resolveHealthConfigFromContext({
-		exists: (rel) => existsSync(path.join(targetDir, rel)),
-		read: (rel) => {
-			const full = path.join(targetDir, rel);
-			if (!existsSync(full)) return void 0;
-			try {
-				return readFileSync(full, "utf-8");
-			} catch (_error) {
-				return;
-			}
-		},
-		config: { stack }
-	}, { isMonorepo });
-}
-//#endregion
-//#region src/utils/script-forwarding.ts
-/**
-* pnpm appends args forwarded via `pnpm <script> <args>` to the END of the
-* resolved script string. A forwarded flag therefore only reaches its intended
-* command when that command is the LAST command in the script. The generated
-* CI workflow depends on this two-hop forwarding:
-*
-*   pnpm ci:check --with-coverage
-*   -> pnpm check --skip 'docker:*' --with-coverage
-*   -> bst checks:run --skip 'docker:*' --with-coverage
-*
-* If `check` or `ci:check` ends in a different command (e.g. an `&&` chain),
-* the forwarded flags silently land on the wrong command -- tests run without
-* coverage and `--skip` becomes a no-op. This module detects that shape so
-* callers can surface a precise diagnosis instead of a confusing downstream
-* failure.
-*/
-/** A script's commands, split on `&&`, `||`, `|`, and `;`, each trimmed. */
-function commandSegments(script) {
-	return script.split(/&&|\|\|?|;/).map((segment) => segment.trim());
-}
-/** The final command of a script, after splitting on `&&`, `||`, `|`, and `;`. */
-function lastCommandSegment(script) {
-	return commandSegments(script).at(-1) ?? "";
+const MISE_ENV_EXPORT_SCRIPT = [
+	"const fs = require(\"fs\");",
+	"const env = JSON.parse(fs.readFileSync(0, \"utf8\"));",
+	"let out = \"\";",
+	"for (const [key, value] of Object.entries(env)) {",
+	"  if (key === \"PATH\") continue;",
+	"  out += key + \"<<BST_MISE_ENV_EOF\\n\" + value + \"\\nBST_MISE_ENV_EOF\\n\";",
+	"}",
+	"fs.appendFileSync(process.env.GITHUB_ENV, out);",
+	"fs.appendFileSync(",
+	"  process.env.GITHUB_PATH,",
+	"  process.env.HOME + \"/.local/share/mise/shims\\n\" + process.env.HOME + \"/.local/bin\\n\",",
+	");"
+].join("\n");
+/** A fresh object per call: one shared object in two jobs would serialize as a YAML alias. */
+function pnpmStoreCacheStep() {
+	return { step: {
+		name: "Cache pnpm store",
+		uses: "actions/cache@v4",
+		with: {
+			path: "~/.local/share/pnpm/store",
+			key: `pnpm-${actionsExpr("runner.os")}-${actionsExpr("hashFiles('pnpm-lock.yaml')")}`
+		}
+	} };
 }
+/** Actions whose ref the generator pins itself, so `preservePinnedActions` must not keep a
+* repo's older ref for them. */
+const GENERATOR_OWNED_ACTIONS = [{
+	name: SETUP_MISE_ACTION_URL,
+	comment: SETUP_MISE_ACTION_TAG
+}];
 /**
-* True when args forwarded to a `check` script would reach `bst checks:run` -- its last command
-* must invoke `bst checks:run`. Trailing flags like `--add` are fine; only the position of the
-* invocation matters.
+* The steps every workflow generator uses in place of `pnpm/action-setup` + `actions/setup-node`:
+* install the pinned `mise`, `mise install` the repo's `mise.toml` toolchain, export its env into
+* the rest of the job, and cache the pnpm store. `MISE_VERSION`/`MISE_LINUX_X64_SHA256`
+* (`mise-pin.ts`) are the same pin the agent runner's base image installs, checked by
+* `runner-base-image-dockerfile.test.ts`.
 *
-* The leading `[\s/]` alternative is what lets a wrapped invocation (`pnpm exec bst checks:run`,
-* or an absolute path ending in `/bst`) still count. It also used to admit a `bin.mjs checks:run`
-* spelling for the tooling repo's own `check` script, which invoked
-* `node packages/tooling-cli/dist/bin.mjs` directly; that repo now depends on itself as
-* `workspace:*` and runs `pnpm exec bst checks:run`, so the exception has no caller left.
-*/
-function isCheckScriptForwardingSafe(script) {
-	return /(?:^|[\s/])bst\s+checks:run(?=\s|$)/.test(lastCommandSegment(script));
-}
-/**
-* True when args forwarded to a `ci:check` script would reach `pnpm check`
-* -- its last command must invoke `pnpm check` (or `pnpm run check`).
+* On Forgejo the mise half is the shared composite action in `bensandee/common`, pinned by commit.
+* GitHub resolves actions only from github.com, so it keeps the same steps inline.
 */
-function isCiCheckScriptForwardingSafe(script) {
-	return /(?:^|\s)pnpm\s+(?:run\s+)?check(?=\s|$)/.test(lastCommandSegment(script));
+function miseSetupSteps(ci) {
+	if (ci !== "forgejo") return inlineMiseSteps();
+	return [{ step: {
+		name: "Set up mise",
+		uses: `${SETUP_MISE_ACTION_URL}@${SETUP_MISE_ACTION_SHA}`,
+		with: {
+			version: MISE_VERSION,
+			sha256: MISE_LINUX_X64_SHA256
+		}
+	} }, pnpmStoreCacheStep()];
 }
 /**
-* Inspect a package.json `scripts` record for `check` / `ci:check` definitions
-* whose shape would swallow pnpm-forwarded args. Returns a human-readable hint
-* naming the problem and the fix, or undefined when forwarding is sound.
+* The inline form of the shared action, for GitHub. Uses `mise env --json` piped into the
+* just-installed mise's own `node -e`, not `mise env --shell bash`: the JSON form is
+* shell-independent and the interpreter reading it is guaranteed to exist (mise just installed
+* it), so this needs no assumption about which shell the runner's `run:` steps use.
 */
-function diagnoseCheckScriptForwarding(scripts) {
-	if (!scripts) return void 0;
-	const problems = [];
-	const check = scripts["check"];
-	if (check !== void 0 && !isCheckScriptForwardingSafe(check)) problems.push(`the \`check\` script does not end with \`bst checks:run\` (its last command is \`${lastCommandSegment(check)}\`)`);
-	const ciCheck = scripts["ci:check"];
-	if (ciCheck !== void 0 && !isCiCheckScriptForwardingSafe(ciCheck)) problems.push(`the \`ci:check\` script does not end with \`pnpm check\` (its last command is \`${lastCommandSegment(ciCheck)}\`)`);
-	if (problems.length === 0) return void 0;
-	return `Likely cause: ${problems.join(", and ")}. pnpm appends forwarded args (e.g. \`--with-coverage\`, \`--skip 'docker:*'\`) to the end of the resolved script, so they never reach \`bst checks:run\`. Make \`bst checks:run\` the last command -- move extra checks into \`bst checks:run --add <name,...>\`.`;
+function inlineMiseSteps() {
+	const installScript = [
+		"curl -fsSL -o \"$RUNNER_TEMP/mise\" " + MISE_RELEASE_URL,
+		`echo "${MISE_LINUX_X64_SHA256}  $RUNNER_TEMP/mise" | sha256sum -c`,
+		"mkdir -p \"$HOME/.local/bin\" && install -m 0755 \"$RUNNER_TEMP/mise\" \"$HOME/.local/bin/mise\"",
+		"export MISE_TRUSTED_CONFIG_PATHS=\"$GITHUB_WORKSPACE\"",
+		"export MISE_YES=1",
+		"\"$HOME/.local/bin/mise\" install",
+		`"$HOME/.local/bin/mise" env --json | "$HOME/.local/bin/mise" exec -- node -e '${MISE_ENV_EXPORT_SCRIPT}'`
+	].join("\n");
+	return [
+		{ step: {
+			name: "Cache mise tools",
+			uses: "actions/cache@v4",
+			with: {
+				path: "~/.local/share/mise",
+				key: `mise-${actionsExpr("runner.os")}-${actionsExpr("hashFiles('mise.toml')")}`
+			}
+		} },
+		pnpmStoreCacheStep(),
+		{ step: {
+			name: "Install mise",
+			env: { GITHUB_TOKEN: "" },
+			run: installScript
+		} }
+	];
 }
 /**
-* The toolchain scripts `MANAGED_SCRIPTS` (package-json.ts) deliberately does NOT
-* force-converge. They are add-if-absent: once a value exists, sync never looks at
-* it again -- because force-converging `build` would stomp a Vite project's
-* `vite build`, which is the entire point of the `builder` axis. The cost of that
-* freedom is that these scripts can drift into nonsense and nothing notices, so we
-* diagnose the one drift shape that fails *silently* rather than loudly.
-*/
-const TOOLCHAIN_SCRIPTS = [
-	"build",
-	"typecheck",
-	"lint",
-	"test",
-	"knip",
-	"format"
-];
-/**
-* True when a pnpm invocation asks for recursion (`-r`) and then pins itself to the
-* workspace root (`-w`) -- `pnpm -r -w --parallel exec tsc --noEmit`.
+* Build the docker publish env block.
 *
-* `-w` wins: the command runs exactly once, in the workspace root, and never descends
-* into `packages/*`. A monorepo root holds no source, so `tsc --noEmit` there typechecks
-* nothing and **exits 0**. That is the failure mode this exists for -- the script is not
-* broken, it is a no-op that reports success, so it survives in CI indefinitely. This
-* repo's own `typecheck` sat in exactly that state until it was found by accident.
+* The LHS env-var names (`DOCKER_USERNAME` / `DOCKER_PASSWORD`) match what
+* publish-docker.ts reads at runtime. The RHS secret references are
+* registry-specific (see {@link dockerSecretNames}) so downstream repos can
+* stop relying on the user/org-level `DOCKER_USERNAME` / `DOCKER_PASSWORD`
+* secrets -- which the Forgejo act fork auto-injects into every `container:`
+* image pull regardless of the target registry.
 *
-* Scanned per `&&`/`||`/`|`/`;` segment so a chained script can't hide the conflict, and
-* only up to the first non-flag token so a *script's own* `-w` (e.g. `vitest --watch`,
-* `tsdown -w`) is never mistaken for pnpm's.
+* When `host` is `null` (couldn't be derived at gen time), the secret references
+* fall back to neutral `REGISTRY_USERNAME` / `REGISTRY_PASSWORD` and the
+* workflow keeps `DOCKER_REGISTRY_HOST` / `DOCKER_REGISTRY_NAMESPACE` so the CLI
+* resolves the registry at runtime.
 */
-function recursionIsPinnedToRoot(script) {
-	return script.split(/&&|\|\|?|;/).some((segment) => {
-		const tokens = segment.trim().split(/\s+/);
-		if (tokens[0] !== "pnpm") return false;
-		let recursive = false;
-		let workspaceRoot = false;
-		for (const token of tokens.slice(1)) {
-			if (!token.startsWith("-")) break;
-			if (token === "--recursive") recursive = true;
-			else if (token === "--workspace-root") workspaceRoot = true;
-			else if (/^-[a-zA-Z]+$/.test(token)) {
-				if (token.includes("r")) recursive = true;
-				if (token.includes("w")) workspaceRoot = true;
-			}
-		}
-		return recursive && workspaceRoot;
-	});
+function dockerPublishEnv(host) {
+	const { username, password } = dockerSecretNames(host);
+	return {
+		...host === null ? {
+			DOCKER_REGISTRY_HOST: actionsExpr("vars.DOCKER_REGISTRY_HOST"),
+			DOCKER_REGISTRY_NAMESPACE: actionsExpr("vars.DOCKER_REGISTRY_NAMESPACE")
+		} : {},
+		DOCKER_USERNAME: actionsExpr(`secrets.${username}`),
+		DOCKER_PASSWORD: actionsExpr(`secrets.${password}`),
+		RELEASE_DEBUG: actionsExpr("vars.RELEASE_DEBUG || 'false'")
+	};
 }
+/** Where `ctx.remove()` puts what it archives. Named here only to describe it to the user. */
+const ARCHIVE_DIR$1 = ".tooling-archived";
 /**
-* Inspect the unmanaged toolchain scripts for silent-no-op shapes. Returns a
-* human-readable hint, or undefined when they look sound.
+* Retire a workflow file tooling used to generate and no longer writes.
 *
-* This is a **warning, not a convergence**: sync must not rewrite these scripts (see
-* {@link TOOLCHAIN_SCRIPTS}), so the only honest move is to tell the human what looks
-* wrong and let them fix it.
+* Returns `undefined` when there is no file at `workflowPath` -- nothing to report. A file
+* tooling does not manage (it carries the ignore comment, or no managed header) is left in
+* place with a `skipped` result naming it, so a plain `repo:sync` tells the human why the
+* leftover is still there. Any other file is removed: `ctx.remove()` archives before deleting
+* (see createContext), so no manual copy is needed.
+*
+* The result is `removed`, not `archived`: `repo:sync --check` counts only the former as drift,
+* and the agent's workflow sync sweep acts only on drift the check reports.
 */
-function diagnoseToolchainScripts(scripts) {
-	if (!scripts) return void 0;
-	const pinned = TOOLCHAIN_SCRIPTS.filter((name) => {
-		const script = scripts[name];
-		return script !== void 0 && recursionIsPinnedToRoot(script);
-	});
-	if (pinned.length === 0) return void 0;
-	return `${pinned.map((name) => `\`${name}\``).join(", ")} ${pinned.length === 1 ? "combines" : "combine"} pnpm's \`-r\` (recursive) with \`-w\` (workspace-root). \`-w\` wins, so the command runs once at the workspace root and never descends into \`packages/*\` -- in a monorepo whose root holds no source, that is a no-op that still exits 0. Drop the \`-w\`.`;
+function retireManagedWorkflow(ctx, workflowPath, reason) {
+	const existing = ctx.read(workflowPath);
+	if (existing === void 0) return void 0;
+	if (isToolingIgnored(existing) || !existing.includes("Managed by @bensandee/tooling --")) return {
+		filePath: workflowPath,
+		action: "skipped",
+		description: `${workflowPath} is not managed by tooling, so it was left in place`
+	};
+	ctx.remove(workflowPath);
+	let description = `Moved to ${ARCHIVE_DIR$1}/${workflowPath} (${reason})`;
+	if (extractCustomBlocks(existing).length > 0) description += "; its # @tooling:custom blocks are kept only in the archive";
+	return {
+		filePath: workflowPath,
+		action: "removed",
+		description
+	};
 }
+//#endregion
+//#region src/generators/publish-ci.ts
+const RegistryHostSchema = z.object({ registryHost: z.string().optional() });
 /**
-* Filesystem wrapper around {@link diagnoseCheckScriptForwarding}: reads
-* `package.json` from `targetDir` (best-effort) and diagnoses its scripts.
-*/
-function diagnoseCheckScriptForwardingAt(targetDir) {
-	let scripts;
-	try {
-		scripts = parsePackageJson(readFileSync(path.join(targetDir, "package.json"), "utf-8"))?.scripts;
-	} catch (_error) {
-		return;
+* Resolve the docker-registry host at gen time so the workflow generator can
+* pick registry-specific secret names. Honors `.tooling.json#registryHost`
+* first, then git remote `origin` (the operational host, not a mirror-pointed
+* package.json), then derives from `package.json#repository` using the same
+* parser as the runtime (`parseGitUrl` handles https, git+https, and ssh shapes).
+* Returns null if neither source yields a host -- in that case the generator
+* falls back to neutral `REGISTRY_USERNAME` / `REGISTRY_PASSWORD` secrets and
+* lets the runtime resolve the host from `DOCKER_REGISTRY_HOST` (still emitted
+* into the step).
+*/
+function resolveGenTimeHost(ctx) {
+	const toolingRaw = ctx.read(".tooling.json");
+	if (toolingRaw) try {
+		const parsed = RegistryHostSchema.safeParse(JSON.parse(toolingRaw));
+		if (parsed.success && parsed.data.registryHost && parsed.data.registryHost.length > 0) return parsed.data.registryHost;
+	} catch (error) {
+		log$1.warn(`Failed to parse .tooling.json: ${error instanceof Error ? error.message : error}`);
 	}
-	return diagnoseCheckScriptForwarding(scripts);
+	const originUrl = detectGitRemoteUrl(ctx.targetDir);
+	if (originUrl !== null) {
+		const parsedOrigin = parseGitUrl(originUrl);
+		if (parsedOrigin) return registryHostFromHostname(parsedOrigin.hostname);
+	}
+	const raw = ctx.read("package.json");
+	if (!raw) return null;
+	const repo = parsePackageJson(raw)?.repository;
+	let urlStr = null;
+	if (typeof repo === "string") urlStr = repo;
+	else if (repo && typeof repo === "object") urlStr = repo.url;
+	if (typeof urlStr !== "string") return null;
+	const parsed = parseGitUrl(urlStr);
+	if (!parsed) return null;
+	return registryHostFromHostname(parsed.hostname);
 }
-//#endregion
-//#region src/generators/package-json.ts
+const PostReleaseHookSchema = z.object({
+	postReleaseHook: z.string().optional(),
+	postReleaseHookSecrets: z.array(z.string()).optional()
+});
+const ReleaseAssetsSchema = z.object({ releaseAssets: z.array(ReleaseAssetSchema).optional() });
+const VersionStampConfigSchema = z.object({ versionStamp: z.array(VersionStampSchema).optional() });
+const DeploySchema = z.object({ deploy: DeployConfigSchema.optional() });
 /**
-* Single source of truth for the supported Node floor: `engines.node` (`>=<floor>`) is the
-* honest minimum this package declares. `mise.toml`'s `tools.node` (`generators/mise.ts`) is the
-* exact pin every consumer -- the agent's containers, generated CI, a developer's shell -- now
-* installs and runs, seeded from this same floor on first generation.
+* Read the `deploy` block from .tooling.json, if configured.
 *
-* `devEngines.runtime` used to carry a caret form of this floor for `actions/setup-node` and
-* pnpm's runtime-download check to read; both are retired by the shared "Install mise" workflow
-* step and `mise install` respectively, so the field is removed wherever this generator finds it
-* (`applyMetadataDefaults`, `generateWorkspaceEngines`) rather than kept in sync.
+* The full file is already validated against ToolingConfigSchema at sync time,
+* so an invalid `deploy` block fails earlier -- undefined here means "not set".
 */
-const NODE_ENGINES_FLOOR = "24.13.0";
-const ENGINES_NODE = `>=${NODE_ENGINES_FLOOR}`;
-function versionPart(s) {
-	return s && s !== "x" && s !== "*" ? Number(s) : 0;
+function getDeployConfig(ctx) {
+	const raw = ctx.read(".tooling.json");
+	if (!raw) return void 0;
+	try {
+		const result = DeploySchema.safeParse(JSON.parse(raw));
+		if (!result.success) return void 0;
+		return result.data.deploy;
+	} catch (error) {
+		log$1.warn(`Failed to parse .tooling.json: ${error instanceof Error ? error.message : error}`);
+		return;
+	}
 }
-function compareTuples(a, b) {
-	for (let i = 0; i < 3; i++) if (a[i] !== b[i]) return a[i] - b[i];
-	return 0;
+/** Read the postReleaseHook command override from .tooling.json, if configured. */
+function getPostReleaseHookCommand(ctx) {
+	const raw = ctx.read(".tooling.json");
+	if (!raw) return void 0;
+	try {
+		const result = PostReleaseHookSchema.safeParse(JSON.parse(raw));
+		if (!result.success) return void 0;
+		return result.data.postReleaseHook;
+	} catch (error) {
+		log$1.warn(`Failed to parse .tooling.json: ${error instanceof Error ? error.message : error}`);
+		return;
+	}
+}
+/** Read the postReleaseHookSecrets array from .tooling.json, if configured. */
+function getPostReleaseHookSecrets(ctx) {
+	const raw = ctx.read(".tooling.json");
+	if (!raw) return void 0;
+	try {
+		const result = PostReleaseHookSchema.safeParse(JSON.parse(raw));
+		if (!result.success) return void 0;
+		return result.data.postReleaseHookSecrets;
+	} catch (error) {
+		log$1.warn(`Failed to parse .tooling.json: ${error instanceof Error ? error.message : error}`);
+		return;
+	}
 }
 /**
-* Effective lower bound of a single conjunction (space-separated comparators like
-* `>=24.14.0 <25.0.0`). Upper bounds (`<`, `<=`) don't raise the floor and are
-* ignored; the floor is the **max** of the remaining lower-bound tokens (`>=`,
-* `>`, `^`, `~`, `=`, bare, `<major>.x`). Missing/wildcard positions read as 0.
-* `undefined` when no token carries a numeric lower bound.
+* Names of the Docker images `detectDockerPackages` discovers for this repo --
+* by package convention, compose service, or `.tooling.json#docker` override.
+* Routed through the same chokepoint every other Docker consumer uses, so a
+* compose-only image (no convention Dockerfile, no override) still gates the
+* scripts and workflow steps below instead of silently dropping them.
 */
-function conjunctionFloor(conjunction) {
-	let floor;
-	for (const token of conjunction.trim().split(/\s+/)) {
-		if (!token || token.startsWith("<")) continue;
-		const match = /(\d+)(?:\.(\d+|x|\*))?(?:\.(\d+|x|\*))?/.exec(token);
-		if (!match) continue;
-		const candidate = [
-			Number(match[1]),
-			versionPart(match[2]),
-			versionPart(match[3])
-		];
-		if (!floor || compareTuples(candidate, floor) > 0) floor = candidate;
+function getDockerPackageNames(ctx) {
+	return detectContextDockerPackages(ctx).map((pkg) => pkg.imageName);
+}
+/** Check whether any Docker packages exist by convention or .tooling.json config. */
+function hasDockerPackages(ctx) {
+	return getDockerPackageNames(ctx).length > 0;
+}
+/** Paths (relative to repo root) of packages whose package.json has a `build:release-assets` script. */
+function detectReleaseAssetsConventionDirs(ctx) {
+	const dirs = [];
+	if (ctx.config.structure === "monorepo") {
+		const packages = getMonorepoPackages(ctx.targetDir);
+		for (const pkg of packages) {
+			const dirName = pkg.name.split("/").pop() ?? pkg.name;
+			const pkgRaw = ctx.read(`packages/${dirName}/package.json`);
+			if (!pkgRaw) continue;
+			if (parsePackageJson(pkgRaw)?.scripts?.["build:release-assets"]) dirs.push(`packages/${dirName}`);
+		}
+	} else {
+		const pkgRaw = ctx.read("package.json");
+		if (pkgRaw) {
+			if (parsePackageJson(pkgRaw)?.scripts?.["build:release-assets"]) dirs.push(".");
+		}
+	}
+	return dirs;
+}
+/** Check whether release assets are configured by convention or in .tooling.json. */
+function hasReleaseAssets(ctx) {
+	if (detectReleaseAssetsConventionDirs(ctx).length > 0) return true;
+	const raw = ctx.read(".tooling.json");
+	if (!raw) return false;
+	try {
+		const result = ReleaseAssetsSchema.safeParse(JSON.parse(raw));
+		if (!result.success) return false;
+		return !!result.data.releaseAssets && result.data.releaseAssets.length > 0;
+	} catch (error) {
+		log$1.warn(`Failed to parse .tooling.json: ${error instanceof Error ? error.message : error}`);
+		return false;
 	}
-	return floor;
 }
 /**
-* Lowest version a semver range permits, as a `[major, minor, patch]` tuple --
-* what pnpm resolves a `devEngines.runtime.version` to when cross-checking
-* `engines.node`. Handles floor-first forms (`>=24.14.0`, `^24.13.0`, `24.x`,
-* `24`), compound ranges in any order (`>=24.14.0 <25.0.0`, `<25 >=24.14.0` ->
-* `24.14.0`), and `||` alternation (the minimum across alternatives).
