@deltabox/toolchain 2.1.1 → 2.3.2

package/CHANGELOG.md

@@ -1,23 +1,159 @@
 # Changelog
 
-## 2.1.1 (October 2026)
+## 2.3.2 (November 2026)
 
 <!-- release:start -->
 
 ### Bug fixes
-#### Changelog
-- Use the release-notes helper for releases ([#36616f0](https://github.com/deltabox-studio/toolchain/commit/36616f0) by [T0chi](https://github.com/T0chi))
-  - Replace the custom release workflow's awk/git-describe extraction with dbx changelog --release-notes, treat --release-notes as machine output, and normalize v-prefixed current versions.
+#### Vscode
+- Load the tsdown base config from source ([#0537c62](https://github.com/deltabox-studio/toolchain/commit/0537c62) by [T0chi](https://github.com/T0chi))
+  - The VS Code integration job builds the extension after only \yarn install\, so the private \@deltabox/toolchain-tsdown\ dist does not exist and unrun failed to load the config. Import baseTsdownConfig\ from the workspace source instead (as the root tsdown config already does).
 
 <!-- release:end -->
 
 
+## 2.3.1 (November 2026)
+
+### Bug fixes
+#### Vscode
+- Validate webview messages and use a secure nonce ([#94bed68](https://github.com/deltabox-studio/toolchain/commit/94bed68) by [T0chi](https://github.com/T0chi))
+  - The Home webview handler trusted the incoming shape and acted on arbitrary project paths, and the CSP nonce came from Math.random. Validate every message, only act on projects the dashboard listed, and generate the nonce from crypto.randomBytes.
+#### Vite
+- Use the Oxlint rule name react/exhaustive-deps ([#ea02ef7](https://github.com/deltabox-studio/toolchain/commit/ea02ef7) by [T0chi](https://github.com/T0chi))
+  - The dogfood config used the legacy ESLint name, so the generated Oxc configs carried both spellings. Rename it to the name in the vendored Oxlint schema and add a guard that every default rule exists there.
+#### Changelog
+- Keep hash links when git history is incomplete ([#182b68a](https://github.com/deltabox-studio/toolchain/commit/182b68a) by [T0chi](https://github.com/T0chi))
+  - A shallow clone or no-git checkout cannot resolve every referenced commit, so valid hashes were left unlinked. Fall back to treating letter-containing refs as commits when history is incomplete, and mock the numeric-hash fixture so the tests do not depend on the checkout's history.
+#### Config
+- Contain generator output paths and render object metadata ([#fe94053](https://github.com/deltabox-studio/toolchain/commit/fe94053) by [T0chi](https://github.com/T0chi))
+  - Scope names and file options were used as paths directly, so a \../\ value could write outside the output directory. Resolve every generated file through a containment check. Also render an object node's own description/annotations before its child fields in per-scope markdown.
+- Derive the CLI reference from the registered commands ([#95dc39f](https://github.com/deltabox-studio/toolchain/commit/95dc39f) by [T0chi](https://github.com/T0chi))
+  - The docs generator kept its own command list, so a new builtin could be missing from the generated reference. Use builtinCommands\ (the CLI's source of truth) and mark registry-dependent provider passthroughs as hidden.
+#### Core
+- Preserve .vscode settings comments when adding keys ([#9b4a105](https://github.com/deltabox-studio/toolchain/commit/9b4a105) by [T0chi](https://github.com/T0chi))
+  - Merging VS Code settings parsed and reserialized the file, dropping its JSONC comments. Insert missing keys in place (preserving layout) and fall back to a full rewrite only when an existing value or array must change.
+#### Ci
+- Check and regenerate nested workspace configs recursively ([#711c7b4](https://github.com/deltabox-studio/toolchain/commit/711c7b4) by [T0chi](https://github.com/T0chi))
+  - The generated schema types are formatted at printWidth 300 and excluded from the formatter, but the ignore patterns were repo-root-relative. Per-workspace vp fmt resolves them from each package directory, so yarn format reformatted biome-config.ts and failed the artifact check. Use **/ globs and make the generated CI/sync workflows run dbx sync --check --recursive so stale workspace configs are caught and regenerated.
+
+## 2.3.0 (November 2026)
+
+### New features
+#### Vscode
+- Show the workflow provider in the run picker ([#af4cc3f](https://github.com/deltabox-studio/toolchain/commit/af4cc3f) by [T0chi](https://github.com/T0chi))
+#### Changelog
+- Dispatch workflows with their vendor CLI ([#eea38ae](https://github.com/deltabox-studio/toolchain/commit/eea38ae) by [T0chi](https://github.com/T0chi))
+#### Config
+- Generate Oxfmt and Oxlint types from vendored schemas ([#8ff5e90](https://github.com/deltabox-studio/toolchain/commit/8ff5e90) by [T0chi](https://github.com/T0chi))
+- Accept complete GitHub, GitLab and Azure workflows ([#070a7f2](https://github.com/deltabox-studio/toolchain/commit/070a7f2) by [T0chi](https://github.com/T0chi))
+- Type tool options and changelog callbacks ([#10bd933](https://github.com/deltabox-studio/toolchain/commit/10bd933) by [T0chi](https://github.com/T0chi))
+### Bug fixes
+#### Config
+- Escape CLI reference tables and fail on missing output ([#15978be](https://github.com/deltabox-studio/toolchain/commit/15978be) by [T0chi](https://github.com/T0chi))
+- Respect secret defaults, `envPathOf` and changelog disabling ([#5cabab8](https://github.com/deltabox-studio/toolchain/commit/5cabab8) by [T0chi](https://github.com/T0chi))
+- Keep named `$ref` schema properties ([#0aa03a1](https://github.com/deltabox-studio/toolchain/commit/0aa03a1) by [T0chi](https://github.com/T0chi))
+#### Vscode
+- Prefer CLI descriptors and sync all workspace roots ([#e68301a](https://github.com/deltabox-studio/toolchain/commit/e68301a) by [T0chi](https://github.com/T0chi))
+- Report signal and timeout exits as failures ([#b7b1ad5](https://github.com/deltabox-studio/toolchain/commit/b7b1ad5) by [T0chi](https://github.com/T0chi))
+#### Cli
+- Forward passthrough flags and validate the update cache ([#a36d586](https://github.com/deltabox-studio/toolchain/commit/a36d586) by [T0chi](https://github.com/T0chi))
+- Leave `reset --config` to the reset command ([#8a3fbec](https://github.com/deltabox-studio/toolchain/commit/8a3fbec) by [T0chi](https://github.com/T0chi))
+#### Vite
+- Surface sync failures and preserve config values ([#93ee933](https://github.com/deltabox-studio/toolchain/commit/93ee933) by [T0chi](https://github.com/T0chi))
+#### Tsdown
+- Write sorted package exports ([#3886a56](https://github.com/deltabox-studio/toolchain/commit/3886a56) by [T0chi](https://github.com/T0chi))
+#### Tsconfig
+- Read referenced configs as JSONC ([#49ded19](https://github.com/deltabox-studio/toolchain/commit/49ded19) by [T0chi](https://github.com/T0chi))
+#### Migrate
+- Surface unsupported and incomplete migrations ([#f50a5d2](https://github.com/deltabox-studio/toolchain/commit/f50a5d2) by [T0chi](https://github.com/T0chi))
+#### Core
+- Keep VS Code files user-owned and guard registry cycles ([#9ef027a](https://github.com/deltabox-studio/toolchain/commit/9ef027a) by [T0chi](https://github.com/T0chi))
+- Keep watch sessions alive and re-sync config edits ([#2849757](https://github.com/deltabox-studio/toolchain/commit/2849757) by [T0chi](https://github.com/T0chi))
+- Reject conflicting `--config` flags ([#1044f2a](https://github.com/deltabox-studio/toolchain/commit/1044f2a) by [T0chi](https://github.com/T0chi))
+- Skip parent hooks for config-less workspaces ([#9658c36](https://github.com/deltabox-studio/toolchain/commit/9658c36) by [T0chi](https://github.com/T0chi))
+- Keep managed paths inside the project root ([#2496bee](https://github.com/deltabox-studio/toolchain/commit/2496bee) by [T0chi](https://github.com/T0chi))
+#### Shared
+- Harden URL policy, merges and token replacement ([#bae1dc8](https://github.com/deltabox-studio/toolchain/commit/bae1dc8) by [T0chi](https://github.com/T0chi))
+- Detect relative Windows `.cmd` shims ([#058430c](https://github.com/deltabox-studio/toolchain/commit/058430c) by [T0chi](https://github.com/T0chi))
+- Restore `PowerShell`-escaped letters ([#4d2be6a](https://github.com/deltabox-studio/toolchain/commit/4d2be6a) by [T0chi](https://github.com/T0chi))
+#### Changelog
+- Fix workflow staging, `commitlint` and YAML escaping ([#1bb19ad](https://github.com/deltabox-studio/toolchain/commit/1bb19ad) by [T0chi](https://github.com/T0chi))
+- Preserve formatting, links and workspace history ([#af5c5dc](https://github.com/deltabox-studio/toolchain/commit/af5c5dc) by [T0chi](https://github.com/T0chi))
+- Restore the standalone bin and `--dry-run` handling ([#97ecef2](https://github.com/deltabox-studio/toolchain/commit/97ecef2) by [T0chi](https://github.com/T0chi))
+- Preserve hand-corrected text in `--format-only` ([#2041e5f](https://github.com/deltabox-studio/toolchain/commit/2041e5f) by [T0chi](https://github.com/T0chi))
+- Resolve hash links and preserve descriptions ([#7633d24](https://github.com/deltabox-studio/toolchain/commit/7633d24) by [T0chi](https://github.com/T0chi))
+- Keep numeric hashes as commits and bold breaking markers ([#0521aee](https://github.com/deltabox-studio/toolchain/commit/0521aee) by [T0chi](https://github.com/T0chi))
+- Unwrap descriptions and keep list items ([#0dc4bda](https://github.com/deltabox-studio/toolchain/commit/0dc4bda) by [T0chi](https://github.com/T0chi))
+#### Project
+- Validate workspace paths before writing ([#0ef515e](https://github.com/deltabox-studio/toolchain/commit/0ef515e) by [T0chi](https://github.com/T0chi))
+### Documentation
+- Document vendor workflows, typed builders and `--format-only` ([#eb66982](https://github.com/deltabox-studio/toolchain/commit/eb66982) by [T0chi](https://github.com/T0chi))
+- Normalize changelog links and breaking markers ([#c3875e4](https://github.com/deltabox-studio/toolchain/commit/c3875e4) by [T0chi](https://github.com/T0chi))
+- Reflow changelog descriptions ([#bc6a40c](https://github.com/deltabox-studio/toolchain/commit/bc6a40c) by [T0chi](https://github.com/T0chi))
+#### Config
+- Document the open `WorkflowJob` type ([#779566b](https://github.com/deltabox-studio/toolchain/commit/779566b) by [T0chi](https://github.com/T0chi))
+#### Changelog
+- Document `formatLine` ([#61e28ec](https://github.com/deltabox-studio/toolchain/commit/61e28ec) by [T0chi](https://github.com/T0chi))
+### CI
+- Add VS Code integration job ([#18b2b7b](https://github.com/deltabox-studio/toolchain/commit/18b2b7b) by [T0chi](https://github.com/T0chi))
+### Chores
+#### Changelog
+- Update the lockfile bin entry ([#f946648](https://github.com/deltabox-studio/toolchain/commit/f946648) by [T0chi](https://github.com/T0chi))
+#### Config
+- Regenerate config-types, schema and docs ([#0b0ca20](https://github.com/deltabox-studio/toolchain/commit/0b0ca20) by [T0chi](https://github.com/T0chi))
+- Shrink the generated `BiomeConfig` type ([#0522932](https://github.com/deltabox-studio/toolchain/commit/0522932) by [T0chi](https://github.com/T0chi))
+#### Vscode
+- Move mocha types to the default tsconfig ([#b604811](https://github.com/deltabox-studio/toolchain/commit/b604811) by [T0chi](https://github.com/T0chi))
+
+### Package changes
+#### Added
+- `@dprint/types` `^0.4.0`
+- `eslint` `^10.14.0`
+- `prettier` `^3.6.2`
+
+## 2.2.0 (November 2026)
+
+### New features
+#### Core
+- Improve formatter/linter auto-detection ([#8324e9a](https://github.com/deltabox-studio/toolchain/commit/8324e9a) by [T0chi](https://github.com/T0chi))
+  - Prefer the project .vscode/settings.json, then the nearest workspace package.json/config file before walking to the root, and include tooling config files as detection candidates.
+### Tests
+#### Vscode
+- Add extension host test setup ([#66aeda6](https://github.com/deltabox-studio/toolchain/commit/66aeda6) by [T0chi](https://github.com/T0chi))
+  - Add @vscode/test-cli/test-electron integration tests, a fixture workspace, build/debug launch tasks, source maps, and documented local test commands.
+
+### Package changes
+#### Added
+- `@types/mocha` `^10.0.10`
+- `@vscode/test-cli` `^0.0.15`
+- `@vscode/test-electron` `^3.1.0`
+
+## 2.1.3 (November 2026)
+
+### Bug fixes
+#### Core
+- Read JSONC VS Code settings and bundle jsonc-parser ([#57d908d](https://github.com/deltabox-studio/toolchain/commit/57d908d) by [T0chi](https://github.com/T0chi))
+  - Parse .vscode/settings.json as JSONC so comments/trailing commas don't block editor defaults, and resolve jsonc-parser's ESM entry in the bundled dbx CLI to avoid the missing ./impl/format module.
+
+## 2.1.2 (November 2026)
+
+### Bug fixes
+#### Vscode
+- Align Home action icons with provider commands ([#05fd6c8](https://github.com/deltabox-studio/toolchain/commit/05fd6c8) by [T0chi](https://github.com/T0chi))
+
+## 2.1.1 (October 2026)
+
+### Bug fixes
+#### Changelog
+- Use the release-notes helper for releases ([#36616f0](https://github.com/deltabox-studio/toolchain/commit/36616f0) by [T0chi](https://github.com/T0chi))
+  - Replace the custom release workflow's awk/git-describe extraction with dbx changelog --release-notes, treat --release-notes as machine output, and normalize v-prefixed current versions.
+
 ## 2.1.0 (October 2026)
 
 ### New features
 #### Changelog
 - Configure breaking-change detection ([#f80634f](https://github.com/deltabox-studio/toolchain/commit/f80634f) by [T0chi](https://github.com/T0chi))
-  - Detect breaking changes by Conventional Commits rules by default (! in the subject or a BREAKING CHANGE: footer) and add a changelog.breaking / ci.changelog.breaking override (conventional, ny, alse, pattern/match, or a callback).
+  - Detect breaking changes by Conventional Commits rules by default (! in the subject or a **BREAKING CHANGE:** footer) and add a changelog.breaking / ci.changelog.breaking override (conventional, any, false, pattern/match, or a callback).
 
