@theholocron/astromech 5.0.0-alpha.116 → 5.0.0-alpha.118

package/dist/index.mjs

@@ -2,1684 +2,1764 @@ import { r as normalizeTaskEntry, t as loadTasksConfig } from "./load-ytspboBj.m
 import { spawnSync } from "node:child_process";
 import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { join, relative } from "node:path";
-//#region src/registry.ts
-const TASKS = {
-	"verification.unitTests": {
-		local: {
-			tool: "vitest",
-			args: ["run"]
-		},
-		flags: { vitest: ["--coverage"] },
-		turbo: {
-			inputs: [
-				"src/**",
-				"vitest.config.ts",
-				"vitest.config.js",
-				"vitest.config.mjs",
-				"package.json"
-			],
-			outputs: ["test-report.junit.xml", "coverage/**"],
-			dependsOn: ["delivery.build", "^delivery.build"]
-		}
-	},
-	"verification.typeSafety": {
-		local: {
-			tool: "tsc",
-			args: ["--noEmit"]
-		},
-		turbo: {
-			inputs: ["src/**", "tsconfig.json"],
-			outputs: [],
-			dependsOn: ["^delivery.build"]
-		}
-	},
-	"verification.performance": { local: { detect: [{
-		when: /^lighthouse\.config\.(cjs|js|mjs|ts)$/,
-		tool: "lhci",
-		args: ["autorun"]
-	}, {
-		when: /^lighthouserc\.(cjs|js|mjs|json|yml|yaml)$/,
-		tool: "lhci",
-		args: ["autorun"]
-	}] } },
-	"sourceQuality.staticAnalysis": {
-		local: null,
-		linterGroup: [
-			"eslint",
-			"actionlint",
-			"git-merge-conflict-markers"
-		],
-		turbo: {
-			inputs: [
-				"src/**",
-				"eslint.config.ts",
-				"eslint.config.js",
-				"eslint.config.mjs",
-				"eslint.config.cjs"
-			],
-			outputs: [],
-			dependsOn: ["^delivery.build"]
-		}
-	},
-	"sourceQuality.formatting": {
-		local: null,
-		linterGroup: [
-			"prettier",
-			"editorconfig",
-			"markdownlint"
-		]
-	},
-	"sourceQuality.structuredDataValidation": {
-		local: null,
-		linterGroup: ["yamllint"]
-	},
-	"sourceQuality.deadCodeAnalysis": { local: { tool: "knip" } },
-	"security.secretDetection": {
-		local: null,
-		linterGroup: ["gitleaks"]
-	},
-	"security.codeScanning": { local: null },
-	"delivery.build": {
-		local: { detect: [
-			{
-				when: /^tsdown\.config\.(ts|js|mjs|cjs)$/,
-				tool: "tsdown"
-			},
-			{
-				when: /^vite\.config\.(ts|js|mjs|cjs)$/,
-				tool: "vite",
-				args: ["build"]
-			},
-			{
-				when: /^rollup\.config\.(ts|js|mjs|cjs)$/,
-				tool: "rollup",
-				args: ["-c"]
-			},
-			{
-				when: /^tsconfig\.json$/,
-				tool: "tsc",
-				args: ["-b"]
-			}
-		] },
-		turbo: {
-			inputs: [
-				"src/**",
-				"package.json",
-				"tsdown.config.ts",
-				"vite.config.ts",
-				"rollup.config.ts",
-				"tsconfig.json"
-			],
-			outputs: ["dist/**"],
-			dependsOn: ["^delivery.build"]
-		}
-	},
-	"delivery.publish": {
-		local: null,
-		preview: true
-	},
-	"delivery.deploy": {
-		local: null,
-		preview: true
-	},
-	"delivery.bundleSize": { local: null },
-	"platform.repoSync": { local: { command: "sync" } },
-	"platform.commitStandards": {
-		local: null,
-		linterGroup: ["commitlint"]
-	},
-	"platform.repoValidation": {
-		local: null,
-		jobs: {
-			adrs: {
-				local: {
-					tool: "node",
-					args: ["scripts/validate-adrs.mjs"]
-				},
-				checkContext: "platform.repoValidation / Validate ADRs and specs"
-			},
-			registry: {
-				local: {
-					tool: "node",
-					args: ["scripts/validate-registry.mjs"]
-				},
-				checkContext: "platform.repoValidation / Validate registry consistency"
-			},
-			docsPresence: {
-				local: {
-					tool: "node",
-					args: ["scripts/validate-docs-presence.mjs"]
-				},
-				checkContext: "platform.repoValidation / Validate docs presence"
-			}
-		}
-	},
-	"knowledge.wiki": {
-		local: { command: "sync-wiki" },
-		preview: true
-	},
-	"knowledge.docs": {
-		local: null,
-		preview: true
-	},
-	"knowledge.components": {
-		local: null,
-		preview: true
-	}
-};
-/** Every task name the registry knows. */
-const KNOWN_TASKS = new Set(Object.keys(TASKS));
-/**
-* The order `holocron ci` runs tasks in — cheapest / fastest signal first, so
-* an agent or a `pre-push` hook fails early. Tasks not listed here run last, in
-* manifest order. (The generated thin callers carry no `needs:` — cross-workflow
-* ordering lives in `theholocron/.github` — so `holocron ci` declares its own.)
-*/
-const CI_ORDER = [
-	"verification.typeSafety",
-	"sourceQuality.staticAnalysis",
-	"sourceQuality.formatting",
-	"sourceQuality.structuredDataValidation",
-	"security.secretDetection",
-	"platform.commitStandards",
-	"platform.repoValidation",
-	"verification.unitTests",
-	"delivery.build",
-	"sourceQuality.deadCodeAnalysis",
-	"delivery.bundleSize",
-	"verification.performance",
-	"security.codeScanning",
-	"delivery.deploy"
-];
-//#endregion
-//#region src/linters.ts
-/**
-* Known linters, in execution order. `always` entries are the current
-* hard-coded super-linter baseline; `prettier` is always-on because the org
-* applies it universally (super-linter only lints files that exist).
-*/
-const LINTERS = {
-	eslint: {
-		validate: ["VALIDATE_JAVASCRIPT_ES", "VALIDATE_TYPESCRIPT_ES"],
-		localBin: "eslint",
-		localArgs: ["."],
-		detect: [
-			"eslint.config.ts",
-			"eslint.config.js",
-			"eslint.config.mjs",
-			"eslint.config.cjs",
-			".eslintrc",
-			".eslintrc.json",
-			".eslintrc.yml",
-			".eslintrc.yaml",
-			".eslintrc.cjs"
-		],
-		configInput: "eslint-config"
-	},
-	prettier: {
-		validate: [
-			"VALIDATE_JAVASCRIPT_PRETTIER",
-			"VALIDATE_JSX_PRETTIER",
-			"VALIDATE_TYPESCRIPT_PRETTIER",
-			"VALIDATE_TSX",
-			"VALIDATE_MARKDOWN_PRETTIER"
-		],
-		fix: [
-			"FIX_JAVASCRIPT_PRETTIER",
-			"FIX_JSX_PRETTIER",
-			"FIX_TYPESCRIPT_PRETTIER",
-			"FIX_TSX",
-			"FIX_MARKDOWN_PRETTIER"
-		],
-		always: true,
-		localBin: "prettier",
-		localArgs: ["--check", "."],
-		configInput: "prettier-config"
-	},
-	yamllint: {
-		validate: ["VALIDATE_YAML"],
-		always: true,
-		localBin: "yamllint",
-		localArgs: ["."],
-		installHint: "brew install yamllint",
-		configInput: "yaml-config"
-	},
-	actionlint: {
-		validate: ["VALIDATE_GITHUB_ACTIONS"],
-		always: true,
-		localBin: "actionlint",
-		localArgs: [],
-		installHint: "brew install actionlint"
-	},
-	gitleaks: {
-		validate: ["VALIDATE_GITLEAKS"],
-		always: true,
-		localBin: "gitleaks",
-		localArgs: [
-			"dir",
-			"--no-banner",
-			"--config",
-			".gitleaks.toml"
-		],
-		installHint: "brew install gitleaks"
-	},
-	editorconfig: {
-		validate: ["VALIDATE_EDITORCONFIG"],
-		always: true,
-		localBin: "editorconfig-checker",
-		localArgs: [],
-		installHint: "brew install editorconfig-checker"
-	},
-	commitlint: {
-		validate: ["VALIDATE_GIT_COMMITLINT"],
-		always: true
-	},
-	"git-merge-conflict-markers": {
-		validate: ["VALIDATE_GIT_MERGE_CONFLICT_MARKERS"],
-		always: true
-	},
-	markdownlint: {
-		validate: ["VALIDATE_MARKDOWN"],
-		localBin: "markdownlint-cli2",
-		localArgs: ["**/*.md"],
-		detect: [
-			".markdownlint.json",
-			".markdownlint.jsonc",
-			".markdownlint.yaml",
-			".markdownlint.yml",
-			".markdownlint-cli2.jsonc",
-			".markdownlint-cli2.yaml",
-			".markdownlint-cli2.mjs"
-		]
-	}
-};
-/** Every linter name the registry knows. */
-const LINTER_NAMES = new Set(Object.keys(LINTERS));
+//#region src/templates/codecov/codecov.yml
+var codecov_default = "codecov:\n  require_ci_to_pass: true\n\ncoverage:\n  precision: 2\n  round: down\n  status:\n    project:\n      default:\n        target: auto\n        threshold: 2%\n        # Infra-only PRs (dep bumps, config, lockfile) touch no coverable code,\n        # so codecov produces no report to compare. Pass instead of blocking\n        # forever on a required check that will never post.\n        if_not_found: success\n    patch:\n      default:\n        target: 80%\n        if_not_found: success\n\ncomment:\n  layout: \"reach,diff,flags,components\"\n  behavior: default\n  require_changes: true\n\ncomponent_management:\n  default_rules:\n    statuses:\n      - type: patch\n        target: 80%\n        if_not_found: success\n  individual_components:\n";
+//#endregion
+//#region src/generators/codecov.ts
 /**
-* Resolve the linter set for a repo. An `explicit` list (from `config.tasks`)
-* picks the candidate set; otherwise the candidates are every `always` linter
-* plus every `detect`-gated linter whose filenames are present at the repo
-* root, OR whose mapped `@theholocron/*-config` package resolves per
-* {@link sharedConfigAvailable} — a repo can't run eslint with genuinely no
-* config anywhere (super-linter FATALs if you ask it to,
-* theholocron/holocron#654), but a *shared* one it has installed counts
-* (holocron#795: proving `clients`' eslint.config.ts files reduce to zero
-* remaining content is only half the story — the file itself was still load-
-* bearing here as the sole "eslint is even configured" signal until this
-* fallback existed). `always` linters are unconditional. Result is ordered
-* by {@link LINTERS} declaration order.
-*
-* `sharedConfigAvailable` is caller-computed (`run.ts`'s `runLinterGroup`
-* already resolves each linter's `resolveToolConfig()` per member to build
-* its actual command — reusing that instead of duplicating the package-
-* resolution logic here keeps this function itself pure and file-I/O-free).
-*
-* @throws when an `explicit` name is not in the registry — a typo is a
-* config bug, not a linter to silently skip.
+* `codecov.yml` generation — a manifest-derived artifact (component `paths`
+* come from workspace packages; the status targets track the `test` task's
+* coverage setup), the same category as the reusable `test.yml` this package
+* also generates. Moved out of `@theholocron/cli` (theholocron/holocron#650)
+* — `holocron setup`'s codecov step now calls {@link codecovConfig} instead
+* of importing this logic directly.
 */
-function resolveLinters(opts) {
-	const order = Object.keys(LINTERS);
-	const present = new Set(opts.rootFiles);
-	const shared = opts.sharedConfigAvailable ?? /* @__PURE__ */ new Set();
-	const configPresent = (name, def) => def.always === true || (def.detect ?? []).some((f) => present.has(f)) || shared.has(name);
-	if (opts.explicit && opts.explicit.length > 0) {
-		const unknown = opts.explicit.filter((n) => !LINTER_NAMES.has(n));
-		if (unknown.length > 0) throw new Error(`unknown linter${unknown.length > 1 ? "s" : ""} ${unknown.map((n) => `"${n}"`).join(", ")} — known: ${order.join(", ")}`);
-		const wanted = new Set(opts.explicit);
-		return order.filter((n) => wanted.has(n) && configPresent(n, LINTERS[n])).map((name) => ({
-			name,
-			def: LINTERS[name]
-		}));
-	}
-	return order.filter((name) => configPresent(name, LINTERS[name])).map((name) => ({
-		name,
-		def: LINTERS[name]
-	}));
+const INDIVIDUAL_COMPONENTS_MARKER = "  individual_components:";
+function scaffoldHeader() {
+	return [
+		`# Scaffolded by holocron setup — edit this file freely.`,
+		`# Source:  theholocron/holocron · packages/astromech/src/generators/codecov.ts`,
+		``
+	].join("\n");
+}
+function codecovComponentBlock(packages) {
+	if (packages.length === 0) return "\n    []\n";
+	return "\n" + packages.flatMap(({ slug, dir }) => [
+		`    - component_id: ${slug}`,
+		`      name: "${slug}"`,
+		`      paths:`,
+		`        - ${dir ?? "packages"}/${slug}/**`,
+		``
+	]).join("\n");
 }
-//#endregion
-//#region src/resolver.ts
 /**
-* `library` is every mapped tool's org-wide default variant today — every
-* currently-migrated repo (`holocron`, `clients`, `utils`, `configs`,
-* `themes`, `observability`, `skills`) is a publishable library package, and
-* `eslint-config`/`vitest-config`/`tsdown-config` all name their
-* general-purpose preset exactly that. Picking a different variant per repo
-* (an app-type template, say) needs new `holocron.config.ts` surface this
-* doesn't add yet — deliberately out of scope until a real consumer needs it.
+* Ensure every codecov status default carries `if_not_found: success`, so an
+* infra-only PR (dep bump, config, lockfile — no coverable change) passes
+* instead of hanging forever on a required check codecov never posts.
+*
+* Injects the key on the line after each `target:` that sits inside a status
+* block (`coverage.status.*.default` or a `statuses:` list item — indent ≥ 8,
+* or ≥ 8 for a `- type:` list entry), when the immediate sibling lines do not
+* already declare it.
 */
-const TOOL_CONFIGS = {
-	eslint: {
-		package: "@theholocron/eslint-config",
-		exportPath: "./bundles/library",
-		flag: ["--config"]
-	},
-	prettier: {
-		package: "@theholocron/prettier-config",
-		exportPath: ".",
-		flag: ["--config"]
-	},
-	vitest: {
-		package: "@theholocron/vitest-config",
-		exportPath: "./bundles/library",
-		flag: ["--config"]
-	},
-	tsdown: {
-		package: "@theholocron/tsdown-config",
-		exportPath: "./presets/library",
-		flag: ["--config"]
-	},
-	commitlint: {
-		package: "@theholocron/commitlint-config",
-		exportPath: ".",
-		flag: ["--config"]
+function ensureIfNotFound(yaml) {
+	const lines = yaml.split("\n");
+	const out = [];
+	for (let i = 0; i < lines.length; i++) {
+		const line = lines[i];
+		out.push(line);
+		const m = /^(\s{8,})target:\s+\S+\s*$/.exec(line);
+		if (!m) continue;
+		const indent = m[1];
+		let alreadySet = false;
+		for (let j = i + 1; j < lines.length; j++) {
+			const sib = lines[j];
+			if (sib.trim() === "") continue;
+			const sibIndent = sib.match(/^\s*/)[0].length;
+			if (sibIndent < indent.length) break;
+			if (sibIndent === indent.length && /^\s*if_not_found\s*:/.test(sib)) {
+				alreadySet = true;
+				break;
+			}
+			if (sibIndent === indent.length && /^\s*(- |\w)/.test(sib) && !/^\s*(threshold|flags|paths|branches)\s*:/.test(sib)) break;
+		}
+		if (!alreadySet) out.push(`${indent}if_not_found: success`);
 	}
-};
-/**
-* Every filename a tool's own auto-discovery would pick up from `cwd` —
-* same extension set `registry.ts`'s `turbo.inputs`/`local.detect` entries
-* already use for these tools, kept in sync by hand (no shared source of
-* truth between the two today). Presence of any one of these means the
-* package has its own local config — customized or not, `resolveToolConfig`
-* can't tell the difference from the filename alone, so it defers to it
-* either way (#749).
-*/
-const LOCAL_CONFIG_FILES = {
-	eslint: [
-		"eslint.config.ts",
-		"eslint.config.js",
-		"eslint.config.mjs",
-		"eslint.config.cjs"
-	],
-	prettier: [
-		"prettier.config.ts",
-		"prettier.config.js",
-		"prettier.config.mjs",
-		"prettier.config.cjs"
-	],
-	vitest: [
-		"vitest.config.ts",
-		"vitest.config.js",
-		"vitest.config.mjs"
-	],
-	tsdown: [
-		"tsdown.config.ts",
-		"tsdown.config.js",
-		"tsdown.config.mjs",
-		"tsdown.config.cjs"
-	],
-	commitlint: [
-		"commitlint.config.ts",
-		"commitlint.config.js",
-		"commitlint.config.mjs",
-		"commitlint.config.cjs"
-	]
-};
-/** Every tool name the resolver knows how to point at a shared config. */
-const RESOLVABLE_TOOLS = new Set(Object.keys(TOOL_CONFIGS));
-/**
-* `<flag> <absolute path>` for `tool`, resolved against `cwd`'s
-* `node_modules` — or `[]` when the tool isn't mapped, `cwd` already has its
-* own local config file for it (#749 — local always wins, customized or
-* not), the shared package isn't installed, its `package.json` doesn't
-* declare the export subpath this needs, or the resolved file doesn't
-* actually exist on disk (a stale install, or a package version that
-* predates the export existing).
-*/
-function resolveToolConfig(tool, cwd, deps) {
-	const spec = TOOL_CONFIGS[tool];
-	if (!spec) return [];
-	if ((LOCAL_CONFIG_FILES[tool] ?? []).some((name) => deps.fileExists(joinPath(cwd, name)))) return [];
-	const pkgDir = joinPath(cwd, "node_modules", ...spec.package.split("/"));
-	const pkgJsonPath = joinPath(pkgDir, "package.json");
-	if (!deps.fileExists(pkgJsonPath)) return [];
-	let pkg;
-	try {
-		pkg = JSON.parse(deps.readFile(pkgJsonPath));
-	} catch {
-		return [];
+	return out.join("\n");
+}
+function mergeCodecovComponents(existing, packages) {
+	const idx = existing.indexOf(INDIVIDUAL_COMPONENTS_MARKER);
+	if (idx === -1) return ensureIfNotFound(existing);
+	return ensureIfNotFound(existing.slice(0, idx + 24)) + codecovComponentBlock(packages);
+}
+function readWorkspaceDir(repoRoot, dir) {
+	const dirPath = join(repoRoot, dir);
+	if (!existsSync(dirPath)) return [];
+	const packages = [];
+	for (const entry of readdirSync(dirPath, { withFileTypes: true })) {
+		if (!entry.isDirectory()) continue;
+		try {
+			const raw = readFileSync(join(dirPath, entry.name, "package.json"), "utf8");
+			const pkg = JSON.parse(raw);
+			if (typeof pkg.name === "string") packages.push({
+				slug: entry.name,
+				name: pkg.name,
+				dir
+			});
+		} catch {}
 	}
-	const relative = resolveExportEntry(pkg.exports?.[spec.exportPath]);
-	if (!relative) return [];
-	const absolute = joinPath(pkgDir, relative.replace(/^\.\//, ""));
-	if (!deps.fileExists(absolute)) return [];
-	return [...spec.flag, absolute];
+	return packages;
 }
 /**
-* Unwrap a `package.json#exports` subpath entry down to its file path —
-* either a bare string, or an object with condition keys (`import`,
-* `default`, `require`, …) that may themselves nest one level (`{ import: {
-* types, default } }`, the shape every `@theholocron/*-config` package
-* actually uses). Prefers `import` (this org ships ESM), then `default`,
-* then `require` as a last resort.
+* Every public `packages/*` and `apps/*` workspace, sorted by slug. `[]`
+* when neither directory exists. Monorepo templates (Next.js, React, …)
+* ship user-facing code under `apps/` alongside library code under
+* `packages/` — both need a codecov component so `codecov/patch/<slug>`
+* actually posts for each.
 */
-function resolveExportEntry(entry) {
-	if (typeof entry === "string") return entry;
-	if (entry === null || typeof entry !== "object") return void 0;
-	const conditions = entry;
-	const value = conditions.import ?? conditions.default ?? conditions.require;
-	if (typeof value === "string") return value;
-	if (typeof value === "object" && value !== null) return resolveExportEntry(value);
+function readWorkspacePackages(repoRoot) {
+	return [...readWorkspaceDir(repoRoot, "packages"), ...readWorkspaceDir(repoRoot, "apps")].sort((a, b) => a.slug.localeCompare(b.slug));
+}
+/** A brand-new `codecov.yml` — the scaffold header + the base template + this repo's component list. */
+function createCodecovConfig(packages) {
+	return `${scaffoldHeader()}${codecov_default.trimEnd()}${codecovComponentBlock(packages)}`;
 }
 /**
-* A minimal, POSIX-safe `path.join` — avoids importing `node:path` just for
-* this. Every path in play here is either already POSIX (a `package.json`
-* `exports` value, always forward-slashed regardless of platform) or built
-* from platform-neutral segments (`cwd`, `"node_modules"`, a scoped package
-* name split on `/`), so a manual join is safe and keeps this module
-* dependency-free like the rest of `run.ts`'s helpers.
+* The full pipeline `holocron setup` needs: read this repo's public
+* `packages/*`, then either merge them into an `existing` `codecov.yml` or
+* scaffold a new one.
 */
-function joinPath(...segments) {
-	return segments.map((s, i) => i === 0 ? s.replace(/\/+$/, "") : s.replace(/^\/+|\/+$/g, "")).filter(Boolean).join("/");
+function codecovConfig(repoRoot, existing) {
+	const packages = readWorkspacePackages(repoRoot);
+	return existing != null ? mergeCodecovComponents(existing, packages) : createCodecovConfig(packages);
 }
 //#endregion
-//#region src/run.ts
+//#region src/templates/reusable/actions/auto-commit.yml
+var auto_commit_default = "name: Auto Commit\ndescription: >\n  Commit and push any file changes using stefanzweifel/git-auto-commit-action.\n  If a branch name is provided and differs from the current branch, a new branch\n  is created automatically.\n\ninputs:\n  token:\n    description: >\n      GitHub token with push access to the target branch. Used to authenticate\n      the git remote so the commit can be pushed.\n    required: true\n  branch:\n    description: >\n      Branch to commit to. Leave empty to commit to the current branch (useful\n      in PR contexts). Provide an explicit name (e.g. chore/auto-sync) to push\n      to a separate branch.\n    required: false\n    default: \"\"\n  commit-message:\n    description: Commit message.\n    required: true\n  commit-options:\n    description: >\n      Additional options passed to git commit (e.g. --no-verify).\n    required: false\n    default: \"\"\n  commit-user-name:\n    description: Git user.name for the commit.\n    required: false\n    default: \"github-actions[bot]\"\n  commit-user-email:\n    description: Git user.email for the commit.\n    required: false\n    default: \"41898282+github-actions[bot]@users.noreply.github.com\"\n  commit-author:\n    description: >\n      Git author string in \"Name <email>\" format.\n    required: false\n    default: \"github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\"\n\noutputs:\n  changes-detected:\n    description: \"'true' if any files were committed, 'false' otherwise.\"\n    value: ${{ steps.commit.outputs.changes_detected }}\n\nruns:\n  using: composite\n  steps:\n    - name: Configure git remote with token\n      shell: bash\n      run: |\n        REMOTE_URL=$(git remote get-url origin)\n        AUTHED_URL=$(echo \"$REMOTE_URL\" | sed \"s|https://|https://x-access-token:${TOKEN}@|\")\n        git remote set-url origin \"$AUTHED_URL\"\n      env:\n        TOKEN: ${{ inputs.token }}\n\n    - name: Reset branch to current HEAD\n      if: ${{ inputs.branch != '' }}\n      shell: bash\n      run: git checkout -B \"$BRANCH\"\n      env:\n        BRANCH: ${{ inputs.branch }}\n\n    - name: Build signed commit message\n      id: msg\n      shell: bash\n      run: |\n        TRAILER=\"Signed-off-by: ${COMMIT_USER_NAME} <${COMMIT_USER_EMAIL}>\"\n        if echo \"$COMMIT_MESSAGE\" | grep -qF \"$TRAILER\"; then\n          FINAL=\"$COMMIT_MESSAGE\"\n        else\n          FINAL=\"${COMMIT_MESSAGE}\"$'\\n\\n'\"${TRAILER}\"\n        fi\n        {\n          echo \"value<<EOF_TRAILER\"\n          printf '%s' \"$FINAL\"\n          echo \"\"\n          echo \"EOF_TRAILER\"\n        } >> \"$GITHUB_OUTPUT\"\n      env:\n        COMMIT_MESSAGE: ${{ inputs.commit-message }}\n        COMMIT_USER_NAME: ${{ inputs.commit-user-name }}\n        COMMIT_USER_EMAIL: ${{ inputs.commit-user-email }}\n\n    - uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d # v7.2.0\n      id: commit\n      with:\n        branch: ${{ inputs.branch }}\n        commit_message: ${{ steps.msg.outputs.value }}\n        commit_options: ${{ inputs.commit-options }}\n        commit_user_name: ${{ inputs.commit-user-name }}\n        commit_user_email: ${{ inputs.commit-user-email }}\n        commit_author: ${{ inputs.commit-author }}\n";
+//#endregion
+//#region src/templates/reusable/actions/holocron.yml
+var holocron_default = "name: Holocron\ndescription: >\n  Run the Holocron CLI — `holocron run <task> [job]` by default, or any other\n  subcommand via `command:` (`sync`, `sync-github`, …). Resolves\n  `@theholocron/cli` from `node_modules` (published tarball) or builds it from\n  source when it resolves to an unbuilt workspace checkout (the holocron repo\n  itself). Requires dependencies to be installed already (run the setup action\n  first).\n\ninputs:\n  command:\n    description: >\n      Holocron subcommand. Default `run` — then `task` (and optional `job`)\n      name the manifest task. Set to `sync` / `sync-github` / … to run that\n      subcommand directly; `args` becomes everything after it.\n    required: false\n    default: run\n  task:\n    description: >\n      Manifest task to run when command is run — typecheck, test, build, audit.\n    required: false\n    default: \"\"\n  job:\n    description: Optional sub-job within the task (e.g. knip, performance for audit).\n    required: false\n    default: \"\"\n  args:\n    description: >\n      For `command: run`, extra arguments forwarded to the tool after `--`.\n      For any other command, the arguments passed straight to it.\n    required: false\n    default: \"\"\n\noutputs:\n  log-file:\n    description: >\n      Path to a file holding the full captured stdout+stderr of this\n      invocation — the same text the live Actions log shows, saved for a\n      caller that wants to ship it elsewhere (e.g. Sentinel's dispatched\n      checks shipping it to Axiom, holocron#769/#794).\n    value: ${{ steps.run.outputs.log-file }}\n\nruns:\n  using: composite\n\n  steps:\n    - name: Build the workspace when the CLI resolves to an unbuilt checkout\n      shell: bash\n      # The holocron repo carries @theholocron/cli as `workspace:*`; its bin\n      # (dist/cli.mjs) does not exist on a fresh checkout. `pnpm build` is a\n      # turbo run — cached and cheap once warm. A no-op everywhere else, where\n      # the published tarball already ships dist/.\n      #\n      # pnpm creates every workspace package's node_modules/.bin/holocron shim\n      # once, during the setup action's earlier `pnpm install` — before this\n      # build has run, so every one of them is silently skipped (\"Failed to\n      # create bin ... ENOENT\"), not just @theholocron/cli's own. That's a\n      # one-time decision: a later build doesn't retroactively fix a shim that\n      # was never created. Re-running `pnpm install` here (fast — the lockfile\n      # hasn't changed, so it only re-links `.bin`) is what actually fixes it,\n      # confirmed against a real cold install: `holocron` stays unresolvable\n      # from inside any package until this second install runs.\n      run: |\n        if [ ! -f node_modules/@theholocron/cli/dist/cli.mjs ]; then\n          echo \"→ @theholocron/cli dist/ missing — building the workspace from source\" >&2\n          pnpm build\n          echo \"→ re-linking node_modules/.bin — pnpm skipped it pre-build\" >&2\n          pnpm install --frozen-lockfile\n        fi\n\n    - name: holocron ${{ inputs.command }} ${{ inputs.task }}\n      id: run\n      shell: bash\n      env:\n        HOLOCRON_COMMAND: ${{ inputs.command }}\n        HOLOCRON_TASK: ${{ inputs.task }}\n        HOLOCRON_JOB: ${{ inputs.job }}\n        HOLOCRON_ARGS: ${{ inputs.args }}\n      run: |\n        if [ \"$HOLOCRON_COMMAND\" = \"run\" ]; then\n          set -- run \"$HOLOCRON_TASK\"\n          [ -n \"$HOLOCRON_JOB\" ] && set -- \"$@\" \"$HOLOCRON_JOB\"\n          # shellcheck disable=SC2086\n          [ -n \"$HOLOCRON_ARGS\" ] && set -- \"$@\" -- $HOLOCRON_ARGS\n        else\n          # shellcheck disable=SC2086\n          set -- \"$HOLOCRON_COMMAND\" $HOLOCRON_ARGS\n        fi\n        # Invoke the built entry directly. `pnpm exec holocron` relies on a\n        # node_modules/.bin/holocron shim that pnpm does not create for a\n        # workspace package whose dist/ was absent at install time (the holocron\n        # repo itself). Resolving the package's main export gives dist/index.mjs;\n        # the bin sits next to it as dist/cli.mjs. This is `require.resolve` from\n        # node_modules — it works in the holocron monorepo AND in every consumer\n        # repo (theholocron/holocron#655), unlike a hard-coded `packages/cli/…`.\n        cli=\"$(dirname \"$(node -e 'process.stdout.write(require.resolve(\"@theholocron/cli\"))')\")/cli.mjs\"\n        if [ ! -f \"$cli\" ]; then\n          echo \"::error::@theholocron/cli entry not found at $cli — is the workspace built?\" >&2\n          exit 1\n        fi\n        echo \"→ $cli $*\" >&2\n        # `tee` keeps the live Actions log streaming exactly as before while\n        # also capturing it to a file callers can ship elsewhere (log-file\n        # output, above). PIPESTATUS[0] -- not $? -- is `node`'s own exit\n        # code; $? after a pipe is tee's, which succeeds even when node fails.\n        log_file=\"${RUNNER_TEMP}/holocron-output.log\"\n        node \"$cli\" \"$@\" 2>&1 | tee \"$log_file\"\n        exit_code=${PIPESTATUS[0]}\n        echo \"log-file=$log_file\" >> \"$GITHUB_OUTPUT\"\n        exit \"$exit_code\"\n";
+//#endregion
+//#region src/templates/reusable/actions/install.yml
+var install_default = "name: Install dependencies\ndescription: Install project dependencies with pnpm frozen lockfile.\n\nruns:\n  using: composite\n\n  steps:\n    - name: Install dependencies\n      if: ${{ hashFiles('pnpm-lock.yaml') != '' }}\n      shell: bash\n      run: pnpm install --frozen-lockfile\n";
+//#endregion
+//#region src/templates/reusable/actions/setup.yml
+var setup_default = "name: Setup\ndescription: Prepare the environment and install project dependencies.\n\ninputs:\n  node-version:\n    description: Node.js version\n    required: false\n    default: \"22.x\"\n\nruns:\n  using: composite\n\n  steps:\n    - uses: theholocron/.github/.github/actions/setup-node@main\n      with:\n        node-version: ${{ inputs.node-version }}\n\n    - uses: theholocron/.github/.github/actions/install@main\n\n    # `@theholocron/cli`'s `dist/cli.mjs` doesn't exist yet at this point, so\n    # pnpm's workspace bin-linking can't create `node_modules/.bin/holocron`\n    # (silent `WARN ... ENOENT`, not a hard failure). Every package whose\n    # scripts delegate via `holocron run <task> --` then fails at run time\n    # with `holocron: not found` (#698). Same fix the `holocron` composite\n    # action already applies for its own direct invocation (see its \"Build\n    # the workspace when the CLI resolves to an unbuilt checkout\" step) —\n    # mirrored here so it also covers *nested* `holocron run <task> --`\n    # calls from inside package.json scripts, which that action's own guard\n    # doesn't reach. `pnpm build` (not a scoped `--filter`) so the CLI's own\n    # workspace dependencies (e.g. rollup-plugin-transform-template) build\n    # in topological order too — a scoped build skips them and fails.\n    # No-op in every consumer repo, where the published tarball already\n    # ships `dist/`.\n    - name: Build the Holocron CLI\n      shell: bash\n      run: |\n        if [ ! -f node_modules/@theholocron/cli/dist/cli.mjs ]; then\n          echo \"→ @theholocron/cli dist/ missing — building the workspace from source\" >&2\n          pnpm build\n          echo \"→ re-linking node_modules/.bin — pnpm skipped it pre-build\" >&2\n          pnpm install --frozen-lockfile\n        fi\n\n    - name: Cache Turbo artifacts\n      if: ${{ hashFiles('turbo.json') != '' }}\n      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0\n      with:\n        path: .turbo\n        key: turbo-${{ runner.os }}-${{ github.sha }}\n        restore-keys: |\n          turbo-${{ runner.os }}-\n";
+//#endregion
+//#region src/templates/reusable/actions/setup-node.yml
+var setup_node_default = "name: Setup Node\ndescription: Install pnpm and Node.js with pnpm dependency caching.\n\ninputs:\n  node-version:\n    description: Node.js version\n    required: false\n    default: \"22.x\"\nruns:\n  using: composite\n\n  steps:\n    - name: Setup pnpm\n      if: ${{ hashFiles('pnpm-lock.yaml') != '' }}\n      uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4\n\n    - name: Setup Node.js\n      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0\n      with:\n        node-version: ${{ hashFiles('.node-version') != '' && '' || inputs.node-version }}\n        node-version-file: ${{ hashFiles('.node-version') != '' && '.node-version' || '' }}\n        cache: ${{ hashFiles('pnpm-lock.yaml') != '' && 'pnpm' || '' }}\n        # Do NOT add registry-url here. setup-node writes .npmrc with\n        # _authToken=${NODE_AUTH_TOKEN} and sets NPM_CONFIG_USERCONFIG to it.\n        # pnpm reads that file, fails env-var substitution when the token is\n        # empty, and loses auth entirely. Without registry-url, pnpm 10.15+\n        # handles Trusted Publishing via its own native OIDC exchange.\n\n    - name: Add node_modules/.bin to PATH\n      shell: bash\n      run: echo \"$GITHUB_WORKSPACE/node_modules/.bin\" >> $GITHUB_PATH\n";
+//#endregion
+//#region src/templates/reusable/bookkeeping.yml
+var bookkeeping_default$1 = "name: Bookkeeping\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      configuration-path:\n        description: Path to the labeler configuration file in the calling repo\n        type: string\n        required: false\n        default: .github/labeler.yml\n\njobs:\n  label:\n    name: Apply Labels\n    permissions:\n      contents: read\n      issues: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          sparse-checkout: ${{ inputs.configuration-path || '.github/labeler.yml' }}\n          sparse-checkout-cone-mode: false\n\n      - uses: github/issue-labeler@c1b0f9f52a63158c4adc09425e858e87b32e9685 # v3.4\n        if: ${{ github.event_name == 'pull_request' && hashFiles(inputs.configuration-path || '.github/labeler.yml') != '' }}\n        # v3.4 bundles Node 20; allow it to run under Actions' current default.\n        env:\n          ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true\n        with:\n          # Fall back to default path when triggered directly (not via workflow_call)\n          # because inputs.* defaults only apply on workflow_call events.\n          configuration-path: ${{ inputs.configuration-path || '.github/labeler.yml' }}\n          include-title: 1\n          include-body: 0\n          sync-labels: 1\n          enable-versioned-regex: 0\n          repo-token: ${{ github.token }}\n";
+//#endregion
+//#region src/templates/reusable/delivery.build.yml
+var delivery_build_default$1 = "name: Build\n\n# Sanity check that every workspace actually compiles to dist/ — doesn't\n# upload or publish anything. delivery.publish builds again before\n# publishing; this just answers \"does it build?\" on every push/PR.\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  build:\n    name: Build every workspace\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Build\n        with:\n          task: delivery.build\n";
+//#endregion
+//#region src/templates/reusable/delivery.bundleSize.yml
+var delivery_bundleSize_default$1 = "name: Audit the Bundle Size\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      CODECOV_TOKEN:\n        required: false\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  bundle-size:\n    name: Upload bundle stats to Codecov\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n      # Read by the bundle-stats uploader inside `holocron run delivery.build`.\n      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Build and upload bundle stats\n        with:\n          task: delivery.build\n";
+//#endregion
+//#region src/templates/reusable/delivery.deploy.yml
