@sebastienrousseau/dotfiles 0.2.508 → 0.2.510

package/docs/security/DEPS_DEV_EXCEPTIONS.md

@@ -7,7 +7,7 @@ render_with_liquid: false
 The CI workflow `.github/workflows/deps-dev-validation.yml` scans
 direct dependencies (npm + PyPI + GitHub Actions) against the
 [deps.dev Insights API](https://docs.deps.dev/) on every PR, every
-push to `master`, and every Tuesday at 04:00 UTC. When an advisory
+push to `main`, and every Tuesday at 04:00 UTC. When an advisory
 is reported at or above the threshold (default `HIGH`), the workflow
 fails.
 
@@ -79,8 +79,8 @@ auto-fail the gate even when they're still listed here.
 
 ## References
 
-- [`tools/ci/check-deps-dev.sh`](../../tools/ci/check-deps-dev.sh) — the scanner.
-- [`.github/workflows/deps-dev-validation.yml`](../../.github/workflows/deps-dev-validation.yml) — CI wiring.
-- [`tests/unit/security/test_check_deps_dev.sh`](../../tests/unit/security/test_check_deps_dev.sh) — contract test against canned fixtures.
+- [`tools/ci/check-deps-dev.sh`](https://github.com/sebastienrousseau/dotfiles/blob/main/tools/ci/check-deps-dev.sh) — the scanner.
+- [`.github/workflows/deps-dev-validation.yml`](https://github.com/sebastienrousseau/dotfiles/blob/main/.github/workflows/deps-dev-validation.yml) — CI wiring.
+- [`tests/unit/security/test_check_deps_dev.sh`](https://github.com/sebastienrousseau/dotfiles/blob/main/tests/unit/security/test_check_deps_dev.sh) — contract test against canned fixtures.
 - [deps.dev API reference](https://docs.deps.dev/api/v3/).
 - Issue [#877](https://github.com/sebastienrousseau/dotfiles/issues/877).

package/docs/security/DISCLOSURE.md

@@ -34,7 +34,7 @@ gpg --fingerprint security@sebastienrousseau.com
 ```
 
 The fingerprint must match the one published in
-[`.github/SECURITY.md`](../../.github/SECURITY.md). Cross-verify
+[`.github/SECURITY.md`](https://github.com/sebastienrousseau/dotfiles/blob/main/.github/SECURITY.md). Cross-verify
 against the SSH signing key in `dot_config/git/allowed_signers.tmpl`
 — the maintainer signs commits with the same identity, so both
 fingerprints derive from the same identity claim.
@@ -75,7 +75,7 @@ subjects in plain text).
 ## 5. Acknowledgement
 
 You should receive an acknowledgement within the SLA in
-[`.github/SECURITY.md`](../../.github/SECURITY.md):
+[`.github/SECURITY.md`](https://github.com/sebastienrousseau/dotfiles/blob/main/.github/SECURITY.md):
 
 | Severity | Initial response |
 |---|---|
@@ -122,7 +122,7 @@ The maintainer commits to:
 
 ## See also
 
-- [`.github/SECURITY.md`](../../.github/SECURITY.md) — policy
+- [`.github/SECURITY.md`](https://github.com/sebastienrousseau/dotfiles/blob/main/.github/SECURITY.md) — policy
   overview + fingerprint.
 - [`docs/security/KEY_ROTATION.md`](KEY_ROTATION.md) — schedule for
   when the disclosure key is rotated.

package/docs/security/INCIDENT_RESPONSE.md

@@ -113,7 +113,7 @@ lock-configs
 gh workflow disable <workflow-name>
 
 # Force-protect the main branch
-gh api repos/{owner}/{repo}/branches/master/protection \
+gh api repos/{owner}/{repo}/branches/main/protection \
   --method PUT \
   --field required_status_checks='{"strict":true,"contexts":["ci"]}' \
   --field enforce_admins=true

package/docs/security/INSTALL_VERIFICATION.md

@@ -56,7 +56,7 @@ These are weaker than a SHA256 check, but they catch the obvious
 After chezmoi is installed, `install.sh` clones the dotfiles repo
 itself. This isn't currently cryptographically verified beyond Git's
 own object integrity, but commits in the repo are SSH-signed and
-branch protection on `master` requires signed commits (see #853).
+branch protection on `main` requires signed commits (see #853).
 
 ## How to obtain per-release hashes
 
@@ -64,7 +64,7 @@ The verified-install snippet uses the SHA256 of the `install.sh`
 file *as it exists at the release tag*. To regenerate after a release:
 