-*
-* Returns `undefined` when no floor can be determined (e.g. `*`, `latest`, an
-* alternative with only an upper bound) -- callers must warn rather than guess.
+* Check whether the repo configures `versionStamp`. A repo with a `versionStamp` block but no
+* `releaseAssets` and no `build:release-assets` script would otherwise get no assets step, and
+* nothing would ever run the stamp -- see the two `hasReleaseAssets(ctx) || hasVersionStamp(ctx)`
+* call sites in `ci.ts` and `release-ci.ts`. Deliberately not folded into `hasReleaseAssets`
+* itself: `gitignore.ts` shares that predicate to decide whether to ignore `release-assets/`, and
+* a stamp-only repo produces no such directory.
 */
-function minVersionTuple(range) {
-	let min;
-	for (const alternative of range.split("||")) {
-		const floor = conjunctionFloor(alternative);
-		if (!floor) return void 0;
-		if (!min || compareTuples(floor, min) < 0) min = floor;
+function hasVersionStamp(ctx) {
+	const raw = ctx.read(".tooling.json");
+	if (!raw) return false;
+	try {
+		const result = VersionStampConfigSchema.safeParse(JSON.parse(raw));
+		if (!result.success) return false;
+		return !!result.data.versionStamp && result.data.versionStamp.length > 0;
+	} catch (error) {
+		log$1.warn(`Failed to parse .tooling.json: ${error instanceof Error ? error.message : error}`);
+		return false;
 	}
-	return min;
 }
 /**
-* Remove `devEngines.runtime` from a package.json object in place, dropping `devEngines`
-* entirely once it is left empty. Returns `true` when something was removed, so callers can push
-* their own change description (the wording differs between the root generator and the
-* nested-workspace pass).
+* Archive the manual `publish.yml` this generator used to write; it writes nothing. Docker
+* images publish from the release workflow, and the manual workflow was a thin wrapper around
+* `bst docker:publish` that nobody ran -- run that command instead. Only a file carrying the
+* managed header is removed: a hand-written `publish.yml`, or one opted out with the ignore
+* comment, belongs to the repo.
 */
-function removeDevEnginesRuntime(pkg) {
-	if (!pkg["devEngines"]?.runtime) return false;
-	delete pkg["devEngines"].runtime;
-	if (Object.keys(pkg["devEngines"]).length === 0) delete pkg["devEngines"];
-	return true;
+async function generateDeployCi(ctx) {
+	const filePath = "deploy-ci";
+	if (ctx.config.ci === "none") return {
+		filePath,
+		action: "skipped",
+		description: "Publish workflow not applicable"
+	};
+	return retireManagedWorkflow(ctx, ctx.config.ci === "github" ? ".github/workflows/publish.yml" : ".forgejo/workflows/publish.yml", "run `bst docker:publish` to publish by hand") ?? {
+		filePath,
+		action: "skipped",
+		description: "No publish workflow to retire"
+	};
 }
-/** Scripts every repo gets, whatever its language. */
-const HARNESS_SCRIPTS = {
-	check: "bst checks:run",
-	"ci:check": "pnpm check --skip 'docker:*'",
-	"tooling:check": "bst repo:sync --check",
-	"docs:check": "bst docs:check",
-	"tooling:sync": "bst repo:sync"
-};
-/** Scripts that need a JS/TS toolchain. */
-const JS_SCRIPTS_SINGLE = {
-	test: "vitest run",
-	"test:coverage": "vitest run --coverage",
-	lint: "oxlint",
-	"lint:report": "bst lint:report",
-	knip: "knip"
-};
-const JS_SCRIPTS_MONOREPO = {
-	test: "pnpm -r test",
-	"test:coverage": "vitest run --coverage",
-	lint: "oxlint",
-	"lint:report": "bst lint:report",
-	knip: "knip"
-};
-/** Scripts that only make sense with a TypeScript compiler. */
-const TS_SCRIPTS_SINGLE = {
-	typecheck: "tsc --noEmit",
-	"lint:types": "bst lint:types"
-};
-const TS_SCRIPTS_MONOREPO = {
-	typecheck: "pnpm -r --parallel run typecheck",
-	"lint:types": "bst lint:types"
-};
-/** Scripts owned by the builder. Only tsdown is ours to write. */
-const TSDOWN_SCRIPTS_SINGLE = {
-	build: "tsdown",
-	dev: "tsdown --watch"
-};
-const TSDOWN_SCRIPTS_MONOREPO = { build: "pnpm -r build" };
-/** Compose the standard `scripts` map from stack/builder/structure. Content-identical
-* (same keys, same values) to the old flat tables for a typescript + tsdown project
-* (single or monorepo) -- key insertion order differs since harness scripts now compose
-* first rather than last, but that's immaterial: `mergeManagedScripts` mutates existing
-* keys in place and only appends keys that were previously absent. */
+//#endregion
+//#region src/codebase-health/config.ts
+const DEFAULT_HEALTH_HISTORY_BRANCH = "bst/health-metrics";
+const TS_EXTENSIONS = [".ts", ".tsx"];
+const JS_EXTENSIONS = [
+	".js",
+	".jsx",
+	".mjs",
+	".cjs"
+];
+const DEFAULT_DIRECTORY_FILE_LIMIT = 20;
+const DEFAULT_FAN_LIMIT = 10;
+const DEFAULT_MODULE_SIZE_LIMIT = 200;
+/** The extensions dependency-cruiser should glob for a given stack. */
+function defaultExtensions(stack) {
+	if (stack === "typescript") return TS_EXTENSIONS;
+	if (stack === "javascript") return JS_EXTENSIONS;
+	return [];
+}
+/** Tolerant of a key `health` does not declare, shared by both entry points below:
+* `resolveHealthConfig` (the CLI) and `resolveHealthConfigFromContext` (the generator). The
+* generator's own caller runs behind `repo:sync`'s strict root read, which has already
+* rejected the document, so leniency here is unreachable there rather than a semantic change
+* for that path. */
+const ToolingShallowSchema$2 = z.object({ health: tolerantBlock(HealthConfigSchema).optional() });
+function defaultSrc(isMonorepo) {
+	return isMonorepo ? ["packages/*/src"] : ["src"];
+}
+function resolveFromOverrides(overrides, isMonorepo, stack) {
+	const o = overrides ?? {};
+	const enabled = o.enabled === true;
+	return {
+		enabled,
+		src: o.src ?? defaultSrc(isMonorepo),
+		exclude: o.exclude ?? [],
+		extensions: o.extensions ?? defaultExtensions(stack),
+		directoryFileLimit: o.directoryFileLimit ?? DEFAULT_DIRECTORY_FILE_LIMIT,
+		fanInLimit: o.fanInLimit ?? DEFAULT_FAN_LIMIT,
+		fanOutLimit: o.fanOutLimit ?? DEFAULT_FAN_LIMIT,
+		moduleSizeLimit: o.moduleSizeLimit ?? DEFAULT_MODULE_SIZE_LIMIT,
+		crossPackage: o.crossPackage ?? true,
+		historyEnabled: enabled && o.history !== "none",
+		historyBranch: o.historyBranch ?? DEFAULT_HEALTH_HISTORY_BRANCH,
+		tolerance: o.tolerance ?? 0,
+		graphMetricsEnabled: stack !== "none",
+		exempt: o.exempt ?? {}
+	};
+}
+function resolveHealthConfigFromContext(reader, opts) {
+	return resolveFromOverrides(parseToolingConfigSlice(reader.read(".tooling.json"), ToolingShallowSchema$2, { block: "health" })?.health, opts.isMonorepo, reader.config.stack);
+}
+/**
+* The two facts about a tree that `resolveHealthConfig` detects but does not return: the stack and
+* whether it is a monorepo. Exported for `health:check`'s reference read, which must resolve the
+* default branch's `health` block with the *same* context the working tree's block was resolved
+* with -- and which therefore has to come out of this module rather than a fresh import, because
+* the command that needs it sits at its fan-out ceiling.
+*/
+function detectHealthContext(targetDir) {
+	return {
+		stack: resolveStack(targetDir),
+		isMonorepo: existsSync(path.join(targetDir, "packages"))
+	};
+}
+/** Resolve from the real filesystem (used by CLI commands). */
+function resolveHealthConfig(targetDir) {
+	const { stack, isMonorepo } = detectHealthContext(targetDir);
+	return resolveHealthConfigFromContext({
+		exists: (rel) => existsSync(path.join(targetDir, rel)),
+		read: (rel) => {
+			const full = path.join(targetDir, rel);
+			if (!existsSync(full)) return void 0;
+			try {
+				return readFileSync(full, "utf-8");
+			} catch (_error) {
+				return;
+			}
+		},
+		config: { stack }
+	}, { isMonorepo });
+}
+//#endregion
+//#region src/utils/script-forwarding.ts
+/**
+* pnpm appends args forwarded via `pnpm <script> <args>` to the END of the
+* resolved script string. A forwarded flag therefore only reaches its intended
+* command when that command is the LAST command in the script. The generated
+* CI workflow depends on this two-hop forwarding:
+*
+*   pnpm ci:check --with-coverage
+*   -> pnpm check --skip 'docker:*' --with-coverage
+*   -> bst checks:run --skip 'docker:*' --with-coverage
+*
+* If `check` or `ci:check` ends in a different command (e.g. an `&&` chain),
+* the forwarded flags silently land on the wrong command -- tests run without
+* coverage and `--skip` becomes a no-op. This module detects that shape so
+* callers can surface a precise diagnosis instead of a confusing downstream
+* failure.
+*/
+/** A script's commands, split on `&&`, `||`, `|`, and `;`, each trimmed. */
+function commandSegments(script) {
+	return script.split(/&&|\|\|?|;/).map((segment) => segment.trim());
+}
+/** The final command of a script, after splitting on `&&`, `||`, `|`, and `;`. */
+function lastCommandSegment(script) {
+	return commandSegments(script).at(-1) ?? "";
+}
+/**
+* True when args forwarded to a `check` script would reach `bst checks:run` -- its last command
+* must invoke `bst checks:run`. Trailing flags like `--add` are fine; only the position of the
+* invocation matters.
+*
+* The leading `[\s/]` alternative is what lets a wrapped invocation (`pnpm exec bst checks:run`,
+* or an absolute path ending in `/bst`) still count. It also used to admit a `bin.mjs checks:run`
+* spelling for the tooling repo's own `check` script, which invoked
+* `node packages/tooling-cli/dist/bin.mjs` directly; that repo now depends on itself as
+* `workspace:*` and runs `pnpm exec bst checks:run`, so the exception has no caller left.
+*/
+function isCheckScriptForwardingSafe(script) {
+	return /(?:^|[\s/])bst\s+checks:run(?=\s|$)/.test(lastCommandSegment(script));
+}
+/**
+* True when args forwarded to a `ci:check` script would reach `pnpm check`
+* -- its last command must invoke `pnpm check` (or `pnpm run check`).
+*/
+function isCiCheckScriptForwardingSafe(script) {
+	return /(?:^|\s)pnpm\s+(?:run\s+)?check(?=\s|$)/.test(lastCommandSegment(script));
+}
+/**
+* Inspect a package.json `scripts` record for `check` / `ci:check` definitions
+* whose shape would swallow pnpm-forwarded args. Returns a human-readable hint
+* naming the problem and the fix, or undefined when forwarding is sound.
+*/
+function diagnoseCheckScriptForwarding(scripts) {
+	if (!scripts) return void 0;
+	const problems = [];
+	const check = scripts["check"];
+	if (check !== void 0 && !isCheckScriptForwardingSafe(check)) problems.push(`the \`check\` script does not end with \`bst checks:run\` (its last command is \`${lastCommandSegment(check)}\`)`);
+	const ciCheck = scripts["ci:check"];
+	if (ciCheck !== void 0 && !isCiCheckScriptForwardingSafe(ciCheck)) problems.push(`the \`ci:check\` script does not end with \`pnpm check\` (its last command is \`${lastCommandSegment(ciCheck)}\`)`);
+	if (problems.length === 0) return void 0;
+	return `Likely cause: ${problems.join(", and ")}. pnpm appends forwarded args (e.g. \`--with-coverage\`, \`--skip 'docker:*'\`) to the end of the resolved script, so they never reach \`bst checks:run\`. Make \`bst checks:run\` the last command -- move extra checks into \`bst checks:run --add <name,...>\`.`;
+}
+/**
+* The toolchain scripts `MANAGED_SCRIPTS` (package-json.ts) deliberately does NOT
+* force-converge. They are add-if-absent: once a value exists, sync never looks at
+* it again -- because force-converging `build` would stomp a Vite project's
+* `vite build`, which is the entire point of the `builder` axis. The cost of that
+* freedom is that these scripts can drift into nonsense and nothing notices, so we
+* diagnose the one drift shape that fails *silently* rather than loudly.
+*/
+const TOOLCHAIN_SCRIPTS = [
+	"build",
+	"typecheck",
+	"lint",
+	"test",
+	"knip",
+	"format"
+];
+/**
+* True when a pnpm invocation asks for recursion (`-r`) and then pins itself to the
+* workspace root (`-w`) -- `pnpm -r -w --parallel exec tsc --noEmit`.
+*
+* `-w` wins: the command runs exactly once, in the workspace root, and never descends
+* into `packages/*`. A monorepo root holds no source, so `tsc --noEmit` there typechecks
+* nothing and **exits 0**. That is the failure mode this exists for -- the script is not
+* broken, it is a no-op that reports success, so it survives in CI indefinitely. This
+* repo's own `typecheck` sat in exactly that state until it was found by accident.
+*
+* Scanned per `&&`/`||`/`|`/`;` segment so a chained script can't hide the conflict, and
+* only up to the first non-flag token so a *script's own* `-w` (e.g. `vitest --watch`,
+* `tsdown -w`) is never mistaken for pnpm's.
+*/
+function recursionIsPinnedToRoot(script) {
+	return script.split(/&&|\|\|?|;/).some((segment) => {
+		const tokens = segment.trim().split(/\s+/);
+		if (tokens[0] !== "pnpm") return false;
+		let recursive = false;
+		let workspaceRoot = false;
+		for (const token of tokens.slice(1)) {
+			if (!token.startsWith("-")) break;
+			if (token === "--recursive") recursive = true;
+			else if (token === "--workspace-root") workspaceRoot = true;
+			else if (/^-[a-zA-Z]+$/.test(token)) {
+				if (token.includes("r")) recursive = true;
+				if (token.includes("w")) workspaceRoot = true;
+			}
+		}
+		return recursive && workspaceRoot;
+	});
+}
+/**
+* Inspect the unmanaged toolchain scripts for silent-no-op shapes. Returns a
+* human-readable hint, or undefined when they look sound.
+*
+* This is a **warning, not a convergence**: sync must not rewrite these scripts (see
+* {@link TOOLCHAIN_SCRIPTS}), so the only honest move is to tell the human what looks
+* wrong and let them fix it.
+*/
+function diagnoseToolchainScripts(scripts) {
+	if (!scripts) return void 0;
+	const pinned = TOOLCHAIN_SCRIPTS.filter((name) => {
+		const script = scripts[name];
+		return script !== void 0 && recursionIsPinnedToRoot(script);
+	});
+	if (pinned.length === 0) return void 0;
+	return `${pinned.map((name) => `\`${name}\``).join(", ")} ${pinned.length === 1 ? "combines" : "combine"} pnpm's \`-r\` (recursive) with \`-w\` (workspace-root). \`-w\` wins, so the command runs once at the workspace root and never descends into \`packages/*\` -- in a monorepo whose root holds no source, that is a no-op that still exits 0. Drop the \`-w\`.`;
+}
+/**
+* Filesystem wrapper around {@link diagnoseCheckScriptForwarding}: reads
+* `package.json` from `targetDir` (best-effort) and diagnoses its scripts.
+*/
+function diagnoseCheckScriptForwardingAt(targetDir) {
+	let scripts;
+	try {
+		scripts = parsePackageJson(readFileSync(path.join(targetDir, "package.json"), "utf-8"))?.scripts;
+	} catch (_error) {
+		return;
+	}
+	return diagnoseCheckScriptForwarding(scripts);
+}
+//#endregion
+//#region src/generators/package-json.ts
+/**
+* Single source of truth for the supported Node floor: `engines.node` (`>=<floor>`) is the
+* honest minimum this package declares. `mise.toml`'s `tools.node` (`generators/mise.ts`) is the
+* exact pin every consumer -- the agent's containers, generated CI, a developer's shell -- now
+* installs and runs, seeded on first generation from the highest of this floor, `engines.node`,
+* and the `devEngines.runtime` range removed below.
+*
+* `devEngines.runtime` used to carry a caret form of this floor for `actions/setup-node` and
+* pnpm's runtime-download check to read; both are retired by the shared "Install mise" workflow
+* step and `mise install` respectively, so the field is removed wherever this generator finds it
+* (`applyMetadataDefaults`, `generateWorkspaceEngines`) rather than kept in sync.
+*/
+const NODE_ENGINES_FLOOR = "24.13.0";
+const ENGINES_NODE = `>=${NODE_ENGINES_FLOOR}`;
+function versionPart(s) {
+	return s && s !== "x" && s !== "*" ? Number(s) : 0;
+}
+function compareTuples(a, b) {
+	for (let i = 0; i < 3; i++) if (a[i] !== b[i]) return a[i] - b[i];
+	return 0;
+}
+/**
+* Effective lower bound of a single conjunction (space-separated comparators like
+* `>=24.14.0 <25.0.0`). Upper bounds (`<`, `<=`) don't raise the floor and are
+* ignored; the floor is the **max** of the remaining lower-bound tokens (`>=`,
+* `>`, `^`, `~`, `=`, bare, `<major>.x`). Missing/wildcard positions read as 0.
+* `undefined` when no token carries a numeric lower bound.
+*/
+function conjunctionFloor(conjunction) {
+	let floor;
+	for (const token of conjunction.trim().split(/\s+/)) {
+		if (!token || token.startsWith("<")) continue;
+		const match = /(\d+)(?:\.(\d+|x|\*))?(?:\.(\d+|x|\*))?/.exec(token);
+		if (!match) continue;
+		const candidate = [
+			Number(match[1]),
+			versionPart(match[2]),
+			versionPart(match[3])
+		];
+		if (!floor || compareTuples(candidate, floor) > 0) floor = candidate;
+	}
+	return floor;
+}
+/**
+* Lowest version a semver range permits, as a `[major, minor, patch]` tuple --
+* what pnpm resolves a `devEngines.runtime.version` to when cross-checking
+* `engines.node`. Handles floor-first forms (`>=24.14.0`, `^24.13.0`, `24.x`,
+* `24`), compound ranges in any order (`>=24.14.0 <25.0.0`, `<25 >=24.14.0` ->
+* `24.14.0`), and `||` alternation (the minimum across alternatives).
+*
+* Returns `undefined` when no floor can be determined (e.g. `*`, `latest`, an
+* alternative with only an upper bound) -- callers must warn rather than guess.
+*/
+function minVersionTuple(range) {
+	let min;
+	for (const alternative of range.split("||")) {
+		const floor = conjunctionFloor(alternative);
+		if (!floor) return void 0;
+		if (!min || compareTuples(floor, min) < 0) min = floor;
+	}
+	return min;
+}
+/**
+* Remove `devEngines.runtime` from a package.json object in place, dropping `devEngines`
+* entirely once it is left empty. Returns `true` when something was removed, so callers can push
+* their own change description (the wording differs between the root generator and the
+* nested-workspace pass).
