@synoikia/create-plugin 0.6.1 → 0.8.0

package/dist/workflow/prose.js

@@ -1,113 +0,0 @@
-const MAX_WORDS = 25;
-/** Inline code and link targets are not prose. */
-const stripInline = (text) => text
-    .replace(/`[^`]*`/g, 'Code')
-    .replace(/\]\([^)]*\)/g, ']')
-    .replace(/<!--.*?-->/g, '')
-    .replace(/https?:\/\/\S+/g, 'link');
-function markdownBlocks(text) {
-    const lines = text.split('\n');
-    const blocks = [];
-    let fence;
-    let comment = false;
-    let para;
-    const flush = () => {
-        if (para)
-            blocks.push(para);
-        para = undefined;
-    };
-    let i = 0;
-    if (lines[0] === '---') {
-        const end = lines.indexOf('---', 1);
-        if (end > 0)
-            i = end + 1;
-    }
-    for (; i < lines.length; i++) {
-        const raw = lines[i];
-        const line = i + 1;
-        const fenceMark = raw.match(/^\s*(`{3,}|~{3,})/)?.[1];
-        if (fence) {
-            if (fenceMark?.startsWith(fence))
-                fence = undefined;
-            continue;
-        }
-        if (fenceMark) {
-            flush();
-            fence = fenceMark;
-            continue;
-        }
-        if (comment || raw.trim().startsWith('<!--')) {
-            comment = !raw.includes('-->');
-            continue;
-        }
-        if (!raw.trim() || (/^\s{4,}\S/.test(raw) && !para)) {
-            flush();
-            continue;
-        }
-        if (/^\s*\|/.test(raw)) {
-            flush();
-            if (!/^\s*\|[\s:|-]+\|\s*$/.test(raw))
-                for (const cell of raw.split('|').slice(1, -1))
-                    blocks.push({ line, lastLine: line, text: cell, label: true });
-            continue;
-        }
-        if (/^\s*#{1,6}\s/.test(raw)) {
-            flush();
-            blocks.push({ line, lastLine: line, text: raw.replace(/^\s*#+\s*/, ''), label: true });
-            continue;
-        }
-        const item = raw.match(/^\s*(?:[-*+]|\d+[.)])\s+(.*)$/);
-        if (item) {
-            flush();
-            para = { line, lastLine: line, text: item[1], label: false };
-            continue;
-        }
-        if (para) {
-            para.text += ` ${raw.trim()}`;
-            para.lastLine = line;
-        }
-        else
-            para = { line, lastLine: line, text: raw.trim().replace(/^>\s*/, ''), label: false };
-    }
-    flush();
-    return blocks;
-}
-function featureBlocks(text) {
-    return text.split('\n').flatMap((raw, i) => {
-        const t = raw.trim();
-        if (!t || t.startsWith('#') || t.startsWith('@'))
-            return [];
-        const label = t.startsWith('|') || /^[A-Za-z ]+:/.test(t);
-        return [{ line: i + 1, lastLine: i + 1, text: t.replace(/^[A-Za-z ]+:\s*/, ''), label }];
-    });
-}
-const words = (sentence) => sentence.split(/\s+/).filter((w) => /[\p{L}\p{N}]/u.test(w)).length;
-/** Problems with the writing rules in one file. With `lines`, only blocks that touch those lines. */
-export function checkProse(file, text, lines) {
-    const blocks = file.endsWith('.feature') ? featureBlocks(text) : markdownBlocks(text);
-    const issues = [];
-    for (const block of blocks) {
-        if (lines) {
-            let touched = false;
-            for (let l = block.line; l <= block.lastLine && !touched; l++)
-                touched = lines.has(l);
-            if (!touched)
-                continue;
-        }
-        const prose = stripInline(block.text);
-        const at = `${file}:${block.line}`;
-        if (prose.includes(';'))
-            issues.push(`${at}: no semicolons. Write two sentences`);
-        if (prose.includes('—'))
-            issues.push(`${at}: no em dashes. Write two sentences or use a colon`);
-        if (block.label)
-            continue;
-        for (const sentence of prose.split(/(?<=[.!?:][*_)"'`]*)\s+(?=[\p{Lu}`*"([])/u)) {
-            const n = words(sentence);
-            if (n > MAX_WORDS)
-                issues.push(`${at}: a sentence has ${n} words. Use ${MAX_WORDS} at most`);
-        }
-    }
-    return issues;
-}
-//# sourceMappingURL=prose.js.map