+var delivery_deploy_default$1 = "name: Deploy\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      type:\n        description: \"Type of deployment: docs or storybook\"\n        required: true\n        type: string\n      storybook-projects:\n        description: >\n          JSON array of { \"name\"?, \"workingDir\", \"outputDir\"? } objects for storybook deploys.\n          Each is built via `pnpm -C <workingDir> build:storybook`. If \"name\" is provided the\n          output is placed under `sandbox/<name>/`; omit \"name\" for single-repo deploys and the\n          output lands directly in `sandbox/`.\n        type: string\n        required: false\n        default: \"[]\"\n      build-script:\n        description: pnpm script that builds the Storybook static output (single storybook, type:storybook only)\n        type: string\n        required: false\n        default: build:storybook\n      output-dir:\n        description: Directory where Storybook writes its static output (single storybook, type:storybook only)\n        type: string\n        required: false\n        default: storybook-static\n\njobs:\n  deploy:\n    name: Deploy\n    runs-on: ubuntu-latest\n    permissions:\n      contents: read\n      pages: write\n      id-token: write\n    environment:\n      name: github-pages\n      url: ${{ steps.deployment.outputs.page_url }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - name: Build docs site\n        if: ${{ inputs.type == 'docs' }}\n        run: pnpm -C docs build\n\n      - name: Build Storybook projects\n        if: ${{ inputs.storybook-projects != '[]' }}\n        env:\n          PROJECTS: ${{ inputs.storybook-projects }}\n        run: |\n          echo \"$PROJECTS\" | jq -c '.[]' | while IFS= read -r project; do\n            workingDir=$(echo \"$project\" | jq -r '.workingDir')\n            pnpm -C \"$workingDir\" build:storybook\n          done\n\n      - name: Build Storybook\n        if: ${{ inputs.type == 'storybook' && inputs.storybook-projects == '[]' }}\n        env:\n          BUILD_SCRIPT: ${{ inputs.build-script }}\n        run: pnpm run \"$BUILD_SCRIPT\"\n\n      - name: Assemble site\n        env:\n          DEPLOY_TYPE: ${{ inputs.type }}\n          PROJECTS: ${{ inputs.storybook-projects }}\n          STORYBOOK_OUTPUT_DIR: ${{ inputs.output-dir }}\n        run: |\n          mkdir -p _site\n          if [ \"$DEPLOY_TYPE\" = \"docs\" ]; then\n            cp -r docs/dist/. _site/\n          fi\n          if [ \"$PROJECTS\" != \"[]\" ]; then\n            echo \"$PROJECTS\" | jq -c '.[]' | while IFS= read -r project; do\n              name=$(echo \"$project\" | jq -r '.name // \"\"')\n              workingDir=$(echo \"$project\" | jq -r '.workingDir')\n              outputDir=$(echo \"$project\" | jq -r '.outputDir // \"storybook-static\"')\n              if [ -n \"$name\" ]; then\n                target=\"_site/sandbox/${name}\"\n              else\n                target=\"_site/sandbox\"\n              fi\n              mkdir -p \"$target\"\n              cp -r \"${workingDir}/${outputDir}/.\" \"$target/\"\n            done\n          elif [ \"$DEPLOY_TYPE\" = \"storybook\" ]; then\n            mkdir -p _site/sandbox\n            cp -r \"${STORYBOOK_OUTPUT_DIR}/.\" _site/sandbox/\n          fi\n\n      - uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1\n        name: Upload pages artifact\n        with:\n          path: _site\n\n      - uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5\n        id: deployment\n        name: Deploy to GitHub Pages\n";
+//#endregion
+//#region src/templates/reusable/delivery.publish.yml
+var delivery_publish_default$1 = "name: Release\n\n# Semantic-release with OIDC Trusted Publishing.\n# actions/setup-node writes a default NODE_AUTH_TOKEN=${{ github.token }}\n# which shadows OIDC auth. We explicitly clear it so npm falls through to\n# the Trusted Publisher OIDC exchange.\n# The calling repo must have a .releaserc.json that configures branches,\n# plugins, and any publish options. npm@11+ is installed to support OIDC.\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      dry-run:\n        description: >\n          When true, runs semantic-release --dry-run: analyzes commits and\n          previews the next release without git writes or publish. Only\n          meaningful for workflow_dispatch triggers; push-triggered runs\n          always run fully.\n        type: boolean\n        required: false\n        default: false\n      post-release:\n        description: >\n          When true, dispatches a readme sync broadcast after a successful\n          release. Enable for packages consumed by other repos via the\n          registry-doc system so downstream README installation blocks\n          stay current.\n        type: boolean\n        required: false\n        default: false\n      run-build:\n        description: Run `pnpm build` before releasing\n        type: boolean\n        required: false\n        default: true\n      deploy-on-release:\n        description: >\n          When true, runs a separate `deploy` job after a successful release\n          (holocron#930): `holocron deploy-on-release` deploys every workspace\n          package whose `delivery.deploy` task is `with: { on: release }`, when\n          the release is on its channel and changes its paths. The job is its\n          own check, re-runnable on its own, and gets VERCEL_TOKEN; the release\n          job never sees it. Off by default, so a repo that doesn't deploy from\n          its release never exposes the token.\n        type: boolean\n        required: false\n        default: false\n      sentry-project:\n        description: >\n          Sentry project slug for sourcemap upload and release creation after\n          publishing. Omit to skip the Sentry release step entirely.\n        type: string\n        required: false\n        default: \"\"\n    secrets:\n      HOLOCRON_RELEASE_TOKEN:\n        description: >\n          Fine-grained PAT (Contents + Issues + Pull requests: write) owned by\n          an admin. Required when the default branch is protected by a ruleset —\n          github.token cannot push through rulesets, but an admin PAT can.\n          Takes priority over HOLOCRON_SYNC_TOKEN. Falls back to github.token.\n        required: false\n      HOLOCRON_SYNC_TOKEN:\n        description: >\n          Legacy alias for HOLOCRON_RELEASE_TOKEN — kept for backward compatibility.\n          Prefer HOLOCRON_RELEASE_TOKEN for new repos.\n        required: false\n      HOLOCRON_READ_TOKEN:\n        description: >\n          Fine-grained PAT for read-only GitHub API calls (e.g. resolving git\n          committer identity via `gh api user`). Falls back to github.token.\n        required: false\n      GH_TOKEN:\n        description: >\n          Generic GitHub token fallback for `gh` CLI calls. Used when\n          HOLOCRON_READ_TOKEN is not set.\n        required: false\n      SENTRY_AUTH_TOKEN:\n        description: >\n          Sentry auth token for sourcemap upload and release creation.\n          Required when sentry-project is set. Use the org-level secret.\n        required: false\n      TURBO_TOKEN:\n        required: false\n      VERCEL_TOKEN:\n        description: >\n          Vercel token for the deploy job. Only used when deploy-on-release is\n          true, and only by that job.\n        required: false\n\njobs:\n  release:\n    name: Semantic release\n    permissions:\n      contents: write\n      id-token: write\n      issues: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    outputs:\n      # Read by the deploy job (holocron#930). Empty unless semantic-release\n      # published: `commit` is the release commit, `previous` the commit of\n      # the release before it (to diff against), `channel` the new version's\n      # prerelease identifier (`alpha`), empty for a stable release (`main`).\n      commit: ${{ steps.release.outputs.commit }}\n      previous: ${{ steps.release.outputs.previous }}\n      channel: ${{ steps.release.outputs.channel }}\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    # Do not cancel in-progress releases — a partial release is worse than a slow one.\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n          persist-credentials: false\n          # Use HOLOCRON_RELEASE_TOKEN when available — git push (tags, release commits)\n          # uses the checkout credential, not GITHUB_TOKEN env var. The\n          # built-in github.token cannot push through branch protection rulesets.\n          token: ${{ secrets.HOLOCRON_RELEASE_TOKEN || secrets.HOLOCRON_SYNC_TOKEN || github.token }}\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - name: Configure git identity\n        run: |\n          GIT_NAME=$(gh api user --jq .name 2>/dev/null || echo \"github-actions[bot]\")\n          GIT_EMAIL=$(gh api user --jq '\"\\(.id)+\\(.login)@users.noreply.github.com\"' 2>/dev/null || echo \"41898282+github-actions[bot]@users.noreply.github.com\")\n          git config --global user.name \"$GIT_NAME\"\n          git config --global user.email \"$GIT_EMAIL\"\n          git config --global format.signoff true\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_READ_TOKEN || secrets.GH_TOKEN || github.token }}\n\n      - name: Upgrade npm for OIDC support\n        run: npm install -g npm@11 sigstore\n        # sigstore is required by libnpmpublish/provenance.js at module parse\n        # time — before any config takes effect. Some npm 11.x builds stopped\n        # bundling it; installing it globally into the same prefix ensures it\n        # resolves regardless of npm version. (Discovered 2026-07-09.)\n\n      - run: pnpm build\n        name: Build\n        if: ${{ inputs.run-build == true }}\n\n      - name: Release\n        id: release\n        run: |\n          BEFORE=$(git rev-parse HEAD)\n          PREVIOUS_TAG=$(git describe --tags --abbrev=0 2>/dev/null || true)\n          PREVIOUS=\"\"\n          if [ -n \"$PREVIOUS_TAG\" ]; then PREVIOUS=$(git rev-list -n 1 \"$PREVIOUS_TAG\"); fi\n          if [ \"$DRY_RUN\" = \"true\" ]; then\n            npx semantic-release --dry-run\n          else\n            npx semantic-release\n          fi\n          AFTER=$(git rev-parse HEAD)\n          # semantic-release only commits (`chore(release): … [skip ci]`) when it\n          # actually publishes. That commit gets no CI (and so no coverage\n          # upload), which makes the next PR's `codecov/project` compare a full\n          # report against a stale ancestor — a phantom drop (holocron#644).\n          # Emit the new SHA so the steps below upload coverage for it.\n          if [ \"$BEFORE\" != \"$AFTER\" ]; then\n            echo \"commit=$AFTER\" >> \"$GITHUB_OUTPUT\"\n            echo \"previous=$PREVIOUS\" >> \"$GITHUB_OUTPUT\"\n            # The new version's channel: the prerelease identifier of its tag\n            # (v5.0.0-alpha.108 -> alpha), empty for a stable release.\n            VERSION=$(git describe --tags --abbrev=0)\n            VERSION=${VERSION#v}\n            CHANNEL=\"\"\n            case \"$VERSION\" in *-*) PRE=${VERSION#*-}; CHANNEL=${PRE%%.*} ;; esac\n            echo \"channel=$CHANNEL\" >> \"$GITHUB_OUTPUT\"\n          fi\n        env:\n          DRY_RUN: ${{ inputs.dry-run }}\n          # Prefer HOLOCRON_RELEASE_TOKEN (fine-grained PAT, Contents+Issues+PRs write,\n          # owned by an admin with ruleset bypass) so @semantic-release/git can\n          # push the version-bump commit through branch protection. Falls back to\n          # HOLOCRON_SYNC_TOKEN (legacy) then github.token for unprotected repos.\n          GITHUB_TOKEN: ${{ secrets.HOLOCRON_RELEASE_TOKEN || secrets.HOLOCRON_SYNC_TOKEN || github.token }}\n          HUSKY: \"0\"\n          NPM_CONFIG_PROVENANCE: true\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Coverage for the release commit\n        if: ${{ steps.release.outputs.commit != '' }}\n        with:\n          task: verification.unitTests\n\n      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0\n        name: Upload release-commit coverage to Codecov\n        if: ${{ steps.release.outputs.commit != '' }}\n        # fail_ci_if_error makes a failed upload fail this step, so it is visible, but\n        # continue-on-error keeps it from failing the job: the release has already\n        # published, and the Sentry release steps below must still run (holocron#934).\n        continue-on-error: true\n        with:\n          use_oidc: true\n          fail_ci_if_error: true\n          override_commit: ${{ steps.release.outputs.commit }}\n          override_branch: ${{ github.ref_name }}\n\n      - name: Get release version\n        id: release_version\n        if: ${{ inputs.sentry-project != '' && inputs.dry-run != true }}\n        env:\n          SENTRY_PROJECT: ${{ inputs.sentry-project }}\n        run: |\n          TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo \"\")\n          if [ -n \"$TAG\" ]; then\n            echo \"release=${SENTRY_PROJECT}@${TAG#v}\" >> \"$GITHUB_OUTPUT\"\n          fi\n\n      - name: Create Sentry release\n        if: ${{ inputs.sentry-project != '' && steps.release_version.outputs.release != '' && inputs.dry-run != true }}\n        uses: getsentry/action-release@ff07929a6537bac57790c3451cf4d364aca38528 # v3\n        env:\n          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}\n          SENTRY_ORG: theholocron\n          SENTRY_PROJECT: ${{ inputs.sentry-project }}\n        with:\n          environment: production\n          version: ${{ steps.release_version.outputs.release }}\n          sourcemaps: \"**/dist\"\n\n  deploy:\n    name: Deploy\n    needs: release\n    # Only after a release that actually published (`commit` is empty on a dry\n    # run or when nothing was released). A failed deploy fails only this job:\n    # the release is already on npm, and this job re-runs on its own.\n    if: ${{ inputs.deploy-on-release == true && inputs.dry-run != true && needs.release.outputs.commit != '' }}\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout the release commit\n        with:\n          ref: ${{ needs.release.outputs.commit }}\n          fetch-depth: 0\n          persist-credentials: false\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Deploy packages that deploy on release\n        env:\n          VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}\n        with:\n          command: deploy-on-release\n          args: >-\n            --channel=${{ needs.release.outputs.channel }}\n            --from=${{ needs.release.outputs.previous }}\n            --to=${{ needs.release.outputs.commit }}\n\n  sync-readme:\n    name: Post-release readme sync\n    needs: release\n    if: ${{ inputs.post-release == true && inputs.dry-run != true }}\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    steps:\n      - name: Trigger broadcast readme sync\n        run: |\n          gh workflow run sync-dispatch.yml \\\n            --repo theholocron/.github \\\n            --field \"steps=readme\"\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN }}\n";
+//#endregion
+//#region src/templates/reusable/dependencies.yml
+var dependencies_default$1 = "name: Dependencies\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      merge-token:\n        description: >\n          Optional privileged token for auto-merge. Falls back to GITHUB_TOKEN.\n          Required when branch protection enforces required reviews — GITHUB_TOKEN\n          cannot approve its own PRs.\n        required: false\n\njobs:\n  dependabot:\n    name: Update the dependencies\n    permissions:\n      contents: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    if: github.event.pull_request.user.login == 'dependabot[bot]'\n    steps:\n      - uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0\n        name: Fetch Dependabot metadata\n        id: metadata\n\n      - run: gh pr merge --auto --squash \"$PR_URL\"\n        # --squash is intentional: repo protection sets allow_merge_commit: false,\n        # so --merge would fail on any repo using the standard preset.\n        name: Enable auto-merge for Dependabot PRs\n        if: steps.metadata.outputs.update-type == 'version-update:semver-patch'\n        env:\n          PR_URL: ${{ github.event.pull_request.html_url }}\n          GH_TOKEN: ${{ secrets.merge-token || github.token }}\n";
+//#endregion
+//#region src/templates/reusable/greetings.yml
+var greetings_default$1 = "name: Greetings\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n\njobs:\n  greeting:\n    name: Greet first-time contributors\n    permissions:\n      issues: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    # Group by the issue/PR number so duplicate events don't race each other.\n    steps:\n      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n        name: Greet on first contribution\n        with:\n          script: |\n            // Only greet on the initial open — ignore synchronize, reopened, etc.\n            if (context.payload.action !== 'opened') return;\n\n            const actor = context.actor;\n            const { owner, repo } = context.repo;\n\n            // Payload inspection is more reliable than context.eventName for detecting\n            // whether this is an issue vs. PR event — works regardless of how GitHub\n            // propagates event names through workflow_call chains.\n            const isIssue = !!context.payload.issue && !context.payload.pull_request;\n            // listForRepo returns both issues and PRs (GitHub treats PRs as issues),\n            // sorted newest-first. Filter by type to track first-issue and first-PR\n            // independently, and avoid search-index eventual-consistency lag.\n            const { data: recent } = await github.rest.issues.listForRepo({\n              owner, repo,\n              creator: actor,\n              state: 'all',\n              per_page: 100\n            });\n\n            const sameType = recent.filter(item =>\n              isIssue ? !item.pull_request : !!item.pull_request\n            );\n\n            if (sameType.length !== 1) return;\n            const body = isIssue\n              ? `Hey @${actor}!\\n\\nWe really appreciate you taking the time to report an issue. The collaborators on this project attempt to help as many people as possible, but we are a limited number of volunteers, so it is possible that this will not be addressed as swiftly.\\n\\nYour patience is much appreciated and we will get back to you as quickly as possible.`\n              : `Hey @${actor}!\\n\\nWe really appreciate you taking the time to help out with this PR. The collaborators on this project attempt to help as many people as possible, but we are a limited number of volunteers, so it is possible that this will not be addressed as swiftly.\\n\\nYour patience is much appreciated and we will get back to you as quickly as possible.`;\n\n            await github.rest.issues.createComment({\n              owner,\n              repo,\n              issue_number: context.issue.number,\n              body\n            });\n";
+//#endregion
+//#region src/templates/reusable/knowledge.wiki.yml
+var knowledge_wiki_default$1 = "name: Wiki\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      fern-version:\n        description: >\n          Fern CLI version to install. Pin this to avoid breaking changes when\n          Fern updates their config schema.\n        type: string\n        required: false\n        default: \"5.114.1\"\n      preview:\n        description: >\n          When true, publishes a preview instead of production.\n          Requires preview-id to be set.\n        type: boolean\n        required: false\n        default: false\n      preview-id:\n        description: >\n          Stable ID for the preview build. Use the PR number (e.g. \"pr-123\")\n          so the same preview URL is reused on every push to the branch.\n        type: string\n        required: false\n        default: \"\"\n      fern-org:\n        description: >\n          DEPRECATED — the preview URL is now read from Fern's own output.\n          Kept as a fallback for building the URL when that parse fails, and so\n          existing callers do not error.\n        type: string\n        required: false\n        default: \"\"\n      base-path:\n        description: >\n          DEPRECATED — see fern-org. Basepath appended to the fallback preview\n          URL (e.g. \"holocron\" for multi-source routing).\n        type: string\n        required: false\n        default: \"\"\n    secrets:\n      HOLOCRON_FERN_TOKEN:\n        required: false\n      FERN_TOKEN:\n        required: false\n\njobs:\n  publish:\n    name: Publish to Fern\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    permissions:\n      contents: read\n      deployments: write\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - name: Install Fern CLI\n        run: npm install -g \"fern-api@$FERN_VERSION\"\n        env:\n          FERN_VERSION: ${{ inputs.fern-version }}\n\n      - name: Publish docs\n        if: ${{ !inputs.preview }}\n        run: fern generate --docs\n        env:\n          FERN_TOKEN: ${{ secrets.HOLOCRON_FERN_TOKEN || secrets.FERN_TOKEN }}\n\n      - name: Preview docs\n        id: preview\n        if: ${{ inputs.preview && inputs.preview-id != '' }}\n        env:\n          FERN_TOKEN: ${{ secrets.HOLOCRON_FERN_TOKEN || secrets.FERN_TOKEN }}\n          PREVIEW_ID: ${{ inputs.preview-id }}\n        run: |\n          out=$(fern generate --docs --preview --id \"$PREVIEW_ID\" 2>&1) || { printf '%s\\n' \"$out\"; exit 1; }\n          printf '%s\\n' \"$out\"\n          # Fern prints \"Published docs to https://<org>-preview-<id>.docs.buildwithfern.com/<path>\"\n          url=$(printf '%s\\n' \"$out\" | grep -oiE 'https://[a-z0-9.-]+\\.docs\\.buildwithfern\\.com[^ )]*' | head -n1)\n          echo \"url=$url\" >> \"$GITHUB_OUTPUT\"\n\n      - name: Report preview URL\n        if: ${{ inputs.preview && inputs.preview-id != '' }}\n        env:\n          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n          CAPTURED_URL: ${{ steps.preview.outputs.url }}\n          FERN_ORG: ${{ inputs.fern-org }}\n          PREVIEW_ID: ${{ inputs.preview-id }}\n          BASE_PATH: ${{ inputs.base-path }}\n        run: |\n          PREVIEW_URL=\"$CAPTURED_URL\"\n          if [ -z \"$PREVIEW_URL\" ] && [ -n \"$FERN_ORG\" ]; then\n            PREVIEW_URL=\"https://${FERN_ORG}-preview-${PREVIEW_ID}.docs.buildwithfern.com${BASE_PATH:+/${BASE_PATH}}\"\n          fi\n          if [ -z \"$PREVIEW_URL\" ]; then\n            echo \"::warning::no preview URL parsed from Fern output and no fern-org fallback — skipping the deployment widget\"\n            exit 0\n          fi\n          PAYLOAD=$(printf '{\"ref\":\"%s\",\"environment\":\"wiki (Preview)\",\"description\":\"Wiki\",\"production_environment\":false,\"auto_merge\":false,\"required_contexts\":[]}' \\\n            \"$GITHUB_HEAD_REF\")\n          DEPLOY_ID=$(printf '%s\\n' \"$PAYLOAD\" | gh api \"repos/${GITHUB_REPOSITORY}/deployments\" \\\n            --method POST --input - | jq -r '.id')\n          gh api \"repos/${GITHUB_REPOSITORY}/deployments/${DEPLOY_ID}/statuses\" \\\n            --method POST --field state=success --field environment_url=\"$PREVIEW_URL\"\n";
+//#endregion
+//#region src/templates/reusable/platform.commitStandards.yml
+var platform_commitStandards_default$1 = "name: Commit Standards\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  commit-standards:\n    name: Run commitlint\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      # No local equivalent (linters.ts: commitlint has no localBin — enforced\n      # only at commit time via the commit-msg hook, and here in CI over the\n      # PR's commit range). Not run through the holocron composite action.\n      #\n      # --config <resolved shared path> (config-resolution workstream, #676)\n      # — falls back to commitlint's own auto-discovery of a local\n      # commitlint.config.ts when the shared package's built dist/ isn't\n      # present, same guard as the commit-msg hook.\n      - name: Run commitlint over the PR range\n        if: github.event_name == 'pull_request'\n        run: |\n          COMMITLINT_CONFIG=\"node_modules/@theholocron/commitlint-config/dist/index.js\"\n          if [ -f \"$COMMITLINT_CONFIG\" ]; then\n            pnpm exec commitlint --config \"$COMMITLINT_CONFIG\" --from \"${{ github.event.pull_request.base.sha }}\" --to \"${{ github.sha }}\"\n          else\n            pnpm exec commitlint --from \"${{ github.event.pull_request.base.sha }}\" --to \"${{ github.sha }}\"\n          fi\n";
+//#endregion
+//#region src/templates/reusable/platform.dispatchedCheck.yml
+var platform_dispatchedCheck_default = "name: Dispatched Check\n\non: # yamllint disable-line rule:truthy\n  workflow_dispatch:\n    inputs:\n      repo:\n        description: Target repo, \"owner/name\", to check out and run the task against.\n        type: string\n        required: true\n      ref:\n        description: Git ref (branch or commit SHA) to check out.\n        type: string\n        required: true\n      task:\n        description: The holocron task name to run (e.g. \"verification.typeSafety\").\n        type: string\n        required: true\n      check-run-id:\n        description: >\n          ID of the check run already posted as \"queued\" on the target repo —\n          patched to \"completed\" once the task finishes.\n        type: string\n        required: true\n\npermissions:\n  contents: read\n\njobs:\n  run-task:\n    name: Run a Sentinel-dispatched task against another repo\n    runs-on: ubuntu-latest\n    timeout-minutes: 20\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      # actions/create-github-app-token defaults to scoping its token to the\n      # *current* repo (.github, where this workflow runs) when owner/\n      # repositories are omitted — useless here, since every real use of this\n      # token targets inputs.repo instead. Split \"owner/name\" up front so the\n      # token step below can scope explicitly to the actual target.\n      - name: Parse target repo\n        id: target\n        run: |\n          echo \"owner=${INPUT_REPO%%/*}\" >> \"$GITHUB_OUTPUT\"\n          echo \"name=${INPUT_REPO##*/}\" >> \"$GITHUB_OUTPUT\"\n        env:\n          INPUT_REPO: ${{ inputs.repo }}\n\n      # Sentinel's own dispatch call only carries plain, non-secret inputs\n      # (repo/ref/task/check-run-id — all visible in the Actions UI/logs).\n      # This step mints a fresh, short-lived installation token here instead,\n      # scoped by the same App's stored credentials — never a raw token\n      # passed through a dispatch input.\n      - name: Generate installation token\n        id: app-token\n        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0\n        with:\n          app-id: ${{ secrets.SENTINEL_APP_ID }}\n          private-key: ${{ secrets.SENTINEL_APP_PRIVATE_KEY }}\n          owner: ${{ steps.target.outputs.owner }}\n          repositories: ${{ steps.target.outputs.name }}\n\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout target repository\n        with:\n          repository: ${{ inputs.repo }}\n          ref: ${{ inputs.ref }}\n          token: ${{ steps.app-token.outputs.token }}\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - name: Run the task\n        id: run-task\n        continue-on-error: true\n        uses: theholocron/.github/.github/actions/holocron@main\n        with:\n          task: ${{ inputs.task }}\n\n      # A bare .../actions/runs/<id> link lands on the run summary, one click\n      # short of the actual step-by-step log a normal check's details_url\n      # points at. This job is always alone in its run, so the first (only)\n      # job in the run's own job list is unambiguously this one.\n      - name: Resolve this job's numeric ID\n        id: job-info\n        if: always()\n        run: |\n          job_id=$(gh api \"repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/jobs\" --jq '.jobs[0].id')\n          echo \"job_id=$job_id\" >> \"$GITHUB_OUTPUT\"\n        env:\n          GH_TOKEN: ${{ steps.app-token.outputs.token }}\n\n      # Ships the task's real captured output (tsc/vitest/etc — whatever\n      # `holocron run` actually printed) to the same Axiom dataset Sentinel's\n      # own structured logs already flow into, tagged so it's queryable by\n      # this exact run. Reuses the existing dataset rather than provisioning\n      # a new one — a prototype-stage call, revisit if CI-log volume ever\n      # warrants a dedicated dataset. Builds a permalink filtered to this\n      # run's own logs (Axiom's own \"copy query link\" URL shape:\n      # /<org>/query?initForm={\"apl\":\"...\"} ) so a viewer lands directly on\n      # the relevant lines, not a bare dataset view.\n      - name: Ship task output to Axiom\n        id: axiom\n        if: always()\n        run: |\n          message=$(tail -c 40000 \"$LOG_FILE\" 2>/dev/null || echo \"(no output captured)\")\n          # \"level\" is one of the field names Axiom's Stream/Query tabs\n          # recognize for severity-color highlighting (docs: level, @level,\n          # severity, @severity, status.code) -- conclusion alone isn't.\n          level=$([ \"$CONCLUSION\" = \"success\" ] && echo \"info\" || echo \"error\")\n          event=$(jq -cn \\\n            --arg time \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\" \\\n            --arg repo \"$REPO\" --arg task \"$TASK\" --arg run_id \"$GITHUB_RUN_ID\" \\\n            --arg job_id \"$JOB_ID\" --arg check_run_id \"$CHECK_RUN_ID\" \\\n            --arg conclusion \"$CONCLUSION\" --arg level \"$level\" --arg message \"$message\" \\\n            '{_time: $time, source: \"dispatched-check\", repo: $repo, task: $task,\n              run_id: $run_id, job_id: $job_id, check_run_id: $check_run_id,\n              conclusion: $conclusion, level: $level, message: $message}')\n          curl -sf -X POST \"https://api.axiom.co/v1/datasets/${AXIOM_DATASET}/ingest\" \\\n            -H \"Authorization: Bearer ${AXIOM_TOKEN}\" \\\n            -H \"Content-Type: application/json\" \\\n            -d \"[${event}]\" || echo \"::warning::Axiom ingest failed — continuing, the check itself still reports the real result\"\n\n          # The ['...'] is Axiom's own APL array-dataset-reference syntax, not\n          # a shell quote boundary — $AXIOM_DATASET/$CHECK_RUN_ID both expand\n          # fine here; shellcheck's single-quote heuristic just can't tell.\n          # shellcheck disable=SC2016\n          apl=\"['${AXIOM_DATASET}'] | where check_run_id == \\\"${CHECK_RUN_ID}\\\"\"\n          init_form=$(jq -cn --arg apl \"$apl\" '{apl: $apl}')\n          encoded=$(jq -rn --arg s \"$init_form\" '$s | @uri')\n          echo \"query-url=https://app.axiom.co/${AXIOM_ORG}/query?initForm=${encoded}\" >> \"$GITHUB_OUTPUT\"\n        env:\n          LOG_FILE: ${{ steps.run-task.outputs.log-file }}\n          REPO: ${{ inputs.repo }}\n          TASK: ${{ inputs.task }}\n          JOB_ID: ${{ steps.job-info.outputs.job_id }}\n          CHECK_RUN_ID: ${{ inputs.check-run-id }}\n          CONCLUSION: ${{ steps.run-task.outcome == 'success' && 'success' || 'failure' }}\n          AXIOM_ORG: the-holocron-7bbe\n          AXIOM_DATASET: holocron-sentinel\n          AXIOM_TOKEN: ${{ secrets.SENTINEL_AXIOM_INGEST_TOKEN }}\n\n      # Always runs, success or failure — the queued check run on the target\n      # repo must be resolved either way, not left hanging. Full JSON body via\n      # jq + --input, not -f flags: output.text needs real nesting (gh api -f\n      # has no dot-notation for that), and the captured task output can\n      # contain characters (quotes, $, backticks) that would break a\n      # hand-built -f string.\n      - name: Report result to the target repo's check run\n        if: always()\n        run: |\n          excerpt=$(tail -c 3000 \"$LOG_FILE\" 2>/dev/null || echo \"(no output captured)\")\n          # The single-quoted format string is intentional — every %s fills\n          # via printf's own args below, not shell expansion; nothing in it\n          # needs to expand.\n          # shellcheck disable=SC2016\n          text=$(printf '**Task:** `%s`\\n\\n**Result:** %s\\n\\n[Full logs on Axiom](%s)\\n\\n### Last output\\n\\n```\\n%s\\n```\\n' \\\n            \"$TASK\" \"$CONCLUSION\" \"$QUERY_URL\" \"$excerpt\")\n          body=$(jq -n \\\n            --arg conclusion \"$CONCLUSION\" \\\n            --arg details_url \"$RUN_URL\" \\\n            --arg title \"$TASK ($CONCLUSION)\" \\\n            --arg summary \"Dispatched via theholocron/.github — see the log excerpt below, or the full run/Axiom links.\" \\\n            --arg text \"$text\" \\\n            '{status: \"completed\", conclusion: $conclusion, details_url: $details_url,\n              output: {title: $title, summary: $summary, text: $text}}')\n          echo \"$body\" | gh api --method PATCH \"/repos/${REPO}/check-runs/${CHECK_RUN_ID}\" --input -\n        env:\n          # `GH_TOKEN` is the literal name `gh api` requires to auto-authenticate\n          # -- not a stand-in for a shared/blanket credential. Its value is the\n          # short-lived, Sentinel-App-scoped token minted above, same as the\n          # checkout step uses; never secrets.HOLOCRON_SYNC_TOKEN (the one\n          # genuinely shared PAT in this org, used by sync-dispatch.yml).\n          GH_TOKEN: ${{ steps.app-token.outputs.token }}\n          REPO: ${{ inputs.repo }}\n          TASK: ${{ inputs.task }}\n          CHECK_RUN_ID: ${{ inputs.check-run-id }}\n          CONCLUSION: ${{ steps.run-task.outcome == 'success' && 'success' || 'failure' }}\n          LOG_FILE: ${{ steps.run-task.outputs.log-file }}\n          QUERY_URL: ${{ steps.axiom.outputs.query-url }}\n          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}/job/${{ steps.job-info.outputs.job_id }}\n";
+//#endregion
+//#region src/templates/reusable/platform.repoSync.yml
+var platform_repoSync_default$1 = "name: Sync\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      steps:\n        description: >\n          Sync steps to run (default: all). Valid values:\n          labels, properties, teams, topics, keywords, description, homepage, readme, workflows, wiki.\n          Pass a space-separated list to run a subset, e.g. \"readme\" or \"readme wiki\".\n        type: string\n        required: false\n    secrets:\n      HOLOCRON_ADMIN_TOKEN:\n        description: Fine-grained PAT with admin scopes (labels, properties, teams).\n        required: false\n      HOLOCRON_AXIOM_TOKEN:\n        description: >\n          Axiom API token. When set alongside the HOLOCRON_AXIOM_DATASET\n          repo/org variable, the CLI ships this run's structured logs to Axiom.\n          Falls back to the vendor-native AXIOM_TOKEN secret.\n        required: false\n      AXIOM_TOKEN:\n        description: Vendor-native fallback for HOLOCRON_AXIOM_TOKEN.\n        required: false\n      HOLOCRON_DEPLOY_TOKEN:\n        description: Fine-grained PAT for GitHub Pages configuration.\n        required: false\n      HOLOCRON_ISSUES_TOKEN:\n        description: Fine-grained PAT for issue management.\n        required: false\n      HOLOCRON_ORG_TOKEN:\n        description: Org-scoped fine-grained PAT for team sync and org properties.\n        required: false\n      HOLOCRON_READ_TOKEN:\n        description: Fine-grained PAT for read-only GitHub API calls.\n        required: false\n      HOLOCRON_SYNC_TOKEN:\n        required: false\n      GH_TOKEN:\n        description: >\n          Generic GitHub token fallback for gh CLI calls. Used when\n          HOLOCRON_SYNC_TOKEN is not set.\n        required: false\n\njobs:\n  sync:\n    name: Run holocron sync\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    permissions:\n      contents: write\n      pull-requests: write\n    # Job-level so the `holocron` composite action's steps inherit them.\n    env:\n      HOLOCRON_ADMIN_TOKEN: ${{ secrets.HOLOCRON_ADMIN_TOKEN }}\n      HOLOCRON_AXIOM_TOKEN: ${{ secrets.HOLOCRON_AXIOM_TOKEN || secrets.AXIOM_TOKEN }}\n      HOLOCRON_AXIOM_DATASET: ${{ vars.HOLOCRON_AXIOM_DATASET || vars.AXIOM_DATASET }}\n      POSTHOG_PROJECT_TOKEN: ${{ vars.POSTHOG_PROJECT_TOKEN }}\n      HOLOCRON_DEPLOY_TOKEN: ${{ secrets.HOLOCRON_DEPLOY_TOKEN }}\n      HOLOCRON_ISSUES_TOKEN: ${{ secrets.HOLOCRON_ISSUES_TOKEN }}\n      HOLOCRON_ORG_TOKEN: ${{ secrets.HOLOCRON_ORG_TOKEN }}\n      HOLOCRON_READ_TOKEN: ${{ secrets.HOLOCRON_READ_TOKEN }}\n      HOLOCRON_SYNC_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          token: ${{ secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN || github.token }}\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - name: Run holocron sync\n        # The `holocron` action resolves @theholocron/cli from node_modules (or\n        # builds the workspace when it's an unbuilt checkout — the holocron repo\n        # itself). `inputs.steps` is a space-separated list or empty; the\n        # `--steps <list>` arg is omitted when empty.\n        uses: theholocron/.github/.github/actions/holocron@main\n        with:\n          command: sync\n          args: ${{ inputs.steps != '' && format('--steps {0}', inputs.steps) || '' }}\n\n      - name: Format generated files\n        run: |\n          pnpm exec prettier --write README.md docs/src/content/docs/index.mdx 2>/dev/null || true\n          # `holocron sync` writes package.json fields (keywords, description,\n          # homepage) with a plain assignment, which appends new keys at the\n          # end — re-apply the canonical order the lint config enforces.\n          pnpm exec eslint --fix --no-warn-ignored package.json 2>/dev/null || true\n\n      - uses: theholocron/.github/.github/actions/auto-commit@main\n        id: auto-commit\n        name: Commit sync changes\n        with:\n          token: ${{ secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN || github.token }}\n          branch: chore/auto-sync\n          commit-message: \"chore: sync from holocron.config\"\n          commit-options: \"--no-verify\"\n\n      - name: Open PR if changes were committed\n        if: steps.auto-commit.outputs.changes-detected == 'true'\n        run: |\n          gh pr create \\\n            --title \"chore: sync README and repo metadata\" \\\n            --body \"Automated sync triggered by changes to config or package files. Merge to apply.\" \\\n            --base main \\\n            --head chore/auto-sync \\\n          || echo \"PR already open — branch updated.\"\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN || github.token }}\n\n      - name: Broadcast wiki sync if navbar changed\n        if: >-\n          steps.auto-commit.outputs.changes-detected == 'true' &&\n          github.event_name == 'push' &&\n          (inputs.steps == '' || contains(inputs.steps, 'wiki'))\n        run: |\n          if git diff HEAD~1 --name-only | grep -q 'fern/docs.yml'; then\n            gh workflow run sync-dispatch.yml \\\n              --repo theholocron/.github \\\n              --field \"steps=wiki\" \\\n            || echo \"skipping broadcast — insufficient permissions\"\n          fi\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN || github.token }}\n";
