@theholocron/astromech 5.0.0-alpha.107 → 5.0.0-alpha.109

package/README.md

@@ -192,6 +192,27 @@ template. `holocron setup` writes the result via the `source` capability;
 this method never touches the filesystem beyond reading `packages/*` and
 `apps/*` under `cwd`.
 
+## Release-time deploys — `deployOnRelease`
+
+Deploys the workspace packages whose manifest declares it (holocron#930):
+
+```ts
+// packages/<app>/holocron.config.ts
+tasks: [{ name: "delivery.deploy", with: { on: "release", channel: "alpha" } }];
+```
+
+`holocron deploy-on-release --channel=<alpha|main> --from=<previous release commit> --to=<release commit>`
+(or `deployOnRelease()` from `@theholocron/astromech`) deploys each such package
+when the release is on its `channel` (default `main`, the stable release;
+set `alpha` for prereleases) and changes the package or one of its `workspace:*` dependencies
+(`with.paths` overrides that), once npm serves the release's new dependency
+versions, by running `pnpm --filter <package> delivery.deploy`. A package
+that doesn't apply to the release is skipped; a deploy that fails exits
+non-zero. The shared `delivery.publish` workflow runs it as a separate `deploy`
+job after the release job (opt in with `deploy-on-release: true`), so a deploy
+is its own re-runnable check. A `delivery.deploy` task with `on: "release"`
+generates no workflow.
+
 ## Development
 
 | Script                                  | Description                                 |

package/dist/config/index.mjs

@@ -1,5 +1,5 @@
-import { t as normalizeTaskEntry } from "../schema-Cf5dfaDO.mjs";
-import { createDefineConfig, loadConfigFile, mergeConfig } from "@theholocron/datapad";
+import { n as mergeTasksLayers, r as normalizeTaskEntry, t as loadTasksConfig } from "../load-XHHfD9TX.mjs";
+import { createDefineConfig } from "@theholocron/datapad";
 //#region src/config/define.ts
 /**
 * Typed identity helper for `astromech.config.ts`:
@@ -14,36 +14,4 @@ import { createDefineConfig, loadConfigFile, mergeConfig } from "@theholocron/da
 */
 const defineConfig = createDefineConfig();
 //#endregion
-//#region src/config/load.ts
-/**
-* Resolve the task manifest for a repo: the `tasks` key of
-* `holocron.config.*`, then a dedicated `astromech.config.*` merged on
-* top (dedicated wins; item arrays concatenate). Returns `{}` when
-* neither source is present.
-*/
-async function loadTasksConfig(cwd) {
-	const dedicated = await loadConfigFile({
-		cwd,
-		name: "astromech"
-	});
-	return mergeTasksLayers((await loadConfigFile({
-		cwd,
-		name: "holocron"
-	}))?.config.tasks, dedicated?.config);
-}
-/**
-* The merge step of {@link loadTasksConfig}, for callers that load the two
-* sources some other way (Sentinel reads them from the GitHub API, not
-* from disk, holocron#916): `holocron.config.*`'s `tasks` value first,
-* then a dedicated `astromech.config.*`'s default export merged on top.
-* Either may be `undefined` (source absent); returns `{}` when both are.
-*/
-function mergeTasksLayers(parentTasks, dedicated) {
-	return [coerce(parentTasks), coerce(dedicated)].filter((layer) => layer !== void 0).reduce((acc, layer) => mergeConfig(acc, layer), {});
-}
-function coerce(value) {
-	if (value == null) return void 0;
-	return Array.isArray(value) ? { tasks: value } : value;
-}
-//#endregion
 export { defineConfig, loadTasksConfig, mergeTasksLayers, normalizeTaskEntry };

package/dist/index.d.mts

@@ -398,6 +398,53 @@ declare function createCodecovConfig(packages: WorkspacePackage[]): string;
  */
 declare function codecovConfig(repoRoot: string, existing: string | null): string;
 //#endregion
+//#region src/deploy-on-release.d.ts
+interface SpawnResult {
+  status: number | null;
+  stdout: string;
+  stderr: string;
+}
+type Run = (command: string, args: string[], options: Record<string, unknown>) => SpawnResult;
+interface Tree {
+  readJson: (path: string) => unknown;
+  listDirs: (path: string) => string[];
+}
+interface DeployOnReleaseOptions {
+  cwd: string;
+  /** The release's channel: its prerelease identifier (`alpha`); empty or `main` for a stable release. */
+  channel: string;
+  /** The previous release's commit; omitted when there is none, so every deploying channel match deploys. */
+  from?: string;
+  /** The release commit. Default `HEAD`. */
+  to?: string;
+  /** Where progress lines go (stdout in the CLI). */
+  print: (line: string) => void;
+  dryRun?: boolean;
+}
+interface DeployOnReleaseDeps extends Partial<Tree> {
+  run?: Run;
+  sleep?: (ms: number) => Promise<void>;
+  now?: () => number;
+  /** Reads a package folder's task manifest; `loadTasksConfig` by default. */
+  loadTasks?: (dir: string) => Promise<TasksConfig>;
+}
+interface DeployOnReleaseResult {
+  pkg: string;
+  status: "ok" | "fail" | "skip" | "dry-run";
+  message: string;
+}
+interface DeployOnReleaseReport {
+  /** `fail` if any package's deploy failed; `skip` if none applied to this release; else `ok`. */
+  status: "ok" | "fail" | "skip";
+  results: DeployOnReleaseResult[];
+}
+/**
+ * Deploys every package whose manifest declares a release-time deploy that
+ * applies to this release. Never throws for a deploy problem: each package's
+ * outcome is in the report, and `status: "fail"` is the caller's exit code.
+ */
+declare function deployOnRelease(options: DeployOnReleaseOptions, { run, readJson, listDirs, sleep, now, loadTasks }?: DeployOnReleaseDeps): Promise<DeployOnReleaseReport>;
+//#endregion
 //#region src/linters.d.ts
 /**
  * The linter registry — one list of linter names (from `config.tasks`'
@@ -739,4 +786,4 @@ interface TsconfigOptions {
  */
 declare function createTsconfig(options: TsconfigOptions): string;
 //#endregion
-export { type Astromech, type AstromechOptions, CI_ORDER, type CiJobReport, type CiOptions, type CiReport, type ExecFn, type JobDef, KNOWN_TASKS, KNOWN_WORKFLOWS, LINTERS, LINTER_NAMES, type LinterDef, type LocalRunner, type OrgContext, type PreviewConfig, RESOLVABLE_TOOLS, REUSABLE_ACTIONS, REUSABLE_WORKFLOWS, type ResolverDeps, type RunLogger, type RunOptions, type RunTaskInput, type RunTaskReport, TASKS, type TaskDef, type TsconfigOptions, WORKFLOW_CHECK_CONTEXTS, WORKFLOW_TEMPLATES, WORKFLOW_TEMPLATE_PROPERTIES, type WorkspacePackage, codecovComponentBlock, codecovConfig, createAstromech, createCodecovConfig, createTsconfig, deriveDeployPaths, ensureIfNotFound, extractPreviewConfig, generateCombinedDeployContent, generateThinCallerContent, mergeCodecovComponents, normalizeWorkflowWith, readWorkspacePackages, requiredChecks, resolveLinters, resolveToolConfig, reusableTemplates, runCi, runTask };
+export { type Astromech, type AstromechOptions, CI_ORDER, type CiJobReport, type CiOptions, type CiReport, type DeployOnReleaseOptions, type DeployOnReleaseReport, type DeployOnReleaseResult, type ExecFn, type JobDef, KNOWN_TASKS, KNOWN_WORKFLOWS, LINTERS, LINTER_NAMES, type LinterDef, type LocalRunner, type OrgContext, type PreviewConfig, RESOLVABLE_TOOLS, REUSABLE_ACTIONS, REUSABLE_WORKFLOWS, type ResolverDeps, type RunLogger, type RunOptions, type RunTaskInput, type RunTaskReport, TASKS, type TaskDef, type TsconfigOptions, WORKFLOW_CHECK_CONTEXTS, WORKFLOW_TEMPLATES, WORKFLOW_TEMPLATE_PROPERTIES, type WorkspacePackage, codecovComponentBlock, codecovConfig, createAstromech, createCodecovConfig, createTsconfig, deployOnRelease, deriveDeployPaths, ensureIfNotFound, extractPreviewConfig, generateCombinedDeployContent, generateThinCallerContent, mergeCodecovComponents, normalizeWorkflowWith, readWorkspacePackages, requiredChecks, resolveLinters, resolveToolConfig, reusableTemplates, runCi, runTask };

package/dist/index.mjs

@@ -1,7 +1,7 @@
-import { t as normalizeTaskEntry } from "./schema-Cf5dfaDO.mjs";
+import { r as normalizeTaskEntry, t as loadTasksConfig } from "./load-XHHfD9TX.mjs";
 import { spawnSync } from "node:child_process";
 import { existsSync, readFileSync, readdirSync } from "node:fs";
-import { join } from "node:path";
+import { join, relative } from "node:path";
 //#region src/registry.ts
 const TASKS = {
 	"verification.unitTests": {
@@ -1415,7 +1415,7 @@ var setup_node_default = "name: Setup Node\ndescription: Install pnpm and Node.j
 */
 /** `workflow_call` implementations → `.github/workflows/<name>.yml`. */
 const REUSABLE_WORKFLOWS = {