 ## 2.0.1 (October 2026)
 
@@ -48,192 +184,122 @@
   - Support ordered arrays, title records, hidden groups and callbacks for the whole group config and per-group title/order/hidden values, including --format-only.
 - Add custom workflow paths, listing and non-Yarn support ([#2e96e6e](https://github.com/deltabox-studio/toolchain/commit/2e96e6e) by [T0chi](https://github.com/T0chi))
 - Add a New contributors footer ([#1e49596](https://github.com/deltabox-studio/toolchain/commit/1e49596) by [T0chi](https://github.com/T0chi))
-  - scanned range (explicit range start, or the oldest commit's parent).
-    login is known) and a nested list of their commit messages, reusing
-    the normal commit bullet formatting without the author/body.
-    only the CC rule/scope grouping is replaced by major/minor/patch.
+  - Detect first-time contributors by checking the authors before the scanned range (explicit range start, or the oldest commit's parent).
+  - Render them as a footer with the contributor (linked when the GitHub login is known) and a nested list of their commit messages, reusing the normal commit bullet formatting without the author/body.
+  - Keep the same formatting in the commitlint-disabled fallback summary; only the CC rule/scope grouping is replaced by major/minor/patch.
 #### Config
 - Type changelog group callbacks ([#a5c6186](https://github.com/deltabox-studio/toolchain/commit/a5c6186) by [T0chi](https://github.com/T0chi))
   - Add the shared ChangelogGroupsSetting types, expose groups on both changelog sections, and regenerate the config schema/types/reference.
 - Revamp config generators and extend tooling customization ([#b924255](https://github.com/deltabox-studio/toolchain/commit/b924255) by [T0chi](https://github.com/T0chi))
-  - and generateConfig* functions (optional disk writes, schema metadata)
-  - **BREAKING CHANGE:** ConfigScopes, ConfigScopeDef, CONFIG_SECTION_SCHEMAS,
-  - CONFIG_TYPE_SCHEMAS and CONFIG_SECTION_DESCRIPTIONS are removed. Consumers
-    should use ConfigSchema with generateConfigTypes/Env/Markdown/Cli/All and read
-    section descriptions from schema metadata.
+  - replace env-first ConfigScopes/ConfigScopeDef/render* APIs with ConfigSchema and generateConfig* functions (optional disk writes, schema metadata)
+  - consolidate configSchema and remove duplicated schema maps/descriptions
+  - support Zod and untyped Schema inputs with env/cli metadata
+  - add markdown frontmatter customization and env/cli JSDoc output
+  - add custom logger support and shorthand fmt/lint tool inference
+  - add changelog bump rules, over-bump opt-in, and provider/commit options
+  - **BREAKING CHANGE:** ConfigScopes, ConfigScopeDef, CONFIG_SECTION_SCHEMAS, CONFIG_TYPE_SCHEMAS and CONFIG_SECTION_DESCRIPTIONS are removed. Consumers should use ConfigSchema with generateConfigTypes/Env/Markdown/Cli/All and read section descriptions from schema metadata.
 - Support metadata annotations in generated output ([#1417bb2](https://github.com/deltabox-studio/toolchain/commit/1417bb2) by [T0chi](https://github.com/T0chi))
 - Add fmt/lint sections and manual changelog config ([#16000e5](https://github.com/deltabox-studio/toolchain/commit/16000e5) by [T0chi](https://github.com/T0chi))
 - Inherit shared sections and add fmt/lint defaults ([#94add6f](https://github.com/deltabox-studio/toolchain/commit/94add6f) by [T0chi](https://github.com/T0chi))
 - Registry source policies and duplicate template-id prompts ([#e030af7](https://github.com/deltabox-studio/toolchain/commit/e030af7) by [T0chi](https://github.com/T0chi))
-  - host and path globs, enforced for local paths, npm registries and
-    remote URLs (also when loading global/remote registries and the
-    provider/registry listings).
-    builtin or project source; non-interactive runs fail with a clear
-    `--id` hint instead of prompting.
-    plus Templates/Providers docs.
+  - Add `toolchain.registry.{templates,providers}` with `allow`/`deny` host and path globs, enforced for local paths, npm registries and remote URLs (also when loading global/remote registries and the provider/registry listings).
+  - Prompt for a unique template id when `template:add` collides with a builtin or project source; non-interactive runs fail with a clear `--id` hint instead of prompting.
+  - Add `--id` to `template:add`, policy tests and the generated reference plus Templates/Providers docs.
 - Ambient Zod meta types and project-tsconfig typechecks ([#e73661b](https://github.com/deltabox-studio/toolchain/commit/e73661b) by [T0chi](https://github.com/T0chi))
-  - `/// <reference types="@deltabox/toolchain/globals" />` and get typed
-    `.meta({ env, path, required, example, ... })` fields.
-    `ConfigBaseMeta.deprecated` the JSON-Schema boolean.
-    instead of `tsconfig.build.json`.
+  - Export `@deltabox/toolchain/globals` so a consumer can add `/// <reference types="@deltabox/toolchain/globals" />` and get typed `.meta({ env, path, required, example, ... })` fields.
+  - Add the shared/config ambient declarations and make `ConfigBaseMeta.deprecated` the JSON-Schema boolean.
+  - Run the root and every workspace typecheck against `tsconfig.json` instead of `tsconfig.build.json`.
 - Move CI workflows and changelog config under toolchain.ci ([#af1b536](https://github.com/deltabox-studio/toolchain/commit/af1b536) by [T0chi](https://github.com/T0chi))
-  - workflows and move the changelog pipeline to `ci.changelog`.
-    `ci.changelog.commitlint: false` and fall back to coarse
-    major/minor/patch changelog groups.
-    `ChangelogBranchesConfig` as a named schema.
-    consumers, but reject it in the loader with a migration error.
-    into the `config-schema/` folder.
-    per-workflow overrides are `WorkflowOptions`, and the new section type
-    is `ToolchainCiConfig`.
-    generated types.
+  - Add the opt-in `ci` section for the ci/release/issues/changelog/sync workflows and move the changelog pipeline to `ci.changelog`.
+  - Make every workflow setting opt-in; disable commitlint with `ci.changelog.commitlint: false` and fall back to coarse major/minor/patch changelog groups.
+  - Move `types`/`scopes` to `ci.changelog.commitlint` and extract `ChangelogBranchesConfig` as a named schema.
+  - Keep the old top-level `changelog` schema marked deprecated for older consumers, but reject it in the loader with a migration error.
+  - Add `withEnabled()` to the schema model and split `config-schema.ts` into the `config-schema/` folder.
+  - Rename the workflow types: the workflow map is `WorkflowConfig`, the per-workflow overrides are `WorkflowOptions`, and the new section type is `ToolchainCiConfig`.
+  - Surface `.meta()` descriptions for `$ref` and object nodes in the generated types.
 - Let defineConfig accept a promise or a callback ([#111776c](https://github.com/deltabox-studio/toolchain/commit/111776c) by [T0chi](https://github.com/T0chi))
-  - `defineConfig` now mirrors Vite's helper: the argument may be a plain object,
-    a `Promise<DbxConfig>`, or a `() => DbxConfig | Promise<DbxConfig>` callback.
-    The loader resolves the module export (awaits a promise, calls a callback and
-    awaits its result), so a config can do async work before returning
-    `{ toolchain }`.
+  - `defineConfig` now mirrors Vite's helper: the argument may be a plain object, a `Promise<DbxConfig>`, or a `() => DbxConfig | Promise<DbxConfig>` callback. The loader resolves the module export (awaits a promise, calls a callback and awaits its result), so a config can do async work before returning `{ toolchain }`.
 #### Vscode
 - Surface workflow conflicts in managed files ([#e692511](https://github.com/deltabox-studio/toolchain/commit/e692511) by [T0chi](https://github.com/T0chi))
   - Read workflowConflicts from the manifest and render them as a warning group with the owning config key.
 - Watch the inputs resolved from the dbx config ([#953f071](https://github.com/deltabox-studio/toolchain/commit/953f071) by [T0chi](https://github.com/T0chi))
-  - watch globs: auto-sync now asks the CLI (`dbx watch --list --json`) per
-    workspace root and watches the returned globs relative to that root, so
-    custom `tsconfig.rootFile`/`defaultFile` names are respected
-    ignore stale results from an older resolve
-    older pinned `dbx`)
-    set value, in any scope, still replaces the resolved inputs
-    `tsconfig.default.json`
-    the behaviour
+  - drop the hard-coded `tsconfig.default.json` / `tsconfig.workspaces.json` watch globs: auto-sync now asks the CLI (`dbx watch --list --json`) per workspace root and watches the returned globs relative to that root, so custom `tsconfig.rootFile`/`defaultFile` names are respected
+  - re-resolve the inputs (debounced) whenever a `dbx.config.*` changes, and ignore stale results from an older resolve
+  - fall back to the default inputs when the CLI cannot report them (eg. an older pinned `dbx`)
+  - `deltabox.toolchain.watch` now defaults to `[]` (resolved); an explicitly set value, in any scope, still replaces the resolved inputs
+  - detect workspace projects with the resolved `defaultFile` instead of `tsconfig.default.json`
+  - unit-test the parsing and watch planning (`watch-inputs.ts`) and document the behaviour
 - Add extension settings link to Home ([#f39cb35](https://github.com/deltabox-studio/toolchain/commit/f39cb35) by [T0chi](https://github.com/T0chi))
 - Add Select dbx version to the Home More actions ([#13ef688](https://github.com/deltabox-studio/toolchain/commit/13ef688) by [T0chi](https://github.com/T0chi))
 - Add the Registries view ([#e3e808e](https://github.com/deltabox-studio/toolchain/commit/e3e808e) by [T0chi](https://github.com/T0chi))
-  - A new collapsible **Registries** view (below Templates) shows **Providers** and
-    (explorer folder or browser for remote URLs), **Add new registry** (the category's
-    add flow) and **Remove registry** (removes the path, keeps the files). The title
-    bar has **New registry…** / **Remove registry…** (global or project scope), also
-    available in the Home "More actions". Removing a template now offers the stored
-    global templates too (`template:remove --global`).
+  - A new collapsible **Registries** view (below Templates) shows **Providers** and (explorer folder or browser for remote URLs), **Add new registry** (the category's add flow) and **Remove registry** (removes the path, keeps the files). The title bar has **New registry…** / **Remove registry…** (global or project scope), also available in the Home "More actions". Removing a template now offers the stored global templates too (`template:remove --global`).
 - Rename registry paths, add a version picker and UI polish ([#9c8b51c](https://github.com/deltabox-studio/toolchain/commit/9c8b51c) by [T0chi](https://github.com/T0chi))
-  - config and code).
-    "which dbx?" notification, only ask when they differ, and add a **Select dbx
-    version…** command that pins one in the workspace settings (npx fallback).
-    More actions), prefix More-actions buttons with a play glyph, start Managed
-    Files collapsed, expand the Vite+ provider by default, and drop unused icon
-    resources.
+  - Rename `templatesSearchPaths` to `registrySearchPaths` (VS Code setting, CLI config and code).
+  - Show the detected project/extension `@deltabox/toolchain` versions in the "which dbx?" notification, only ask when they differ, and add a **Select dbx version…** command that pins one in the workspace settings (npx fallback).
+  - Replace the Home "Run Vite+…" quick action with **Add provider…** (also in More actions), prefix More-actions buttons with a play glyph, start Managed Files collapsed, expand the Vite+ provider by default, and drop unused icon resources.
 - Sync the global registry with the VS Code settings ([#86a0671](https://github.com/deltabox-studio/toolchain/commit/86a0671) by [T0chi](https://github.com/T0chi))
-  - Add the `deltabox.templatesSearchPaths` setting, record the VS Code user dir in
-    the CLI config on activation, and mirror setting changes into it (so the CLI and
-    editor agree). Adding a template now asks whether to register it globally (yes
-    by default), and adding a provider asks for a project or global scope; the
-    Providers view reads the merged registry.
+  - Add the `deltabox.templatesSearchPaths` setting, record the VS Code user dir in the CLI config on activation, and mirror setting changes into it (so the CLI and editor agree). Adding a template now asks whether to register it globally (yes by default), and adding a provider asks for a project or global scope; the Providers view reads the merged registry.
 #### Project
 - Inherit root Oxc config and harden scaffolds ([#56a1895](https://github.com/deltabox-studio/toolchain/commit/56a1895) by [T0chi](https://github.com/T0chi))
   - Nested projects omit local Oxc files/opt-ins when the root owns them, template create gains --force, and scaffold writes now reject duplicates, BOM catalogs and root scope fallbacks are handled.
 - Make scaffolds runnable and safer ([#eab297b](https://github.com/deltabox-studio/toolchain/commit/eab297b) by [T0chi](https://github.com/T0chi))
-- Fold an existing vite config when generating a config ([#5891154](https://github.com/deltabox-studio/toolchain/issues/5891154) by [T0chi](https://github.com/T0chi))
-  - `project:config` now checks for a hand-written `vite.config.*` and folds its
-    literal props into the generated `dbx.config.ts`'s `toolchain.vite` (using the
-    vite migration's extract/scan/fold helpers), adding the `/vite.config.ts` fmt
-    ignore. A non-foldable config is reported and left alone. The VS Code "Generate
-    config" actions run `dbx sync` afterwards so the managed shim is written.
+- Fold an existing vite config when generating a config ([#5891154](https://github.com/deltabox-studio/toolchain/commit/5891154) by [T0chi](https://github.com/T0chi))
+  - `project:config` now checks for a hand-written `vite.config.*` and folds its literal props into the generated `dbx.config.ts`'s `toolchain.vite` (using the vite migration's extract/scan/fold helpers), adding the `/vite.config.ts` fmt ignore. A non-foldable config is reported and left alone. The VS Code "Generate config" actions run `dbx sync` afterwards so the managed shim is written.
 #### Core
 - Resolve watched inputs from the config and add `dbx watch --list` ([#0ab08a9](https://github.com/deltabox-studio/toolchain/commit/0ab08a9) by [T0chi](https://github.com/T0chi))
-  - `watch` globs with function forms resolved (eg. custom
-    `tsconfig.rootFile`/`defaultFile` names); `runWatch` now uses it, so only the
-    inputs of tasks that actually run are watched
-    resolved tsconfig file names (`{ globs, tsconfig }`) without watching
-    a `tsconfig` section
+  - add `resolveWatchGlobs(tasks, config, projectType?)`: the active tasks' `watch` globs with function forms resolved (eg. custom `tsconfig.rootFile`/`defaultFile` names); `runWatch` now uses it, so only the inputs of tasks that actually run are watched
+  - add `dbx watch --list [--json]`, printing the resolved input globs plus the resolved tsconfig file names (`{ globs, tsconfig }`) without watching
+  - emulate the report for the default names, custom names and a config without a `tsconfig` section
 - Untracked managed files, config-derived task globs and a reset restore hook ([#5da6691](https://github.com/deltabox-studio/toolchain/commit/5da6691) by [T0chi](https://github.com/T0chi))
-  - it in the manifest, so a user-owned file a task patches is never pruned by a
-    later sync or removed by `dbx reset`
-    follow configured file names
-    (written before `files`/`origins`, which it can never clobber), and
-    `SyncContext.check` flags `dbx sync --check`
-    the manifest is removed and report the `restored` files
-- Provider registry search paths and safer managed-file sync ([#4033009](https://github.com/deltabox-studio/toolchain/issues/4033009) by [T0chi](https://github.com/T0chi))
-  - http(s) URLs), keeping the legacy provider files for compatibility.
-    providers`, `--set`, `--clear`), the CLI config and the VS Code
-    `deltabox.providerRegistrySearchPaths` setting; the Registries view
-    now manages both kinds and the Providers view can fetch remote
-    registries through `loadToolchainProviders()`.
-    pre-existing file. Adopted files are unmanaged, never deleted.
-    their previous content); the extension shows a notification listing
-    removed files with Restore/Close.
+  - `ManagedFile.track: false` writes and drift-checks a file without recording it in the manifest, so a user-owned file a task patches is never pruned by a later sync or removed by `dbx reset`
+  - `SyncTask.watch` / `SyncTask.keep` accept `config => string[]`, so globs can follow configured file names
+  - `SyncContext.manifest` persists task metadata in the manifest between syncs (written before `files`/`origins`, which it can never clobber), and `SyncContext.check` flags `dbx sync --check`
+  - `resetToolchain` / `resetProjects` take a `restore` hook that runs before the manifest is removed and report the `restored` files
+- Provider registry search paths and safer managed-file sync ([#4033009](https://github.com/deltabox-studio/toolchain/commit/4033009) by [T0chi](https://github.com/T0chi))
+  - Load providers from project/global search paths (JSON files, dirs or http(s) URLs), keeping the legacy provider files for compatibility.
+  - Add provider search-path management to `dbx registry` (`--kind providers`, `--set`, `--clear`), the CLI config and the VS Code `deltabox.providerRegistrySearchPaths` setting; the Registries view now manages both kinds and the Providers view can fetch remote registries through `loadToolchainProviders()`.
+  - Track whether a managed file was created by dbx or adopted from a pre-existing file. Adopted files are unmanaged, never deleted.
+  - `dbx sync --json` reports the sync result (including removed files and their previous content); the extension shows a notification listing removed files with Restore/Close.
 - Merge global providers with the project registry ([#81c510b](https://github.com/deltabox-studio/toolchain/commit/81c510b) by [T0chi](https://github.com/T0chi))
-  - Providers can live in `~/.dbx/toolchain/.registry/providers.json` too.
-    `readAllProviders` merges them with the project's `.dbx/toolchain/providers.json`
-    (project wins on an id clash), and the CLI's provider list and passthrough
-    commands use it so a global provider works in every project.
+  - Providers can live in `~/.dbx/toolchain/.registry/providers.json` too. `readAllProviders` merges them with the project's `.dbx/toolchain/providers.json` (project wins on an id clash), and the CLI's provider list and passthrough commands use it so a global provider works in every project.
 #### Tsconfig
 - Resolver, `extends`/`baseFile` options and snapshot-backed overrides ([#2b38963](https://github.com/deltabox-studio/toolchain/commit/2b38963) by [T0chi](https://github.com/T0chi))
-  - JSONC) and `dbx tsconfig --json/--alias/--paths/--references/--tsconfig/--root/--no-extends`;
-    the generator now resolves the workspaces tsconfig through it
-    templates, and `tsconfig.baseFile` for the root base tsconfig
-    into the user-owned tsconfigs on sync, honouring custom
-    `baseFile`/`rootFile`/`defaultFile`/`buildFile` names (also in the task's
-    watched/kept globs and in `dbx tsconfig`)
-    (repo-relative paths only) and record the applied override per file in
-    `tsconfigOverrides`; removing a key restores the snapshot value when the
-    original defined it, otherwise removes it (pruning emptied parents), and keeps
-    a value edited after the override applied it
-    `tsconfig.override-edited`) and skip instead of creating missing targets;
-    patched files are untracked, so sync/reset never delete them
-    (`restoreTsconfigOverrides`), warning with `tsconfig.restore-reapply` while
-    the overrides are still configured; `dbx reset` restores before removing the
-    manifest
+  - add an extends-aware `resolveTsconfig` (+ `readTsconfig`/`parseTsconfig` for JSONC) and `dbx tsconfig --json/--alias/--paths/--references/--tsconfig/--root/--no-extends`; the generator now resolves the workspaces tsconfig through it
+  - add `tsconfig.extends` for the `extends` of scaffolded base/default/build templates, and `tsconfig.baseFile` for the root base tsconfig
+  - add `tsconfig.overrides` (`base`, `root`, `default`, `build`): deep-merged into the user-owned tsconfigs on sync, honouring custom `baseFile`/`rootFile`/`defaultFile`/`buildFile` names (also in the task's watched/kept globs and in `dbx tsconfig`)
+  - snapshot the original files in the manifest's top-level `snapshots` tree (repo-relative paths only) and record the applied override per file in `tsconfigOverrides`; removing a key restores the snapshot value when the original defined it, otherwise removes it (pruning emptied parents), and keeps a value edited after the override applied it
+  - warn (`tsconfig.missing-file`, `tsconfig.outside-root`, `tsconfig.override-edited`) and skip instead of creating missing targets; patched files are untracked, so sync/reset never delete them