 ```bash
-git switch master
+git switch main
 git pull
 NEW_TAG="v0.2.502"   # adjust
 git tag -s "$NEW_TAG" -m "..."

package/docs/security/MCP_POLICY.md

@@ -21,9 +21,9 @@ Properties:
 
 ## Policy artifact
 
-The source of truth lives in [mcp-policy.json](../../defaults/dot_config/dotfiles/mcp-policy.json).
-Approved package pins live in [mcp-lock.json](../../defaults/dot_config/dotfiles/mcp-lock.json).
-Tracked server registry entries live in [mcp-registry.json](../../defaults/dot_config/dotfiles/mcp-registry.json).
+The source of truth lives in [mcp-policy.json](https://github.com/sebastienrousseau/dotfiles/blob/main/defaults/dot_config/dotfiles/mcp-policy.json).
+Approved package pins live in [mcp-lock.json](https://github.com/sebastienrousseau/dotfiles/blob/main/defaults/dot_config/dotfiles/mcp-lock.json).
+Tracked server registry entries live in [mcp-registry.json](https://github.com/sebastienrousseau/dotfiles/blob/main/defaults/dot_config/dotfiles/mcp-registry.json).
 
 Current defaults:
 
@@ -75,4 +75,4 @@ Current approved refs:
 - active servers match the tracked registry entries
 - remote HTTP transports are HTTPS and OAuth-backed
 
-Policy bundle baselines live in [policy-bundles.json](../../defaults/dot_config/dotfiles/policy-bundles.json).
+Policy bundle baselines live in [policy-bundles.json](https://github.com/sebastienrousseau/dotfiles/blob/main/defaults/dot_config/dotfiles/policy-bundles.json).

package/docs/security/SCORECARD.md

@@ -41,7 +41,7 @@ Aggregate score **7.6 / 10** at 2026-05-17T08:11:51Z.
 [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/sebastienrousseau/dotfiles/badge)](https://scorecard.dev/viewer/?uri=github.com/sebastienrousseau/dotfiles)
 
 The badge above is regenerated every Monday at 06:00 UTC and on every
-push to `master` by `.github/workflows/scorecard.yml`. The SARIF
+push to `main` by `.github/workflows/scorecard.yml`. The SARIF
 result is uploaded to GitHub Code Scanning (Security tab) and
 retained as a 30-day workflow artifact.
 
@@ -57,7 +57,7 @@ Regressions are triaged within one Monday cycle: identify the check
 that dropped, either remediate or file an exception entry below with
 a rationale and an expiry date.
 
-## Per-check posture (snapshot, master HEAD)
+## Per-check posture (snapshot, main HEAD)
 
 The checks below come from OpenSSF Scorecard's published rubric. Tick
 marks reflect this repo's posture at the time of writing — the
@@ -65,19 +65,19 @@ marks reflect this repo's posture at the time of writing — the
 