-	"verification.unitTests": "name: Test\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      run-unit:\n        description: Run unit tests with coverage (disable for UI-only repos that use Storybook testing exclusively)\n        type: boolean\n        required: false\n        default: true\n      run-storybook:\n        description: Run Storybook vitest interaction tests (requires .storybook/ setup)\n        type: boolean\n        required: false\n        default: false\n      run-interaction:\n        description: Run Storybook interaction and accessibility tests with Playwright\n        type: boolean\n        required: false\n        default: false\n      run-chromatic:\n        description: Publish Storybook to Chromatic for visual regression testing\n        type: boolean\n        required: false\n        default: false\n      chromatic-projects:\n        description: >\n          JSON array of Chromatic projects to build, one matrix job per entry.\n          Each entry: { \"tokenName\": \"WEB\", \"workingDir\": \"apps/web\", \"buildScript\": \"build:storybook\" }.\n          tokenName maps to secret CHROMATIC_PROJECT_TOKEN_<TOKENNAME>; use \"default\"\n          (or omit for the legacy empty-string form) to use the bare CHROMATIC_PROJECT_TOKEN\n          secret for single-project repos.\n          buildScript defaults to \"build:storybook\" when omitted.\n          Default runs a single job from the repo root using CHROMATIC_PROJECT_TOKEN.\n        type: string\n        required: false\n        default: '[{\"tokenName\":\"default\",\"workingDir\":\".\",\"buildScript\":\"build:storybook\"}]'\n      run-user-flow:\n        description: Run Cypress E2E user-flow tests (requires cypress.config.*)\n        type: boolean\n        required: false\n        default: false\n      wait-on-url:\n        description: URL to wait for before running Cypress tests (default is Vite dev server; override for non-Vite stacks e.g. http://localhost:3000 for Next.js)\n        type: string\n        required: false\n        default: \"http://localhost:5173\"\n    secrets:\n      CHROMATIC_PROJECT_TOKEN:\n        required: false\n      CYPRESS_RECORD_KEY:\n        required: false\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  unit:\n    name: Run unit tests and collect coverage\n    if: ${{ inputs.run-unit }}\n    permissions:\n      contents: read\n      id-token: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Run tests with coverage\n        with:\n          task: verification.unitTests\n\n      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0\n        name: Upload coverage to Codecov\n        with:\n          use_oidc: true\n\n      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0\n        name: Upload test results to Codecov\n        if: ${{ !cancelled() }}\n        with:\n          use_oidc: true\n          report_type: test_results\n          files: \"**/test-report.junit.xml\"\n\n  storybook:\n    name: Run Storybook interaction tests\n    if: ${{ inputs.run-storybook }}\n    permissions:\n      contents: read\n      id-token: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: pnpm exec playwright install chromium --with-deps\n        name: Install Playwright\n\n      - run: pnpm test:storybook\n        name: Run Storybook tests\n\n      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0\n        name: Upload coverage to Codecov\n        with:\n          use_oidc: true\n\n      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0\n        name: Upload test results to Codecov\n        if: ${{ !cancelled() }}\n        with:\n          use_oidc: true\n          report_type: test_results\n          files: \"**/test-report.junit.xml\"\n\n  visual-and-composition:\n    # No explicit matrix reference here — a skipped job (run-chromatic:\n    # false, the common case) never expands its matrix, so a `${{\n    # matrix.project.tokenName }}` in name: has nothing to resolve and\n    # shows as raw template text in the checks UI. GitHub auto-appends\n    # the matrix values in parens when the matrix *does* expand, so this\n    # loses no distinctness across multiple Chromatic projects.\n    name: Run visual and composition tests\n    if: ${{ inputs.run-chromatic }}\n    strategy:\n      fail-fast: false\n      matrix:\n        project: ${{ fromJSON(inputs.chromatic-projects) }}\n    permissions:\n      contents: read\n      statuses: write\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: chromaui/action@14cfaef73576e69f95f47f60058063f46ca38719 # v18\n        name: Publish to Chromatic\n        with:\n          projectToken: ${{ (matrix.project.tokenName == 'default' || matrix.project.tokenName == '') && secrets.CHROMATIC_PROJECT_TOKEN || secrets[format('CHROMATIC_PROJECT_TOKEN_{0}', matrix.project.tokenName)] }}\n          token: ${{ github.token }}\n          buildScriptName: ${{ matrix.project.buildScript || 'build:storybook' }}\n          workingDir: ${{ matrix.project.workingDir || '.' }}\n          storybookBaseDir: ${{ matrix.project.storybookBaseDir || '' }}\n          untraced: ${{ matrix.project.untraced || '' }}\n          onlyStoryFiles: ${{ matrix.project.onlyStoryFiles || '' }}\n          exitZeroOnChanges: ${{ matrix.project.exitZeroOnChanges || false }}\n\n  interaction-and-accessibility:\n    name: Run interactions and accessibility tests\n    if: ${{ inputs.run-interaction }}\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: pnpm exec playwright install --with-deps\n        name: Install Playwright\n\n      - run: pnpm test:storybook\n        name: Run interaction and accessibility tests\n\n  user-flow:\n    name: Run user flow tests\n    if: ${{ inputs.run-user-flow }}\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    strategy:\n      fail-fast: false\n      matrix:\n        containers: [1, 2]\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: pnpm exec cypress install\n        name: Install Cypress binary\n\n      - uses: cypress-io/github-action@1052aa98bbbe4f55210f844878213c07d9c8c399 # v6.7.13\n        name: Cypress run\n        with:\n          start: pnpm dev\n          wait-on: ${{ inputs.wait-on-url }}\n          record: true\n          parallel: true\n        env:\n          CYPRESS_RECORD_KEY: ${{ secrets.CYPRESS_RECORD_KEY }}\n          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n\n  conclusion:\n    name: Conclusion\n    runs-on: ubuntu-latest\n    if: always()\n    needs: [unit, storybook, visual-and-composition, interaction-and-accessibility, user-flow]\n    steps:\n      - name: Check job statuses\n        run: |\n          if [[ \"$RESULTS\" == *\"failure\"* ]] || [[ \"$RESULTS\" == *\"cancelled\"* ]]; then\n            exit 1\n          fi\n        env:\n          RESULTS: ${{ join(needs.*.result, ',') }}\n",
+	"verification.unitTests": "name: Test\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      run-unit:\n        description: Run unit tests with coverage (disable for UI-only repos that use Storybook testing exclusively)\n        type: boolean\n        required: false\n        default: true\n      run-storybook:\n        description: Run Storybook vitest interaction tests (requires .storybook/ setup)\n        type: boolean\n        required: false\n        default: false\n      run-interaction:\n        description: Run Storybook interaction and accessibility tests with Playwright\n        type: boolean\n        required: false\n        default: false\n      run-chromatic:\n        description: Publish Storybook to Chromatic for visual regression testing\n        type: boolean\n        required: false\n        default: false\n      chromatic-projects:\n        description: >\n          JSON array of Chromatic projects to build, one matrix job per entry.\n          Each entry: { \"tokenName\": \"WEB\", \"workingDir\": \"apps/web\", \"buildScript\": \"build:storybook\" }.\n          tokenName maps to secret CHROMATIC_PROJECT_TOKEN_<TOKENNAME>; use \"default\"\n          (or omit for the legacy empty-string form) to use the bare CHROMATIC_PROJECT_TOKEN\n          secret for single-project repos.\n          buildScript defaults to \"build:storybook\" when omitted.\n          Default runs a single job from the repo root using CHROMATIC_PROJECT_TOKEN.\n        type: string\n        required: false\n        default: '[{\"tokenName\":\"default\",\"workingDir\":\".\",\"buildScript\":\"build:storybook\"}]'\n      run-user-flow:\n        description: Run Cypress E2E user-flow tests (requires cypress.config.*)\n        type: boolean\n        required: false\n        default: false\n      wait-on-url:\n        description: URL to wait for before running Cypress tests (default is Vite dev server; override for non-Vite stacks e.g. http://localhost:3000 for Next.js)\n        type: string\n        required: false\n        default: \"http://localhost:5173\"\n    secrets:\n      CHROMATIC_PROJECT_TOKEN:\n        required: false\n      CYPRESS_RECORD_KEY:\n        required: false\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  unit:\n    name: Run unit tests and collect coverage\n    if: ${{ inputs.run-unit }}\n    permissions:\n      contents: read\n      id-token: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Run tests with coverage\n        with:\n          task: verification.unitTests\n\n      # A Codecov upload must not fail silently. fail_ci_if_error makes a failed\n      # upload fail this step (the action's default is to log the error and pass),\n      # which fails the job and so the `Test / Conclusion` check. Whether that\n      # blocks a merge is up to whether the check is required, not this workflow\n      # (holocron#934).\n      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0\n        name: Upload coverage to Codecov\n        with:\n          use_oidc: true\n          fail_ci_if_error: true\n\n      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0\n        name: Upload test results to Codecov\n        if: ${{ !cancelled() }}\n        with:\n          use_oidc: true\n          fail_ci_if_error: true\n          report_type: test_results\n          files: \"**/test-report.junit.xml\"\n\n  storybook:\n    name: Run Storybook interaction tests\n    if: ${{ inputs.run-storybook }}\n    permissions:\n      contents: read\n      id-token: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: pnpm exec playwright install chromium --with-deps\n        name: Install Playwright\n\n      - run: pnpm test:storybook\n        name: Run Storybook tests\n\n      # A Codecov upload must not fail silently. fail_ci_if_error makes a failed\n      # upload fail this step (the action's default is to log the error and pass),\n      # which fails the job and so the `Test / Conclusion` check. Whether that\n      # blocks a merge is up to whether the check is required, not this workflow\n      # (holocron#934).