+  - add `dbx tsconfig --restore [base|root|default|build]` (`restoreTsconfigOverrides`), warning with `tsconfig.restore-reapply` while the overrides are still configured; `dbx reset` restores before removing the manifest
+  - type the override bodies as `TsConfigJson` (`type-fest` is now a dependency)
+  - cover the overrides with unit and emulate tests
 #### Vite
 - Add static shims and a configurable shim import ([#bddcb62](https://github.com/deltabox-studio/toolchain/commit/bddcb62) by [T0chi](https://github.com/T0chi))
-  - the generated `vite.config.ts`, so Vite+ can load it without a built
-    `@deltabox/toolchain` (rejects functions, regexps and class instances)
-    shims; relative values resolve from the repo root and are rewritten per
-    generated config
+  - `vite.shim: 'static'` serializes the resolved `toolchain.vite` config into the generated `vite.config.ts`, so Vite+ can load it without a built `@deltabox/toolchain` (rejects functions, regexps and class instances)
+  - `vite.shimImport` changes the `resolveVite` import specifier of runtime shims; relative values resolve from the repo root and are rewritten per generated config
+  - type both options in `ToolchainViteConfig` and document them
 - Preserve existing imports/comments when regenerating the shim ([#194461c](https://github.com/deltabox-studio/toolchain/commit/194461c) by [T0chi](https://github.com/T0chi))
-  - `renderViteConfig` now accepts the existing `vite.config.ts` source: it keeps
-    the file's leading comments and import statements and merges `defineConfig` (and
-    the config type) into the existing `vite`/`vite-plus` import, preserving default,
-    namespace, other named and type-only specifiers. Regeneration is idempotent, and
-    the sync task feeds the current file in so a custom import block/comment is not
-    dropped.
+  - `renderViteConfig` now accepts the existing `vite.config.ts` source: it keeps the file's leading comments and import statements and merges `defineConfig` (and the config type) into the existing `vite`/`vite-plus` import, preserving default, namespace, other named and type-only specifiers. Regeneration is idempotent, and the sync task feeds the current file in so a custom import block/comment is not dropped.
 - Detect the project's vite package and allow resolveVite overrides ([#dfaedee](https://github.com/deltabox-studio/toolchain/commit/dfaedee) by [T0chi](https://github.com/T0chi))
-  - The generated `vite.config.ts` shim now imports `defineConfig` (and its config
-    type) from whichever package the project installs — `vite` or `vite-plus` —
-    detected from `package.json` and walking up so a hoisted workspace dependency
-    resolves. `resolveVite` is generic so the shim type-checks against both, and
-    `ResolveViteOptions` now carries inline `vite` overrides that are deep-merged
-    over the loaded section.
+  - The generated `vite.config.ts` shim now imports `defineConfig` (and its config type) from whichever package the project installs — `vite` or `vite-plus` — detected from `package.json` and walking up so a hoisted workspace dependency resolves. `resolveVite` is generic so the shim type-checks against both, and `ResolveViteOptions` now carries inline `vite` overrides that are deep-merged over the loaded section.
 #### Migrate
 - Add Oxc migration and repeatable --from ([#0f6930d](https://github.com/deltabox-studio/toolchain/commit/0f6930d) by [T0chi](https://github.com/T0chi))
 #### Cli
 - Add config selection and logger suppression ([#9b69e3f](https://github.com/deltabox-studio/toolchain/commit/9b69e3f) by [T0chi](https://github.com/T0chi))
 #### Template
 - Re-prompt on duplicate ids in init and the editor ([#a4d7cde](https://github.com/deltabox-studio/toolchain/commit/a4d7cde) by [T0chi](https://github.com/T0chi))
-  - one (or fails with an `--id` hint when non-interactive), and accepts
-    `--id`.
-    the provider already exists, updating its command names too.
+  - `template:init --add` checks builtin + project ids, prompts for a unique one (or fails with an `--id` hint when non-interactive), and accepts `--id`.
+  - The VS Code Add provider flow suggests and validates a renamed id when the provider already exists, updating its command names too.
 - Unscoped npm packages, custom registries and remote sources ([#08cb68c](https://github.com/deltabox-studio/toolchain/commit/08cb68c) by [T0chi](https://github.com/T0chi))
-  - npm create packages. The registry defaults to the project package
-    manager's (`npmRegistryServer` / `.npmrc`) and can be overridden per
-    source with `--registry` or the new `ToolchainTemplateSource.registry`.
-    whose `{ sources }` / `{ templates }` / array is merged recursively.
-    docs.
+  - Support scoped (`@scope/create`) and unscoped (`create-*`, `*-create`) npm create packages. The registry defaults to the project package manager's (`npmRegistryServer` / `.npmrc`) and can be overridden per source with `--registry` or the new `ToolchainTemplateSource.registry`.
+  - Add the `remote` template source type: an `http(s)` JSON source registry whose `{ sources }` / `{ templates }` / array is merged recursively.
+  - Refresh the generated schema/types/reference and the online template docs.
 - Add project registries, registry listing and global removal ([#ff3cd16](https://github.com/deltabox-studio/toolchain/commit/ff3cd16) by [T0chi](https://github.com/T0chi))
-  - to `<project>/.dbx/toolchain/.registry/templates`; the project paths are
-    resolved before the global ones (remote `http(s)` entries are kept as URLs).
-    `dbx registry` command lists them (`--json`) and adds/removes template paths
-    (`--add`/`--remove`, `--scope global|project`).
-    remove stored global templates; remote registries accept `{ sources }`,
-    `{ templates }` or an array of sources.
+  - Project-scoped registries live in `.dbx/toolchain/registries.json` and default to `<project>/.dbx/toolchain/.registry/templates`; the project paths are resolved before the global ones (remote `http(s)` entries are kept as URLs).
+  - `listRegistries(cwd)` exposes the detected template/provider registries, the `dbx registry` command lists them (`--json`) and adds/removes template paths (`--add`/`--remove`, `--scope global|project`).
+  - `dbx template:list --global` and `dbx template:remove --global <id>` list and remove stored global templates; remote registries accept `{ sources }`, `{ templates }` or an array of sources.
 - Add a global template registry ([#638dd3b](https://github.com/deltabox-studio/toolchain/commit/638dd3b) by [T0chi](https://github.com/T0chi))
-  - Templates registered with `template:init --add`/`template:add` are also stored
-    under `~/.dbx/toolchain/.registry/templates` (unless `--no-global`), so they are
-    available in every project and the VS Code extension. Global templates merge
-    with the project's own (project wins on an id clash).
-  - Search paths default to that directory and can be configured as a string/array
-    of directories or `http(s)` remote registries. They live in
-    `~/.dbx/toolchain/cli/config.json` (`templatesSearchPaths`, plus a `vscodeDir`
-    pointing at the VS Code user dir) and are managed with the new
-    `dbx template:registry` command (`--add`/`--set`/`--remove`/`--clear`), which
-    also writes the VS Code `deltabox.templatesSearchPaths` setting.
+  - Templates registered with `template:init --add`/`template:add` are also stored under `~/.dbx/toolchain/.registry/templates` (unless `--no-global`), so they are available in every project and the VS Code extension. Global templates merge with the project's own (project wins on an id clash).
+  - Search paths default to that directory and can be configured as a string/array of directories or `http(s)` remote registries. They live in `~/.dbx/toolchain/cli/config.json` (`templatesSearchPaths`, plus a `vscodeDir` pointing at the VS Code user dir) and are managed with the new `dbx template:registry` command (`--add`/`--set`/`--remove`/`--clear`), which also writes the VS Code `deltabox.templatesSearchPaths` setting.
 ### Bug fixes
 #### Cli
 - Filter denied providers at registration ([#74c49bb](https://github.com/deltabox-studio/toolchain/commit/74c49bb) by [T0chi](https://github.com/T0chi))
@@ -244,11 +310,7 @@
   - Allow true/false for every fmt/lint tool, honour explicit biome opt-outs, and ignore disabled biome overrides.
 - Honour disabled sections and regenerate config types ([#dddd9a7](https://github.com/deltabox-studio/toolchain/commit/dddd9a7) by [T0chi](https://github.com/T0chi))
 - Keep union, enum and nested types in the combined markdown reference ([#2eaa373](https://github.com/deltabox-studio/toolchain/commit/2eaa373) by [T0chi](https://github.com/T0chi))
-  - The combined (`combined: true`) markdown renderer received the untyped
-    lowering of Zod scopes, which collapses unions/enums to `any` with a `{}`
-    default. Render Zod scopes from `toJSONSchema` instead (resolving the root
-    `$ref` into `$defs`), so the reference shows real types and nested options
-    again.
+  - The combined (`combined: true`) markdown renderer received the untyped lowering of Zod scopes, which collapses unions/enums to `any` with a `{}` default. Render Zod scopes from `toJSONSchema` instead (resolving the root `$ref` into `$defs`), so the reference shows real types and nested options again.
 - Finish generator ergonomics and changelog customization ([#38f6d5b](https://github.com/deltabox-studio/toolchain/commit/38f6d5b) by [T0chi](https://github.com/T0chi))
 #### Changelog
 - Honour workflow token overrides and disabled ci ([#de266dd](https://github.com/deltabox-studio/toolchain/commit/de266dd) by [T0chi](https://github.com/T0chi))
@@ -264,18 +326,13 @@
 - Make sync generation quiet, one-pass and non-fatal ([#f0d7663](https://github.com/deltabox-studio/toolchain/commit/f0d7663) by [T0chi](https://github.com/T0chi))
 #### Ci
 - Keep the build tsconfigs for CI typechecks ([#b1502ad](https://github.com/deltabox-studio/toolchain/commit/b1502ad) by [T0chi](https://github.com/T0chi))
-  - the generated CI workflow.
-    root + package `tsconfig.json` (including tests).
+  - Revert the package/root `typecheck` tasks to `tsconfig.build.json`.
+  - Add `typecheck:ci` (the old build-based pipeline) for CI and run it in the generated CI workflow.
+  - Make `yarn typecheck` a development-only workspace check that uses the root + package `tsconfig.json` (including tests).
 #### Migrate
 - Deep-merge the folded vite config ([#f74d2ed](https://github.com/deltabox-studio/toolchain/commit/f74d2ed) by [T0chi](https://github.com/T0chi))
-  - Folding a hand-written `vite.config.*` into an existing `toolchain.vite` now
-    deep-merges object literals (nested objects combine; arrays/scalars from the
-    vite config win) instead of replacing the section, and flips a previous
-    `config: false` to `true` since the hand-written file is removed.
-  - Also fixes `findTopLevelValue` so a scalar last key no longer swallows the
-    object's closing `}`, updates the managed-shim detection for the generic
-    `resolveVite<T>(...)` form, and corrects the "nothing to migrate" message when
-    the migration is registered but no source is detected.
+  - Folding a hand-written `vite.config.*` into an existing `toolchain.vite` now deep-merges object literals (nested objects combine; arrays/scalars from the vite config win) instead of replacing the section, and flips a previous `config: false` to `true` since the hand-written file is removed.
+  - Also fixes `findTopLevelValue` so a scalar last key no longer swallows the object's closing `}`, updates the managed-shim detection for the generic `resolveVite<T>(...)` form, and corrects the "nothing to migrate" message when the migration is registered but no source is detected.
 ### Refactors
 - Run quality checks through vp tasks ([#2fee264](https://github.com/deltabox-studio/toolchain/commit/2fee264) by [T0chi](https://github.com/T0chi))
 - Run build and test through vp tasks too ([#e890665](https://github.com/deltabox-studio/toolchain/commit/e890665) by [T0chi](https://github.com/T0chi))
@@ -287,55 +344,49 @@
   - Cover scaffold --force, root Oxc inheritance, boolean tool opt-ins, workflow package-manager version defaults and the managed-file conflict group.
 - Regenerate config artifacts and document the fixes ([#9be4d73](https://github.com/deltabox-studio/toolchain/commit/9be4d73) by [T0chi](https://github.com/T0chi))
 - Document tsconfig overrides, snapshots and `--restore` ([#dad4084](https://github.com/deltabox-studio/toolchain/commit/dad4084) by [T0chi](https://github.com/T0chi))
-  - snapshots, removal rules, restoring, warnings) and the new CLI flags/exports
-    the sync task API additions and an upgrade step
-    the package reference
-    `llms-full.txt`
+  - `guide/tsconfig.md`: `baseFile`, custom file names, overrides (deep merge, snapshots, removal rules, restoring, warnings) and the new CLI flags/exports
+  - `migration-v1-v2.md`: overrides, manifest `snapshots`/`tsconfigOverrides`, the sync task API additions and an upgrade step
+  - note the override revert in the `dbx reset` / `dbx tsconfig` CLI docs and the package reference
+  - regenerate `config/reference.md`, `config/cli.md`, `config.schema.json` and `llms-full.txt`
 - Document v2 generators, custom logger and changelog customization ([#f0f7f5d](https://github.com/deltabox-studio/toolchain/commit/f0f7f5d) by [T0chi](https://github.com/T0chi))
-- Update README highlights and regenerate LLM docs ([#6380770](https://github.com/deltabox-studio/toolchain/issues/6380770) by [T0chi](https://github.com/T0chi))
+- Update README highlights and regenerate LLM docs ([#6380770](https://github.com/deltabox-studio/toolchain/commit/6380770) by [T0chi](https://github.com/T0chi))
 - Add the CI guide, TypeScript page and interactive CLI sections ([#fc6099a](https://github.com/deltabox-studio/toolchain/commit/fc6099a) by [T0chi](https://github.com/T0chi))
-  - `guide/ci/` section (overview + settings + ci/issues/changelog/sync/
-    releases) and retitle the overview to "CI".
-    metadata, programmatic API, Vite+ generics).
-    VS Code sync notification and CLI `sync --json` docs.
+  - Move the workflow/release pages from the Changelog guide into a new `guide/ci/` section (overview + settings + ci/issues/changelog/sync/ releases) and retitle the overview to "CI".
+  - Add `guide/typescript.md` (defineConfig, config types, ambient Zod metadata, programmatic API, Vite+ generics).
+  - Add `## Interactive CLI` sections and update the provider registry, VS Code sync notification and CLI `sync --json` docs.
+  - Refresh the LLM bundles.
 - Split the config, API, config-generator and changelog guides ([#4153d86](https://github.com/deltabox-studio/toolchain/commit/4153d86) by [T0chi](https://github.com/T0chi))
-  - `guide/changelog.md` into folders with an index + one sibling page per
-    second-level section.
-    commitlint, Versioning, CLI, writing messages, Troubleshooting and
-    Releases into sibling pages.
-    workflows, the commitlint opt-out fallback and the migration from the
-    deprecated top-level `changelog` section.
-    LLM bundles.
+  - Turn `guide/api.md`, `guide/config.md`, `guide/config-generator.md` and `guide/changelog.md` into folders with an index + one sibling page per second-level section.
+  - Retitle the changelog index to "Changelog" and move Workflows, Branches, commitlint, Versioning, CLI, writing messages, Troubleshooting and Releases into sibling pages.
+  - Document the new `toolchain.ci` / `ci.changelog` structure, opt-in workflows, the commitlint opt-out fallback and the migration from the deprecated top-level `changelog` section.
+  - Update sidebar entries, cross-links, the generated reference and the LLM bundles.
 - Document the Registries view, project registries and dbx version picker ([#752d1cd](https://github.com/deltabox-studio/toolchain/commit/752d1cd) by [T0chi](https://github.com/T0chi))
-  - Cover `registrySearchPaths`, project registries, the `registry` command, remote
-    registries, the Registries view/actions, and the extension's version selection.
+  - Cover `registrySearchPaths`, project registries, the `registry` command, remote registries, the Registries view/actions, and the extension's version selection.
 - Document the global template/provider registry ([#55651e1](https://github.com/deltabox-studio/toolchain/commit/55651e1) by [T0chi](https://github.com/T0chi))
-  - Cover the global templates dir, `--no-global`, the `template:registry` command,
-    the CLI config and `deltabox.templatesSearchPaths` sync, remote registries, and
-    global providers.
+  - Cover the global templates dir, `--no-global`, the `template:registry` command, the CLI config and `deltabox.templatesSearchPaths` sync, remote registries, and global providers.
 - Document defineConfig callbacks, shim detection and deep-merge migration ([#701de7c](https://github.com/deltabox-studio/toolchain/commit/701de7c) by [T0chi](https://github.com/T0chi))
-  - Cover `defineConfig` promises/callbacks, the shim importing from the project's
-    vite package, inline `resolveVite` overrides, and the vite migration deep-merging
-    into `toolchain.vite`.
+  - Cover `defineConfig` promises/callbacks, the shim importing from the project's vite package, inline `resolveVite` overrides, and the vite migration deep-merging into `toolchain.vite`.
 #### Vscode
 - Document extension requirements ([#07fd6fa](https://github.com/deltabox-studio/toolchain/commit/07fd6fa) by [T0chi](https://github.com/T0chi))
 #### Config
 - Generate CLI, env and config-type references ([#ba640a3](https://github.com/deltabox-studio/toolchain/commit/ba640a3) by [T0chi](https://github.com/T0chi))
-  - `config:docs`) to generate `apps/docs/config/index.md`, `cli.md` from
-    the ToolchainCommand descriptors, and `env.md` from ConfigMeta.
+  - Add `scripts/generate-config-docs.ts` (wired into `config:generate` and `config:docs`) to generate `apps/docs/config/index.md`, `cli.md` from the ToolchainCommand descriptors, and `env.md` from ConfigMeta.
+  - Add the three pages to the config sidebar and frontmatter outlines.
+  - Extend the CI drift check to cover the new generated files.
 ### Tests
 - Run the emulate suite in a temp sandbox outside the repo ([#a94fa4c](https://github.com/deltabox-studio/toolchain/commit/a94fa4c) by [T0chi](https://github.com/T0chi))
-  - `node_modules` link back to the repo install) instead of `tests/emulate`,
-    so a stray sync can never touch the toolchain repo
-    every test, and clean up on `SIGHUP`/`SIGBREAK` too
-    sandboxes
+  - create the scratch workspaces under `<tmp>/dbx-emulate-*` (with a `node_modules` link back to the repo install) instead of `tests/emulate`, so a stray sync can never touch the toolchain repo
+  - snapshot and restore the repo's managed files (not only the manifest) after every test, and clean up on `SIGHUP`/`SIGBREAK` too
+  - add `yarn test:clean` (`scripts/clean-emulate.mjs`) to remove leftover sandboxes
+  - update the README development section (source-first workflow, `test:clean`)
 - Cover provider search paths, registry policy and remote sources ([#91a5859](https://github.com/deltabox-studio/toolchain/commit/91a5859) by [T0chi](https://github.com/T0chi))
 ### Build system
 - Run typechecks, tests and Vite+ from source without a built `dist` ([#4353a36](https://github.com/deltabox-studio/toolchain/commit/4353a36) by [T0chi](https://github.com/T0chi))
-  - `tsconfig.workspaces.json` and regenerate every workspace `tsconfig.json`,
-    so typechecks resolve workspace source instead of `dist`
-    building the package first
-    the source tsconfigs
+  - alias `@deltabox/toolchain` (+ subpaths) to `src` in `tsconfig.workspaces.json` and regenerate every workspace `tsconfig.json`, so typechecks resolve workspace source instead of `dist`
+  - enable `resolve.tsconfigPaths` for Vite/Vitest (root + every workspace)
+  - dogfood `vite.shim: 'static'`, so `vp` loads the generated shims without building the package first
+  - drop the `typecheck:ci` script, tasks and CI step; `typecheck` already runs the source tsconfigs
+  - apply pending formatter output to the config/changelog sources
 ### Chores
 - Fix lint warnings and remove unused helper ([#ac890d8](https://github.com/deltabox-studio/toolchain/commit/ac890d8) by [T0chi](https://github.com/T0chi))
 - Add lint and check vp tasks to every workspace ([#83bb7e5](https://github.com/deltabox-studio/toolchain/commit/83bb7e5) by [T0chi](https://github.com/T0chi))
@@ -350,24 +401,17 @@
 - Updated misleading docs ([#5a5e44c](https://github.com/deltabox-studio/toolchain/commit/5a5e44c) by [T0chi](https://github.com/T0chi))
 ### Chores
 #### Vscode
-- Rearranged views order ([#0620097](https://github.com/deltabox-studio/toolchain/issues/0620097) by [T0chi](https://github.com/T0chi))
+- Rearranged views order ([#0620097](https://github.com/deltabox-studio/toolchain/commit/0620097) by [T0chi](https://github.com/T0chi))
 