+*/
+function removeDevEnginesRuntime(pkg) {
+	if (!pkg["devEngines"]?.runtime) return false;
+	delete pkg["devEngines"].runtime;
+	if (Object.keys(pkg["devEngines"]).length === 0) delete pkg["devEngines"];
+	return true;
+}
+/** Scripts every repo gets, whatever its language. */
+const HARNESS_SCRIPTS = {
+	check: "bst checks:run",
+	"ci:check": "pnpm check --skip 'docker:*'",
+	"tooling:check": "bst repo:sync --check",
+	"docs:check": "bst docs:check",
+	"tooling:sync": "bst repo:sync"
+};
+/** Scripts that need a JS/TS toolchain. */
+const JS_SCRIPTS_SINGLE = {
+	test: "vitest run",
+	"test:coverage": "vitest run --coverage",
+	lint: "oxlint",
+	"lint:report": "bst lint:report",
+	knip: "knip"
+};
+const JS_SCRIPTS_MONOREPO = {
+	test: "pnpm -r test",
+	"test:coverage": "vitest run --coverage",
+	lint: "oxlint",
+	"lint:report": "bst lint:report",
+	knip: "knip"
+};
+/** Scripts that only make sense with a TypeScript compiler. */
+const TS_SCRIPTS_SINGLE = {
+	typecheck: "tsc --noEmit",
+	"lint:types": "bst lint:types"
+};
+const TS_SCRIPTS_MONOREPO = {
+	typecheck: "pnpm -r --parallel run typecheck",
+	"lint:types": "bst lint:types"
+};
+/** Scripts owned by the builder. Only tsdown is ours to write. */
+const TSDOWN_SCRIPTS_SINGLE = {
+	build: "tsdown",
+	dev: "tsdown --watch"
+};
+const TSDOWN_SCRIPTS_MONOREPO = { build: "pnpm -r build" };
+/** Compose the standard `scripts` map from stack/builder/structure. Content-identical
+* (same keys, same values) to the old flat tables for a typescript + tsdown project
+* (single or monorepo) -- key insertion order differs since harness scripts now compose
+* first rather than last, but that's immaterial: `mergeManagedScripts` mutates existing
+* keys in place and only appends keys that were previously absent. */
 function standardScripts(config) {
 	const mono = config.structure === "monorepo";
 	const scripts = { ...HARNESS_SCRIPTS };
@@ -7119,7 +7453,7 @@ function buildManagedDevDeps(ctx) {
 	const devDeps = { ...rootDevDeps(ctx.config) };
 	if (!isMonorepo) Object.assign(devDeps, perPackageDevDeps(ctx.config));
 	if (ctx.config.stack !== "none" || ctx.config.ci === "forgejo") devDeps["@bensandee/config"] = isWorkspacePackage(ctx, "@bensandee/config") ? "workspace:*" : "0.14.5";
-	if (!isWorkspacePackage(ctx, "@bensandee/tooling")) devDeps["@bensandee/tooling"] = "0.87.0";
+	if (!isWorkspacePackage(ctx, "@bensandee/tooling")) devDeps["@bensandee/tooling"] = "0.87.1";
 	if (ctx.config.useEslintPlugin && ctx.config.stack !== "none") devDeps["@bensandee/eslint-plugin"] = isWorkspacePackage(ctx, "@bensandee/eslint-plugin") ? "workspace:*" : "0.16.0";
 	if (ctx.config.formatter === "oxfmt") devDeps["oxfmt"] = {
 		"@changesets/cli": "3.0.3",
@@ -8351,1411 +8685,1110 @@ async function generateOxfmt(ctx) {
 	let jsonValue;
 	try {
 		jsonValue = JSON.parse(existing);
-	} catch {
-		const config = { ignorePatterns: required };
-		ctx.write(filePath, JSON.stringify(config, null, 2) + "\n");
-		return {
-			filePath,
-			action: "updated",
-			description: "Replaced malformed .oxfmtrc.json"
-		};
-	}
-	const parseResult = OxfmtConfigSchema.safeParse(jsonValue);
-	if (!parseResult.success) {
-		const config = { ignorePatterns: required };
-		ctx.write(filePath, JSON.stringify(config, null, 2) + "\n");
-		return {
-			filePath,
-			action: "updated",
-			description: "Replaced malformed .oxfmtrc.json"
-		};
-	}
-	const parsed = parseResult.data;
-	const ignorePatterns = Array.isArray(parsed["ignorePatterns"]) ? parsed["ignorePatterns"] : [];
-	const strings = ignorePatterns.filter((p) => typeof p === "string");
-	const existingSet = new Set(strings);
-	const missing = required.filter((p) => !existingSet.has(p));
-	const kept = strings.filter((p) => !SUPERSEDED_IGNORE_PATTERNS.has(p));
-	const removed = strings.filter((p) => SUPERSEDED_IGNORE_PATTERNS.has(p));
-	const nonStringPatterns = ignorePatterns.filter((p) => typeof p !== "string");
-	if (missing.length === 0 && removed.length === 0) return {
-		filePath,
-		action: "skipped",
-		description: "Existing oxfmt config already has required ignorePatterns"
-	};
-	parsed["ignorePatterns"] = [
-		...kept,
-		...nonStringPatterns,
-		...missing
-	];
-	ctx.write(filePath, JSON.stringify(parsed, null, 2) + "\n");
-	const changeParts = [];
-	if (missing.length > 0) changeParts.push(`Added ignorePatterns: ${missing.join(", ")}`);
-	if (removed.length > 0) changeParts.push(`removed: ${removed.join(", ")}`);
-	return {
-		filePath,
-		action: "updated",
-		description: changeParts.join("; ")
-	};
-}
-async function generatePrettier(ctx) {
-	const filePath = ".prettierrc";
-	if (ctx.exists(filePath)) return {
-		filePath,
-		action: "skipped",
-		description: "Existing prettier config preserved"
-	};
-	ctx.write(filePath, PRETTIER_CONFIG);
-	return {
-		filePath,
-		action: "created",
-		description: "Generated .prettierrc"
-	};
-}
-//#endregion
-//#region src/generators/tsdown.ts
-/**
-* Exported so `package-json.ts#reclaimManagedDevDeps` can gate the `tsdown`
-* devDependency reclaim on the same generated-template evidence this generator
-* uses for the config file itself -- the two must never disagree about what
-* "no longer used" means (see the block comment there).
-*/
-const TSDOWN_CONFIG = `import { defineConfig } from "tsdown";
-
-export default defineConfig({
-  entry: ["src/index.ts"],
-});
-`;
-async function generateTsdown(ctx) {
-	const filePath = "tsdown.config.ts";
-	if (ctx.config.structure === "monorepo") return {
-		filePath,
-		action: "skipped",
-		description: "Monorepo: tsdown config belongs in individual packages"
-	};
-	if (ctx.config.builder !== "tsdown") {
-		if (ctx.read(filePath) !== void 0 && isGeneratedTemplate(ctx, filePath, TSDOWN_CONFIG)) return reportStaleConfig(filePath, `builder is ${ctx.config.builder}`);
-		return {
-			filePath,
-			action: "skipped",
-			description: `Builder is ${ctx.config.builder}; tsdown config not managed`
-		};
-	}
-	const existing = ctx.read(filePath);
-	const config = formattedTemplate(ctx, filePath, TSDOWN_CONFIG);
-	if (existing) {
-		if (existing === config) return {
-			filePath,
-			action: "skipped",
-			description: "Already configured"
-		};
-		if (await ctx.confirmOverwrite(filePath) === "skip") return {
-			filePath,
-			action: "skipped",
-			description: "Existing tsdown config preserved"
-		};
-	}
-	ctx.write(filePath, config);
-	return {
-		filePath,
-		action: existing ? "updated" : "created",
-		description: "Generated tsdown.config.ts"
-	};
-}
-//#endregion
-//#region src/generators/mise.ts
-/**
-* `mise.toml` owns exactly two keys, `tools.node` and `tools.pnpm`, and carries every other byte
-* -- other tools, `[env]`, `[tasks.*]`, comments -- through untouched. `smol-toml`'s `parse` is
-* used only to validate the file and to inspect the owned keys' shapes; it preserves no layout, so
-* every mutation below is a textual edit against the raw source rather than a reserialization.
-* `generators/package-json.ts` documents the same "manage the keys, not the file" posture for
-* `devEngines.runtime`.
-*/
-const TOOLS_HEADER_RE = /^\[tools\]\s*$/m;
-/** Any top-level table header (`[x]` or `[x.y]`) or array-of-tables header (`[[x]]`), used to find
-* where `[tools]`'s own range ends -- an array-of-tables entry is a fresh table just as much as a
-* `[x]` header is, so it must terminate the body range too, or an owned line appended past it
-* lands inside that entry instead of `[tools]`. */
-const TOP_LEVEL_HEADER_RE = /^\[{1,2}[^[].*\]{1,2}\s*$/m;
-const PNPM_LINE_RE = /^pnpm\s*=.*$/m;
-/** Tolerant shape of the file's `[tools]` table: string or table form for every key, so a
-* table-form `node`/`pnpm` is caught rather than mistaken for absent. */
-const ToolsTableSchema = z.record(z.string(), z.union([z.string(), z.record(z.string(), z.unknown())]));
-/** Tolerant shape of the whole parsed document -- only `tools` is read. */
-const ParsedTomlSchema = z.looseObject({ tools: z.unknown().optional() });
-/** The `[tools]` table's body range: right after its header line to the next top-level header or
-* EOF. `undefined` when there is no `[tools]` table at all. */
-function toolsRange(source) {
-	const headerMatch = TOOLS_HEADER_RE.exec(source);
-	if (!headerMatch) return void 0;
-	const start = headerMatch.index + headerMatch[0].length;
-	const rest = source.slice(start);
-	const nextHeader = TOP_LEVEL_HEADER_RE.exec(rest);
-	return {
-		start,
-		end: nextHeader ? start + nextHeader.index : source.length
-	};
-}
-/** Strip the version out of `packageManager` (`pnpm@11.27.0` -> `11.27.0`). */
-function pnpmVersionFromPackageManager(packageManager) {
-	return /^pnpm@(\S+)$/.exec(packageManager ?? "")?.[1];
-}
-/** The exact pin to seed `tools.node` with: the higher of `enginesNode`'s own floor (e.g. a repo
-* whose `package.json` already declares `>=24.14.0`) and {@link NODE_ENGINES_FLOOR}, so a loose
-* `engines.node` (`>=24`, `24.x`) can never seed a pin below the supported floor -- the same
-* derive-from-engines discipline the retired `devEngines.runtime` generator used. */
-function nodePinFor(enginesNode) {
-	const tuple = enginesNode ? minVersionTuple(enginesNode) : void 0;
-	const floorTuple = minVersionTuple(NODE_ENGINES_FLOOR);
-	if (!tuple || !floorTuple) return NODE_ENGINES_FLOOR;
-	return compareTuples(tuple, floorTuple) > 0 ? tuple.join(".") : NODE_ENGINES_FLOOR;
-}
-/** The two owned lines, in order, for a file created from scratch (or a `[tools]` table added to
-* one that had none). */
-function ownedLines(pnpmVersion, enginesNode) {
-	const lines = [`[tools]`, `node = "${nodePinFor(enginesNode)}"`];
-	if (pnpmVersion) lines.push(`pnpm = "${pnpmVersion}"`);
-	return lines;
-}
-/** Append a `key = "value"` line to a `[tools]` body, respecting whatever trailing newline it
-* already has. */
-function appendLine(body, line) {
-	return (body.endsWith("\n") || body.length === 0 ? body : body + "\n") + line + "\n";
-}
-/** `action: "failed"` naming an owned key present in table form. */
-function tableFormFailure(filePath, key) {
-	return {
-		filePath,
-		action: "failed",
-		description: `mise.toml: tools.${key} is a table; repo:sync owns it as a plain string pin`
-	};
-}
-/** `true` when `pinned` provably resolves below `enginesNode`'s floor. Only two pin shapes are
-* compared: an exact `X.Y.Z` against the whole floor, and a bare major (`"24"`, what `mise use
-* node@24` writes) against the floor's major alone. Anything else -- `"24.12"`, `"lts"`, a prefix
-* mise resolves -- is left for mise to resolve, because the toolchain gate in
-* `commands/sync-gates.ts` treats such pins as legitimate and checks the version mise resolves
-* them to. Reading `"24"` as `24.0.0` would refuse a pin that resolves to the newest 24.x. An
-* unparseable `enginesNode` compares nothing. */
-function isBelowFloor(pinned, enginesNode) {
-	const floor = minVersionTuple(enginesNode);
-	if (floor === void 0) return false;
-	const exact = /^(\d+)\.(\d+)\.(\d+)$/.exec(pinned);
-	if (exact) return compareTuples([
-		Number(exact[1]),
-		Number(exact[2]),
-		Number(exact[3])
-	], floor) < 0;
-	const major = /^(\d+)$/.exec(pinned);
-	if (major) return Number(major[1]) < floor[0];
-	return false;
-}
-/** Resolve the two facts `mise.toml` needs from `package.json`: the engines floor to validate an
-* existing `tools.node` pin against, and the pnpm version to keep `tools.pnpm` in step with. */
-function readPackageJsonFacts(ctx) {
-	const pkgRaw = ctx.read("package.json");
-	const pkg = pkgRaw ? parsePackageJson(pkgRaw) : void 0;
-	return {
-		enginesNode: pkg?.engines?.["node"],
-		pnpmVersion: pnpmVersionFromPackageManager(pkg?.packageManager)
-	};
-}
-/** Edit an existing `[tools]` body in place: add `node` only when absent, rewrite `pnpm` only on
-* drift. Returns the new body and the change descriptions, or `undefined` for the body when
-* nothing changed. */
-function editToolsBody(body, existingNode, existingPnpm, pnpmVersion, enginesNode) {
-	let newBody = body;
-	const changes = [];
-	if (existingNode === void 0) {
-		const pin = nodePinFor(enginesNode);
-		newBody = appendLine(newBody, `node = "${pin}"`);
-		changes.push(`added tools.node = "${pin}"`);
-	}
-	if (pnpmVersion && existingPnpm !== pnpmVersion) {
-		if (existingPnpm === void 0) {
-			newBody = appendLine(newBody, `pnpm = "${pnpmVersion}"`);
-			changes.push(`added tools.pnpm = "${pnpmVersion}"`);
-		} else {
-			newBody = newBody.replace(PNPM_LINE_RE, (line) => {
-				return `pnpm = "${pnpmVersion}"${/(\s*#.*)$/.exec(line)?.[1] ?? ""}`;
-			});
-			changes.push(`updated tools.pnpm ${existingPnpm} -> ${pnpmVersion}`);
-		}
-	}
-	return {
-		body: newBody,
-		changes
-	};
-}
-async function generateMise(ctx) {
-	const filePath = "mise.toml";
-	const { enginesNode, pnpmVersion } = readPackageJsonFacts(ctx);
-	const existing = ctx.read(filePath);
-	if (!existing) {
-		ctx.write(filePath, ownedLines(pnpmVersion, enginesNode).join("\n") + "\n");
-		return {
-			filePath,
-			action: "created",
-			description: "Generated mise.toml"
-		};
-	}
-	let parsed;
-	try {
-		parsed = parse$2(existing);
-	} catch (error) {
+	} catch {
+		const config = { ignorePatterns: required };
+		ctx.write(filePath, JSON.stringify(config, null, 2) + "\n");
 		return {
 			filePath,
-			action: "failed",
-			description: `Could not parse existing mise.toml -- ${error instanceof Error ? error.message : String(error)}`
+			action: "updated",
+			description: "Replaced malformed .oxfmtrc.json"
 		};
 	}
-	const document = ParsedTomlSchema.safeParse(parsed);
-	const parsedTools = document.success ? document.data.tools ?? {} : {};
-	const toolsResult = ToolsTableSchema.safeParse(parsedTools);
-	const toolsTable = toolsResult.success ? toolsResult.data : {};
-	if (typeof toolsTable["node"] === "object") return tableFormFailure(filePath, "node");
-	if (typeof toolsTable["pnpm"] === "object") return tableFormFailure(filePath, "pnpm");
-	const existingNode = toolsTable["node"];
-	const existingPnpm = toolsTable["pnpm"];
-	if (existingNode !== void 0 && enginesNode !== void 0 && isBelowFloor(existingNode, enginesNode)) return {
-		filePath,
-		action: "failed",
-		description: `mise.toml: tools.node "${existingNode}" is below engines.node "${enginesNode}"`
-	};
-	const range = toolsRange(existing);
-	let text;
-	let changes;
-	if (range === void 0) {
-		if (Object.keys(toolsTable).length > 0) return {
+	const parseResult = OxfmtConfigSchema.safeParse(jsonValue);
+	if (!parseResult.success) {
+		const config = { ignorePatterns: required };
+		ctx.write(filePath, JSON.stringify(config, null, 2) + "\n");
+		return {
 			filePath,
-			action: "failed",
-			description: `mise.toml: tools.* is declared with dotted keys; repo:sync only manages a [tools] table`
+			action: "updated",
+			description: "Replaced malformed .oxfmtrc.json"
 		};
-		text = ownedLines(pnpmVersion, enginesNode).join("\n") + "\n\n" + existing;
-		changes = ["added [tools] table"];
-	} else {
-		const body = existing.slice(range.start, range.end);
-		const edited = editToolsBody(body, existingNode, existingPnpm, pnpmVersion, enginesNode);
-		changes = edited.changes;
-		text = edited.body === body ? existing : existing.slice(0, range.start) + edited.body + existing.slice(range.end);
 	}
-	if (changes.length === 0) return {
+	const parsed = parseResult.data;
+	const ignorePatterns = Array.isArray(parsed["ignorePatterns"]) ? parsed["ignorePatterns"] : [];
+	const strings = ignorePatterns.filter((p) => typeof p === "string");
+	const existingSet = new Set(strings);
+	const missing = required.filter((p) => !existingSet.has(p));
+	const kept = strings.filter((p) => !SUPERSEDED_IGNORE_PATTERNS.has(p));
+	const removed = strings.filter((p) => SUPERSEDED_IGNORE_PATTERNS.has(p));
+	const nonStringPatterns = ignorePatterns.filter((p) => typeof p !== "string");
+	if (missing.length === 0 && removed.length === 0) return {
 		filePath,
 		action: "skipped",
-		description: "Already up to spec"
+		description: "Existing oxfmt config already has required ignorePatterns"
 	};
-	ctx.write(filePath, text);
+	parsed["ignorePatterns"] = [
+		...kept,
+		...nonStringPatterns,
+		...missing
+	];
+	ctx.write(filePath, JSON.stringify(parsed, null, 2) + "\n");
+	const changeParts = [];
+	if (missing.length > 0) changeParts.push(`Added ignorePatterns: ${missing.join(", ")}`);
+	if (removed.length > 0) changeParts.push(`removed: ${removed.join(", ")}`);
 	return {
 		filePath,
 		action: "updated",
-		description: changes.join(", ")
+		description: changeParts.join("; ")
 	};
 }
-let current = {
-	warn(message) {
-		process.stderr.write(`${message}\n`);
-	},
-	debug() {}
-};
-function setForgejoLogger(logger) {
-	current = logger;
-}
-/** Stable call-site surface: modules bind `log` once; injection swaps the target underneath. */
-const log = {
-	warn(message) {
-		current.warn(message);
-	},
-	debug(message) {
-		current.debug(message);
-	}
-};
-//#endregion
-//#region ../forgejo/src/releases.ts
-/** Patient-repair attempts (delete frozen release, wait, retry) before escalating. */
-const SETTLE_ATTEMPTS = 4;
-/** Base backoff between patient-repair attempts; doubles each attempt. */
-const SETTLE_BASE_DELAY_MS = 2e3;
-/** Cap on a single patient-repair backoff. */
-const SETTLE_MAX_DELAY_MS = 16e3;
-/** Check whether a Forgejo release already exists for a given tag. */
-async function findRelease(executor, conn, tag) {
-	const encodedTag = encodeURIComponent(tag);
-	const url = `${conn.serverUrl}/api/v1/repos/${conn.repository}/releases/tags/${encodedTag}`;
-	const res = await executor.fetch(url, { headers: { Authorization: `token ${conn.token}` } });
-	if (res.status === 200) return true;
-	if (res.status === 404) return false;
-	throw new TransientError(await forgejoErrorMessage(res, {
-		verb: "check release",
-		resource: tag
-	}));
-}
-const ReleaseSchema = z.object({
-	id: z.number(),
-	tag_name: z.string().optional(),
-	created_at: z.string().optional(),
-	published_at: z.string().optional(),
-	html_url: z.string().nullish(),
-	prerelease: z.boolean().optional()
-});
-/**
-* Detect the signature of a broken Forgejo release: a `created_at` that maps to
-* the Unix epoch (`created_unix = 0`).
-*
-* Forgejo auto-creates a "tag placeholder" release row when a tag is pushed.
-* If our `POST /releases` races that placeholder, Forgejo promotes the
-* placeholder in place (flipping `is_tag` to false) **without** resetting
-* `created_unix`, leaving a published release stuck at the epoch. Such a
-* release sorts as the oldest, so `/releases/latest` never returns it.
-*
-* The epoch renders as `1969-12-31T18:00:00-06:00` or `1970-01-01T00:00:00Z`
-* depending on the server timezone; both parse to `<= 0` ms. A missing or
-* unparseable date is treated as broken too, so the caller repairs rather than
-* ships it.
-*/
-function isEpochReleaseDate(date) {
-	if (!date) return true;
-	const ms = new Date(date).getTime();
-	return Number.isNaN(ms) || ms <= 0;
-}
-/**
-* Fetch the Forgejo release for a tag, returning the parsed object or `null`
-* when no release exists (404). Unlike {@link findRelease}, this exposes the
-* release `id` and dates so callers can inspect/repair an epoch-dated release.
-*/
-async function getReleaseByTag(executor, conn, tag) {
-	const encodedTag = encodeURIComponent(tag);
-	const url = `${conn.serverUrl}/api/v1/repos/${conn.repository}/releases/tags/${encodedTag}`;
-	const res = await executor.fetch(url, { headers: { Authorization: `token ${conn.token}` } });
-	if (res.status === 404) return null;
-	if (!res.ok) throw new TransientError(await forgejoErrorMessage(res, {
-		verb: "check release",
-		resource: tag
-	}));
-	const parsed = ReleaseSchema.safeParse(await res.json());
-	if (!parsed.success) throw new UnexpectedError(`Unexpected release response: ${parsed.error.message}`);
-	return parsed.data;
-}
-/**
-* Create a Forgejo release for a given tag.
-*
-* When `options.target` (a commit SHA or branch) is provided and the tag does
-* not yet exist, Forgejo **creates the tag itself** from that commitish and
-* stamps `created_unix = now` synchronously -- sidestepping the buggy async
-* stamping of a pushed tag. The created tag is lightweight.
-*/
-async function createRelease(executor, conn, tag, options = {}) {
-	const url = `${conn.serverUrl}/api/v1/repos/${conn.repository}/releases`;
-	const payload = {
-		tag_name: tag,
-		name: tag,
-		body: `Published ${tag}`,
-		prerelease: options.prerelease ?? false
+async function generatePrettier(ctx) {
+	const filePath = ".prettierrc";
+	if (ctx.exists(filePath)) return {
+		filePath,
+		action: "skipped",
+		description: "Existing prettier config preserved"
+	};
+	ctx.write(filePath, PRETTIER_CONFIG);
+	return {
+		filePath,
+		action: "created",
+		description: "Generated .prettierrc"
 	};
-	if (options.target) payload["target_commitish"] = options.target;
-	const res = await executor.fetch(url, {
-		method: "POST",
-		headers: {
-			Authorization: `token ${conn.token}`,
-			"Content-Type": "application/json"
-		},
-		body: JSON.stringify(payload)
-	});
-	if (!res.ok) throw new TransientError(await forgejoErrorMessage(res, {
-		verb: "create release",
-		resource: tag
-	}));
-}
-/**
-* Delete a git tag from the repository (`DELETE /repos/{repo}/tags/{tag}`).
-*
-* Used by {@link ensureRelease} to take tag ownership away from the buggy
-* push-ingestion path: once the tag is gone, recreating the release with a
-* `target_commitish` makes Forgejo create the tag fresh with a real date. A 404
-* (already gone) is treated as success.