package/dist/workflow/prose.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"prose.js","sourceRoot":"","sources":["../../src/workflow/prose.ts"],"names":[],"mappings":"AAAA,MAAM,SAAS,GAAG,EAAE,CAAC;AAUrB,kDAAkD;AAClD,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,EAAE,CACnC,IAAI;KACD,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC;KAC3B,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC;KAC5B,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC;KAC1B,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;AAExC,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,IAAI,KAAyB,CAAC;IAC9B,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,IAAuB,CAAC;IAC5B,MAAM,KAAK,GAAG,GAAG,EAAE;QACjB,IAAI,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,GAAG,SAAS,CAAC;IACnB,CAAC,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACpC,IAAI,GAAG,GAAG,CAAC;YAAE,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACtB,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACnB,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACtD,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,SAAS,EAAE,UAAU,CAAC,KAAK,CAAC;gBAAE,KAAK,GAAG,SAAS,CAAC;YACpD,SAAS;QACX,CAAC;QACD,IAAI,SAAS,EAAE,CAAC;YACd,KAAK,EAAE,CAAC;YACR,KAAK,GAAG,SAAS,CAAC;YAClB,SAAS;QACX,CAAC;QACD,IAAI,OAAO,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7C,OAAO,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC/B,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACpD,KAAK,EAAE,CAAC;YACR,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,KAAK,EAAE,CAAC;YACR,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC;gBACnC,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;oBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACjH,SAAS;QACX,CAAC;QACD,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,KAAK,EAAE,CAAC;YACR,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACvF,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACxD,IAAI,IAAI,EAAE,CAAC;YACT,KAAK,EAAE,CAAC;YACR,IAAI,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;YAC9D,SAAS;QACX,CAAC;QACD,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC,IAAI,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;YAC9B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACvB,CAAC;;YAAM,IAAI,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC9F,CAAC;IACD,KAAK,EAAE,CAAC;IACR,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACzC,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,CAAC;QAC5D,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1D,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,QAAgB,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAExG,qGAAqG;AACrG,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,IAAY,EAAE,KAA2B;IAChF,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;IACtF,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE;gBAAE,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACtF,IAAI,CAAC,OAAO;gBAAE,SAAS;QACzB,CAAC;QACD,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,EAAE,GAAG,GAAG,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,sCAAsC,CAAC,CAAC;QAClF,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,oDAAoD,CAAC,CAAC;QAChG,IAAI,KAAK,CAAC,KAAK;YAAE,SAAS;QAC1B,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,2CAA2C,CAAC,EAAE,CAAC;YAChF,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC1B,IAAI,CAAC,GAAG,SAAS;gBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC,eAAe,SAAS,UAAU,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/workflow/red.d.ts

@@ -1,2 +0,0 @@
-/** Runs the feature files at `sha` in a temporary worktree. True when at least one package fails. */
-export declare function featuresFailAt(root: string, sha: string, features: readonly string[]): boolean;

package/dist/workflow/red.js

@@ -1,36 +0,0 @@
-import { spawnSync } from 'node:child_process';
-import { existsSync, mkdtempSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import path from 'node:path';
-import { git } from './git.js';
-const run = (cwd, cmd, args) => spawnSync(cmd, args, { cwd, stdio: 'inherit', env: { ...process.env, CI: 'true' } }).status ?? 1;
-/** The nearest directory up from `file` with a package.json, below `root`. */
-function packageOf(root, file) {
-    let dir = path.dirname(path.join(root, file));
-    while (dir !== root && !existsSync(path.join(dir, 'package.json')))
-        dir = path.dirname(dir);
-    return dir;
-}
-/** Runs the feature files at `sha` in a temporary worktree. True when at least one package fails. */
-export function featuresFailAt(root, sha, features) {
-    const dir = mkdtempSync(path.join(tmpdir(), 'synoikia-red-'));
-    try {
-        git(root, 'worktree', 'add', '--detach', dir, sha);
-        if (run(dir, 'pnpm', ['install', '--frozen-lockfile', '--prefer-offline']) !== 0)
-            throw new Error(`pnpm install failed at ${sha.slice(0, 7)}`);
-        const byPackage = new Map();
-        for (const f of features.filter((f) => existsSync(path.join(dir, f)))) {
-            const pkg = packageOf(dir, f);
-            byPackage.set(pkg, [...(byPackage.get(pkg) ?? []), path.relative(pkg, path.join(dir, f))]);
-        }
-        let failed = false;
-        for (const [pkg, files] of byPackage)
-            failed = run(pkg, 'pnpm', ['exec', 'vitest', 'run', ...files]) !== 0 || failed;
-        return failed;
-    }
-    finally {
-        spawnSync('git', ['worktree', 'remove', '--force', dir], { cwd: root });
-        rmSync(dir, { recursive: true, force: true });
-    }
-}
-//# sourceMappingURL=red.js.map