 ## 1.11.3 (October 2026)
 
 ### Bug fixes
 #### Ci
 - Emit the dbx.config.ts fence title in the generated reference ([#d154039](https://github.com/deltabox-studio/toolchain/commit/d154039) by [T0chi](https://github.com/T0chi))
-  - `apps/docs/config/reference.md` is generated by `scripts/generate-config.ts`
-    (and the CI `Verify generated config artifacts are up to date` step), so its
-    "Full example" fence must be produced by the generator. The docs rebrand added
-    a `[dbx.config.ts]` title to that fence by hand, which `yarn config:generate`
-    then stripped, failing the drift check. Emit the title from the generator so
-    the regenerated (and formatted) file matches the committed one.
+  - `apps/docs/config/reference.md` is generated by `scripts/generate-config.ts` (and the CI `Verify generated config artifacts are up to date` step), so its "Full example" fence must be produced by the generator. The docs rebrand added a `[dbx.config.ts]` title to that fence by hand, which `yarn config:generate` then stripped, failing the drift check. Emit the title from the generator so the regenerated (and formatted) file matches the committed one.
 ### Styles
 - Format the docs brand stylesheet ([#fb3a711](https://github.com/deltabox-studio/toolchain/commit/fb3a711) by [T0chi](https://github.com/T0chi))
-  - Run the formatter over `apps/docs/.vitepress/theme/style.css` (trailing
-    whitespace, indentation, numeric normalization) so `yarn format` no longer
-    dirties the tree.
+  - Run the formatter over `apps/docs/.vitepress/theme/style.css` (trailing whitespace, indentation, numeric normalization) so `yarn format` no longer dirties the tree.
 
 ## 1.11.2 (October 2026)
 
@@ -379,53 +423,28 @@
 ### Bug fixes
 - Write scaffold files only at the end and resolve "." names ([#c01fcf3](https://github.com/deltabox-studio/toolchain/commit/c01fcf3) by [T0chi](https://github.com/T0chi))
   - Two scaffolding robustness fixes:
-  - Cancelling any prompt (scope, package manager, include-config, the
-    folder picker) aborts the whole command instead of falling back to a
-    default and creating orphan files/dirs. The local-template copier also
-    reads and renders the entire tree into memory before writing, so a
-    failed or interrupted run can never leave a half-copied template.
-  - directory it is created in (`--out`/`--root`), so
-    `dbx create --name . --out ./my-app` names the package `my-app`.
+  - A scaffold now writes nothing until every prompt has been answered. Cancelling any prompt (scope, package manager, include-config, the folder picker) aborts the whole command instead of falling back to a default and creating orphan files/dirs. The local-template copier also reads and renders the entire tree into memory before writing, so a failed or interrupted run can never leave a half-copied template.
+  - A project/workspace name of `.` resolves to the basename of the directory it is created in (`--out`/`--root`), so `dbx create --name . --out ./my-app` names the package `my-app`.
   - Tests: emulate the `.` name through both `create` and `project:init`.
 #### Shared
 - Quote a Windows command path that contains spaces ([#2e1f2ab](https://github.com/deltabox-studio/toolchain/commit/2e1f2ab) by [T0chi](https://github.com/T0chi))
-  - `spawnCross` routes every Windows command through `cmd.exe`, which splits an
-    unquoted command at whitespace, so an absolute path like
-    `C:\Program Files\nodejs\node.exe` was resolved as `C:\Program` and never ran.
-    Quote the command when it contains whitespace instead of caret-escaping the
-    space (which `cmd.exe` still splits on). The same fix is mirrored in the
-    extension's `win-spawn` port.
-  - Tests: a functional case that hardlinks `node.exe` into a space-containing
-    temp dir and runs it, plus unit assertions for `escapeCmdCommand`.
+  - `spawnCross` routes every Windows command through `cmd.exe`, which splits an unquoted command at whitespace, so an absolute path like `C:\Program Files\nodejs\node.exe` was resolved as `C:\Program` and never ran. Quote the command when it contains whitespace instead of caret-escaping the space (which `cmd.exe` still splits on). The same fix is mirrored in the extension's `win-spawn` port.
+  - Tests: a functional case that hardlinks `node.exe` into a space-containing temp dir and runs it, plus unit assertions for `escapeCmdCommand`.
 #### Vscode
 - Run template create without a shell so npm scopes survive ([#0863cf2](https://github.com/deltabox-studio/toolchain/commit/0863cf2) by [T0chi](https://github.com/T0chi))
-  - `createFromTemplate` sent online/Vite+ creates to an integrated terminal as a
-    shell string. On PowerShell a bare `@scope` is read as splatting (`@deltabox` ->
-    splat of an undefined variable), so the value was dropped and commander failed
-    with `option '-s, --scope <scope>' argument missing`.
-  - Run every template through the same argv pipeline (`runCli`, no shell) so values
-    like an npm scope are never mangled. Vite+ projects skip the post-create sync
-    since they are not dbx-managed.
+  - `createFromTemplate` sent online/Vite+ creates to an integrated terminal as a shell string. On PowerShell a bare `@scope` is read as splatting (`@deltabox` -> splat of an undefined variable), so the value was dropped and commander failed with `option '-s, --scope <scope>' argument missing`.
+  - Run every template through the same argv pipeline (`runCli`, no shell) so values like an npm scope are never mangled. Vite+ projects skip the post-create sync since they are not dbx-managed.
 ### Documentation
 - Updated `vscode-example.mp4` ([#58c0061](https://github.com/deltabox-studio/toolchain/commit/58c0061) by [T0chi](https://github.com/T0chi))
 - Rebrand to the new logo and blue theme ([#e28c1f9](https://github.com/deltabox-studio/toolchain/commit/e28c1f9) by [T0chi](https://github.com/T0chi))
-  - Swap the toolchain/box2d logos for the new `logo/*` assets, re-theme the
-    site with the blue brand tokens and hero/logo animations, update the home
-    page (GitHub action, feature icons), and refresh the guide/reference copy
-    and code fences. Regenerated `llms.txt` / `llms-full.txt`.
+  - Swap the toolchain/box2d logos for the new `logo/*` assets, re-theme the site with the blue brand tokens and hero/logo animations, update the home page (GitHub action, feature icons), and refresh the guide/reference copy and code fences. Regenerated `llms.txt` / `llms-full.txt`.
 - Adopt the Carbon theme with code-group icons ([#09b2608](https://github.com/deltabox-studio/toolchain/commit/09b2608) by [T0chi](https://github.com/T0chi))
-  - Build the docs on vitepress-carbon: spread its base config and override
-    `vite.plugins` so the LLM plugin runs once (with our copy instead of
-    Carbon's default), add `vitepress-plugin-group-icons` for language icons on
-    `::: code-group` / `[title]` blocks, and register the theme. Also refresh
-    the year/footer config. Adds the two dev dependencies.
+  - Build the docs on vitepress-carbon: spread its base config and override `vite.plugins` so the LLM plugin runs once (with our copy instead of Carbon's default), add `vitepress-plugin-group-icons` for language icons on `::: code-group` / `[title]` blocks, and register the theme. Also refresh the year/footer config. Adds the two dev dependencies.
 - Rename the "LLM context files" page to "LLMs" ([#9a9e8c7](https://github.com/deltabox-studio/toolchain/commit/9a9e8c7) by [T0chi](https://github.com/T0chi))
 ### Chores
 #### Vscode
 - Rebrand the extension icon and README ([#bbde675](https://github.com/deltabox-studio/toolchain/commit/bbde675) by [T0chi](https://github.com/T0chi))
-  - Point the extension icon at the new `resources/logo.png` / `icon.svg`,
-    drop the old `icon.png` / `logo.svg`, and update the README with the new
-    banner.
+  - Point the extension icon at the new `resources/logo.png` / `icon.svg`, drop the old `icon.png` / `logo.svg`, and update the README with the new banner.
 
 ### Package changes
 #### Added
@@ -437,21 +456,13 @@
 ### New features
 #### Vscode
 - Scaffold any template and drive Vite+ create from the extension ([#fb4a55c](https://github.com/deltabox-studio/toolchain/commit/fb4a55c) by [T0chi](https://github.com/T0chi))
-  - project" picker (`template:list --online`) instead of only the dbx builtins;
-    each entry runs the same create pipeline (name/scope/variables/actions).
-    bare `vite-plus` template — through the extension's prompt pipeline: pick a
-    concrete Vite+ template, then create like any other template. Consumers no
-    longer land in the interactive `vp create` CLI menu.
+  - List every template (builtin + local + npm/git + Vite+) in the "Scaffold project" picker (`template:list --online`) instead of only the dbx builtins; each entry runs the same create pipeline (name/scope/variables/actions).
+  - Route `vite:create` — from the Vite+ command picker, the provider tree and the bare `vite-plus` template — through the extension's prompt pipeline: pick a concrete Vite+ template, then create like any other template. Consumers no longer land in the interactive `vp create` CLI menu.
 ### Bug fixes
 #### Project
 - Tag a scaffolded workspace with its own project type ([#9d05637](https://github.com/deltabox-studio/toolchain/commit/9d05637) by [T0chi](https://github.com/T0chi))
-  - `resolveType` fell back to the loaded config's `project.type`, but a scaffold
-    runs with the config of the directory it is invoked from — the monorepo root
-    when adding a workspace. A workspace was therefore tagged `monorepo-root`, and
-    the post-scaffold sync then generated root-only CI, husky and VS Code files
-    inside the workspace.
-  - Only honour an explicit `--type` (or the command's implied default); ignore the
-    ambient config type.
+  - `resolveType` fell back to the loaded config's `project.type`, but a scaffold runs with the config of the directory it is invoked from — the monorepo root when adding a workspace. A workspace was therefore tagged `monorepo-root`, and the post-scaffold sync then generated root-only CI, husky and VS Code files inside the workspace.
+  - Only honour an explicit `--type` (or the command's implied default); ignore the ambient config type.
 ### Documentation
 - Update descriptions and vscode screenshot ([#215bc4f](https://github.com/deltabox-studio/toolchain/commit/215bc4f) by [T0chi](https://github.com/T0chi))
 ### Styles
@@ -459,10 +470,8 @@
   - Long single-line descriptions from earlier commits; `vp fmt` wraps them back.
 ### Tests
 - Emulate custom templates/providers and workspace scaffolding ([#37d370e](https://github.com/deltabox-studio/toolchain/commit/37d370e) by [T0chi](https://github.com/T0chi))
-  - Code extension writes) and assert the CLI lists, scaffolds and runs them —
-    i.e. the payloads the extension's trees consume.
-    assert the workspace does NOT inherit their outputs
-    (.github/.husky/.vscode/commitlint.config.mjs).
+  - Register a custom local template plus a custom provider (the JSON shape the VS Code extension writes) and assert the CLI lists, scaffolds and runs them — i.e. the payloads the extension's trees consume.
+  - Scaffold a workspace into a root that enables the root-only sections, and assert the workspace does NOT inherit their outputs (.github/.husky/.vscode/commitlint.config.mjs).
 ### Chores
 #### Vscode
 - Rename the Home "All actions" section to "More actions" ([#b8a2137](https://github.com/deltabox-studio/toolchain/commit/b8a2137) by [T0chi](https://github.com/T0chi))
@@ -477,24 +486,14 @@
 ### Bug fixes
 #### Vscode
 - Recompute the Home model when the provider list loads ([#fd6f6f1](https://github.com/deltabox-studio/toolchain/commit/fd6f6f1) by [T0chi](https://github.com/T0chi))
-  - The Home "Run Vite+" button is disabled while the Home model's `hasVite` is
-    false, and that value comes from the asynchronously-loaded provider list (a
-    `dbx providers --json` spawn). A webview rendered before the list resolved was
-    never re-posted, so the button could stay disabled from a cold start even though
-    the `deltabox.hasVite` context key (command palette) was updated.
-  - Recompute the context keys and the Home model whenever the provider tree
-    reloads, via its `onDidChangeTreeData` event. Vite+ is always contributed by the
-    toolchain, so `hasVite` is true as soon as the list loads.
+  - The Home "Run Vite+" button is disabled while the Home model's `hasVite` is false, and that value comes from the asynchronously-loaded provider list (a `dbx providers --json` spawn). A webview rendered before the list resolved was never re-posted, so the button could stay disabled from a cold start even though the `deltabox.hasVite` context key (command palette) was updated.
+  - Recompute the context keys and the Home model whenever the provider tree reloads, via its `onDidChangeTreeData` event. Vite+ is always contributed by the toolchain, so `hasVite` is true as soon as the list loads.
 #### Core
 - Split the last-sync timestamp into a gitignored timestamps.json ([#0aa6f77](https://github.com/deltabox-studio/toolchain/commit/0aa6f77) by [T0chi](https://github.com/T0chi))
-  - The per-project `manifest.json` embedded `syncedAt`, so every sync rewrote a
-    committed file with a new clock value — noisy diffs in the repo and in every
-    consumer. Move the timestamp out into a sibling, gitignored
-    `.dbx/toolchain/timestamps.json`:
-  - to `timestamps.json`, so the next sync migrates a legacy inline value
-    automatically (the property is gone from `manifest.json`).
-    inline `syncedAt` until that migration runs, so nothing breaks in between.
-    only the block's comment was updated.
+  - The per-project `manifest.json` embedded `syncedAt`, so every sync rewrote a committed file with a new clock value — noisy diffs in the repo and in every consumer. Move the timestamp out into a sibling, gitignored `.dbx/toolchain/timestamps.json`:
+  - `writeManifest` writes only the file list to `manifest.json` and the timestamp to `timestamps.json`, so the next sync migrates a legacy inline value automatically (the property is gone from `manifest.json`).
+  - `readManifest`/`readSyncedAt` (and the VS Code reader) fall back to a legacy inline `syncedAt` until that migration runs, so nothing breaks in between.
+  - The new file is covered by the existing `.dbx/toolchain/*` gitignore glob; only the block's comment was updated.
 ### Documentation
 - Added a video preview of the extension ([#6b0ca40](https://github.com/deltabox-studio/toolchain/commit/6b0ca40) by [T0chi](https://github.com/T0chi))
 
@@ -509,85 +508,51 @@
 ### Bug fixes
 #### Core
 - Only fall back to tsx when Node cannot load TypeScript ([#c96ae7d](https://github.com/deltabox-studio/toolchain/commit/c96ae7d) by [T0chi](https://github.com/T0chi))
-  - The config loader retried every failed native import through `tsx`, so a
-    genuinely broken `dbx.config.*` could be silently loaded as an empty config.
-    On Linux the root build had baked an absolute path to `tsx` into the bundle,
-    which happened to resolve there: tsx elided the unresolvable (unused) import,
-    the config "loaded", no error was recorded, and `dbx sync` exited 0 instead of
-    failing (the emulation suite caught this in CI).
-  - (`ERR_UNKNOWN_FILE_EXTENSION`, `ERR_UNSUPPORTED_TYPESCRIPT_SYNTAX`); let
-    genuine errors (module-not-found, syntax errors, throws) propagate.
-    `import('tsx/esm/api')` instead of a build-machine path, and promote `tsx` to
-    a runtime dependency so the config-loader fallback works for consumers.
+  - The config loader retried every failed native import through `tsx`, so a genuinely broken `dbx.config.*` could be silently loaded as an empty config. On Linux the root build had baked an absolute path to `tsx` into the bundle, which happened to resolve there: tsx elided the unresolvable (unused) import, the config "loaded", no error was recorded, and `dbx sync` exited 0 instead of failing (the emulation suite caught this in CI).
+  - Only use the `tsx` fallback for errors that mean Node cannot load TS itself (`ERR_UNKNOWN_FILE_EXTENSION`, `ERR_UNSUPPORTED_TYPESCRIPT_SYNTAX`); let genuine errors (module-not-found, syntax errors, throws) propagate.
+  - Unwrap tsx's possibly-nested default export.
+  - Keep `tsx` external in the root bundle so `dist` keeps the portable bare `import('tsx/esm/api')` instead of a build-machine path, and promote `tsx` to a runtime dependency so the config-loader fallback works for consumers.
 