\n      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0\n        name: Upload coverage to Codecov\n        with:\n          use_oidc: true\n          fail_ci_if_error: true\n\n      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0\n        name: Upload test results to Codecov\n        if: ${{ !cancelled() }}\n        with:\n          use_oidc: true\n          fail_ci_if_error: true\n          report_type: test_results\n          files: \"**/test-report.junit.xml\"\n\n  visual-and-composition:\n    # No explicit matrix reference here — a skipped job (run-chromatic:\n    # false, the common case) never expands its matrix, so a `${{\n    # matrix.project.tokenName }}` in name: has nothing to resolve and\n    # shows as raw template text in the checks UI. GitHub auto-appends\n    # the matrix values in parens when the matrix *does* expand, so this\n    # loses no distinctness across multiple Chromatic projects.\n    name: Run visual and composition tests\n    if: ${{ inputs.run-chromatic }}\n    strategy:\n      fail-fast: false\n      matrix:\n        project: ${{ fromJSON(inputs.chromatic-projects) }}\n    permissions:\n      contents: read\n      statuses: write\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: chromaui/action@14cfaef73576e69f95f47f60058063f46ca38719 # v18\n        name: Publish to Chromatic\n        with:\n          projectToken: ${{ (matrix.project.tokenName == 'default' || matrix.project.tokenName == '') && secrets.CHROMATIC_PROJECT_TOKEN || secrets[format('CHROMATIC_PROJECT_TOKEN_{0}', matrix.project.tokenName)] }}\n          token: ${{ github.token }}\n          buildScriptName: ${{ matrix.project.buildScript || 'build:storybook' }}\n          workingDir: ${{ matrix.project.workingDir || '.' }}\n          storybookBaseDir: ${{ matrix.project.storybookBaseDir || '' }}\n          untraced: ${{ matrix.project.untraced || '' }}\n          onlyStoryFiles: ${{ matrix.project.onlyStoryFiles || '' }}\n          exitZeroOnChanges: ${{ matrix.project.exitZeroOnChanges || false }}\n\n  interaction-and-accessibility:\n    name: Run interactions and accessibility tests\n    if: ${{ inputs.run-interaction }}\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: pnpm exec playwright install --with-deps\n        name: Install Playwright\n\n      - run: pnpm test:storybook\n        name: Run interaction and accessibility tests\n\n  user-flow:\n    name: Run user flow tests\n    if: ${{ inputs.run-user-flow }}\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    strategy:\n      fail-fast: false\n      matrix:\n        containers: [1, 2]\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: pnpm exec cypress install\n        name: Install Cypress binary\n\n      - uses: cypress-io/github-action@1052aa98bbbe4f55210f844878213c07d9c8c399 # v6.7.13\n        name: Cypress run\n        with:\n          start: pnpm dev\n          wait-on: ${{ inputs.wait-on-url }}\n          record: true\n          parallel: true\n        env:\n          CYPRESS_RECORD_KEY: ${{ secrets.CYPRESS_RECORD_KEY }}\n          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n\n  conclusion:\n    name: Conclusion\n    runs-on: ubuntu-latest\n    if: always()\n    needs: [unit, storybook, visual-and-composition, interaction-and-accessibility, user-flow]\n    steps:\n      - name: Check job statuses\n        run: |\n          if [[ \"$RESULTS\" == *\"failure\"* ]] || [[ \"$RESULTS\" == *\"cancelled\"* ]]; then\n            exit 1\n          fi\n        env:\n          RESULTS: ${{ join(needs.*.result, ',') }}\n",
 	"verification.typeSafety": "name: Typecheck\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  typecheck:\n    name: Run tsc --noEmit\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Type check\n        with:\n          task: verification.typeSafety\n",
 	"verification.performance": "name: Audit the Performance\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      lighthouse-config:\n        description: >\n          Path to the Lighthouse CI config file, forwarded to `holocron run\n          verification.performance -- --config`. Defaults to\n          lighthouse.config.cjs (the org standard).\n        type: string\n        required: false\n        default: lighthouse.config.cjs\n    secrets:\n      LHCI_GITHUB_APP_TOKEN:\n        required: false\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  performance:\n    name: Run Lighthouse CI\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n      # Read by `lhci autorun` inside `holocron run verification.performance`.\n      LHCI_GITHUB_APP_TOKEN: ${{ secrets.LHCI_GITHUB_APP_TOKEN }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: npm install -g @lhci/cli@0.14.x\n        name: Install Lighthouse CLI\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Run Lighthouse CI\n        with:\n          task: verification.performance\n          args: --config=${{ inputs.lighthouse-config }}\n",
 	"sourceQuality.staticAnalysis": "name: Static Analysis\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      enable-auto-commit:\n        description: >\n          Auto-commit eslint --fix results as a verified commit via a GitHub App.\n          Requires SUPER_LINTER_APP_ID and SUPER_LINTER_PRIVATE_KEY secrets\n          (same App used across every formatting-capable task — D12).\n        type: boolean\n        required: false\n        default: false\n    secrets:\n      SUPER_LINTER_APP_ID:\n        required: false\n      SUPER_LINTER_PRIVATE_KEY:\n        required: false\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  static-analysis:\n    name: Run eslint and actionlint\n    permissions:\n      contents: write\n      statuses: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n      APP_ID_SET: ${{ secrets.SUPER_LINTER_APP_ID != '' }}\n    steps:\n      - name: Generate GitHub App token\n        id: app-token\n        if: >\n          inputs.enable-auto-commit == true &&\n          github.event.pull_request != null &&\n          github.event.pull_request.head.repo.full_name == github.repository &&\n          github.ref_name != github.event.repository.default_branch &&\n          env.APP_ID_SET == 'true'\n        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0\n        with:\n          app-id: ${{ secrets.SUPER_LINTER_APP_ID }}\n          private-key: ${{ secrets.SUPER_LINTER_PRIVATE_KEY }}\n\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n          token: ${{ steps.app-token.outputs.token || github.token }}\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      # actionlint has no npm distribution — install the prebuilt binary via\n      # the maintainer's own documented download script.\n      # NOTE: unverified against a live CI run at authoring time (D12) — flag\n      # here if this needs adjustment.\n      - name: Install actionlint\n        run: |\n          bash <(curl -sSf https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)\n          sudo mv ./actionlint /usr/local/bin/actionlint\n\n      - name: Check for merge-conflict markers\n        # No package distributes this as a standalone tool — a plain grep for\n        # the marker lines (the same check the old bundled linter ran, D12).\n        run: |\n          if grep -rlnE '^(<{7}|={7}|>{7})( |$)' \\\n            --exclude-dir=.git --exclude-dir=node_modules .; then\n            echo \"::error::merge-conflict markers found\"\n            exit 1\n          fi\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Run eslint and actionlint\n        with:\n          task: sourceQuality.staticAnalysis\n\n      - uses: theholocron/.github/.github/actions/auto-commit@main\n        name: Commit and push eslint --fix\n        if: >\n          inputs.enable-auto-commit == true &&\n          github.event.pull_request != null &&\n          github.event.pull_request.head.repo.full_name == github.repository &&\n          github.ref_name != github.event.repository.default_branch &&\n          env.APP_ID_SET == 'true' &&\n          steps.app-token.conclusion == 'success'\n        with:\n          token: ${{ steps.app-token.outputs.token }}\n          branch: ${{ github.event.pull_request.head.ref || github.head_ref || github.ref }}\n          commit-message: \"chore: fix static-analysis issues\"\n          commit-options: \"--no-verify\"\n",
@@ -1425,7 +1425,7 @@ const REUSABLE_WORKFLOWS = {
 	"security.secretDetection": "name: Secret Detection\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  secret-detection:\n    name: Run gitleaks\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n\n      # gitleaks has no npm distribution — install the prebuilt binary via\n      # the maintainer's own documented install script.\n      # NOTE: unverified against a live CI run at authoring time (D12) — flag\n      # here if this needs adjustment.\n      - name: Install gitleaks\n        run: |\n          curl -sSfL https://raw.githubusercontent.com/gitleaks/gitleaks/master/install.sh | sh -s -- -b /usr/local/bin\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Run gitleaks\n        with:\n          task: security.secretDetection\n",