+//#endregion
+//#region src/templates/reusable/platform.repoValidation.yml
+var platform_repoValidation_default$1 = "name: Repo Validation\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  adrs:\n    name: Validate ADRs and specs\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Validate ADR and spec frontmatter\n        with:\n          task: platform.repoValidation\n          job: adrs\n\n  registry:\n    name: Validate registry consistency\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Validate registry consistency\n        with:\n          task: platform.repoValidation\n          job: registry\n\n  docs-presence:\n    name: Validate docs presence\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Validate docs presence for new packages\n        with:\n          task: platform.repoValidation\n          job: docsPresence\n        env:\n          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}\n\n  conclusion:\n    name: Conclusion\n    runs-on: ubuntu-latest\n    if: always()\n    needs: [adrs, registry, docs-presence]\n    steps:\n      - name: Check job statuses\n        run: |\n          if [[ \"$RESULTS\" == *\"failure\"* ]] || [[ \"$RESULTS\" == *\"cancelled\"* ]]; then\n            exit 1\n          fi\n        env:\n          RESULTS: ${{ join(needs.*.result, ',') }}\n";
+//#endregion
+//#region src/templates/reusable/preview.yml
+var preview_default$1 = "name: Preview\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      type:\n        description: \"Type of deployment: docs or storybook\"\n        required: true\n        type: string\n      name:\n        description: Repo name prefix used to filter the docs site package (<name>-site); omit to run pnpm -C docs build\n        required: false\n        type: string\n        default: \"\"\n      storybook-projects:\n        description: >\n          JSON array of { \"name\"?, \"workingDir\", \"outputDir\"? } objects for storybook deploys.\n          Each is built via `pnpm -C <workingDir> build:storybook`. If \"name\" is provided the\n          output is placed under `sandbox/<name>/`; omit \"name\" for single-repo deploys and the\n          output lands directly in `sandbox/`.\n        type: string\n        required: false\n        default: \"[]\"\n      build-script:\n        description: pnpm script that builds the Storybook static output (single storybook, type:storybook only)\n        type: string\n        required: false\n        default: build:storybook\n      output-dir:\n        description: Directory where Storybook writes its static output (single storybook, type:storybook only)\n        type: string\n        required: false\n        default: storybook-static\n      cloudflare-project:\n        description: >\n          Cloudflare Pages project name. Falls back to the CLOUDFLARE_PAGES_PROJECT\n          org variable when omitted — set that variable once and all repos get previews\n          without per-repo config.\n        required: false\n        type: string\n        default: \"\"\n\njobs:\n  deploy-preview:\n    name: Preview\n    if: ${{ github.event.action != 'closed' }}\n    runs-on: ubuntu-latest\n    permissions:\n      contents: read\n      deployments: write\n      pull-requests: write\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - name: Build workspace dependencies\n        # The docs site imports workspace packages (e.g. a shared theme) via\n        # `workspace:*` — its exports map points at dist/, which doesn't\n        # exist until something builds it. Nothing else in this job does,\n        # so without this step Vite fails to resolve the import entirely.\n        if: ${{ inputs.type == 'docs' }}\n        run: pnpm run build\n\n      - name: Build docs site\n        if: ${{ inputs.type == 'docs' && inputs.name != '' }}\n        env:\n          SITE_NAME: ${{ inputs.name }}\n        run: pnpm --filter @theholocron/\"$SITE_NAME\"-site build\n\n      - name: Build docs site\n        if: ${{ inputs.type == 'docs' && inputs.name == '' }}\n        run: pnpm -C docs build\n\n      - name: Build Storybook projects\n        if: ${{ inputs.storybook-projects != '[]' }}\n        env:\n          PROJECTS: ${{ inputs.storybook-projects }}\n        run: |\n          echo \"$PROJECTS\" | jq -c '.[]' | while IFS= read -r project; do\n            workingDir=$(echo \"$project\" | jq -r '.workingDir')\n            pnpm -C \"$workingDir\" build:storybook\n          done\n\n      - name: Build Storybook\n        if: ${{ inputs.type == 'storybook' && inputs.storybook-projects == '[]' }}\n        env:\n          BUILD_SCRIPT: ${{ inputs.build-script }}\n        run: pnpm run \"$BUILD_SCRIPT\"\n\n      - name: Assemble site\n        env:\n          DEPLOY_TYPE: ${{ inputs.type }}\n          SITE_NAME: ${{ inputs.name }}\n          PROJECTS: ${{ inputs.storybook-projects }}\n          STORYBOOK_OUTPUT_DIR: ${{ inputs.output-dir }}\n        run: |\n          mkdir -p _site\n          if [ \"$DEPLOY_TYPE\" = \"docs\" ]; then\n            if [ -n \"$SITE_NAME\" ]; then\n              # Site built with base: /<name>/ — nest under _site/<name>/ so asset\n              # paths match (/name/_astro/... → served at /name/_astro/...).\n              mkdir -p \"_site/${SITE_NAME}\"\n              cp -r docs/dist/. \"_site/${SITE_NAME}/\"\n              # Redirect root to the base path so the preview URL lands correctly.\n              printf \"/ /%s/ 301\\n\" \"$SITE_NAME\" > _site/_redirects\n            else\n              cp -r docs/dist/. _site/\n            fi\n          fi\n          if [ \"$PROJECTS\" != \"[]\" ]; then\n            echo \"$PROJECTS\" | jq -c '.[]' | while IFS= read -r project; do\n              name=$(echo \"$project\" | jq -r '.name // \"\"')\n              workingDir=$(echo \"$project\" | jq -r '.workingDir')\n              outputDir=$(echo \"$project\" | jq -r '.outputDir // \"storybook-static\"')\n              if [ -n \"$name\" ]; then\n                target=\"_site/sandbox/${name}\"\n              else\n                target=\"_site/sandbox\"\n              fi\n              mkdir -p \"$target\"\n              cp -r \"${workingDir}/${outputDir}/.\" \"$target/\"\n            done\n          elif [ \"$DEPLOY_TYPE\" = \"storybook\" ]; then\n            mkdir -p _site/sandbox\n            cp -r \"${STORYBOOK_OUTPUT_DIR}/.\" _site/sandbox/\n          fi\n\n      - name: Install Wrangler\n        # The action's install step runs npm/pnpm in the repo root; pnpm fails\n        # because it rejects adding to a workspace root without -w, and npm fails\n        # because package.json contains pnpm catalog: references it cannot parse.\n        # Pre-installing from /tmp (no package.json) lets the action find wrangler\n        # already on PATH and skip its own install entirely.\n        working-directory: /tmp\n        run: npm install -g wrangler@4\n\n      - uses: cloudflare/wrangler-action@ebbaa1584979971c8614a24965b4405ff95890e0 # v4.0.0\n        id: deploy\n        name: Deploy to Cloudflare Pages\n        # Skip when neither the per-repo input nor the org variable is set.\n        if: ${{ inputs.cloudflare-project != '' || vars.CLOUDFLARE_PAGES_PROJECT != '' }}\n        with:\n          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}\n          accountId: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}\n          packageManager: npm\n          command: >-\n            pages deploy _site\n            --project-name ${{ inputs.cloudflare-project || vars.CLOUDFLARE_PAGES_PROJECT }}\n            --branch ${{ github.event.repository.name }}-pr-${{ github.event.pull_request.number }}\n            --commit-dirty=true\n\n      - name: Report preview URL\n        if: ${{ steps.deploy.outputs.pages-deployment-alias-url != '' }}\n        env:\n          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n          ALIAS: ${{ steps.deploy.outputs.pages-deployment-alias-url }}\n          SITE_NAME: ${{ inputs.name }}\n          PROJECT: ${{ inputs.cloudflare-project || vars.CLOUDFLARE_PAGES_PROJECT }}\n        run: |\n          PREVIEW_URL=\"${ALIAS%/}${SITE_NAME:+/${SITE_NAME}}/\"\n          # GITHUB_HEAD_REF is the PR branch name — links the deployment to this PR's sidebar widget.\n          PAYLOAD=$(printf '{\"ref\":\"%s\",\"environment\":\"%s\",\"description\":\"Cloudflare Pages\",\"production_environment\":false,\"auto_merge\":false,\"required_contexts\":[]}' \\\n            \"$GITHUB_HEAD_REF\" \"${PROJECT} (Preview)\")\n          DEPLOY_ID=$(echo \"$PAYLOAD\" | gh api \"repos/${GITHUB_REPOSITORY}/deployments\" \\\n            --method POST --input - | jq -r '.id')\n          gh api \"repos/${GITHUB_REPOSITORY}/deployments/${DEPLOY_ID}/statuses\" \\\n            --method POST --field state=success --field environment_url=\"${PREVIEW_URL}\"\n\n  cleanup:\n    name: Clean up Preview\n    if: ${{ github.event.action == 'closed' }}\n    runs-on: ubuntu-latest\n    permissions:\n      contents: read\n      deployments: write\n      pull-requests: write\n    steps:\n      - name: Delete Cloudflare Pages deployments for branch\n        if: ${{ inputs.cloudflare-project != '' || vars.CLOUDFLARE_PAGES_PROJECT != '' }}\n        env:\n          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}\n          CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}\n          PROJECT: ${{ inputs.cloudflare-project || vars.CLOUDFLARE_PAGES_PROJECT }}\n          BRANCH: ${{ github.event.repository.name }}-pr-${{ github.event.pull_request.number }}\n          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n        run: |\n          DEPLOYMENTS=$(curl -s \\\n            \"https://api.cloudflare.com/client/v4/accounts/${CLOUDFLARE_ACCOUNT_ID}/pages/projects/${PROJECT}/deployments\" \\\n            -H \"Authorization: Bearer ${CLOUDFLARE_API_TOKEN}\" \\\n            | jq -r --arg b \"$BRANCH\" \\\n              '.result[] | select(.deployment_trigger.metadata.branch == $b) | .id')\n\n          if [ -z \"$DEPLOYMENTS\" ]; then\n            echo \"No deployments found for branch ${BRANCH} — nothing to clean up.\"\n            exit 0\n          fi\n\n          for id in $DEPLOYMENTS; do\n            echo \"Deleting CF Pages deployment: $id\"\n            curl -s -X DELETE \\\n              \"https://api.cloudflare.com/client/v4/accounts/${CLOUDFLARE_ACCOUNT_ID}/pages/projects/${PROJECT}/deployments/${id}?force=true\" \\\n              -H \"Authorization: Bearer ${CLOUDFLARE_API_TOKEN}\" | jq -r 'if .success then \"  ✓ deleted\" else \"  ✗ \\(.errors[0].message)\" end'\n          done\n\n          # Mark the GitHub Deployment environment as inactive.\n          ENV_NAME=\"${PROJECT} (Preview)\"\n          gh api \"repos/${GITHUB_REPOSITORY}/deployments\" \\\n            | jq -r \".[] | select(.environment == \\\"${ENV_NAME}\\\") | .id\" \\\n            | while read -r deploy_id; do\n                gh api \"repos/${GITHUB_REPOSITORY}/deployments/${deploy_id}/statuses\" \\\n                  --method POST --field state=inactive 2>/dev/null || true\n              done\n";
+//#endregion
+//#region src/templates/reusable/review.yml
+var review_default$1 = "name: Review\n\n# ReviewDog is the annotation layer — posts inline PR diff annotations.\n# Runs on pull_request only: inline annotations require PR context,\n# and branch protection ensures all changes go through PRs anyway.\n# security.secretDetection.yml / sourceQuality.structuredDataValidation.yml\n# are the CI gates covering push + PR events. Gitleaks and YAML are\n# intentionally duplicated: those gate merges; ReviewDog surfaces exact\n# line annotations in the PR diff.\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n\njobs:\n  reviewdog:\n    name: Post inline lint annotations\n    runs-on: ubuntu-latest\n    timeout-minutes: 20\n    permissions:\n      contents: read\n      pull-requests: write\n\n    steps:\n      - name: Checkout repository\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          fetch-depth: 0\n\n      - name: Setup\n        if: ${{ hashFiles('pnpm-lock.yaml') != '' }}\n        uses: theholocron/.github/.github/actions/setup@main\n\n      - name: Install ReviewDog\n        uses: reviewdog/action-setup@d8a7baabd7f3e8544ee4dbde3ee41d0011c3a93f # v1\n        with:\n          reviewdog_version: latest\n\n      # Detect which tools are relevant for this repo, excluding node_modules.\n      # hashFiles('**/*') recurses into node_modules/.pnpm and produces false\n      # positives for repos that don't own those file types.\n      # -print -quit stops find after the first match without a pipe, avoiding\n      # the SIGPIPE/pipefail exit-141 that find|head-1 triggers under\n      # GitHub Actions' default bash --noprofile --norc -e -o pipefail mode.\n      - name: Detect project features\n        id: detect\n        shell: bash\n        run: |\n          has() { find . -not -path '*/node_modules/*' -name \"$1\" -print -quit 2>/dev/null | grep -q .; }\n          has_ext() { find . -not -path '*/node_modules/*' -name \"$1\" -print -quit 2>/dev/null | grep -q .; }\n          { { has 'eslint.config.js' || has 'eslint.config.mjs' || has 'eslint.config.cjs' || \\\n              has 'eslint.config.ts' || has '.eslintrc' || has '.eslintrc.js' || \\\n              has '.eslintrc.cjs' || has '.eslintrc.json' || has '.eslintrc.yaml' || \\\n              has '.eslintrc.yml'; } && grep -qF '\"eslint\":' package.json 2>/dev/null; } && echo \"eslint=true\" >> \"$GITHUB_OUTPUT\" || echo \"eslint=false\" >> \"$GITHUB_OUTPUT\"\n          { has 'tsconfig.json' && grep -qF '\"typescript\":' package.json 2>/dev/null; } && echo \"tsconfig=true\" >> \"$GITHUB_OUTPUT\" || echo \"tsconfig=false\" >> \"$GITHUB_OUTPUT\"\n          has_ext '*.sh' && echo \"shell=true\" >> \"$GITHUB_OUTPUT\" || echo \"shell=false\" >> \"$GITHUB_OUTPUT\"\n          has 'Dockerfile' || has_ext '*.Dockerfile' || has 'Containerfile' && \\\n            echo \"docker=true\" >> \"$GITHUB_OUTPUT\" || echo \"docker=false\" >> \"$GITHUB_OUTPUT\"\n          has_ext '.env*' && echo \"dotenv=true\" >> \"$GITHUB_OUTPUT\" || echo \"dotenv=false\" >> \"$GITHUB_OUTPUT\"\n          has_ext '*.md' && echo \"markdown=true\" >> \"$GITHUB_OUTPUT\" || echo \"markdown=false\" >> \"$GITHUB_OUTPUT\"\n\n      #\n      # Always applicable\n      #\n\n      - name: Gitleaks (secrets)\n        uses: reviewdog/action-gitleaks@2b7b5685e3e3eecddab5d30cfa04f18123031421 # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / gitleaks\"\n          fail_level: error\n          gitleaks_flags: --log-opts=${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }}\n\n      - name: YamlLint\n        if: ${{ hashFiles('.yamllint.yml') != '' }}\n        uses: reviewdog/action-yamllint@b5f7217d8c815ae374d1d55840d5e569d82f01f0 # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / yamllint\"\n          fail_level: error\n          yamllint_flags: -c ${{ github.workspace }}/.yamllint.yml ${{ github.workspace }}\n\n      - name: ActionLint (GitHub Actions)\n        if: ${{ hashFiles('.github/workflows/*.yml', '.github/workflows/*.yaml') != '' }}\n        uses: reviewdog/action-actionlint@6fb7acc99f4a1008869fa8a0f09cfca740837d9d # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / actionlint\"\n          fail_level: error\n\n      #\n      # TypeScript / JavaScript\n      #\n\n      - name: ESLint\n        if: steps.detect.outputs.eslint == 'true'\n        uses: reviewdog/action-eslint@556a3fdaf8b4201d4d74d406013386aa4f7dab96 # v1.34.0\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / eslint\"\n          fail_level: error\n          eslint_flags: .\n\n      - name: TypeScript\n        if: steps.detect.outputs.tsconfig == 'true'\n        uses: EPMatt/reviewdog-action-tsc@63d923a3c5b4497671940b8874f58a404e2351b5 # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / tsc\"\n          fail_level: error\n\n      #\n      # Shell\n      #\n\n      - name: ShellCheck\n        if: steps.detect.outputs.shell == 'true'\n        uses: reviewdog/action-shellcheck@4c07458293ac342d477251099501a718ae5ef86e # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / shellcheck\"\n          fail_level: none\n\n      #\n      # Docker\n      #\n\n      - name: Hadolint\n        if: steps.detect.outputs.docker == 'true'\n        uses: reviewdog/action-hadolint@1b2cfa6ba72072ad35158d7ff3aa49bbdc03506d # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / hadolint\"\n          fail_level: none\n\n      #\n      # Environment files\n      #\n\n      - name: dotenv-linter\n        if: steps.detect.outputs.dotenv == 'true'\n        uses: dotenv-linter/action-dotenv-linter@afde61cfda2ecffe7bea35837b6f20b956c88689 # v3.0.0\n        with:\n          reporter: github-code-suggestions\n\n      #\n      # Documentation\n      #\n\n      - name: Alex (inclusive language)\n        if: steps.detect.outputs.markdown == 'true'\n        uses: reviewdog/action-alex@347481655add010a2ae302df34b57c9bcfa0d6e4 # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / alex\"\n";
+//#endregion
+//#region src/templates/reusable/security.codeScanning.yml
+var security_codeScanning_default$1 = "name: Security\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      language:\n        description: CodeQL language to analyze\n        type: string\n        required: false\n        default: javascript-typescript\n\njobs:\n  analyze:\n    name: Analyze (${{ inputs.language }})\n    permissions:\n      actions: read\n      contents: read\n      security-events: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 45\n    # Do not cancel in-progress security scans.\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0\n        name: Initialize CodeQL\n        with:\n          languages: ${{ inputs.language }}\n\n      - uses: github/codeql-action/autobuild@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0\n        name: Autobuild\n\n      - uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0\n        name: Analyze\n        with:\n          category: /language:${{ inputs.language }}\n";
+//#endregion
+//#region src/templates/reusable/security.secretDetection.yml
+var security_secretDetection_default$1 = "name: Secret Detection\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  secret-detection:\n    name: Run gitleaks\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n\n      # gitleaks has no npm distribution — install the prebuilt binary via\n      # the maintainer's own documented install script.\n      # NOTE: unverified against a live CI run at authoring time (D12) — flag\n      # here if this needs adjustment.\n      - name: Install gitleaks\n        run: |\n          curl -sSfL https://raw.githubusercontent.com/gitleaks/gitleaks/master/install.sh | sh -s -- -b /usr/local/bin\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Run gitleaks\n        with:\n          task: security.secretDetection\n";
+//#endregion
+//#region src/templates/reusable/sourceQuality.deadCodeAnalysis.yml
+var sourceQuality_deadCodeAnalysis_default$1 = "name: Dead Code Analysis\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  dead-code-analysis:\n    name: Run knip\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          persist-credentials: false\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Run knip\n        with:\n          task: sourceQuality.deadCodeAnalysis\n";
+//#endregion
+//#region src/templates/reusable/sourceQuality.formatting.yml
+var sourceQuality_formatting_default$1 = "name: Formatting\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      enable-auto-commit:\n        description: >\n          Auto-commit prettier/editorconfig/markdownlint --fix results as a\n          verified commit via a GitHub App (same App used across every\n          formatting-capable task — D12).\n        type: boolean\n        required: false\n        default: false\n    secrets:\n      SUPER_LINTER_APP_ID:\n        required: false\n      SUPER_LINTER_PRIVATE_KEY:\n        required: false\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  formatting:\n    name: Run prettier, editorconfig-checker, markdownlint\n    permissions:\n      contents: write\n      statuses: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n      APP_ID_SET: ${{ secrets.SUPER_LINTER_APP_ID != '' }}\n    steps:\n      - name: Generate GitHub App token\n        id: app-token\n        if: >\n          inputs.enable-auto-commit == true &&\n          github.event.pull_request != null &&\n          github.event.pull_request.head.repo.full_name == github.repository &&\n          github.ref_name != github.event.repository.default_branch &&\n          env.APP_ID_SET == 'true'\n        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0\n        with:\n          app-id: ${{ secrets.SUPER_LINTER_APP_ID }}\n          private-key: ${{ secrets.SUPER_LINTER_PRIVATE_KEY }}\n\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n          token: ${{ steps.app-token.outputs.token || github.token }}\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      # editorconfig-checker has no npm distribution — install the prebuilt\n      # binary from its release tarball (v4.0.1+ ships the binary at the\n      # tarball root as `editorconfig-checker`, not `bin/ec-<os>-<arch>` —\n      # confirmed against a live CI run; the old asset name/path 404s now).\n      - name: Install editorconfig-checker\n        run: |\n          curl -sSL https://github.com/editorconfig-checker/editorconfig-checker/releases/latest/download/editorconfig-checker-linux-amd64.tar.gz \\\n            | tar xz -C /usr/local/bin editorconfig-checker\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Run prettier, editorconfig-checker, markdownlint\n        with:\n          task: sourceQuality.formatting\n\n      - uses: theholocron/.github/.github/actions/auto-commit@main\n        name: Commit and push formatting fixes\n        if: >\n          inputs.enable-auto-commit == true &&\n          github.event.pull_request != null &&\n          github.event.pull_request.head.repo.full_name == github.repository &&\n          github.ref_name != github.event.repository.default_branch &&\n          env.APP_ID_SET == 'true' &&\n          steps.app-token.conclusion == 'success'\n        with:\n          token: ${{ steps.app-token.outputs.token }}\n          branch: ${{ github.event.pull_request.head.ref || github.head_ref || github.ref }}\n          commit-message: \"chore: fix formatting issues\"\n          commit-options: \"--no-verify\"\n";
+//#endregion
+//#region src/templates/reusable/sourceQuality.staticAnalysis.yml
+var sourceQuality_staticAnalysis_default$1 = "name: Static Analysis\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      enable-auto-commit:\n        description: >\n          Auto-commit eslint --fix results as a verified commit via a GitHub App.\n          Requires SUPER_LINTER_APP_ID and SUPER_LINTER_PRIVATE_KEY secrets\n          (same App used across every formatting-capable task — D12).\n        type: boolean\n        required: false\n        default: false\n    secrets:\n      SUPER_LINTER_APP_ID:\n        required: false\n      SUPER_LINTER_PRIVATE_KEY:\n        required: false\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  static-analysis:\n    name: Run eslint and actionlint\n    permissions:\n      contents: write\n      statuses: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n      APP_ID_SET: ${{ secrets.SUPER_LINTER_APP_ID != '' }}\n    steps:\n      - name: Generate GitHub App token\n        id: app-token\n        if: >\n          inputs.enable-auto-commit == true &&\n          github.event.pull_request != null &&\n          github.event.pull_request.head.repo.full_name == github.repository &&\n          github.ref_name != github.event.repository.default_branch &&\n          env.APP_ID_SET == 'true'\n        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0\n        with:\n          app-id: ${{ secrets.SUPER_LINTER_APP_ID }}\n          private-key: ${{ secrets.SUPER_LINTER_PRIVATE_KEY }}\n\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n          token: ${{ steps.app-token.outputs.token || github.token }}\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      # actionlint has no npm distribution — install the prebuilt binary via\n      # the maintainer's own documented download script.\n      # NOTE: unverified against a live CI run at authoring time (D12) — flag\n      # here if this needs adjustment.\n      - name: Install actionlint\n        run: |\n          bash <(curl -sSf https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)\n          sudo mv ./actionlint /usr/local/bin/actionlint\n\n      - name: Check for merge-conflict markers\n        # No package distributes this as a standalone tool — a plain grep for\n        # the marker lines (the same check the old bundled linter ran, D12).\n        run: |\n          if grep -rlnE '^(<{7}|={7}|>{7})( |$)' \\\n            --exclude-dir=.git --exclude-dir=node_modules .; then\n            echo \"::error::merge-conflict markers found\"\n            exit 1\n          fi\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Run eslint and actionlint\n        with:\n          task: sourceQuality.staticAnalysis\n\n      - uses: theholocron/.github/.github/actions/auto-commit@main\n        name: Commit and push eslint --fix\n        if: >\n          inputs.enable-auto-commit == true &&\n          github.event.pull_request != null &&\n          github.event.pull_request.head.repo.full_name == github.repository &&\n          github.ref_name != github.event.repository.default_branch &&\n          env.APP_ID_SET == 'true' &&\n          steps.app-token.conclusion == 'success'\n        with:\n          token: ${{ steps.app-token.outputs.token }}\n          branch: ${{ github.event.pull_request.head.ref || github.head_ref || github.ref }}\n          commit-message: \"chore: fix static-analysis issues\"\n          commit-options: \"--no-verify\"\n";
+//#endregion
+//#region src/templates/reusable/sourceQuality.structuredDataValidation.yml
+var sourceQuality_structuredDataValidation_default$1 = "name: Structured Data Validation\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  structured-data-validation:\n    name: Run yamllint\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      # yamllint has no npm distribution — Python ships preinstalled on\n      # ubuntu-latest runners.\n      - name: Install yamllint\n        run: pip install --user yamllint\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Run yamllint\n        with:\n          task: sourceQuality.structuredDataValidation\n";
+//#endregion
+//#region src/templates/reusable/stale.yml
+var stale_default$1 = "name: Stale\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      days-before-stale:\n        description: Days of inactivity before an issue or PR is marked stale (applies to both unless type-specific value is set)\n        type: number\n        required: false\n        default: 30\n      days-before-close:\n        description: Days after stale label before closing (applies to both unless type-specific value is set)\n        type: number\n        required: false\n        default: 5\n      days-before-issue-stale:\n        description: Days of inactivity before an issue is marked stale; overrides days-before-stale when set to a non-negative value\n        type: number\n        required: false\n        default: -1\n      days-before-issue-close:\n        description: Days after stale label before closing an issue; overrides days-before-close when set to a non-negative value\n        type: number\n        required: false\n        default: -1\n      days-before-pr-stale:\n        description: Days of inactivity before a PR is marked stale; overrides days-before-stale when set to a non-negative value\n        type: number\n        required: false\n        default: -1\n      days-before-pr-close:\n        description: Days after stale label before closing a PR; overrides days-before-close when set to a non-negative value\n        type: number\n        required: false\n        default: -1\n      exempt-issue-labels:\n        description: Comma-separated labels that exempt an issue from being marked stale\n        type: string\n        required: false\n        default: \"in-progress,wip\"\n      exempt-pr-labels:\n        description: Comma-separated labels that exempt a PR from being marked stale\n        type: string\n        required: false\n        default: \"\"\n      exempt-all-issue-milestones:\n        description: Issues assigned to any milestone are never marked stale\n        type: boolean\n        required: false\n        default: true\n      exempt-all-pr-milestones:\n        description: PRs assigned to any milestone are never marked stale\n        type: boolean\n        required: false\n        default: true\n      exempt-all-issue-projects:\n        description: Issues assigned to any project are never marked stale\n        type: boolean\n        required: false\n        default: true\n      exempt-all-pr-projects:\n        description: PRs assigned to any project are never marked stale\n        type: boolean\n        required: false\n        default: true\n\njobs:\n  stale:\n    name: Mark stale issues and pull requests\n    permissions:\n      contents: write\n      issues: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    steps:\n      - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0\n        name: Run Stale\n        with:\n          close-issue-message: >\n            This issue was closed because it has been stalled for\n            ${{ inputs.days-before-close }} days with no activity.\n          days-before-close: ${{ inputs.days-before-close }}\n          days-before-issue-close: ${{ inputs.days-before-issue-close }}\n          days-before-issue-stale: ${{ inputs.days-before-issue-stale }}\n          days-before-pr-close: ${{ inputs.days-before-pr-close }}\n          days-before-pr-stale: ${{ inputs.days-before-pr-stale }}\n          days-before-stale: ${{ inputs.days-before-stale }}\n          exempt-all-issue-milestones: ${{ inputs.exempt-all-issue-milestones }}\n          exempt-all-issue-projects: ${{ inputs.exempt-all-issue-projects }}\n          exempt-all-pr-milestones: ${{ inputs.exempt-all-pr-milestones }}\n          exempt-all-pr-projects: ${{ inputs.exempt-all-pr-projects }}\n          exempt-issue-labels: ${{ inputs.exempt-issue-labels }}\n          exempt-pr-labels: ${{ inputs.exempt-pr-labels }}\n          stale-issue-label: wontfix\n          stale-issue-message: >\n            This issue is stale because it has been open ${{ inputs.days-before-stale }}\n            days with no activity. Remove the stale label or comment, or this will be\n            closed in ${{ inputs.days-before-close }} days.\n          stale-pr-label: wontfix\n          stale-pr-message: >\n            This PR is stale because it has been open ${{ inputs.days-before-stale }}\n            days with no activity. Remove the stale label or comment, or this will be\n            closed in ${{ inputs.days-before-close }} days.\n";
+//#endregion
+//#region src/templates/reusable/sync-dispatch.yml
+var sync_dispatch_default = "name: Sync Dispatch\n\non: # yamllint disable-line rule:truthy\n  workflow_dispatch:\n    inputs:\n      steps:\n        description: >\n          Sync steps to pass to each repo's sync.yml. Default is \"readme\"\n          (only README marker blocks are updated).\n        type: string\n        required: false\n        default: readme\n\npermissions:\n  contents: read\n\njobs:\n  broadcast:\n    name: Broadcast sync to all repos\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    steps:\n      - name: Dispatch sync to all repos with sync.yml\n        run: |\n          gh api /orgs/theholocron/repos --paginate --jq '.[].name' \\\n            | while IFS= read -r repo; do\n              gh api \"/repos/theholocron/$repo/contents/.github/workflows/sync.yml\" --silent 2>/dev/null || continue\n              echo \"Dispatching sync to theholocron/$repo\"\n              gh workflow run sync.yml \\\n                --repo \"theholocron/$repo\" \\\n                --field \"steps=$STEPS\" \\\n              || echo \"Warning: could not dispatch to theholocron/$repo — skipping\"\n            done\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN }}\n          STEPS: ${{ inputs.steps }}\n";
+//#endregion
+//#region src/templates/reusable/sync-github.yml