package/dist/workflow/red.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"red.js","sourceRoot":"","sources":["../../src/workflow/red.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAE/B,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,GAAW,EAAE,IAAc,EAAE,EAAE,CACvD,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;AAEnG,8EAA8E;AAC9E,SAAS,SAAS,CAAC,IAAY,EAAE,IAAY;IAC3C,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9C,OAAO,GAAG,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAAE,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5F,OAAO,GAAG,CAAC;AACb,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,GAAW,EAAE,QAA2B;IACnF,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACnD,IAAI,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,SAAS,EAAE,mBAAmB,EAAE,kBAAkB,CAAC,CAAC,KAAK,CAAC;YAC9E,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/D,MAAM,SAAS,GAAG,IAAI,GAAG,EAAoB,CAAC;QAC9C,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAC9B,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,SAAS;YAClC,MAAM,GAAG,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC;QACjF,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC"}

package/dist/workflow/secrets.d.ts

@@ -1,2 +0,0 @@
-/** Staged paths that look like credential files, by name rather than content. */
-export declare const credentialPaths: (files: readonly string[]) => string[];

package/dist/workflow/secrets.js

@@ -1,5 +0,0 @@
-const EXAMPLE = /(?:\.|^|\/)(?:example|sample|template)(?:\.[^/]+)?$/;
-const CREDENTIAL = /(?:^|\/)(?:secrets?(?:\.[^/]+)*\.ya?ml|\.env(?:\..+)?|\.dev\.vars(?:\..+)?|[^/]+\.secret(?:\..+)?|[^/]+\.(?:pem|key|p12|pfx)|id_(?:rsa|dsa|ecdsa|ed25519)|\.npmrc|\.netrc)$/;
-/** Staged paths that look like credential files, by name rather than content. */
-export const credentialPaths = (files) => files.filter((f) => !EXAMPLE.test(f) && CREDENTIAL.test(f));
-//# sourceMappingURL=secrets.js.map

package/dist/workflow/secrets.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/workflow/secrets.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,GAAG,qDAAqD,CAAC;AACtE,MAAM,UAAU,GACd,6KAA6K,CAAC;AAEhL,iFAAiF;AACjF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAwB,EAAE,EAAE,CAC1D,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC"}

package/dist/workflow/security-line.d.ts

@@ -1,6 +0,0 @@
-export declare const SECURITY_LINE: RegExp;
-/** A ready PR that changes a security path states its audit on a line of its own. */
-export declare function checkSecurityLine(pr: {
-    draft: boolean;
-    body: string | null;
-}, changed: readonly string[], paths: readonly string[]): string[];

package/dist/workflow/security-line.js

@@ -1,14 +0,0 @@
-import { matchesAny } from './glob.js';
-export const SECURITY_LINE = /^Security audit: \S/m;
-/** A ready PR that changes a security path states its audit on a line of its own. */
-export function checkSecurityLine(pr, changed, paths) {
-    if (pr.draft)
-        return [];
-    const touched = changed.filter((f) => matchesAny(f, paths));
-    if (!touched.length || SECURITY_LINE.test(pr.body ?? ''))
-        return [];
-    return [
-        `this PR changes security paths (${touched.slice(0, 5).join(', ')}${touched.length > 5 ? ', …' : ''}). Add a line "Security audit: <boundary and findings>" or "Security audit: none. <why>" to its description`,
-    ];
-}
-//# sourceMappingURL=security-line.js.map

package/dist/workflow/security-line.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"security-line.js","sourceRoot":"","sources":["../../src/workflow/security-line.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC,MAAM,CAAC,MAAM,aAAa,GAAG,sBAAsB,CAAC;AAEpD,qFAAqF;AACrF,MAAM,UAAU,iBAAiB,CAC/B,EAA2C,EAC3C,OAA0B,EAC1B,KAAwB;IAExB,IAAI,EAAE,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACxB,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IAC5D,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;QAAE,OAAO,EAAE,CAAC;IACpE,OAAO;QACL,mCAAmC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,6GAA6G;KACjN,CAAC;AACJ,CAAC"}

package/dist/workflow/sync.d.ts

@@ -1,4 +0,0 @@
-/** The shared workflow files, as repo-relative path → template path. Claude files only for repos that use Claude. */
-export declare function workflowFiles(root: string): Map<string, string>;
-/** Writes the shared files, or with `check` lists the ones that differ. Returns the paths written or out of date. */
-export declare function syncWorkflow(root: string, check?: boolean): string[];