-*/
-async function deleteTag(executor, conn, tag) {
-	const encodedTag = encodeURIComponent(tag);
-	const url = `${conn.serverUrl}/api/v1/repos/${conn.repository}/tags/${encodedTag}`;
-	const res = await executor.fetch(url, {
-		method: "DELETE",
-		headers: { Authorization: `token ${conn.token}` }
-	});
-	if (!res.ok && res.status !== 404) throw new TransientError(await forgejoErrorMessage(res, {
-		verb: "delete tag",
-		resource: tag
-	}));
-}
-z.looseObject({
-	name: z.string(),
-	id: z.string(),
-	commit: z.object({ sha: z.string().regex(/^[0-9a-f]{40}$/) })
-});
-/**
-* Delete a Forgejo release by id. Does **not** delete the underlying git tag
-* (no `delete_tag` query param) -- the tag is the source of truth, and a
-* subsequent `POST /releases` relies on it still existing to insert a fresh
-* row with `created_unix = now`. A 404 (already gone) is treated as success.
-*/
-async function deleteRelease(executor, conn, releaseId) {
-	const url = `${conn.serverUrl}/api/v1/repos/${conn.repository}/releases/${String(releaseId)}`;
-	const res = await executor.fetch(url, {
-		method: "DELETE",
-		headers: { Authorization: `token ${conn.token}` }
-	});
-	if (!res.ok && res.status !== 404) throw new TransientError(await forgejoErrorMessage(res, {
-		verb: "delete release",
-		resource: String(releaseId)
-	}));
-}
-/**
-* Flag an existing Forgejo release as a prerelease (`PATCH /repos/{repo}/releases/{id}`).
-*
-* {@link ensureRelease} uses this on the path where the release was already there, and so does a
-* rerun, so a rerun over a release an earlier unflagged run created can still
-* keep the forge's Latest pointer off a prerelease. It sets the flag and never clears it, which is
-* why the body is fixed at
-* `{ prerelease: true }` and why the write is a fixed-field PATCH: `{ idempotent: true }`, the
-* convention every other fixed-field PATCH in this package passes (see `updateForgejoComment` in
-* `issue-comments.ts`), because a re-sent convergent PATCH is a no-op.
-*
-* The JSON body is {@link createRelease}'s shape (one `Authorization` header plus a content type),
-* but unlike {@link deleteRelease} against the same URL a 404 is **not** tolerated here: a row that
-* vanished mid-run means the flag was not applied, and the caller must know.
-*/
-async function markReleasePrerelease(executor, conn, releaseId, tag) {
-	const url = `${conn.serverUrl}/api/v1/repos/${conn.repository}/releases/${String(releaseId)}`;
-	const res = await executor.fetch(url, {
-		method: "PATCH",
-		headers: {
-			Authorization: `token ${conn.token}`,
-			"Content-Type": "application/json"
-		},
-		body: JSON.stringify({ prerelease: true })
-	}, { idempotent: true });
-	if (!res.ok) throw new TransientError(await forgejoErrorMessage(res, {
-		verb: "edit release",
-		resource: tag
-	}));
 }
+//#endregion
+//#region src/generators/tsdown.ts
 /**
-* Ensure a Forgejo release exists for a tag **with a real created date**.
-*
-* Forgejo stamps a pushed annotated tag's date *asynchronously*; a release
-* creation that races that stamp freezes the row at the Unix epoch (see
-* {@link isEpochReleaseDate}) -- a published-but-invisible release, because
-* `/releases/latest` sorts by date. The failure is intermittent. The repair:
-*
-* 1. A real-dated release already exists -> `"exists"`.
-* 2. Otherwise create the release and read it back. On epoch, delete the frozen
-*    release and wait (increasing backoff) for Forgejo to settle the tag's date,
-*    then retry -- **preserving the pushed (annotated) tag**. The frozen release
-*    is never deleted-and-left-empty.
-* 3. If the date still never settles and a `target` commit is known, delete the
-*    tag and recreate the release with `target_commitish` so **Forgejo creates
-*    the tag itself**, stamped `now`. The tag becomes lightweight. -> `"repaired"`.
-* 4. If nothing yields a real date, leave a visible release row (rather than only
-*    an invisible tag) and throw loudly.
-*
-* Returns `{ status, release }` -- see {@link EnsureReleaseOutcome}.
+* Exported so `package-json.ts#reclaimManagedDevDeps` can gate the `tsdown`
+* devDependency reclaim on the same generated-template evidence this generator
+* uses for the config file itself -- the two must never disagree about what
+* "no longer used" means (see the block comment there).
 */
-async function ensureRelease(executor, conn, tag, options = {}) {
-	const attempts = options.attempts ?? SETTLE_ATTEMPTS;
-	const baseDelayMs = options.baseDelayMs ?? SETTLE_BASE_DELAY_MS;
-	const existing = await getReleaseByTag(executor, conn, tag);
-	if (existing && !isEpochReleaseDate(existing.created_at)) {
-		if (options.prerelease === true && existing.prerelease === false) await markReleasePrerelease(executor, conn, existing.id, tag);
+const TSDOWN_CONFIG = `import { defineConfig } from "tsdown";
+
+export default defineConfig({
+  entry: ["src/index.ts"],
+});
+`;
+async function generateTsdown(ctx) {
+	const filePath = "tsdown.config.ts";
+	if (ctx.config.structure === "monorepo") return {
+		filePath,
+		action: "skipped",
+		description: "Monorepo: tsdown config belongs in individual packages"
+	};
+	if (ctx.config.builder !== "tsdown") {
+		if (ctx.read(filePath) !== void 0 && isGeneratedTemplate(ctx, filePath, TSDOWN_CONFIG)) return reportStaleConfig(filePath, `builder is ${ctx.config.builder}`);
 		return {
-			status: "exists",
-			release: releaseRef(existing)
+			filePath,
+			action: "skipped",
+			description: `Builder is ${ctx.config.builder}; tsdown config not managed`
 		};
 	}
-	let current = existing;
-	let repairing = false;
-	for (let attempt = 1; attempt <= attempts; attempt++) {
-		if (current && isEpochReleaseDate(current.created_at)) {
-			await deleteRelease(executor, conn, current.id);
-			current = null;
-			repairing = true;
-			await settleBackoff(attempt, baseDelayMs);
-		}
-		try {
-			await createRelease(executor, conn, tag, {
-				target: options.target,
-				prerelease: options.prerelease
-			});
-		} catch (error) {
-			const raced = await getReleaseByTag(executor, conn, tag);
-			if (raced && !isEpochReleaseDate(raced.created_at)) return {
-				status: "race",
-				release: releaseRef(raced)
-			};
-			current = raced;
-			if (attempt >= attempts) break;
-			log.warn(`Release creation attempt ${String(attempt)}/${String(attempts)} failed: ${describeError(error)}`);
-			await settleBackoff(attempt, baseDelayMs);
-			continue;
-		}
-		current = await getReleaseByTag(executor, conn, tag);
-		if (current && !isEpochReleaseDate(current.created_at)) return {
-			status: repairing ? "repaired" : "created",
-			release: releaseRef(current)
+	const existing = ctx.read(filePath);
+	const config = formattedTemplate(ctx, filePath, TSDOWN_CONFIG);
+	if (existing) {
+		if (existing === config) return {
+			filePath,
+			action: "skipped",
+			description: "Already configured"
+		};
+		if (await ctx.confirmOverwrite(filePath) === "skip") return {
+			filePath,
+			action: "skipped",
+			description: "Existing tsdown config preserved"
 		};
-		if (attempt < attempts) log.warn(`Release for ${tag} came back epoch-dated (attempt ${String(attempt)}/${String(attempts)}) -- waiting for Forgejo to settle the tag's date before retrying`);
-	}
-	const recreated = options.target ? await recreateTagViaApi(executor, conn, tag, {
-		target: options.target,
-		prerelease: options.prerelease,
-		current,
-		attempts,
-		baseDelayMs
-	}) : null;
-	if (recreated) return {
-		status: "repaired",
-		release: releaseRef(recreated)
-	};
-	throw new TransientError(`Release for ${tag} never got a real (non-epoch) created date after ${String(attempts)} attempts. This is an intermittent Forgejo bug: a pushed tag's date settles asynchronously and a racing release creation freezes it at the Unix epoch (1969/1970). ` + (options.target ? `Recreating the tag via the API did not help -- investigate the server or upgrade Forgejo.` : `Pass the release tag's target commit so the tag can be recreated, or retry the release.`));
-}
-async function recreateTagViaApi(executor, conn, tag, opts) {
-	const { target, prerelease, current, attempts, baseDelayMs } = opts;
-	log.warn(`Release for ${tag} stayed epoch-dated -- recreating the tag via the API so Forgejo stamps a real date (the tag becomes lightweight)`);
-	if (current) await deleteRelease(executor, conn, current.id);
-	await deleteTag(executor, conn, tag);
-	for (let attempt = 1; attempt <= attempts; attempt++) {
-		try {
-			await createRelease(executor, conn, tag, {
-				target,
-				prerelease
-			});
-		} catch (error) {
-			if (attempt >= attempts) throw new TransientError(`Release for ${tag} was deleted to repair its epoch date, but recreating it from ${target} failed: ${describeError(error)}. The tag no longer exists on the server -- re-push it (or re-run the release) to restore it.`);
-			await settleBackoff(attempt, baseDelayMs);
-			continue;
-		}
-		const recreated = await getReleaseByTag(executor, conn, tag);
-		if (recreated && !isEpochReleaseDate(recreated.created_at)) return recreated;
-		return null;
 	}
-	return null;
-}
-/**
-* The `{ id, url }` projection of a release row carried back to a caller. A server that omits
-* `html_url` yields `url: null` -- the id is still the row's identity.
-*/
-function releaseRef(release) {
+	ctx.write(filePath, config);
 	return {
-		id: release.id,
-		url: release.html_url ?? null
+		filePath,
+		action: existing ? "updated" : "created",
+		description: "Generated tsdown.config.ts"
 	};
 }
-/** Exponential backoff (capped) between patient-repair attempts; a non-positive base is a no-op. */
-async function settleBackoff(attempt, baseDelayMs) {
-	if (baseDelayMs <= 0) return;
-	const delay = Math.min(baseDelayMs * 2 ** (attempt - 1), SETTLE_MAX_DELAY_MS);
-	await new Promise((resolve) => setTimeout(resolve, delay));
-}
-/** Upload an asset file to a Forgejo release. */
-async function uploadReleaseAsset(executor, conn, tag, options) {
-	const encodedTag = encodeURIComponent(tag);
-	const releaseUrl = `${conn.serverUrl}/api/v1/repos/${conn.repository}/releases/tags/${encodedTag}`;
-	const releaseRes = await executor.fetch(releaseUrl, { headers: { Authorization: `token ${conn.token}` } });
-	if (!releaseRes.ok) throw new TransientError(await forgejoErrorMessage(releaseRes, {
-		verb: "get release",
-		resource: tag
-	}));
-	const parsed = z.object({ id: z.number() }).safeParse(await releaseRes.json());
-	if (!parsed.success) throw new UnexpectedError(`Unexpected release response: ${parsed.error.message}`);
-	const releaseId = parsed.data.id;
-	const uploadUrl = `${conn.serverUrl}/api/v1/repos/${conn.repository}/releases/${String(releaseId)}/assets?name=${encodeURIComponent(options.assetName)}`;
-	const form = new FormData();
-	form.append("attachment", new Blob([options.fileBuffer]), options.assetName);
-	const res = await executor.fetch(uploadUrl, {
-		method: "POST",
-		headers: { Authorization: `token ${conn.token}` },
-		body: form
-	}, { timeoutMs: LONG_FETCH_TIMEOUT_MS });
-	if (!res.ok) throw new TransientError(await forgejoErrorMessage(res, {
-		verb: "upload asset",
-		resource: `${options.assetName} to ${tag}`
-	}));
-}
 //#endregion
-//#region src/release/publish/version-of-record.ts
-const FOREIGN_VERSION_FILES = [{
-	file: "Cargo.toml",
-	sections: ["package"]
-}, {
-	file: "pyproject.toml",
-	sections: ["project", "tool.poetry"]
-}];
-/** A static `version = "..."` assignment. `version.workspace = true` is deliberately not a match. */
-const STATIC_VERSION = /^\s*version\s*=\s*"[^"]*"/;
+//#region src/generators/mise.ts
 /**
-* True when one of the named TOML tables holds a static `version = "..."`. A
-* dependency-free section scan, not a full TOML parse: each `[table]` header
-* (or `[[array]]`) opens a section that runs until the next header, so a
-* `version` under `[tool.poetry.dependencies]` never counts as the package
-* version. The failure mode is a false negative (a version we don't recognize),
-* which lands on today's behavior -- no regression.
+* `mise.toml` owns exactly two keys, `tools.node` and `tools.pnpm`, and carries every other byte
+* -- other tools, `[env]`, `[tasks.*]`, comments -- through untouched. `smol-toml`'s `parse` is
+* used only to validate the file and to inspect the owned keys' shapes; it preserves no layout, so
+* every mutation below is a textual edit against the raw source rather than a reserialization.
+* `generators/package-json.ts` documents the same "manage the keys, not the file" posture for
+* `devEngines.runtime`.
 */
-function sectionHasStaticVersion(content, sections) {
-	const wanted = new Set(sections);
-	let current;
-	for (const rawLine of content.split("\n")) {
-		const line = rawLine.trim();
-		const header = /^\[+\s*([^\]]+?)\s*\]+/.exec(line);
-		if (header) {
-			current = header[1];
-			continue;
-		}
-		if (current !== void 0 && wanted.has(current) && STATIC_VERSION.test(line)) return true;
-	}
-	return false;
+const TOOLS_HEADER_RE = /^\[tools\]\s*$/m;
+/** Any top-level table header (`[x]` or `[x.y]`) or array-of-tables header (`[[x]]`), used to find
+* where `[tools]`'s own range ends -- an array-of-tables entry is a fresh table just as much as a
+* `[x]` header is, so it must terminate the body range too, or an owned line appended past it
+* lands inside that entry instead of `[tools]`. */
+const TOP_LEVEL_HEADER_RE = /^\[{1,2}[^[].*\]{1,2}\s*$/m;
+const PNPM_LINE_RE = /^pnpm\s*=.*$/m;
+/** Tolerant shape of the file's `[tools]` table: string or table form for every key, so a
+* table-form `node`/`pnpm` is caught rather than mistaken for absent. */
+const ToolsTableSchema = z.record(z.string(), z.union([z.string(), z.record(z.string(), z.unknown())]));
+/** Tolerant shape of the whole parsed document -- only `tools` is read. */
+const ParsedTomlSchema = z.looseObject({ tools: z.unknown().optional() });
+/** The `[tools]` table's body range: right after its header line to the next top-level header or
+* EOF. `undefined` when there is no `[tools]` table at all. */
+function toolsRange(source) {
+	const headerMatch = TOOLS_HEADER_RE.exec(source);
+	if (!headerMatch) return void 0;
+	const start = headerMatch.index + headerMatch[0].length;
+	const rest = source.slice(start);
+	const nextHeader = TOP_LEVEL_HEADER_RE.exec(rest);
+	return {
+		start,
+		end: nextHeader ? start + nextHeader.index : source.length
+	};
 }
-/**
-* The filename of a foreign version-of-record (`Cargo.toml`, `pyproject.toml`)
-* that carries an explicit static version, or `undefined` when none is present.
-*
-* On a `stack: none` repo this is proof that `package.json` is only the bst
-* harness and the real version lives elsewhere -- the trigger for `release:simple`
-* to refuse rather than silently bump the wrong file.
-*/
-function detectForeignVersionOfRecord(targetDir) {
-	for (const { file, sections } of FOREIGN_VERSION_FILES) {
-		const full = path.join(targetDir, file);
-		if (!existsSync(full)) continue;
-		let content;
-		try {
-			content = readFileSync(full, "utf-8");
-		} catch (_error) {
-			continue;
-		}
-		if (sectionHasStaticVersion(content, sections)) return file;
-	}
+/** Strip the version out of `packageManager` (`pnpm@11.27.0` -> `11.27.0`). */
+function pnpmVersionFromPackageManager(packageManager) {
+	return /^pnpm@(\S+)$/.exec(packageManager ?? "")?.[1];
 }
-/**
-* The version-of-record conflict `release:simple` refuses on: the filename when
-* `stack: none` (so `package.json` is provably just the harness) meets a
-* `releaseStrategy: simple` and a foreign version-of-record file, else
-* `undefined`. A `javascript` repo (its `package.json` legitimately IS the
-* version) and an empty `stack: none` repo (no competing file) are both allowed.
-*/
-function releaseTargetConflict(stack, releaseStrategy, targetDir) {
-	if (stack !== "none" || releaseStrategy !== "simple") return void 0;
-	return detectForeignVersionOfRecord(targetDir);
+/** The `version` range of the `node` entry in `devEngines.runtime`, which may be one entry or an
+* array of them. */
+function devEnginesNodeVersion(devEngines) {
+	const runtime = devEngines?.runtime;
+	if (!runtime) return void 0;
+	return (Array.isArray(runtime) ? runtime : [runtime]).find((entry) => entry.name === "node")?.version;
+}
+/** The exact pin to seed `tools.node` with: the highest floor among `devEngines.runtime`'s node
+* range, `engines.node`, and {@link NODE_ENGINES_FLOOR}. Renovate's shared preset never raises
+* `engines.node`, so on its own it can seed a pin below the Node the repo actually runs;
+* `devEngines.runtime` is the range Renovate does raise, which is why it is read here even though
+* `generatePackageJson` removes it. An unparseable range is ignored. */
+function nodePinFor(enginesNode, devEnginesNode) {
+	let pin = minVersionTuple(NODE_ENGINES_FLOOR);
+	for (const range of [enginesNode, devEnginesNode]) {
+		const tuple = range ? minVersionTuple(range) : void 0;
+		if (tuple && (!pin || compareTuples(tuple, pin) > 0)) pin = tuple;
+	}
+	return pin ? pin.join(".") : NODE_ENGINES_FLOOR;
 }
-//#endregion
-//#region src/release/publish/version-stamp.ts
-function splitLines(content) {
-	const trailingNewline = content.endsWith("\n");
+/** The two owned lines, in order, for a file created from scratch (or a `[tools]` table added to
+* one that had none). */
+function ownedLines(pnpmVersion, nodePin) {
+	const lines = [`[tools]`, `node = "${nodePin}"`];
+	if (pnpmVersion) lines.push(`pnpm = "${pnpmVersion}"`);
+	return lines;
+}
+/** Append a `key = "value"` line to a `[tools]` body, respecting whatever trailing newline it
+* already has. */
+function appendLine(body, line) {
+	return (body.endsWith("\n") || body.length === 0 ? body : body + "\n") + line + "\n";
+}
+/** `action: "failed"` naming an owned key present in table form. */
+function tableFormFailure(filePath, key) {
 	return {
-		lines: (trailingNewline ? content.slice(0, -1) : content).split("\n"),
-		trailingNewline
+		filePath,
+		action: "failed",
+		description: `mise.toml: tools.${key} is a table; repo:sync owns it as a plain string pin`
 	};
 }
-function joinLines({ lines, trailingNewline }) {
-	return lines.join("\n") + (trailingNewline ? "\n" : "");
-}
-function stripCr(line) {
-	return line.endsWith("\r") ? line.slice(0, -1) : line;
+/** `true` when `pinned` provably resolves below `enginesNode`'s floor. Only two pin shapes are
+* compared: an exact `X.Y.Z` against the whole floor, and a bare major (`"24"`, what `mise use
+* node@24` writes) against the floor's major alone. Anything else -- `"24.12"`, `"lts"`, a prefix
+* mise resolves -- is left for mise to resolve, because the toolchain gate in
+* `commands/sync-gates.ts` treats such pins as legitimate and checks the version mise resolves
+* them to. Reading `"24"` as `24.0.0` would refuse a pin that resolves to the newest 24.x. An
+* unparseable `enginesNode` compares nothing. */
+function isBelowFloor(pinned, enginesNode) {
+	const floor = minVersionTuple(enginesNode);
+	if (floor === void 0) return false;
+	const exact = /^(\d+)\.(\d+)\.(\d+)$/.exec(pinned);
+	if (exact) return compareTuples([
+		Number(exact[1]),
+		Number(exact[2]),
+		Number(exact[3])
+	], floor) < 0;
+	const major = /^(\d+)$/.exec(pinned);
+	if (major) return Number(major[1]) < floor[0];
+	return false;
 }
-/** `prefix + version + suffix` -- the exact line a matching entry is replaced with. */
-function expectedStampLine(entry, version) {
-	return entry.prefix + version + (entry.suffix ?? "");
+/** Resolve the two facts `mise.toml` needs from `package.json`: the engines floor to validate an
+* existing `tools.node` pin against, and the pnpm version to keep `tools.pnpm` in step with. */
+function readPackageJsonFacts(ctx) {
+	const pkgRaw = ctx.read("package.json");
+	const pkg = pkgRaw ? parsePackageJson(pkgRaw) : void 0;
+	return {
+		enginesNode: pkg?.engines?.["node"],
+		devEngines: pkg?.devEngines,
+		pnpmVersion: pnpmVersionFromPackageManager(pkg?.packageManager)
+	};
 }
-/**
-* Indexes (into `content.split("\n")`, post trailing-newline removal) of every line that
-* starts with `entry.prefix`, ends with `entry.suffix` (default: none), and is at least
-* `prefix.length + suffix.length` characters long so the two cannot overlap on a
-* degenerate line. Compared against each line with a trailing `\r` stripped.
-*/
-function matchingLineIndexes(content, entry) {
-	const suffix = entry.suffix ?? "";
-	const minLength = entry.prefix.length + suffix.length;
-	const { lines } = splitLines(content);
-	const indexes = [];
-	lines.forEach((rawLine, index) => {
-		const line = stripCr(rawLine);
-		if (line.startsWith(entry.prefix) && line.endsWith(suffix) && line.length >= minLength) indexes.push(index);
-	});
-	return indexes;
+/** Edit an existing `[tools]` body in place: add `node` only when absent, rewrite `pnpm` only on
+* drift. Returns the new body and the change descriptions, or `undefined` for the body when
+* nothing changed. */
+function editToolsBody(body, existingNode, existingPnpm, pnpmVersion, nodePin) {
+	let newBody = body;
+	const changes = [];
+	if (existingNode === void 0) {
+		newBody = appendLine(newBody, `node = "${nodePin}"`);
+		changes.push(`added tools.node = "${nodePin}"`);
+	}
+	if (pnpmVersion && existingPnpm !== pnpmVersion) {
+		if (existingPnpm === void 0) {
+			newBody = appendLine(newBody, `pnpm = "${pnpmVersion}"`);
+			changes.push(`added tools.pnpm = "${pnpmVersion}"`);
+		} else {
+			newBody = newBody.replace(PNPM_LINE_RE, (line) => {
+				return `pnpm = "${pnpmVersion}"${/(\s*#.*)$/.exec(line)?.[1] ?? ""}`;
+			});
+			changes.push(`updated tools.pnpm ${existingPnpm} -> ${pnpmVersion}`);
+		}
+	}
+	return {
+		body: newBody,
+		changes
+	};
 }
 /**
-* `undefined` when exactly one line in `content` matches `entry`; otherwise the
-* user-facing sentence describing the zero- or many-match failure, naming the file, the
-* prefix, and the fix (a more specific prefix, or a second `versionStamp` entry). Both the
-* `release:assets` stamp phase and the `repo:sync` static gate report through this one
-* function so the two messages cannot drift apart.