 | Check | Status | Notes |
 |---|---|---|
-| Branch-Protection | ⚠ | `master` requires signed commits, linear history, required checks (`.github/rulesets/master.json`). Scorecard can't read classic protection rules without a fine-grained PAT, so this check reports as `-1` ("internal error"). |
+| Branch-Protection | ⚠ | `main` requires signed commits, linear history, required checks (`.github/rulesets/main.json`). Scorecard can't read classic protection rules without a fine-grained PAT, so this check reports as `-1` ("internal error"). |
 | Code-Review | ⚠ | Single-maintainer repo; PRs are self-merged after CI. Scorecard scores 0/30 here by design — see `Open findings` below. |
 | Signed-Commits | ✓ | Enforced by pre-push hook (`scripts/git-hooks/pre-push`) and at-push by branch protection (#853 + #857). |
 | Dependency-Update-Tool | ✓ | Dependabot configured for github-actions / npm / docker / devcontainers / uv. |
 | Fuzzing | ⚠ | `install.sh` fuzz harness lives under `tests/fuzz/` (closes #881), but it's shell-based and Scorecard's heuristic only recognizes OSS-Fuzz / ClusterFuzzLite / native Go fuzz / libFuzzer / Atheris. None support shell. Property tests under `tests/unit/functions/test_property_*.sh` cover the closest equivalent surface. |
 | License | ✓ | MIT at repo root (`LICENSE`). |
-| Maintained | ✓ | Active commit cadence; the [README](../../README.md) lists the current `dotfiles_version`. |
+| Maintained | ✓ | Active commit cadence; the [README](https://github.com/sebastienrousseau/dotfiles/blob/main/README.md) lists the current `dotfiles_version`. |
 | Pinned-Dependencies | ⚠ | Closed 8 of 14 findings this cycle (every Dockerfile base + every workflow action + 2 `curl \| sh` installers + the `npm install -g npm` upgrade step). 5 residual findings stay open by design — see `Open findings`. |
 | SAST | ✓ | CodeQL (`.github/workflows/codeql.yml`) + Checkov + Grype. |
 | SBOM | ✓ | Generated per PR by `sbom-diff.yml` and per release by `security-release.yml`. |
 | Security-Policy | ✓ | `.github/SECURITY.md` + this page + `docs/security/THREAT_MODEL.md`. |
 | Token-Permissions | ✓ | Top-level `permissions:` blocks restricted to `contents: read`. `write` scopes scoped to the jobs that need them (#886). |
-| Vulnerabilities | ✓ | Grype gate hard-fails on `high` / `critical` on `master` (#852). |
+| Vulnerabilities | ✓ | Grype gate hard-fails on `high` / `critical` on `main` (#852). |
 | Webhooks | n/a | No external webhooks configured. |
 | CI-Tests | ✓ | Linux + macOS Intel + Apple Silicon matrix; optional Windows. |
 | CII-Best-Practices | ☐ | Not applied yet — see `Open work` below. |
@@ -138,7 +138,7 @@ false positives in Scorecard's regex.
 - **Re-trigger Scorecard after SLSA backfill propagates** — expected `Signed-Releases` 3 → 10.
 - **`harden-runner` block-mode adoption (#878)** — should tighten the `Token-Permissions` check further.
 - **Investigate `License` 9/10 false-positive** — repo is MIT (SPDX-compliant), Scorecard's penalty should not apply.
-- **Investigate `Branch-Protection` `-1`** — scanner internal error; manually verify with `gh api repos/:owner/:repo/branches/master/protection` and document.
+- **Investigate `Branch-Protection` `-1`** — scanner internal error; manually verify with `gh api repos/:owner/:repo/branches/main/protection` and document.
 
 ### Enabling Branch-Protection + Webhooks checks (one-time PAT setup)
 
@@ -180,7 +180,7 @@ gh api 'repos/sebastienrousseau/dotfiles/code-scanning/alerts?state=open&per_pag
   --jq '[.[].rule.id] | group_by(.) | map({rule: .[0], count: length})'
 