 	"security.codeScanning": "name: Security\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      language:\n        description: CodeQL language to analyze\n        type: string\n        required: false\n        default: javascript-typescript\n\njobs:\n  analyze:\n    name: Analyze (${{ inputs.language }})\n    permissions:\n      actions: read\n      contents: read\n      security-events: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 45\n    # Do not cancel in-progress security scans.\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0\n        name: Initialize CodeQL\n        with:\n          languages: ${{ inputs.language }}\n\n      - uses: github/codeql-action/autobuild@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0\n        name: Autobuild\n\n      - uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0\n        name: Analyze\n        with:\n          category: /language:${{ inputs.language }}\n",
 	"delivery.build": "name: Build\n\n# Sanity check that every workspace actually compiles to dist/ — doesn't\n# upload or publish anything. delivery.publish builds again before\n# publishing; this just answers \"does it build?\" on every push/PR.\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  build:\n    name: Build every workspace\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Build\n        with:\n          task: delivery.build\n",
-	"delivery.publish": "name: Release\n\n# Semantic-release with OIDC Trusted Publishing.\n# actions/setup-node writes a default NODE_AUTH_TOKEN=${{ github.token }}\n# which shadows OIDC auth. We explicitly clear it so npm falls through to\n# the Trusted Publisher OIDC exchange.\n# The calling repo must have a .releaserc.json that configures branches,\n# plugins, and any publish options. npm@11+ is installed to support OIDC.\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      dry-run:\n        description: >\n          When true, runs semantic-release --dry-run: analyzes commits and\n          previews the next release without git writes or publish. Only\n          meaningful for workflow_dispatch triggers; push-triggered runs\n          always run fully.\n        type: boolean\n        required: false\n        default: false\n      post-release:\n        description: >\n          When true, dispatches a readme sync broadcast after a successful\n          release. Enable for packages consumed by other repos via the\n          registry-doc system so downstream README installation blocks\n          stay current.\n        type: boolean\n        required: false\n        default: false\n      run-build:\n        description: Run `pnpm build` before releasing\n        type: boolean\n        required: false\n        default: true\n      deploy-on-release:\n        description: >\n          When true, passes VERCEL_TOKEN into the semantic-release step so the\n          repo's own deploy-on-release plugin (holocron#928) can deploy once\n          the release has published. Off by default, so a repo that doesn't\n          deploy from its release never exposes the token to its release\n          plugins.\n        type: boolean\n        required: false\n        default: false\n      sentry-project:\n        description: >\n          Sentry project slug for sourcemap upload and release creation after\n          publishing. Omit to skip the Sentry release step entirely.\n        type: string\n        required: false\n        default: \"\"\n    secrets:\n      HOLOCRON_RELEASE_TOKEN:\n        description: >\n          Fine-grained PAT (Contents + Issues + Pull requests: write) owned by\n          an admin. Required when the default branch is protected by a ruleset —\n          github.token cannot push through rulesets, but an admin PAT can.\n          Takes priority over HOLOCRON_SYNC_TOKEN. Falls back to github.token.\n        required: false\n      HOLOCRON_SYNC_TOKEN:\n        description: >\n          Legacy alias for HOLOCRON_RELEASE_TOKEN — kept for backward compatibility.\n          Prefer HOLOCRON_RELEASE_TOKEN for new repos.\n        required: false\n      HOLOCRON_READ_TOKEN:\n        description: >\n          Fine-grained PAT for read-only GitHub API calls (e.g. resolving git\n          committer identity via `gh api user`). Falls back to github.token.\n        required: false\n      GH_TOKEN:\n        description: >\n          Generic GitHub token fallback for `gh` CLI calls. Used when\n          HOLOCRON_READ_TOKEN is not set.\n        required: false\n      SENTRY_AUTH_TOKEN:\n        description: >\n          Sentry auth token for sourcemap upload and release creation.\n          Required when sentry-project is set. Use the org-level secret.\n        required: false\n      TURBO_TOKEN:\n        required: false\n      VERCEL_TOKEN:\n        description: >\n          Vercel token for the repo's deploy-on-release plugin. Only passed to\n          the release step when deploy-on-release is true.\n        required: false\n\njobs:\n  release:\n    name: Semantic release\n    permissions:\n      contents: write\n      id-token: write\n      issues: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    # Do not cancel in-progress releases — a partial release is worse than a slow one.\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n          persist-credentials: false\n          # Use HOLOCRON_RELEASE_TOKEN when available — git push (tags, release commits)\n          # uses the checkout credential, not GITHUB_TOKEN env var. The\n          # built-in github.token cannot push through branch protection rulesets.\n          token: ${{ secrets.HOLOCRON_RELEASE_TOKEN || secrets.HOLOCRON_SYNC_TOKEN || github.token }}\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - name: Configure git identity\n        run: |\n          GIT_NAME=$(gh api user --jq .name 2>/dev/null || echo \"github-actions[bot]\")\n          GIT_EMAIL=$(gh api user --jq '\"\\(.id)+\\(.login)@users.noreply.github.com\"' 2>/dev/null || echo \"41898282+github-actions[bot]@users.noreply.github.com\")\n          git config --global user.name \"$GIT_NAME\"\n          git config --global user.email \"$GIT_EMAIL\"\n          git config --global format.signoff true\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_READ_TOKEN || secrets.GH_TOKEN || github.token }}\n\n      - name: Upgrade npm for OIDC support\n        run: npm install -g npm@11 sigstore\n        # sigstore is required by libnpmpublish/provenance.js at module parse\n        # time — before any config takes effect. Some npm 11.x builds stopped\n        # bundling it; installing it globally into the same prefix ensures it\n        # resolves regardless of npm version. (Discovered 2026-07-09.)\n\n      - run: pnpm build\n        name: Build\n        if: ${{ inputs.run-build == true }}\n\n      - name: Release\n        id: release\n        run: |\n          BEFORE=$(git rev-parse HEAD)\n          if [ \"$DRY_RUN\" = \"true\" ]; then\n            npx semantic-release --dry-run\n          else\n            npx semantic-release\n          fi\n          AFTER=$(git rev-parse HEAD)\n          # semantic-release only commits (`chore(release): … [skip ci]`) when it\n          # actually publishes. That commit gets no CI (and so no coverage\n          # upload), which makes the next PR's `codecov/project` compare a full\n          # report against a stale ancestor — a phantom drop (holocron#644).\n          # Emit the new SHA so the steps below upload coverage for it.\n          if [ \"$BEFORE\" != \"$AFTER\" ]; then echo \"commit=$AFTER\" >> \"$GITHUB_OUTPUT\"; fi\n        env:\n          DRY_RUN: ${{ inputs.dry-run }}\n          # Prefer HOLOCRON_RELEASE_TOKEN (fine-grained PAT, Contents+Issues+PRs write,\n          # owned by an admin with ruleset bypass) so @semantic-release/git can\n          # push the version-bump commit through branch protection. Falls back to\n          # HOLOCRON_SYNC_TOKEN (legacy) then github.token for unprotected repos.\n          GITHUB_TOKEN: ${{ secrets.HOLOCRON_RELEASE_TOKEN || secrets.HOLOCRON_SYNC_TOKEN || github.token }}\n          HUSKY: \"0\"\n          NPM_CONFIG_PROVENANCE: true\n          # Read by a repo's own deploy-on-release semantic-release plugin\n          # (holocron#928) to deploy once the release has published. Empty\n          # unless the caller opts in with deploy-on-release, so other repos'\n          # release plugins never see the token.\n          VERCEL_TOKEN: ${{ inputs.deploy-on-release && secrets.VERCEL_TOKEN || '' }}\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Coverage for the release commit\n        if: ${{ steps.release.outputs.commit != '' }}\n        with:\n          task: verification.unitTests\n\n      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0\n        name: Upload release-commit coverage to Codecov\n        if: ${{ steps.release.outputs.commit != '' }}\n        with:\n          use_oidc: true\n          override_commit: ${{ steps.release.outputs.commit }}\n          override_branch: ${{ github.ref_name }}\n\n      - name: Get release version\n        id: release_version\n        if: ${{ inputs.sentry-project != '' && inputs.dry-run != true }}\n        env:\n          SENTRY_PROJECT: ${{ inputs.sentry-project }}\n        run: |\n          TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo \"\")\n          if [ -n \"$TAG\" ]; then\n            echo \"release=${SENTRY_PROJECT}@${TAG#v}\" >> \"$GITHUB_OUTPUT\"\n          fi\n\n      - name: Create Sentry release\n        if: ${{ inputs.sentry-project != '' && steps.release_version.outputs.release != '' && inputs.dry-run != true }}\n        uses: getsentry/action-release@ff07929a6537bac57790c3451cf4d364aca38528 # v3\n        env:\n          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}\n          SENTRY_ORG: theholocron\n          SENTRY_PROJECT: ${{ inputs.sentry-project }}\n        with:\n          environment: production\n          version: ${{ steps.release_version.outputs.release }}\n          sourcemaps: \"**/dist\"\n\n  sync-readme:\n    name: Post-release readme sync\n    needs: release\n    if: ${{ inputs.post-release == true && inputs.dry-run != true }}\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    steps:\n      - name: Trigger broadcast readme sync\n        run: |\n          gh workflow run sync-dispatch.yml \\\n            --repo theholocron/.github \\\n            --field \"steps=readme\"\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN }}\n",