 ## 1.10.0 (October 2026)
 
 ### New features
 #### Template
 - Scaffold actions, package-manager choice and catalogs ([#6c66c97](https://github.com/deltabox-studio/toolchain/commit/6c66c97) by [T0chi](https://github.com/T0chi))
-  - `module` (relative to the template dir, `export default async (ctx) => {}`,
-    not copied to the output) or a shell `command`. Actions run through the same
-    pipeline everywhere (CLI prompts / `--action <id>`, extension prompts,
-    programmatic API `actions: string[]`).
-    (`builtin: 'install'`, default off) and a `packageManager` input
-    (yarn default | pnpm | npm | bun).
-    when supported: `.yarnrc.yml` (yarn), `pnpm-workspace.yaml` (pnpm),
-    `package.json` `workspaces.catalog` (bun); npm pins versions inline.
-    task that keeps `.yarnrc.yml` / `pnpm-workspace.yaml` catalogs in sync. It
-    only writes a file that is absent or toolchain-managed (marker comment), so a
-    hand-written file is never clobbered; bun/npm warn.
-    the manager.
-    config reference/schema/types regenerated.
+  - Templates can declare post-scaffold `actions`: a `builtin` (`install`), a JS `module` (relative to the template dir, `export default async (ctx) => {}`, not copied to the output) or a shell `command`. Actions run through the same pipeline everywhere (CLI prompts / `--action <id>`, extension prompts, programmatic API `actions: string[]`).
+  - Built-in templates declare an opt-in **Install dependencies?** action (`builtin: 'install'`, default off) and a `packageManager` input (yarn default | pnpm | npm | bun).
+  - Scaffolds write the chosen manager's catalog file and reference `catalog:` when supported: `.yarnrc.yml` (yarn), `pnpm-workspace.yaml` (pnpm), `package.json` `workspaces.catalog` (bun); npm pins versions inline.
+  - Add a `catalogs` config section (`packages` + `named`) and a `catalogs` sync task that keeps `.yarnrc.yml` / `pnpm-workspace.yaml` catalogs in sync. It only writes a file that is absent or toolchain-managed (marker comment), so a hand-written file is never clobbered; bun/npm warn.
+  - `project:init*` gains `--package-manager`; the extension scaffold prompts for the manager.
+  - Docs: templates (inputs + actions), project (package manager & catalogs), config reference/schema/types regenerated.
 - Generic builtins + inputs + Vite+ templates; resilient config loading ([#fb8d7cc](https://github.com/deltabox-studio/toolchain/commit/fb8d7cc) by [T0chi](https://github.com/T0chi))
-  - `catalog:` protocol from generated projects, add a pinned
-    `@deltabox/toolchain` devDependency, and generate a `dbx.config.ts` with only
-    the `project` section — every other section is now opt-in.
-    `monorepo-example`, and expose every Vite+ template
-    (`vite-plus-monorepo`, `-application`, `-library`, `-generator`).
-    shared by the CLI, the programmatic API, the VS Code extension and the
-    builtins; document it in the Templates guide.
-    `@deltabox/toolchain/tsdown` (the private `@deltabox/toolchain-tsdown` package
-    is never published).
-    stderr instead of aborting unrelated commands (`template:list`, `providers`,
-    ...), so the extension views no longer empty out after scaffolding; `sync`
-    still fails on a broken config (and `--recursive` reports per project).
-    choice, and add a "Need help? Go to documentation" link to the Home view.
+  - Templates: drop Turbo (no `turbo.json`, dep or scripts) and the repo-internal `catalog:` protocol from generated projects, add a pinned `@deltabox/toolchain` devDependency, and generate a `dbx.config.ts` with only the `project` section — every other section is now opt-in.
+  - Add a bare `monorepo` builtin (no example workspace), keep `monorepo-example`, and expose every Vite+ template (`vite-plus-monorepo`, `-application`, `-library`, `-generator`).
+  - Add a template input pipeline (`variables` with prompt/default/options/required) shared by the CLI, the programmatic API, the VS Code extension and the builtins; document it in the Templates guide.
+  - Fix the generated workspace `tsdown.config.ts` to import `@deltabox/toolchain/tsdown` (the private `@deltabox/toolchain-tsdown` package is never published).
+  - Load `dbx.config.*` tolerantly in the CLI: a broken config now warns on stderr instead of aborting unrelated commands (`template:list`, `providers`, ...), so the extension views no longer empty out after scaffolding; `sync` still fails on a broken config (and `--recursive` reports per project).
+  - Extension: prompt for template inputs, offer a bare/example monorepo scaffold choice, and add a "Need help? Go to documentation" link to the Home view.
 ### Bug fixes
 - Issues found emulating the extension + command palette ([#1049afa](https://github.com/deltabox-studio/toolchain/commit/1049afa) by [T0chi](https://github.com/T0chi))
   - Emulated the extension (bundled and portal `dbx`) against a consumer workspace:
-  - name ("No version specified for X") for yarn/pnpm/npm/bun, so `projectToPackageJson`
-    skips the field when no version is known, and scaffolds/`project:config` seed a
-    default version (`DEFAULT_PACKAGE_MANAGER_VERSIONS`) or the existing
-    package.json manager. `renderToolchainConfig` always emits `packageManagerVersion`.
-    `vite-plus` ships two bins, so `npx vite-plus` failed with "could not determine
-    executable to run" (broke `dbx vite:*`).
-    `@deltabox/toolchain/vite` no longer runs `resolveDbx` at module load, so every
-    command stopped printing spurious `dbx`-resolution warnings.
-    option").
-    template), so the Managed Files and Home views populate instead of staying empty.
+  - `packageManager` is never written without a version. Corepack rejects a bare name ("No version specified for X") for yarn/pnpm/npm/bun, so `projectToPackageJson` skips the field when no version is known, and scaffolds/`project:config` seed a default version (`DEFAULT_PACKAGE_MANAGER_VERSIONS`) or the existing package.json manager. `renderToolchainConfig` always emits `packageManagerVersion`.
+  - `resolveVp`'s `npx` fallback names the bin (`npx --yes --package vite-plus vp`): `vite-plus` ships two bins, so `npx vite-plus` failed with "could not determine executable to run" (broke `dbx vite:*`).
+  - `DBX_TASKS` computes its commands lazily (getters): importing `@deltabox/toolchain/vite` no longer runs `resolveDbx` at module load, so every command stopped printing spurious `dbx`-resolution warnings.
+  - `template:info` accepts `--json` (the extension passed it; it errored "unknown option").
+  - The extension syncs right after a successful scaffold (project/root/workspace/ template), so the Managed Files and Home views populate instead of staying empty.
+  - Regression tests for the version-less `packageManager` and the versioned scaffold.
 #### Project
 - Preserve scoped package name and never delete catalog files ([#dbb0b21](https://github.com/deltabox-studio/toolchain/commit/dbb0b21) by [T0chi](https://github.com/T0chi))
   - Found by exercising a portal-linked consumer workspace:
-  - defines `name` without `scope` (eg. a nested workspace), instead of renaming
-    `@acme/a` to `a`. Mirrors the token resolution in the config loader.
-    a previously toolchain-managed catalog file is never deleted when the task
-    stops producing it (eg. the user replaces it with a hand-written one) — it
-    already refused to overwrite it, but `runSync` would still remove it.
+  - `projectSyncTask` now falls back to the `package.json` scope when a config defines `name` without `scope` (eg. a nested workspace), instead of renaming `@acme/a` to `a`. Mirrors the token resolution in the config loader.
+  - `catalogsSyncTask` declares `keep: ['.yarnrc.yml', 'pnpm-workspace.yaml']`, so a previously toolchain-managed catalog file is never deleted when the task stops producing it (eg. the user replaces it with a hand-written one) — it already refused to overwrite it, but `runSync` would still remove it.
+  - Regression tests for both.
 ### Tests
 - Add a real CLI emulation suite under tests/emulate ([#2c76d66](https://github.com/deltabox-studio/toolchain/commit/2c76d66) by [T0chi](https://github.com/T0chi))
-  - extension and command palette drive) in a per-test scratch workspace under
-    `tests/emulate/<id>` and asserts on real behavior: builtins + inputs/actions,
-    per-package-manager scaffolding (catalog vs pinned), bare/nested monorepos,
-    custom module/command actions, the opt-in install action, catalog sync +
-    never-delete, config-load resilience, `template:info --json`, and the
-    post-scaffold extension flow.
-    boundary and never inherits the toolchain repo's own config/manifest. Scratch
-    dirs are removed after every test (pass or fail), once more on `afterAll`, and
-    again on process exit; the repo's own manifest is snapshotted and restored so
-    the working tree stays clean.
-    always execute against a fresh CLI bundle.
-    emitting a dangling `catalog:` — Bun's catalog lives in `package.json`
-    `workspaces.catalog`, which only a monorepo root writes. Regression tests added.
+  - `tests/emulate.test.ts` spawns the **built** `dbx` CLI (the surface the VS Code extension and command palette drive) in a per-test scratch workspace under `tests/emulate/<id>` and asserts on real behavior: builtins + inputs/actions, per-package-manager scaffolding (catalog vs pinned), bare/nested monorepos, custom module/command actions, the opt-in install action, catalog sync + never-delete, config-load resilience, `template:info --json`, and the post-scaffold extension flow.
+  - Each scratch root carries an empty `.git` so `dbx` treats it as a repository boundary and never inherits the toolchain repo's own config/manifest. Scratch dirs are removed after every test (pass or fail), once more on `afterAll`, and again on process exit; the repo's own manifest is snapshotted and restored so the working tree stays clean.
+  - `.gitignore`: ignore `tests/emulate/*` (the scratch content).
+  - root `test` script now runs `vp run build:root` first, so the emulation tests always execute against a fresh CLI bundle.
+  - fix(project): a single Bun project now pins its dependencies instead of emitting a dangling `catalog:` — Bun's catalog lives in `package.json` `workspaces.catalog`, which only a monorepo root writes. Regression tests added.
 
 ## 1.9.2 (October 2026)
 
@@ -599,75 +564,36 @@
 ### CI
 #### Vscode
 - Target the release environment by name (drop resourceType) ([#2bbd25a](https://github.com/deltabox-studio/toolchain/commit/2bbd25a) by [T0chi](https://github.com/T0chi))
-  - `resourceType` only accepts `virtualMachine`/`Kubernetes`. `resourceType: none`
-    made the deployment job look for a resource of type `none`, so it failed with
-    "No resource were found in the environment ... ResourceType Undefined". Use the
-    string form `environment: 'release'`, which records the deployment against the
-    resource-less environment and still applies its approvals/checks.
+  - `resourceType` only accepts `virtualMachine`/`Kubernetes`. `resourceType: none` made the deployment job look for a resource of type `none`, so it failed with "No resource were found in the environment ... ResourceType Undefined". Use the string form `environment: 'release'`, which records the deployment against the resource-less environment and still applies its approvals/checks.
 
 ## 1.9.0 (October 2026)
 
 ### New features
 #### Changelog
 - Allow a raw YAML string as a workflow setting ([#aa0e1b7](https://github.com/deltabox-studio/toolchain/commit/aa0e1b7) by [T0chi](https://github.com/T0chi))
-  - `changelog.workflows.<id>` now accepts a raw YAML string in addition to a
-    boolean or a `WorkflowConfig` object. A raw string is written verbatim as the
-    workflow file: no default merge, no token replacement and no generated header,
-    and the `changelog.branches` defaults don't apply (it defines its own triggers).
-    An empty string disables the workflow.
-  - Docs: add a "Workflows" section covering the three forms, and a "Writing commit
-    messages" section warning about shell escaping (PowerShell backtick escapes and
-    bash command substitution) and AI/LLM-drafted messages introducing stray control
-    characters, curly quotes, dashes and other typographic characters. Regenerate
-    the schema, types and docs reference.
+  - `changelog.workflows.<id>` now accepts a raw YAML string in addition to a boolean or a `WorkflowConfig` object. A raw string is written verbatim as the workflow file: no default merge, no token replacement and no generated header, and the `changelog.branches` defaults don't apply (it defines its own triggers). An empty string disables the workflow.
+  - Docs: add a "Workflows" section covering the three forms, and a "Writing commit messages" section warning about shell escaping (PowerShell backtick escapes and bash command substitution) and AI/LLM-drafted messages introducing stray control characters, curly quotes, dashes and other typographic characters. Regenerate the schema, types and docs reference.
 ### CI
 #### Vscode
 - Skip the release when the extension version is already published ([#0d54cfe](https://github.com/deltabox-studio/toolchain/commit/0d54cfe) by [T0chi](https://github.com/T0chi))
-  - `vsce publish` fails with "already exists" when `deltabox.toolchain-vscode@<version>`
-    is already on the Marketplace, failing the whole pipeline. Add a `Check` stage
-    before `Build` that reads the version from `packages/vscode/package.json`,
-    queries the Marketplace `extensionquery` API, and exposes an `alreadyPublished`
-    stage output. `Build` and `Release` now depend on `Check` and skip when it is
-    `true` (a failed query assumes "not published" so a release is never silently
-    skipped).
+  - `vsce publish` fails with "already exists" when `deltabox.toolchain-vscode@<version>` is already on the Marketplace, failing the whole pipeline. Add a `Check` stage before `Build` that reads the version from `packages/vscode/package.json`, queries the Marketplace `extensionquery` API, and exposes an `alreadyPublished` stage output. `Build` and `Release` now depend on `Check` and skip when it is `true` (a failed query assumes "not published" so a release is never silently skipped).
 ### Chores
 #### Changelog
 - Repair escaped text in the 1.8.0 entry ([#587e47d](https://github.com/deltabox-studio/toolchain/commit/587e47d) by [T0chi](https://github.com/T0chi))
-  - The shared/core/project/tsconfig/vite commits were authored with PowerShell
-    `\``-escaped backticks, so their bodies carried `\` + control-character
-    artifacts (e.g. `` `r `` -> `\`+CR, `` `b `` -> backspace). The changelog
-    sanitizer stripped the control characters but left the stray backslashes and
-    dropped letters, so the 1.8.0 entry read `esolveVite`, `\{ ... }\`, `epo\`, etc.
-    Restore the intended text (backticked code, `resolveVite`, `repo`/`repository`,
-    `name`/`scope`/`description`/`type`, `rootFile`/`defaultFile`/`buildFile`).
+  - The shared/core/project/tsconfig/vite commits were authored with PowerShell `\``-escaped backticks, so their bodies carried `\` + control-character artifacts (e.g. `` `r `` -> `\`+CR, `` `b `` -> backspace). The changelog sanitizer stripped the control characters but left the stray backslashes and dropped letters, so the 1.8.0 entry read `esolveVite`, `\{ ... }\`, `epo\`, etc. Restore the intended text (backticked code, `resolveVite`, `repo`/`repository`, `name`/`scope`/`description`/`type`, `rootFile`/`defaultFile`/`buildFile`).
 