+var sync_github_default = "name: Sync workflow templates\n\n# Builds the holocron CLI from source and pushes updated workflow templates\n# and composite actions to downstream .github repos. Runs whenever the\n# template source files change on main or alpha.\n#\n# Secrets required:\n#   HOLOCRON_SYNC_TOKEN — fine-grained PAT (resource owner: org) with:\n#                  Actions:       Read and write  (dispatch workflow runs via gh workflow run)\n#                  Contents:      Read and write  (git trees, blobs, refs)\n#                  Pull requests: Read and write  (open sync PR)\n#                  Workflows:     Read and write  (write .github/workflows/*.yml)\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      primary-repo:\n        description: >\n          Primary .github repo — receives composite actions, reusable workflows,\n          and thin-caller templates. Requires a PR (branch protection assumed).\n        type: string\n        required: false\n        default: theholocron/.github\n      secondary-repos:\n        description: >\n          Space-separated list of secondary repos (reusable workflows + thin\n          callers only, no composite actions). Changes are delivered via pull\n          request, same as the primary repo.\n        type: string\n        required: false\n        default: \"\"\n      sync-branch:\n        description: Branch name used for the primary and secondary repo PRs\n        type: string\n        required: false\n        default: chore/sync-templates\n    secrets:\n      HOLOCRON_SYNC_TOKEN:\n        required: true\n      HOLOCRON_READ_TOKEN:\n        description: >\n          Fine-grained PAT for read-only GitHub API calls (e.g. resolving git\n          committer identity via `gh api user`). Falls back to HOLOCRON_SYNC_TOKEN.\n        required: false\n      GH_TOKEN:\n        description: >\n          Generic GitHub token fallback for `gh` CLI calls. Used when neither\n          HOLOCRON_READ_TOKEN nor HOLOCRON_SYNC_TOKEN is set.\n        required: false\n      HOLOCRON_AXIOM_TOKEN:\n        description: >\n          Axiom API token. When set alongside the HOLOCRON_AXIOM_DATASET\n          repo/org variable, the CLI ships this run's structured logs to Axiom.\n          Falls back to the vendor-native AXIOM_TOKEN secret.\n        required: false\n      AXIOM_TOKEN:\n        description: Vendor-native fallback for HOLOCRON_AXIOM_TOKEN.\n        required: false\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  sync:\n    name: Sync templates\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    permissions:\n      contents: read\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n      HOLOCRON_AXIOM_TOKEN: ${{ secrets.HOLOCRON_AXIOM_TOKEN || secrets.AXIOM_TOKEN }}\n      HOLOCRON_AXIOM_DATASET: ${{ vars.HOLOCRON_AXIOM_DATASET || vars.AXIOM_DATASET }}\n      POSTHOG_PROJECT_TOKEN: ${{ vars.POSTHOG_PROJECT_TOKEN }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: pnpm build\n        name: Build CLI\n\n      - name: Cache actionlint\n        id: cache-actionlint\n        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0\n        with:\n          path: /tmp/actionlint\n          key: actionlint-v1.7.7-linux-amd64\n\n      - name: Download actionlint\n        if: steps.cache-actionlint.outputs.cache-hit != 'true'\n        run: |\n          curl -fsSL https://github.com/rhysd/actionlint/releases/download/v1.7.7/actionlint_1.7.7_linux_amd64.tar.gz \\\n            | tar -xz -C /tmp actionlint\n\n      - name: Validate generated workflows\n        run: |\n          node packages/cli/dist/cli.mjs sync-github \\\n            --repo \"$PRIMARY_REPO\" \\\n            --output-dir /tmp/sync-validate\n          /tmp/actionlint /tmp/sync-validate/.github/workflows/*.yml\n        env:\n          PRIMARY_REPO: ${{ inputs.primary-repo }}\n\n      - name: Sync primary repo (PR)\n        run: |\n          GIT_NAME=$(gh api user --jq .name 2>/dev/null || echo \"github-actions[bot]\")\n          GIT_EMAIL=$(gh api user --jq '\"\\(.id)+\\(.login)@users.noreply.github.com\"' 2>/dev/null || echo \"41898282+github-actions[bot]@users.noreply.github.com\")\n          COMMIT_MSG=\"chore: sync from theholocron/holocron\"$'\\n\\n'\"Signed-off-by: $GIT_NAME <$GIT_EMAIL>\"\n          node packages/cli/dist/cli.mjs sync-github \\\n            --repo \"$PRIMARY_REPO\" \\\n            --branch \"$SYNC_BRANCH\" \\\n            --pr \\\n            --message \"$COMMIT_MSG\"\n          GH_TOKEN=\"$HOLOCRON_SYNC_TOKEN\" gh pr merge --auto --squash \\\n            --repo \"$PRIMARY_REPO\" \"$SYNC_BRANCH\" 2>/dev/null || true\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_READ_TOKEN || secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN }}\n          HOLOCRON_SYNC_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN }}\n          PRIMARY_REPO: ${{ inputs.primary-repo }}\n          SYNC_BRANCH: ${{ inputs.sync-branch }}\n\n      - name: Sync secondary repos (PR)\n        if: ${{ inputs.secondary-repos != '' }}\n        run: |\n          GIT_NAME=$(gh api user --jq .name 2>/dev/null || echo \"github-actions[bot]\")\n          GIT_EMAIL=$(gh api user --jq '\"\\(.id)+\\(.login)@users.noreply.github.com\"' 2>/dev/null || echo \"41898282+github-actions[bot]@users.noreply.github.com\")\n          COMMIT_MSG=\"chore: sync from theholocron/holocron\"$'\\n\\n'\"Signed-off-by: $GIT_NAME <$GIT_EMAIL>\"\n          for repo in $SECONDARY_REPOS; do\n            node packages/cli/dist/cli.mjs sync-github \\\n              --repo \"$repo\" \\\n              --branch \"$SYNC_BRANCH\" \\\n              --pr \\\n              --message \"$COMMIT_MSG\"\n            GH_TOKEN=\"$HOLOCRON_SYNC_TOKEN\" gh pr merge --auto --squash \\\n              --repo \"$repo\" \"$SYNC_BRANCH\" 2>/dev/null || true\n          done\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_READ_TOKEN || secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN }}\n          HOLOCRON_SYNC_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN }}\n          SECONDARY_REPOS: ${{ inputs.secondary-repos }}\n          SYNC_BRANCH: ${{ inputs.sync-branch }}\n";
+//#endregion
+//#region src/templates/reusable/tag.yml
+var tag_default = "name: Tag\n\n# Release Please — fully automated tag and GitHub Release from Conventional Commits.\n# No package.json or npm publishing required. Operates in \"simple\" mode by default:\n# analyzes commits since the last tag, maintains a rolling Release PR, and creates\n# a tag + GitHub Release when that PR is merged.\n#\n# The calling repo must have two files at the root:\n#   release-please-config.json    — declares packages and release-type\n#   .release-please-manifest.json — tracks the current version\n\non: # yamllint disable-line rule:truthy\n  # Self-trigger: when this workflow lives in theholocron/.github itself,\n  # push to main runs Release Please for that repo's own releases.\n  push:\n    branches:\n      - main\n  workflow_call:\n    inputs:\n      release-type:\n        description: Release Please release type (simple, node, python, etc.)\n        type: string\n        required: false\n        default: simple\n      config-file:\n        description: Path to release-please-config.json\n        type: string\n        required: false\n        default: release-please-config.json\n      manifest-file:\n        description: Path to .release-please-manifest.json\n        type: string\n        required: false\n        default: .release-please-manifest.json\n\njobs:\n  tag:\n    name: Tag release\n    permissions:\n      contents: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    steps:\n      - uses: google-github-actions/release-please-action@e4dc86ba9405554aeba3c6bb2d169500e7d3b4ee # v4.1.1\n        name: Run Release Please\n        with:\n          release-type: ${{ inputs.release-type }}\n          config-file: ${{ inputs.config-file }}\n          manifest-file: ${{ inputs.manifest-file }}\n";
+//#endregion
+//#region src/templates/reusable/verification.performance.yml
+var verification_performance_default$1 = "name: Audit the Performance\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      lighthouse-config:\n        description: >\n          Path to the Lighthouse CI config file, forwarded to `holocron run\n          verification.performance -- --config`. Defaults to\n          lighthouse.config.cjs (the org standard).\n        type: string\n        required: false\n        default: lighthouse.config.cjs\n    secrets:\n      LHCI_GITHUB_APP_TOKEN:\n        required: false\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  performance:\n    name: Run Lighthouse CI\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n      # Read by `lhci autorun` inside `holocron run verification.performance`.\n      LHCI_GITHUB_APP_TOKEN: ${{ secrets.LHCI_GITHUB_APP_TOKEN }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: npm install -g @lhci/cli@0.14.x\n        name: Install Lighthouse CLI\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Run Lighthouse CI\n        with:\n          task: verification.performance\n          args: --config=${{ inputs.lighthouse-config }}\n";
+//#endregion
+//#region src/templates/reusable/verification.typeSafety.yml
+var verification_typeSafety_default$1 = "name: Typecheck\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  typecheck:\n    name: Run tsc --noEmit\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Type check\n        with:\n          task: verification.typeSafety\n";
+//#endregion
+//#region src/templates/reusable/verification.unitTests.yml
+var verification_unitTests_default$1 = "name: Test\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      run-unit:\n        description: Run unit tests with coverage (disable for UI-only repos that use Storybook testing exclusively)\n        type: boolean\n        required: false\n        default: true\n      run-storybook:\n        description: Run Storybook vitest interaction tests (requires .storybook/ setup)\n        type: boolean\n        required: false\n        default: false\n      run-interaction:\n        description: Run Storybook interaction and accessibility tests with Playwright\n        type: boolean\n        required: false\n        default: false\n      run-chromatic:\n        description: Publish Storybook to Chromatic for visual regression testing\n        type: boolean\n        required: false\n        default: false\n      chromatic-projects:\n        description: >\n          JSON array of Chromatic projects to build, one matrix job per entry.\n          Each entry: { \"tokenName\": \"WEB\", \"workingDir\": \"apps/web\", \"buildScript\": \"build:storybook\" }.\n          tokenName maps to secret CHROMATIC_PROJECT_TOKEN_<TOKENNAME>; use \"default\"\n          (or omit for the legacy empty-string form) to use the bare CHROMATIC_PROJECT_TOKEN\n          secret for single-project repos.\n          buildScript defaults to \"build:storybook\" when omitted.\n          Default runs a single job from the repo root using CHROMATIC_PROJECT_TOKEN.\n        type: string\n        required: false\n        default: '[{\"tokenName\":\"default\",\"workingDir\":\".\",\"buildScript\":\"build:storybook\"}]'\n      run-user-flow:\n        description: Run Cypress E2E user-flow tests (requires cypress.config.*)\n        type: boolean\n        required: false\n        default: false\n      wait-on-url:\n        description: URL to wait for before running Cypress tests (default is Vite dev server; override for non-Vite stacks e.g. http://localhost:3000 for Next.js)\n        type: string\n        required: false\n        default: \"http://localhost:5173\"\n    secrets:\n      CHROMATIC_PROJECT_TOKEN:\n        required: false\n      CYPRESS_RECORD_KEY:\n        required: false\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  unit:\n    name: Run unit tests and collect coverage\n    if: ${{ inputs.run-unit }}\n    permissions:\n      contents: read\n      id-token: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Run tests with coverage\n        with:\n          task: verification.unitTests\n\n      # A Codecov upload must not fail silently. fail_ci_if_error makes a failed\n      # upload fail this step (the action's default is to log the error and pass),\n      # which fails the job and so the `Test / Conclusion` check. Whether that\n      # blocks a merge is up to whether the check is required, not this workflow\n      # (holocron#934).\n      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0\n        name: Upload coverage to Codecov\n        with:\n          use_oidc: true\n          fail_ci_if_error: true\n\n      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0\n        name: Upload test results to Codecov\n        if: ${{ !cancelled() }}\n        with:\n          use_oidc: true\n          fail_ci_if_error: true\n          report_type: test_results\n          files: \"**/test-report.junit.xml\"\n\n  storybook:\n    name: Run Storybook interaction tests\n    if: ${{ inputs.run-storybook }}\n    permissions:\n      contents: read\n      id-token: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: pnpm exec playwright install chromium --with-deps\n        name: Install Playwright\n\n      - run: pnpm test:storybook\n        name: Run Storybook tests\n\n      # A Codecov upload must not fail silently. fail_ci_if_error makes a failed\n      # upload fail this step (the action's default is to log the error and pass),\n      # which fails the job and so the `Test / Conclusion` check. Whether that\n      # blocks a merge is up to whether the check is required, not this workflow\n      # (holocron#934).\n      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0\n        name: Upload coverage to Codecov\n        with:\n          use_oidc: true\n          fail_ci_if_error: true\n\n      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0\n        name: Upload test results to Codecov\n        if: ${{ !cancelled() }}\n        with:\n          use_oidc: true\n          fail_ci_if_error: true\n          report_type: test_results\n          files: \"**/test-report.junit.xml\"\n\n  visual-and-composition:\n    # No explicit matrix reference here — a skipped job (run-chromatic:\n    # false, the common case) never expands its matrix, so a `${{\n    # matrix.project.tokenName }}` in name: has nothing to resolve and\n    # shows as raw template text in the checks UI. GitHub auto-appends\n    # the matrix values in parens when the matrix *does* expand, so this\n    # loses no distinctness across multiple Chromatic projects.\n    name: Run visual and composition tests\n    if: ${{ inputs.run-chromatic }}\n    strategy:\n      fail-fast: false\n      matrix:\n        project: ${{ fromJSON(inputs.chromatic-projects) }}\n    permissions:\n      contents: read\n      statuses: write\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: chromaui/action@14cfaef73576e69f95f47f60058063f46ca38719 # v18\n        name: Publish to Chromatic\n        with:\n          projectToken: ${{ (matrix.project.tokenName == 'default' || matrix.project.tokenName == '') && secrets.CHROMATIC_PROJECT_TOKEN || secrets[format('CHROMATIC_PROJECT_TOKEN_{0}', matrix.project.tokenName)] }}\n          token: ${{ github.token }}\n          buildScriptName: ${{ matrix.project.buildScript || 'build:storybook' }}\n          workingDir: ${{ matrix.project.workingDir || '.' }}\n          storybookBaseDir: ${{ matrix.project.storybookBaseDir || '' }}\n          untraced: ${{ matrix.project.untraced || '' }}\n          onlyStoryFiles: ${{ matrix.project.onlyStoryFiles || '' }}\n          exitZeroOnChanges: ${{ matrix.project.exitZeroOnChanges || false }}\n\n  interaction-and-accessibility:\n    name: Run interactions and accessibility tests\n    if: ${{ inputs.run-interaction }}\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: pnpm exec playwright install --with-deps\n        name: Install Playwright\n\n      - run: pnpm test:storybook\n        name: Run interaction and accessibility tests\n\n  user-flow:\n    name: Run user flow tests\n    if: ${{ inputs.run-user-flow }}\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    strategy:\n      fail-fast: false\n      matrix:\n        containers: [1, 2]\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: pnpm exec cypress install\n        name: Install Cypress binary\n\n      - uses: cypress-io/github-action@1052aa98bbbe4f55210f844878213c07d9c8c399 # v6.7.13\n        name: Cypress run\n        with:\n          start: pnpm dev\n          wait-on: ${{ inputs.wait-on-url }}\n          record: true\n          parallel: true\n        env:\n          CYPRESS_RECORD_KEY: ${{ secrets.CYPRESS_RECORD_KEY }}\n          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n\n  conclusion:\n    name: Conclusion\n    runs-on: ubuntu-latest\n    if: always()\n    needs: [unit, storybook, visual-and-composition, interaction-and-accessibility, user-flow]\n    steps:\n      - name: Check job statuses\n        run: |\n          if [[ \"$RESULTS\" == *\"failure\"* ]] || [[ \"$RESULTS\" == *\"cancelled\"* ]]; then\n            exit 1\n          fi\n        env:\n          RESULTS: ${{ join(needs.*.result, ',') }}\n";
+//#endregion
+//#region src/generators/github-action-thin-callers.ts
 /**
-* `holocron run <task> [job] [-- <passthrough>]` — run a registry task (or one
-* of its sub-jobs) locally.
-*
-* A `job` argument only applies to tasks that declare `jobs`; for any other
-* task it is folded back into the passthrough (`holocron run delivery.build
-* src/`).
+* Workflow templates + thin-caller generation.
 *
-* Resolution:
+* `WORKFLOW_TEMPLATES` holds each reusable `.github/workflows/<name>.yml`
+* (synced to `theholocron/.github`); `generateThinCallerContent` wraps one
+* into the thin caller `holocron setup` / `holocron sync` write locally.
+*/
+const WORKFLOW_TEMPLATES = {
+	"verification.unitTests": "name: Verification\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\nconcurrency:\n  group: test-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n  id-token: write\n  statuses: write\n\njobs:\n  test:\n    name: Test\n    uses: theholocron/.github/.github/workflows/verification.unitTests.yml@main\n    with:\n      run-unit: true\n    secrets: inherit\n",
+	"verification.typeSafety": "name: Verification\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\nconcurrency:\n  group: typecheck-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n\njobs:\n  typecheck:\n    name: Typecheck\n    uses: theholocron/.github/.github/workflows/verification.typeSafety.yml@main\n    secrets: inherit\n",
+	"verification.performance": "name: Verification\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\npermissions:\n  contents: read\n\njobs:\n  performance:\n    name: Audit the Performance\n    uses: theholocron/.github/.github/workflows/verification.performance.yml@main\n    secrets: inherit\n",
+	"sourceQuality.staticAnalysis": "name: Source Quality\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\nconcurrency:\n  group: source-quality-static-analysis-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: write\n  statuses: write\n\njobs:\n  static-analysis:\n    name: Static Analysis\n    uses: theholocron/.github/.github/workflows/sourceQuality.staticAnalysis.yml@main\n    secrets: inherit\n",
+	"sourceQuality.formatting": "name: Source Quality\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\nconcurrency:\n  group: source-quality-formatting-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: write\n  statuses: write\n\njobs:\n  formatting:\n    name: Formatting\n    uses: theholocron/.github/.github/workflows/sourceQuality.formatting.yml@main\n    secrets: inherit\n",
+	"sourceQuality.structuredDataValidation": "name: Source Quality\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\nconcurrency:\n  group: source-quality-structured-data-validation-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n\njobs:\n  structured-data-validation:\n    name: Structured Data Validation\n    uses: theholocron/.github/.github/workflows/sourceQuality.structuredDataValidation.yml@main\n    secrets: inherit\n",
+	"sourceQuality.deadCodeAnalysis": "name: Source Quality\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\npermissions:\n  contents: read\n\njobs:\n  dead-code-analysis:\n    name: Dead Code Analysis\n    uses: theholocron/.github/.github/workflows/sourceQuality.deadCodeAnalysis.yml@main\n    secrets: inherit\n",
+	"security.secretDetection": "name: Security\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\nconcurrency:\n  group: security-secret-detection-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n\njobs:\n  secret-detection:\n    name: Secret Detection\n    uses: theholocron/.github/.github/workflows/security.secretDetection.yml@main\n    secrets: inherit\n",
+	"security.codeScanning": "name: Security\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches:\n      - main\n  pull_request:\n    branches:\n      - main\n  schedule:\n    - cron: \"0 0 * * 1\"\n\npermissions:\n  actions: read\n  contents: read\n  security-events: write\n\njobs:\n  security:\n    name: Code Scanning\n    uses: theholocron/.github/.github/workflows/security.codeScanning.yml@main\n    secrets: inherit\n",
+	"delivery.build": "name: Delivery\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches-ignore:\n      - main # delivery.publish builds before publishing\n  pull_request:\n    branches:\n      - main\n\nconcurrency:\n  group: delivery.build-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n\njobs:\n  build:\n    name: Build\n    uses: theholocron/.github/.github/workflows/delivery.build.yml@main\n    secrets: inherit\n",
+	"delivery.publish": "name: Delivery\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches:\n      - main\n      - alpha\n  workflow_dispatch:\n    inputs:\n      dry_run:\n        description: >\n          Dry run — analyze commits and preview the release without git writes\n          or publish. Push-triggered runs always run fully; this only applies\n          to manual workflow_dispatch triggers.\n        required: false\n        default: true\n        type: boolean\n\npermissions:\n  contents: write\n  id-token: write\n  issues: write\n  pull-requests: write\n\nconcurrency:\n  group: ${{ github.workflow }}-${{ github.ref }}\n  cancel-in-progress: false\n\njobs:\n  release:\n    name: Release\n    uses: theholocron/.github/.github/workflows/delivery.publish.yml@main\n    with:\n      dry-run: ${{ inputs.dry_run == true }}\n    secrets: inherit\n",
+	"delivery.deploy": "name: Delivery\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main]\n  workflow_dispatch:\n\nconcurrency:\n  group: pages\n  cancel-in-progress: false\n\npermissions:\n  contents: read\n  pages: write\n  id-token: write\n\njobs:\n  deploy:\n    name: Deploy\n    uses: theholocron/.github/.github/workflows/delivery.deploy.yml@main\n    secrets: inherit\n",
+	"delivery.bundleSize": "name: Delivery\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\npermissions:\n  contents: read\n\njobs:\n  bundle-size:\n    name: Audit the Bundle Size\n    uses: theholocron/.github/.github/workflows/delivery.bundleSize.yml@main\n    secrets: inherit\n",
+	"platform.repoSync": "name: Platform\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main]\n    paths:\n      - holocron.config.ts\n      - package.json\n      - pnpm-workspace.yaml\n  workflow_dispatch:\n    inputs:\n      steps:\n        description: \"Sync steps to run (default: all)\"\n        type: string\n        required: false\n\nconcurrency:\n  group: sync-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: write\n  pull-requests: write\n\njobs:\n  sync:\n    name: Sync\n    uses: theholocron/.github/.github/workflows/platform.repoSync.yml@main\n    with:\n      steps: ${{ inputs.steps }}\n    secrets: inherit\n",
+	"platform.commitStandards": "name: Platform\n\non: # yamllint disable-line rule:truthy\n  pull_request:\n\nconcurrency:\n  group: platform-commit-standards-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n\njobs:\n  commit-standards:\n    name: Commit Standards\n    uses: theholocron/.github/.github/workflows/platform.commitStandards.yml@main\n    secrets: inherit\n",
+	"platform.repoValidation": "name: Platform\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\npermissions:\n  contents: read\n\njobs:\n  repo-validation:\n    name: Repo Validation\n    uses: theholocron/.github/.github/workflows/platform.repoValidation.yml@main\n    secrets: inherit\n",
+	"knowledge.wiki": "name: Knowledge\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main]\n  pull_request:\n    branches: [main]\n\nconcurrency:\n  group: ${{ github.event_name == 'pull_request' && format('wiki-preview-{0}', github.event.pull_request.number) || 'wiki' }}\n  cancel-in-progress: ${{ github.event_name == 'pull_request' }}\n\npermissions:\n  contents: read\n  deployments: write\n\njobs:\n  publish:\n    name: Publish\n    if: ${{ github.event_name != 'pull_request' }}\n    uses: theholocron/.github/.github/workflows/knowledge.wiki.yml@main\n    secrets: inherit\n\n  preview:\n    name: Preview\n    if: ${{ github.event_name == 'pull_request' }}\n    uses: theholocron/.github/.github/workflows/knowledge.wiki.yml@main\n    with:\n      preview: true\n      preview-id: pr-${{ github.event.pull_request.number }}\n    secrets: inherit\n",
+	preview: "name: Preview\n\non: # yamllint disable-line rule:truthy\n  pull_request:\n    branches: [main]\n\nconcurrency:\n  group: preview-${{ github.event.pull_request.number }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n  deployments: write\n  pull-requests: write\n\njobs:\n  preview:\n    name: Preview\n    uses: theholocron/.github/.github/workflows/preview.yml@main\n    secrets: inherit\n",
+	review: "name: Source Quality\n\non: # yamllint disable-line rule:truthy\n  pull_request:\n\nconcurrency:\n  group: review-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n  checks: write\n  pull-requests: write\n\njobs:\n  review:\n    name: Annotations\n    uses: theholocron/.github/.github/workflows/review.yml@main\n    secrets: inherit\n",
+	stale: "name: Stale\n\non: # yamllint disable-line rule:truthy\n  schedule:\n    - cron: \"30 1 * * *\"\n\npermissions:\n  contents: write\n  issues: write\n  pull-requests: write\n\njobs:\n  stale:\n    uses: theholocron/.github/.github/workflows/stale.yml@main\n    with:\n      exempt-issue-labels: \"in-progress,wip\"\n      exempt-all-issue-milestones: true\n      exempt-all-issue-projects: true\n      exempt-all-pr-projects: true\n    secrets: inherit\n",
+	greetings: "name: Platform\n\non: # yamllint disable-line rule:truthy\n  pull_request:\n  issues:\n\npermissions:\n  issues: write\n  pull-requests: write\n\njobs:\n  greetings:\n    name: Greetings\n    uses: theholocron/.github/.github/workflows/greetings.yml@main\n    secrets: inherit\n",
+	dependencies: "name: Platform\n\non: # yamllint disable-line rule:truthy\n  pull_request:\n\npermissions:\n  contents: write\n  pull-requests: write\n\njobs:\n  dependencies:\n    name: Dependencies\n    uses: theholocron/.github/.github/workflows/dependencies.yml@main\n    secrets: inherit\n",
+	bookkeeping: "name: Platform\n\non: # yamllint disable-line rule:truthy\n  pull_request:\n    types:\n      - opened\n      - edited\n\npermissions:\n  contents: read\n  issues: write\n  pull-requests: write\n\njobs:\n  bookkeeping:\n    name: Bookkeeping\n    uses: theholocron/.github/.github/workflows/bookkeeping.yml@main\n    secrets: inherit\n"
+};
+const KNOWN_WORKFLOWS = new Set(Object.keys(WORKFLOW_TEMPLATES));
+/**
+* The GitHub status-check context a `required` task contributes to branch
+* protection. Format: `"{workflow name} / {job name}"`.
 *
-*   J. job given                              → TASKS[task].jobs[job].local (unknown job → exit 1)
-*   1. turbo.json defines the task            → `turbo run <task>`
-*   2. package.json has a `<task>` script     → `<pm> run <task>`
-*      (unless it's the `holocron run …` thin caller — that recurses)
-*   3. TASKS[task].local resolves             → `<tool> <args> <org-flags> <passthrough>`
-*   3b. TASKS[task].linterGroup               → run each resolved linter natively (see below)
-*   4. TASKS[task].jobs has entries           → run each job in declared order
-*   5. TASKS[task].local === null             → "enforced in CI" (skip, even with --required)
-*   5b. known task, nothing resolved          → "no <task> task" (exit 0, or 1 with --required)
-*   6. unknown task                           → "unknown task" (exit 1)
+* Most of these are single-job workflows now (D3's decomposition split what
+* used to be multi-job `lint`/`audit` into one task per concern) — the
+* context names that job directly, no `Conclusion` aggregator needed; a
+* single job's own conclusion already *is* the workflow's conclusion.
+* `Conclusion` fan-in jobs are kept only where a task genuinely has several
+* conditionally-run jobs feeding one required check:
+* `verification.unitTests` (unit / Storybook / Chromatic / interaction /
+* user-flow, each gated by its own `run-*` input) and
+* `platform.repoValidation` (its three script jobs all must pass). Only
+* merge-gating workflows are listed. `astromech.requiredChecks()` reads this
+* for every `required` task.
+*/
+const WORKFLOW_CHECK_CONTEXTS = {
+	"delivery.build": "Build / Build every workspace",
+	"verification.unitTests": "Test / Conclusion",
+	"verification.typeSafety": "Typecheck / Run tsc --noEmit",
+	"verification.performance": "Audit the Performance / Run Lighthouse CI",
+	"sourceQuality.staticAnalysis": "Static Analysis / Run eslint and actionlint",
+	"sourceQuality.formatting": "Formatting / Run prettier, editorconfig-checker, markdownlint",
+	"sourceQuality.structuredDataValidation": "Structured Data Validation / Run yamllint",
+	"sourceQuality.deadCodeAnalysis": "Dead Code Analysis / Run knip",
+	"security.secretDetection": "Secret Detection / Run gitleaks",
+	"platform.commitStandards": "Commit Standards / Run commitlint",
+	"platform.repoValidation": "Repo Validation / Conclusion",
+	"delivery.bundleSize": "Audit the Bundle Size / Upload bundle stats to Codecov"
+};
+/**
+* Generate the thin caller content for a workflow, optionally injecting or
+* merging `with:` overrides into the jobs block.
 *
-* A `linterGroup` task (`sourceQuality.staticAnalysis`, etc.) runs its fixed
-* set of `linters.ts` entries, each still gated by that linter's own
-* `detect`/`always` rule — every entry runs its `localBin` natively when
-* found on PATH. Missing tools are flagged; the exit code is the worst of
-* the lot. Unlike the old single `lint` task, this check runs *after*
-* turbo/`package.json` resolution (step 3b, not step 0) — a `linterGroup`
-* task is a normal turbo-delegatable task like any other.
+* Two strategies are used depending on the template:
+* - Templates that already have a `with:` block (e.g. lint):
+*   the override entries are merged in, replacing existing keys and appending
+*   new ones.
+* - Templates that end with `    secrets: inherit`: a new `with:` block is
+*   injected immediately before `secrets: inherit`.
+* If neither pattern matches the template, a warning is emitted and the
+* base template is returned unchanged.
 */
-/** The per-command runner — `runTask` and `runLintAggregate` share it. */
-function makeRunOne(input) {
-	const { print, logger, exec, task, cwd } = input;
-	const dryRun = input.dryRun ?? false;
-	return (cmd, args) => {
-		const command = [cmd, ...args].join(" ");
-		if (dryRun) {
-			print(`would run: ${command}`);
-			logger.debug({
-				task,
-				command,
-				status: "dry-run"
-			}, `run: ${task}`);
-			return {
-				status: "dry-run",
-				command
-			};
-		}
-		print(`→ ${command}`);
-		const { exitCode } = exec(cmd, args, { cwd });
-		const status = exitCode === 0 ? "ok" : "fail";
-		logger[status === "fail" ? "warn" : "debug"]({
-			task,
-			command,
-			exitCode,
-			status
-		}, `run: ${task}`);
-		return {
-			status,
-			command,
-			...status === "fail" ? { message: `\`${command}\` exited ${exitCode}` } : {}
-		};
+function generateThinCallerContent(name, withOverrides, additionalPaths, logger, comments) {
+	const base = WORKFLOW_TEMPLATES[name];
+	if (!base) return "";
+	const yamlScalar = (v) => {
+		if (v === true) return "true";
+		if (v === false) return "false";
+		const s = String(v);
+		return s.startsWith("[") || s.startsWith("{") ? `'${s}'` : s;
 	};
-}
-function runTask(input) {
-	const { print, logger, readFile, fileExists, listDir, task, cwd } = input;
-	const def = TASKS[task];
-	let job = input.job;
-	let passthrough = input.passthrough ?? [];
-	if (job !== void 0 && !def?.jobs) {
-		passthrough = [job, ...passthrough];
-		job = void 0;
-	}
-	if (job !== void 0) {
-		const jobDef = def.jobs[job];
-		if (!jobDef) {
-			const known = Object.keys(def.jobs).join(", ");
-			print(`✗ unknown job "${job}" for "${task}" (known: ${known})`);
-			logger.warn({
-				task,
-				job,
-				status: "unknown"
-			}, `run: ${task} ${job}`);
-			return {
-				status: "unknown",
-				message: `unknown job "${task} ${job}"`
-			};
-		}
-		const label = `${task} ${job}`;
-		return runUnit(input, label, jobDef.local, makeRunOne({
-			...input,
-			task: label
-		}), passthrough);
-	}
-	const run = makeRunOne(input);
-	if (turboDefinesTask(cwd, task, readFile, fileExists)) {
-		const filterArg = input.filter ? [`--filter=${input.filter}`] : [];
-		const forwarded = [...def?.local && !def.local.command && def.local.tool ? def.flags?.[def.local.tool] ?? [] : [], ...passthrough];
-		const args = [
-			"run",
-			task,
-			...filterArg,
-			...forwarded.length ? ["--", ...forwarded] : []
-		];
-		return run(resolveBin(cwd, "turbo", fileExists), args);
-	}
-	const script = packageJsonScript(cwd, task, readFile, fileExists);
-	if (script && !/^holocron run\b/.test(script.trim())) return run(packageManager(cwd, readFile, fileExists), [
-		"run",
-		task,
-		...passthrough.length ? ["--", ...passthrough] : []
-	]);
-	if (def?.local) {
-		if (def.local.command) return run(process.execPath, [
-			process.argv[1],
-			def.local.command,
-			...passthrough
-		]);
-		const runner = resolveRunner(def.local, cwd, listDir, readFile);
-		if (runner) {
-			const flags = (def.flags?.[runner.tool] ?? []).filter((f) => !passthrough.includes(f));
-			const configFlags = resolveToolConfig(runner.tool, cwd, {
-				readFile,
-				fileExists
-			});
-			return run(resolveBin(cwd, runner.tool, fileExists), [
-				...runner.args,
-				...configFlags,
-				...flags,
-				...passthrough
-			]);
+	const fmt = (k, v) => {
+		const line = `      ${k}: ${yamlScalar(v)}`;
+		return comments?.[k] ? `      # ${comments[k]}\n${line}` : line;
+	};
+	let result = base;
+	if (additionalPaths && additionalPaths.length > 0) {
+		const pathsBlockRe = /( {4}paths:\n)((?:[ ]{6}- [^\n]+\n)+)/;
+		if (pathsBlockRe.test(result)) result = result.replace(pathsBlockRe, (_, header, existing) => {
+			const existingPaths = new Set([...existing.matchAll(/- (.+)/g)].map((m) => m[1]));
+			const newEntries = additionalPaths.filter((p) => !existingPaths.has(p)).map((p) => `      - ${p}\n`).join("");
+			return header + existing + newEntries;
+		});
+		else {
+			const pathsBlock = `    paths:\n${additionalPaths.map((p) => `      - ${p}\n`).join("")}`;
+			result = result.replace(/( {4}branches: \[main\]\n)/, `$1${pathsBlock}`);
 		}
 	}
-	if (def?.linterGroup) return runLinterGroup(input, def.linterGroup, passthrough);
-	if (def?.jobs && Object.keys(def.jobs).length > 0) return runAllJobs(input, def.jobs, passthrough);
-	if (def?.local === null) {
-		const msg = `no local equivalent for ${task} — enforced in CI`;
-		print(`· ${msg}`);
-		logger.debug({
-			task,
-			status: "skip"
-		}, `run: ${task}`);
-		return {
-			status: "skip",
-			message: msg
-		};
-	}
-	if (KNOWN_TASKS.has(task)) {
-		const msg = `no ${task} task for this repo`;
-		print(input.required ? `✗ ${msg} (required)` : `· ${msg}`);
-		logger[input.required ? "warn" : "debug"]({
-			task,
-			status: input.required ? "fail" : "skip"
-		}, `run: ${task}`);
-		return {
-			status: input.required ? "fail" : "skip",
-			message: msg
-		};
+	if (!withOverrides || Object.keys(withOverrides).length === 0) return result;
+	const withBlockRe = /( {4}with:\n)((?:[ ]{6}[^\n]+\n)*)/;
+	const existingMatch = result.match(withBlockRe);
+	if (existingMatch) {
+		const existingEntries = new Map(existingMatch[2].split("\n").filter(Boolean).filter((line) => !line.trim().startsWith("#")).map((line) => {
+			const m = line.match(/^ {6}([^:]+):\s*(.*)/);
+			return m ? [m[1].trim(), m[2].trim()] : null;
+		}).filter((e) => e !== null));
+		for (const [k, v] of Object.entries(withOverrides)) existingEntries.set(k, yamlScalar(v));
+		const merged = [...existingEntries.entries()].map(([k, v]) => `      ${k}: ${v}`).join("\n");
+		return result.replace(withBlockRe, `    with:\n${merged}\n`);
 	}
-	print(`✗ unknown task "${task}"`);
-	logger.warn({
-		task,
-		status: "unknown"
-	}, `run: ${task}`);
-	return {
-		status: "unknown",
-		message: `unknown task "${task}"`
-	};
+	const withBlock = Object.entries(withOverrides).map(([k, v]) => fmt(k, v)).join("\n");
+	const injected = result.replace(/ {4}secrets: inherit\n$/, `    with:\n${withBlock}\n    secrets: inherit\n`);
+	if (injected === result) logger?.warn({ template: name }, "generateThinCallerContent: could not inject `with:` overrides");
+	return injected;
 }
 /**
-* Run one registry unit — a task's own runner or a single sub-job. Resolution
-* is registry-only (`turbo` / `package.json` scripts are keyed by task, not
-* `task/job`). `label` names the unit in messages (`audit performance`).