+	"delivery.publish": "name: Release\n\n# Semantic-release with OIDC Trusted Publishing.\n# actions/setup-node writes a default NODE_AUTH_TOKEN=${{ github.token }}\n# which shadows OIDC auth. We explicitly clear it so npm falls through to\n# the Trusted Publisher OIDC exchange.\n# The calling repo must have a .releaserc.json that configures branches,\n# plugins, and any publish options. npm@11+ is installed to support OIDC.\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      dry-run:\n        description: >\n          When true, runs semantic-release --dry-run: analyzes commits and\n          previews the next release without git writes or publish. Only\n          meaningful for workflow_dispatch triggers; push-triggered runs\n          always run fully.\n        type: boolean\n        required: false\n        default: false\n      post-release:\n        description: >\n          When true, dispatches a readme sync broadcast after a successful\n          release. Enable for packages consumed by other repos via the\n          registry-doc system so downstream README installation blocks\n          stay current.\n        type: boolean\n        required: false\n        default: false\n      run-build:\n        description: Run `pnpm build` before releasing\n        type: boolean\n        required: false\n        default: true\n      deploy-on-release:\n        description: >\n          When true, runs a separate `deploy` job after a successful release\n          (holocron#930): `holocron deploy-on-release` deploys every workspace\n          package whose `delivery.deploy` task is `with: { on: release }`, when\n          the release is on its channel and changes its paths. The job is its\n          own check, re-runnable on its own, and gets VERCEL_TOKEN; the release\n          job never sees it. Off by default, so a repo that doesn't deploy from\n          its release never exposes the token.\n        type: boolean\n        required: false\n        default: false\n      sentry-project:\n        description: >\n          Sentry project slug for sourcemap upload and release creation after\n          publishing. Omit to skip the Sentry release step entirely.\n        type: string\n        required: false\n        default: \"\"\n    secrets:\n      HOLOCRON_RELEASE_TOKEN:\n        description: >\n          Fine-grained PAT (Contents + Issues + Pull requests: write) owned by\n          an admin. Required when the default branch is protected by a ruleset —\n          github.token cannot push through rulesets, but an admin PAT can.\n          Takes priority over HOLOCRON_SYNC_TOKEN. Falls back to github.token.\n        required: false\n      HOLOCRON_SYNC_TOKEN:\n        description: >\n          Legacy alias for HOLOCRON_RELEASE_TOKEN — kept for backward compatibility.\n          Prefer HOLOCRON_RELEASE_TOKEN for new repos.\n        required: false\n      HOLOCRON_READ_TOKEN:\n        description: >\n          Fine-grained PAT for read-only GitHub API calls (e.g. resolving git\n          committer identity via `gh api user`). Falls back to github.token.\n        required: false\n      GH_TOKEN:\n        description: >\n          Generic GitHub token fallback for `gh` CLI calls. Used when\n          HOLOCRON_READ_TOKEN is not set.\n        required: false\n      SENTRY_AUTH_TOKEN:\n        description: >\n          Sentry auth token for sourcemap upload and release creation.\n          Required when sentry-project is set. Use the org-level secret.\n        required: false\n      TURBO_TOKEN:\n        required: false\n      VERCEL_TOKEN:\n        description: >\n          Vercel token for the deploy job. Only used when deploy-on-release is\n          true, and only by that job.\n        required: false\n\njobs:\n  release:\n    name: Semantic release\n    permissions:\n      contents: write\n      id-token: write\n      issues: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    outputs:\n      # Read by the deploy job (holocron#930). Empty unless semantic-release\n      # published: `commit` is the release commit, `previous` the commit of\n      # the release before it (to diff against), `channel` the new version's\n      # prerelease identifier (`alpha`), empty for a stable release (`main`).\n      commit: ${{ steps.release.outputs.commit }}\n      previous: ${{ steps.release.outputs.previous }}\n      channel: ${{ steps.release.outputs.channel }}\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    # Do not cancel in-progress releases — a partial release is worse than a slow one.\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n          persist-credentials: false\n          # Use HOLOCRON_RELEASE_TOKEN when available — git push (tags, release commits)\n          # uses the checkout credential, not GITHUB_TOKEN env var. The\n          # built-in github.token cannot push through branch protection rulesets.\n          token: ${{ secrets.HOLOCRON_RELEASE_TOKEN || secrets.HOLOCRON_SYNC_TOKEN || github.token }}\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - name: Configure git identity\n        run: |\n          GIT_NAME=$(gh api user --jq .name 2>/dev/null || echo \"github-actions[bot]\")\n          GIT_EMAIL=$(gh api user --jq '\"\\(.id)+\\(.login)@users.noreply.github.com\"' 2>/dev/null || echo \"41898282+github-actions[bot]@users.noreply.github.com\")\n          git config --global user.name \"$GIT_NAME\"\n          git config --global user.email \"$GIT_EMAIL\"\n          git config --global format.signoff true\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_READ_TOKEN || secrets.GH_TOKEN || github.token }}\n\n      - name: Upgrade npm for OIDC support\n        run: npm install -g npm@11 sigstore\n        # sigstore is required by libnpmpublish/provenance.js at module parse\n        # time — before any config takes effect. Some npm 11.x builds stopped\n        # bundling it; installing it globally into the same prefix ensures it\n        # resolves regardless of npm version. (Discovered 2026-07-09.)\n\n      - run: pnpm build\n        name: Build\n        if: ${{ inputs.run-build == true }}\n\n      - name: Release\n        id: release\n        run: |\n          BEFORE=$(git rev-parse HEAD)\n          PREVIOUS_TAG=$(git describe --tags --abbrev=0 2>/dev/null || true)\n          PREVIOUS=\"\"\n          if [ -n \"$PREVIOUS_TAG\" ]; then PREVIOUS=$(git rev-list -n 1 \"$PREVIOUS_TAG\"); fi\n          if [ \"$DRY_RUN\" = \"true\" ]; then\n            npx semantic-release --dry-run\n          else\n            npx semantic-release\n          fi\n          AFTER=$(git rev-parse HEAD)\n          # semantic-release only commits (`chore(release): … [skip ci]`) when it\n          # actually publishes. That commit gets no CI (and so no coverage\n          # upload), which makes the next PR's `codecov/project` compare a full\n          # report against a stale ancestor — a phantom drop (holocron#644).\n          # Emit the new SHA so the steps below upload coverage for it.\n          if [ \"$BEFORE\" != \"$AFTER\" ]; then\n            echo \"commit=$AFTER\" >> \"$GITHUB_OUTPUT\"\n            echo \"previous=$PREVIOUS\" >> \"$GITHUB_OUTPUT\"\n            # The new version's channel: the prerelease identifier of its tag\n            # (v5.0.0-alpha.108 -> alpha), empty for a stable release.\n            VERSION=$(git describe --tags --abbrev=0)\n            VERSION=${VERSION#v}\n            CHANNEL=\"\"\n            case \"$VERSION\" in *-*) PRE=${VERSION#*-}; CHANNEL=${PRE%%.*} ;; esac\n            echo \"channel=$CHANNEL\" >> \"$GITHUB_OUTPUT\"\n          fi\n        env:\n          DRY_RUN: ${{ inputs.dry-run }}\n          # Prefer HOLOCRON_RELEASE_TOKEN (fine-grained PAT, Contents+Issues+PRs write,\n          # owned by an admin with ruleset bypass) so @semantic-release/git can\n          # push the version-bump commit through branch protection. Falls back to\n          # HOLOCRON_SYNC_TOKEN (legacy) then github.token for unprotected repos.\n          GITHUB_TOKEN: ${{ secrets.HOLOCRON_RELEASE_TOKEN || secrets.HOLOCRON_SYNC_TOKEN || github.token }}\n          HUSKY: \"0\"\n          NPM_CONFIG_PROVENANCE: true\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Coverage for the release commit\n        if: ${{ steps.release.outputs.commit != '' }}\n        with:\n          task: verification.unitTests\n\n      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0\n        name: Upload release-commit coverage to Codecov\n        if: ${{ steps.release.outputs.commit != '' }}\n        # fail_ci_if_error makes a failed upload fail this step, so it is visible, but\n        # continue-on-error keeps it from failing the job: the release has already\n        # published, and the Sentry release steps below must still run (holocron#934).