 ## 1.8.0 (October 2026)
 
 ### New features
 #### Cli
 - Expose the sync tasks to commands and keep --json output clean ([#1e4ecec](https://github.com/deltabox-studio/toolchain/commit/1e4ecec) by [T0chi](https://github.com/T0chi))
-  - The command context now carries `syncTasks` (`defaultSyncTasks()`) so a package
-    command such as `migrate` can regenerate managed files without depending on
-    every sync package. Skip the update-check notice when `--json` is passed so it
-    never lands on stdout and corrupts machine output.
+  - The command context now carries `syncTasks` (`defaultSyncTasks()`) so a package command such as `migrate` can regenerate managed files without depending on every sync package. Skip the update-check notice when `--json` is passed so it never lands on stdout and corrupts machine output.
 #### Changelog
 - Per-workspace changelogs and configurable branches ([#0aa329c](https://github.com/deltabox-studio/toolchain/commit/0aa329c) by [T0chi](https://github.com/T0chi))
-  - Scan a workspace's own commits (plus its transitive dependencies) via
-    `relatedWorkspacePaths` and create a missing workspace `CHANGELOG.md` instead of
-    skipping it. `changelog.branches.main`/`dev` accept a string or an array, `dev`
-    defaults to `main`, and the branch list is injected into the generated
-    workflows. Add `changelog.commitlint.dir` for a custom commitlint config
-    location. Release notes aggregate every changelog entry since the last tag.
+  - Scan a workspace's own commits (plus its transitive dependencies) via `relatedWorkspacePaths` and create a missing workspace `CHANGELOG.md` instead of skipping it. `changelog.branches.main`/`dev` accept a string or an array, `dev` defaults to `main`, and the branch list is injected into the generated workflows. Add `changelog.commitlint.dir` for a custom commitlint config location. Release notes aggregate every changelog entry since the last tag.
 #### Migrate
 - Recursive, interactive migration and post-migration sync ([#bb87b33](https://github.com/deltabox-studio/toolchain/commit/bb87b33) by [T0chi](https://github.com/T0chi))
-  - `dbx migrate` is now `--recursive` (off by default): it discovers the projects
-    under the root and, on a TTY, prompts a multi-select with an "All projects"
-    option. The `vite` migration creates a fresh nested `dbx.config.ts` (wrapped in
-    `defineConfig`) when the project has none, and removes the folded
-    `vite.config.*` unless `--ignore-vite-config-file`. `--write` also regenerates
-    the project's managed files unless `--ignore-managed-files`, dropping the
-    changelog task when `--ignore-changelog`; removals are reported. Adds
-    `@clack/prompts`, `@deltabox/toolchain-core` and `glob` to the package.
+  - `dbx migrate` is now `--recursive` (off by default): it discovers the projects under the root and, on a TTY, prompts a multi-select with an "All projects" option. The `vite` migration creates a fresh nested `dbx.config.ts` (wrapped in `defineConfig`) when the project has none, and removes the folded `vite.config.*` unless `--ignore-vite-config-file`. `--write` also regenerates the project's managed files unless `--ignore-managed-files`, dropping the changelog task when `--ignore-changelog`; removals are reported. Adds `@clack/prompts`, `@deltabox/toolchain-core` and `glob` to the package.
 #### Vite
 - Accept a single options object in resolveVite ([#2e2384b](https://github.com/deltabox-studio/toolchain/commit/2e2384b) by [T0chi](https://github.com/T0chi))
   - `resolveVite(options?: DbxConfig & ResolveViteOptions)` replaces the two-argument form. The generated shim passes `{ cwd: import.meta.dirname }` so a nested shim resolves its own `dbx.config.*` instead of the process cwd's.
@@ -686,52 +612,25 @@
 ### Bug fixes
 #### Vscode
 - Resolve the bundled CLI and gate commands on availability ([#5220ed3](https://github.com/deltabox-studio/toolchain/commit/5220ed3) by [T0chi](https://github.com/T0chi))
-  - Capture the running extension's path and version at activation instead of
-    hardcoding the id (`deltabox.toolchain` is stale: the id is
-    `<publisher>.<name>`), so `bundledCliEntry()`/`pinnedToolchainSpec()` find the
-    shipped `dbx.cjs` and Providers/Templates/scaffolding work without a
-    project-local install. Disable the sync commands (`deltabox.canSync`) and the
-    Vite+ commands (`deltabox.hasVite`) via context keys + command `enablement` and
-    the Home buttons when there is nothing to sync / the provider is unavailable.
-    Exclude `dbx.config.ts` and `.dbx/**` from the VSIX.
+  - Capture the running extension's path and version at activation instead of hardcoding the id (`deltabox.toolchain` is stale: the id is `<publisher>.<name>`), so `bundledCliEntry()`/`pinnedToolchainSpec()` find the shipped `dbx.cjs` and Providers/Templates/scaffolding work without a project-local install. Disable the sync commands (`deltabox.canSync`) and the Vite+ commands (`deltabox.hasVite`) via context keys + command `enablement` and the Home buttons when there is nothing to sync / the provider is unavailable. Exclude `dbx.config.ts` and `.dbx/**` from the VSIX.
 ### Documentation
 - Add guides for every config section and the llms output ([#4c231dc](https://github.com/deltabox-studio/toolchain/commit/4c231dc) by [T0chi](https://github.com/T0chi))
-  - Add per-section guides (project, biome, vite, watch, logger, tsconfig), refresh
-    the CLI/config/monorepo/VS Code/api pages and the sidebar, and wire
-    `vitepress-plugin-llms` with `apps/docs/llms.md` plus the script that copies the
-    generated `llms.txt`/`llms-full.txt` to the repo root.
+  - Add per-section guides (project, biome, vite, watch, logger, tsconfig), refresh the CLI/config/monorepo/VS Code/api pages and the sidebar, and wire `vitepress-plugin-llms` with `apps/docs/llms.md` plus the script that copies the generated `llms.txt`/`llms-full.txt` to the repo root.
 ### Build system
 - Make the published package installable ([#b2597ee](https://github.com/deltabox-studio/toolchain/commit/b2597ee) by [T0chi](https://github.com/T0chi))
-  - npm runs a dependency's `postinstall` on install, so the repo-only
-    `husky && node scripts/bootstrap.mjs` broke every consumer (and global) install
-    with `'husky' is not recognized`. Move the logic into `scripts/bootstrap.mjs`,
-    publish it, and guard every checkout-only step: husky runs only when `.husky`
-    exists and the dist build only when `packages/` exists. A consumer install is
-    now a clean no-op.
+  - npm runs a dependency's `postinstall` on install, so the repo-only `husky && node scripts/bootstrap.mjs` broke every consumer (and global) install with `'husky' is not recognized`. Move the logic into `scripts/bootstrap.mjs`, publish it, and guard every checkout-only step: husky runs only when `.husky` exists and the dist build only when `packages/` exists. A consumer install is now a clean no-op.
 ### CI
 - Aggregate release notes and refresh the generated workflows ([#9426a40](https://github.com/deltabox-studio/toolchain/commit/9426a40) by [T0chi](https://github.com/T0chi))
-  - The release workflow now extracts every changelog entry since the last tag, and
-    the generated `ci.yml`/`release.yml` are regenerated from `dbx.config.ts`.
-    Includes the hand-written `release-vscode.yml` pipeline.
+  - The release workflow now extracts every changelog entry since the last tag, and the generated `ci.yml`/`release.yml` are regenerated from `dbx.config.ts`. Includes the hand-written `release-vscode.yml` pipeline.
 #### Vscode
 - Fix the release-vscode Azure Pipelines trigger ([#b59964c](https://github.com/deltabox-studio/toolchain/commit/b59964c) by [T0chi](https://github.com/T0chi))
-  - `pr` is a top-level pipeline keyword, not a child of `trigger` (whose full
-    syntax only accepts `batch`, `branches`, `paths` and `tags`), so `trigger.pr`
-    was reported as an unexpected property. Move `pr: none` to the top level and
-    trigger on `v*` tags through `tags` (with `branches: exclude: ['*']` for a
-    tag-only trigger) instead of the invalid `branches.include: refs/tags/v*`.
+  - `pr` is a top-level pipeline keyword, not a child of `trigger` (whose full syntax only accepts `batch`, `branches`, `paths` and `tags`), so `trigger.pr` was reported as an unexpected property. Move `pr: none` to the top level and trigger on `v*` tags through `tags` (with `branches: exclude: ['*']` for a tag-only trigger) instead of the invalid `branches.include: refs/tags/v*`.
 ### Chores
 - Self-host nested dbx configs across the workspaces ([#003cb9f](https://github.com/deltabox-studio/toolchain/commit/003cb9f) by [T0chi](https://github.com/T0chi))
-  - Every workspace now has its own `dbx.config.ts` (holding its Vite Task
-    definitions) and a generated `vite.config.ts` shim, plus its own tracked
-    manifest. The root gains a `@deltabox/toolchain` `portal:.` self-link so the
-    shims resolve `@deltabox/toolchain/vite`, and `.gitignore` keeps nested
-    manifests while ignoring the rest. The root `tsconfig.monorepo.json` is renamed
-    to `tsconfig.workspaces.json`.
+  - Every workspace now has its own `dbx.config.ts` (holding its Vite Task definitions) and a generated `vite.config.ts` shim, plus its own tracked manifest. The root gains a `@deltabox/toolchain` `portal:.` self-link so the shims resolve `@deltabox/toolchain/vite`, and `.gitignore` keeps nested manifests while ignoring the rest. The root `tsconfig.monorepo.json` is renamed to `tsconfig.workspaces.json`.
 #### Deps
 - Refresh the lockfile ([#420c805](https://github.com/deltabox-studio/toolchain/commit/420c805) by [T0chi](https://github.com/T0chi))
-  - Covers `vitepress-plugin-llms` (docs), `@clack/prompts`/`glob`/core (migrate)
-    and the root `@deltabox/toolchain` `portal:.` self-link.
+  - Covers `vitepress-plugin-llms` (docs), `@clack/prompts`/`glob`/core (migrate) and the root `@deltabox/toolchain` `portal:.` self-link.
 
 ### Package changes
 #### Added
@@ -748,7 +647,7 @@
 
 ### CI
 #### Vscode
-- Upload `release-vscode.yml` pipeline ([#3080357](https://github.com/deltabox-studio/toolchain/issues/3080357) by [T0chi](https://github.com/T0chi))
+- Upload `release-vscode.yml` pipeline ([#3080357](https://github.com/deltabox-studio/toolchain/commit/3080357) by [T0chi](https://github.com/T0chi))
 
 ## 1.7.6 (October 2026)
 
@@ -785,7 +684,7 @@
 - Set up ci with `Azure Pipelines` ([#5bc736f](https://github.com/deltabox-studio/toolchain/commit/5bc736f) by [T0chi](https://github.com/T0chi))
   - [skip ci]
 ### Chores
-- Remove `azure-pipelines.yml` ([#7965965](https://github.com/deltabox-studio/toolchain/issues/7965965) by [T0chi](https://github.com/T0chi))
+- Remove `azure-pipelines.yml` ([#7965965](https://github.com/deltabox-studio/toolchain/commit/7965965) by [T0chi](https://github.com/T0chi))
 
 ## 1.7.1 (October 2026)
 
@@ -804,7 +703,7 @@
   - Add stripControlChars/stripEscapeArtifacts/sanitizeText to the shared string utils: they strip the predictable shell-escape artifacts (a backslash before a control character) and any remaining bare control characters, while leaving ordinary backslashes and normal whitespace alone. Apply them to the config markdown generator's descriptions and the changelog commit reader/formatter, and cap generated headings at h6 (VitePress dropped the literal #######).
 ### Chores
 #### Changelog
-- Repair escaped commit text and label code refs ([#1425419](https://github.com/deltabox-studio/toolchain/issues/1425419) by [T0chi](https://github.com/T0chi))
+- Repair escaped commit text and label code refs ([#1425419](https://github.com/deltabox-studio/toolchain/commit/1425419) by [T0chi](https://github.com/T0chi))
   - PowerShell interpreted the escaped backticks in the commit bodies as control-character escapes, so the changelog carried backslash+control artifacts (TAB/CR/LF/BS/FF/VT) and mojibake. Repair the affected 1.4.1-1.6.1 entries and add backticks around commands, paths, flags, types and identifiers throughout the file.
 
 ## 1.6.1 (October 2026)
@@ -844,7 +743,7 @@
 
 ### New features
 #### Changelog
-- Emit the husky `commit-msg` hook for consumers ([#6898386](https://github.com/deltabox-studio/toolchain/issues/6898386) by [T0chi](https://github.com/T0chi))
+- Emit the husky `commit-msg` hook for consumers ([#6898386](https://github.com/deltabox-studio/toolchain/commit/6898386) by [T0chi](https://github.com/T0chi))
   - `dbx sync` now writes `.husky/commit-msg` (running `commitlint`) alongside the workflows and `commitlint.config.mjs`, so consumers using the Conventional-Commits CI lint commits locally too. The docs recommend `postinstall: husky` (Yarn Berry never runs `prepare`) and `.husky/* text eol=lf` (a trailing CR breaks the hook).
 
 ## 1.4.1 (October 2026)
@@ -861,63 +760,46 @@
 
 ### New features
 - Render the `dbx` CLI with `clack`, author the Vite+ config in `dbx.config` ([#fb8b9ef](https://github.com/deltabox-studio/toolchain/commit/fb8b9ef) by [T0chi](https://github.com/T0chi))
-  - `vite.config.ts` in and adds the `fmt` ignore; `dbx` resolves its own binary first
-    and colour `Commander`'s help
+  - resolveVite() + a generated vite.config.ts shim (no drift); dbx migrate folds vite.config.ts in and adds the fmt ignore; dbx resolves its own binary first
+  - render dbx output with @clack/prompts (logger, intro/outro, create prompts) and colour Commander's help
+  - fix the Toolchain* typecheck errors and stale tsdown rename leftovers
+  - add a dist bootstrap so the generated shim resolves on a fresh checkout
 #### Vscode
 - Add Providers and Templates views ([#9aa6d12](https://github.com/deltabox-studio/toolchain/commit/9aa6d12) by [T0chi](https://github.com/T0chi))
-  - `add`/`remove`/`run-command`/`open-homepage`/`copy-id` actions
-    `toolchainProviders()`, so a registered provider's commands become `dbx` commands
-    Templates -> Managed Files
+  - Providers: lists providers (dbx providers --json + a custom registry) with add/remove/run-command/open-homepage/copy-id actions
+  - Templates: lists templates with add/remove-source/create/info actions
+  - custom provider registry (.dbx/toolchain/providers.json) merged into toolchainProviders(), so a registered provider's commands become dbx commands
+  - viewsWelcome empty states; view order Home -> Providers -> Projects -> Templates -> Managed Files
 #### Vite
 - Drive `dbx` from the `dbx()` plugin, drop `defineDbxConfig` ([#8d11557](https://github.com/deltabox-studio/toolchain/commit/8d11557) by [T0chi](https://github.com/T0chi))
-  - The Vite/Vite+ integration is now the `dbx()` plugin plus spreading `DBX_TASKS` into
-    `run.tasks`, so the consumer's own `vite` config stays the config:
-  - `export default defineConfig({`
-    `plugins: [dbx()],`
-    `run: { tasks: { ...DBX_TASKS } },`
-    `});`
-  - Remove the `defineDbxConfig` wrapper (and `DbxViteConfig`) and update the README, the
-    Providers guide and the API reference.
-- Author the Vite+ config in `dbx.config`, generate `vite.config.ts` ([#9885225](https://github.com/deltabox-studio/toolchain/issues/9885225) by [T0chi](https://github.com/T0chi))
-  - `toolchain.vite` now holds the whole Vite+ config (a loose object) with a
-    `config: false` opt-out, and `dbx sync` generates the managed root
-    `vite.config.ts` from it, so `dbx.config.*` is the only hand-authored root config.
-  - Add `dbx migrate --from vite` (auto-detected): it extracts the object passed to
-    `defineConfig` in an existing root `vite.config.ts` and folds it into `dbx.config.*`'s
-    `toolchain.vite`, refusing configs it cannot migrate faithfully.
+  - The Vite/Vite+ integration is now the `dbx()` plugin plus spreading `DBX_TASKS` into `run.tasks`, so the consumer's own `vite` config stays the config:
+  - `export default defineConfig({` `plugins: [dbx()],` `run: { tasks: { ...DBX_TASKS } },` `});`
+  - Remove the `defineDbxConfig` wrapper (and `DbxViteConfig`) and update the README, the Providers guide and the API reference.
+- Author the Vite+ config in `dbx.config`, generate `vite.config.ts` ([#9885225](https://github.com/deltabox-studio/toolchain/commit/9885225) by [T0chi](https://github.com/T0chi))
+  - `toolchain.vite` now holds the whole Vite+ config (a loose object) with a `config: false` opt-out, and `dbx sync` generates the managed root `vite.config.ts` from it, so `dbx.config.*` is the only hand-authored root config.
+  - Add `dbx migrate --from vite` (auto-detected): it extracts the object passed to `defineConfig` in an existing root `vite.config.ts` and folds it into `dbx.config.*`'s `toolchain.vite`, refusing configs it cannot migrate faithfully.
   - The config-types generator now honors `.catchall`, emitting an index signature.
 #### Config
 - Expose the Vite+ config type, rename `Tooling*` to `Toolchain*` ([#088de56](https://github.com/deltabox-studio/toolchain/commit/088de56) by [T0chi](https://github.com/T0chi))
-  - `ToolchainViteConfig` is now Vite+ `ViteUserConfig` intersected with the managed
-    `config?: boolean` opt-out, instead of a generated loose object. The config-types
-    generator gains a hand-written type override plus an imports block, used for the
-    vite type, and `vite-plus` becomes an optional peer dependency.
-  - Rename every `Tooling*` type, schema id and identifier to `Toolchain*`. That covers
-    the config schema ids, `CONFIG_TYPE_SCHEMAS` keys, the provider/migration models
-    and the CLI helpers (`toolchainConfigSchema`, `loadToolchainConfig`,
-    `toolchainProviders`, `registerToolchainCommands`). Regenerated types/schema/docs.
+  - `ToolchainViteConfig` is now Vite+ `ViteUserConfig` intersected with the managed `config?: boolean` opt-out, instead of a generated loose object. The config-types generator gains a hand-written type override plus an imports block, used for the vite type, and `vite-plus` becomes an optional peer dependency.
+  - Rename every `Tooling*` type, schema id and identifier to `Toolchain*`. That covers the config schema ids, `CONFIG_TYPE_SCHEMAS` keys, the provider/migration models and the CLI helpers (`toolchainConfigSchema`, `loadToolchainConfig`, `toolchainProviders`, `registerToolchainCommands`). Regenerated types/schema/docs.
 ### Bug fixes
 #### Deps
 - Sync the lockfile for `@clack/prompts` ([#568a7c6](https://github.com/deltabox-studio/toolchain/commit/568a7c6) by [T0chi](https://github.com/T0chi))
-  - The lockfile was missing the `@clack/prompts` entry for `packages/shared` and
-    `packages/template`, so `yarn install --immutable` failed in CI (YN0028).
+  - The lockfile was missing the `@clack/prompts` entry for `packages/shared` and `packages/template`, so `yarn install --immutable` failed in CI (YN0028).
 ### Refactors
 - Rename Ox to Oxc across the project ([#39b37d3](https://github.com/deltabox-studio/toolchain/commit/39b37d3) by [T0chi](https://github.com/T0chi))
-  - (`Oxfmt`/`Oxlint` and `.oxlintrc`/`.oxfmtrc` are unchanged)
+  - migrate: the target tool value is 'oxc' and the ids are *-to-oxc (Oxfmt/Oxlint and .oxlintrc/.oxfmtrc are unchanged)
+  - docs + README prose
 ### Documentation
 - Cover the clack CLI output, prompts and `dbx` binary resolution ([#f45ed3f](https://github.com/deltabox-studio/toolchain/commit/f45ed3f) by [T0chi](https://github.com/T0chi))
 - Document the Vite+ config type and the `Toolchain*` names ([#1e70950](https://github.com/deltabox-studio/toolchain/commit/1e70950) by [T0chi](https://github.com/T0chi))
-  - Note that `toolchain.vite` is typed as Vite's `UserConfig` as augmented by Vite+
-    (`ToolchainViteConfig`), and list `ToolchainViteConfig` among the shared config
-    types. Covers the unreleased changes since v1.3.1 together with the sections the
-    feature commits already added (the Vite+ config in `dbx.config`, the generated
-    `vite.config.ts`, the vite migration and the `dbx` plugin).
+  - Note that `toolchain.vite` is typed as Vite's `UserConfig` as augmented by Vite+ (`ToolchainViteConfig`), and list `ToolchainViteConfig` among the shared config types. Covers the unreleased changes since v1.3.1 together with the sections the feature commits already added (the Vite+ config in `dbx.config`, the generated `vite.config.ts`, the vite migration and the `dbx` plugin).
 #### Vscode
 - Refresh the extension screenshot and add its `LICENSE` ([#49d4510](https://github.com/deltabox-studio/toolchain/commit/49d4510) by [T0chi](https://github.com/T0chi))
 ### Build system
 - Package the VS Code extension in `yarn build` ([#1dd14a1](https://github.com/deltabox-studio/toolchain/commit/1dd14a1) by [T0chi](https://github.com/T0chi))
-  - `yarn build` now also runs the vscode `package:vsix`, so `deltabox-toolchain.vsix`
-    is always produced.
+  - `yarn build` now also runs the vscode `package:vsix`, so `deltabox-toolchain.vsix` is always produced.
 