+* Extract the Cloudflare Pages preview config from a deploy workflow's `with:` object.
 *
-* `local: null` → CI-only by design, always a skip (never a failure, even with
-* `--required`). A declared runner with no matching repo file, or whose tool
-* isn't installed locally → a skip (`--required` turns it into a failure — the
-* repo claims a check it can't back). Mirrors the lint aggregate: run what's
-* here, flag the rest, let CI enforce.
+* Accepts three forms:
+* - `preview: true` — derive both project and domain from org context
+* - `preview: { project: "..." }` — explicit project; domain derived from context if omitted
+* - `preview: { project: "...", domain: "..." }` — fully explicit
+*
+* Returns null when `preview:` is absent, false, or can't be resolved.
 */
-function runUnit(input, label, local, run, passthrough) {
-	const { print, logger, listDir, lookPath, cwd, readFile } = input;
-	const skip = (msg) => {
-		print(input.required ? `✗ ${msg} (required)` : `· ${msg}`);
-		logger[input.required ? "warn" : "debug"]({
-			task: label,
-			status: input.required ? "fail" : "skip"
-		}, `run: ${label}`);
+function extractPreviewConfig(raw, ctx = {}) {
+	const preview = raw["preview"];
+	if (!preview) return null;
+	if (preview === true) {
+		const project = ctx.org ? `${ctx.org}-preview` : null;
+		const domain = ctx.domain ? `preview.${ctx.domain}` : void 0;
+		if (!project) return null;
 		return {
-			status: input.required ? "fail" : "skip",
-			message: msg
+			project,
+			...domain ? { domain } : {}
 		};
-	};
-	if (local) {
-		const runner = resolveRunner(local, cwd, listDir, readFile);
-		if (!runner) return skip(`no ${label} runner for this repo`);
-		const found = lookPath(cwd, runner.tool);
-		if (!found) return skip(`${runner.tool} not installed locally for ${label} — enforced in CI`);
-		return run(found, [...runner.args, ...passthrough]);
-	}
-	const msg = `no local equivalent for ${label} — enforced in CI`;
-	print(`· ${msg}`);
-	logger.debug({
-		task: label,
-		status: "skip"
-	}, `run: ${label}`);
-	return {
-		status: "skip",
-		message: msg
-	};
-}
-/**
-* `holocron run <task>` for a task that is a container of sub-jobs (`audit`) —
-* run each job in declared order. Status precedence: any `fail` → `fail`; else
-* any `ok` → `ok`; else any `dry-run` → `dry-run`; else `skip` (nothing ran).
-*/
-function runAllJobs(input, jobs, passthrough) {
-	const { print, task } = input;
-	const perJob = {
-		...input,
-		required: false
-	};
-	const reports = [];
-	for (const [name, jobDef] of Object.entries(jobs)) {
-		const label = `${task} ${name}`;
-		print(`▶ ${jobDef.checkContext}`);
-		reports.push(runUnit(perJob, label, jobDef.local, makeRunOne({
-			...perJob,
-			task: label
-		}), passthrough));
 	}
-	const command = reports.map((r) => r.command).filter((c) => Boolean(c)).join(" && ");
-	const statuses = new Set(reports.map((r) => r.status));
-	if (statuses.has("fail")) return {
-		status: "fail",
-		command,
-		message: `one or more ${task} jobs failed`
-	};
-	if (statuses.has("ok")) return {
-		status: "ok",
-		command
-	};
-	if (statuses.has("dry-run")) return {
-		status: "dry-run",
-		command
-	};
+	if (typeof preview !== "object") return null;
+	const p = preview;
+	const project = typeof p["project"] === "string" && p["project"] ? p["project"] : ctx.org ? `${ctx.org}-preview` : null;
+	if (!project) return null;
+	const domain = typeof p["domain"] === "string" && p["domain"] ? p["domain"] : ctx.domain ? `preview.${ctx.domain}` : void 0;
 	return {
-		status: "skip",
-		message: `no ${task} job has a local equivalent — enforced in CI`
+		project,
+		...domain ? { domain } : {}
 	};
 }
 /**
-* `holocron run <task>` for a `linterGroup` task — the task's fixed linter
-* set, each still gated by its own `detect`/`always` rule, run natively.
-* Worst exit code wins. Runs *after* the caller's own turbo/`package.json`
-* resolution (step 3b) — no per-linter turbo passthrough here, unlike the
-* old single `lint` task's eslint-only special case; the whole task is what
-* turbo/a package script would have already caught in steps 1–2.
+* Generate the full thin-caller YAML for a `deploy.yml` that handles both
+* production (push to main → GitHub Pages) and preview (pull_request →
+* Cloudflare Pages) in a single file.
+*
+* Both jobs receive the same docs/storybook `with:` inputs. If the per-repo
+* config supplies `cloudflare-project` it is forwarded; otherwise the reusable
+* falls back to the `CLOUDFLARE_PAGES_PROJECT` org variable — set that once and
+* all repos with a `deploy` workflow get previews without per-repo config.
 */
-function runLinterGroup(input, names, passthrough) {
-	const { print, logger, listDir, lookPath, cwd, task, readFile, fileExists } = input;
-	const dryRun = input.dryRun ?? false;
-	const runOne = makeRunOne(input);
-	let rootFiles;
-	try {
-		rootFiles = listDir(cwd);
-	} catch {
-		rootFiles = [];
-	}
-	const sharedConfigAvailable = new Set(names.filter((name) => resolveToolConfig(name, cwd, {
-		readFile,
-		fileExists
-	}).length > 0));
-	const resolved = resolveLinters({
-		explicit: names,
-		rootFiles,
-		sharedConfigAvailable
-	});
-	const reports = [];
-	let anyHasLocalBin = false;
-	for (const { name, def } of resolved) {
-		const bin = def.localBin;
-		if (!bin) {
-			print(`· ${name} (CI only)`);
-			continue;
-		}
-		anyHasLocalBin = true;
-		const found = lookPath(cwd, bin);
-		if (!found) {
-			print(`! ${name} — ${bin} not on PATH${def.installHint ? `. ${def.installHint}` : ""} (enforced in CI)`);
-			continue;
-		}
-		const configFlags = resolveToolConfig(name, cwd, {
-			readFile,
-			fileExists
-		});
-		reports.push(runOne(found, [
-			...configFlags,
-			...def.localArgs ?? [],
-			...passthrough
-		]));
-	}
-	if (reports.length === 0) {
-		const required = input.required && anyHasLocalBin;
-		const msg = `no tooling available locally for ${task} — every linter in this group is CI-only here`;
-		print(required ? `✗ ${msg} (required)` : `· ${msg}`);
-		logger[required ? "warn" : "debug"]({
-			task,
-			status: required ? "fail" : "skip"
-		}, `run: ${task}`);
-		return {
-			status: required ? "fail" : "skip",
-			message: msg
-		};
-	}
-	const command = reports.map((r) => r.command).filter((c) => Boolean(c)).join(" && ");
-	if (dryRun) return {
-		status: "dry-run",
-		command
+function generateCombinedDeployContent(deployWith, paths, preview) {
+	const yamlScalar = (v) => {
+		if (v === true) return "true";
+		if (v === false) return "false";
+		const s = String(v);
+		return s.startsWith("[") || s.startsWith("{") ? `'${s}'` : s;
 	};
-	return reports.some((r) => r.status === "fail") ? {
-		status: "fail",
-		command,
-		message: "one or more linters failed"
-	} : {
-		status: "ok",
-		command
+	const withLines = (entries) => Object.entries(entries).map(([k, v]) => `      ${k}: ${yamlScalar(v)}`).join("\n");
+	const pathsBlock = paths.length > 0 ? `    paths:\n${paths.map((p) => `      - ${p}\n`).join("")}` : "";
+	const previewWith = {
+		...deployWith,
+		"cloudflare-project": preview.project
 	};
+	const deployWithBlock = Object.keys(deployWith).length > 0 ? `    with:\n${withLines(deployWith)}\n` : "";
+	const previewWithBlock = `    with:\n${withLines(previewWith)}\n`;
+	return [
+		`name: Deploy`,
+		``,
+		`on: # yamllint disable-line rule:truthy`,
+		`  push:`,
+		`    branches: [main]`,
+		...pathsBlock ? [`${pathsBlock}`] : [],
+		`  pull_request:`,
+		`    branches: [main]`,
+		`    types: [opened, synchronize, reopened, closed]`,
+		...pathsBlock ? [`${pathsBlock}`] : [],
+		`  workflow_dispatch:`,
+		``,
+		`concurrency:`,
+		`  group: $\{{ github.event_name == 'pull_request' && format('preview-{0}', github.event.pull_request.number) || 'pages' }}`,
+		`  cancel-in-progress: $\{{ github.event_name == 'pull_request' && github.event.action != 'closed' }}`,
+		``,
+		`permissions:`,
+		`  contents: read`,
+		`  deployments: write`,
+		`  pages: write`,
+		`  id-token: write`,
+		`  pull-requests: write`,
+		``,
+		`jobs:`,
+		`  deploy:`,
+		`    name: Deploy`,
+		`    if: \${{ github.event_name != 'pull_request' }}`,
+		`    uses: theholocron/.github/.github/workflows/delivery.deploy.yml@main`,
+		...deployWithBlock ? [deployWithBlock.trimEnd()] : [],
+		`    secrets: inherit`,
+		``,
+		`  preview:`,
+		`    name: Preview`,
+		`    if: \${{ github.event_name == 'pull_request' }}`,
+		`    uses: theholocron/.github/.github/workflows/preview.yml@main`,
+		previewWithBlock.trimEnd(),
+		`    secrets: inherit`,
+		``
+	].join("\n");
 }
-const mkRunner = (tool, args = []) => ({
-	tool,
-	args
-});
 /**
-* Resolve `{ tool, args }` for a runner, applying `detect[]` against repo
-* files, falling back (#750) to each candidate's `tool` name against
-* `package.json`'s own declared dependencies when neither matches by
-* filename. Only called for `tool` / `detect` runners — the caller handles
-* `command` runners itself, so `local.detect` is present whenever
-* `local.tool` is not.
-*
-* The dependency fallback matters once a Bucket A migration (#680) deletes
-* a build tool's own config file (`tsdown.config.ts`, `vite.config.ts`, …):
-* that file was the *only* signal `detect[]` had to offer, so removing it
-* used to make `delivery.build` report "no task for this repo" and silently
-* skip the build, even though the tool is still very much in use — a
-* package can't actually build with `tsdown` without it in
-* `dependencies`/`devDependencies`, so that's a signal at least as reliable
-* as the config file, and one deleting the file doesn't remove.
+* Expand structured with-values to flat GitHub Actions inputs before
+* generating the thin caller. Handles:
+*   - deploy shorthand: docs/storybook → type + storybook-projects
+*   - preview: stripped (handled separately via extractPreviewConfig)
+*   - run-chromatic object → run-chromatic: true + chromatic-projects
+*   - plain arrays → JSON-stringified for YAML scalar quoting
 *
-* **Per-candidate, not two full passes** (#750 follow-up — the first
-* shipped version got this wrong): `delivery.build`'s own `detect[]` ends
-* with `{ when: /^tsconfig\.json$/, tool: "tsc" }` as its last-resort
-* fallback, and `tsconfig.json` exists in essentially every package
-* regardless of build tool. A "check every candidate's filename, *then*
-* check every candidate's dependency" two-pass design would let that
-* always-present fallback file win over a real `tsdown`/`vite`/`rollup`
-* dependency match, the moment the earlier candidates' own config files are
-* gone — exactly backwards. Checking `(file match) || (dependency match)`
-* together for each candidate before moving to the next preserves the
-* intended precedence: a real signal for an *earlier* candidate, by either
-* means, still wins over a later candidate's mere filename presence.
+* Used by both `holocron setup` and `sync-workflow-templates`.
 */
-function resolveRunner(local, cwd, listDir, readFile) {
-	if (local.tool) return mkRunner(local.tool, local.args);
-	let files;
-	try {
-		files = listDir(cwd);
-	} catch {
-		files = [];
+function normalizeWorkflowWith(raw) {
+	const result = { ...raw };
+	delete result["preview"];
+	const hasDocs = raw["docs"] === true || raw["docs"] !== null && typeof raw["docs"] === "object";
+	const storybookProjects = raw["storybook"];
+	if (hasDocs) {
+		result["type"] = "docs";
+		delete result["docs"];
 	}
-	const deps = packageJsonDependencies(cwd, readFile);
-	for (const candidate of local.detect) if (files.some((f) => candidate.when.test(f)) || deps.has(candidate.tool)) return mkRunner(candidate.tool, candidate.args);
-}
-/** Every key from `package.json`'s `dependencies` + `devDependencies`, or an empty set on any read/parse failure. */
-function packageJsonDependencies(cwd, readFile) {
-	try {
-		const pkg = JSON.parse(readFile(join(cwd, "package.json")));
-		return /* @__PURE__ */ new Set([...Object.keys(pkg.dependencies ?? {}), ...Object.keys(pkg.devDependencies ?? {})]);
-	} catch {
-		return /* @__PURE__ */ new Set();
+	if (Array.isArray(storybookProjects)) {
+		if (!hasDocs) result["type"] = "storybook";
+		result["storybook-projects"] = JSON.stringify(storybookProjects.map(({ name, path = "." }) => ({
+			name,
+			workingDir: path
+		})));
+		delete result["storybook"];
+	}
+	const runChromatic = raw["run-chromatic"];
+	if (runChromatic !== null && typeof runChromatic === "object" && "projects" in runChromatic) {
+		result["run-chromatic"] = true;
+		const projects = runChromatic.projects.map((p) => ({
+			...p,
+			...Array.isArray(p.untraced) ? { untraced: p.untraced.join("\n") } : {}
+		}));
+		result["chromatic-projects"] = JSON.stringify(projects);
 	}
+	for (const [k, v] of Object.entries(result)) if (Array.isArray(v)) result[k] = JSON.stringify(v);
+	return result;
 }
-function resolveBin(cwd, tool, fileExists) {
-	const local = join(cwd, "node_modules", ".bin", tool);
-	return fileExists(local) ? local : tool;
+/**
+* Derive on.push.paths entries from the deploy with: shorthand.
+* Used by both `holocron setup` and `sync-workflow-templates`.
+*/
+function deriveDeployPaths(raw) {
+	const paths = [];
+	const docs = raw["docs"];
+	if (docs === true) {
+		paths.push("docs/**");
+		paths.push("astro.config.ts");
+		paths.push("pnpm-workspace.yaml");
+		paths.push("pnpm-lock.yaml");
+	} else if (docs !== null && typeof docs === "object" && "path" in docs) {
+		const p = docs.path;
+		if (p && p !== ".") paths.push(`${p}/**`);
+	}
+	const storybookProjects = raw["storybook"];
+	if (Array.isArray(storybookProjects)) for (const s of storybookProjects) {
+		const p = s.path || ".";
+		if (p === ".") {
+			paths.push("src/**");
+			paths.push(".storybook/**");
+		} else paths.push(`${p}/**`);
+	}
+	return paths;
 }
-function packageManager(cwd, readFile, fileExists) {
-	try {
-		const pkg = JSON.parse(readFile(join(cwd, "package.json")));
-		if (typeof pkg.packageManager === "string") return pkg.packageManager.split("@")[0];
-	} catch {}
-	if (fileExists(join(cwd, "pnpm-lock.yaml"))) return "pnpm";
-	if (fileExists(join(cwd, "bun.lockb"))) return "bun";
-	if (fileExists(join(cwd, "yarn.lock"))) return "yarn";
-	if (fileExists(join(cwd, "package-lock.json"))) return "npm";
-	return "pnpm";
+//#endregion
+//#region src/generators/github-action-reusable-workflows.ts
+/**
+* The **reusable** GitHub Actions surface pushed to `theholocron/.github` by
+* `holocron sync-github` — the `workflow_call` implementations and composite
+* actions that every repo's thin callers delegate to.
+*
+* `theholocron/.github` is a **pure sync target**: `.github/workflows/*`,
+* `.github/actions/*` and `workflow-templates/*` there are generated from the
+* `.yml` files in `src/templates/reusable/` and pushed verbatim (with a
+* "do not edit" header). Never hand-edit them in `.github`.
+*
+* Not to be confused with `WORKFLOW_TEMPLATES` in `github-action-thin-callers.ts` — those are
+* the *thin-caller bases* written into each consumer repo's `.github/workflows/`.
+*/
+/** `workflow_call` implementations → `.github/workflows/<name>.yml`. */
+const REUSABLE_WORKFLOWS = {
+	"verification.unitTests": verification_unitTests_default$1,
+	"verification.typeSafety": verification_typeSafety_default$1,
+	"verification.performance": verification_performance_default$1,
+	"sourceQuality.staticAnalysis": sourceQuality_staticAnalysis_default$1,
+	"sourceQuality.formatting": sourceQuality_formatting_default$1,
+	"sourceQuality.structuredDataValidation": sourceQuality_structuredDataValidation_default$1,
+	"sourceQuality.deadCodeAnalysis": sourceQuality_deadCodeAnalysis_default$1,
+	"security.secretDetection": security_secretDetection_default$1,
+	"security.codeScanning": security_codeScanning_default$1,
+	"delivery.build": delivery_build_default$1,
+	"delivery.publish": delivery_publish_default$1,
+	"delivery.deploy": delivery_deploy_default$1,
+	"delivery.bundleSize": delivery_bundleSize_default$1,
+	"platform.repoSync": platform_repoSync_default$1,
+	"platform.commitStandards": platform_commitStandards_default$1,
+	"platform.repoValidation": platform_repoValidation_default$1,
+	"platform.dispatchedCheck": platform_dispatchedCheck_default,
+	"knowledge.wiki": knowledge_wiki_default$1,
+	bookkeeping: bookkeeping_default$1,
+	dependencies: dependencies_default$1,
+	preview: preview_default$1,
+	greetings: greetings_default$1,
+	review: review_default$1,
+	stale: stale_default$1,
+	"sync-dispatch": sync_dispatch_default,
+	tag: tag_default,
+	"sync-github": sync_github_default
+};
+/** Composite actions → `.github/actions/<name>/action.yml` (key includes `/action`). */
+const REUSABLE_ACTIONS = {
+	"auto-commit/action": auto_commit_default,
+	"holocron/action": holocron_default,
+	"install/action": install_default,
+	"setup/action": setup_default,
+	"setup-node/action": setup_node_default
+};
+/** GitHub starter-workflow metadata → `workflow-templates/<name>.properties.json`. */
+const WORKFLOW_TEMPLATE_PROPERTIES = { bookkeeping: JSON.stringify({
+	name: "Bookkeeping",
+	description: "Label and track issues and pull requests.",
+	iconName: "octicon tag"
+}, null, 2) };
+const SOURCE = "packages/astromech/src/generators/github-action-reusable-workflows.ts";
+/**
+* "AUTO-GENERATED — do not edit" header for the YAML pushed to
+* `theholocron/.github`. Matches `createHeader().workflowHeader({ forPrimary: true })`
+* field-for-field, minus any timestamp — a live `Synced:` line makes the content
+* hash change on every run and defeats `sync-github`'s unchanged-file skip.
+*/
+function reusableHeader() {
+	return [
+		`# AUTO-GENERATED — do not edit in theholocron/.github directly.`,
+		`# Source:  theholocron/holocron · ${SOURCE}`,
+		`# Tool:    holocron sync-github`,
+		`# Changes: edit source in theholocron/holocron`,
+		``
+	].join("\n");
 }
-function turboDefinesTask(cwd, task, readFile, fileExists) {
-	if (!fileExists(join(cwd, "turbo.json"))) return false;
-	try {
-		const turbo = JSON.parse(readFile(join(cwd, "turbo.json")));
-		return Boolean(turbo.tasks?.[task] ?? turbo.pipeline?.[task]);
-	} catch {
-		return false;
+/**
+* The complete file batch `holocron sync-github` pushes to `theholocron/.github`:
+* path → content. YAML gets the "do not edit" header; the starter-workflow
+* `.properties.json` files are left bare (native JSON, not a commented file).
+*/
+function reusableTemplates() {
+	const out = /* @__PURE__ */ new Map();
+	const header = reusableHeader();
+	for (const [name, body] of Object.entries(REUSABLE_ACTIONS)) out.set(`.github/actions/${name}.yml`, `${header}${body}`);
+	for (const [name, body] of Object.entries(REUSABLE_WORKFLOWS)) out.set(`.github/workflows/${name}.yml`, `${header}${body}`);
+	for (const [name, body] of Object.entries(WORKFLOW_TEMPLATES)) {
+		out.set(`workflow-templates/${name}.yml`, `${header}${body}`);
+		const props = WORKFLOW_TEMPLATE_PROPERTIES[name];
+		if (props) out.set(`workflow-templates/${name}.properties.json`, props);
 	}
+	return out;
 }
-function packageJsonScript(cwd, task, readFile, fileExists) {
-	if (!fileExists(join(cwd, "package.json"))) return void 0;
-	try {
-		return JSON.parse(readFile(join(cwd, "package.json"))).scripts?.[task];
-	} catch {
-		return;
+//#endregion
+//#region src/registry.ts
+const TASKS = {
+	"verification.unitTests": {
+		local: {
+			tool: "vitest",
+			args: ["run"]
+		},
+		flags: { vitest: ["--coverage"] },
+		turbo: {
+			inputs: [
+				"src/**",
+				"vitest.config.ts",
+				"vitest.config.js",
+				"vitest.config.mjs",
+				"package.json"
+			],
+			outputs: ["test-report.junit.xml", "coverage/**"],
+			dependsOn: ["delivery.build", "^delivery.build"]
+		}
+	},
+	"verification.typeSafety": {
+		local: {
+			tool: "tsc",
+			args: ["--noEmit"]
+		},
+		turbo: {
+			inputs: ["src/**", "tsconfig.json"],
+			outputs: [],
+			dependsOn: ["^delivery.build"]
+		}
+	},
+	"verification.performance": { local: { detect: [{
+		when: /^lighthouse\.config\.(cjs|js|mjs|ts)$/,
+		tool: "lhci",
+		args: ["autorun"]
+	}, {
+		when: /^lighthouserc\.(cjs|js|mjs|json|yml|yaml)$/,
+		tool: "lhci",
+		args: ["autorun"]
+	}] } },
+	"sourceQuality.staticAnalysis": {
+		local: null,
+		linterGroup: [
+			"eslint",
+			"actionlint",
+			"git-merge-conflict-markers"
+		],
+		turbo: {
+			inputs: [
+				"src/**",
+				"eslint.config.ts",
+				"eslint.config.js",
+				"eslint.config.mjs",
+				"eslint.config.cjs"
+			],
+			outputs: [],
+			dependsOn: ["^delivery.build"]
+		}
+	},
+	"sourceQuality.formatting": {
+		local: null,
+		linterGroup: [
+			"prettier",
+			"editorconfig",
+			"markdownlint"
+		]
+	},
+	"sourceQuality.structuredDataValidation": {
+		local: null,
+		linterGroup: ["yamllint"]
+	},
+	"sourceQuality.deadCodeAnalysis": { local: { tool: "knip" } },
+	"security.secretDetection": {
+		local: null,
+		linterGroup: ["gitleaks"]
+	},
+	"security.codeScanning": { local: null },
+	"delivery.build": {
+		local: { detect: [
+			{
+				when: /^tsdown\.config\.(ts|js|mjs|cjs)$/,
+				tool: "tsdown"
+			},
+			{
+				when: /^vite\.config\.(ts|js|mjs|cjs)$/,
+				tool: "vite",
+				args: ["build"]
+			},
+			{
+				when: /^rollup\.config\.(ts|js|mjs|cjs)$/,
+				tool: "rollup",
+				args: ["-c"]
+			},
+			{
+				when: /^tsconfig\.json$/,
+				tool: "tsc",
+				args: ["-b"]
+			}
+		] },
+		turbo: {
+			inputs: [
+				"src/**",
+				"package.json",
+				"tsdown.config.ts",
+				"vite.config.ts",
+				"rollup.config.ts",
+				"tsconfig.json"
+			],
+			outputs: ["dist/**"],
+			dependsOn: ["^delivery.build"]
+		}
+	},
+	"delivery.publish": {
+		local: null,
+		preview: true
+	},
+	"delivery.deploy": {
+		local: null,
+		preview: true
+	},
+	"delivery.bundleSize": { local: null },
+	"platform.repoSync": { local: { command: "sync" } },
+	"platform.commitStandards": {
+		local: null,
+		linterGroup: ["commitlint"]
+	},
+	"platform.repoValidation": {
+		local: null,
+		jobs: {
+			adrs: {
+				local: {
+					tool: "node",
+					args: ["scripts/validate-adrs.mjs"]
+				},
+				checkContext: "platform.repoValidation / Validate ADRs and specs"
+			},
+			registry: {
+				local: {
+					tool: "node",
+					args: ["scripts/validate-registry.mjs"]
+				},
+				checkContext: "platform.repoValidation / Validate registry consistency"
+			},
+			docsPresence: {
+				local: {
+					tool: "node",
+					args: ["scripts/validate-docs-presence.mjs"]
+				},
+				checkContext: "platform.repoValidation / Validate docs presence"
+			}
+		}
+	},
+	"knowledge.wiki": {
+		local: { command: "sync-wiki" },
+		preview: true
+	},
+	"knowledge.docs": {
+		local: null,
+		preview: true
+	},
+	"knowledge.components": {
+		local: null,
+		preview: true
 	}
-}
-//#endregion
-//#region src/thin-callers.ts
-/**
-* Workflow templates + thin-caller generation.
-*
-* `WORKFLOW_TEMPLATES` holds each reusable `.github/workflows/<name>.yml`
-* (synced to `theholocron/.github`); `generateThinCallerContent` wraps one
-* into the thin caller `holocron setup` / `holocron sync` write locally.
-*/
-const WORKFLOW_TEMPLATES = {
-	"verification.unitTests": "name: Verification\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\nconcurrency:\n  group: test-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n  id-token: write\n  statuses: write\n\njobs:\n  test:\n    name: Test\n    uses: theholocron/.github/.github/workflows/verification.unitTests.yml@main\n    with:\n      run-unit: true\n    secrets: inherit\n",
-	"verification.typeSafety": "name: Verification\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\nconcurrency:\n  group: typecheck-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n\njobs:\n  typecheck:\n    name: Typecheck\n    uses: theholocron/.github/.github/workflows/verification.typeSafety.yml@main\n    secrets: inherit\n",
-	"verification.performance": "name: Verification\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\npermissions:\n  contents: read\n\njobs:\n  performance:\n    name: Audit the Performance\n    uses: theholocron/.github/.github/workflows/verification.performance.yml@main\n    secrets: inherit\n",
-	"sourceQuality.staticAnalysis": "name: Source Quality\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\nconcurrency:\n  group: source-quality-static-analysis-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: write\n  statuses: write\n\njobs:\n  static-analysis:\n    name: Static Analysis\n    uses: theholocron/.github/.github/workflows/sourceQuality.staticAnalysis.yml@main\n    secrets: inherit\n",
-	"sourceQuality.formatting": "name: Source Quality\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\nconcurrency:\n  group: source-quality-formatting-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: write\n  statuses: write\n\njobs:\n  formatting:\n    name: Formatting\n    uses: theholocron/.github/.github/workflows/sourceQuality.formatting.yml@main\n    secrets: inherit\n",
-	"sourceQuality.structuredDataValidation": "name: Source Quality\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\nconcurrency:\n  group: source-quality-structured-data-validation-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n\njobs:\n  structured-data-validation:\n    name: Structured Data Validation\n    uses: theholocron/.github/.github/workflows/sourceQuality.structuredDataValidation.yml@main\n    secrets: inherit\n",
-	"sourceQuality.deadCodeAnalysis": "name: Source Quality\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\npermissions:\n  contents: read\n\njobs:\n  dead-code-analysis:\n    name: Dead Code Analysis\n    uses: theholocron/.github/.github/workflows/sourceQuality.deadCodeAnalysis.yml@main\n    secrets: inherit\n",
-	"security.secretDetection": "name: Security\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\nconcurrency:\n  group: security-secret-detection-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n\njobs:\n  secret-detection:\n    name: Secret Detection\n    uses: theholocron/.github/.github/workflows/security.secretDetection.yml@main\n    secrets: inherit\n",
-	"security.codeScanning": "name: Security\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches:\n      - main\n  pull_request:\n    branches:\n      - main\n  schedule:\n    - cron: \"0 0 * * 1\"\n\npermissions:\n  actions: read\n  contents: read\n  security-events: write\n\njobs:\n  security:\n    name: Code Scanning\n    uses: theholocron/.github/.github/workflows/security.codeScanning.yml@main\n    secrets: inherit\n",
-	"delivery.build": "name: Delivery\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches-ignore:\n      - main # delivery.publish builds before publishing\n  pull_request:\n    branches:\n      - main\n\nconcurrency:\n  group: delivery.build-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n\njobs:\n  build:\n    name: Build\n    uses: theholocron/.github/.github/workflows/delivery.build.yml@main\n    secrets: inherit\n",
-	"delivery.publish": "name: Delivery\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches:\n      - main\n      - alpha\n  workflow_dispatch:\n    inputs:\n      dry_run:\n        description: >\n          Dry run — analyze commits and preview the release without git writes\n          or publish. Push-triggered runs always run fully; this only applies\n          to manual workflow_dispatch triggers.\n        required: false\n        default: true\n        type: boolean\n\npermissions:\n  contents: write\n  id-token: write\n  issues: write\n  pull-requests: write\n\nconcurrency:\n  group: ${{ github.workflow }}-${{ github.ref }}\n  cancel-in-progress: false\n\njobs:\n  release:\n    name: Release\n    uses: theholocron/.github/.github/workflows/delivery.publish.yml@main\n    with:\n      dry-run: ${{ inputs.dry_run == true }}\n    secrets: inherit\n",
-	"delivery.deploy": "name: Delivery\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main]\n  workflow_dispatch:\n\nconcurrency:\n  group: pages\n  cancel-in-progress: false\n\npermissions:\n  contents: read\n  pages: write\n  id-token: write\n\njobs:\n  deploy:\n    name: Deploy\n    uses: theholocron/.github/.github/workflows/delivery.deploy.yml@main\n    secrets: inherit\n",
-	"delivery.bundleSize": "name: Delivery\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\npermissions:\n  contents: read\n\njobs:\n  bundle-size:\n    name: Audit the Bundle Size\n    uses: theholocron/.github/.github/workflows/delivery.bundleSize.yml@main\n    secrets: inherit\n",
-	"platform.repoSync": "name: Platform\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main]\n    paths:\n      - holocron.config.ts\n      - package.json\n      - pnpm-workspace.yaml\n  workflow_dispatch:\n    inputs:\n      steps:\n        description: \"Sync steps to run (default: all)\"\n        type: string\n        required: false\n\nconcurrency:\n  group: sync-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: write\n  pull-requests: write\n\njobs:\n  sync:\n    name: Sync\n    uses: theholocron/.github/.github/workflows/platform.repoSync.yml@main\n    with:\n      steps: ${{ inputs.steps }}\n    secrets: inherit\n",
-	"platform.commitStandards": "name: Platform\n\non: # yamllint disable-line rule:truthy\n  pull_request:\n\nconcurrency:\n  group: platform-commit-standards-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n\njobs:\n  commit-standards:\n    name: Commit Standards\n    uses: theholocron/.github/.github/workflows/platform.commitStandards.yml@main\n    secrets: inherit\n",
-	"platform.repoValidation": "name: Platform\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\npermissions:\n  contents: read\n\njobs:\n  repo-validation:\n    name: Repo Validation\n    uses: theholocron/.github/.github/workflows/platform.repoValidation.yml@main\n    secrets: inherit\n",
-	"knowledge.wiki": "name: Knowledge\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main]\n  pull_request:\n    branches: [main]\n\nconcurrency:\n  group: ${{ github.event_name == 'pull_request' && format('wiki-preview-{0}', github.event.pull_request.number) || 'wiki' }}\n  cancel-in-progress: ${{ github.event_name == 'pull_request' }}\n\npermissions:\n  contents: read\n  deployments: write\n\njobs:\n  publish:\n    name: Publish\n    if: ${{ github.event_name != 'pull_request' }}\n    uses: theholocron/.github/.github/workflows/knowledge.wiki.yml@main\n    secrets: inherit\n\n  preview:\n    name: Preview\n    if: ${{ github.event_name == 'pull_request' }}\n    uses: theholocron/.github/.github/workflows/knowledge.wiki.yml@main\n    with:\n      preview: true\n      preview-id: pr-${{ github.event.pull_request.number }}\n    secrets: inherit\n",
-	preview: "name: Preview\n\non: # yamllint disable-line rule:truthy\n  pull_request:\n    branches: [main]\n\nconcurrency:\n  group: preview-${{ github.event.pull_request.number }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n  deployments: write\n  pull-requests: write\n\njobs:\n  preview:\n    name: Preview\n    uses: theholocron/.github/.github/workflows/preview.yml@main\n    secrets: inherit\n",
-	review: "name: Source Quality\n\non: # yamllint disable-line rule:truthy\n  pull_request:\n\nconcurrency:\n  group: review-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n  checks: write\n  pull-requests: write\n\njobs:\n  review:\n    name: Annotations\n    uses: theholocron/.github/.github/workflows/review.yml@main\n    secrets: inherit\n",
-	stale: "name: Stale\n\non: # yamllint disable-line rule:truthy\n  schedule:\n    - cron: \"30 1 * * *\"\n\npermissions:\n  contents: write\n  issues: write\n  pull-requests: write\n\njobs:\n  stale:\n    uses: theholocron/.github/.github/workflows/stale.yml@main\n    with:\n      exempt-issue-labels: \"in-progress,wip\"\n      exempt-all-issue-milestones: true\n      exempt-all-issue-projects: true\n      exempt-all-pr-projects: true\n    secrets: inherit\n",
-	greetings: "name: Platform\n\non: # yamllint disable-line rule:truthy\n  pull_request:\n  issues:\n\npermissions:\n  issues: write\n  pull-requests: write\n\njobs:\n  greetings:\n    name: Greetings\n    uses: theholocron/.github/.github/workflows/greetings.yml@main\n    secrets: inherit\n",
-	dependencies: "name: Platform\n\non: # yamllint disable-line rule:truthy\n  pull_request:\n\npermissions:\n  contents: write\n  pull-requests: write\n\njobs:\n  dependencies:\n    name: Dependencies\n    uses: theholocron/.github/.github/workflows/dependencies.yml@main\n    secrets: inherit\n",
-	bookkeeping: "name: Platform\n\non: # yamllint disable-line rule:truthy\n  pull_request:\n    types:\n      - opened\n      - edited\n\npermissions:\n  contents: read\n  issues: write\n  pull-requests: write\n\njobs:\n  bookkeeping:\n    name: Bookkeeping\n    uses: theholocron/.github/.github/workflows/bookkeeping.yml@main\n    secrets: inherit\n"
 };
-const KNOWN_WORKFLOWS = new Set(Object.keys(WORKFLOW_TEMPLATES));
+/** Every task name the registry knows. */
+const KNOWN_TASKS = new Set(Object.keys(TASKS));
 /**
-* The GitHub status-check context a `required` task contributes to branch
-* protection. Format: `"{workflow name} / {job name}"`.