package/dist/workflow/sync.js

@@ -1,47 +0,0 @@
-import { chmodSync, existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, realpathSync, statSync, writeFileSync, } from 'node:fs';
-import path from 'node:path';
-import { TEMPLATES_DIR } from '../repo-root.js';
-const WORKFLOW_DIR = path.join(TEMPLATES_DIR, 'workflow');
-const outName = (name) => (/^_[a-zA-Z]/.test(name) ? `.${name.slice(1)}` : name);
-/** The shared workflow files, as repo-relative path → template path. Claude files only for repos that use Claude. */
-export function workflowFiles(root) {
-    const files = new Map();
-    const walk = (from, to) => {
-        for (const entry of readdirSync(from).sort()) {
-            const src = path.join(from, entry);
-            const dest = path.posix.join(to, outName(entry));
-            if (statSync(src).isDirectory())
-                walk(src, dest);
-            else
-                files.set(dest, src);
-        }
-    };
-    walk(path.join(WORKFLOW_DIR, 'base'), '');
-    if (existsSync(path.join(root, '.claude')))
-        walk(path.join(WORKFLOW_DIR, 'claude'), '');
-    return files;
-}
-/** Writes the shared files, or with `check` lists the ones that differ. Returns the paths written or out of date. */
-export function syncWorkflow(root, check = false) {
-    const changed = [];
-    for (const [rel, src] of workflowFiles(root)) {
-        const dest = path.join(root, rel);
-        if (lstatSync(dest, { throwIfNoEntry: false })?.isSymbolicLink())
-            throw new Error(`${rel} is a symlink. Remove it before the sync`);
-        const text = readFileSync(src, 'utf8');
-        if (existsSync(dest) && readFileSync(dest, 'utf8') === text)
-            continue;
-        changed.push(rel);
-        if (check)
-            continue;
-        mkdirSync(path.dirname(dest), { recursive: true });
-        const real = realpathSync(path.dirname(dest));
-        if (path.relative(realpathSync(root), real).startsWith('..'))
-            throw new Error(`${rel} resolves outside the repository`);
-        writeFileSync(dest, text);
-        if (rel.startsWith('.githooks/'))
-            chmodSync(dest, 0o755);
-    }
-    return changed;
-}
-//# sourceMappingURL=sync.js.map

package/dist/workflow/sync.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sync.js","sourceRoot":"","sources":["../../src/workflow/sync.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,UAAU,EACV,SAAS,EACT,SAAS,EACT,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,QAAQ,EACR,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEhD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;AAC1D,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAEzF,qHAAqH;AACrH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAU,EAAE,EAAE;QACxC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACnC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;YACjD,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;gBAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;;gBAC5C,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1C,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;IACxF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,qHAAqH;AACrH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,KAAK,GAAG,KAAK;IACtD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAClC,IAAI,SAAS,CAAC,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,cAAc,EAAE;YAC9D,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,0CAA0C,CAAC,CAAC;QACpE,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACvC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,IAAI;YAAE,SAAS;QACtE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClB,IAAI,KAAK;YAAE,SAAS;QACpB,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9C,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,kCAAkC,CAAC,CAAC;QAC5D,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC1B,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC;YAAE,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/workflow/tests.d.ts

@@ -1,2 +0,0 @@
-/** New test files must be pure-function unit tests. Behavior is specified in feature files. */
-export declare const unlistedTests: (added: readonly string[], unitTests: readonly string[]) => string[];

package/dist/workflow/tests.js

@@ -1,6 +0,0 @@
-import { matchesAny } from './glob.js';
-/** New test files must be pure-function unit tests. Behavior is specified in feature files. */
-export const unlistedTests = (added, unitTests) => added
-    .filter((f) => /\.(?:test|spec)\.[cm]?[jt]sx?$/.test(f) && !matchesAny(f, unitTests))
-    .map((f) => `${f}: a new test file must be a pure-function unit test (${unitTests.join(', ')}). Specify behavior in a feature file`);
-//# sourceMappingURL=tests.js.map

package/dist/workflow/tests.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"tests.js","sourceRoot":"","sources":["../../src/workflow/tests.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC,+FAA+F;AAC/F,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAAwB,EAAE,SAA4B,EAAE,EAAE,CACtF,KAAK;KACF,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gCAAgC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;KACpF,GAAG,CACF,CAAC,CAAC,EAAE,EAAE,CACJ,GAAG,CAAC,wDAAwD,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,uCAAuC,CAC1H,CAAC"}