 ### Package changes
 #### Added
@@ -937,72 +819,46 @@
 ### New features
 #### Core
 - Keep the generated `.dbx` directory out of git ([#9fc1434](https://github.com/deltabox-studio/toolchain/commit/9fc1434) by [T0chi](https://github.com/T0chi))
-  - `dbx sync` now appends the `.dbx` ignore block (everything under `.dbx/` except the
-    manifest, which holds no absolute paths) to an existing `.gitignore`, and the
-    installation guide documents the pattern and the automatic step.
+  - `dbx sync` now appends the `.dbx` ignore block (everything under `.dbx/` except the manifest, which holds no absolute paths) to an existing `.gitignore`, and the installation guide documents the pattern and the automatic step.
 #### Cli
 - Route CLI output through the logger, add a providers colour option ([#ce76a4d](https://github.com/deltabox-studio/toolchain/commit/ce76a4d) by [T0chi](https://github.com/T0chi))
-  - `Commander`'s help and errors now go through the shared logger (help to stdout,
-    errors to stderr, colour-aware, ANSI stripped when colour is off). Vite+
-    passthrough commands keep `commander`'s defaults so the spawned `vp` keeps its own
-    coloured logging.
-  - Add a `providers` config section (`color?: boolean`): `color: false` forces plain
-    provider output, the global `--no-color` still turns it off, and `runVp` sets
-    `NO_COLOR` / `FORCE_COLOR` on the child when colour is disabled.
+  - `Commander`'s help and errors now go through the shared logger (help to stdout, errors to stderr, colour-aware, ANSI stripped when colour is off). Vite+ passthrough commands keep `commander`'s defaults so the spawned `vp` keeps its own coloured logging.
+  - Add a `providers` config section (`color?: boolean`): `color: false` forces plain provider output, the global `--no-color` still turns it off, and `runVp` sets `NO_COLOR` / `FORCE_COLOR` on the child when colour is disabled.
 - Check for a newer `dbx` version ([#772aae2](https://github.com/deltabox-studio/toolchain/commit/772aae2) by [T0chi](https://github.com/T0chi))
-  - On each run, check the npm registry in the background (cached for a day, never
-    blocking) and print a short notice with a link to the release when a newer
-    `@deltabox/toolchain` exists. Skipped in CI and by `NO_UPDATE_NOTIFIER` or
-    `DBX_NO_UPDATE_CHECK`, and can be turned off with the new `--no-update-check` flag.
+  - On each run, check the npm registry in the background (cached for a day, never blocking) and print a short notice with a link to the release when a newer `@deltabox/toolchain` exists. Skipped in CI and by `NO_UPDATE_NOTIFIER` or `DBX_NO_UPDATE_CHECK`, and can be turned off with the new `--no-update-check` flag.
 - Default a bare Vite+ command to the `vite` passthrough ([#75770e4](https://github.com/deltabox-studio/toolchain/commit/75770e4) by [T0chi](https://github.com/T0chi))
-  - `dbx fmt` / `dbx lint` / `dbx run` / `dbx dev` now work: when the first operand
-    is not a built-in command but names a Vite+ subcommand (or one of its aliases),
-    `vite` is inserted before it and the whole Vite+ CLI stays reachable without the
-    explicit namespace. Built-in commands win, so `dbx migrate` remains the
-    toolchain's migration (`dbx vite migrate` is Vite+'s).
-  - The Package scripts, Migrations, Monorepo, CLI and Providers guides now show the
-    bare form, and the consumers' root scripts were updated to match.
+  - `dbx fmt` / `dbx lint` / `dbx run` / `dbx dev` now work: when the first operand is not a built-in command but names a Vite+ subcommand (or one of its aliases), `vite` is inserted before it and the whole Vite+ CLI stays reachable without the explicit namespace. Built-in commands win, so `dbx migrate` remains the toolchain's migration (`dbx vite migrate` is Vite+'s).
+  - The Package scripts, Migrations, Monorepo, CLI and Providers guides now show the bare form, and the consumers' root scripts were updated to match.
 #### Vscode
 - Bundle the `dbx` CLI into the extension ([#bf12403](https://github.com/deltabox-studio/toolchain/commit/bf12403) by [T0chi](https://github.com/T0chi))
-  - Ship a self-contained `dbx.cjs` inside the VSIX (built by the new
-    `tsdown.bin.config.ts`) and prefer it in the extension, so a consumer no longer
-    needs to install `@deltabox/toolchain`. It falls back to a workspace-local
-    install and then `npx`.
-  - Make the changelog and tsconfig direct-run guards basename-aware so they do not
-    fire when the module is inlined into the single-file bundle.
+  - Ship a self-contained `dbx.cjs` inside the VSIX (built by the new `tsdown.bin.config.ts`) and prefer it in the extension, so a consumer no longer needs to install `@deltabox/toolchain`. It falls back to a workspace-local install and then `npx`.
+  - Make the changelog and tsconfig direct-run guards basename-aware so they do not fire when the module is inlined into the single-file bundle.
 #### Shared
 - Add a configurable shared logger ([#54b51fa](https://github.com/deltabox-studio/toolchain/commit/54b51fa) by [T0chi](https://github.com/T0chi))
-  - Add `packages/shared/src/logger.ts`: one level-aware, colour-aware sink (colours
-    via `picocolors`, the same package Vite uses) with `debug`, `info`, `success`, `warn`,
-    `error` and `raw` (unprefixed machine output). It is configurable from `dbx.config`'s
-    new `logger` section and from the CLI (`--log-level`, `--no-color`), with the CLI
-    taking precedence.
-  - Every `console` call in the toolchain now goes through the logger (JSON output
-    through `raw`), including the sync/watch log callback and the `run` helper's
-    verbose line. The generated config types, the JSON schema, the docs reference
-    and the Configuration/CLI guides document the new `logger` section.
+  - Add `packages/shared/src/logger.ts`: one level-aware, colour-aware sink (colours via `picocolors`, the same package Vite uses) with `debug`, `info`, `success`, `warn`, `error` and `raw` (unprefixed machine output). It is configurable from `dbx.config`'s new `logger` section and from the CLI (`--log-level`, `--no-color`), with the CLI taking precedence.
+  - Every `console` call in the toolchain now goes through the logger (JSON output through `raw`), including the sync/watch log callback and the `run` helper's verbose line. The generated config types, the JSON schema, the docs reference and the Configuration/CLI guides document the new `logger` section.
 ### Bug fixes
 - Correct tsconfig aliases under `--cwd`, prune self-referential task runs ([#40e0c34](https://github.com/deltabox-studio/toolchain/commit/40e0c34) by [T0chi](https://github.com/T0chi))
   - Two bugs found by exercising the CLI against the local consumer projects:
-  - instead of `process.cwd()`, so `dbx sync --cwd <dir>` (run from elsewhere)
-    writes correct relative paths rather than paths pointing at the caller.
-    spawning the task runner, and prunes itself when the same command runs again
-    from the same root. A root task whose script calls `run -r <task>` can no
-    longer recurse.
+  - tsconfig: monorepo path aliases are now resolved against the project root instead of process.cwd(), so `dbx sync --cwd <dir>` (run from elsewhere) writes correct relative paths rather than paths pointing at the caller.
+  - run: a `run` command records its root and operands in an env marker before spawning the task runner, and prunes itself when the same command runs again from the same root. A root task whose script calls `run -r <task>` can no longer recurse.
 - Changelog links, oxfmt map, build idempotency, watch timer, vscode spawn ([#2389c98](https://github.com/deltabox-studio/toolchain/commit/2389c98) by [T0chi](https://github.com/T0chi))
-  - render commits as a plain short hash instead of a `github.com/undefined` link
-    `yarn build` no longer rewrites it and the working tree stays idempotent
-    `spawnCli` and `cliInvocation`
+  - changelog: with no GitHub remote (and a non-GitHub package.json repository), render commits as a plain short hash instead of a github.com/undefined link
+  - migrate: read javascript.formatter.jsxQuoteStyle so it is reported unmapped
+  - set the changelog and tsconfig package.json bin to the object form, so `yarn build` no longer rewrites it and the working tree stays idempotent
+  - core watch: clear the pending debounce timer on SIGINT/SIGTERM
+  - vscode: document the ELECTRON_RUN_AS_NODE mechanism consistently between spawnCli and cliInvocation
 - Sync `--check` writes, quiet level, log flags and template tokens ([#7f5690f](https://github.com/deltabox-studio/toolchain/commit/7f5690f) by [T0chi](https://github.com/T0chi))
   - Audit pass over the toolchain source:
-  - actually generated by `dbx sync`
+  - include the vite sync task in defaultSyncTasks, so a `vite` config section is actually generated by dbx sync
+  - stop dbx sync --check from writing the project graph (it must not write)
+  - make --quiet hide info/debug/warn but still show errors
+  - stop the logger flag pre-scan at `--`, and reject inherited level keys
+  - strip a UTF-8 BOM from a JSON dbx.config
+  - let explicit --name/--scope win over dbx.config project values in dbx create
 ### Documentation
 - Document the full public API surface ([#6f78245](https://github.com/deltabox-studio/toolchain/commit/6f78245) by [T0chi](https://github.com/T0chi))
-  - Expand `guide/api.md` to cover the umbrella plus every subpath export, grouped by
-    package. Add the logging API (`logger`, `createLogger`, `setLogConfig`,
-    `setLogOverrides`, levels, colours, `raw`) to the API and Configuration guides, and
-    document the config generator's `formatGenerated` helper and the Vite and CLI
-    programmatic helpers.
+  - Expand `guide/api.md` to cover the umbrella plus every subpath export, grouped by package. Add the logging API (`logger`, `createLogger`, `setLogConfig`, `setLogOverrides`, levels, colours, `raw`) to the API and Configuration guides, and document the config generator's `formatGenerated` helper and the Vite and CLI programmatic helpers.
 ### Chores
 - Track only the `.dbx` manifest ([#a254062](https://github.com/deltabox-studio/toolchain/commit/a254062) by [T0chi](https://github.com/T0chi))
   - Ignore everything under `.dbx/` except `.dbx/toolchain/manifest.json`, which records the managed files and holds no absolute paths. The project graph (which embeds the absolute root) stays ignored.
@@ -1017,50 +873,31 @@
 
 ### Documentation
 - Drive Vite+ from `dbx` in the recommended package scripts ([#6131c59](https://github.com/deltabox-studio/toolchain/commit/6131c59) by [T0chi](https://github.com/T0chi))
-  - Use `dbx vite <command>` (the Vite+ passthrough) instead of calling `vp`
-    directly in the Package scripts, Migrations and Monorepo guides, so a project
-    only needs the one `dbx` command.
+  - Use `dbx vite <command>` (the Vite+ passthrough) instead of calling `vp` directly in the Package scripts, Migrations and Monorepo guides, so a project only needs the one `dbx` command.
 
 ## 1.2.7 (October 2026)
 
 ### Documentation
 - Link package script migrations from the Migrations page ([#036ebf5](https://github.com/deltabox-studio/toolchain/commit/036ebf5) by [T0chi](https://github.com/T0chi))
-  - Add a "Package scripts" section to the Migrations guide with the Biome/Turbo
-    script swaps and a link to the full Package scripts page.
+  - Add a "Package scripts" section to the Migrations guide with the Biome/Turbo script swaps and a link to the full Package scripts page.
 
 ## 1.2.6 (October 2026)
 
 ### Bug fixes
 #### Config
 - Tidy generated types and format them with Oxfmt ([#6fef440](https://github.com/deltabox-studio/toolchain/commit/6fef440) by [T0chi](https://github.com/T0chi))
-  - `untyped`'s type generator emits a blank line between every member and verbose
-    multi-line JSDoc. Strip the member blank lines in the generator, then run the
-    generated output through Oxfmt's programmatic `format()` (with `jsdoc: true`)
-    at generation time instead of shelling out to the repo-root `vp`, so the file
-    is written already formatted and resembles the hand-written `types.ts`.
-  - Also drop the toolchain-specific `yarn config:types` hint from the generated
-    header: the types ship through `@deltabox/toolchain-shared`, so a script name
-    that only exists in this repo's `package.json` is misleading to consumers (a
-    consumer supplies its own header via the `header` option).
+  - `untyped`'s type generator emits a blank line between every member and verbose multi-line JSDoc. Strip the member blank lines in the generator, then run the generated output through Oxfmt's programmatic `format()` (with `jsdoc: true`) at generation time instead of shelling out to the repo-root `vp`, so the file is written already formatted and resembles the hand-written `types.ts`.
+  - Also drop the toolchain-specific `yarn config:types` hint from the generated header: the types ship through `@deltabox/toolchain-shared`, so a script name that only exists in this repo's `package.json` is misleading to consumers (a consumer supplies its own header via the `header` option).
 ### Documentation
 - Add Package scripts guide and a navbar version ([#b279739](https://github.com/deltabox-studio/toolchain/commit/b279739) by [T0chi](https://github.com/T0chi))
-  - Add a guide page covering the recommended root scripts (Vite+ format/lint and
-    Vite Task) and how to migrate an existing Biome + Turbo project onto them, and
-    surface it in the sidebar and Getting Started list. Also show the current
-    version in the navbar (linked to the changelog, releases and npm), like the
-    Proxified docs.
+  - Add a guide page covering the recommended root scripts (Vite+ format/lint and Vite Task) and how to migrate an existing Biome + Turbo project onto them, and surface it in the sidebar and Getting Started list. Also show the current version in the navbar (linked to the changelog, releases and npm), like the Proxified docs.
 
 ## 1.2.5 (October 2026)
 
 ### Bug fixes
 #### Changelog
 - Keep generated commitlint enums expanded ([#a6ad600](https://github.com/deltabox-studio/toolchain/commit/a6ad600) by [T0chi](https://github.com/T0chi))
-  - Oxfmt collapses an array onto one line when it fits the print width, so a
-    generated `commitlint.config.mjs` whose type/scope enum is short was
-    reformatted by `vp fmt` and then failed `dbx sync --check`. An inert leading
-    line comment inside each enum keeps the list expanded regardless of the
-    consumer's print width, so the generated file is now Oxfmt-idempotent and
-    consumers no longer need to exclude it from formatting.
+  - Oxfmt collapses an array onto one line when it fits the print width, so a generated `commitlint.config.mjs` whose type/scope enum is short was reformatted by `vp fmt` and then failed `dbx sync --check`. An inert leading line comment inside each enum keeps the list expanded regardless of the consumer's print width, so the generated file is now Oxfmt-idempotent and consumers no longer need to exclude it from formatting.
 
 ## 1.2.4 (October 2026)
 
@@ -1081,9 +918,7 @@
 
 ### Documentation
 - Show how to load the generated config ([#0f4d0d1](https://github.com/deltabox-studio/toolchain/commit/0f4d0d1) by [T0chi](https://github.com/T0chi))
-  - Add a "Load the config at runtime" section to the config generator guide
-    (`parseEnvTree`, the typed accessors, `applyOverrides`, and schema validation via
-    `compileZodSchema`) plus a short loading example in the README.
+  - Add a "Load the config at runtime" section to the config generator guide (`parseEnvTree`, the typed accessors, `applyOverrides`, and schema validation via `compileZodSchema`) plus a short loading example in the README.
 - Update description and tags ([#64b64aa](https://github.com/deltabox-studio/toolchain/commit/64b64aa) by [T0chi](https://github.com/T0chi))
 
 ## 1.2.0 (October 2026)
@@ -1091,25 +926,15 @@
 ### New features
 #### Config
 - Generate the shared config types via the config generator ([#a063a2d](https://github.com/deltabox-studio/toolchain/commit/a063a2d) by [T0chi](https://github.com/T0chi))
-  - Teach the config engine's Zod->untyped bridge and types generator to handle
-    unions (`anyOf`/`oneOf`), `const`, and unknown records, and to render a schema's
-    fields on the main interface when it has no `base` group (plus type aliases for
-    non-object roots). Named `$ref`s (via `.meta({ id })`) render as the type name,
-    so the generated config types reference each other instead of inlining.
-  - Generate `packages/shared/src/config-types.ts` from the Zod config model with the
-    engine's `renderConfigTypes` (`yarn config:types`); `config-schema.ts` keeps only
-    the schemas and the types are exported from `config-types.ts`.
+  - Teach the config engine's Zod->untyped bridge and types generator to handle unions (`anyOf`/`oneOf`), `const`, and unknown records, and to render a schema's fields on the main interface when it has no `base` group (plus type aliases for non-object roots). Named `$ref`s (via `.meta({ id })`) render as the type name, so the generated config types reference each other instead of inlining.
+  - Generate `packages/shared/src/config-types.ts` from the Zod config model with the engine's `renderConfigTypes` (`yarn config:types`); `config-schema.ts` keeps only the schemas and the types are exported from `config-types.ts`.
 ### Bug fixes
 #### Vscode
 - Group managed files by project and reorder the views ([#f5b49d9](https://github.com/deltabox-studio/toolchain/commit/f5b49d9) by [T0chi](https://github.com/T0chi))
-  - The Managed Files view read a manifest per project, so a monorepo's root-level
-    managed files never showed. Read each workspace root's manifest and group its
-    files by the deepest project that owns them. Move the Projects view above
-    Managed Files (renamed from Files).
+  - The Managed Files view read a manifest per project, so a monorepo's root-level managed files never showed. Read each workspace root's manifest and group its files by the deepest project that owns them. Move the Projects view above Managed Files (renamed from Files).
 ### Documentation
 - Document the config generator outputs ([#fcfcd69](https://github.com/deltabox-studio/toolchain/commit/fcfcd69) by [T0chi](https://github.com/T0chi))
-  - Show a short example of each generated output (config types, markdown, env,
-    JSON schema) in the config generator guide and the README.
+  - Show a short example of each generated output (config types, markdown, env, JSON schema) in the config generator guide and the README.
 - Update vscode extension preview ([#fd90dda](https://github.com/deltabox-studio/toolchain/commit/fd90dda) by [T0chi](https://github.com/T0chi))
 
 ## 1.1.24 (October 2026)
@@ -1127,9 +952,7 @@
 ### Bug fixes
 #### Ci
 - Skip the Marketplace publish when `VSCE_PAT` is unset ([#fe4b3ad](https://github.com/deltabox-studio/toolchain/commit/fe4b3ad) by [T0chi](https://github.com/T0chi))
-  - The VS Code Marketplace publish was the only failing release step (no
-    `VSCE_PAT` set). Make it a no-op while the secret is unset and publish
-    automatically once it is added to the `toolchain / release` environment.
+  - The VS Code Marketplace publish was the only failing release step (no `VSCE_PAT` set). Make it a no-op while the secret is unset and publish automatically once it is added to the `toolchain / release` environment.
   - Also remove the temporary OIDC diagnostic step now that the release publishes.
 