-*
-* Most of these are single-job workflows now (D3's decomposition split what
-* used to be multi-job `lint`/`audit` into one task per concern) — the
-* context names that job directly, no `Conclusion` aggregator needed; a
-* single job's own conclusion already *is* the workflow's conclusion.
-* `Conclusion` fan-in jobs are kept only where a task genuinely has several
-* conditionally-run jobs feeding one required check:
-* `verification.unitTests` (unit / Storybook / Chromatic / interaction /
-* user-flow, each gated by its own `run-*` input) and
-* `platform.repoValidation` (its three script jobs all must pass). Only
-* merge-gating workflows are listed. `astromech.requiredChecks()` reads this
-* for every `required` task.
+* The order `holocron ci` runs tasks in — cheapest / fastest signal first, so
+* an agent or a `pre-push` hook fails early. Tasks not listed here run last, in
+* manifest order. (The generated thin callers carry no `needs:` — cross-workflow
+* ordering lives in `theholocron/.github` — so `holocron ci` declares its own.)
 */
-const WORKFLOW_CHECK_CONTEXTS = {
-	"delivery.build": "Build / Build every workspace",
-	"verification.unitTests": "Test / Conclusion",
-	"verification.typeSafety": "Typecheck / Run tsc --noEmit",
-	"verification.performance": "Audit the Performance / Run Lighthouse CI",
-	"sourceQuality.staticAnalysis": "Static Analysis / Run eslint and actionlint",
-	"sourceQuality.formatting": "Formatting / Run prettier, editorconfig-checker, markdownlint",
-	"sourceQuality.structuredDataValidation": "Structured Data Validation / Run yamllint",
-	"sourceQuality.deadCodeAnalysis": "Dead Code Analysis / Run knip",
-	"security.secretDetection": "Secret Detection / Run gitleaks",
-	"platform.commitStandards": "Commit Standards / Run commitlint",
-	"platform.repoValidation": "Repo Validation / Conclusion",
-	"delivery.bundleSize": "Audit the Bundle Size / Upload bundle stats to Codecov"
-};
+const CI_ORDER = [
+	"verification.typeSafety",
+	"sourceQuality.staticAnalysis",
+	"sourceQuality.formatting",
+	"sourceQuality.structuredDataValidation",
+	"security.secretDetection",
+	"platform.commitStandards",
+	"platform.repoValidation",
+	"verification.unitTests",
+	"delivery.build",
+	"sourceQuality.deadCodeAnalysis",
+	"delivery.bundleSize",
+	"verification.performance",
+	"security.codeScanning",
+	"delivery.deploy"
+];
+//#endregion
+//#region src/generators/required-checks.ts
 /**
-* Generate the thin caller content for a workflow, optionally injecting or
-* merging `with:` overrides into the jobs block.
-*
-* Two strategies are used depending on the template:
-* - Templates that already have a `with:` block (e.g. lint):
-*   the override entries are merged in, replacing existing keys and appending
-*   new ones.
-* - Templates that end with `    secrets: inherit`: a new `with:` block is
-*   injected immediately before `secrets: inherit`.
-* If neither pattern matches the template, a warning is emitted and the
-* base template is returned unchanged.
-*/
-function generateThinCallerContent(name, withOverrides, additionalPaths, logger, comments) {
-	const base = WORKFLOW_TEMPLATES[name];
-	if (!base) return "";
-	const yamlScalar = (v) => {
-		if (v === true) return "true";
-		if (v === false) return "false";
-		const s = String(v);
-		return s.startsWith("[") || s.startsWith("{") ? `'${s}'` : s;
-	};
-	const fmt = (k, v) => {
-		const line = `      ${k}: ${yamlScalar(v)}`;
-		return comments?.[k] ? `      # ${comments[k]}\n${line}` : line;
-	};
-	let result = base;
-	if (additionalPaths && additionalPaths.length > 0) {
-		const pathsBlockRe = /( {4}paths:\n)((?:[ ]{6}- [^\n]+\n)+)/;
-		if (pathsBlockRe.test(result)) result = result.replace(pathsBlockRe, (_, header, existing) => {
-			const existingPaths = new Set([...existing.matchAll(/- (.+)/g)].map((m) => m[1]));
-			const newEntries = additionalPaths.filter((p) => !existingPaths.has(p)).map((p) => `      - ${p}\n`).join("");
-			return header + existing + newEntries;
-		});
-		else {
-			const pathsBlock = `    paths:\n${additionalPaths.map((p) => `      - ${p}\n`).join("")}`;
-			result = result.replace(/( {4}branches: \[main\]\n)/, `$1${pathsBlock}`);
+* `requiredChecks(config)` — the branch-protection required-status-check list,
+* derived from the task manifest. Every `required: true` task contributes its
+* {@link WORKFLOW_CHECK_CONTEXTS} entry; `config.extraRequiredChecks` adds
+* contexts not backed by a task (codecov, DCO is prepended by the caller).
+*
+* `@theholocron/cli`'s `holocron setup` calls this instead of the old
+* hand-maintained `repo.requiredChecks` array. Policy-free — it only knows the
+* manifest.
+*/
+/** Ordered (task contexts in {@link CI_ORDER}, then extras), de-duplicated. */
+function requiredChecks(config) {
+	const entries = (config.tasks ?? []).map(normalizeTaskEntry);
+	const seen = /* @__PURE__ */ new Set();
+	const out = [];
+	for (const name of CI_ORDER) {
+		const context = entries.some((e) => e.name === name && e.required === true) ? WORKFLOW_CHECK_CONTEXTS[name] : void 0;
+		if (context && !seen.has(context)) {
+			seen.add(context);
+			out.push(context);
 		}
 	}
-	if (!withOverrides || Object.keys(withOverrides).length === 0) return result;
-	const withBlockRe = /( {4}with:\n)((?:[ ]{6}[^\n]+\n)*)/;
-	const existingMatch = result.match(withBlockRe);
-	if (existingMatch) {
-		const existingEntries = new Map(existingMatch[2].split("\n").filter(Boolean).filter((line) => !line.trim().startsWith("#")).map((line) => {
-			const m = line.match(/^ {6}([^:]+):\s*(.*)/);
-			return m ? [m[1].trim(), m[2].trim()] : null;
-		}).filter((e) => e !== null));
-		for (const [k, v] of Object.entries(withOverrides)) existingEntries.set(k, yamlScalar(v));
-		const merged = [...existingEntries.entries()].map(([k, v]) => `      ${k}: ${v}`).join("\n");
-		return result.replace(withBlockRe, `    with:\n${merged}\n`);
+	for (const context of config.extraRequiredChecks ?? []) if (!seen.has(context)) {
+		seen.add(context);
+		out.push(context);
 	}
-	const withBlock = Object.entries(withOverrides).map(([k, v]) => fmt(k, v)).join("\n");
-	const injected = result.replace(/ {4}secrets: inherit\n$/, `    with:\n${withBlock}\n    secrets: inherit\n`);
-	if (injected === result) logger?.warn({ template: name }, "generateThinCallerContent: could not inject `with:` overrides");
-	return injected;
+	return out;
 }
+//#endregion
+//#region src/generators/turbo.ts
 /**
-* Extract the Cloudflare Pages preview config from a deploy workflow's `with:` object.
+* `turboConfig(config)` — the generated `turbo.json` for a repo's task
+* manifest, epic #672 D9 (#681). Every workspace, monorepo or single-package
+* (Turborepo's single-package mode), gets this from the same `tasks` array
+* that already drives thin callers / required checks / package scripts —
+* never hand-authored.
 *
-* Accepts three forms:
-* - `preview: true` — derive both project and domain from org context
-* - `preview: { project: "..." }` — explicit project; domain derived from context if omitted
-* - `preview: { project: "...", domain: "..." }` — fully explicit
+* Only tasks with a {@link TurboTaskConfig} in the registry (real per-
+* workspace build/compile/test steps) get an entry. Whole-repo, single-run
+* tools (prettier, gitleaks, commitlint, yamllint, …) have none — they stay
+* off turbo.json entirely, same as today.
 *
-* Returns null when `preview:` is absent, false, or can't be resolved.
+* A task entry's own `turbo.passThroughEnv` (schema.ts) appends extra env
+* vars to the registry default's cache-key hashing — the one thing that's
+* genuinely per-repo (e.g. a package tagging Sentry releases during its own
+* build needs `SENTRY_AUTH_TOKEN` in its cache key; most repos don't).
 */
-function extractPreviewConfig(raw, ctx = {}) {
-	const preview = raw["preview"];
-	if (!preview) return null;
-	if (preview === true) {
-		const project = ctx.org ? `${ctx.org}-preview` : null;
-		const domain = ctx.domain ? `preview.${ctx.domain}` : void 0;
-		if (!project) return null;
-		return {
-			project,
-			...domain ? { domain } : {}
-		};
+/** Filed once per repo, unconditionally — every generated turbo.json's root. */
+const GLOBAL_DEPENDENCIES = ["pnpm-workspace.yaml", "tsconfig.json"];
+/**
+* `turbo.json` content for this manifest, pretty-printed — write it
+* directly, no merge (matches `thinCallers()` / `reusableTemplates()`: this
+* file is generated, not hand-edited). `null` when no task in the manifest
+* has turbo fan-out config (nothing to write).
+*/
+function turboConfig(config) {
+	const entries = (config.tasks ?? []).map(normalizeTaskEntry);
+	const tasks = {};
+	for (const entry of entries) {
+		if (entry.local === false) continue;
+		const turbo = TASKS[entry.name]?.turbo;
+		if (!turbo) continue;
+		const extraEnv = entry.turbo?.passThroughEnv;
+		tasks[entry.name] = extraEnv && extraEnv.length > 0 ? {
+			...turbo,
+			passThroughEnv: extraEnv
+		} : turbo;
 	}
-	if (typeof preview !== "object") return null;
-	const p = preview;
-	const project = typeof p["project"] === "string" && p["project"] ? p["project"] : ctx.org ? `${ctx.org}-preview` : null;
-	if (!project) return null;
-	const domain = typeof p["domain"] === "string" && p["domain"] ? p["domain"] : ctx.domain ? `preview.${ctx.domain}` : void 0;
-	return {
-		project,
-		...domain ? { domain } : {}
-	};
+	if (Object.keys(tasks).length === 0) return null;
+	return `${JSON.stringify({
+		$schema: "https://turborepo.org/schema.json",
+		globalDependencies: GLOBAL_DEPENDENCIES,
+		tasks
+	}, null, 2)}\n`;
 }
 /**
-* Generate the full thin-caller YAML for a `deploy.yml` that handles both
-* production (push to main → GitHub Pages) and preview (pull_request →
-* Cloudflare Pages) in a single file.
+* Fixes #692: `turboConfig()` writes a `turbo.json` the moment *any* task in
+* the manifest has fan-out config — with no check for whether the repo's own
+* root package is actually covered by `pnpm-workspace.yaml`'s `packages:`
+* list. A repo shaped like `observability` (the library lives at repo root;
+* `packages:` lists only an unrelated `docs` site) silently breaks the
+* instant `turbo.json` exists: `holocron run <task>` switches from running
+* root's own script directly to `turbo run <task>`, which only sees declared
+* workspace members — root vanishes, the task "succeeds" with zero real work
+* done (confirmed empirically: `Packages in scope: docs`, root never
+* mentioned, exit 0).
 *
-* Both jobs receive the same docs/storybook `with:` inputs. If the per-repo
-* config supplies `cloudflare-project` it is forwarded; otherwise the reusable
-* falls back to the `CLOUDFLARE_PAGES_PROJECT` org variable — set that once and
-* all repos with a `deploy` workflow get previews without per-repo config.
+* Detection is narrow and specific: root only needs to be an explicit
+* workspace member if its *own* `package.json` has a script literally named
+* after one of the tasks turbo.json is about to fan out — a plain
+* orchestrator root (`holocron`'s own `"build": "turbo run delivery.build"`,
+* which has no `delivery.build` script itself) never trips this; only a root
+* that's genuinely a directly-buildable package does. Confirmed the fix
+* empirically too — adding `.` to `packages:` makes turbo pick root back up
+* (`Packages in scope: docs, root-lib`) without disturbing the sibling
+* package's own caching.
+*
+* A matching script key alone isn't enough — its *value* has to be a real
+* command, not the generated `holocron run <task> --` wrapper (#846, the
+* counterpart `mergePackageJsonScripts()` already had to learn for #747/
+* #748). A repo whose root predates this tooling can already have that exact
+* wrapper sitting in a task-name-matching script with nothing ever having
+* generated it this session; adding `.` there fires #747's recursion
+* immediately (`turbo run <task>` → root's own `<task>` script → the wrapper
+* → `holocron run <task>` sees `turbo.json` still defines it → `turbo run
+* <task>` again, forever). Only a matching script whose value is *not* that
+* wrapper counts as "root is genuinely a directly-buildable package".
+*
+* A targeted line-based edit, not a full YAML parse/reserialize — same
+* pattern `codecov.ts`'s `mergeCodecovComponents()` already uses for editing
+* an existing generated file. `pnpm-workspace.yaml` routinely carries a
+* `catalog:`/`catalogs:`/`overrides:` block after `packages:`; a real parser
+* round-trip risks reformatting or reordering content nobody asked to touch.
+* Only ever *adds* a line — never rewrites or reorders anything already
+* there — and is a no-op (`changed: false`) whenever root doesn't need it,
+* root is already listed, or `packages:` isn't in the plain block-list form
+* every repo checked actually uses.
 */
-function generateCombinedDeployContent(deployWith, paths, preview) {
-	const yamlScalar = (v) => {
-		if (v === true) return "true";
-		if (v === false) return "false";
-		const s = String(v);
-		return s.startsWith("[") || s.startsWith("{") ? `'${s}'` : s;
+function ensureRootWorkspaceMember(workspaceYaml, rootScripts, taskNames) {
+	if (!taskNames.some((t) => {
+		const script = rootScripts[t];
+		return script !== void 0 && !isGeneratedRunWrapper(script, t);
+	})) return {
+		content: workspaceYaml,
+		changed: false
 	};
-	const withLines = (entries) => Object.entries(entries).map(([k, v]) => `      ${k}: ${yamlScalar(v)}`).join("\n");
-	const pathsBlock = paths.length > 0 ? `    paths:\n${paths.map((p) => `      - ${p}\n`).join("")}` : "";
-	const previewWith = {
-		...deployWith,
-		"cloudflare-project": preview.project
+	const lines = workspaceYaml.split("\n");
+	const packagesLineIdx = lines.findIndex((l) => /^packages:\s*$/.test(l));
+	if (packagesLineIdx === -1) return {
+		content: workspaceYaml,
+		changed: false
+	};
+	const items = [];
+	let cursor = packagesLineIdx + 1;
+	while (cursor < lines.length && /^\s*-\s*/.test(lines[cursor])) {
+		items.push(lines[cursor]);
+		cursor++;
+	}
+	if (items.some((item) => {
+		const value = item.replace(/^\s*-\s*/, "").replace(/^["']|["']$/g, "").trim();
+		return value === "." || value === "";
+	})) return {
+		content: workspaceYaml,
+		changed: false
+	};
+	const newLine = `${items[0]?.match(/^(\s*-\s*)/)?.[1] ?? "  - "}"."`;
+	return {
+		content: [
+			...lines.slice(0, packagesLineIdx + 1),
+			newLine,
+			...lines.slice(packagesLineIdx + 1)
+		].join("\n"),
+		changed: true
 	};
-	const deployWithBlock = Object.keys(deployWith).length > 0 ? `    with:\n${withLines(deployWith)}\n` : "";
-	const previewWithBlock = `    with:\n${withLines(previewWith)}\n`;
-	return [
-		`name: Deploy`,
-		``,
-		`on: # yamllint disable-line rule:truthy`,
-		`  push:`,
-		`    branches: [main]`,
-		...pathsBlock ? [`${pathsBlock}`] : [],
-		`  pull_request:`,
-		`    branches: [main]`,
-		`    types: [opened, synchronize, reopened, closed]`,
-		...pathsBlock ? [`${pathsBlock}`] : [],
-		`  workflow_dispatch:`,
-		``,
-		`concurrency:`,
-		`  group: $\{{ github.event_name == 'pull_request' && format('preview-{0}', github.event.pull_request.number) || 'pages' }}`,
-		`  cancel-in-progress: $\{{ github.event_name == 'pull_request' && github.event.action != 'closed' }}`,
-		``,
-		`permissions:`,
-		`  contents: read`,
-		`  deployments: write`,
-		`  pages: write`,
-		`  id-token: write`,
-		`  pull-requests: write`,
-		``,
-		`jobs:`,
-		`  deploy:`,
-		`    name: Deploy`,
-		`    if: \${{ github.event_name != 'pull_request' }}`,
-		`    uses: theholocron/.github/.github/workflows/delivery.deploy.yml@main`,
-		...deployWithBlock ? [deployWithBlock.trimEnd()] : [],
-		`    secrets: inherit`,
-		``,
-		`  preview:`,
-		`    name: Preview`,
-		`    if: \${{ github.event_name == 'pull_request' }}`,
-		`    uses: theholocron/.github/.github/workflows/preview.yml@main`,
-		previewWithBlock.trimEnd(),
-		`    secrets: inherit`,
-		``
-	].join("\n");
-}
-/**
-* Expand structured with-values to flat GitHub Actions inputs before
-* generating the thin caller. Handles:
-*   - deploy shorthand: docs/storybook → type + storybook-projects
-*   - preview: stripped (handled separately via extractPreviewConfig)
-*   - run-chromatic object → run-chromatic: true + chromatic-projects
-*   - plain arrays → JSON-stringified for YAML scalar quoting
-*
-* Used by both `holocron setup` and `sync-workflow-templates`.
-*/
-function normalizeWorkflowWith(raw) {
-	const result = { ...raw };
-	delete result["preview"];
-	const hasDocs = raw["docs"] === true || raw["docs"] !== null && typeof raw["docs"] === "object";
-	const storybookProjects = raw["storybook"];
-	if (hasDocs) {
-		result["type"] = "docs";
-		delete result["docs"];
-	}
-	if (Array.isArray(storybookProjects)) {
-		if (!hasDocs) result["type"] = "storybook";
-		result["storybook-projects"] = JSON.stringify(storybookProjects.map(({ name, path = "." }) => ({
-			name,
-			workingDir: path
-		})));
-		delete result["storybook"];
-	}
-	const runChromatic = raw["run-chromatic"];
-	if (runChromatic !== null && typeof runChromatic === "object" && "projects" in runChromatic) {
-		result["run-chromatic"] = true;
-		const projects = runChromatic.projects.map((p) => ({
-			...p,
-			...Array.isArray(p.untraced) ? { untraced: p.untraced.join("\n") } : {}
-		}));
-		result["chromatic-projects"] = JSON.stringify(projects);
-	}
-	for (const [k, v] of Object.entries(result)) if (Array.isArray(v)) result[k] = JSON.stringify(v);
-	return result;
 }
 /**
-* Derive on.push.paths entries from the deploy with: shorthand.
-* Used by both `holocron setup` and `sync-workflow-templates`.
+* Matches the exact shape `packageScripts()` generates for `taskName` —
+* `<bin> run <taskName> --`, `<bin>` normally `holocron` but substitutable
+* (`holocronScript`, itself allowed to be multi-word, e.g. `"node
+* packages/cli/dist/cli.mjs"` — see its own test). Checking the *suffix*
+* rather than the whole string means an old wrapper survives a
+* `holocronScript` rename intact — it's still recognized as a wrapper (safe
+* to update to the new one), not mistaken for a real command. Mirrors
+* `sync.ts`'s private `isGeneratedRunWrapper()` — same predicate, needed on
+* both sides of #692/#747: whether to *write* the wrapper, and here, whether
+* an *existing* one should count as "root is directly buildable".
 */
-function deriveDeployPaths(raw) {
-	const paths = [];
-	const docs = raw["docs"];
-	if (docs === true) {
-		paths.push("docs/**");
-		paths.push("astro.config.ts");
-		paths.push("pnpm-workspace.yaml");
-		paths.push("pnpm-lock.yaml");
-	} else if (docs !== null && typeof docs === "object" && "path" in docs) {
-		const p = docs.path;
-		if (p && p !== ".") paths.push(`${p}/**`);
-	}
-	const storybookProjects = raw["storybook"];
-	if (Array.isArray(storybookProjects)) for (const s of storybookProjects) {
-		const p = s.path || ".";
-		if (p === ".") {
-			paths.push("src/**");
-			paths.push(".storybook/**");
-		} else paths.push(`${p}/**`);
-	}
-	return paths;
+function isGeneratedRunWrapper(command, taskName) {
+	return command.endsWith(` run ${taskName} --`);
 }
-//#endregion
-//#region src/ci.ts
 /**
-* `holocron ci` / `astromech.ci()` — run the merge-gating checks locally, in CI
-* order, and exit non-zero on the first failure. The "will CI pass?" command a
-* `pre-push` hook and the agent skills point at.
+* Fallback pin when a repo's own `pnpm-workspace.yaml` has no `turbo`
+* catalog entry yet — matches this repo's own catalog version (the
+* canonical source-of-truth repo for the whole org's tooling).
+*/
+const DEFAULT_TURBO_VERSION = "^2.10.12";
+/**
+* Ensures `turbo` is declared in `package.json#devDependencies` — found
+* the hard way rolling this out to `observability` (predates #691):
+* `turboConfig()` writes a `turbo.json` the moment any task has fan-out
+* config, but never touches `package.json`, so a repo that predates this
+* feature (or never had `turbo` installed for any other reason) ends up
+* with a `turbo.json` and nothing local to run it. `resolveBin()`
+* (`run.ts`) falls back to a bare `turbo` on `PATH` when
+* `node_modules/.bin/turbo` doesn't exist — on a machine with no global
+* `turbo` at all that's a hard failure for every task; on one that
+* happens to have an unrelated global install, silent version skew
+* (confirmed empirically: a global 2.6.0 rejected this repo's generated
+* `turbo.json` outright — `Found an unknown key "globalDependencies"`,
+* a schema key from a newer version than the one actually resolved).
 *
-* Default scope: every `required: true` task. If the manifest marks nothing
-* required (an un-migrated repo), fall back to every `ci: true` task. `--all`
-* forces the full set. Each task runs through {@link runTask}: a `required`
-* task whose local runner can't run is a failure; a `local: null` task with
-* no turbo task / `package.json` script is skipped, never failed — even when
-* `required` (it's a CI-only check, not a local one).
+* Prefers `"catalog:"` when the repo's own `pnpm-workspace.yaml` already
+* has a `turbo` catalog entry — matches every already-migrated repo
+* (`holocron`, `clients`, …) — falling back to a real pinned version
+* otherwise. Never touches an existing `devDependencies.turbo` entry, so
+* a repo pinning its own version on purpose is left alone — idempotent,
+* a no-op once set either way.
 */
-function runCi(input) {
-	const { print } = input;
-	const byName = /* @__PURE__ */ new Map();
-	for (const item of input.config?.tasks ?? []) byName.set(taskName(item), normalizeTaskEntry(item));
-	const gating = [...byName.values()].filter((e) => CI_ORDER.includes(e.name));
-	const all = gating.filter((e) => e.ci !== false);
-	const required = gating.filter((e) => e.required === true);
-	let selected = input.scope === "all" ? all : required;
-	const fellBack = input.scope !== "all" && selected.length === 0 && all.length > 0;
-	if (fellBack) selected = all;
-	const ordered = [...selected].sort((a, b) => CI_ORDER.indexOf(a.name) - CI_ORDER.indexOf(b.name));
-	print(`holocron ci — ${input.scope === "all" ? "all CI checks" : "required checks"} (${ordered.length})`);
-	if (fellBack) print("  (no required tasks in the manifest — running every CI task)");
-	print("");
-	const jobs = [];
-	for (const entry of ordered) {
-		const context = WORKFLOW_CHECK_CONTEXTS[entry.name] ?? null;
-		print(`▶ ${context ?? entry.name}`);
-		const r = runTask({
-			print: (line) => print(`  ${line}`),
-			logger: input.logger,
-			exec: input.exec,
-			readFile: input.readFile,
-			fileExists: input.fileExists,
-			listDir: input.listDir,
-			lookPath: input.lookPath,
-			task: entry.name,
-			cwd: input.cwd,
-			dryRun: input.dryRun ?? false,
-			required: entry.required === true,
-			...input.filter ? { filter: input.filter } : {}
-		});
-		const status = r.status;
-		jobs.push({
-			task: entry.name,
-			checkContext: context,
-			status,
-			command: r.command,
-			message: r.message
-		});
-	}
-	const failed = jobs.filter((j) => j.status === "fail").length;
-	const passed = jobs.filter((j) => j.status === "ok" || j.status === "dry-run").length;
-	const skipped = jobs.filter((j) => j.status === "skip").length;
-	print("");
-	if (ordered.length === 0) print("holocron ci — nothing to run");
-	else if (failed > 0) print(`✗ ${failed} failed, ${passed} passed${skipped ? `, ${skipped} skipped` : ""}`);
-	else print(`✓ ${passed} passed${skipped ? `, ${skipped} skipped` : ""}${input.dryRun ? " (plan only)" : ""}`);
+function ensureTurboDependency(packageJson, workspaceYaml) {
+	const pkg = JSON.parse(packageJson);
+	if (typeof pkg.devDependencies?.turbo === "string") return {
+		content: packageJson,
+		changed: false
+	};
+	const hasTurboCatalogEntry = /^\s*turbo:\s*\S/m.test(workspaceYaml);
+	const devDependencies = {
+		...pkg.devDependencies,
+		turbo: hasTurboCatalogEntry ? "catalog:" : DEFAULT_TURBO_VERSION
+	};
+	const updated = {
+		...pkg,
+		devDependencies
+	};
 	return {
-		status: failed > 0 ? "fail" : "ok",
-		jobs
+		content: `${JSON.stringify(updated, null, 2)}\n`,
+		changed: true
 	};
 }
-function taskName(item) {
-	return typeof item === "string" ? item : item.name;
-}
-//#endregion
-//#region src/templates/codecov/codecov.yml
-var codecov_default = "codecov:\n  require_ci_to_pass: true\n\ncoverage:\n  precision: 2\n  round: down\n  status:\n    project:\n      default:\n        target: auto\n        threshold: 2%\n        # Infra-only PRs (dep bumps, config, lockfile) touch no coverable code,\n        # so codecov produces no report to compare. Pass instead of blocking\n        # forever on a required check that will never post.\n        if_not_found: success\n    patch:\n      default:\n        target: 80%\n        if_not_found: success\n\ncomment:\n  layout: \"reach,diff,flags,components\"\n  behavior: default\n  require_changes: true\n\ncomponent_management:\n  default_rules:\n    statuses:\n      - type: patch\n        target: 80%\n        if_not_found: success\n  individual_components:\n";
 //#endregion
-//#region src/codecov.ts
+//#region src/tasks/run/linters.ts
 /**
-* `codecov.yml` generation — a manifest-derived artifact (component `paths`
-* come from workspace packages; the status targets track the `test` task's
-* coverage setup), the same category as the reusable `test.yml` this package
-* also generates. Moved out of `@theholocron/cli` (theholocron/holocron#650)
-* — `holocron setup`'s codecov step now calls {@link codecovConfig} instead
-* of importing this logic directly.
+* Known linters, in execution order. `always` entries are the current
+* hard-coded super-linter baseline; `prettier` is always-on because the org
+* applies it universally (super-linter only lints files that exist).
 */
-const INDIVIDUAL_COMPONENTS_MARKER = "  individual_components:";
-function scaffoldHeader() {
-	return [
-		`# Scaffolded by holocron setup — edit this file freely.`,
-		`# Source:  theholocron/holocron · packages/astromech/src/codecov.ts`,
-		``
-	].join("\n");
-}
-function codecovComponentBlock(packages) {
-	if (packages.length === 0) return "\n    []\n";
-	return "\n" + packages.flatMap(({ slug, dir }) => [
-		`    - component_id: ${slug}`,
-		`      name: "${slug}"`,
-		`      paths:`,
-		`        - ${dir ?? "packages"}/${slug}/**`,
-		``
-	]).join("\n");
-}
+const LINTERS = {
+	eslint: {
+		validate: ["VALIDATE_JAVASCRIPT_ES", "VALIDATE_TYPESCRIPT_ES"],
+		localBin: "eslint",
+		localArgs: ["."],
+		detect: [
+			"eslint.config.ts",
+			"eslint.config.js",
+			"eslint.config.mjs",
+			"eslint.config.cjs",
+			".eslintrc",
+			".eslintrc.json",
+			".eslintrc.yml",
+			".eslintrc.yaml",
+			".eslintrc.cjs"
+		],
+		configInput: "eslint-config"
+	},
+	prettier: {
+		validate: [
+			"VALIDATE_JAVASCRIPT_PRETTIER",
+			"VALIDATE_JSX_PRETTIER",
+			"VALIDATE_TYPESCRIPT_PRETTIER",
+			"VALIDATE_TSX",
+			"VALIDATE_MARKDOWN_PRETTIER"
+		],
+		fix: [
+			"FIX_JAVASCRIPT_PRETTIER",
+			"FIX_JSX_PRETTIER",
+			"FIX_TYPESCRIPT_PRETTIER",
+			"FIX_TSX",
+			"FIX_MARKDOWN_PRETTIER"
+		],
+		always: true,
+		localBin: "prettier",
+		localArgs: ["--check", "."],
+		configInput: "prettier-config"
+	},
+	yamllint: {
+		validate: ["VALIDATE_YAML"],
+		always: true,
+		localBin: "yamllint",
+		localArgs: ["."],
+		installHint: "brew install yamllint",
+		configInput: "yaml-config"
+	},
+	actionlint: {
+		validate: ["VALIDATE_GITHUB_ACTIONS"],
+		always: true,
+		localBin: "actionlint",
+		localArgs: [],
+		installHint: "brew install actionlint"
+	},
+	gitleaks: {
+		validate: ["VALIDATE_GITLEAKS"],
+		always: true,
+		localBin: "gitleaks",
+		localArgs: [
+			"dir",
+			"--no-banner",
+			"--config",
+			".gitleaks.toml"
+		],
+		installHint: "brew install gitleaks"
+	},
+	editorconfig: {
+		validate: ["VALIDATE_EDITORCONFIG"],
+		always: true,
+		localBin: "editorconfig-checker",
+		localArgs: [],
+		installHint: "brew install editorconfig-checker"
+	},
+	commitlint: {
+		validate: ["VALIDATE_GIT_COMMITLINT"],
+		always: true
+	},
+	"git-merge-conflict-markers": {
+		validate: ["VALIDATE_GIT_MERGE_CONFLICT_MARKERS"],
+		always: true
+	},
+	markdownlint: {
+		validate: ["VALIDATE_MARKDOWN"],
+		localBin: "markdownlint-cli2",
+		localArgs: ["**/*.md"],
+		detect: [
+			".markdownlint.json",
+			".markdownlint.jsonc",
+			".markdownlint.yaml",
+			".markdownlint.yml",
+			".markdownlint-cli2.jsonc",
+			".markdownlint-cli2.yaml",
+			".markdownlint-cli2.mjs"
+		]
+	}
+};
+/** Every linter name the registry knows. */
+const LINTER_NAMES = new Set(Object.keys(LINTERS));
 /**
-* Ensure every codecov status default carries `if_not_found: success`, so an
-* infra-only PR (dep bump, config, lockfile — no coverable change) passes
-* instead of hanging forever on a required check codecov never posts.
+* Resolve the linter set for a repo. An `explicit` list (from `config.tasks`)
+* picks the candidate set; otherwise the candidates are every `always` linter
+* plus every `detect`-gated linter whose filenames are present at the repo
+* root, OR whose mapped `@theholocron/*-config` package resolves per
+* {@link sharedConfigAvailable} — a repo can't run eslint with genuinely no
+* config anywhere (super-linter FATALs if you ask it to,
+* theholocron/holocron#654), but a *shared* one it has installed counts
+* (holocron#795: proving `clients`' eslint.config.ts files reduce to zero
+* remaining content is only half the story — the file itself was still load-
+* bearing here as the sole "eslint is even configured" signal until this
+* fallback existed). `always` linters are unconditional. Result is ordered
+* by {@link LINTERS} declaration order.
 *
-* Injects the key on the line after each `target:` that sits inside a status
-* block (`coverage.status.*.default` or a `statuses:` list item — indent ≥ 8,
-* or ≥ 8 for a `- type:` list entry), when the immediate sibling lines do not
-* already declare it.
+* `sharedConfigAvailable` is caller-computed (`run.ts`'s `runLinterGroup`
+* already resolves each linter's `resolveToolConfig()` per member to build
+* its actual command — reusing that instead of duplicating the package-
+* resolution logic here keeps this function itself pure and file-I/O-free).
+*
+* @throws when an `explicit` name is not in the registry — a typo is a
+* config bug, not a linter to silently skip.
 */
-function ensureIfNotFound(yaml) {
-	const lines = yaml.split("\n");
-	const out = [];
-	for (let i = 0; i < lines.length; i++) {
-		const line = lines[i];
-		out.push(line);
-		const m = /^(\s{8,})target:\s+\S+\s*$/.exec(line);
-		if (!m) continue;
-		const indent = m[1];
-		let alreadySet = false;
-		for (let j = i + 1; j < lines.length; j++) {
-			const sib = lines[j];
-			if (sib.trim() === "") continue;
-			const sibIndent = sib.match(/^\s*/)[0].length;
-			if (sibIndent < indent.length) break;
-			if (sibIndent === indent.length && /^\s*if_not_found\s*:/.test(sib)) {
-				alreadySet = true;
-				break;
-			}
-			if (sibIndent === indent.length && /^\s*(- |\w)/.test(sib) && !/^\s*(threshold|flags|paths|branches)\s*:/.test(sib)) break;
-		}
-		if (!alreadySet) out.push(`${indent}if_not_found: success`);
-	}
-	return out.join("\n");
-}
-function mergeCodecovComponents(existing, packages) {
-	const idx = existing.indexOf(INDIVIDUAL_COMPONENTS_MARKER);
-	if (idx === -1) return ensureIfNotFound(existing);
-	return ensureIfNotFound(existing.slice(0, idx + 24)) + codecovComponentBlock(packages);
-}
-function readWorkspaceDir(repoRoot, dir) {
-	const dirPath = join(repoRoot, dir);
-	if (!existsSync(dirPath)) return [];
-	const packages = [];
-	for (const entry of readdirSync(dirPath, { withFileTypes: true })) {
-		if (!entry.isDirectory()) continue;
-		try {
-			const raw = readFileSync(join(dirPath, entry.name, "package.json"), "utf8");
-			const pkg = JSON.parse(raw);
-			if (typeof pkg.name === "string") packages.push({
-				slug: entry.name,
-				name: pkg.name,
-				dir
-			});
-		} catch {}
+function resolveLinters(opts) {
+	const order = Object.keys(LINTERS);
+	const present = new Set(opts.rootFiles);
+	const shared = opts.sharedConfigAvailable ?? /* @__PURE__ */ new Set();
+	const configPresent = (name, def) => def.always === true || (def.detect ?? []).some((f) => present.has(f)) || shared.has(name);
+	if (opts.explicit && opts.explicit.length > 0) {
+		const unknown = opts.explicit.filter((n) => !LINTER_NAMES.has(n));
+		if (unknown.length > 0) throw new Error(`unknown linter${unknown.length > 1 ? "s" : ""} ${unknown.map((n) => `"${n}"`).join(", ")} — known: ${order.join(", ")}`);
+		const wanted = new Set(opts.explicit);
+		return order.filter((n) => wanted.has(n) && configPresent(n, LINTERS[n])).map((name) => ({
+			name,
+			def: LINTERS[name]
+		}));
 	}
-	return packages;
+	return order.filter((name) => configPresent(name, LINTERS[name])).map((name) => ({
+		name,
+		def: LINTERS[name]
+	}));
 }
+//#endregion
+//#region src/tasks/run/resolver.ts
 /**
-* Every public `packages/*` and `apps/*` workspace, sorted by slug. `[]`
-* when neither directory exists. Monorepo templates (Next.js, React, …)
-* ship user-facing code under `apps/` alongside library code under
-* `packages/` — both need a codecov component so `codecov/patch/<slug>`
-* actually posts for each.