package/templates/repo/claude/_claude/agents/security-reviewer.md

@@ -1,33 +0,0 @@
----
-name: security-reviewer
-description: Reviews a change to a Synoikia plugin, or to this repository's release workflow, for security problems and known CVEs in its dependencies. Use proactively before opening or merging a PR that touches plugins/*/manifest.json, plugins/*/plugin.yaml, plugins/*/src, a plugin's dependencies or .github/workflows; or when asked for a security review or dependency audit.
-tools: Read, Grep, Glob, Bash
----
-
-You review changes to Synoikia plugins for security problems. You are read-only: never edit files, commit, push or change the environment. Use Bash only for read-only commands (`git diff`, `git log`, `pnpm audit`, `pnpm why`, `pnpm ls`) and for running existing tests.
-
-## The trust model
-
-Synoikia core runs every plugin as a permission-confined child and puts every call through its own sandbox, permission gate, human approvals, redaction and audit log. Core enforces policy based on what the plugin tells it. A plugin that labels a destructive call `read`, leaves a secret out of `sensitiveKeys`, or writes a misleading approval summary weakens every install, and core can't detect it. Most findings are cases where the plugin gave core wrong information.
-
-## Scope
-
-Start from the diff you were given, otherwise `git diff origin/main...HEAD` plus uncommitted changes. Read the plugin's `manifest.json` and `plugin.yaml` in full whenever its `src/` changes.
-
-## What to check
-
-- **Classification** (`plugin.yaml` rules, discovery in `src/`): no operation with side effects is labeled read, including GETs that act. Destructive or hard-to-undo operations are `locked`. Unknown operations fail closed. A `classification: read` override needs a reason; removing a `locked`, `sensitiveParams` or `sensitiveResult` rule, or widening `include` past an `exclude`, is a finding unless the PR justifies it. `splitWhen` predicates must fail closed (unknown means the locked twin).
-- **Request building**: model-supplied arguments cannot change the host, scheme or port, path parameters are encoded, model arguments cannot set auth headers, and the operation key core gated is the one invoked.
-- **Summaries and confirm literals**: the approval shows exactly what will be affected; a literal names the thing at risk, and crafted params can't make it misleading. Summaries never contain secrets.
-- **Secrets**: every credential field is `writeOnly`, uses the `secret` widget and is in `sensitiveKeys`; every secret field the upstream returns is in `sensitiveKeys` or a `sensitiveResult` rule, with an e2e check. Credentials never appear in errors, logs or catalog text, and are never sent to any host but the upstream.
-- **Network**: `network.hosts` is minimal; TLS verification is on by default.
-- **Staying inside core's model**: no plugin-side allow/deny lists, approval prompts or caching that serves data after core denied a call; no `eval`, `new Function` or dynamic imports; nothing loaded from disk at runtime (`plugin.yaml` is inlined at build time).
-- **Untrusted upstream data**: specs, JSON and frames are untrusted; look for prototype pollution, unbounded sizes and YAML beyond plain data.
-
-## Known vulnerabilities
-
-Run `pnpm audit --json` and `pnpm audit --prod`. For each advisory, `pnpm why <package>`: a plugin's `dependencies` are bundled and ship to every install, so judge reachability; `devDependencies` run only in CI. Give the advisory ID, affected and patched ranges, the dependency path and the smallest fix. If the audit can't reach the registry, say so.
-
-## Reporting
-
-Report only issues tied to concrete code or a concrete advisory: severity (critical, high, medium, low), location, what breaks, a scenario, and the smallest fix with the test that would catch a regression. If there are none, say so and list what you checked.

package/templates/repo/claude/_claude/hooks/format.mjs

@@ -1,20 +0,0 @@
-// PostToolUse hook: runs Prettier on the file just edited, so `pnpm format:check` in CI stays green.
-// Prettier skips files in .prettierignore and unknown types; a failure here never blocks the edit.
-import { execFileSync } from 'node:child_process';
-import { existsSync } from 'node:fs';
-import path from 'node:path';
-
-let input = '';
-for await (const chunk of process.stdin) input += chunk;
-const { tool_input: toolInput = {}, cwd } = JSON.parse(input || '{}');
-const root = process.env.CLAUDE_PROJECT_DIR ?? cwd ?? process.cwd();
-const prettier = path.join(root, 'node_modules/.bin/prettier');
-const file = toolInput.file_path;
-
-if (file && existsSync(file) && existsSync(prettier)) {
-  try {
-    execFileSync(prettier, ['--write', '--ignore-unknown', '--log-level=warn', file], { cwd: root, stdio: 'ignore' });
-  } catch {
-    // A file Prettier can't parse is left as written; lint and format:check will report it.
-  }
-}