\n        continue-on-error: true\n        with:\n          use_oidc: true\n          fail_ci_if_error: true\n          override_commit: ${{ steps.release.outputs.commit }}\n          override_branch: ${{ github.ref_name }}\n\n      - name: Get release version\n        id: release_version\n        if: ${{ inputs.sentry-project != '' && inputs.dry-run != true }}\n        env:\n          SENTRY_PROJECT: ${{ inputs.sentry-project }}\n        run: |\n          TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo \"\")\n          if [ -n \"$TAG\" ]; then\n            echo \"release=${SENTRY_PROJECT}@${TAG#v}\" >> \"$GITHUB_OUTPUT\"\n          fi\n\n      - name: Create Sentry release\n        if: ${{ inputs.sentry-project != '' && steps.release_version.outputs.release != '' && inputs.dry-run != true }}\n        uses: getsentry/action-release@ff07929a6537bac57790c3451cf4d364aca38528 # v3\n        env:\n          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}\n          SENTRY_ORG: theholocron\n          SENTRY_PROJECT: ${{ inputs.sentry-project }}\n        with:\n          environment: production\n          version: ${{ steps.release_version.outputs.release }}\n          sourcemaps: \"**/dist\"\n\n  deploy:\n    name: Deploy\n    needs: release\n    # Only after a release that actually published (`commit` is empty on a dry\n    # run or when nothing was released). A failed deploy fails only this job:\n    # the release is already on npm, and this job re-runs on its own.\n    if: ${{ inputs.deploy-on-release == true && inputs.dry-run != true && needs.release.outputs.commit != '' }}\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout the release commit\n        with:\n          ref: ${{ needs.release.outputs.commit }}\n          fetch-depth: 0\n          persist-credentials: false\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Deploy packages that deploy on release\n        env:\n          VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}\n        with:\n          command: deploy-on-release\n          args: >-\n            --channel=${{ needs.release.outputs.channel }}\n            --from=${{ needs.release.outputs.previous }}\n            --to=${{ needs.release.outputs.commit }}\n\n  sync-readme:\n    name: Post-release readme sync\n    needs: release\n    if: ${{ inputs.post-release == true && inputs.dry-run != true }}\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    steps:\n      - name: Trigger broadcast readme sync\n        run: |\n          gh workflow run sync-dispatch.yml \\\n            --repo theholocron/.github \\\n            --field \"steps=readme\"\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN }}\n",
 	"delivery.deploy": "name: Deploy\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      type:\n        description: \"Type of deployment: docs or storybook\"\n        required: true\n        type: string\n      storybook-projects:\n        description: >\n          JSON array of { \"name\"?, \"workingDir\", \"outputDir\"? } objects for storybook deploys.\n          Each is built via `pnpm -C <workingDir> build:storybook`. If \"name\" is provided the\n          output is placed under `sandbox/<name>/`; omit \"name\" for single-repo deploys and the\n          output lands directly in `sandbox/`.\n        type: string\n        required: false\n        default: \"[]\"\n      build-script:\n        description: pnpm script that builds the Storybook static output (single storybook, type:storybook only)\n        type: string\n        required: false\n        default: build:storybook\n      output-dir:\n        description: Directory where Storybook writes its static output (single storybook, type:storybook only)\n        type: string\n        required: false\n        default: storybook-static\n\njobs:\n  deploy:\n    name: Deploy\n    runs-on: ubuntu-latest\n    permissions:\n      contents: read\n      pages: write\n      id-token: write\n    environment:\n      name: github-pages\n      url: ${{ steps.deployment.outputs.page_url }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - name: Build docs site\n        if: ${{ inputs.type == 'docs' }}\n        run: pnpm -C docs build\n\n      - name: Build Storybook projects\n        if: ${{ inputs.storybook-projects != '[]' }}\n        env:\n          PROJECTS: ${{ inputs.storybook-projects }}\n        run: |\n          echo \"$PROJECTS\" | jq -c '.[]' | while IFS= read -r project; do\n            workingDir=$(echo \"$project\" | jq -r '.workingDir')\n            pnpm -C \"$workingDir\" build:storybook\n          done\n\n      - name: Build Storybook\n        if: ${{ inputs.type == 'storybook' && inputs.storybook-projects == '[]' }}\n        env:\n          BUILD_SCRIPT: ${{ inputs.build-script }}\n        run: pnpm run \"$BUILD_SCRIPT\"\n\n      - name: Assemble site\n        env:\n          DEPLOY_TYPE: ${{ inputs.type }}\n          PROJECTS: ${{ inputs.storybook-projects }}\n          STORYBOOK_OUTPUT_DIR: ${{ inputs.output-dir }}\n        run: |\n          mkdir -p _site\n          if [ \"$DEPLOY_TYPE\" = \"docs\" ]; then\n            cp -r docs/dist/. _site/\n          fi\n          if [ \"$PROJECTS\" != \"[]\" ]; then\n            echo \"$PROJECTS\" | jq -c '.[]' | while IFS= read -r project; do\n              name=$(echo \"$project\" | jq -r '.name // \"\"')\n              workingDir=$(echo \"$project\" | jq -r '.workingDir')\n              outputDir=$(echo \"$project\" | jq -r '.outputDir // \"storybook-static\"')\n              if [ -n \"$name\" ]; then\n                target=\"_site/sandbox/${name}\"\n              else\n                target=\"_site/sandbox\"\n              fi\n              mkdir -p \"$target\"\n              cp -r \"${workingDir}/${outputDir}/.\" \"$target/\"\n            done\n          elif [ \"$DEPLOY_TYPE\" = \"storybook\" ]; then\n            mkdir -p _site/sandbox\n            cp -r \"${STORYBOOK_OUTPUT_DIR}/.\" _site/sandbox/\n          fi\n\n      - uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1\n        name: Upload pages artifact\n        with:\n          path: _site\n\n      - uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5\n        id: deployment\n        name: Deploy to GitHub Pages\n",
 	"delivery.bundleSize": "name: Audit the Bundle Size\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      CODECOV_TOKEN:\n        required: false\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  bundle-size:\n    name: Upload bundle stats to Codecov\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n      # Read by the bundle-stats uploader inside `holocron run delivery.build`.\n      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Build and upload bundle stats\n        with:\n          task: delivery.build\n",
 	"platform.repoSync": "name: Sync\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      steps:\n        description: >\n          Sync steps to run (default: all). Valid values:\n          labels, properties, teams, topics, keywords, description, homepage, readme, workflows, wiki.\n          Pass a space-separated list to run a subset, e.g. \"readme\" or \"readme wiki\".\n        type: string\n        required: false\n    secrets:\n      HOLOCRON_ADMIN_TOKEN:\n        description: Fine-grained PAT with admin scopes (labels, properties, teams).\n        required: false\n      HOLOCRON_AXIOM_TOKEN:\n        description: >\n          Axiom API token. When set alongside the HOLOCRON_AXIOM_DATASET\n          repo/org variable, the CLI ships this run's structured logs to Axiom.\n          Falls back to the vendor-native AXIOM_TOKEN secret.\n        required: false\n      AXIOM_TOKEN:\n        description: Vendor-native fallback for HOLOCRON_AXIOM_TOKEN.\n        required: false\n      HOLOCRON_DEPLOY_TOKEN:\n        description: Fine-grained PAT for GitHub Pages configuration.\n        required: false\n      HOLOCRON_ISSUES_TOKEN:\n        description: Fine-grained PAT for issue management.\n        required: false\n      HOLOCRON_ORG_TOKEN:\n        description: Org-scoped fine-grained PAT for team sync and org properties.\n        required: false\n      HOLOCRON_READ_TOKEN:\n        description: Fine-grained PAT for read-only GitHub API calls.\n        required: false\n      HOLOCRON_SYNC_TOKEN:\n        required: false\n      GH_TOKEN:\n        description: >\n          Generic GitHub token fallback for gh CLI calls. Used when\n          HOLOCRON_SYNC_TOKEN is not set.\n        required: false\n\njobs:\n  sync:\n    name: Run holocron sync\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    permissions:\n      contents: write\n      pull-requests: write\n    # Job-level so the `holocron` composite action's steps inherit them.\n    env:\n      HOLOCRON_ADMIN_TOKEN: ${{ secrets.HOLOCRON_ADMIN_TOKEN }}\n      HOLOCRON_AXIOM_TOKEN: ${{ secrets.HOLOCRON_AXIOM_TOKEN || secrets.AXIOM_TOKEN }}\n      HOLOCRON_AXIOM_DATASET: ${{ vars.HOLOCRON_AXIOM_DATASET || vars.AXIOM_DATASET }}\n      POSTHOG_PROJECT_TOKEN: ${{ vars.POSTHOG_PROJECT_TOKEN }}\n      HOLOCRON_DEPLOY_TOKEN: ${{ secrets.HOLOCRON_DEPLOY_TOKEN }}\n      HOLOCRON_ISSUES_TOKEN: ${{ secrets.HOLOCRON_ISSUES_TOKEN }}\n      HOLOCRON_ORG_TOKEN: ${{ secrets.HOLOCRON_ORG_TOKEN }}\n      HOLOCRON_READ_TOKEN: ${{ secrets.HOLOCRON_READ_TOKEN }}\n      HOLOCRON_SYNC_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          token: ${{ secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN || github.token }}\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - name: Run holocron sync\n        # The `holocron` action resolves @theholocron/cli from node_modules (or\n        # builds the workspace when it's an unbuilt checkout — the holocron repo\n        # itself). `inputs.steps` is a space-separated list or empty; the\n        # `--steps <list>` arg is omitted when empty.