+* `priorDevEngines` is `package.json`'s `devEngines` as it stood before this sync: the pipeline
+* reads it before `generatePackageJson` removes `devEngines.runtime`, because by the time this
+* generator re-reads `package.json` the field is gone. Without it, the file read now is used.
 */
-function describeStampProblem(content, entry) {
-	const indexes = matchingLineIndexes(content, entry);
-	if (indexes.length === 1) return void 0;
-	const suffixClause = entry.suffix === void 0 ? "" : ` and suffix ${JSON.stringify(entry.suffix)}`;
-	const prefixClause = `prefix ${JSON.stringify(entry.prefix)}${suffixClause}`;
-	if (indexes.length === 0) return `${entry.file}: no line matches ${prefixClause}. Fix the prefix/suffix to match the file's actual content.`;
-	return `${entry.file}: ${indexes.length} lines match ${prefixClause}, which is ambiguous. Use a more specific prefix, or split this into a second versionStamp entry.`;
+async function generateMise(ctx, priorDevEngines) {
+	const filePath = "mise.toml";
+	const { enginesNode, devEngines, pnpmVersion } = readPackageJsonFacts(ctx);
+	const nodePin = nodePinFor(enginesNode, devEnginesNodeVersion(priorDevEngines ?? devEngines));
+	const existing = ctx.read(filePath);
+	if (!existing) {
+		ctx.write(filePath, ownedLines(pnpmVersion, nodePin).join("\n") + "\n");
+		return {
+			filePath,
+			action: "created",
+			description: "Generated mise.toml"
+		};
+	}
+	let parsed;
+	try {
+		parsed = parse$2(existing);
+	} catch (error) {
+		return {
+			filePath,
+			action: "failed",
+			description: `Could not parse existing mise.toml -- ${error instanceof Error ? error.message : String(error)}`
+		};
+	}
+	const document = ParsedTomlSchema.safeParse(parsed);
+	const parsedTools = document.success ? document.data.tools ?? {} : {};
+	const toolsResult = ToolsTableSchema.safeParse(parsedTools);
+	const toolsTable = toolsResult.success ? toolsResult.data : {};
+	if (typeof toolsTable["node"] === "object") return tableFormFailure(filePath, "node");
+	if (typeof toolsTable["pnpm"] === "object") return tableFormFailure(filePath, "pnpm");
+	const existingNode = toolsTable["node"];
+	const existingPnpm = toolsTable["pnpm"];
+	if (existingNode !== void 0 && enginesNode !== void 0 && isBelowFloor(existingNode, enginesNode)) return {
+		filePath,
+		action: "failed",
+		description: `mise.toml: tools.node "${existingNode}" is below engines.node "${enginesNode}"`
+	};
+	const range = toolsRange(existing);
+	let text;
+	let changes;
+	if (range === void 0) {
+		if (Object.keys(toolsTable).length > 0) return {
+			filePath,
+			action: "failed",
+			description: `mise.toml: tools.* is declared with dotted keys; repo:sync only manages a [tools] table`
+		};
+		text = ownedLines(pnpmVersion, nodePin).join("\n") + "\n\n" + existing;
+		changes = ["added [tools] table"];
+	} else {
+		const body = existing.slice(range.start, range.end);
+		const edited = editToolsBody(body, existingNode, existingPnpm, pnpmVersion, nodePin);
+		changes = edited.changes;
+		text = edited.body === body ? existing : existing.slice(0, range.start) + edited.body + existing.slice(range.end);
+	}
+	if (changes.length === 0) return {
+		filePath,
+		action: "skipped",
+		description: "Already up to spec"
+	};
+	ctx.write(filePath, text);
+	return {
+		filePath,
+		action: "updated",
+		description: changes.join(", ")
+	};
 }
-/**
-* Replaces the single line in `content` matching `entry` with `expectedStampLine(entry,
-* version)`, preserving that line's trailing `\r` and the file's trailing newline (or its
-* absence). Idempotent: stamping an already-stamped line reproduces the file byte for
-* byte. Precondition: `describeStampProblem(content, entry)` is `undefined` -- callers
-* must check that first, since this indexes the sole match directly.
-*/
-function stampContent(content, entry, version) {
-	const split = splitLines(content);
-	const [index] = matchingLineIndexes(content, entry);
-	const hasCr = split.lines[index].endsWith("\r");
-	const replacement = expectedStampLine(entry, version);
-	split.lines[index] = hasCr ? `${replacement}\r` : replacement;
-	return joinLines(split);
+let current = {
+	warn(message) {
+		process.stderr.write(`${message}\n`);
+	},
+	debug() {}
+};
+function setForgejoLogger(logger) {
+	current = logger;
 }
+/** Stable call-site surface: modules bind `log` once; injection swaps the target underneath. */
+const log = {
+	warn(message) {
+		current.warn(message);
+	},
+	debug(message) {
+		current.debug(message);
+	}
+};
 //#endregion
-//#region src/release/publish/assets.ts
-const CONVENTION_SCRIPT = "build:release-assets";
-const CONVENTION_OUTPUT_DIR = "release-assets";
-function configuredTargets(cwd, toolingConfig) {
-	return (toolingConfig?.releaseAssets ?? []).map((asset) => ({
-		commandCwd: cwd,
-		command: asset.command,
-		files: [{
-			path: path.resolve(cwd, asset.file),
-			...asset.name && { name: asset.name }
-		}]
-	}));
-}
-function conventionTargets(executor, cwd) {
-	const targets = [];
-	const checkDir = (relDir) => {
-		const absDir = path.resolve(cwd, relDir);
-		const raw = executor.readFile(path.join(absDir, "package.json"));
-		if (!raw) return;
-		if (!parsePackageJson(raw)?.scripts?.[CONVENTION_SCRIPT]) return;
-		targets.push({
-			commandCwd: absDir,
-			command: [
-				"pnpm",
-				"run",
-				CONVENTION_SCRIPT
-			],
-			files: [],
-			collectFromDir: path.join(absDir, CONVENTION_OUTPUT_DIR)
-		});
-	};
-	checkDir(".");
-	for (const dir of executor.listPackageDirs(cwd)) checkDir(path.join("packages", dir));
-	return targets;
+//#region ../forgejo/src/releases.ts
+/** Patient-repair attempts (delete frozen release, wait, retry) before escalating. */
+const SETTLE_ATTEMPTS = 4;
+/** Base backoff between patient-repair attempts; doubles each attempt. */
+const SETTLE_BASE_DELAY_MS = 2e3;
+/** Cap on a single patient-repair backoff. */
+const SETTLE_MAX_DELAY_MS = 16e3;
+/** Check whether a Forgejo release already exists for a given tag. */
+async function findRelease(executor, conn, tag) {
+	const encodedTag = encodeURIComponent(tag);
+	const url = `${conn.serverUrl}/api/v1/repos/${conn.repository}/releases/tags/${encodedTag}`;
+	const res = await executor.fetch(url, { headers: { Authorization: `token ${conn.token}` } });
+	if (res.status === 200) return true;
+	if (res.status === 404) return false;
+	throw new TransientError(await forgejoErrorMessage(res, {
+		verb: "check release",
+		resource: tag
+	}));
 }
+const ReleaseSchema = z.object({
+	id: z.number(),
+	tag_name: z.string().optional(),
+	created_at: z.string().optional(),
+	published_at: z.string().optional(),
+	html_url: z.string().nullish(),
+	prerelease: z.boolean().optional()
+});
 /**
-* The release version `versionStamp` writes into each configured file: the root
-* `package.json#version`, the same source `release:simple` reads. A missing file, unparseable
-* JSON, and a manifest with no `version` are all rejected -- a missing version is the "ships
-* 0.0.0" failure this design exists to catch, never a skip.
+* Detect the signature of a broken Forgejo release: a `created_at` that maps to
+* the Unix epoch (`created_unix = 0`).
+*
+* Forgejo auto-creates a "tag placeholder" release row when a tag is pushed.
+* If our `POST /releases` races that placeholder, Forgejo promotes the
+* placeholder in place (flipping `is_tag` to false) **without** resetting
+* `created_unix`, leaving a published release stuck at the epoch. Such a
+* release sorts as the oldest, so `/releases/latest` never returns it.
+*
+* The epoch renders as `1969-12-31T18:00:00-06:00` or `1970-01-01T00:00:00Z`
+* depending on the server timezone; both parse to `<= 0` ms. A missing or
+* unparseable date is treated as broken too, so the caller repairs rather than
+* ships it.
 */
-function resolveStampVersion(executor, cwd) {
-	const pkgPath = path.join(cwd, "package.json");
-	const raw = executor.readFile(pkgPath);
-	if (raw === null) throw new FatalError(`release:assets could not read package.json at ${pkgPath} to resolve the version for versionStamp.`);
-	const pkg = parsePackageJson(raw);
-	if (!pkg?.version) throw new FatalError(`release:assets could not find a "version" field in package.json at ${pkgPath}. versionStamp needs a version to stamp.`);
-	return pkg.version;
+function isEpochReleaseDate(date) {
+	if (!date) return true;
+	const ms = new Date(date).getTime();
+	return Number.isNaN(ms) || ms <= 0;
 }
 /**
-* Stamps every `versionStamp` entry with `version`, before any build command runs. Throws
-* `describeStampProblem`'s message on a zero- or many-match config, so the two consumers
-* (this phase and `repo:sync`'s static gate) cannot report the failure differently.
+* Fetch the Forgejo release for a tag, returning the parsed object or `null`
+* when no release exists (404). Unlike {@link findRelease}, this exposes the
+* release `id` and dates so callers can inspect/repair an epoch-dated release.
 */
-function stampVersionFiles(executor, cwd, toolingConfig, version) {
-	const entries = toolingConfig?.versionStamp ?? [];
-	const stamped = [];
-	for (const entry of entries) {
-		const filePath = path.resolve(cwd, entry.file);
-		const content = executor.readFile(filePath);
-		if (content === null) throw new FatalError(`versionStamp file not found: ${entry.file} (resolved to ${filePath})`);
-		const problem = describeStampProblem(content, entry);
-		if (problem) throw new FatalError(`versionStamp: ${problem}`);
-		const expectedLine = expectedStampLine(entry, version);
-		executor.writeFile(filePath, stampContent(content, entry, version));
-		log$1.info(`Stamped ${entry.file}: ${expectedLine}`);
-		stamped.push({
-			path: filePath,
-			expectedLine
-		});
-	}
-	return stamped;
+async function getReleaseByTag(executor, conn, tag) {
+	const encodedTag = encodeURIComponent(tag);
+	const url = `${conn.serverUrl}/api/v1/repos/${conn.repository}/releases/tags/${encodedTag}`;
+	const res = await executor.fetch(url, { headers: { Authorization: `token ${conn.token}` } });
+	if (res.status === 404) return null;
+	if (!res.ok) throw new TransientError(await forgejoErrorMessage(res, {
+		verb: "check release",
+		resource: tag
+	}));
+	const parsed = ReleaseSchema.safeParse(await res.json());
+	if (!parsed.success) throw new UnexpectedError(`Unexpected release response: ${parsed.error.message}`);
+	return parsed.data;
 }
 /**
-* Re-reads each stamped file and requires exactly one line equal to its `expectedLine`. Runs
-* after the build loop -- the only failure this read-back can catch that the stamp phase did not
-* already is the build overwriting the stamp (a `build:release-assets` script that regenerates or
-* copies over the stamped file).
+* Create a Forgejo release for a given tag.
+*
+* When `options.target` (a commit SHA or branch) is provided and the tag does
+* not yet exist, Forgejo **creates the tag itself** from that commitish and
+* stamps `created_unix = now` synchronously -- sidestepping the buggy async
+* stamping of a pushed tag. The created tag is lightweight.
 */
-function verifyStamp(executor, stamped) {
-	for (const { path: filePath, expectedLine } of stamped) {
-		const matches = (executor.readFile(filePath) ?? "").split("\n").filter((line) => (line.endsWith("\r") ? line.slice(0, -1) : line) === expectedLine).length;
-		if (matches !== 1) throw new FatalError(`versionStamp verify failed for ${filePath}: expected exactly one line "${expectedLine}" after the build, found ${matches}. The build likely overwrote the stamp -- check for a script that regenerates or copies over this file.`);
-	}
+async function createRelease(executor, conn, tag, options = {}) {
+	const url = `${conn.serverUrl}/api/v1/repos/${conn.repository}/releases`;
+	const payload = {
+		tag_name: tag,
+		name: tag,
+		body: `Published ${tag}`,
+		prerelease: options.prerelease ?? false
+	};
+	if (options.target) payload["target_commitish"] = options.target;
+	const res = await executor.fetch(url, {
+		method: "POST",
+		headers: {
+			Authorization: `token ${conn.token}`,
+			"Content-Type": "application/json"
+		},
+		body: JSON.stringify(payload)
+	});
+	if (!res.ok) throw new TransientError(await forgejoErrorMessage(res, {
+		verb: "create release",
+		resource: tag
+	}));
 }
 /**
-* The whole stamp phase, gated on a non-empty `versionStamp`: refuse a foreign
-* version-of-record, resolve the release version, and stamp every entry. Returns `[]`
-* untouched (no real-filesystem read, no executor read) when the repo configures no
-* `versionStamp`, so no existing call path changes behaviour.
+* Delete a git tag from the repository (`DELETE /repos/{repo}/tags/{tag}`).
+*
+* Used by {@link ensureRelease} to take tag ownership away from the buggy
+* push-ingestion path: once the tag is gone, recreating the release with a
+* `target_commitish` makes Forgejo create the tag fresh with a real date. A 404
+* (already gone) is treated as success.
 */
-function runVersionStampPhase(executor, config) {
-	if ((config.toolingConfig?.versionStamp ?? []).length === 0) return [];
-	const conflict = detectForeignVersionOfRecord(config.cwd);
-	if (conflict) throw new FatalError(`release:assets stamps package.json's version into versionStamp files, but this repo's version-of-record is ${conflict}. A stamp would carry a version the ${conflict} artifact never gets. Release this repo through its own toolchain, or remove the versionStamp block.`);
-	const version = resolveStampVersion(executor, config.cwd);
-	return stampVersionFiles(executor, config.cwd, config.toolingConfig, version);
-}
-function runBuild(executor, target, config) {
-	if (!target.command || target.command.length === 0) return;
-	const [file, ...args] = target.command;
-	if (!file) return;
-	const label = target.commandCwd === config.cwd ? "root" : path.relative(config.cwd, target.commandCwd);
-	log$1.info(`Building assets in ${label}: ${target.command.join(" ")}`);
-	executor.execInherit(file, args, { cwd: target.commandCwd });
-	debug(config, `Asset build completed for ${label}`);
-}
-function collectFromDir(executor, target) {
-	if (!target.collectFromDir) return;
-	const before = target.files.length;
-	for (const entry of executor.listFiles(target.collectFromDir)) target.files.push({ path: path.join(target.collectFromDir, entry) });
-	if (target.files.length === before) throw new FatalError(`${CONVENTION_SCRIPT} ran in ${target.commandCwd} but emitted no files to ${target.collectFromDir}. Update your script to write artifacts there, or declare assets explicitly via releaseAssets in .tooling.json.`);
-}
-function uploadToGitHub(executor, config, tag, asset) {
-	const assetName = asset.name ?? path.basename(asset.path);
-	const result = executor.exec("gh", [
-		"release",
-		"upload",
-		tag,
-		asset.path,
-		"--clobber"
-	], { cwd: config.cwd });
-	debugExec(config, `gh release upload ${tag} ${assetName}`, result);
-	if (result.exitCode !== 0) throw new FatalError(`GitHub release upload failed for ${assetName}: ${result.stderr || result.stdout}`);
-	log$1.info(`Uploaded ${assetName} to ${tag} (GitHub)`);
-}
-async function uploadToForgejo(executor, conn, tag, asset) {
-	const assetName = asset.name ?? path.basename(asset.path);
-	const fileBuffer = executor.readFileBuffer(asset.path);
-	if (!fileBuffer) throw new FatalError(`Asset file not found: ${asset.path}`);
-	await uploadReleaseAsset(executor, conn, tag, {
-		assetName,
-		fileBuffer
+async function deleteTag(executor, conn, tag) {
+	const encodedTag = encodeURIComponent(tag);
+	const url = `${conn.serverUrl}/api/v1/repos/${conn.repository}/tags/${encodedTag}`;
+	const res = await executor.fetch(url, {
+		method: "DELETE",
+		headers: { Authorization: `token ${conn.token}` }
 	});
-	log$1.info(`Uploaded ${assetName} to ${tag} (Forgejo)`);
-}
-async function runReleaseAssets(executor, config) {
-	debug(config, `Config: dryRun=${String(config.dryRun)} cwd=${config.cwd}`);
-	const targets = [...configuredTargets(config.cwd, config.toolingConfig), ...conventionTargets(executor, config.cwd)];
-	const stampedFiles = runVersionStampPhase(executor, config);
-	for (const target of targets) {
-		runBuild(executor, target, config);
-		collectFromDir(executor, target);
-	}
-	verifyStamp(executor, stampedFiles);
-	if (targets.length === 0) {
-		log$1.info(`No release assets configured in .tooling.json or by convention (${CONVENTION_SCRIPT} script)`);
-		return;
-	}
-	if (config.dryRun) {
-		log$1.info("[dry-run] Skipping upload");
-		return;
-	}
-	if (!config.platform) throw new FatalError("Platform connection is required for asset upload");
-	const tagResult = executor.exec("git", [
-		"tag",
-		"--points-at",
-		"HEAD"
-	], { cwd: config.cwd });
-	debugExec(config, "git tag --points-at HEAD", tagResult);
-	if (tagResult.exitCode !== 0) throw new FatalError("Could not determine current tags");
-	const tags = tagResult.stdout.trim().split("\n").filter(Boolean);
-	if (tags.length === 0) {
-		log$1.info("No tags pointing to HEAD, skipping upload");
-		return;
-	}
-	let uploaded = 0;
-	for (const tag of tags) {
-		if (!await releaseExists(executor, config, tag)) {
-			log$1.info(`No release found for ${tag}, skipping (likely a sliding tag)`);
-			continue;
-		}
-		log$1.info(`Uploading assets to release ${tag}`);
-		for (const target of targets) for (const asset of target.files) if (config.platform.type === "github") uploadToGitHub(executor, config, tag, asset);
-		else await uploadToForgejo(executor, config.platform.conn, tag, asset);
-		uploaded++;
-	}
-	if (uploaded === 0) log$1.info("No releases found for any tag pointing to HEAD, skipping upload");
-}
-async function releaseExists(executor, config, tag) {
-	if (!config.platform) return false;
-	if (config.platform.type === "forgejo") return findRelease(executor, config.platform.conn, tag);
-	const result = executor.exec("gh", [
-		"release",
-		"view",
-		tag
-	], { cwd: config.cwd });
-	debugExec(config, `gh release view ${tag}`, result);
-	return result.exitCode === 0;
+	if (!res.ok && res.status !== 404) throw new TransientError(await forgejoErrorMessage(res, {
+		verb: "delete tag",
+		resource: tag
+	}));
+}
+z.looseObject({
+	name: z.string(),
+	id: z.string(),
+	commit: z.object({ sha: z.string().regex(/^[0-9a-f]{40}$/) })
+});
+/**
+* Delete a Forgejo release by id. Does **not** delete the underlying git tag
+* (no `delete_tag` query param) -- the tag is the source of truth, and a
+* subsequent `POST /releases` relies on it still existing to insert a fresh
+* row with `created_unix = now`. A 404 (already gone) is treated as success.
+*/
+async function deleteRelease(executor, conn, releaseId) {
+	const url = `${conn.serverUrl}/api/v1/repos/${conn.repository}/releases/${String(releaseId)}`;
+	const res = await executor.fetch(url, {
+		method: "DELETE",
+		headers: { Authorization: `token ${conn.token}` }
+	});
+	if (!res.ok && res.status !== 404) throw new TransientError(await forgejoErrorMessage(res, {
+		verb: "delete release",
+		resource: String(releaseId)
+	}));
 }
-//#endregion
-//#region src/generators/gitignore.ts
-/** Entries that every project should have -- repo:sync --check flags these as missing. */
-const REQUIRED_ENTRIES = [
-	"node_modules/",
-	".pnpm-store/",
-	"dist/",
-	"*.tsbuildinfo",
-	".env",
-	".env.*",
-	"!.env.example"
-];
 /**
-* Tooling-specific entries added during init/update but not required for repo:sync --check.
+* Flag an existing Forgejo release as a prerelease (`PATCH /repos/{repo}/releases/{id}`).
 *
-* `.superpowers/` is agent scratch state (task briefs, review diffs, the SDD progress ledger)
-* that the superpowers plugin writes into whatever repo it runs in. The plugin's own protection
-* is a self-ignoring `.superpowers/sdd/.gitignore` it creates as a side effect of running a
-* skill -- untracked, so it never reaches a clone, and scoped to `sdd/`, so any sibling folder a
-* future skill writes lands untracked-but-not-ignored and one `git add -A` commits it. Ignore
-* the whole directory here for the same reason as `.tooling-archived/`: it is tool-generated
-* scratch that appears without the user asking, so the tool should be what ignores it.
+* {@link ensureRelease} uses this on the path where the release was already there, and so does a
+* rerun, so a rerun over a release an earlier unflagged run created can still
+* keep the forge's Latest pointer off a prerelease. It sets the flag and never clears it, which is
+* why the body is fixed at
+* `{ prerelease: true }` and why the write is a fixed-field PATCH: `{ idempotent: true }`, the
+* convention every other fixed-field PATCH in this package passes (see `updateForgejoComment` in
+* `issue-comments.ts`), because a re-sent convergent PATCH is a no-op.
+*
+* The JSON body is {@link createRelease}'s shape (one `Authorization` header plus a content type),
+* but unlike {@link deleteRelease} against the same URL a 404 is **not** tolerated here: a row that
+* vanished mid-run means the flag was not applied, and the caller must know.