 # Trigger Scorecard manually:
-gh workflow run scorecard.yml --ref master
+gh workflow run scorecard.yml --ref main
 ```
 
 If a new category appears, add a row to the matching bucket. If a

package/docs/security/SECURITY_CHECKLIST.md

@@ -45,7 +45,7 @@ Run `dot mcp --strict --json` to validate all MCP server configurations and capt
 - [ ] **SBOM Generation**: Verify `dotfiles-sbom.spdx.json` is generated in release workflow.
 - [ ] **Attestation Signing**: Confirm `actions/attest-build-provenance` signs the release artifacts.
 - [ ] **Attestation Verification**: Verify with `gh attestation verify <artifact> --repo sebastienrousseau/dotfiles`.
-- [ ] **Branch Protection**: Ensure `security-attestation` is a required status check on master.
+- [ ] **Branch Protection**: Ensure `security-attestation` is a required status check on main.
 - [ ] **Automation Keying**: Confirm `ACTIONS_BOT_SIGNING_KEY` exists and matches the signer in `dot_config/git/allowed_signers`.
 
 ## 7. Final Verification

package/docs/security/SHELL_EXEMPTIONS.md

@@ -7,10 +7,10 @@ render_with_liquid: false
 Every bash script in this repo must include `set -euo pipefail` (or
 `set -eu` for POSIX `sh`) within its first 50 lines. The rule is
 enforced by
-[`tools/ci/check-shell-preamble.sh`](../../tools/ci/check-shell-preamble.sh),
+[`tools/ci/check-shell-preamble.sh`](https://github.com/sebastienrousseau/dotfiles/blob/main/tools/ci/check-shell-preamble.sh),
 wired into `pre-commit` and the `reusable-shell-lint.yml` CI job.
 Tests pin the contract under
-[`tests/unit/security/test_shell_preamble_lint.sh`](../../tests/unit/security/test_shell_preamble_lint.sh).
+[`tests/unit/security/test_shell_preamble_lint.sh`](https://github.com/sebastienrousseau/dotfiles/blob/main/tests/unit/security/test_shell_preamble_lint.sh).
 
 ## Why the preamble is mandatory
 

package/docs/security/SOUP_REGISTER.md

@@ -12,13 +12,13 @@ Controlled inventory for software of unknown pedigree used by the dotfiles platf
 
 | Component | Source | Version control | Verification path | Owner | Status |
 | :--- | :--- | :--- | :--- | :--- | :--- |
-| Homebrew installer | `raw.githubusercontent.com/Homebrew/install` | Moving upstream script, gated by `HOMEBREW_INSTALLER_SHA256` | SHA-256 in [package_managers.sh](../../install/lib/package_managers.sh) | Repo maintainer | Conditional |
+| Homebrew installer | `raw.githubusercontent.com/Homebrew/install` | Moving upstream script, gated by `HOMEBREW_INSTALLER_SHA256` | SHA-256 in [package_managers.sh](https://github.com/sebastienrousseau/dotfiles/blob/main/install/lib/package_managers.sh) | Repo maintainer | Conditional |
 | Chezmoi installer | `get.chezmoi.io` | Pinned by `CHEZMOI_INSTALLER_SHA256` when used | SHA-256 in `install/lib/chezmoi.sh` | Repo maintainer | Controlled |
 | GitHub Actions marketplace actions | GitHub Marketplace | Full commit SHA pinning | Workflow `uses:` pins | Repo maintainer | Controlled |
-| Grype container | `anchore/grype` | Pinned tag in workflow | Container tag in [security-enhanced.yml](../../.github/workflows/security-enhanced.yml) | Repo maintainer | Controlled |
-| Trivy container | `aquasec/trivy` | Pinned tag in workflow | Container tag in [security-enhanced.yml](../../.github/workflows/security-enhanced.yml) | Repo maintainer | Controlled |