package/templates/repo/claude/_claude/hooks/guard-paths.mjs

@@ -1,43 +0,0 @@
-// PreToolUse hook: stops edits to generated files and asks before edits to the signing key.
-// Reads the tool call from stdin; prints a permission decision for matching paths, nothing otherwise.
-import path from 'node:path';
-
-const RULES = [
-  {
-    match: /(^|\/)pnpm-lock\.yaml$/,
-    decision: 'deny',
-    reason: 'pnpm-lock.yaml is generated. Change package.json and run `pnpm install` instead.',
-  },
-  {
-    match: /^plugins\/[^/]+\/dist\//,
-    decision: 'deny',
-    reason: 'dist/ is the esbuild bundle. Edit src/ and run `pnpm --filter ./plugins/<id> build`.',
-  },
-  {
-    match: /^minisign\.pub$/,
-    decision: 'ask',
-    reason:
-      'minisign.pub is the key every Synoikia install pins for this repository. Changing it blocks installs until each admin confirms the new key; only for a compromised key.',
-  },
-];
-
-let input = '';
-for await (const chunk of process.stdin) input += chunk;
-const { tool_input: toolInput = {}, cwd } = JSON.parse(input || '{}');
-const file = toolInput.file_path ?? toolInput.notebook_path;
-if (!file) process.exit(0);
-
-const root = process.env.CLAUDE_PROJECT_DIR ?? cwd ?? process.cwd();
-const rel = path.relative(root, path.resolve(root, file)).split(path.sep).join('/');
-const rule = RULES.find((r) => r.match.test(rel));
-if (!rule) process.exit(0);
-
-console.log(
-  JSON.stringify({
-    hookSpecificOutput: {
-      hookEventName: 'PreToolUse',
-      permissionDecision: rule.decision,
-      permissionDecisionReason: `${rel}: ${rule.reason}`,
-    },
-  }),
-);

package/templates/repo/claude/_claude/skills/add-plugin/SKILL.md

@@ -1,39 +0,0 @@
----
-name: add-plugin
-description: Scaffold a new Synoikia plugin under plugins/<id> with `pnpm new`, then fill in its plugin.yaml rules, discovery and tests. Use when asked to add, create or start a plugin for a new upstream service.
----
-
-# Add a plugin
-
-## 1. Settle the basics
-
-- **`<id>`**: lowercase, the directory name and manifest `id`; the sandbox namespace defaults to it in camelCase.
-- **Archetype**: `openapi-rest` (the upstream serves an OpenAPI spec), `static-rest` (a REST API without one; operations are declared in `plugin.yaml`), `websocket-rpc` (JSON-RPC over WebSocket), or `blank`.
-- **Auth**: `bearer`, `api-key` (with its header), `basic` or `none`.
-- **Destructive operations**: which ones are `locked` (always a human who types a confirmation literal), and what that literal is.
-- **Secrets**: which connection fields are credentials, and which fields the upstream returns hold secrets.
-
-## 2. Scaffold
-
-```sh
-pnpm new --id <id> --name "<Name>" --archetype <archetype> --auth <auth> --yes
-```
-
-This writes `plugins/<id>/` (manifest, `plugin.yaml`, `src/`, a fake upstream, unit and e2e tests) and runs `pnpm install`. The generated plugin already builds and passes its tests.
-
-## 3. Describe the upstream
-
-- `manifest.json`: connection fields and help, `sensitiveKeys` (add every secret field the upstream returns), `network.hosts`.
-- `plugin.yaml`: `rules` for locks, splits, classification overrides, `sensitiveParams`, `sensitiveResult`, `confirm` literals and summary notes; `exclude` for plumbing the model has no business calling. A rule's `classification` can never unlock a locked operation, and anything unclassified is a write.
-- `src/plugin.ts`: only what needs logic, such as a `splitWhen` predicate or a custom confirm source.
-
-## 4. Tests
-
-Extend `test/fake-upstream.ts` to answer what the plugin calls, including responses with secrets. Fill in `test/compliance.yaml`: a case for each locked operation, and each secret the fake returns. Core's compliance suite must print that the plugin is fit for production. Specify plugin-specific behavior in `features/*.feature` with the suite's steps (`docs/plugin-authoring.md`).
-
-```sh
-pnpm --filter ./plugins/<id> test
-pnpm typecheck && pnpm lint && pnpm format:check
-```
-
-Then run the `security-reviewer` subagent on the diff.