 */
-const OPTIONAL_ENTRIES = [
-	".tooling-migrate.md",
-	".tooling-archived/",
-	".claude/hooks/bst-hook.audit.local.jsonl*",
-	".superpowers/",
-	"coverage/"
-];
+async function markReleasePrerelease(executor, conn, releaseId, tag) {
+	const url = `${conn.serverUrl}/api/v1/repos/${conn.repository}/releases/${String(releaseId)}`;
+	const res = await executor.fetch(url, {
+		method: "PATCH",
+		headers: {
+			Authorization: `token ${conn.token}`,
+			"Content-Type": "application/json"
+		},
+		body: JSON.stringify({ prerelease: true })
+	}, { idempotent: true });
+	if (!res.ok) throw new TransientError(await forgejoErrorMessage(res, {
+		verb: "edit release",
+		resource: tag
+	}));
+}
 /**
-* Optional entries added only when a feature is actually configured.
-* Patterns are written without a leading slash so they match at any depth --
-* a single `release-assets/` entry in the root .gitignore covers monorepo
-* subpackage output like `packages/app/release-assets/` too.
+* Ensure a Forgejo release exists for a tag **with a real created date**.
+*
+* Forgejo stamps a pushed annotated tag's date *asynchronously*; a release
+* creation that races that stamp freezes the row at the Unix epoch (see
+* {@link isEpochReleaseDate}) -- a published-but-invisible release, because
+* `/releases/latest` sorts by date. The failure is intermittent. The repair:
+*
+* 1. A real-dated release already exists -> `"exists"`.
+* 2. Otherwise create the release and read it back. On epoch, delete the frozen
+*    release and wait (increasing backoff) for Forgejo to settle the tag's date,
+*    then retry -- **preserving the pushed (annotated) tag**. The frozen release
+*    is never deleted-and-left-empty.
+* 3. If the date still never settles and a `target` commit is known, delete the
+*    tag and recreate the release with `target_commitish` so **Forgejo creates
+*    the tag itself**, stamped `now`. The tag becomes lightweight. -> `"repaired"`.
+* 4. If nothing yields a real date, leave a visible release row (rather than only
+*    an invisible tag) and throw loudly.
+*
+* Returns `{ status, release }` -- see {@link EnsureReleaseOutcome}.
 */
-function conditionalEntries(ctx) {
-	const entries = [];
-	if (hasReleaseAssets(ctx)) entries.push(`${CONVENTION_OUTPUT_DIR}/`);
-	return entries;
-}
-/** Normalize a gitignore entry for comparison: strip leading `/` and trailing `/`. */
-function normalizeEntry(entry) {
-	let s = entry.trim();
-	if (s.startsWith("/")) s = s.slice(1);
-	if (s.endsWith("/")) s = s.slice(0, -1);
-	return s;
-}
-async function generateGitignore(ctx) {
-	const filePath = ".gitignore";
-	const allEntries = [
-		...REQUIRED_ENTRIES,
-		...OPTIONAL_ENTRIES,
-		...conditionalEntries(ctx)
-	];
-	const existing = ctx.read(filePath);
-	if (existing) {
-		const existingNormalized = new Set(existing.split("\n").map(normalizeEntry).filter((line) => line.length > 0));
-		const missing = allEntries.filter((entry) => !existingNormalized.has(normalizeEntry(entry)));
-		if (missing.length === 0) return {
-			filePath,
-			action: "skipped",
-			description: "Already has all standard entries"
-		};
-		const missingRequired = REQUIRED_ENTRIES.filter((entry) => !existingNormalized.has(normalizeEntry(entry)));
-		const updated = existing.trimEnd() + "\n\n# Added by @bensandee/tooling\n" + missing.join("\n") + "\n";
-		ctx.write(filePath, updated);
-		if (missingRequired.length === 0) return {
-			filePath,
-			action: "skipped",
-			description: "Only optional entries missing"
-		};
+async function ensureRelease(executor, conn, tag, options = {}) {
+	const attempts = options.attempts ?? SETTLE_ATTEMPTS;
+	const baseDelayMs = options.baseDelayMs ?? SETTLE_BASE_DELAY_MS;
+	const existing = await getReleaseByTag(executor, conn, tag);
+	if (existing && !isEpochReleaseDate(existing.created_at)) {
+		if (options.prerelease === true && existing.prerelease === false) await markReleasePrerelease(executor, conn, existing.id, tag);
 		return {
-			filePath,
-			action: "updated",
-			description: `Appended ${String(missing.length)} missing entries`
+			status: "exists",
+			release: releaseRef(existing)
 		};
 	}
-	ctx.write(filePath, allEntries.join("\n") + "\n");
-	return {
-		filePath,
-		action: "created",
-		description: "Generated .gitignore"
+	let current = existing;
+	let repairing = false;
+	for (let attempt = 1; attempt <= attempts; attempt++) {
+		if (current && isEpochReleaseDate(current.created_at)) {
+			await deleteRelease(executor, conn, current.id);
+			current = null;
+			repairing = true;
+			await settleBackoff(attempt, baseDelayMs);
+		}
+		try {
+			await createRelease(executor, conn, tag, {
+				target: options.target,
+				prerelease: options.prerelease
+			});
+		} catch (error) {
+			const raced = await getReleaseByTag(executor, conn, tag);
+			if (raced && !isEpochReleaseDate(raced.created_at)) return {
+				status: "race",
+				release: releaseRef(raced)
+			};
+			current = raced;
+			if (attempt >= attempts) break;
+			log.warn(`Release creation attempt ${String(attempt)}/${String(attempts)} failed: ${describeError(error)}`);
+			await settleBackoff(attempt, baseDelayMs);
+			continue;
+		}
+		current = await getReleaseByTag(executor, conn, tag);
+		if (current && !isEpochReleaseDate(current.created_at)) return {
+			status: repairing ? "repaired" : "created",
+			release: releaseRef(current)
+		};
+		if (attempt < attempts) log.warn(`Release for ${tag} came back epoch-dated (attempt ${String(attempt)}/${String(attempts)}) -- waiting for Forgejo to settle the tag's date before retrying`);
+	}
+	const recreated = options.target ? await recreateTagViaApi(executor, conn, tag, {
+		target: options.target,
+		prerelease: options.prerelease,
+		current,
+		attempts,
+		baseDelayMs
+	}) : null;
+	if (recreated) return {
+		status: "repaired",
+		release: releaseRef(recreated)
 	};
+	throw new TransientError(`Release for ${tag} never got a real (non-epoch) created date after ${String(attempts)} attempts. This is an intermittent Forgejo bug: a pushed tag's date settles asynchronously and a racing release creation freezes it at the Unix epoch (1969/1970). ` + (options.target ? `Recreating the tag via the API did not help -- investigate the server or upgrade Forgejo.` : `Pass the release tag's target commit so the tag can be recreated, or retry the release.`));
 }
-//#endregion
-//#region src/generators/gitattributes.ts
-const MANAGED_HEADER = ["# Managed by @bensandee/tooling: LF working tree on every platform, overriding", "# core.autocrlf/core.eol at checkout. Rules below this line win over it."].join("\n");
-/** Placed only when prepending above a consumer's existing content -- explains, in the file
-* itself, why the rule goes first rather than last (the code has no other way to show it). */
-const PREPEND_REASON = ["# Prepended above your existing rules: .gitattributes is last-match-wins, so a rule", "# placed below would override any binary/-text marks you already have."].join("\n");
-const RULE_LINE = "* text=auto eol=lf";
-/**
-* True when `content` already carries a rule equivalent to `* text=auto eol=lf`: a
-* non-comment line whose first whitespace-separated token is exactly `*` and whose
-* remaining tokens include both `text=auto` and `eol=lf`, in either order. Token-based so
-* reordered or extra-whitespace variants still count, but a narrower pattern (`*.ts ...`)
-* or a commented-out line does not.
-*/
-function hasLfRule(content) {
-	return content.split("\n").some((line) => {
-		const trimmed = line.trim();
-		if (trimmed.startsWith("#")) return false;
-		const tokens = trimmed.split(/\s+/).filter(Boolean);
-		if (tokens[0] !== "*") return false;
-		const rest = new Set(tokens.slice(1));
-		return rest.has("text=auto") && rest.has("eol=lf");
-	});
+async function recreateTagViaApi(executor, conn, tag, opts) {
+	const { target, prerelease, current, attempts, baseDelayMs } = opts;
+	log.warn(`Release for ${tag} stayed epoch-dated -- recreating the tag via the API so Forgejo stamps a real date (the tag becomes lightweight)`);
+	if (current) await deleteRelease(executor, conn, current.id);
+	await deleteTag(executor, conn, tag);
+	for (let attempt = 1; attempt <= attempts; attempt++) {
+		try {
+			await createRelease(executor, conn, tag, {
+				target,
+				prerelease
+			});
+		} catch (error) {
+			if (attempt >= attempts) throw new TransientError(`Release for ${tag} was deleted to repair its epoch date, but recreating it from ${target} failed: ${describeError(error)}. The tag no longer exists on the server -- re-push it (or re-run the release) to restore it.`);
+			await settleBackoff(attempt, baseDelayMs);
+			continue;
+		}
+		const recreated = await getReleaseByTag(executor, conn, tag);
+		if (recreated && !isEpochReleaseDate(recreated.created_at)) return recreated;
+		return null;
+	}
+	return null;
 }
 /**
-* Scaffold `.gitattributes` with `* text=auto eol=lf`, the rule that makes the working tree
-* LF regardless of a developer's global `core.autocrlf`/`core.eol`. No managed-file header
-* from `utils/generated-header.ts` -- this file is merged into like `.gitignore`, not
-* wholesale-regenerated. The rule is required, not optional: a missing rule is
-* created/updated and fails `repo:sync --check` like any other drift.
+* The `{ id, url }` projection of a release row carried back to a caller. A server that omits
+* `html_url` yields `url: null` -- the id is still the row's identity.
 */
-async function generateGitattributes(ctx) {
-	const filePath = ".gitattributes";
-	const existing = ctx.read(filePath);
-	if (existing === void 0 || existing.trim() === "") {
-		ctx.write(filePath, `${MANAGED_HEADER}\n${RULE_LINE}\n`);
-		return {
-			filePath,
-			action: existing === void 0 ? "created" : "updated",
-			description: "Generated .gitattributes"
-		};
-	}
-	if (hasLfRule(existing)) return {
-		filePath,
-		action: "skipped",
-		description: "Already has the LF rule"
-	};
-	const updated = `${MANAGED_HEADER}\n${PREPEND_REASON}\n${RULE_LINE}\n\n${existing}`;
-	ctx.write(filePath, updated);
+function releaseRef(release) {
 	return {
-		filePath,
-		action: "updated",
-		description: "Prepended the LF rule"
+		id: release.id,
+		url: release.html_url ?? null
 	};
 }
+/** Exponential backoff (capped) between patient-repair attempts; a non-positive base is a no-op. */
+async function settleBackoff(attempt, baseDelayMs) {
+	if (baseDelayMs <= 0) return;
+	const delay = Math.min(baseDelayMs * 2 ** (attempt - 1), SETTLE_MAX_DELAY_MS);
+	await new Promise((resolve) => setTimeout(resolve, delay));
+}
+/** Upload an asset file to a Forgejo release. */
+async function uploadReleaseAsset(executor, conn, tag, options) {
+	const encodedTag = encodeURIComponent(tag);
+	const releaseUrl = `${conn.serverUrl}/api/v1/repos/${conn.repository}/releases/tags/${encodedTag}`;
+	const releaseRes = await executor.fetch(releaseUrl, { headers: { Authorization: `token ${conn.token}` } });
+	if (!releaseRes.ok) throw new TransientError(await forgejoErrorMessage(releaseRes, {
+		verb: "get release",
+		resource: tag
+	}));
+	const parsed = z.object({ id: z.number() }).safeParse(await releaseRes.json());
+	if (!parsed.success) throw new UnexpectedError(`Unexpected release response: ${parsed.error.message}`);
+	const releaseId = parsed.data.id;
+	const uploadUrl = `${conn.serverUrl}/api/v1/repos/${conn.repository}/releases/${String(releaseId)}/assets?name=${encodeURIComponent(options.assetName)}`;
+	const form = new FormData();
+	form.append("attachment", new Blob([options.fileBuffer]), options.assetName);
+	const res = await executor.fetch(uploadUrl, {
+		method: "POST",
+		headers: { Authorization: `token ${conn.token}` },
+		body: form
+	}, { timeoutMs: LONG_FETCH_TIMEOUT_MS });
+	if (!res.ok) throw new TransientError(await forgejoErrorMessage(res, {
+		verb: "upload asset",
+		resource: `${options.assetName} to ${tag}`
+	}));
+}
 //#endregion
-//#region src/release/publish/publish-config-lint.ts
-const FIX = `add "publishConfig": { "registry": "<your registry URL>" } to its package.json`;
+//#region src/release/publish/version-of-record.ts
+const FOREIGN_VERSION_FILES = [{
+	file: "Cargo.toml",
+	sections: ["package"]
+}, {
+	file: "pyproject.toml",
+	sections: ["project", "tool.poetry"]
+}];
+/** A static `version = "..."` assignment. `version.workspace = true` is deliberately not a match. */
+const STATIC_VERSION = /^\s*version\s*=\s*"[^"]*"/;
 /**
-* Whether a value can serve as a publish destination: an absolute http(s) URL.
-* Presence alone is not the test -- a relative or empty registry is as silently
-* wrong as an absent one, and npm resolves neither to the place the author meant.
+* True when one of the named TOML tables holds a static `version = "..."`. A
+* dependency-free section scan, not a full TOML parse: each `[table]` header
+* (or `[[array]]`) opens a section that runs until the next header, so a
+* `version` under `[tool.poetry.dependencies]` never counts as the package
+* version. The failure mode is a false negative (a version we don't recognize),
+* which lands on today's behavior -- no regression.
 */
-function isUsableRegistry(value) {
-	if (typeof value !== "string" || value.trim() === "") return false;
-	try {
-		const url = new URL(value);
-		return url.protocol === "https:" || url.protocol === "http:";
-	} catch {
-		return false;
+function sectionHasStaticVersion(content, sections) {
+	const wanted = new Set(sections);
+	let current;
+	for (const rawLine of content.split("\n")) {
+		const line = rawLine.trim();
+		const header = /^\[+\s*([^\]]+?)\s*\]+/.exec(line);
+		if (header) {
+			current = header[1];
+			continue;
+		}
+		if (current !== void 0 && wanted.has(current) && STATIC_VERSION.test(line)) return true;
 	}
-}
-function isRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
+	return false;
 }
 /**
-* Require every package this repo would publish to declare where it publishes.
-*
-* npm and pnpm use one `registry` key for reads and writes alike, so a project
-* `.npmrc` aimed at an install cache silently repoints `pnpm publish` too. A
-* package that never declares its destination inherits one, and an inherited
-* destination can be changed by a file that never mentions publishing.
+* The filename of a foreign version-of-record (`Cargo.toml`, `pyproject.toml`)
+* that carries an explicit static version, or `undefined` when none is present.
 *
-* Reports rather than repairs: the correct registry is not derivable here, and
-* writing a guess would redirect a working release exactly the way this gate
-* exists to prevent.
+* On a `stack: none` repo this is proof that `package.json` is only the bst
+* harness and the real version lives elsewhere -- the trigger for `release:simple`
+* to refuse rather than silently bump the wrong file.
 */
-function lintPublishConfig(targetDir, structure) {
-	const issues = [];
-	for (const pkg of getPublishablePackages(targetDir, structure)) {
-		const manifest = readPackageJson(pkg.dir);
-		if (!manifest) continue;
-		const file = path.relative(targetDir, path.join(pkg.dir, "package.json"));
-		const pc = manifest.publishConfig;
-		const registry = isRecord(pc) ? pc["registry"] : void 0;
-		if (registry === void 0) {
-			issues.push({
-				kind: "missing",
-				package: pkg.name,
-				file,
-				message: `${pkg.name} is published from this repo but declares no publishConfig.registry, so its release destination is inherited -- a project .npmrc can repoint it silently. In ${file}, ${FIX}.`
-			});
+function detectForeignVersionOfRecord(targetDir) {
+	for (const { file, sections } of FOREIGN_VERSION_FILES) {
+		const full = path.join(targetDir, file);
+		if (!existsSync(full)) continue;
+		let content;
+		try {
+			content = readFileSync(full, "utf-8");
+		} catch (_error) {
 			continue;
 		}
-		if (!isUsableRegistry(registry)) issues.push({
-			kind: "malformed",
-			package: pkg.name,
-			file,
-			message: `${pkg.name} declares publishConfig.registry as ${JSON.stringify(registry)}, which is not an absolute http(s) URL and cannot be published to. In ${file}, ${FIX}.`
-		});
+		if (sectionHasStaticVersion(content, sections)) return file;
 	}
-	return issues;
 }
 /**
-* The registries this repo's publishable packages actually declare, distinct and in
-* first-seen order.
-*
-* Reuses the same "absolute http(s) URL" narrowing as {@link lintPublishConfig} rather
-* than re-deriving it -- a registry this misses here would fail that gate first, so
-* `repo:sync` never reaches a generator with an undeclared or malformed registry. A
-* caller that invokes a generator directly (or a repo whose publishable set is empty,
-* e.g. every package private) still gets a safe empty result.
+* The version-of-record conflict `release:simple` refuses on: the filename when
+* `stack: none` (so `package.json` is provably just the harness) meets a
+* `releaseStrategy: simple` and a foreign version-of-record file, else
+* `undefined`. A `javascript` repo (its `package.json` legitimately IS the
+* version) and an empty `stack: none` repo (no competing file) are both allowed.
 */
-function declaredPublishRegistries(targetDir, structure, rootPackageJson) {
-	const registries = [];
-	for (const pkg of getPublishablePackages(targetDir, structure, rootPackageJson)) {
-		const manifest = structure === "single" ? rootPackageJson ?? readPackageJson(pkg.dir) : readPackageJson(pkg.dir);
-		if (!manifest) continue;
-		const pc = manifest.publishConfig;
-		const registry = isRecord(pc) ? pc["registry"] : void 0;
-		if (typeof registry === "string" && isUsableRegistry(registry) && !registries.includes(registry)) registries.push(registry);
-	}
-	return registries;
+function releaseTargetConflict(stack, releaseStrategy, targetDir) {
+	if (stack !== "none" || releaseStrategy !== "simple") return void 0;
+	return detectForeignVersionOfRecord(targetDir);
 }
 //#endregion
-//#region src/generators/mise-pin.ts
+//#region src/release/publish/version-stamp.ts
+function splitLines(content) {
+	const trailingNewline = content.endsWith("\n");
+	return {
+		lines: (trailingNewline ? content.slice(0, -1) : content).split("\n"),
+		trailingNewline
+	};
+}
+function joinLines({ lines, trailingNewline }) {
+	return lines.join("\n") + (trailingNewline ? "\n" : "");
+}
+function stripCr(line) {
+	return line.endsWith("\r") ? line.slice(0, -1) : line;
+}
+/** `prefix + version + suffix` -- the exact line a matching entry is replaced with. */
+function expectedStampLine(entry, version) {
+	return entry.prefix + version + (entry.suffix ?? "");
+}
 /**
-* The mise version and release-asset digest the fleet's CI and the agent runner base image agree
-* to run. This is the one place that agreement is recorded; `packages/agent/test/runner-base-image-dockerfile.test.ts`
-* (task 8 of the mise-toolchain-provisioning plan) reads both constants back through
-* `readRepoFile` and asserts the base image's own `ARG MISE_VERSION` and `mise.sha256` manifest
-* agree with them, so the two packages cannot drift without a failing test on either side.
-*
-* Each constant sits under its own `// renovate:` marker comment, in the three-line grammar
-* `packages/agent/docker/agent-goose-image/goose.sha256` uses for its own digest line, so the same
-* shape of custom regex manager in the root `renovate.json` can rewrite both this version and this
-* digest (`customManagers` entries scoped to this file).
+* Indexes (into `content.split("\n")`, post trailing-newline removal) of every line that
+* starts with `entry.prefix`, ends with `entry.suffix` (default: none), and is at least
+* `prefix.length + suffix.length` characters long so the two cannot overlap on a
+* degenerate line. Compared against each line with a trailing `\r` stripped.
 */
-const MISE_VERSION = "2026.10.2";
-const MISE_LINUX_X64_SHA256 = "8f5f6660336f572830e33cd9b378d3131e529a0d4c4f0c553776be90a1ba302a";
-/** Where generated Forgejo workflows fetch the shared mise setup action: a composite action in
-* `bensandee/common`, on the forge every fleet repo lives on. GitHub cannot reach it; the
-* generators keep inline steps there. */
-const SETUP_MISE_ACTION_URL = "https://code.orangebikelabs.com/bensandee/common/actions/setup-mise";
-/** The tag in `bensandee/common` that marks the current release of the action. Generated `uses:`
-* lines carry it as their comment, and Renovate moves the SHA below to wherever it points. */
-const SETUP_MISE_ACTION_TAG = "setup-mise@latest";
-const SETUP_MISE_ACTION_SHA = "db99e4e9ee46bfeaca2146e7ae55cc700b4c23bf";
-//#endregion
-//#region src/generators/ci-utils.ts
-/** Build a GitHub Actions expression like `${{ expr }}` without triggering no-template-curly-in-string. */
-function actionsExpr(expr) {
-	return `\${{ ${expr} }}`;
+function matchingLineIndexes(content, entry) {
+	const suffix = entry.suffix ?? "";
+	const minLength = entry.prefix.length + suffix.length;
+	const { lines } = splitLines(content);
+	const indexes = [];
+	lines.forEach((rawLine, index) => {
+		const line = stripCr(rawLine);
+		if (line.startsWith(entry.prefix) && line.endsWith(suffix) && line.length >= minLength) indexes.push(index);
+	});
+	return indexes;
 }
-const MAIN_BRANCH_REF = "refs/heads/main";
-/** `if:` condition that gates a step to push events on the default branch. */
-const IS_MAIN_BRANCH = `github.ref == '${MAIN_BRANCH_REF}'`;
 /**
-* Negated form for concurrency `cancel-in-progress` and similar uses.
-*
-* Main is exempt from cancellation on purpose, and the exemption stays: a main run publishes and
-* pushes tags, and cancelling one mid-flight can leave a partial publish -- some packages on the
-* registry, no matching tags, and no run left alive to finish. A superseded feature-branch run
-* wastes minutes; a half-published release costs a manual unwind.
-*
-* So several main runs can be in flight at once, each versioning from its own triggering commit.