+| Grype container | `anchore/grype` | Pinned tag in workflow | Container tag in [security-enhanced.yml](https://github.com/sebastienrousseau/dotfiles/blob/main/.github/workflows/security-enhanced.yml) | Repo maintainer | Controlled |
+| Trivy container | `aquasec/trivy` | Pinned tag in workflow | Container tag in [security-enhanced.yml](https://github.com/sebastienrousseau/dotfiles/blob/main/.github/workflows/security-enhanced.yml) | Repo maintainer | Controlled |
 | Checkov action | GitHub Marketplace | Full commit SHA pinning | Workflow `uses:` pin | Repo maintainer | Controlled |
-| Nix inputs | GitHub flakes | Locked in [flake.lock](../../flake.lock) | `narHash` and revision lock | Repo maintainer | Controlled |
+| Nix inputs | GitHub flakes | Locked in [flake.lock](https://github.com/sebastienrousseau/dotfiles/blob/main/flake.lock) | `narHash` and revision lock | Repo maintainer | Controlled |
 | GitHub release metadata queries | GitHub API | Discovery only, not release validation | `update-deps.yml` query path | Repo maintainer | Monitored |
 
 ## Validation record

package/docs/stylesheets/extra.css

@@ -0,0 +1,444 @@
+/* ──────────────────────────────────────────────────────────────────────────
+ *  doc.dotfiles.io — custom theme
+ *  Dark + terminal-green palette on MkDocs Material.
+ *  Inspired by the polish of docs.n8n.io / GitHub docs dark, adapted to
+ *  Material's structure.
+ *  ────────────────────────────────────────────────────────────────────── */
+
+/* -- font stack ------------------------------------------------------------ */
+@import url("https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&family=JetBrains+Mono:wght@400;500;600&display=swap");
+
+:root {
+  --dot-font-body: "Inter", -apple-system, BlinkMacSystemFont, "Segoe UI",
+    "Helvetica Neue", Arial, sans-serif;
+  --dot-font-code: "JetBrains Mono", ui-monospace, SFMono-Regular, "SF Mono",
+    Menlo, Consolas, monospace;
+
+  --dot-green: #7ee787;         /* terminal green */
+  --dot-green-bright: #b0f5b7;  /* hover / focused */
+  --dot-green-dim: #4a9153;     /* muted / secondary */
+  --dot-green-rgb: 126, 231, 135;
+
+  --dot-bg: #0b0e14;            /* base */
+  --dot-bg-elev: #111621;       /* elevated card */
+  --dot-bg-elev-2: #161b26;     /* higher elevation */
+  --dot-border: #1f2937;
+  --dot-border-strong: #2b3646;
+
+  --dot-fg: #e4e7ec;
+  --dot-fg-muted: #94a3b8;
+  --dot-fg-subtle: #64748b;
+}
+
+/* -- global typography ----------------------------------------------------- */
+body,
+.md-typeset {
+  font-family: var(--dot-font-body);
+  font-feature-settings: "ss01", "cv11";
+  -webkit-font-smoothing: antialiased;
+  -moz-osx-font-smoothing: grayscale;
+}
+
+.md-typeset code,
+.md-typeset kbd,
+.md-typeset pre,
+code {
+  font-family: var(--dot-font-code);
+  font-feature-settings: "calt", "ss20";
+}
+
+/* -- dark palette override (slate) ---------------------------------------- */
+[data-md-color-scheme="slate"] {
+  --md-hue: 210;
+  --md-default-bg-color: var(--dot-bg);
+  --md-default-fg-color: var(--dot-fg);
+  --md-default-fg-color--light: var(--dot-fg-muted);
+  --md-default-fg-color--lighter: var(--dot-fg-subtle);
+  --md-default-fg-color--lightest: hsla(210, 20%, 40%, 0.3);
+
+  --md-primary-fg-color: var(--dot-green);
+  --md-primary-fg-color--light: var(--dot-green-bright);
+  --md-primary-fg-color--dark: var(--dot-green-dim);
+  --md-primary-bg-color: var(--dot-bg);
+  --md-primary-bg-color--light: var(--dot-bg-elev);
+