\n        uses: theholocron/.github/.github/actions/holocron@main\n        with:\n          command: sync\n          args: ${{ inputs.steps != '' && format('--steps {0}', inputs.steps) || '' }}\n\n      - name: Format generated files\n        run: |\n          pnpm exec prettier --write README.md docs/src/content/docs/index.mdx 2>/dev/null || true\n          # `holocron sync` writes package.json fields (keywords, description,\n          # homepage) with a plain assignment, which appends new keys at the\n          # end — re-apply the canonical order the lint config enforces.\n          pnpm exec eslint --fix --no-warn-ignored package.json 2>/dev/null || true\n\n      - uses: theholocron/.github/.github/actions/auto-commit@main\n        id: auto-commit\n        name: Commit sync changes\n        with:\n          token: ${{ secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN || github.token }}\n          branch: chore/auto-sync\n          commit-message: \"chore: sync from holocron.config\"\n          commit-options: \"--no-verify\"\n\n      - name: Open PR if changes were committed\n        if: steps.auto-commit.outputs.changes-detected == 'true'\n        run: |\n          gh pr create \\\n            --title \"chore: sync README and repo metadata\" \\\n            --body \"Automated sync triggered by changes to config or package files. Merge to apply.\" \\\n            --base main \\\n            --head chore/auto-sync \\\n          || echo \"PR already open — branch updated.\"\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN || github.token }}\n\n      - name: Broadcast wiki sync if navbar changed\n        if: >-\n          steps.auto-commit.outputs.changes-detected == 'true' &&\n          github.event_name == 'push' &&\n          (inputs.steps == '' || contains(inputs.steps, 'wiki'))\n        run: |\n          if git diff HEAD~1 --name-only | grep -q 'fern/docs.yml'; then\n            gh workflow run sync-dispatch.yml \\\n              --repo theholocron/.github \\\n              --field \"steps=wiki\" \\\n            || echo \"skipping broadcast — insufficient permissions\"\n          fi\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN || github.token }}\n",
@@ -1739,6 +1739,7 @@ function createAstromech(options) {
 				const isDocsSite = entry.name === "knowledge.docs";
 				const isComponents = entry.name === "knowledge.components";
 				if (entry.ci === false || !KNOWN_WORKFLOWS.has(entry.name) && !isDocsSite && !isComponents) continue;
+				if (entry.name === "delivery.deploy" && entry.with?.["on"] === "release") continue;
 				const rawWith = isDocsSite ? {
 					preview: true,
 					...entry.with,
@@ -1790,6 +1791,257 @@ function createAstromech(options) {
 	};
 }
 //#endregion
+//#region src/deploy-on-release.ts
+/**
+* Deploy workspace packages once a release has published (holocron#930).
+*
+* A package opts in with a `delivery.deploy` task in its own `holocron.config`
+* whose `with.on` is `"release"`:
+*
+* ```ts
+* // packages/<app>/holocron.config.ts
+* tasks: [{ name: "delivery.deploy", with: { on: "release", channel: "alpha" } }];
+* ```
+*
+* `channel` defaults to `main` (a stable release); set a prerelease identifier
+* such as `alpha` to deploy those releases instead.
+*
+* The shared `delivery.publish` workflow runs this (`holocron deploy-on-release`)
+* as its own `deploy` job after the release job, so a deploy is a separate,
+* re-runnable check rather than a step buried in the release log. Each package
+* with such a task deploys when the release is on its `channel` and changes a file under its paths: the package itself plus its
+* `workspace:*` dependencies ({@link defaultPaths}), or an explicit
+* `with.paths`. It first waits for npm to serve the release's new versions of
+* those dependencies ({@link waitForPublished}) — the registry can lag a version
+* it has just accepted, and the deploy installs them — then runs
+* `pnpm --filter <package> delivery.deploy`.
+*
+* The release is already published by then, so a failed deploy can't undo it;
+* it fails this job instead, loudly and re-runnable on its own. A task is
+* `skip`ped (not failed) only when it doesn't apply to this release.
+*
+* A `delivery.deploy` task with `on: "release"` generates no CI workflow.
+*/
+/** A stable release (no prerelease identifier) is on `main`, the default channel for a task. */
+const MAIN_CHANNEL = "main";
+const DEPLOY_TASK = "delivery.deploy";
+/** How long to wait for npm to serve the release's versions, and how often to ask. */
+const WAIT_TIMEOUT_MS = 3e5;
+const WAIT_INTERVAL_MS = 1e4;
+/** Every package under `<repoRoot>/packages/*` with a readable, named `package.json`. */
+function workspacePackages(repoRoot, { readJson, listDirs }) {
+	const packagesDir = join(repoRoot, "packages");
+	return listDirs(packagesDir).flatMap((folder) => {
+		try {
+			const manifest = readJson(join(packagesDir, folder, "package.json"));
+			if (!manifest.name) return [];
+			return [{
+				name: manifest.name,
+				dir: join(packagesDir, folder),
+				version: manifest.version,
+				dependencies: manifest.dependencies ?? {}
+			}];
+		} catch {
+			return [];
+		}
+	});
+}
+/** The `workspace:*` dependencies of `pkg`, as workspace packages (with their current version). */
+function workspaceDependencies(pkg, all) {
+	const names = new Set(Object.entries(pkg.dependencies).filter(([, spec]) => String(spec).startsWith("workspace:")).map(([name]) => name));
+	return all.filter((candidate) => names.has(candidate.name));
+}
+/**
+* The paths a release must touch to redeploy `pkg` when its manifest doesn't
+* list them: its own folder plus the folder of every
+* {@link workspaceDependencies} entry. Derived rather than listed so a new or
+* dropped workspace dependency needs no second edit.
+*
+* @returns Repo-relative prefixes, each ending in `/`.
+*/
+function defaultPaths(repoRoot, pkg, all) {
+	return [pkg, ...workspaceDependencies(pkg, all)].map(({ dir }) => `${relative(repoRoot, dir)}/`);
+}
+/**
+* The packages whose manifest declares a release-time `delivery.deploy`
+* (`with.on === "release"`), with the task's options resolved.
+*/
+function deployTargets(packages, manifests) {
+	return packages.flatMap((pkg) => (manifests.get(pkg.dir)?.tasks ?? []).flatMap((item) => {
+		const entry = normalizeTaskEntry(item);
+		if (entry.name !== DEPLOY_TASK || entry.with?.["on"] !== "release") return [];
+		const { channel, paths } = entry.with;
+		return [{
+			pkg,
+			channel: typeof channel === "string" ? channel : MAIN_CHANNEL,
+			paths: Array.isArray(paths) ? paths.map(String) : void 0
+		}];
+	}));
+}
+/**
+* Waits until npm serves every `name@version` in `packages`, asking with
+* `npm view --prefer-online` (so npm's local cache can't answer for the
+* registry) every `intervalMs`, for up to `timeoutMs`.
+*
+* @returns The specs npm still doesn't serve; empty once all are available.
+*/
+async function waitForPublished({ packages, run, sleep, now, cwd, timeoutMs = WAIT_TIMEOUT_MS, intervalMs = WAIT_INTERVAL_MS }) {
+	const deadline = now() + timeoutMs;
+	let pending = packages.map(({ name, version }) => `${name}@${version}`);
+	for (;;) {
+		pending = pending.filter((spec) => {
+			const version = spec.slice(spec.lastIndexOf("@") + 1);
+			const result = run("npm", [
+				"view",
+				spec,
+				"version",
+				"--prefer-online"
+			], { cwd });
+			return !(result.status === 0 && result.stdout.trim() === version);
+		});
+		if (pending.length === 0 || now() + intervalMs > deadline) return pending;
+		await sleep(intervalMs);
+	}
+}
+/**
+* @param channel The release's channel: its prerelease identifier (`alpha`), or `main` for a stable release.
+* @param changedFiles `undefined` when there's no previous release to diff against.
+*/
+function shouldDeploy({ channel, configuredChannel, changedFiles, paths }) {
+	if (channel !== configuredChannel) return {
+		deploy: false,
+		reason: `channel "${channel}" isn't "${configuredChannel}"`
+	};
+	if (changedFiles === void 0) return {
+		deploy: true,
+		reason: "no previous release to diff against"
+	};
+	const touched = changedFiles.find((file) => paths.some((path) => file.startsWith(path)));
+	return touched ? {
+		deploy: true,
+		reason: `the release changes ${touched}`
+	} : {
+		deploy: false,
+		reason: `the release changes nothing under ${paths.join(", ")}`
+	};
+}
+const defaultRun = (command, args, opts) => spawnSync(command, args, {
+	encoding: "utf8",
+	...opts
+});
+const defaultReadJson = (path) => JSON.parse(readFileSync(path, "utf8"));
+const defaultListDirs = (path) => readdirSync(path, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
+const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/**
+* Deploys every package whose manifest declares a release-time deploy that
+* applies to this release. Never throws for a deploy problem: each package's
+* outcome is in the report, and `status: "fail"` is the caller's exit code.