package/templates/repo/claude/_claude/skills/release-plugin/SKILL.md

@@ -1,18 +0,0 @@
----
-name: release-plugin
-description: Prepare a plugin release by bumping its version in manifest.json and package.json together, and optionally its minimum Synoikia version. Use when asked to release, publish, ship or bump the version of a plugin.
----
-
-# Release a plugin
-
-A release is a version bump merged to `main`; the Release workflow packs, signs, verifies and publishes every plugin whose version isn't in the published index yet (see `RELEASING.md`).
-
-1. **Pick the version** with semver against the last release (`git log --oneline -- plugins/<id>`):
-   - patch: fixes, catalog corrections, wording;
-   - minor: new operations, connection fields or capabilities; also any `plugin.yaml` change that unlocks an operation, drops a `sensitiveParams`/`sensitiveResult` rule or overrides a classification to read (call it out in the PR);
-   - major: a change that breaks existing instances, such as a renamed operation key or a removed connection field.
-2. **Bump both files to the same version**: `plugins/<id>/manifest.json` and `plugins/<id>/package.json`.
-3. **Minimum Synoikia version**, only when the change needs a newer core: `"synoikia": { "minCoreVersion": "x.y.z" }` in `package.json`. A newer SDK means bumping the manifest `sdk` range together with the `@synoikia/plugin-sdk` range, then `pnpm install`.
-4. **Verify**: `pnpm --filter ./plugins/<id> test`, then `pnpm typecheck && pnpm lint && pnpm format:check`.
-
-Released versions are immutable. Never touch `minisign.pub` or the signing steps of the workflow.

package/templates/workflow/base/_githooks/pre-commit

@@ -1,3 +0,0 @@
-#!/bin/sh
-# Refuses credential files by name, then scans the staged changes with gitleaks when it is installed.
-exec pnpm run --silent workflow pre-commit

package/templates/workflow/base/_githooks/pre-push

@@ -1,4 +0,0 @@
-#!/bin/sh
-# Runs the workflow checks that CI runs, except the red check. ALLOW_WORKFLOW=1 skips them once.
-[ "${ALLOW_WORKFLOW:-}" = "1" ] && exit 0
-exec pnpm run --silent workflow pre-push

package/templates/workflow/base/_github/workflows/workflow.yml

@@ -1,45 +0,0 @@
-# Written by `synoikia-plugin workflow sync`. Edit the template in via-justa/synoikia-core instead.
-name: Workflow
-
-on:
-  pull_request:
-    types: [opened, edited, synchronize, reopened, ready_for_review, labeled, unlabeled]
-
-permissions:
-  contents: read
-
-jobs:
-  workflow:
-    runs-on: ubuntu-latest
-    env:
-      BACKFILL: ${{ contains(github.event.pull_request.labels.*.name, 'backfill') && '--backfill' || '' }}
-      BASE: ${{ github.event.pull_request.base.sha }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
-          fetch-depth: 0
-          persist-credentials: false
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version-file: .nvmrc
-          cache: pnpm
-      - run: pnpm install --frozen-lockfile
-      - run: pnpm workflow check-branch
-      - run: pnpm workflow check-features --base "$BASE" $BACKFILL
-      - run: pnpm workflow check-prose --base "$BASE" --pr-body
-      - run: pnpm workflow check-security-line --base "$BASE"
-      - run: pnpm workflow check-phases --base "$BASE" --red-green $BACKFILL
-
-  gitleaks:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-      - uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2.3.9
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GITLEAKS_ENABLE_COMMENTS: false