+  --md-accent-fg-color: var(--dot-green-bright);
+  --md-accent-fg-color--transparent: rgba(126, 231, 135, 0.1);
+  --md-accent-bg-color: var(--dot-bg);
+  --md-accent-bg-color--light: var(--dot-bg-elev);
+
+  --md-typeset-a-color: var(--dot-green);
+
+  --md-code-bg-color: var(--dot-bg-elev-2);
+  --md-code-fg-color: var(--dot-fg);
+  --md-code-hl-color: rgba(126, 231, 135, 0.12);
+  --md-code-hl-color--light: rgba(126, 231, 135, 0.08);
+
+  /* Admonitions */
+  --md-admonition-bg-color: var(--dot-bg-elev);
+  --md-admonition-fg-color: var(--dot-fg);
+
+  /* Footer */
+  --md-footer-bg-color: #050710;
+  --md-footer-bg-color--dark: #030509;
+}
+
+/* -- header --------------------------------------------------------------- */
+.md-header {
+  background-color: rgba(11, 14, 20, 0.92);
+  backdrop-filter: saturate(180%) blur(12px);
+  -webkit-backdrop-filter: saturate(180%) blur(12px);
+  border-bottom: 1px solid var(--dot-border);
+  box-shadow: none;
+}
+
+.md-header[data-md-state="shadow"] {
+  box-shadow: 0 1px 0 var(--dot-border);
+}
+
+.md-header__title {
+  font-weight: 600;
+  letter-spacing: -0.01em;
+}
+
+.md-header__button.md-logo :is(img, svg) {
+  color: var(--dot-green);
+  fill: var(--dot-green);
+  height: 1.6rem;
+  width: 1.6rem;
+}
+
+/* -- tabs --------------------------------------------------------------- */
+.md-tabs {
+  background-color: rgba(11, 14, 20, 0.85);
+  border-bottom: 1px solid var(--dot-border);
+}
+
+.md-tabs__link {
+  color: var(--dot-fg-muted);
+  opacity: 1;
+  font-size: 0.75rem;
+  font-weight: 500;
+  transition: color 120ms ease;
+}
+
+.md-tabs__link:hover,
+.md-tabs__link--active {
+  color: var(--dot-green-bright);
+}
+
+.md-tabs__link--active {
+  position: relative;
+}
+.md-tabs__link--active::after {
+  content: "";
+  position: absolute;
+  left: 0;
+  right: 0;
+  bottom: -2px;
+  height: 2px;
+  background: linear-gradient(90deg, transparent, var(--dot-green), transparent);
+}
+
+/* -- sidebar (left nav) --------------------------------------------------- */
+.md-nav__title {
+  font-size: 0.68rem;
+  font-weight: 700;
+  text-transform: uppercase;
+  letter-spacing: 0.05em;
+  color: var(--dot-fg-subtle);
+  padding-top: 1.2rem;
+}
+
+.md-nav__link {
+  color: var(--dot-fg-muted);
+  transition: color 120ms ease, background-color 120ms ease;
+  border-radius: 6px;
+  padding: 4px 8px;
+  margin: 1px 0;
+}
+.md-nav__link:hover {
+  color: var(--dot-fg);
+  background: rgba(126, 231, 135, 0.06);
+}
+.md-nav__link--active,
+.md-nav__link.md-nav__link--active {
+  color: var(--dot-green-bright);
+  background: rgba(126, 231, 135, 0.1);
+  font-weight: 500;
+}
+
+/* -- right TOC ------------------------------------------------------------ */
+.md-nav--secondary .md-nav__title {
+  border-left: 2px solid var(--dot-border);
+  background: transparent;
+}
+.md-nav--secondary .md-nav__link--active {
+  border-left: 2px solid var(--dot-green);
+  color: var(--dot-green-bright);
+  background: transparent;
+}
+
+/* -- content -------------------------------------------------------------- */
+.md-typeset h1,
+.md-typeset h2,
+.md-typeset h3,
+.md-typeset h4 {
+  font-family: var(--dot-font-body);
+  letter-spacing: -0.02em;
+  color: var(--dot-fg);
+}
+
+.md-typeset h1 {
+  font-weight: 700;
+  font-size: 2.2rem;
+  line-height: 1.15;
+  margin-bottom: 0.6em;
+  background: linear-gradient(180deg, #ffffff 0%, #cbd5e1 100%);