+*/
+async function deployOnRelease(options, { run = defaultRun, readJson = defaultReadJson, listDirs = defaultListDirs, sleep = defaultSleep, now = Date.now, loadTasks = loadTasksConfig } = {}) {
+	const { cwd, from, print } = options;
+	const channel = options.channel || MAIN_CHANNEL;
+	const to = options.to ?? "HEAD";
+	const packages = workspacePackages(cwd, {
+		readJson,
+		listDirs
+	});
+	const manifests = /* @__PURE__ */ new Map();
+	for (const pkg of packages) try {
+		manifests.set(pkg.dir, await loadTasks(pkg.dir));
+	} catch (err) {
+		print(`${pkg.name}: couldn't read its task manifest (${err.message}); not deploying it.`);
+	}
+	const targets = deployTargets(packages, manifests);
+	if (targets.length === 0) {
+		print("No package declares a release-time delivery.deploy (with.on: release).");
+		return {
+			status: "skip",
+			results: []
+		};
+	}
+	let diff;
+	const changedFiles = () => {
+		if (diff) return diff;
+		if (!from) return diff = { files: void 0 };
+		const result = run("git", [
+			"diff",
+			"--name-only",
+			from,
+			to
+		], { cwd });
+		return diff = result.status === 0 ? { files: result.stdout.split("\n").filter(Boolean) } : {
+			files: [],
+			error: `git diff ${from} ${to} failed: ${result.stderr || result.status}`
+		};
+	};
+	const results = [];
+	const record = (pkg, status, message) => {
+		results.push({
+			pkg,
+			status,
+			message
+		});
+		print(`${status === "fail" ? "✗ " : ""}${pkg}: ${message}`);
+	};
+	for (const target of targets) {
+		const name = target.pkg.name;
+		const { files, error } = target.channel === channel ? changedFiles() : {
+			files: [],
+			error: void 0
+		};
+		if (error) {
+			record(name, "fail", error);
+			continue;
+		}
+		const decision = shouldDeploy({
+			channel,
+			configuredChannel: target.channel,
+			changedFiles: files,
+			paths: target.paths ?? defaultPaths(cwd, target.pkg, packages)
+		});
+		if (!decision.deploy) {
+			record(name, "skip", `not deploying: ${decision.reason}.`);
+			continue;
+		}
+		if (options.dryRun) {
+			record(name, "dry-run", `would deploy because ${decision.reason}.`);
+			continue;
+		}
+		const dependencies = workspaceDependencies(target.pkg, packages).flatMap(({ name: dep, version }) => version ? [{
+			name: dep,
+			version
+		}] : []);
+		print(`${name}: waiting for npm to serve ${dependencies.map((d) => `${d.name}@${d.version}`).join(", ") || "nothing"}.`);
+		const unpublished = await waitForPublished({
+			packages: dependencies,
+			run,
+			sleep,
+			now,
+			cwd
+		});
+		if (unpublished.length > 0) {
+			record(name, "fail", `npm still doesn't serve ${unpublished.join(", ")} after ${WAIT_TIMEOUT_MS / 6e4} minutes. Re-run this job once it does.`);
+			continue;
+		}
+		print(`${name}: deploying because ${decision.reason}.`);
+		const result = run("pnpm", [
+			"--filter",
+			name,
+			DEPLOY_TASK
+		], {
+			cwd,
+			env: process.env,
+			stdio: "inherit"
+		});
+		if (result.status === 0) record(name, "ok", "deployed.");
+		else record(name, "fail", `the deploy failed (exit ${result.status}).`);
+	}
+	return {
+		status: results.some((r) => r.status === "fail") ? "fail" : results.every((r) => r.status === "skip") ? "skip" : "ok",
+		results
+	};
+}
+//#endregion
 //#region src/tsconfig.ts
 /**
 * A package-level `tsconfig.json` — the uniform shape confirmed across
@@ -1817,4 +2069,4 @@ function createTsconfig(options) {
 	return JSON.stringify(config, null, 2) + "\n";
 }
 //#endregion
-export { CI_ORDER, KNOWN_TASKS, KNOWN_WORKFLOWS, LINTERS, LINTER_NAMES, RESOLVABLE_TOOLS, REUSABLE_ACTIONS, REUSABLE_WORKFLOWS, TASKS, WORKFLOW_CHECK_CONTEXTS, WORKFLOW_TEMPLATES, WORKFLOW_TEMPLATE_PROPERTIES, codecovComponentBlock, codecovConfig, createAstromech, createCodecovConfig, createTsconfig, deriveDeployPaths, ensureIfNotFound, extractPreviewConfig, generateCombinedDeployContent, generateThinCallerContent, mergeCodecovComponents, normalizeWorkflowWith, readWorkspacePackages, requiredChecks, resolveLinters, resolveToolConfig, reusableTemplates, runCi, runTask };
+export { CI_ORDER, KNOWN_TASKS, KNOWN_WORKFLOWS, LINTERS, LINTER_NAMES, RESOLVABLE_TOOLS, REUSABLE_ACTIONS, REUSABLE_WORKFLOWS, TASKS, WORKFLOW_CHECK_CONTEXTS, WORKFLOW_TEMPLATES, WORKFLOW_TEMPLATE_PROPERTIES, codecovComponentBlock, codecovConfig, createAstromech, createCodecovConfig, createTsconfig, deployOnRelease, deriveDeployPaths, ensureIfNotFound, extractPreviewConfig, generateCombinedDeployContent, generateThinCallerContent, mergeCodecovComponents, normalizeWorkflowWith, readWorkspacePackages, requiredChecks, resolveLinters, resolveToolConfig, reusableTemplates, runCi, runTask };

package/dist/load-XHHfD9TX.mjs

@@ -0,0 +1,44 @@
+import { loadConfigFile, mergeConfig } from "@theholocron/datapad";
+//#region src/config/schema.ts
+/** Normalise a `TaskConfigItem` to a full {@link TaskEntry} with defaults applied. */
+function normalizeTaskEntry(item) {
+	return {
+		ci: true,
+		local: true,
+		...typeof item === "string" ? { name: item } : item
+	};
+}
+//#endregion
+//#region src/config/load.ts
+/**
+* Resolve the task manifest for a repo: the `tasks` key of
+* `holocron.config.*`, then a dedicated `astromech.config.*` merged on
+* top (dedicated wins; item arrays concatenate). Returns `{}` when
+* neither source is present.
+*/
+async function loadTasksConfig(cwd) {
+	const dedicated = await loadConfigFile({
+		cwd,
+		name: "astromech"
+	});
+	return mergeTasksLayers((await loadConfigFile({
+		cwd,
+		name: "holocron"
+	}))?.config.tasks, dedicated?.config);
+}
+/**
+* The merge step of {@link loadTasksConfig}, for callers that load the two
+* sources some other way (Sentinel reads them from the GitHub API, not
+* from disk, holocron#916): `holocron.config.*`'s `tasks` value first,
+* then a dedicated `astromech.config.*`'s default export merged on top.
+* Either may be `undefined` (source absent); returns `{}` when both are.
+*/
+function mergeTasksLayers(parentTasks, dedicated) {
+	return [coerce(parentTasks), coerce(dedicated)].filter((layer) => layer !== void 0).reduce((acc, layer) => mergeConfig(acc, layer), {});
+}
+function coerce(value) {
+	if (value == null) return void 0;
+	return Array.isArray(value) ? { tasks: value } : value;
+}
+//#endregion
+export { mergeTasksLayers as n, normalizeTaskEntry as r, loadTasksConfig as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theholocron/astromech",
-  "version": "5.0.0-alpha.107",
+  "version": "5.0.0-alpha.109",
   "description": "The Holocron task runner — one task manifest drives `holocron run`, `holocron ci`, the CI workflows, package.json scripts, linters, and required checks.",
   "keywords": [
     "ci",
@@ -37,7 +37,7 @@
     "dist"
   ],
   "dependencies": {
-    "@theholocron/datapad": "5.0.0-alpha.107"
+    "@theholocron/datapad": "5.0.0-alpha.109"
   },
   "devDependencies": {
     "@theholocron/eslint-config": "^8.6.0",
@@ -53,7 +53,7 @@
     "tsdown": "^0.22.14",
     "typescript": "^5.9.3",
     "vitest": "^4.1.11",
-    "@theholocron/rollup-plugin-transform-template": "5.0.0-alpha.107"
+    "@theholocron/rollup-plugin-transform-template": "5.0.0-alpha.109"
   },
   "engines": {
     "node": ">=22"

package/dist/schema-Cf5dfaDO.mjs

@@ -1,11 +0,0 @@
-//#region src/config/schema.ts
-/** Normalise a `TaskConfigItem` to a full {@link TaskEntry} with defaults applied. */
-function normalizeTaskEntry(item) {
-	return {
-		ci: true,
-		local: true,
-		...typeof item === "string" ? { name: item } : item
-	};
-}
-//#endregion
-export { normalizeTaskEntry as t };