-* Overlap safety rests on one invariant: **main advances solely via commits that trigger a CI
-* run.** The `[skip ci]` coverage, health, and egress records go to `bst/*` orphan branches and
-* never to main; a `[skip ci]` commit pushed straight to main would leave a superseded run skipping
-* and its changesets stranded until the next push, which is why the supersession guard skips rather
-* than fails. Three guards carry the overlap itself: supersession plus a `--force-with-lease`
-* version push (`release/publish/version.ts`), the `headBumpedVersion` publish guard plus reading
-* remote tags and releases before acting (`commands/release-changesets.ts`,
-* `release/publish/publish.ts`), and floating git and Docker tags that only move forward
-* (`release/publish/floating-tags.ts`, `release/docker.ts`). Such a run may also version pending
-* changesets after it publishes -- the stale version-PR merge -- under the same supersession guard
-* and push lease as any other version run. A later commit publishes a bump only when its tag is
-* missing and every main run since the package's last release tag has settled
-* (`release/publish/unpublished-bump.ts`), so no run that could still publish it is in flight; a
-* manual re-run of one of those runs is the overlap left. On Forgejo the concurrency block is
-* only a PR-run cancellation mechanism -- it holds a main run in its group and, in Forgejo 16,
-* intermittently fails to release it, which is why main runs get a group of their own there. GitHub's shape stays shared
-* because its queue works: one run, one pending, a newer arrival replacing the pending, so
-* `changesets/action@v1` never needs a guard of its own. Any new side effect in a main run must be
-* idempotent under overlap or be listed here with the guard that makes it so.
+* `undefined` when exactly one line in `content` matches `entry`; otherwise the
+* user-facing sentence describing the zero- or many-match failure, naming the file, the
+* prefix, and the fix (a more specific prefix, or a second `versionStamp` entry). Both the
+* `release:assets` stamp phase and the `repo:sync` static gate report through this one
+* function so the two messages cannot drift apart.
 */
-const IS_NOT_MAIN_BRANCH = `github.ref != '${MAIN_BRANCH_REF}'`;
+function describeStampProblem(content, entry) {
+	const indexes = matchingLineIndexes(content, entry);
+	if (indexes.length === 1) return void 0;
+	const suffixClause = entry.suffix === void 0 ? "" : ` and suffix ${JSON.stringify(entry.suffix)}`;
+	const prefixClause = `prefix ${JSON.stringify(entry.prefix)}${suffixClause}`;
+	if (indexes.length === 0) return `${entry.file}: no line matches ${prefixClause}. Fix the prefix/suffix to match the file's actual content.`;
+	return `${entry.file}: ${indexes.length} lines match ${prefixClause}, which is ambiguous. Use a more specific prefix, or split this into a second versionStamp entry.`;
+}
+/**
+* Replaces the single line in `content` matching `entry` with `expectedStampLine(entry,
+* version)`, preserving that line's trailing `\r` and the file's trailing newline (or its
+* absence). Idempotent: stamping an already-stamped line reproduces the file byte for
+* byte. Precondition: `describeStampProblem(content, entry)` is `undefined` -- callers
+* must check that first, since this indexes the sole match directly.
+*/
+function stampContent(content, entry, version) {
+	const split = splitLines(content);
+	const [index] = matchingLineIndexes(content, entry);
+	const hasCr = split.lines[index].endsWith("\r");
+	const replacement = expectedStampLine(entry, version);
+	split.lines[index] = hasCr ? `${replacement}\r` : replacement;
+	return joinLines(split);
+}
+//#endregion
+//#region src/release/publish/assets.ts
+const CONVENTION_SCRIPT = "build:release-assets";
+const CONVENTION_OUTPUT_DIR = "release-assets";
+function configuredTargets(cwd, toolingConfig) {
+	return (toolingConfig?.releaseAssets ?? []).map((asset) => ({
+		commandCwd: cwd,
+		command: asset.command,
+		files: [{
+			path: path.resolve(cwd, asset.file),
+			...asset.name && { name: asset.name }
+		}]
+	}));
+}
+function conventionTargets(executor, cwd) {
+	const targets = [];
+	const checkDir = (relDir) => {
+		const absDir = path.resolve(cwd, relDir);
+		const raw = executor.readFile(path.join(absDir, "package.json"));
+		if (!raw) return;
+		if (!parsePackageJson(raw)?.scripts?.[CONVENTION_SCRIPT]) return;
+		targets.push({
+			commandCwd: absDir,
+			command: [
+				"pnpm",
+				"run",
+				CONVENTION_SCRIPT
+			],
+			files: [],
+			collectFromDir: path.join(absDir, CONVENTION_OUTPUT_DIR)
+		});
+	};
+	checkDir(".");
+	for (const dir of executor.listPackageDirs(cwd)) checkDir(path.join("packages", dir));
+	return targets;
+}
 /**
-* Job-level `env:` block that evaluates the default-branch check once, so steps
-* can gate on `env.IS_MAIN` instead of repeating the `github.ref` expression.
+* The release version `versionStamp` writes into each configured file: the root
+* `package.json#version`, the same source `release:simple` reads. A missing file, unparseable
+* JSON, and a manifest with no `version` are all rejected -- a missing version is the "ships
+* 0.0.0" failure this design exists to catch, never a skip.
 */
-const IS_MAIN_JOB_ENV = { IS_MAIN: actionsExpr(IS_MAIN_BRANCH) };
-/** `if:` condition referencing the job-level `IS_MAIN` env var (see {@link IS_MAIN_JOB_ENV}). */
-const IS_MAIN_ENV_GUARD = "env.IS_MAIN == 'true'";
+function resolveStampVersion(executor, cwd) {
+	const pkgPath = path.join(cwd, "package.json");
+	const raw = executor.readFile(pkgPath);
+	if (raw === null) throw new FatalError(`release:assets could not read package.json at ${pkgPath} to resolve the version for versionStamp.`);
+	const pkg = parsePackageJson(raw);
+	if (!pkg?.version) throw new FatalError(`release:assets could not find a "version" field in package.json at ${pkgPath}. versionStamp needs a version to stamp.`);
+	return pkg.version;
+}
 /**
-* npm's own registry-key rule for an `.npmrc` auth line: strip the scheme, keep
-* host/port/path, and end with exactly one slash. `actions/setup-node` derives the
-* same key from a registry URL; this mirrors that so a hand-written line matches
-* what npm looks up at publish time -- npm-registry-fetch walks the request path
-* upward through ancestor keys until one matches.
+* Stamps every `versionStamp` entry with `version`, before any build command runs. Throws
+* `describeStampProblem`'s message on a zero- or many-match config, so the two consumers
+* (this phase and `repo:sync`'s static gate) cannot report the failure differently.
 */
-function npmrcAuthKey(registryUrl) {
-	return `${registryUrl.replace(/^https?:/i, "").replace(/\/+$/, "")}/`;
+function stampVersionFiles(executor, cwd, toolingConfig, version) {
+	const entries = toolingConfig?.versionStamp ?? [];
+	const stamped = [];
+	for (const entry of entries) {
+		const filePath = path.resolve(cwd, entry.file);
+		const content = executor.readFile(filePath);
+		if (content === null) throw new FatalError(`versionStamp file not found: ${entry.file} (resolved to ${filePath})`);
+		const problem = describeStampProblem(content, entry);
+		if (problem) throw new FatalError(`versionStamp: ${problem}`);
+		const expectedLine = expectedStampLine(entry, version);
+		executor.writeFile(filePath, stampContent(content, entry, version));
+		log$1.info(`Stamped ${entry.file}: ${expectedLine}`);
+		stamped.push({
+			path: filePath,
+			expectedLine
+		});
+	}
+	return stamped;
 }
-const NODE_AUTH_TOKEN_VAR = ["$", "{NODE_AUTH_TOKEN}"].join("");
 /**
-* Build both halves of a job's npm auth wiring together, so one value decides
-* them: the auth lines the publishing step writes, and the step-level
-* `NODE_AUTH_TOKEN` it carries. A job that gets none of the declared registries
-* gets neither -- including a `publishes: true` job whose publishable set is
-* empty (every package private), since there is then no npmrc line for a real
-* secret to pair with.
-*
-* The lines go into a temp userconfig exported only inside the publishing
-* step's shell, never `~/.npmrc` or `$GITHUB_ENV`: pnpm 11 warns
-* `Failed to replace env in config` on every call that reads the placeholder
-* while the token is unset or empty, so a line in a shared file makes install, `ci:check`,
-* and every step after the publish warn. An empty job-level default does not
-* silence it, and `${NODE_AUTH_TOKEN:-}` is rejected as an empty fallback and
-* warns in every case. The `-n` guard keeps a run without the secret quiet; the
-* single quotes keep the token itself off disk, since npm expands it at read time.
+* Re-reads each stamped file and requires exactly one line equal to its `expectedLine`. Runs
+* after the build loop -- the only failure this read-back can catch that the stamp phase did not
+* already is the build overwriting the stamp (a `build:release-assets` script that regenerates or
+* copies over the stamped file).
 */
-function npmAuthWiring(ctx, publishes) {
-	const registries = publishes ? declaredPublishRegistries(ctx.targetDir, ctx.config.structure, ctx.packageJson) : [];
-	if (registries.length === 0) return {
-		publishRun: (command) => command,
-		tokenEnv: {}
-	};
-	const setup = [
-		"if [ -n \"$NODE_AUTH_TOKEN\" ]; then",
-		"  NPM_CONFIG_USERCONFIG=\"$(mktemp)\"",
-		"  export NPM_CONFIG_USERCONFIG",
-		"  if [ -f ~/.npmrc ]; then cat ~/.npmrc > \"$NPM_CONFIG_USERCONFIG\"; fi",
-		...registries.map((registry) => `  printf '\\n%s\\n' '${npmrcAuthKey(registry)}:_authToken=${NODE_AUTH_TOKEN_VAR}' >> "$NPM_CONFIG_USERCONFIG"`),
-		"fi"
-	];
-	return {
-		publishRun: (command) => [...setup, command].join("\n"),
-		tokenEnv: { NODE_AUTH_TOKEN: actionsExpr("secrets.NPM_TOKEN") }
-	};
+function verifyStamp(executor, stamped) {
+	for (const { path: filePath, expectedLine } of stamped) {
+		const matches = (executor.readFile(filePath) ?? "").split("\n").filter((line) => (line.endsWith("\r") ? line.slice(0, -1) : line) === expectedLine).length;
+		if (matches !== 1) throw new FatalError(`versionStamp verify failed for ${filePath}: expected exactly one line "${expectedLine}" after the build, found ${matches}. The build likely overwrote the stamp -- check for a script that regenerates or copies over this file.`);
+	}
 }
-const MISE_RELEASE_URL = `https://github.com/jdx/mise/releases/download/v${MISE_VERSION}/mise-v${MISE_VERSION}-linux-x64`;
 /**
-* The node script `inlineMiseSteps` pipes `mise env --json` into, run under the mise it just
-* installed. Reads the env map off stdin (mise exec passes it straight through) and exports every
-* key except `PATH` into `$GITHUB_ENV` in heredoc form -- the form that survives any value,
-* including one containing `$` or quotes -- then appends mise's shim directory and the
-* `~/.local/bin` install location to `$GITHUB_PATH` so every later step sees node, pnpm, and any
-* other declared tool on PATH with no prefix.
+* The whole stamp phase, gated on a non-empty `versionStamp`: refuse a foreign
+* version-of-record, resolve the release version, and stamp every entry. Returns `[]`
+* untouched (no real-filesystem read, no executor read) when the repo configures no
+* `versionStamp`, so no existing call path changes behaviour.
 */
-const MISE_ENV_EXPORT_SCRIPT = [
-	"const fs = require(\"fs\");",
-	"const env = JSON.parse(fs.readFileSync(0, \"utf8\"));",
-	"let out = \"\";",
-	"for (const [key, value] of Object.entries(env)) {",
-	"  if (key === \"PATH\") continue;",
-	"  out += key + \"<<BST_MISE_ENV_EOF\\n\" + value + \"\\nBST_MISE_ENV_EOF\\n\";",
-	"}",
-	"fs.appendFileSync(process.env.GITHUB_ENV, out);",
-	"fs.appendFileSync(",
-	"  process.env.GITHUB_PATH,",
-	"  process.env.HOME + \"/.local/share/mise/shims\\n\" + process.env.HOME + \"/.local/bin\\n\",",
-	");"
-].join("\n");
-/** A fresh object per call: one shared object in two jobs would serialize as a YAML alias. */
-function pnpmStoreCacheStep() {
-	return { step: {
-		name: "Cache pnpm store",
-		uses: "actions/cache@v4",
-		with: {
-			path: "~/.local/share/pnpm/store",
-			key: `pnpm-${actionsExpr("runner.os")}-${actionsExpr("hashFiles('pnpm-lock.yaml')")}`
+function runVersionStampPhase(executor, config) {
+	if ((config.toolingConfig?.versionStamp ?? []).length === 0) return [];
+	const conflict = detectForeignVersionOfRecord(config.cwd);
+	if (conflict) throw new FatalError(`release:assets stamps package.json's version into versionStamp files, but this repo's version-of-record is ${conflict}. A stamp would carry a version the ${conflict} artifact never gets. Release this repo through its own toolchain, or remove the versionStamp block.`);
+	const version = resolveStampVersion(executor, config.cwd);
+	return stampVersionFiles(executor, config.cwd, config.toolingConfig, version);
+}
+function runBuild(executor, target, config) {
+	if (!target.command || target.command.length === 0) return;
+	const [file, ...args] = target.command;
+	if (!file) return;
+	const label = target.commandCwd === config.cwd ? "root" : path.relative(config.cwd, target.commandCwd);
+	log$1.info(`Building assets in ${label}: ${target.command.join(" ")}`);
+	executor.execInherit(file, args, { cwd: target.commandCwd });
+	debug(config, `Asset build completed for ${label}`);
+}
+function collectFromDir(executor, target) {
+	if (!target.collectFromDir) return;
+	const before = target.files.length;
+	for (const entry of executor.listFiles(target.collectFromDir)) target.files.push({ path: path.join(target.collectFromDir, entry) });
+	if (target.files.length === before) throw new FatalError(`${CONVENTION_SCRIPT} ran in ${target.commandCwd} but emitted no files to ${target.collectFromDir}. Update your script to write artifacts there, or declare assets explicitly via releaseAssets in .tooling.json.`);
+}
+function uploadToGitHub(executor, config, tag, asset) {
+	const assetName = asset.name ?? path.basename(asset.path);
+	const result = executor.exec("gh", [
+		"release",
+		"upload",
+		tag,
+		asset.path,
+		"--clobber"
+	], { cwd: config.cwd });
+	debugExec(config, `gh release upload ${tag} ${assetName}`, result);
+	if (result.exitCode !== 0) throw new FatalError(`GitHub release upload failed for ${assetName}: ${result.stderr || result.stdout}`);
+	log$1.info(`Uploaded ${assetName} to ${tag} (GitHub)`);
+}
+async function uploadToForgejo(executor, conn, tag, asset) {
+	const assetName = asset.name ?? path.basename(asset.path);
+	const fileBuffer = executor.readFileBuffer(asset.path);
+	if (!fileBuffer) throw new FatalError(`Asset file not found: ${asset.path}`);
+	await uploadReleaseAsset(executor, conn, tag, {
+		assetName,
+		fileBuffer
+	});
+	log$1.info(`Uploaded ${assetName} to ${tag} (Forgejo)`);
+}
+async function runReleaseAssets(executor, config) {
+	debug(config, `Config: dryRun=${String(config.dryRun)} cwd=${config.cwd}`);
+	const targets = [...configuredTargets(config.cwd, config.toolingConfig), ...conventionTargets(executor, config.cwd)];
+	const stampedFiles = runVersionStampPhase(executor, config);
+	for (const target of targets) {
+		runBuild(executor, target, config);
+		collectFromDir(executor, target);
+	}
+	verifyStamp(executor, stampedFiles);
+	if (targets.length === 0) {
+		log$1.info(`No release assets configured in .tooling.json or by convention (${CONVENTION_SCRIPT} script)`);
+		return;
+	}
+	if (config.dryRun) {
+		log$1.info("[dry-run] Skipping upload");
+		return;
+	}
+	if (!config.platform) throw new FatalError("Platform connection is required for asset upload");
+	const tagResult = executor.exec("git", [
+		"tag",
+		"--points-at",
+		"HEAD"
+	], { cwd: config.cwd });
+	debugExec(config, "git tag --points-at HEAD", tagResult);
+	if (tagResult.exitCode !== 0) throw new FatalError("Could not determine current tags");
+	const tags = tagResult.stdout.trim().split("\n").filter(Boolean);
+	if (tags.length === 0) {
+		log$1.info("No tags pointing to HEAD, skipping upload");
+		return;
+	}
+	let uploaded = 0;
+	for (const tag of tags) {
+		if (!await releaseExists(executor, config, tag)) {
+			log$1.info(`No release found for ${tag}, skipping (likely a sliding tag)`);
+			continue;
 		}
-	} };
+		log$1.info(`Uploading assets to release ${tag}`);
+		for (const target of targets) for (const asset of target.files) if (config.platform.type === "github") uploadToGitHub(executor, config, tag, asset);
+		else await uploadToForgejo(executor, config.platform.conn, tag, asset);
+		uploaded++;
+	}
+	if (uploaded === 0) log$1.info("No releases found for any tag pointing to HEAD, skipping upload");
 }
-/** Actions whose ref the generator pins itself, so `preservePinnedActions` must not keep a
-* repo's older ref for them. */
-const GENERATOR_OWNED_ACTIONS = [{
-	name: SETUP_MISE_ACTION_URL,
-	comment: SETUP_MISE_ACTION_TAG
-}];
+async function releaseExists(executor, config, tag) {
+	if (!config.platform) return false;
+	if (config.platform.type === "forgejo") return findRelease(executor, config.platform.conn, tag);
+	const result = executor.exec("gh", [
+		"release",
+		"view",
+		tag
+	], { cwd: config.cwd });
+	debugExec(config, `gh release view ${tag}`, result);
+	return result.exitCode === 0;
+}
+//#endregion
+//#region src/generators/gitignore.ts
+/** Entries that every project should have -- repo:sync --check flags these as missing. */
+const REQUIRED_ENTRIES = [
+	"node_modules/",
+	".pnpm-store/",
+	"dist/",
+	"*.tsbuildinfo",
+	".env",
+	".env.*",
+	"!.env.example"
+];
 /**
-* The steps every workflow generator uses in place of `pnpm/action-setup` + `actions/setup-node`:
-* install the pinned `mise`, `mise install` the repo's `mise.toml` toolchain, export its env into
-* the rest of the job, and cache the pnpm store. `MISE_VERSION`/`MISE_LINUX_X64_SHA256`
-* (`mise-pin.ts`) are the same pin the agent runner's base image installs, checked by
-* `runner-base-image-dockerfile.test.ts`.
+* Tooling-specific entries added during init/update but not required for repo:sync --check.
 *
-* On Forgejo the mise half is the shared composite action in `bensandee/common`, pinned by commit.
-* GitHub resolves actions only from github.com, so it keeps the same steps inline.
+* `.superpowers/` is agent scratch state (task briefs, review diffs, the SDD progress ledger)
+* that the superpowers plugin writes into whatever repo it runs in. The plugin's own protection
+* is a self-ignoring `.superpowers/sdd/.gitignore` it creates as a side effect of running a
+* skill -- untracked, so it never reaches a clone, and scoped to `sdd/`, so any sibling folder a
+* future skill writes lands untracked-but-not-ignored and one `git add -A` commits it. Ignore
+* the whole directory here for the same reason as `.tooling-archived/`: it is tool-generated
+* scratch that appears without the user asking, so the tool should be what ignores it.
 */
-function miseSetupSteps(ci) {
-	if (ci !== "forgejo") return inlineMiseSteps();
-	return [{ step: {
-		name: "Set up mise",
-		uses: `${SETUP_MISE_ACTION_URL}@${SETUP_MISE_ACTION_SHA}`,
-		with: {
-			version: MISE_VERSION,
-			sha256: MISE_LINUX_X64_SHA256
-		}
-	} }, pnpmStoreCacheStep()];
-}
+const OPTIONAL_ENTRIES = [
+	".tooling-migrate.md",
+	".tooling-archived/",
+	".claude/hooks/bst-hook.audit.local.jsonl*",
+	".superpowers/",
+	"coverage/"
+];
 /**
-* The inline form of the shared action, for GitHub. Uses `mise env --json` piped into the
-* just-installed mise's own `node -e`, not `mise env --shell bash`: the JSON form is
-* shell-independent and the interpreter reading it is guaranteed to exist (mise just installed
-* it), so this needs no assumption about which shell the runner's `run:` steps use.
+* Optional entries added only when a feature is actually configured.
+* Patterns are written without a leading slash so they match at any depth --
+* a single `release-assets/` entry in the root .gitignore covers monorepo
+* subpackage output like `packages/app/release-assets/` too.