+* `library` is every mapped tool's org-wide default variant today — every
+* currently-migrated repo (`holocron`, `clients`, `utils`, `configs`,
+* `themes`, `observability`, `skills`) is a publishable library package, and
+* `eslint-config`/`vitest-config`/`tsdown-config` all name their
+* general-purpose preset exactly that. Picking a different variant per repo
+* (an app-type template, say) needs new `holocron.config.ts` surface this
+* doesn't add yet — deliberately out of scope until a real consumer needs it.
 */
-function readWorkspacePackages(repoRoot) {
-	return [...readWorkspaceDir(repoRoot, "packages"), ...readWorkspaceDir(repoRoot, "apps")].sort((a, b) => a.slug.localeCompare(b.slug));
-}
-/** A brand-new `codecov.yml` — the scaffold header + the base template + this repo's component list. */
-function createCodecovConfig(packages) {
-	return `${scaffoldHeader()}${codecov_default.trimEnd()}${codecovComponentBlock(packages)}`;
-}
+const TOOL_CONFIGS = {
+	eslint: {
+		package: "@theholocron/eslint-config",
+		exportPath: "./bundles/library",
+		flag: ["--config"]
+	},
+	prettier: {
+		package: "@theholocron/prettier-config",
+		exportPath: ".",
+		flag: ["--config"]
+	},
+	vitest: {
+		package: "@theholocron/vitest-config",
+		exportPath: "./bundles/library",
+		flag: ["--config"]
+	},
+	tsdown: {
+		package: "@theholocron/tsdown-config",
+		exportPath: "./presets/library",
+		flag: ["--config"]
+	},
+	commitlint: {
+		package: "@theholocron/commitlint-config",
+		exportPath: ".",
+		flag: ["--config"]
+	}
+};
 /**
-* The full pipeline `holocron setup` needs: read this repo's public
-* `packages/*`, then either merge them into an `existing` `codecov.yml` or
-* scaffold a new one.
+* Every filename a tool's own auto-discovery would pick up from `cwd` —
+* same extension set `registry.ts`'s `turbo.inputs`/`local.detect` entries
+* already use for these tools, kept in sync by hand (no shared source of
+* truth between the two today). Presence of any one of these means the
+* package has its own local config — customized or not, `resolveToolConfig`
+* can't tell the difference from the filename alone, so it defers to it
+* either way (#749).
 */
-function codecovConfig(repoRoot, existing) {
-	const packages = readWorkspacePackages(repoRoot);
-	return existing != null ? mergeCodecovComponents(existing, packages) : createCodecovConfig(packages);
-}
-//#endregion
-//#region src/required-checks.ts
+const LOCAL_CONFIG_FILES = {
+	eslint: [
+		"eslint.config.ts",
+		"eslint.config.js",
+		"eslint.config.mjs",
+		"eslint.config.cjs"
+	],
+	prettier: [
+		"prettier.config.ts",
+		"prettier.config.js",
+		"prettier.config.mjs",
+		"prettier.config.cjs"
+	],
+	vitest: [
+		"vitest.config.ts",
+		"vitest.config.js",
+		"vitest.config.mjs"
+	],
+	tsdown: [
+		"tsdown.config.ts",
+		"tsdown.config.js",
+		"tsdown.config.mjs",
+		"tsdown.config.cjs"
+	],
+	commitlint: [
+		"commitlint.config.ts",
+		"commitlint.config.js",
+		"commitlint.config.mjs",
+		"commitlint.config.cjs"
+	]
+};
+new Set(Object.keys(TOOL_CONFIGS));
 /**
-* `requiredChecks(config)` — the branch-protection required-status-check list,
-* derived from the task manifest. Every `required: true` task contributes its
-* {@link WORKFLOW_CHECK_CONTEXTS} entry; `config.extraRequiredChecks` adds
-* contexts not backed by a task (codecov, DCO is prepended by the caller).
-*
-* `@theholocron/cli`'s `holocron setup` calls this instead of the old
-* hand-maintained `repo.requiredChecks` array. Policy-free — it only knows the
-* manifest.
+* `<flag> <absolute path>` for `tool`, resolved against `cwd`'s
+* `node_modules` — or `[]` when the tool isn't mapped, `cwd` already has its
+* own local config file for it (#749 — local always wins, customized or
+* not), the shared package isn't installed, its `package.json` doesn't
+* declare the export subpath this needs, or the resolved file doesn't
+* actually exist on disk (a stale install, or a package version that
+* predates the export existing).
 */
-/** Ordered (task contexts in {@link CI_ORDER}, then extras), de-duplicated. */
-function requiredChecks(config) {
-	const entries = (config.tasks ?? []).map(normalizeTaskEntry);
-	const seen = /* @__PURE__ */ new Set();
-	const out = [];
-	for (const name of CI_ORDER) {
-		const context = entries.some((e) => e.name === name && e.required === true) ? WORKFLOW_CHECK_CONTEXTS[name] : void 0;
-		if (context && !seen.has(context)) {
-			seen.add(context);
-			out.push(context);
-		}
-	}
-	for (const context of config.extraRequiredChecks ?? []) if (!seen.has(context)) {
-		seen.add(context);
-		out.push(context);
+function resolveToolConfig(tool, cwd, deps) {
+	const spec = TOOL_CONFIGS[tool];
+	if (!spec) return [];
+	if ((LOCAL_CONFIG_FILES[tool] ?? []).some((name) => deps.fileExists(joinPath(cwd, name)))) return [];
+	const pkgDir = joinPath(cwd, "node_modules", ...spec.package.split("/"));
+	const pkgJsonPath = joinPath(pkgDir, "package.json");
+	if (!deps.fileExists(pkgJsonPath)) return [];
+	let pkg;
+	try {
+		pkg = JSON.parse(deps.readFile(pkgJsonPath));
+	} catch {
+		return [];
 	}
-	return out;
+	const relative = resolveExportEntry(pkg.exports?.[spec.exportPath]);
+	if (!relative) return [];
+	const absolute = joinPath(pkgDir, relative.replace(/^\.\//, ""));
+	if (!deps.fileExists(absolute)) return [];
+	return [...spec.flag, absolute];
 }
-//#endregion
-//#region src/templates/reusable/actions/auto-commit.yml
-var auto_commit_default = "name: Auto Commit\ndescription: >\n  Commit and push any file changes using stefanzweifel/git-auto-commit-action.\n  If a branch name is provided and differs from the current branch, a new branch\n  is created automatically.\n\ninputs:\n  token:\n    description: >\n      GitHub token with push access to the target branch. Used to authenticate\n      the git remote so the commit can be pushed.\n    required: true\n  branch:\n    description: >\n      Branch to commit to. Leave empty to commit to the current branch (useful\n      in PR contexts). Provide an explicit name (e.g. chore/auto-sync) to push\n      to a separate branch.\n    required: false\n    default: \"\"\n  commit-message:\n    description: Commit message.\n    required: true\n  commit-options:\n    description: >\n      Additional options passed to git commit (e.g. --no-verify).\n    required: false\n    default: \"\"\n  commit-user-name:\n    description: Git user.name for the commit.\n    required: false\n    default: \"github-actions[bot]\"\n  commit-user-email:\n    description: Git user.email for the commit.\n    required: false\n    default: \"41898282+github-actions[bot]@users.noreply.github.com\"\n  commit-author:\n    description: >\n      Git author string in \"Name <email>\" format.\n    required: false\n    default: \"github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\"\n\noutputs:\n  changes-detected:\n    description: \"'true' if any files were committed, 'false' otherwise.\"\n    value: ${{ steps.commit.outputs.changes_detected }}\n\nruns:\n  using: composite\n  steps:\n    - name: Configure git remote with token\n      shell: bash\n      run: |\n        REMOTE_URL=$(git remote get-url origin)\n        AUTHED_URL=$(echo \"$REMOTE_URL\" | sed \"s|https://|https://x-access-token:${TOKEN}@|\")\n        git remote set-url origin \"$AUTHED_URL\"\n      env:\n        TOKEN: ${{ inputs.token }}\n\n    - name: Reset branch to current HEAD\n      if: ${{ inputs.branch != '' }}\n      shell: bash\n      run: git checkout -B \"$BRANCH\"\n      env:\n        BRANCH: ${{ inputs.branch }}\n\n    - name: Build signed commit message\n      id: msg\n      shell: bash\n      run: |\n        TRAILER=\"Signed-off-by: ${COMMIT_USER_NAME} <${COMMIT_USER_EMAIL}>\"\n        if echo \"$COMMIT_MESSAGE\" | grep -qF \"$TRAILER\"; then\n          FINAL=\"$COMMIT_MESSAGE\"\n        else\n          FINAL=\"${COMMIT_MESSAGE}\"$'\\n\\n'\"${TRAILER}\"\n        fi\n        {\n          echo \"value<<EOF_TRAILER\"\n          printf '%s' \"$FINAL\"\n          echo \"\"\n          echo \"EOF_TRAILER\"\n        } >> \"$GITHUB_OUTPUT\"\n      env:\n        COMMIT_MESSAGE: ${{ inputs.commit-message }}\n        COMMIT_USER_NAME: ${{ inputs.commit-user-name }}\n        COMMIT_USER_EMAIL: ${{ inputs.commit-user-email }}\n\n    - uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d # v7.2.0\n      id: commit\n      with:\n        branch: ${{ inputs.branch }}\n        commit_message: ${{ steps.msg.outputs.value }}\n        commit_options: ${{ inputs.commit-options }}\n        commit_user_name: ${{ inputs.commit-user-name }}\n        commit_user_email: ${{ inputs.commit-user-email }}\n        commit_author: ${{ inputs.commit-author }}\n";
-//#endregion
-//#region src/templates/reusable/actions/holocron.yml
-var holocron_default = "name: Holocron\ndescription: >\n  Run the Holocron CLI — `holocron run <task> [job]` by default, or any other\n  subcommand via `command:` (`sync`, `sync-github`, …). Resolves\n  `@theholocron/cli` from `node_modules` (published tarball) or builds it from\n  source when it resolves to an unbuilt workspace checkout (the holocron repo\n  itself). Requires dependencies to be installed already (run the setup action\n  first).\n\ninputs:\n  command:\n    description: >\n      Holocron subcommand. Default `run` — then `task` (and optional `job`)\n      name the manifest task. Set to `sync` / `sync-github` / … to run that\n      subcommand directly; `args` becomes everything after it.\n    required: false\n    default: run\n  task:\n    description: >\n      Manifest task to run when command is run — typecheck, test, build, audit.\n    required: false\n    default: \"\"\n  job:\n    description: Optional sub-job within the task (e.g. knip, performance for audit).\n    required: false\n    default: \"\"\n  args:\n    description: >\n      For `command: run`, extra arguments forwarded to the tool after `--`.\n      For any other command, the arguments passed straight to it.\n    required: false\n    default: \"\"\n\noutputs:\n  log-file:\n    description: >\n      Path to a file holding the full captured stdout+stderr of this\n      invocation — the same text the live Actions log shows, saved for a\n      caller that wants to ship it elsewhere (e.g. Sentinel's dispatched\n      checks shipping it to Axiom, holocron#769/#794).\n    value: ${{ steps.run.outputs.log-file }}\n\nruns:\n  using: composite\n\n  steps:\n    - name: Build the workspace when the CLI resolves to an unbuilt checkout\n      shell: bash\n      # The holocron repo carries @theholocron/cli as `workspace:*`; its bin\n      # (dist/cli.mjs) does not exist on a fresh checkout. `pnpm build` is a\n      # turbo run — cached and cheap once warm. A no-op everywhere else, where\n      # the published tarball already ships dist/.\n      #\n      # pnpm creates every workspace package's node_modules/.bin/holocron shim\n      # once, during the setup action's earlier `pnpm install` — before this\n      # build has run, so every one of them is silently skipped (\"Failed to\n      # create bin ... ENOENT\"), not just @theholocron/cli's own. That's a\n      # one-time decision: a later build doesn't retroactively fix a shim that\n      # was never created. Re-running `pnpm install` here (fast — the lockfile\n      # hasn't changed, so it only re-links `.bin`) is what actually fixes it,\n      # confirmed against a real cold install: `holocron` stays unresolvable\n      # from inside any package until this second install runs.\n      run: |\n        if [ ! -f node_modules/@theholocron/cli/dist/cli.mjs ]; then\n          echo \"→ @theholocron/cli dist/ missing — building the workspace from source\" >&2\n          pnpm build\n          echo \"→ re-linking node_modules/.bin — pnpm skipped it pre-build\" >&2\n          pnpm install --frozen-lockfile\n        fi\n\n    - name: holocron ${{ inputs.command }} ${{ inputs.task }}\n      id: run\n      shell: bash\n      env:\n        HOLOCRON_COMMAND: ${{ inputs.command }}\n        HOLOCRON_TASK: ${{ inputs.task }}\n        HOLOCRON_JOB: ${{ inputs.job }}\n        HOLOCRON_ARGS: ${{ inputs.args }}\n      run: |\n        if [ \"$HOLOCRON_COMMAND\" = \"run\" ]; then\n          set -- run \"$HOLOCRON_TASK\"\n          [ -n \"$HOLOCRON_JOB\" ] && set -- \"$@\" \"$HOLOCRON_JOB\"\n          # shellcheck disable=SC2086\n          [ -n \"$HOLOCRON_ARGS\" ] && set -- \"$@\" -- $HOLOCRON_ARGS\n        else\n          # shellcheck disable=SC2086\n          set -- \"$HOLOCRON_COMMAND\" $HOLOCRON_ARGS\n        fi\n        # Invoke the built entry directly. `pnpm exec holocron` relies on a\n        # node_modules/.bin/holocron shim that pnpm does not create for a\n        # workspace package whose dist/ was absent at install time (the holocron\n        # repo itself). Resolving the package's main export gives dist/index.mjs;\n        # the bin sits next to it as dist/cli.mjs. This is `require.resolve` from\n        # node_modules — it works in the holocron monorepo AND in every consumer\n        # repo (theholocron/holocron#655), unlike a hard-coded `packages/cli/…`.\n        cli=\"$(dirname \"$(node -e 'process.stdout.write(require.resolve(\"@theholocron/cli\"))')\")/cli.mjs\"\n        if [ ! -f \"$cli\" ]; then\n          echo \"::error::@theholocron/cli entry not found at $cli — is the workspace built?\" >&2\n          exit 1\n        fi\n        echo \"→ $cli $*\" >&2\n        # `tee` keeps the live Actions log streaming exactly as before while\n        # also capturing it to a file callers can ship elsewhere (log-file\n        # output, above). PIPESTATUS[0] -- not $? -- is `node`'s own exit\n        # code; $? after a pipe is tee's, which succeeds even when node fails.\n        log_file=\"${RUNNER_TEMP}/holocron-output.log\"\n        node \"$cli\" \"$@\" 2>&1 | tee \"$log_file\"\n        exit_code=${PIPESTATUS[0]}\n        echo \"log-file=$log_file\" >> \"$GITHUB_OUTPUT\"\n        exit \"$exit_code\"\n";
-//#endregion
-//#region src/templates/reusable/actions/install.yml
-var install_default = "name: Install dependencies\ndescription: Install project dependencies with pnpm frozen lockfile.\n\nruns:\n  using: composite\n\n  steps:\n    - name: Install dependencies\n      if: ${{ hashFiles('pnpm-lock.yaml') != '' }}\n      shell: bash\n      run: pnpm install --frozen-lockfile\n";
-//#endregion
-//#region src/templates/reusable/actions/setup.yml
-var setup_default = "name: Setup\ndescription: Prepare the environment and install project dependencies.\n\ninputs:\n  node-version:\n    description: Node.js version\n    required: false\n    default: \"22.x\"\n\nruns:\n  using: composite\n\n  steps:\n    - uses: theholocron/.github/.github/actions/setup-node@main\n      with:\n        node-version: ${{ inputs.node-version }}\n\n    - uses: theholocron/.github/.github/actions/install@main\n\n    # `@theholocron/cli`'s `dist/cli.mjs` doesn't exist yet at this point, so\n    # pnpm's workspace bin-linking can't create `node_modules/.bin/holocron`\n    # (silent `WARN ... ENOENT`, not a hard failure). Every package whose\n    # scripts delegate via `holocron run <task> --` then fails at run time\n    # with `holocron: not found` (#698). Same fix the `holocron` composite\n    # action already applies for its own direct invocation (see its \"Build\n    # the workspace when the CLI resolves to an unbuilt checkout\" step) —\n    # mirrored here so it also covers *nested* `holocron run <task> --`\n    # calls from inside package.json scripts, which that action's own guard\n    # doesn't reach. `pnpm build` (not a scoped `--filter`) so the CLI's own\n    # workspace dependencies (e.g. rollup-plugin-transform-template) build\n    # in topological order too — a scoped build skips them and fails.\n    # No-op in every consumer repo, where the published tarball already\n    # ships `dist/`.\n    - name: Build the Holocron CLI\n      shell: bash\n      run: |\n        if [ ! -f node_modules/@theholocron/cli/dist/cli.mjs ]; then\n          echo \"→ @theholocron/cli dist/ missing — building the workspace from source\" >&2\n          pnpm build\n          echo \"→ re-linking node_modules/.bin — pnpm skipped it pre-build\" >&2\n          pnpm install --frozen-lockfile\n        fi\n\n    - name: Cache Turbo artifacts\n      if: ${{ hashFiles('turbo.json') != '' }}\n      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0\n      with:\n        path: .turbo\n        key: turbo-${{ runner.os }}-${{ github.sha }}\n        restore-keys: |\n          turbo-${{ runner.os }}-\n";
-//#endregion
-//#region src/templates/reusable/actions/setup-node.yml
-var setup_node_default = "name: Setup Node\ndescription: Install pnpm and Node.js with pnpm dependency caching.\n\ninputs:\n  node-version:\n    description: Node.js version\n    required: false\n    default: \"22.x\"\nruns:\n  using: composite\n\n  steps:\n    - name: Setup pnpm\n      if: ${{ hashFiles('pnpm-lock.yaml') != '' }}\n      uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4\n\n    - name: Setup Node.js\n      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0\n      with:\n        node-version: ${{ hashFiles('.node-version') != '' && '' || inputs.node-version }}\n        node-version-file: ${{ hashFiles('.node-version') != '' && '.node-version' || '' }}\n        cache: ${{ hashFiles('pnpm-lock.yaml') != '' && 'pnpm' || '' }}\n        # Do NOT add registry-url here. setup-node writes .npmrc with\n        # _authToken=${NODE_AUTH_TOKEN} and sets NPM_CONFIG_USERCONFIG to it.\n        # pnpm reads that file, fails env-var substitution when the token is\n        # empty, and loses auth entirely. Without registry-url, pnpm 10.15+\n        # handles Trusted Publishing via its own native OIDC exchange.\n\n    - name: Add node_modules/.bin to PATH\n      shell: bash\n      run: echo \"$GITHUB_WORKSPACE/node_modules/.bin\" >> $GITHUB_PATH\n";
-//#endregion
-//#region src/reusable.ts
 /**
-* The **reusable** GitHub Actions surface pushed to `theholocron/.github` by
-* `holocron sync-github` — the `workflow_call` implementations and composite
-* actions that every repo's thin callers delegate to.
-*
-* `theholocron/.github` is a **pure sync target**: `.github/workflows/*`,
-* `.github/actions/*` and `workflow-templates/*` there are generated from the
-* `.yml` files in `src/templates/reusable/` and pushed verbatim (with a
-* "do not edit" header). Never hand-edit them in `.github`.
-*
-* Not to be confused with `WORKFLOW_TEMPLATES` in `thin-callers.ts` — those are
-* the *thin-caller bases* written into each consumer repo's `.github/workflows/`.
+* Unwrap a `package.json#exports` subpath entry down to its file path —
+* either a bare string, or an object with condition keys (`import`,
+* `default`, `require`, …) that may themselves nest one level (`{ import: {
+* types, default } }`, the shape every `@theholocron/*-config` package
+* actually uses). Prefers `import` (this org ships ESM), then `default`,
+* then `require` as a last resort.
 */
-/** `workflow_call` implementations → `.github/workflows/<name>.yml`. */
-const REUSABLE_WORKFLOWS = {
-	"verification.unitTests": "name: Test\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      run-unit:\n        description: Run unit tests with coverage (disable for UI-only repos that use Storybook testing exclusively)\n        type: boolean\n        required: false\n        default: true\n      run-storybook:\n        description: Run Storybook vitest interaction tests (requires .storybook/ setup)\n        type: boolean\n        required: false\n        default: false\n      run-interaction:\n        description: Run Storybook interaction and accessibility tests with Playwright\n        type: boolean\n        required: false\n        default: false\n      run-chromatic:\n        description: Publish Storybook to Chromatic for visual regression testing\n        type: boolean\n        required: false\n        default: false\n      chromatic-projects:\n        description: >\n          JSON array of Chromatic projects to build, one matrix job per entry.\n          Each entry: { \"tokenName\": \"WEB\", \"workingDir\": \"apps/web\", \"buildScript\": \"build:storybook\" }.\n          tokenName maps to secret CHROMATIC_PROJECT_TOKEN_<TOKENNAME>; use \"default\"\n          (or omit for the legacy empty-string form) to use the bare CHROMATIC_PROJECT_TOKEN\n          secret for single-project repos.\n          buildScript defaults to \"build:storybook\" when omitted.\n          Default runs a single job from the repo root using CHROMATIC_PROJECT_TOKEN.\n        type: string\n        required: false\n        default: '[{\"tokenName\":\"default\",\"workingDir\":\".\",\"buildScript\":\"build:storybook\"}]'\n      run-user-flow:\n        description: Run Cypress E2E user-flow tests (requires cypress.config.*)\n        type: boolean\n        required: false\n        default: false\n      wait-on-url:\n        description: URL to wait for before running Cypress tests (default is Vite dev server; override for non-Vite stacks e.g. http://localhost:3000 for Next.js)\n        type: string\n        required: false\n        default: \"http://localhost:5173\"\n    secrets:\n      CHROMATIC_PROJECT_TOKEN:\n        required: false\n      CYPRESS_RECORD_KEY:\n        required: false\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  unit:\n    name: Run unit tests and collect coverage\n    if: ${{ inputs.run-unit }}\n    permissions:\n      contents: read\n      id-token: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Run tests with coverage\n        with:\n          task: verification.unitTests\n\n      # A Codecov upload must not fail silently. fail_ci_if_error makes a failed\n      # upload fail this step (the action's default is to log the error and pass),\n      # which fails the job and so the `Test / Conclusion` check. Whether that\n      # blocks a merge is up to whether the check is required, not this workflow\n      # (holocron#934).\n      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0\n        name: Upload coverage to Codecov\n        with:\n          use_oidc: true\n          fail_ci_if_error: true\n\n      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0\n        name: Upload test results to Codecov\n        if: ${{ !cancelled() }}\n        with:\n          use_oidc: true\n          fail_ci_if_error: true\n          report_type: test_results\n          files: \"**/test-report.junit.xml\"\n\n  storybook:\n    name: Run Storybook interaction tests\n    if: ${{ inputs.run-storybook }}\n    permissions:\n      contents: read\n      id-token: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: pnpm exec playwright install chromium --with-deps\n        name: Install Playwright\n\n      - run: pnpm test:storybook\n        name: Run Storybook tests\n\n      # A Codecov upload must not fail silently. fail_ci_if_error makes a failed\n      # upload fail this step (the action's default is to log the error and pass),\n      # which fails the job and so the `Test / Conclusion` check. Whether that\n      # blocks a merge is up to whether the check is required, not this workflow\n      # (holocron#934).\n      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0\n        name: Upload coverage to Codecov\n        with:\n          use_oidc: true\n          fail_ci_if_error: true\n\n      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0\n        name: Upload test results to Codecov\n        if: ${{ !cancelled() }}\n        with:\n          use_oidc: true\n          fail_ci_if_error: true\n          report_type: test_results\n          files: \"**/test-report.junit.xml\"\n\n  visual-and-composition:\n    # No explicit matrix reference here — a skipped job (run-chromatic:\n    # false, the common case) never expands its matrix, so a `${{\n    # matrix.project.tokenName }}` in name: has nothing to resolve and\n    # shows as raw template text in the checks UI. GitHub auto-appends\n    # the matrix values in parens when the matrix *does* expand, so this\n    # loses no distinctness across multiple Chromatic projects.\n    name: Run visual and composition tests\n    if: ${{ inputs.run-chromatic }}\n    strategy:\n      fail-fast: false\n      matrix:\n        project: ${{ fromJSON(inputs.chromatic-projects) }}\n    permissions:\n      contents: read\n      statuses: write\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: chromaui/action@14cfaef73576e69f95f47f60058063f46ca38719 # v18\n        name: Publish to Chromatic\n        with:\n          projectToken: ${{ (matrix.project.tokenName == 'default' || matrix.project.tokenName == '') && secrets.CHROMATIC_PROJECT_TOKEN || secrets[format('CHROMATIC_PROJECT_TOKEN_{0}', matrix.project.tokenName)] }}\n          token: ${{ github.token }}\n          buildScriptName: ${{ matrix.project.buildScript || 'build:storybook' }}\n          workingDir: ${{ matrix.project.workingDir || '.' }}\n          storybookBaseDir: ${{ matrix.project.storybookBaseDir || '' }}\n          untraced: ${{ matrix.project.untraced || '' }}\n          onlyStoryFiles: ${{ matrix.project.onlyStoryFiles || '' }}\n          exitZeroOnChanges: ${{ matrix.project.exitZeroOnChanges || false }}\n\n  interaction-and-accessibility:\n    name: Run interactions and accessibility tests\n    if: ${{ inputs.run-interaction }}\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: pnpm exec playwright install --with-deps\n        name: Install Playwright\n\n      - run: pnpm test:storybook\n        name: Run interaction and accessibility tests\n\n  user-flow:\n    name: Run user flow tests\n    if: ${{ inputs.run-user-flow }}\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    strategy:\n      fail-fast: false\n      matrix:\n        containers: [1, 2]\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: pnpm exec cypress install\n        name: Install Cypress binary\n\n      - uses: cypress-io/github-action@1052aa98bbbe4f55210f844878213c07d9c8c399 # v6.7.13\n        name: Cypress run\n        with:\n          start: pnpm dev\n          wait-on: ${{ inputs.wait-on-url }}\n          record: true\n          parallel: true\n        env:\n          CYPRESS_RECORD_KEY: ${{ secrets.CYPRESS_RECORD_KEY }}\n          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n\n  conclusion:\n    name: Conclusion\n    runs-on: ubuntu-latest\n    if: always()\n    needs: [unit, storybook, visual-and-composition, interaction-and-accessibility, user-flow]\n    steps:\n      - name: Check job statuses\n        run: |\n          if [[ \"$RESULTS\" == *\"failure\"* ]] || [[ \"$RESULTS\" == *\"cancelled\"* ]]; then\n            exit 1\n          fi\n        env:\n          RESULTS: ${{ join(needs.*.result, ',') }}\n",
-	"verification.typeSafety": "name: Typecheck\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  typecheck:\n    name: Run tsc --noEmit\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Type check\n        with:\n          task: verification.typeSafety\n",
-	"verification.performance": "name: Audit the Performance\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      lighthouse-config:\n        description: >\n          Path to the Lighthouse CI config file, forwarded to `holocron run\n          verification.performance -- --config`. Defaults to\n          lighthouse.config.cjs (the org standard).\n        type: string\n        required: false\n        default: lighthouse.config.cjs\n    secrets:\n      LHCI_GITHUB_APP_TOKEN:\n        required: false\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  performance:\n    name: Run Lighthouse CI\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n      # Read by `lhci autorun` inside `holocron run verification.performance`.\n      LHCI_GITHUB_APP_TOKEN: ${{ secrets.LHCI_GITHUB_APP_TOKEN }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: npm install -g @lhci/cli@0.14.x\n        name: Install Lighthouse CLI\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Run Lighthouse CI\n        with:\n          task: verification.performance\n          args: --config=${{ inputs.lighthouse-config }}\n",
-	"sourceQuality.staticAnalysis": "name: Static Analysis\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      enable-auto-commit:\n        description: >\n          Auto-commit eslint --fix results as a verified commit via a GitHub App.\n          Requires SUPER_LINTER_APP_ID and SUPER_LINTER_PRIVATE_KEY secrets\n          (same App used across every formatting-capable task — D12).\n        type: boolean\n        required: false\n        default: false\n    secrets:\n      SUPER_LINTER_APP_ID:\n        required: false\n      SUPER_LINTER_PRIVATE_KEY:\n        required: false\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  static-analysis:\n    name: Run eslint and actionlint\n    permissions:\n      contents: write\n      statuses: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n      APP_ID_SET: ${{ secrets.SUPER_LINTER_APP_ID != '' }}\n    steps:\n      - name: Generate GitHub App token\n        id: app-token\n        if: >\n          inputs.enable-auto-commit == true &&\n          github.event.pull_request != null &&\n          github.event.pull_request.head.repo.full_name == github.repository &&\n          github.ref_name != github.event.repository.default_branch &&\n          env.APP_ID_SET == 'true'\n        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0\n        with:\n          app-id: ${{ secrets.SUPER_LINTER_APP_ID }}\n          private-key: ${{ secrets.SUPER_LINTER_PRIVATE_KEY }}\n\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n          token: ${{ steps.app-token.outputs.token || github.token }}\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      # actionlint has no npm distribution — install the prebuilt binary via\n      # the maintainer's own documented download script.\n      # NOTE: unverified against a live CI run at authoring time (D12) — flag\n      # here if this needs adjustment.\n      - name: Install actionlint\n        run: |\n          bash <(curl -sSf https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)\n          sudo mv ./actionlint /usr/local/bin/actionlint\n\n      - name: Check for merge-conflict markers\n        # No package distributes this as a standalone tool — a plain grep for\n        # the marker lines (the same check the old bundled linter ran, D12).\n        run: |\n          if grep -rlnE '^(<{7}|={7}|>{7})( |$)' \\\n            --exclude-dir=.git --exclude-dir=node_modules .; then\n            echo \"::error::merge-conflict markers found\"\n            exit 1\n          fi\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Run eslint and actionlint\n        with:\n          task: sourceQuality.staticAnalysis\n\n      - uses: theholocron/.github/.github/actions/auto-commit@main\n        name: Commit and push eslint --fix\n        if: >\n          inputs.enable-auto-commit == true &&\n          github.event.pull_request != null &&\n          github.event.pull_request.head.repo.full_name == github.repository &&\n          github.ref_name != github.event.repository.default_branch &&\n          env.APP_ID_SET == 'true' &&\n          steps.app-token.conclusion == 'success'\n        with:\n          token: ${{ steps.app-token.outputs.token }}\n          branch: ${{ github.event.pull_request.head.ref || github.head_ref || github.ref }}\n          commit-message: \"chore: fix static-analysis issues\"\n          commit-options: \"--no-verify\"\n",
-	"sourceQuality.formatting": "name: Formatting\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      enable-auto-commit:\n        description: >\n          Auto-commit prettier/editorconfig/markdownlint --fix results as a\n          verified commit via a GitHub App (same App used across every\n          formatting-capable task — D12).\n        type: boolean\n        required: false\n        default: false\n    secrets:\n      SUPER_LINTER_APP_ID:\n        required: false\n      SUPER_LINTER_PRIVATE_KEY:\n        required: false\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  formatting:\n    name: Run prettier, editorconfig-checker, markdownlint\n    permissions:\n      contents: write\n      statuses: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n      APP_ID_SET: ${{ secrets.SUPER_LINTER_APP_ID != '' }}\n    steps:\n      - name: Generate GitHub App token\n        id: app-token\n        if: >\n          inputs.enable-auto-commit == true &&\n          github.event.pull_request != null &&\n          github.event.pull_request.head.repo.full_name == github.repository &&\n          github.ref_name != github.event.repository.default_branch &&\n          env.APP_ID_SET == 'true'\n        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0\n        with:\n          app-id: ${{ secrets.SUPER_LINTER_APP_ID }}\n          private-key: ${{ secrets.SUPER_LINTER_PRIVATE_KEY }}\n\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n          token: ${{ steps.app-token.outputs.token || github.token }}\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      # editorconfig-checker has no npm distribution — install the prebuilt\n      # binary from its release tarball (v4.0.1+ ships the binary at the\n      # tarball root as `editorconfig-checker`, not `bin/ec-<os>-<arch>` —\n      # confirmed against a live CI run; the old asset name/path 404s now).\n      - name: Install editorconfig-checker\n        run: |\n          curl -sSL https://github.com/editorconfig-checker/editorconfig-checker/releases/latest/download/editorconfig-checker-linux-amd64.tar.gz \\\n            | tar xz -C /usr/local/bin editorconfig-checker\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Run prettier, editorconfig-checker, markdownlint\n        with:\n          task: sourceQuality.formatting\n\n      - uses: theholocron/.github/.github/actions/auto-commit@main\n        name: Commit and push formatting fixes\n        if: >\n          inputs.enable-auto-commit == true &&\n          github.event.pull_request != null &&\n          github.event.pull_request.head.repo.full_name == github.repository &&\n          github.ref_name != github.event.repository.default_branch &&\n          env.APP_ID_SET == 'true' &&\n          steps.app-token.conclusion == 'success'\n        with:\n          token: ${{ steps.app-token.outputs.token }}\n          branch: ${{ github.event.pull_request.head.ref || github.head_ref || github.ref }}\n          commit-message: \"chore: fix formatting issues\"\n          commit-options: \"--no-verify\"\n",
-	"sourceQuality.structuredDataValidation": "name: Structured Data Validation\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  structured-data-validation:\n    name: Run yamllint\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      # yamllint has no npm distribution — Python ships preinstalled on\n      # ubuntu-latest runners.\n      - name: Install yamllint\n        run: pip install --user yamllint\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Run yamllint\n        with:\n          task: sourceQuality.structuredDataValidation\n",
-	"sourceQuality.deadCodeAnalysis": "name: Dead Code Analysis\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  dead-code-analysis:\n    name: Run knip\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          persist-credentials: false\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Run knip\n        with:\n          task: sourceQuality.deadCodeAnalysis\n",
-	"security.secretDetection": "name: Secret Detection\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  secret-detection:\n    name: Run gitleaks\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n\n      # gitleaks has no npm distribution — install the prebuilt binary via\n      # the maintainer's own documented install script.\n      # NOTE: unverified against a live CI run at authoring time (D12) — flag\n      # here if this needs adjustment.\n      - name: Install gitleaks\n        run: |\n          curl -sSfL https://raw.githubusercontent.com/gitleaks/gitleaks/master/install.sh | sh -s -- -b /usr/local/bin\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Run gitleaks\n        with:\n          task: security.secretDetection\n",
-	"security.codeScanning": "name: Security\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      language:\n        description: CodeQL language to analyze\n        type: string\n        required: false\n        default: javascript-typescript\n\njobs:\n  analyze:\n    name: Analyze (${{ inputs.language }})\n    permissions:\n      actions: read\n      contents: read\n      security-events: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 45\n    # Do not cancel in-progress security scans.\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0\n        name: Initialize CodeQL\n        with:\n          languages: ${{ inputs.language }}\n\n      - uses: github/codeql-action/autobuild@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0\n        name: Autobuild\n\n      - uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0\n        name: Analyze\n        with:\n          category: /language:${{ inputs.language }}\n",