+  -webkit-background-clip: text;
+  background-clip: text;
+  color: transparent;
+}
+
+.md-typeset h2 {
+  font-weight: 600;
+  font-size: 1.6rem;
+  margin-top: 2.4em;
+  padding-top: 0.4em;
+  border-top: 1px solid var(--dot-border);
+}
+
+.md-typeset h3 {
+  font-weight: 600;
+  font-size: 1.2rem;
+  color: var(--dot-green-bright);
+}
+
+.md-typeset a {
+  text-decoration: none;
+  border-bottom: 1px solid transparent;
+  transition: border-color 120ms ease, color 120ms ease;
+}
+.md-typeset a:hover {
+  border-bottom-color: var(--dot-green-bright);
+  color: var(--dot-green-bright);
+}
+
+/* -- code blocks ---------------------------------------------------------- */
+.md-typeset pre > code,
+.md-typeset .highlight pre {
+  background-color: var(--dot-bg-elev-2);
+  border: 1px solid var(--dot-border);
+  border-radius: 8px;
+}
+.md-typeset code {
+  background-color: rgba(126, 231, 135, 0.08);
+  border: 1px solid rgba(126, 231, 135, 0.15);
+  color: var(--dot-green-bright);
+  border-radius: 4px;
+  padding: 0.1em 0.35em;
+  font-size: 0.88em;
+}
+.md-typeset pre > code {
+  background: transparent;
+  border: none;
+  color: var(--dot-fg);
+  padding: 0;
+}
+
+/* -- tables --------------------------------------------------------------- */
+.md-typeset table:not([class]) {
+  border: 1px solid var(--dot-border);
+  border-radius: 8px;
+  overflow: hidden;
+  font-size: 0.8rem;
+}
+.md-typeset table:not([class]) th {
+  background: var(--dot-bg-elev);
+  color: var(--dot-fg);
+  font-weight: 600;
+  border-bottom: 1px solid var(--dot-border-strong);
+}
+.md-typeset table:not([class]) tr:hover {
+  background: rgba(126, 231, 135, 0.03);
+}
+
+/* -- admonitions ---------------------------------------------------------- */
+.md-typeset .admonition,
+.md-typeset details {
+  background: var(--dot-bg-elev);
+  border: 1px solid var(--dot-border);
+  border-left: 3px solid var(--dot-green);
+  border-radius: 8px;
+  box-shadow: none;
+}
+.md-typeset .admonition-title,
+.md-typeset summary {
+  background: transparent;
+  border-bottom: 1px solid var(--dot-border);
+  font-weight: 600;
+}
+
+/* -- grid cards ----------------------------------------------------------- */
+.md-typeset .grid.cards > :is(ul, ol) > li,
+.md-typeset .grid.cards > .card {
+  background: var(--dot-bg-elev);
+  border: 1px solid var(--dot-border);
+  border-radius: 12px;
+  padding: 1.2rem;
+  transition: transform 180ms ease, border-color 180ms ease,
+    box-shadow 180ms ease, background 180ms ease;
+  position: relative;
+  overflow: hidden;
+}
+.md-typeset .grid.cards > :is(ul, ol) > li::before {
+  content: "";
+  position: absolute;
+  inset: 0;
+  background: radial-gradient(
+    circle at top left,
+    rgba(126, 231, 135, 0.06),
+    transparent 60%
+  );
+  opacity: 0;
+  transition: opacity 220ms ease;
+  pointer-events: none;
+}
+.md-typeset .grid.cards > :is(ul, ol) > li:hover {
+  transform: translateY(-2px);
+  border-color: rgba(126, 231, 135, 0.35);
+  background: var(--dot-bg-elev-2);
+  box-shadow: 0 8px 24px -8px rgba(0, 0, 0, 0.5),
+    0 0 0 1px rgba(126, 231, 135, 0.08) inset;
+}
+.md-typeset .grid.cards > :is(ul, ol) > li:hover::before {
+  opacity: 1;
+}
+.md-typeset .grid.cards > :is(ul, ol) > li > :first-child {
+  margin-top: 0;
+}
+.md-typeset .grid.cards > :is(ul, ol) > li strong {
+  color: var(--dot-green-bright);
+  font-weight: 600;
+  font-size: 1rem;
+  display: block;