 ## 1.1.21 (October 2026)
@@ -1137,72 +960,43 @@
 ### Bug fixes
 #### Ci
 - Publish to npm directly, falling back to a staged publish ([#85cffe7](https://github.com/deltabox-studio/toolchain/commit/85cffe7) by [T0chi](https://github.com/T0chi))
-  - Try `npm publish` first and fall back to `npm stage publish` on failure, so
-    toggling the trusted publisher's publish/stage permissions on npm never breaks
-    the release: a direct publish succeeds when allowed, and a staged publish (always
-    permitted) is used otherwise.
+  - Try `npm publish` first and fall back to `npm stage publish` on failure, so toggling the trusted publisher's publish/stage permissions on npm never breaks the release: a direct publish succeeds when allowed, and a staged publish (always permitted) is used otherwise.
 ### Documentation
 - Show the published npm version in the README badge ([#5f83ca2](https://github.com/deltabox-studio/toolchain/commit/5f83ca2) by [T0chi](https://github.com/T0chi))
-  - Replace the static npm-name badge with a shields.io npm/v badge so the README
-    shows the currently published version.
+  - Replace the static npm-name badge with a shields.io npm/v badge so the README shows the currently published version.
 
 ## 1.1.20 (October 2026)
 
 ### Bug fixes
 #### Ci
 - Stage npm releases via OIDC instead of publishing directly ([#53d1f52](https://github.com/deltabox-studio/toolchain/commit/53d1f52) by [T0chi](https://github.com/T0chi))
-  - Default to `npm stage publish` for OIDC trusted publishing: it always stages
-    the version and defers the maintainer's 2FA approval, and is always permitted
-    for a trusted publisher (unlike direct `npm publish`, which the package's 2FA
-    policy rejects). Drop the automation-token fallback and require npm >= 11.15.1
-    (the first with `npm stage`).
+  - Default to `npm stage publish` for OIDC trusted publishing: it always stages the version and defers the maintainer's 2FA approval, and is always permitted for a trusted publisher (unlike direct `npm publish`, which the package's 2FA policy rejects). Drop the automation-token fallback and require npm >= 11.15.1 (the first with `npm stage`).
 
 ## 1.1.19 (October 2026)
 
 ### Chores
 #### Ci
 - Add a temporary OIDC diagnostic to the release workflow ([#7b42e33](https://github.com/deltabox-studio/toolchain/commit/7b42e33) by [T0chi](https://github.com/T0chi))
-  - The publish still fails after binding the environment, and npm falls back to
-    the (automation) token and 403s. Add a temporary step that decodes the OIDC
-    claims and calls the token-exchange endpoint directly so the exact
-    trusted-publisher mismatch is visible in the log. Removed once fixed.
+  - The publish still fails after binding the environment, and npm falls back to the (automation) token and 403s. Add a temporary step that decodes the OIDC claims and calls the token-exchange endpoint directly so the exact trusted-publisher mismatch is visible in the log. Removed once fixed.
 
 ## 1.1.18 (October 2026)
 
 ### Bug fixes
 #### Ci
 - Bind the release job to the OIDC environment ([#7b8f1b4](https://github.com/deltabox-studio/toolchain/commit/7b8f1b4) by [T0chi](https://github.com/T0chi))
-  - The npm OIDC trusted publisher is bound to the GitHub environment
-    "toolchain / release", but the release job declared no environment. The OIDC
-    environment claim therefore did not match, the token exchange failed, and npm
-    silently fell back to the placeholder token (the misleading E404).
-  - Declare `environment: 'toolchain / release'` on the job and add an optional
-    `NODE_AUTH_TOKEN` fallback (the environment's `NPM_TOKEN`) to the publish step.
-    OIDC is still tried first, so the token is never relied on.
+  - The npm OIDC trusted publisher is bound to the GitHub environment "toolchain / release", but the release job declared no environment. The OIDC environment claim therefore did not match, the token exchange failed, and npm silently fell back to the placeholder token (the misleading E404).
+  - Declare `environment: 'toolchain / release'` on the job and add an optional `NODE_AUTH_TOKEN` fallback (the environment's `NPM_TOKEN`) to the publish step. OIDC is still tried first, so the token is never relied on.
 #### Vscode
 - Spawn the CLI safely on Windows ([#99e3ad1](https://github.com/deltabox-studio/toolchain/commit/99e3ad1) by [T0chi](https://github.com/T0chi))
-  - `spawn('npx.cmd', ...)` throws EINVAL synchronously on Windows, and
-    `captureCli`/`runCli` call spawn inside a Promise executor, so the throw
-    rejected the promise and the command aborted with no UI ("nothing happens").
-    This fired whenever the CLI resolved to the `npx.cmd` fallback (a workspace
-    without a local `@deltabox/toolchain`), e.g. "From template..." which round-trips
-    `template:list --json` through `captureCli`.
-  - Add a pure `win-spawn` module (ported from the shared `spawnCross`) that escapes
-    the command + args and runs a `.cmd` shim through `cmd.exe`; use it from `spawnCli`.
-    `captureCli`/`runCli` no longer reject on a spawn failure. Also fix `cliInvocation`
-    for the integrated terminal: `process.execPath` is the VS Code binary in the
-    extension host, so it now uses `npx dbx` / `npx --yes @deltabox/toolchain`.
+  - `spawn('npx.cmd', ...)` throws EINVAL synchronously on Windows, and `captureCli`/`runCli` call spawn inside a Promise executor, so the throw rejected the promise and the command aborted with no UI ("nothing happens"). This fired whenever the CLI resolved to the `npx.cmd` fallback (a workspace without a local `@deltabox/toolchain`), e.g. "From template..." which round-trips `template:list --json` through `captureCli`.
+  - Add a pure `win-spawn` module (ported from the shared `spawnCross`) that escapes the command + args and runs a `.cmd` shim through `cmd.exe`; use it from `spawnCli`. `captureCli`/`runCli` no longer reject on a spawn failure. Also fix `cliInvocation` for the integrated terminal: `process.execPath` is the VS Code binary in the extension host, so it now uses `npx dbx` / `npx --yes @deltabox/toolchain`.
 
 ## 1.1.17 (October 2026)
 
 ### Bug fixes
 #### Ci
 - Upgrade npm before publishing for OIDC trusted publishing ([#657d4b9](https://github.com/deltabox-studio/toolchain/commit/657d4b9) by [T0chi](https://github.com/T0chi))
-  - Node 22 bundles npm 10.x, but npm OIDC trusted publishing requires
-    npm >= 11.5.1. Without it `npm publish` fell back to token auth and the
-    registry answered a misleading 404, so every release since 1.0.7 failed
-    at the publish step. Add an explicit npm upgrade step before the publish
-    step in the generated release workflow.
+  - Node 22 bundles npm 10.x, but npm OIDC trusted publishing requires npm >= 11.5.1. Without it `npm publish` fell back to token auth and the registry answered a misleading 404, so every release since 1.0.7 failed at the publish step. Add an explicit npm upgrade step before the publish step in the generated release workflow.
 
 ## 1.1.16 (October 2026)
 
@@ -1218,7 +1012,7 @@
 ## 1.1.14 (October 2026)
 
 ### Documentation
-- Highlight the Vite/Vite+ plugin in the README and docs ([#8218179](https://github.com/deltabox-studio/toolchain/issues/8218179) by [T0chi](https://github.com/T0chi))
+- Highlight the Vite/Vite+ plugin in the README and docs ([#8218179](https://github.com/deltabox-studio/toolchain/commit/8218179) by [T0chi](https://github.com/T0chi))
 
 ## 1.1.13 (October 2026)
 
@@ -1249,7 +1043,7 @@
 
 ### Documentation
 - Reindent the README lists ([#1d41d68](https://github.com/deltabox-studio/toolchain/commit/1d41d68) by [T0chi](https://github.com/T0chi))
-- Mirror the VS Code extension installation guide from the README ([#1889832](https://github.com/deltabox-studio/toolchain/issues/1889832) by [T0chi](https://github.com/T0chi))
+- Mirror the VS Code extension installation guide from the README ([#1889832](https://github.com/deltabox-studio/toolchain/commit/1889832) by [T0chi](https://github.com/T0chi))
 ### Chores
 - Update VS Code extension installation guide in `README.md` ([#aab06d5](https://github.com/deltabox-studio/toolchain/commit/aab06d5) by [T0chi](https://github.com/T0chi))
 
@@ -1298,18 +1092,14 @@
 ### Documentation
 
 - Publish `config.schema.json` at the docs site root ([#b7680cb](https://github.com/deltabox-studio/toolchain/commit/b7680cb) by [T0chi](https://github.com/T0chi))
-    - The VitePress build now copies the generated `dbx` JSON schema into the dist
-      root, so it is served at https://toolchain.deltabox.studio/config.schema.json.
+  - - The VitePress build now copies the generated `dbx` JSON schema into the dist root, so it is served at https://toolchain.deltabox.studio/config.schema.json.
 
 ### CI
 
 #### Release
 
 - Publish to npm via trusted publishing (OIDC) ([#41be869](https://github.com/deltabox-studio/toolchain/commit/41be869) by [T0chi](https://github.com/T0chi))
-    - Drop the `NPM_TOKEN`-based `yarn npm publish` (which also staged). Use npm
-      trusted publishing: `id-token: write`, setup-node `registry-url`, `yarn pack`
-      (resolves `catalog:`/`workspace:`) + `npm publish <tarball>` — provenance is
-      generated automatically. Re-enable `publishConfig.provenance`.
+  - - Drop the `NPM_TOKEN`-based `yarn npm publish` (which also staged). Use npm trusted publishing: `id-token: write`, setup-node `registry-url`, `yarn pack` (resolves `catalog:`/`workspace:`) + `npm publish <tarball>` — provenance is generated automatically. Re-enable `publishConfig.provenance`.
 
 ## 1.1.0 (October 2026)
 
@@ -1318,10 +1108,7 @@
 #### Vite
 
 - Add a `dbx()` Vite+ plugin and `defineDbxConfig` wrapper ([#a1edaf9](https://github.com/deltabox-studio/toolchain/commit/a1edaf9) by [T0chi](https://github.com/T0chi))
-    - Lets Vite+-only consumers drive `dbx` from `vite.config.ts`: `dbx()` runs
-      `dbx sync` before dev/build (or `dbx sync --check` in CI) and re-syncs on
-      input changes; `defineDbxConfig()` also registers the `vp run dbx:*` tasks
-      (Vite+ reads `run.tasks` from the static config, not a plugin hook).
+  - - Lets Vite+-only consumers drive `dbx` from `vite.config.ts`: `dbx()` runs `dbx sync` before dev/build (or `dbx sync --check` in CI) and re-syncs on input changes; `defineDbxConfig()` also registers the `vp run dbx:*` tasks (Vite+ reads `run.tasks` from the static config, not a plugin hook).
 
 ### Chores
 
@@ -1340,10 +1127,7 @@
 #### Release
 
 - Manage the release workflow from `dbx.config.ts` ([#bf55b70](https://github.com/deltabox-studio/toolchain/commit/bf55b70) by [T0chi](https://github.com/T0chi))
-    - Drop the hand-written `.github/workflows/release.yml`; the release flow (tag +
-      GitHub Release with the VSIX + notes, `npm publish`, Marketplace publish) is
-      now defined under `changelog.workflows.release` in the config and generated
-      by `dbx sync`. Removes the need to hand-write CI.
+  - - Drop the hand-written `.github/workflows/release.yml`; the release flow (tag + GitHub Release with the VSIX + notes, `npm publish`, Marketplace publish) is now defined under `changelog.workflows.release` in the config and generated by `dbx sync`. Removes the need to hand-write CI.
 
 ## 1.0.7 (October 2026)
 
@@ -1358,11 +1142,7 @@
 #### Release
 
 - Release on push to `main` (tag + GitHub Release + npm + Marketplace) ([#4714b1a](https://github.com/deltabox-studio/toolchain/commit/4714b1a) by [T0chi](https://github.com/T0chi))
-    - Replaces the generated release-PR workflow with a hand-written one that, on
-      each push to `main`, packages the VS Code extension, creates the `v<version>`
-      tag and a GitHub Release (notes from `CHANGELOG.md` + the `.vsix` asset),
-      publishes `@deltabox/toolchain` to npm, and publishes the extension to the VS
-      Code Marketplace. Idempotent: skipped when the tag already exists.
+  - - Replaces the generated release-PR workflow with a hand-written one that, on each push to `main`, packages the VS Code extension, creates the `v<version>` tag and a GitHub Release (notes from `CHANGELOG.md` + the `.vsix` asset), publishes `@deltabox/toolchain` to npm, and publishes the extension to the VS Code Marketplace. Idempotent: skipped when the tag already exists.
 
 ## 1.0.6 (October 2026)
 
@@ -1416,19 +1196,11 @@
 #### Changelog
 
 - Tolerate a missing `CHANGELOG.md` in the release workflow ([#18ad219](https://github.com/deltabox-studio/toolchain/commit/18ad219) by [T0chi](https://github.com/T0chi))
-    - The release PR job extracted notes with `awk`, which failed when
-      `CHANGELOG.md` did not exist yet (a fresh repo). Fall back to an empty notes
-      string.
+  - - The release PR job extracted notes with `awk`, which failed when `CHANGELOG.md` did not exist yet (a fresh repo). Fall back to an empty notes string.
 - Create `CHANGELOG.md` when missing; ignore dry-run output ([#f5e4926](https://github.com/deltabox-studio/toolchain/commit/f5e4926) by [T0chi](https://github.com/T0chi))
-    - `prependChangelogEntry` read the existing file unconditionally, so the first
-      run on a repo without a `CHANGELOG.md` failed with `ENOENT`. Seed it with a
-      `# Changelog` header instead. Also gitignore `CHANGELOG.proposed.md`.
+  - - `prependChangelogEntry` read the existing file unconditionally, so the first run on a repo without a `CHANGELOG.md` failed with `ENOENT`. Seed it with a `# Changelog` header instead. Also gitignore `CHANGELOG.proposed.md`.
 - Resolve repo root from `cwd` instead of the module location ([#5278e57](https://github.com/deltabox-studio/toolchain/commit/5278e57) by [T0chi](https://github.com/T0chi))
-    - Running `dbx changelog` from source (or from the published package in
-      `node_modules`) walked up from `import.meta.url` and landed on the wrong
-      `package.json`, so it looked for `CHANGELOG.md` in the wrong directory and
-      failed. Resolve the nearest `package.json` above the working directory
-      instead.
+  - - Running `dbx changelog` from source (or from the published package in `node_modules`) walked up from `import.meta.url` and landed on the wrong `package.json`, so it looked for `CHANGELOG.md` in the wrong directory and failed. Resolve the nearest `package.json` above the working directory instead.
 
 ### Chores
 
@@ -1436,6 +1208,4 @@
 - Drop Netlify config (docs move to Railway); move `PLAN.md` out of the repo ([#e51b714](https://github.com/deltabox-studio/toolchain/commit/e51b714) by [T0chi](https://github.com/T0chi))
 - Update package description and keywords ([#d75b503](https://github.com/deltabox-studio/toolchain/commit/d75b503) by [T0chi](https://github.com/T0chi))
 - Initial commit of `@deltabox/toolchain` ([#ed4673b](https://github.com/deltabox-studio/toolchain/commit/ed4673b) by [T0chi](https://github.com/T0chi))
-    - Self-hosts CI + changelog: `dbx.config.ts` drives the generated workflows,
-      commitlint config and Conventional-Commits VS Code settings. Config file is
-      `dbx.config.*` with sections wrapped under `toolchain`.
+  - - Self-hosts CI + changelog: `dbx.config.ts` drives the generated workflows, commitlint config and Conventional-Commits VS Code settings. Config file is `dbx.config.*` with sections wrapped under `toolchain`.