package/templates/workflow/base/docs/workflow.md

@@ -1,100 +0,0 @@
-# Workflow
-
-This repository builds every change spec first and test first. The rules below bind every contributor. CI checks them on each pull request. The git hooks run the same checks before a commit and a push.
-
-`synoikia-plugin workflow sync` writes this file from `@synoikia/create-plugin`. Do not edit it here. Change the template in `via-justa/synoikia-core` instead.
-
-## Steps
-
-One change is one slice: one rule of one feature, with three scenarios at most. Each slice gets its own branch and pull request.
-
-1. **Spec.** Write the scenarios in a feature file. Commit them as `spec: …`.
-2. **Architecture and plan.** Write the build plan: the slices in order, and the existing code each one reuses. Put it in the pull request description. Place the slice in the model in `docs/architecture/` when it adds or moves a part. Commit as `arch: …`.
-3. **Red.** Write the step definitions. Run the scenarios and see them fail because the behavior is missing. Commit as `test: …`.
-4. **Green.** Write the least code that makes the scenarios pass. Use existing code that does the same work. Commit as `feat: …` or `fix: …`.
-5. **Refactor.** Clean up with the scenarios green. Extract code that duplicates the same behavior into one shared function. Commit as `refactor: …`.
-6. **Pull request.** Push and open the pull request. Fill in the template.
-
-## Commits
-
-Each commit belongs to one phase. Its subject starts with the phase, and it changes only the files of that phase.
-
-| Prefix                 | Changes                                                            |
-| ---------------------- | ------------------------------------------------------------------ |
-| `spec:`                | Feature files only                                                 |
-| `arch:`                | The architecture model only                                        |
-| `test:`                | Step definitions, the World and unit tests only                    |
-| `feat:` `fix:`         | Code. Not feature files and not the model                          |
-| `refactor:`            | Code with the scenarios green. Not feature files and not the model |
-| `docs:` `chore:` `ci:` | Documents, tooling and CI. Not feature files and not the model     |
-
-A `feat:` or `fix:` commit that changes product code needs a `test:` commit before it. CI checks out that `test:` commit and runs its feature files. They must fail there. CI then runs them at the head of the branch, where they must pass.
-
-A requirement that turns out wrong while you build is not worked around. Change it in its own `spec:` commit, where the reviewer sees it.
-
-Pull requests merge by rebase, so every commit lands on `main`. A `spec:` or `test:` commit is red by design. Skip it in `git bisect` with `git bisect skip`.
-
-## Branches
-
-A branch name is `<component>/<summary>` in lowercase kebab-case. The summary is two to four words about the whole change: `core/auth-refactoring`.
-
-- The component is the package or plugin where the most important change lands, or `ci`, `docs`, `skills` or `deps`.
-- Do not use generated names, random words, session IDs or dates.
-- After a pull request merges, start follow-up work on a new branch.
-
-## Feature files
-
-Feature files live in `features/<domain>/<feature>.feature` inside the package or plugin they specify. Steps and the World live next to them, in `features/**/*.ts`.
-
-- **One feature per file, with an `@id:<kebab-case>` tag.** Other files refer to the feature by this id. The id never changes after a push.
-- **Every scenario is in a `Rule:`.** A rule groups the scenarios that show one business rule.
-- **Write outcomes, not solutions.** Say what someone can do and what they see. Do not name screens, clicks, endpoints, status codes, wire formats or tables.
-- **Write short scenarios.** Use five steps at most, with one `When` and one `Then`. A `Background:` has four steps at most.
-- **Use real values from the World.** Name the World's things, not a category. Write `Given the instance "nas-01" has 3 pools`, not `Given an instance with pools`.
-- **Write what someone can see in a `Then`.** Name what the admin, the agent or the upstream service observes, not an internal verdict.
-- **Use the field's standard terms and the glossary's words.** Use each term with one meaning.
-- **Tags.** Use only `@id:<kebab-case>`, `@backlog`, `@long-running` and `@exclusive`. `@backlog` marks a scenario not built yet, `@long-running` a slow scenario, and `@exclusive` a scenario that must run alone in its test process.
-- **No comments.** Put an explanation in the feature narrative.
-
-Scenarios run in vitest through quickpickle. They drive the product through its real interface: the MCP endpoints, the Admin API, the plugin entry or the portal in a browser. They never call internal services and never mock internal modules.
-
-## Tests
-
-Feature files are the only behavior tests. A new `*.test.ts` file must be a pure-function unit test in a `test/unit/` directory. Do not test libraries, frameworks or third-party APIs.
-
-## Writing
-
-All prose follows ASD-STE100 Simplified Technical English. This includes documents, skills, feature files and pull request descriptions.
-
-- Write short sentences: 20 words at most for an instruction, 25 for a description.
-- Write one instruction per sentence. Use the active voice and approved plain words.
-- Do not use semicolons. Write two sentences.
-- Do not use em dashes.
-- Write one topic per paragraph.
-- Do not repeat a fact. Link to the place that states it.
-- Prefer tables and lists to long paragraphs.
-
-## Security
-
-- Do not commit credential files. The pre-commit hook refuses `.env` files, private keys and secret files by name. CI runs gitleaks on every pull request.
-- A pull request that changes a security path needs a line of its own in its description: `Security audit: <boundary and findings>` or `Security audit: none. <why>`. The paths are in `synoikia.workflow.securityPaths` in the root `package.json`.
-
-## Checks
-
-Install the git hooks once per clone:
-
-```sh
-pnpm hooks:install
-```
-
-The hooks run the `workflow` script of the branch that you have checked out. Before you check out a pull request from someone you do not trust, read its changes to `.githooks/` and `package.json`.
-
-| Command                                    | Checks                                                       |
-| ------------------------------------------ | ------------------------------------------------------------ |
-| `pnpm workflow check-branch`               | The branch name                                              |
-| `pnpm workflow check-phases --base main`   | Commit prefixes and phases. `--red-green` runs the red check |
-| `pnpm workflow check-features --base main` | Feature files, the slice size and new test files             |
-| `pnpm workflow check-prose --base main`    | The writing rules on added lines                             |
-| `pnpm workflow pre-push`                   | All of the above, as the pre-push hook runs them             |
-
-A pull request labelled `backfill` specifies behavior that exists already. Its scenarios pass at once, so CI skips the red check and the slice size for it.