+  margin-bottom: 0.4rem;
+}
+.md-typeset .grid.cards > :is(ul, ol) > li .twemoji,
+.md-typeset .grid.cards > :is(ul, ol) > li svg {
+  color: var(--dot-green);
+  fill: var(--dot-green);
+  height: 1.4rem;
+  width: 1.4rem;
+  margin-bottom: 0.6rem;
+}
+
+/* -- hero banner (used by landing page) ----------------------------------- */
+.dot-hero {
+  padding: 3rem 0 2.4rem;
+  margin: -1.6rem -0.8rem 2.4rem;
+  text-align: center;
+  border-bottom: 1px solid var(--dot-border);
+  position: relative;
+  background: radial-gradient(
+    ellipse 60% 100% at 50% 0%,
+    rgba(126, 231, 135, 0.08),
+    transparent 70%
+  );
+}
+.dot-hero h1 {
+  font-size: 3rem;
+  line-height: 1.05;
+  margin-bottom: 0.4em;
+  padding: 0;
+  border: none;
+}
+.dot-hero .tagline {
+  font-size: 1.1rem;
+  color: var(--dot-fg-muted);
+  max-width: 40rem;
+  margin: 0 auto 1.4rem;
+}
+.dot-hero .buttons {
+  display: flex;
+  gap: 0.6rem;
+  justify-content: center;
+  flex-wrap: wrap;
+}
+.dot-hero .buttons a {
+  display: inline-flex;
+  align-items: center;
+  gap: 0.4rem;
+  padding: 0.6rem 1.1rem;
+  border-radius: 8px;
+  font-weight: 500;
+  font-size: 0.9rem;
+  text-decoration: none;
+  border: 1px solid var(--dot-border-strong);
+  color: var(--dot-fg);
+  transition: all 160ms ease;
+}
+.dot-hero .buttons a.primary {
+  background: var(--dot-green);
+  color: var(--dot-bg);
+  border-color: var(--dot-green);
+  font-weight: 600;
+}
+.dot-hero .buttons a.primary:hover {
+  background: var(--dot-green-bright);
+  border-color: var(--dot-green-bright);
+  transform: translateY(-1px);
+}
+.dot-hero .buttons a:not(.primary):hover {
+  border-color: var(--dot-green);
+  color: var(--dot-green-bright);
+}
+
+/* -- search --------------------------------------------------------------- */
+.md-search__form {
+  background: var(--dot-bg-elev);
+  border: 1px solid var(--dot-border);
+  border-radius: 8px;
+}
+.md-search__form:hover,
+.md-search__input:focus + .md-search__icon,
+.md-search__form:focus-within {
+  border-color: var(--dot-green);
+  background: var(--dot-bg-elev-2);
+}
+.md-search__input {
+  color: var(--dot-fg);
+}
+.md-search__input::placeholder {
+  color: var(--dot-fg-subtle);
+}
+
+/* -- footer --------------------------------------------------------------- */
+.md-footer {
+  border-top: 1px solid var(--dot-border);
+}
+.md-footer-meta {
+  background: var(--dot-bg);
+  border-top: 1px solid var(--dot-border);
+}
+.md-copyright {
+  color: var(--dot-fg-subtle);
+  font-size: 0.72rem;
+}
+
+/* -- scrollbar (webkit) --------------------------------------------------- */
+::-webkit-scrollbar {
+  width: 10px;
+  height: 10px;
+}
+::-webkit-scrollbar-track {
+  background: transparent;
+}
+::-webkit-scrollbar-thumb {
+  background: var(--dot-border-strong);
+  border-radius: 8px;
+  border: 2px solid var(--dot-bg);
+}
+::-webkit-scrollbar-thumb:hover {
+  background: var(--dot-green-dim);
+}

package/docs/themes/hero-shot.svg

@@ -70,7 +70,7 @@
     <!-- New prompt -->
     <text x="40" y="405" fill="#a6e3a1">&#10148;</text>
     <text x="60" y="405" fill="#cdd6f4">~/.dotfiles</text>
-    <text x="170" y="405" fill="#f5c2e7">on master</text>
+    <text x="170" y="405" fill="#f5c2e7">on main</text>
     <rect x="275" y="393" width="8" height="16" fill="#cdd6f4">
       <animate attributeName="opacity" values="1;0;1" dur="1s" repeatCount="indefinite" />
     </rect>