 */
-function inlineMiseSteps() {
-	const installScript = [
-		"curl -fsSL -o \"$RUNNER_TEMP/mise\" " + MISE_RELEASE_URL,
-		`echo "${MISE_LINUX_X64_SHA256}  $RUNNER_TEMP/mise" | sha256sum -c`,
-		"mkdir -p \"$HOME/.local/bin\" && install -m 0755 \"$RUNNER_TEMP/mise\" \"$HOME/.local/bin/mise\"",
-		"export MISE_TRUSTED_CONFIG_PATHS=\"$GITHUB_WORKSPACE\"",
-		"export MISE_YES=1",
-		"\"$HOME/.local/bin/mise\" install",
-		`"$HOME/.local/bin/mise" env --json | "$HOME/.local/bin/mise" exec -- node -e '${MISE_ENV_EXPORT_SCRIPT}'`
-	].join("\n");
-	return [
-		{ step: {
-			name: "Cache mise tools",
-			uses: "actions/cache@v4",
-			with: {
-				path: "~/.local/share/mise",
-				key: `mise-${actionsExpr("runner.os")}-${actionsExpr("hashFiles('mise.toml')")}`
-			}
-		} },
-		pnpmStoreCacheStep(),
-		{ step: {
-			name: "Install mise",
-			env: { GITHUB_TOKEN: "" },
-			run: installScript
-		} }
+function conditionalEntries(ctx) {
+	const entries = [];
+	if (hasReleaseAssets(ctx)) entries.push(`${CONVENTION_OUTPUT_DIR}/`);
+	return entries;
+}
+/** Normalize a gitignore entry for comparison: strip leading `/` and trailing `/`. */
+function normalizeEntry(entry) {
+	let s = entry.trim();
+	if (s.startsWith("/")) s = s.slice(1);
+	if (s.endsWith("/")) s = s.slice(0, -1);
+	return s;
+}
+async function generateGitignore(ctx) {
+	const filePath = ".gitignore";
+	const allEntries = [
+		...REQUIRED_ENTRIES,
+		...OPTIONAL_ENTRIES,
+		...conditionalEntries(ctx)
 	];
+	const existing = ctx.read(filePath);
+	if (existing) {
+		const existingNormalized = new Set(existing.split("\n").map(normalizeEntry).filter((line) => line.length > 0));
+		const missing = allEntries.filter((entry) => !existingNormalized.has(normalizeEntry(entry)));
+		if (missing.length === 0) return {
+			filePath,
+			action: "skipped",
+			description: "Already has all standard entries"
+		};
+		const missingRequired = REQUIRED_ENTRIES.filter((entry) => !existingNormalized.has(normalizeEntry(entry)));
+		const updated = existing.trimEnd() + "\n\n# Added by @bensandee/tooling\n" + missing.join("\n") + "\n";
+		ctx.write(filePath, updated);
+		if (missingRequired.length === 0) return {
+			filePath,
+			action: "skipped",
+			description: "Only optional entries missing"
+		};
+		return {
+			filePath,
+			action: "updated",
+			description: `Appended ${String(missing.length)} missing entries`
+		};
+	}
+	ctx.write(filePath, allEntries.join("\n") + "\n");
+	return {
+		filePath,
+		action: "created",
+		description: "Generated .gitignore"
+	};
 }
+//#endregion
+//#region src/generators/gitattributes.ts
+const MANAGED_HEADER = ["# Managed by @bensandee/tooling: LF working tree on every platform, overriding", "# core.autocrlf/core.eol at checkout. Rules below this line win over it."].join("\n");
+/** Placed only when prepending above a consumer's existing content -- explains, in the file
+* itself, why the rule goes first rather than last (the code has no other way to show it). */
+const PREPEND_REASON = ["# Prepended above your existing rules: .gitattributes is last-match-wins, so a rule", "# placed below would override any binary/-text marks you already have."].join("\n");
+const RULE_LINE = "* text=auto eol=lf";
 /**
-* Build the docker publish env block.
-*
-* The LHS env-var names (`DOCKER_USERNAME` / `DOCKER_PASSWORD`) match what
-* publish-docker.ts reads at runtime. The RHS secret references are
-* registry-specific (see {@link dockerSecretNames}) so downstream repos can
-* stop relying on the user/org-level `DOCKER_USERNAME` / `DOCKER_PASSWORD`
-* secrets -- which the Forgejo act fork auto-injects into every `container:`
-* image pull regardless of the target registry.
-*
-* When `host` is `null` (couldn't be derived at gen time), the secret references
-* fall back to neutral `REGISTRY_USERNAME` / `REGISTRY_PASSWORD` and the
-* workflow keeps `DOCKER_REGISTRY_HOST` / `DOCKER_REGISTRY_NAMESPACE` so the CLI
-* resolves the registry at runtime.
+* True when `content` already carries a rule equivalent to `* text=auto eol=lf`: a
+* non-comment line whose first whitespace-separated token is exactly `*` and whose
+* remaining tokens include both `text=auto` and `eol=lf`, in either order. Token-based so
+* reordered or extra-whitespace variants still count, but a narrower pattern (`*.ts ...`)
+* or a commented-out line does not.
 */
-function dockerPublishEnv(host) {
-	const { username, password } = dockerSecretNames(host);
+function hasLfRule(content) {
+	return content.split("\n").some((line) => {
+		const trimmed = line.trim();
+		if (trimmed.startsWith("#")) return false;
+		const tokens = trimmed.split(/\s+/).filter(Boolean);
+		if (tokens[0] !== "*") return false;
+		const rest = new Set(tokens.slice(1));
+		return rest.has("text=auto") && rest.has("eol=lf");
+	});
+}
+/**
+* Scaffold `.gitattributes` with `* text=auto eol=lf`, the rule that makes the working tree
+* LF regardless of a developer's global `core.autocrlf`/`core.eol`. No managed-file header
+* from `utils/generated-header.ts` -- this file is merged into like `.gitignore`, not
+* wholesale-regenerated. The rule is required, not optional: a missing rule is
+* created/updated and fails `repo:sync --check` like any other drift.
+*/
+async function generateGitattributes(ctx) {
+	const filePath = ".gitattributes";
+	const existing = ctx.read(filePath);
+	if (existing === void 0 || existing.trim() === "") {
+		ctx.write(filePath, `${MANAGED_HEADER}\n${RULE_LINE}\n`);
+		return {
+			filePath,
+			action: existing === void 0 ? "created" : "updated",
+			description: "Generated .gitattributes"
+		};
+	}
+	if (hasLfRule(existing)) return {
+		filePath,
+		action: "skipped",
+		description: "Already has the LF rule"
+	};
+	const updated = `${MANAGED_HEADER}\n${PREPEND_REASON}\n${RULE_LINE}\n\n${existing}`;
+	ctx.write(filePath, updated);
 	return {
-		...host === null ? {
-			DOCKER_REGISTRY_HOST: actionsExpr("vars.DOCKER_REGISTRY_HOST"),
-			DOCKER_REGISTRY_NAMESPACE: actionsExpr("vars.DOCKER_REGISTRY_NAMESPACE")
-		} : {},
-		DOCKER_USERNAME: actionsExpr(`secrets.${username}`),
-		DOCKER_PASSWORD: actionsExpr(`secrets.${password}`),
-		RELEASE_DEBUG: actionsExpr("vars.RELEASE_DEBUG || 'false'")
+		filePath,
+		action: "updated",
+		description: "Prepended the LF rule"
 	};
 }
 //#endregion
@@ -9952,21 +9985,36 @@ function buildSteps(strategy, ctx) {
 		default: return null;
 	}
 }
+/**
+* Whether this release strategy gets its own `release.yml`.
+*
+* `changesets` releases from the CI workflow (`generateCi` writes that step inline) and `none`
+* releases nothing. Exported for `generateStaleCiWorkflows`, which asks the same question to
+* decide whether a `release.yml` on disk is still current -- the two must not answer it
+* differently or the retirer deletes a file this generator has just written.
+*/
+function hasReleaseWorkflow(strategy) {
+	return strategy === "simple" || strategy === "release-it";
+}
+/** Where this platform's release workflow lives. */
+function releaseWorkflowPath(ci) {
+	return ci === "github" ? ".github/workflows/release.yml" : ".forgejo/workflows/release.yml";
+}
 async function generateReleaseCi(ctx) {
 	const filePath = "release-ci";
-	if (ctx.config.releaseStrategy === "none" || ctx.config.ci === "none") return {
+	const isGitHub = ctx.config.ci === "github";
+	if (ctx.config.ci === "none" || ctx.config.releaseStrategy === "none") return {
 		filePath,
 		action: "skipped",
 		description: "Release CI workflow not applicable"
 	};
-	const publishesNpm = ctx.config.publishNpm === true;
-	if (ctx.config.releaseStrategy === "changesets") return {
+	if (!hasReleaseWorkflow(ctx.config.releaseStrategy)) return {
 		filePath,
 		action: "skipped",
 		description: "Release step included in CI workflow"
 	};
-	const isGitHub = ctx.config.ci === "github";
-	const workflowPath = isGitHub ? ".github/workflows/release.yml" : ".forgejo/workflows/release.yml";
+	const publishesNpm = ctx.config.publishNpm === true;
+	const workflowPath = releaseWorkflowPath(ctx.config.ci);
 	const hasDocker = hasDockerPackages(ctx) && ctx.config.publishDocker;
 	const hasAssets = hasReleaseAssets(ctx) || hasVersionStamp(ctx);
 	const host = resolveGenTimeHost(ctx);
@@ -10173,7 +10221,13 @@ function checkSteps(ci, coverageEnabled, emitDockerSweepStep) {
 		} }
 	];
 }
-/** Resolve the CI workflow filename based on release strategy. */
+/**
+* Resolve the CI workflow filename based on release strategy.
+*
+* Exported for `generateStaleCiWorkflows`, which derives the file the current strategy keeps
+* from this one function rather than a second copy of the mapping -- if the two could drift
+* apart, the retirer would delete a file this generator has just written.
+*/
 function ciWorkflowPath(ci, releaseStrategy) {
 	return `${ci === "github" ? ".github/workflows" : ".forgejo/workflows"}/${releaseStrategy === "changesets" ? "ci.yml" : "check.yml"}`;
 }
@@ -11172,7 +11226,7 @@ function buildConfig$1(config) {
 	].join("\n");
 }
 /** Where `ctx.remove()` puts what it archives. Named here only to describe it to the user. */
-const ARCHIVE_DIR$1 = ".tooling-archived";
+const ARCHIVE_DIR = ".tooling-archived";
 /** Common client-side git hooks that husky may have configured. */
 const HUSKY_HOOK_NAMES = [
 	"pre-commit",
@@ -11206,7 +11260,7 @@ function archiveHuskyHooks(ctx, results) {
 			results.push({
 				filePath: huskyPath,
 				action: "archived",
-				description: `Moved to ${ARCHIVE_DIR$1}/${huskyPath}`
+				description: `Moved to ${ARCHIVE_DIR}/${huskyPath}`
 			});
 			found = true;
 		}
@@ -11221,7 +11275,7 @@ function archiveLintStagedConfigs(ctx, results) {
 		results.push({
 			filePath: lsPath,
 			action: "archived",
-			description: `Moved to ${ARCHIVE_DIR$1}/${lsPath}`
+			description: `Moved to ${ARCHIVE_DIR}/${lsPath}`
 		});
 		found = true;
 	}
@@ -11429,12 +11483,17 @@ async function generateVscodeSettings(ctx) {
 }
 //#endregion
 //#region src/generators/coverage-ci.ts
-/** Where `ctx.remove()` puts what it archives. Named here only to describe it to the user. */
-const ARCHIVE_DIR = ".tooling-archived";
 /**
-* Cleanup-only generator: coverage steps now run inline in ci.yml (see
-* generateCi). Any legacy coverage.yml left over from a previous version is
-* archived to .tooling-archived/ on the next repo:sync.
+* Cleanup-only generator: coverage steps now run inline in the CI workflow (see generateCi), so
+* any legacy `coverage.yml` left over from an older sync is removed.
+*
+* The result is `removed`, not `archived`: `repo:sync --check` counts only the former as drift,
+* and the agent's workflow sync sweep acts only on drift the check reports. An `archived` result
+* let a plain `repo:sync` delete a file while `--check` called the repo up to date.
+*
+* The ignore comment is the only opt-out here, and there is deliberately no managed-header guard:
+* this file predates the header, so no legacy `coverage.yml` in a synced repo carries one. Requiring
+* it would leave every file this generator exists to remove exactly where it is.
 */
 async function generateCoverageCi(ctx) {
 	const filePath = "coverage-ci";
@@ -11444,19 +11503,23 @@ async function generateCoverageCi(ctx) {
 		description: "CI workflow not requested"
 	};
 	const workflowPath = ctx.config.ci === "github" ? ".github/workflows/coverage.yml" : ".forgejo/workflows/coverage.yml";
-	if (ctx.read(workflowPath) !== void 0) {
-		ctx.remove(workflowPath);
-		return {
-			filePath: workflowPath,
-			action: "archived",
-			description: `Moved to ${ARCHIVE_DIR}/${workflowPath} (coverage now runs inline in ci.yml)`
-		};
-	}
-	return {
+	const existing = ctx.read(workflowPath);
+	if (existing === void 0) return {
 		filePath,
 		action: "skipped",
 		description: "Coverage runs inline in ci.yml"
 	};
+	if (isToolingIgnored(existing)) return {
+		filePath: workflowPath,
+		action: "skipped",
+		description: "coverage.yml has ignore comment"
+	};
+	ctx.remove(workflowPath);
+	return {
+		filePath: workflowPath,
+		action: "removed",
+		description: `Moved to ${ARCHIVE_DIR$1}/${workflowPath} (coverage now runs inline in ci.yml)`
+	};
 }
 //#endregion
 //#region src/docs-check/blocks.ts
@@ -12937,12 +13000,74 @@ async function generateVersionrc(ctx) {
 	};
 }
 //#endregion
+//#region src/generators/stale-ci-workflows.ts
+/**
+* Cleanup-only generator: retire the strategy-dependent CI workflow that the repo's current
+* `releaseStrategy` no longer writes.
+*
+* `generateCi` names its file after the release strategy (`ci.yml` for changesets, `check.yml`
+* for every other strategy), and `generateReleaseCi` writes `release.yml` for two of the four.
+* Changing `.tooling.json#releaseStrategy` therefore leaves the previous file on disk, where it
+* keeps running the check pipeline or a release job beside the new one. Nothing else removes it:
+* no generator names a file the current strategy does not use, so no generator reports it.
+*
+* The kept set comes from the two generators' own functions -- `ciWorkflowPath` for the CI file
+* and `hasReleaseWorkflow` for `release.yml` -- never from a table copied here. That is the whole
+* safety argument: this retirer cannot delete a file the generator has just written, because both
+* read one mapping.
+*
+* `ci: "none"` retires nothing. A repo that switched CI off is not claiming these files are
+* stale, and emptying a workflow directory a human chose to manage by hand is not this
+* generator's call.
+*/
+async function generateStaleCiWorkflows(ctx) {
+	const ci = ctx.config.ci;
+	if (ci === "none") return [];
+	const strategy = ctx.config.releaseStrategy;
+	const keptCiPath = ciWorkflowPath(ci, strategy);
+	const candidates = [
+		ciWorkflowPath(ci, "changesets"),
+		ciWorkflowPath(ci, "none"),
+		releaseWorkflowPath(ci)
+	];
+	const kept = /* @__PURE__ */ new Set([keptCiPath]);
+	if (hasReleaseWorkflow(strategy)) kept.add(releaseWorkflowPath(ci));
+	const results = [];
+	for (const candidate of candidates) {
+		if (kept.has(candidate)) continue;
+		const result = retireManagedWorkflow(ctx, candidate, retireReason(strategy, candidate, keptCiPath, ci));
+		if (result !== void 0) results.push(result);
+	}
+	return results;
+}
+/** Last path segment. `node:path` has no opinion about workflow separators, and these are
+* always POSIX paths, so this stays here rather than pulling in a platform-aware helper. */
+function baseName(workflowPath) {
+	return workflowPath.slice(workflowPath.lastIndexOf("/") + 1);
+}
+/**
+* Why this file is stale, naming the strategy that made it so, so the sync sweep's pull request
+* and the `--check` output explain the deletion without the reader opening a generator.
+*
+* Every branch reads the kept path, never a strategy literal: a changesets repo runs its release
+* step inside `ci.yml`, so a retired `release.yml` there says the release moved there, and
+* anywhere else the strategy has no release workflow at all.
+*/
+function retireReason(strategy, retiredPath, keptCiPath, ci) {
+	const keptCiBaseName = baseName(keptCiPath);
+	const prefix = `releaseStrategy "${strategy}"`;
+	if (retiredPath !== releaseWorkflowPath(ci)) return `${prefix} runs checks in ${keptCiBaseName}`;
+	if (keptCiPath === ciWorkflowPath(ci, "changesets")) return `${prefix} releases from ${keptCiBaseName}`;
+	return `${prefix} has no release workflow`;
+}
+//#endregion
 //#region src/generators/pipeline.ts
 /** Run all generators sequentially and return their results. */
 async function runGenerators(ctx) {
 	const results = [];
+	const priorDevEngines = ctx.packageJson?.devEngines;
 	results.push(await generatePackageJson(ctx));
-	results.push(await generateMise(ctx));
+	results.push(await generateMise(ctx, priorDevEngines));
 	results.push(...await generateWorkspaceEngines(ctx));
 	results.push(await generatePnpmWorkspace(ctx));
 	results.push(...await generateTsconfig(ctx));
@@ -12961,6 +13086,7 @@ async function runGenerators(ctx) {
 	results.push(await generateVersionrc(ctx));
 	results.push(await generateChangesets(ctx));
 	results.push(await generateReleaseCi(ctx));
+	results.push(...await generateStaleCiWorkflows(ctx));
 	results.push(await generateDeployCi(ctx));
 	results.push(await generateCoverageCi(ctx));
 	results.push(...await generateClaudeMd(ctx));
@@ -12993,7 +13119,7 @@ function reportFailures(failed, command) {
 function generateMigratePrompt(results, config, detected) {
 	const sections = [];
 	const timestamp = (/* @__PURE__ */ new Date()).toISOString();
-	sections.push(`# Migration Prompt\n\n_Generated by \`@bensandee/tooling@0.87.0 repo:sync\` on ${timestamp}_\n`);
+	sections.push(`# Migration Prompt\n\n_Generated by \`@bensandee/tooling@0.87.1 repo:sync\` on ${timestamp}_\n`);
 	const changed = results.filter((r) => r.action === "created" || r.action === "updated" || r.action === "archived");
 	if (changed.length > 0) {
 		const items = changed.map((r) => {
@@ -22082,12 +22208,16 @@ const PROBE_TIMEOUT_SECONDS = "5";
 * Pinned by digest, not a tag: a tag-pinned probe image would re-pull (and
 * could silently change) on every check run, reintroducing this exact
 * issue's silent-timeout symptom on the very shared-agent CI runners it
-* targets, since registry egress is often restricted there. Resolved from
-* `curlimages/curl:8.21.0` (the latest stable tag as of 2026-07-16) via the
-* Docker Hub registry API -- this is the digest of the multi-arch manifest
-* list, so `docker run` still resolves the correct platform automatically.
+* targets, since registry egress is often restricted there. The digest is
+* the multi-arch manifest list's, so `docker run` still resolves the correct
+* platform automatically.
+*
+* The tag rides along only for Renovate: Docker resolves a `tag@digest`
+* reference by the digest alone, and the root `renovate.json` has a custom
+* manager that reads the tag as the current version and moves tag and digest
+* together.
 */
-const PROBE_IMAGE = "curlimages/curl@sha256:7c12af72ceb38b7432ab85e1a265cff6ae58e06f95539d539b654f2cfa64bb13";
+const PROBE_IMAGE = "curlimages/curl:8.21.0@sha256:7c12af72ceb38b7432ab85e1a265cff6ae58e06f95539d539b654f2cfa64bb13";
 /** Look up the health status of a specific service from container info. */
 function getContainerHealth(containers, serviceName) {
 	return containers.find((c) => c.Service === serviceName)?.Health ?? "unknown";
@@ -32363,6 +32493,11 @@ function taskLabelNumber(text) {
 * statement speaks for every future slice, the progress note only for this one. `**Progress:**`
 * and `**Blocked:**` alone declare nothing.
 *
+* A box's **title** is the first sentence of its paragraph, not of its line: markdown joins a
+* wrapped box into one paragraph, and a title cut at the wrap read as a fragment on the control
+* panel. `**` markers are dropped from it. The title is the identity the agent's box diff pairs
+* on, so it must stay a pure function of the box's own text.
+*
 * A box is the **retire task** when its title starts with optional `**` or `__`, then the
 * literal `Retire this plan`, word-bounded (not followed by a letter or digit). That
 * classification carries no judgement about whether the task is done; `isOutstanding` reads a
@@ -32390,6 +32525,49 @@ function noteKind(label) {
 	if (label === "Blocked") return "blocked";
 	return "declined";
 }
+/** A line that ends a box's paragraph: another list item, or a `**Progress:**`-shaped note. */
+const PARAGRAPH_BREAK_REGEX = /^[ \t]*(?:[-*+][ \t]|[0-9]+[.)][ \t]|\*\*(?:Progress|Blocked|Declined):\*\*)/;
+/** A word whose trailing period abbreviates rather than ends a sentence. */
+const ABBREVIATION_REGEX = /(?:^|[^A-Za-z])(?:e\.g|i\.e|etc|vs|cf)$/i;
+/**
+* The box line's text joined with the lines that continue its paragraph, one space apart. Markdown
+* renders a wrapped box as one paragraph, so a line break says nothing about where the title ends.
+* The paragraph stops at a blank line, a heading, a fenced line, another list item, or a note.
+*/
+function boxParagraph(lines, fenced, start, end, first) {
+	const parts = [first];
+	for (let index = start + 1; index < end; index++) {
+		const line = lines[index] ?? "";
+		if (fenced[index] === true || line.trim() === "") break;
+		if (HEADING_REGEX.test(line) || PARAGRAPH_BREAK_REGEX.test(line)) break;
+		parts.push(line.trim());
+	}
+	return parts.join(" ").trim();
+}
+/**
+* The paragraph's first sentence: up to the first `.`, `!` or `?` outside an inline code span that
+* is followed by whitespace or the end, with any closing `*`, `_`, `)` or quote kept on it so a
+* bold span ending in a period stays whole. A common abbreviation (`e.g.`) does not end it. A
+* paragraph with no sentence end is returned whole.
+*/
+function firstSentence$1(paragraph) {
+	let inCode = false;
+	for (let index = 0; index < paragraph.length; index++) {
+		const char = paragraph[index];
+		if (char === "`") inCode = !inCode;
+		if (inCode || char !== "." && char !== "!" && char !== "?") continue;
+		let end = index + 1;
+		while (end < paragraph.length && /[*_)"']/.test(paragraph[end] ?? "")) end++;
+		if (end < paragraph.length && !/\s/.test(paragraph[end] ?? "")) continue;
+		if (char === "." && ABBREVIATION_REGEX.test(paragraph.slice(0, index))) continue;
+		return paragraph.slice(0, end);
+	}
+	return paragraph;
+}
+/** `**` markers outside inline code spans removed: the title is shown as plain text. */
+function stripStrong(text) {
+	return text.split(/(`[^`]*`)/).map((part) => part.startsWith("`") ? part : part.replaceAll("**", "")).join("").trim();
+}
 /**
 * The checkbox marker stripped, then a `**`/`__` span wrapping the whole title unwrapped (only
 * when the closing marker matches the opening one, so a title merely starting or ending with the
@@ -32426,7 +32604,7 @@ function parsePlanBoxes(planText) {
 				break;
 			}
 		}
-		const title = unwrapEmphasis(box.rawTitle);
+		const title = stripStrong(unwrapEmphasis(firstSentence$1(boxParagraph(lines, fenced, box.index, blockEnd, box.rawTitle))));
 		const retireTask = RETIRE_TASK_REGEX.test(title);
 		if (box.checked) return {
 			line: box.index,
@@ -32959,7 +33137,7 @@ setForgejoLogger(log$1);
 * `local <sha>[-dirty]` otherwise -- so an artifact built from the working tree
 * can't pass itself off as the published release whose version it carries.
 */
-const displayVersion = "0.87.0";
+const displayVersion = "0.87.1";
 /**
 * The registered `bst` subcommand map, exported so both the JSON entry path below (resolving a
 * command name before citty parses anything) and the coverage test (enumerating every