-	"delivery.build": "name: Build\n\n# Sanity check that every workspace actually compiles to dist/ — doesn't\n# upload or publish anything. delivery.publish builds again before\n# publishing; this just answers \"does it build?\" on every push/PR.\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  build:\n    name: Build every workspace\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Build\n        with:\n          task: delivery.build\n",
-	"delivery.publish": "name: Release\n\n# Semantic-release with OIDC Trusted Publishing.\n# actions/setup-node writes a default NODE_AUTH_TOKEN=${{ github.token }}\n# which shadows OIDC auth. We explicitly clear it so npm falls through to\n# the Trusted Publisher OIDC exchange.\n# The calling repo must have a .releaserc.json that configures branches,\n# plugins, and any publish options. npm@11+ is installed to support OIDC.\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      dry-run:\n        description: >\n          When true, runs semantic-release --dry-run: analyzes commits and\n          previews the next release without git writes or publish. Only\n          meaningful for workflow_dispatch triggers; push-triggered runs\n          always run fully.\n        type: boolean\n        required: false\n        default: false\n      post-release:\n        description: >\n          When true, dispatches a readme sync broadcast after a successful\n          release. Enable for packages consumed by other repos via the\n          registry-doc system so downstream README installation blocks\n          stay current.\n        type: boolean\n        required: false\n        default: false\n      run-build:\n        description: Run `pnpm build` before releasing\n        type: boolean\n        required: false\n        default: true\n      deploy-on-release:\n        description: >\n          When true, runs a separate `deploy` job after a successful release\n          (holocron#930): `holocron deploy-on-release` deploys every workspace\n          package whose `delivery.deploy` task is `with: { on: release }`, when\n          the release is on its channel and changes its paths. The job is its\n          own check, re-runnable on its own, and gets VERCEL_TOKEN; the release\n          job never sees it. Off by default, so a repo that doesn't deploy from\n          its release never exposes the token.\n        type: boolean\n        required: false\n        default: false\n      sentry-project:\n        description: >\n          Sentry project slug for sourcemap upload and release creation after\n          publishing. Omit to skip the Sentry release step entirely.\n        type: string\n        required: false\n        default: \"\"\n    secrets:\n      HOLOCRON_RELEASE_TOKEN:\n        description: >\n          Fine-grained PAT (Contents + Issues + Pull requests: write) owned by\n          an admin. Required when the default branch is protected by a ruleset —\n          github.token cannot push through rulesets, but an admin PAT can.\n          Takes priority over HOLOCRON_SYNC_TOKEN. Falls back to github.token.\n        required: false\n      HOLOCRON_SYNC_TOKEN:\n        description: >\n          Legacy alias for HOLOCRON_RELEASE_TOKEN — kept for backward compatibility.\n          Prefer HOLOCRON_RELEASE_TOKEN for new repos.\n        required: false\n      HOLOCRON_READ_TOKEN:\n        description: >\n          Fine-grained PAT for read-only GitHub API calls (e.g. resolving git\n          committer identity via `gh api user`). Falls back to github.token.\n        required: false\n      GH_TOKEN:\n        description: >\n          Generic GitHub token fallback for `gh` CLI calls. Used when\n          HOLOCRON_READ_TOKEN is not set.\n        required: false\n      SENTRY_AUTH_TOKEN:\n        description: >\n          Sentry auth token for sourcemap upload and release creation.\n          Required when sentry-project is set. Use the org-level secret.\n        required: false\n      TURBO_TOKEN:\n        required: false\n      VERCEL_TOKEN:\n        description: >\n          Vercel token for the deploy job. Only used when deploy-on-release is\n          true, and only by that job.\n        required: false\n\njobs:\n  release:\n    name: Semantic release\n    permissions:\n      contents: write\n      id-token: write\n      issues: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    outputs:\n      # Read by the deploy job (holocron#930). Empty unless semantic-release\n      # published: `commit` is the release commit, `previous` the commit of\n      # the release before it (to diff against), `channel` the new version's\n      # prerelease identifier (`alpha`), empty for a stable release (`main`).\n      commit: ${{ steps.release.outputs.commit }}\n      previous: ${{ steps.release.outputs.previous }}\n      channel: ${{ steps.release.outputs.channel }}\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    # Do not cancel in-progress releases — a partial release is worse than a slow one.\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n          persist-credentials: false\n          # Use HOLOCRON_RELEASE_TOKEN when available — git push (tags, release commits)\n          # uses the checkout credential, not GITHUB_TOKEN env var. The\n          # built-in github.token cannot push through branch protection rulesets.\n          token: ${{ secrets.HOLOCRON_RELEASE_TOKEN || secrets.HOLOCRON_SYNC_TOKEN || github.token }}\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - name: Configure git identity\n        run: |\n          GIT_NAME=$(gh api user --jq .name 2>/dev/null || echo \"github-actions[bot]\")\n          GIT_EMAIL=$(gh api user --jq '\"\\(.id)+\\(.login)@users.noreply.github.com\"' 2>/dev/null || echo \"41898282+github-actions[bot]@users.noreply.github.com\")\n          git config --global user.name \"$GIT_NAME\"\n          git config --global user.email \"$GIT_EMAIL\"\n          git config --global format.signoff true\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_READ_TOKEN || secrets.GH_TOKEN || github.token }}\n\n      - name: Upgrade npm for OIDC support\n        run: npm install -g npm@11 sigstore\n        # sigstore is required by libnpmpublish/provenance.js at module parse\n        # time — before any config takes effect. Some npm 11.x builds stopped\n        # bundling it; installing it globally into the same prefix ensures it\n        # resolves regardless of npm version. (Discovered 2026-07-09.)\n\n      - run: pnpm build\n        name: Build\n        if: ${{ inputs.run-build == true }}\n\n      - name: Release\n        id: release\n        run: |\n          BEFORE=$(git rev-parse HEAD)\n          PREVIOUS_TAG=$(git describe --tags --abbrev=0 2>/dev/null || true)\n          PREVIOUS=\"\"\n          if [ -n \"$PREVIOUS_TAG\" ]; then PREVIOUS=$(git rev-list -n 1 \"$PREVIOUS_TAG\"); fi\n          if [ \"$DRY_RUN\" = \"true\" ]; then\n            npx semantic-release --dry-run\n          else\n            npx semantic-release\n          fi\n          AFTER=$(git rev-parse HEAD)\n          # semantic-release only commits (`chore(release): … [skip ci]`) when it\n          # actually publishes. That commit gets no CI (and so no coverage\n          # upload), which makes the next PR's `codecov/project` compare a full\n          # report against a stale ancestor — a phantom drop (holocron#644).\n          # Emit the new SHA so the steps below upload coverage for it.\n          if [ \"$BEFORE\" != \"$AFTER\" ]; then\n            echo \"commit=$AFTER\" >> \"$GITHUB_OUTPUT\"\n            echo \"previous=$PREVIOUS\" >> \"$GITHUB_OUTPUT\"\n            # The new version's channel: the prerelease identifier of its tag\n            # (v5.0.0-alpha.108 -> alpha), empty for a stable release.\n            VERSION=$(git describe --tags --abbrev=0)\n            VERSION=${VERSION#v}\n            CHANNEL=\"\"\n            case \"$VERSION\" in *-*) PRE=${VERSION#*-}; CHANNEL=${PRE%%.*} ;; esac\n            echo \"channel=$CHANNEL\" >> \"$GITHUB_OUTPUT\"\n          fi\n        env:\n          DRY_RUN: ${{ inputs.dry-run }}\n          # Prefer HOLOCRON_RELEASE_TOKEN (fine-grained PAT, Contents+Issues+PRs write,\n          # owned by an admin with ruleset bypass) so @semantic-release/git can\n          # push the version-bump commit through branch protection. Falls back to\n          # HOLOCRON_SYNC_TOKEN (legacy) then github.token for unprotected repos.\n          GITHUB_TOKEN: ${{ secrets.HOLOCRON_RELEASE_TOKEN || secrets.HOLOCRON_SYNC_TOKEN || github.token }}\n          HUSKY: \"0\"\n          NPM_CONFIG_PROVENANCE: true\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Coverage for the release commit\n        if: ${{ steps.release.outputs.commit != '' }}\n        with:\n          task: verification.unitTests\n\n      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0\n        name: Upload release-commit coverage to Codecov\n        if: ${{ steps.release.outputs.commit != '' }}\n        # fail_ci_if_error makes a failed upload fail this step, so it is visible, but\n        # continue-on-error keeps it from failing the job: the release has already\n        # published, and the Sentry release steps below must still run (holocron#934).\n        continue-on-error: true\n        with:\n          use_oidc: true\n          fail_ci_if_error: true\n          override_commit: ${{ steps.release.outputs.commit }}\n          override_branch: ${{ github.ref_name }}\n\n      - name: Get release version\n        id: release_version\n        if: ${{ inputs.sentry-project != '' && inputs.dry-run != true }}\n        env:\n          SENTRY_PROJECT: ${{ inputs.sentry-project }}\n        run: |\n          TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo \"\")\n          if [ -n \"$TAG\" ]; then\n            echo \"release=${SENTRY_PROJECT}@${TAG#v}\" >> \"$GITHUB_OUTPUT\"\n          fi\n\n      - name: Create Sentry release\n        if: ${{ inputs.sentry-project != '' && steps.release_version.outputs.release != '' && inputs.dry-run != true }}\n        uses: getsentry/action-release@ff07929a6537bac57790c3451cf4d364aca38528 # v3\n        env:\n          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}\n          SENTRY_ORG: theholocron\n          SENTRY_PROJECT: ${{ inputs.sentry-project }}\n        with:\n          environment: production\n          version: ${{ steps.release_version.outputs.release }}\n          sourcemaps: \"**/dist\"\n\n  deploy:\n    name: Deploy\n    needs: release\n    # Only after a release that actually published (`commit` is empty on a dry\n    # run or when nothing was released). A failed deploy fails only this job:\n    # the release is already on npm, and this job re-runs on its own.\n    if: ${{ inputs.deploy-on-release == true && inputs.dry-run != true && needs.release.outputs.commit != '' }}\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout the release commit\n        with:\n          ref: ${{ needs.release.outputs.commit }}\n          fetch-depth: 0\n          persist-credentials: false\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Deploy packages that deploy on release\n        env:\n          VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}\n        with:\n          command: deploy-on-release\n          args: >-\n            --channel=${{ needs.release.outputs.channel }}\n            --from=${{ needs.release.outputs.previous }}\n            --to=${{ needs.release.outputs.commit }}\n\n  sync-readme:\n    name: Post-release readme sync\n    needs: release\n    if: ${{ inputs.post-release == true && inputs.dry-run != true }}\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    steps:\n      - name: Trigger broadcast readme sync\n        run: |\n          gh workflow run sync-dispatch.yml \\\n            --repo theholocron/.github \\\n            --field \"steps=readme\"\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN }}\n",
-	"delivery.deploy": "name: Deploy\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      type:\n        description: \"Type of deployment: docs or storybook\"\n        required: true\n        type: string\n      storybook-projects:\n        description: >\n          JSON array of { \"name\"?, \"workingDir\", \"outputDir\"? } objects for storybook deploys.\n          Each is built via `pnpm -C <workingDir> build:storybook`. If \"name\" is provided the\n          output is placed under `sandbox/<name>/`; omit \"name\" for single-repo deploys and the\n          output lands directly in `sandbox/`.\n        type: string\n        required: false\n        default: \"[]\"\n      build-script:\n        description: pnpm script that builds the Storybook static output (single storybook, type:storybook only)\n        type: string\n        required: false\n        default: build:storybook\n      output-dir:\n        description: Directory where Storybook writes its static output (single storybook, type:storybook only)\n        type: string\n        required: false\n        default: storybook-static\n\njobs:\n  deploy:\n    name: Deploy\n    runs-on: ubuntu-latest\n    permissions:\n      contents: read\n      pages: write\n      id-token: write\n    environment:\n      name: github-pages\n      url: ${{ steps.deployment.outputs.page_url }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - name: Build docs site\n        if: ${{ inputs.type == 'docs' }}\n        run: pnpm -C docs build\n\n      - name: Build Storybook projects\n        if: ${{ inputs.storybook-projects != '[]' }}\n        env:\n          PROJECTS: ${{ inputs.storybook-projects }}\n        run: |\n          echo \"$PROJECTS\" | jq -c '.[]' | while IFS= read -r project; do\n            workingDir=$(echo \"$project\" | jq -r '.workingDir')\n            pnpm -C \"$workingDir\" build:storybook\n          done\n\n      - name: Build Storybook\n        if: ${{ inputs.type == 'storybook' && inputs.storybook-projects == '[]' }}\n        env:\n          BUILD_SCRIPT: ${{ inputs.build-script }}\n        run: pnpm run \"$BUILD_SCRIPT\"\n\n      - name: Assemble site\n        env:\n          DEPLOY_TYPE: ${{ inputs.type }}\n          PROJECTS: ${{ inputs.storybook-projects }}\n          STORYBOOK_OUTPUT_DIR: ${{ inputs.output-dir }}\n        run: |\n          mkdir -p _site\n          if [ \"$DEPLOY_TYPE\" = \"docs\" ]; then\n            cp -r docs/dist/. _site/\n          fi\n          if [ \"$PROJECTS\" != \"[]\" ]; then\n            echo \"$PROJECTS\" | jq -c '.[]' | while IFS= read -r project; do\n              name=$(echo \"$project\" | jq -r '.name // \"\"')\n              workingDir=$(echo \"$project\" | jq -r '.workingDir')\n              outputDir=$(echo \"$project\" | jq -r '.outputDir // \"storybook-static\"')\n              if [ -n \"$name\" ]; then\n                target=\"_site/sandbox/${name}\"\n              else\n                target=\"_site/sandbox\"\n              fi\n              mkdir -p \"$target\"\n              cp -r \"${workingDir}/${outputDir}/.\" \"$target/\"\n            done\n          elif [ \"$DEPLOY_TYPE\" = \"storybook\" ]; then\n            mkdir -p _site/sandbox\n            cp -r \"${STORYBOOK_OUTPUT_DIR}/.\" _site/sandbox/\n          fi\n\n      - uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1\n        name: Upload pages artifact\n        with:\n          path: _site\n\n      - uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5\n        id: deployment\n        name: Deploy to GitHub Pages\n",
-	"delivery.bundleSize": "name: Audit the Bundle Size\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      CODECOV_TOKEN:\n        required: false\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  bundle-size:\n    name: Upload bundle stats to Codecov\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n      # Read by the bundle-stats uploader inside `holocron run delivery.build`.\n      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Build and upload bundle stats\n        with:\n          task: delivery.build\n",
-	"platform.repoSync": "name: Sync\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      steps:\n        description: >\n          Sync steps to run (default: all). Valid values:\n          labels, properties, teams, topics, keywords, description, homepage, readme, workflows, wiki.\n          Pass a space-separated list to run a subset, e.g. \"readme\" or \"readme wiki\".\n        type: string\n        required: false\n    secrets:\n      HOLOCRON_ADMIN_TOKEN:\n        description: Fine-grained PAT with admin scopes (labels, properties, teams).\n        required: false\n      HOLOCRON_AXIOM_TOKEN:\n        description: >\n          Axiom API token. When set alongside the HOLOCRON_AXIOM_DATASET\n          repo/org variable, the CLI ships this run's structured logs to Axiom.\n          Falls back to the vendor-native AXIOM_TOKEN secret.\n        required: false\n      AXIOM_TOKEN:\n        description: Vendor-native fallback for HOLOCRON_AXIOM_TOKEN.\n        required: false\n      HOLOCRON_DEPLOY_TOKEN:\n        description: Fine-grained PAT for GitHub Pages configuration.\n        required: false\n      HOLOCRON_ISSUES_TOKEN:\n        description: Fine-grained PAT for issue management.\n        required: false\n      HOLOCRON_ORG_TOKEN:\n        description: Org-scoped fine-grained PAT for team sync and org properties.\n        required: false\n      HOLOCRON_READ_TOKEN:\n        description: Fine-grained PAT for read-only GitHub API calls.\n        required: false\n      HOLOCRON_SYNC_TOKEN:\n        required: false\n      GH_TOKEN:\n        description: >\n          Generic GitHub token fallback for gh CLI calls. Used when\n          HOLOCRON_SYNC_TOKEN is not set.\n        required: false\n\njobs:\n  sync:\n    name: Run holocron sync\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    permissions:\n      contents: write\n      pull-requests: write\n    # Job-level so the `holocron` composite action's steps inherit them.\n    env:\n      HOLOCRON_ADMIN_TOKEN: ${{ secrets.HOLOCRON_ADMIN_TOKEN }}\n      HOLOCRON_AXIOM_TOKEN: ${{ secrets.HOLOCRON_AXIOM_TOKEN || secrets.AXIOM_TOKEN }}\n      HOLOCRON_AXIOM_DATASET: ${{ vars.HOLOCRON_AXIOM_DATASET || vars.AXIOM_DATASET }}\n      POSTHOG_PROJECT_TOKEN: ${{ vars.POSTHOG_PROJECT_TOKEN }}\n      HOLOCRON_DEPLOY_TOKEN: ${{ secrets.HOLOCRON_DEPLOY_TOKEN }}\n      HOLOCRON_ISSUES_TOKEN: ${{ secrets.HOLOCRON_ISSUES_TOKEN }}\n      HOLOCRON_ORG_TOKEN: ${{ secrets.HOLOCRON_ORG_TOKEN }}\n      HOLOCRON_READ_TOKEN: ${{ secrets.HOLOCRON_READ_TOKEN }}\n      HOLOCRON_SYNC_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          token: ${{ secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN || github.token }}\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - name: Run holocron sync\n        # The `holocron` action resolves @theholocron/cli from node_modules (or\n        # builds the workspace when it's an unbuilt checkout — the holocron repo\n        # itself). `inputs.steps` is a space-separated list or empty; the\n        # `--steps <list>` arg is omitted when empty.\n        uses: theholocron/.github/.github/actions/holocron@main\n        with:\n          command: sync\n          args: ${{ inputs.steps != '' && format('--steps {0}', inputs.steps) || '' }}\n\n      - name: Format generated files\n        run: |\n          pnpm exec prettier --write README.md docs/src/content/docs/index.mdx 2>/dev/null || true\n          # `holocron sync` writes package.json fields (keywords, description,\n          # homepage) with a plain assignment, which appends new keys at the\n          # end — re-apply the canonical order the lint config enforces.\n          pnpm exec eslint --fix --no-warn-ignored package.json 2>/dev/null || true\n\n      - uses: theholocron/.github/.github/actions/auto-commit@main\n        id: auto-commit\n        name: Commit sync changes\n        with:\n          token: ${{ secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN || github.token }}\n          branch: chore/auto-sync\n          commit-message: \"chore: sync from holocron.config\"\n          commit-options: \"--no-verify\"\n\n      - name: Open PR if changes were committed\n        if: steps.auto-commit.outputs.changes-detected == 'true'\n        run: |\n          gh pr create \\\n            --title \"chore: sync README and repo metadata\" \\\n            --body \"Automated sync triggered by changes to config or package files. Merge to apply.\" \\\n            --base main \\\n            --head chore/auto-sync \\\n          || echo \"PR already open — branch updated.\"\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN || github.token }}\n\n      - name: Broadcast wiki sync if navbar changed\n        if: >-\n          steps.auto-commit.outputs.changes-detected == 'true' &&\n          github.event_name == 'push' &&\n          (inputs.steps == '' || contains(inputs.steps, 'wiki'))\n        run: |\n          if git diff HEAD~1 --name-only | grep -q 'fern/docs.yml'; then\n            gh workflow run sync-dispatch.yml \\\n              --repo theholocron/.github \\\n              --field \"steps=wiki\" \\\n            || echo \"skipping broadcast — insufficient permissions\"\n          fi\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN || github.token }}\n",
-	"platform.commitStandards": "name: Commit Standards\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  commit-standards:\n    name: Run commitlint\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      # No local equivalent (linters.ts: commitlint has no localBin — enforced\n      # only at commit time via the commit-msg hook, and here in CI over the\n      # PR's commit range). Not run through the holocron composite action.\n      #\n      # --config <resolved shared path> (config-resolution workstream, #676)\n      # — falls back to commitlint's own auto-discovery of a local\n      # commitlint.config.ts when the shared package's built dist/ isn't\n      # present, same guard as the commit-msg hook.\n      - name: Run commitlint over the PR range\n        if: github.event_name == 'pull_request'\n        run: |\n          COMMITLINT_CONFIG=\"node_modules/@theholocron/commitlint-config/dist/index.js\"\n          if [ -f \"$COMMITLINT_CONFIG\" ]; then\n            pnpm exec commitlint --config \"$COMMITLINT_CONFIG\" --from \"${{ github.event.pull_request.base.sha }}\" --to \"${{ github.sha }}\"\n          else\n            pnpm exec commitlint --from \"${{ github.event.pull_request.base.sha }}\" --to \"${{ github.sha }}\"\n          fi\n",
-	"platform.repoValidation": "name: Repo Validation\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  adrs:\n    name: Validate ADRs and specs\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Validate ADR and spec frontmatter\n        with:\n          task: platform.repoValidation\n          job: adrs\n\n  registry:\n    name: Validate registry consistency\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Validate registry consistency\n        with:\n          task: platform.repoValidation\n          job: registry\n\n  docs-presence:\n    name: Validate docs presence\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Validate docs presence for new packages\n        with:\n          task: platform.repoValidation\n          job: docsPresence\n        env:\n          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}\n\n  conclusion:\n    name: Conclusion\n    runs-on: ubuntu-latest\n    if: always()\n    needs: [adrs, registry, docs-presence]\n    steps:\n      - name: Check job statuses\n        run: |\n          if [[ \"$RESULTS\" == *\"failure\"* ]] || [[ \"$RESULTS\" == *\"cancelled\"* ]]; then\n            exit 1\n          fi\n        env:\n          RESULTS: ${{ join(needs.*.result, ',') }}\n",
-	"platform.dispatchedCheck": "name: Dispatched Check\n\non: # yamllint disable-line rule:truthy\n  workflow_dispatch:\n    inputs:\n      repo:\n        description: Target repo, \"owner/name\", to check out and run the task against.\n        type: string\n        required: true\n      ref:\n        description: Git ref (branch or commit SHA) to check out.\n        type: string\n        required: true\n      task:\n        description: The holocron task name to run (e.g. \"verification.typeSafety\").\n        type: string\n        required: true\n      check-run-id:\n        description: >\n          ID of the check run already posted as \"queued\" on the target repo —\n          patched to \"completed\" once the task finishes.\n        type: string\n        required: true\n\npermissions:\n  contents: read\n\njobs:\n  run-task:\n    name: Run a Sentinel-dispatched task against another repo\n    runs-on: ubuntu-latest\n    timeout-minutes: 20\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      # actions/create-github-app-token defaults to scoping its token to the\n      # *current* repo (.github, where this workflow runs) when owner/\n      # repositories are omitted — useless here, since every real use of this\n      # token targets inputs.repo instead. Split \"owner/name\" up front so the\n      # token step below can scope explicitly to the actual target.\n      - name: Parse target repo\n        id: target\n        run: |\n          echo \"owner=${INPUT_REPO%%/*}\" >> \"$GITHUB_OUTPUT\"\n          echo \"name=${INPUT_REPO##*/}\" >> \"$GITHUB_OUTPUT\"\n        env:\n          INPUT_REPO: ${{ inputs.repo }}\n\n      # Sentinel's own dispatch call only carries plain, non-secret inputs\n      # (repo/ref/task/check-run-id — all visible in the Actions UI/logs).\n      # This step mints a fresh, short-lived installation token here instead,\n      # scoped by the same App's stored credentials — never a raw token\n      # passed through a dispatch input.\n      - name: Generate installation token\n        id: app-token\n        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0\n        with:\n          app-id: ${{ secrets.SENTINEL_APP_ID }}\n          private-key: ${{ secrets.SENTINEL_APP_PRIVATE_KEY }}\n          owner: ${{ steps.target.outputs.owner }}\n          repositories: ${{ steps.target.outputs.name }}\n\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout target repository\n        with:\n          repository: ${{ inputs.repo }}\n          ref: ${{ inputs.ref }}\n          token: ${{ steps.app-token.outputs.token }}\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - name: Run the task\n        id: run-task\n        continue-on-error: true\n        uses: theholocron/.github/.github/actions/holocron@main\n        with:\n          task: ${{ inputs.task }}\n\n      # A bare .../actions/runs/<id> link lands on the run summary, one click\n      # short of the actual step-by-step log a normal check's details_url\n      # points at. This job is always alone in its run, so the first (only)\n      # job in the run's own job list is unambiguously this one.\n      - name: Resolve this job's numeric ID\n        id: job-info\n        if: always()\n        run: |\n          job_id=$(gh api \"repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/jobs\" --jq '.jobs[0].id')\n          echo \"job_id=$job_id\" >> \"$GITHUB_OUTPUT\"\n        env:\n          GH_TOKEN: ${{ steps.app-token.outputs.token }}\n\n      # Ships the task's real captured output (tsc/vitest/etc — whatever\n      # `holocron run` actually printed) to the same Axiom dataset Sentinel's\n      # own structured logs already flow into, tagged so it's queryable by\n      # this exact run. Reuses the existing dataset rather than provisioning\n      # a new one — a prototype-stage call, revisit if CI-log volume ever\n      # warrants a dedicated dataset. Builds a permalink filtered to this\n      # run's own logs (Axiom's own \"copy query link\" URL shape:\n      # /<org>/query?initForm={\"apl\":\"...\"} ) so a viewer lands directly on\n      # the relevant lines, not a bare dataset view.\n      - name: Ship task output to Axiom\n        id: axiom\n        if: always()\n        run: |\n          message=$(tail -c 40000 \"$LOG_FILE\" 2>/dev/null || echo \"(no output captured)\")\n          # \"level\" is one of the field names Axiom's Stream/Query tabs\n          # recognize for severity-color highlighting (docs: level, @level,\n          # severity, @severity, status.code) -- conclusion alone isn't.\n          level=$([ \"$CONCLUSION\" = \"success\" ] && echo \"info\" || echo \"error\")\n          event=$(jq -cn \\\n            --arg time \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\" \\\n            --arg repo \"$REPO\" --arg task \"$TASK\" --arg run_id \"$GITHUB_RUN_ID\" \\\n            --arg job_id \"$JOB_ID\" --arg check_run_id \"$CHECK_RUN_ID\" \\\n            --arg conclusion \"$CONCLUSION\" --arg level \"$level\" --arg message \"$message\" \\\n            '{_time: $time, source: \"dispatched-check\", repo: $repo, task: $task,\n              run_id: $run_id, job_id: $job_id, check_run_id: $check_run_id,\n              conclusion: $conclusion, level: $level, message: $message}')\n          curl -sf -X POST \"https://api.axiom.co/v1/datasets/${AXIOM_DATASET}/ingest\" \\\n            -H \"Authorization: Bearer ${AXIOM_TOKEN}\" \\\n            -H \"Content-Type: application/json\" \\\n            -d \"[${event}]\" || echo \"::warning::Axiom ingest failed — continuing, the check itself still reports the real result\"\n\n          # The ['...'] is Axiom's own APL array-dataset-reference syntax, not\n          # a shell quote boundary — $AXIOM_DATASET/$CHECK_RUN_ID both expand\n          # fine here; shellcheck's single-quote heuristic just can't tell.\n          # shellcheck disable=SC2016\n          apl=\"['${AXIOM_DATASET}'] | where check_run_id == \\\"${CHECK_RUN_ID}\\\"\"\n          init_form=$(jq -cn --arg apl \"$apl\" '{apl: $apl}')\n          encoded=$(jq -rn --arg s \"$init_form\" '$s | @uri')\n          echo \"query-url=https://app.axiom.co/${AXIOM_ORG}/query?initForm=${encoded}\" >> \"$GITHUB_OUTPUT\"\n        env:\n          LOG_FILE: ${{ steps.run-task.outputs.log-file }}\n          REPO: ${{ inputs.repo }}\n          TASK: ${{ inputs.task }}\n          JOB_ID: ${{ steps.job-info.outputs.job_id }}\n          CHECK_RUN_ID: ${{ inputs.check-run-id }}\n          CONCLUSION: ${{ steps.run-task.outcome == 'success' && 'success' || 'failure' }}\n          AXIOM_ORG: the-holocron-7bbe\n          AXIOM_DATASET: holocron-sentinel\n          AXIOM_TOKEN: ${{ secrets.SENTINEL_AXIOM_INGEST_TOKEN }}\n\n      # Always runs, success or failure — the queued check run on the target\n      # repo must be resolved either way, not left hanging. Full JSON body via\n      # jq + --input, not -f flags: output.text needs real nesting (gh api -f\n      # has no dot-notation for that), and the captured task output can\n      # contain characters (quotes, $, backticks) that would break a\n      # hand-built -f string.\n      - name: Report result to the target repo's check run\n        if: always()\n        run: |\n          excerpt=$(tail -c 3000 \"$LOG_FILE\" 2>/dev/null || echo \"(no output captured)\")\n          # The single-quoted format string is intentional — every %s fills\n          # via printf's own args below, not shell expansion; nothing in it\n          # needs to expand.\n          # shellcheck disable=SC2016\n          text=$(printf '**Task:** `%s`\\n\\n**Result:** %s\\n\\n[Full logs on Axiom](%s)\\n\\n### Last output\\n\\n```\\n%s\\n```\\n' \\\n            \"$TASK\" \"$CONCLUSION\" \"$QUERY_URL\" \"$excerpt\")\n          body=$(jq -n \\\n            --arg conclusion \"$CONCLUSION\" \\\n            --arg details_url \"$RUN_URL\" \\\n            --arg title \"$TASK ($CONCLUSION)\" \\\n            --arg summary \"Dispatched via theholocron/.github — see the log excerpt below, or the full run/Axiom links.\" \\\n            --arg text \"$text\" \\\n            '{status: \"completed\", conclusion: $conclusion, details_url: $details_url,\n              output: {title: $title, summary: $summary, text: $text}}')\n          echo \"$body\" | gh api --method PATCH \"/repos/${REPO}/check-runs/${CHECK_RUN_ID}\" --input -\n        env:\n          # `GH_TOKEN` is the literal name `gh api` requires to auto-authenticate\n          # -- not a stand-in for a shared/blanket credential. Its value is the\n          # short-lived, Sentinel-App-scoped token minted above, same as the\n          # checkout step uses; never secrets.HOLOCRON_SYNC_TOKEN (the one\n          # genuinely shared PAT in this org, used by sync-dispatch.yml).\n          GH_TOKEN: ${{ steps.app-token.outputs.token }}\n          REPO: ${{ inputs.repo }}\n          TASK: ${{ inputs.task }}\n          CHECK_RUN_ID: ${{ inputs.check-run-id }}\n          CONCLUSION: ${{ steps.run-task.outcome == 'success' && 'success' || 'failure' }}\n          LOG_FILE: ${{ steps.run-task.outputs.log-file }}\n          QUERY_URL: ${{ steps.axiom.outputs.query-url }}\n          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}/job/${{ steps.job-info.outputs.job_id }}\n",
-	"knowledge.wiki": "name: Wiki\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      fern-version:\n        description: >\n          Fern CLI version to install. Pin this to avoid breaking changes when\n          Fern updates their config schema.\n        type: string\n        required: false\n        default: \"5.114.1\"\n      preview:\n        description: >\n          When true, publishes a preview instead of production.\n          Requires preview-id to be set.\n        type: boolean\n        required: false\n        default: false\n      preview-id:\n        description: >\n          Stable ID for the preview build. Use the PR number (e.g. \"pr-123\")\n          so the same preview URL is reused on every push to the branch.\n        type: string\n        required: false\n        default: \"\"\n      fern-org:\n        description: >\n          DEPRECATED — the preview URL is now read from Fern's own output.\n          Kept as a fallback for building the URL when that parse fails, and so\n          existing callers do not error.\n        type: string\n        required: false\n        default: \"\"\n      base-path:\n        description: >\n          DEPRECATED — see fern-org. Basepath appended to the fallback preview\n          URL (e.g. \"holocron\" for multi-source routing).\n        type: string\n        required: false\n        default: \"\"\n    secrets:\n      HOLOCRON_FERN_TOKEN:\n        required: false\n      FERN_TOKEN:\n        required: false\n\njobs:\n  publish:\n    name: Publish to Fern\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    permissions:\n      contents: read\n      deployments: write\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - name: Install Fern CLI\n        run: npm install -g \"fern-api@$FERN_VERSION\"\n        env:\n          FERN_VERSION: ${{ inputs.fern-version }}\n\n      - name: Publish docs\n        if: ${{ !inputs.preview }}\n        run: fern generate --docs\n        env:\n          FERN_TOKEN: ${{ secrets.HOLOCRON_FERN_TOKEN || secrets.FERN_TOKEN }}\n\n      - name: Preview docs\n        id: preview\n        if: ${{ inputs.preview && inputs.preview-id != '' }}\n        env:\n          FERN_TOKEN: ${{ secrets.HOLOCRON_FERN_TOKEN || secrets.FERN_TOKEN }}\n          PREVIEW_ID: ${{ inputs.preview-id }}\n        run: |\n          out=$(fern generate --docs --preview --id \"$PREVIEW_ID\" 2>&1) || { printf '%s\\n' \"$out\"; exit 1; }\n          printf '%s\\n' \"$out\"\n          # Fern prints \"Published docs to https://<org>-preview-<id>.docs.buildwithfern.com/<path>\"\n          url=$(printf '%s\\n' \"$out\" | grep -oiE 'https://[a-z0-9.-]+\\.docs\\.buildwithfern\\.com[^ )]*' | head -n1)\n          echo \"url=$url\" >> \"$GITHUB_OUTPUT\"\n\n      - name: Report preview URL\n        if: ${{ inputs.preview && inputs.preview-id != '' }}\n        env:\n          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n          CAPTURED_URL: ${{ steps.preview.outputs.url }}\n          FERN_ORG: ${{ inputs.fern-org }}\n          PREVIEW_ID: ${{ inputs.preview-id }}\n          BASE_PATH: ${{ inputs.base-path }}\n        run: |\n          PREVIEW_URL=\"$CAPTURED_URL\"\n          if [ -z \"$PREVIEW_URL\" ] && [ -n \"$FERN_ORG\" ]; then\n            PREVIEW_URL=\"https://${FERN_ORG}-preview-${PREVIEW_ID}.docs.buildwithfern.com${BASE_PATH:+/${BASE_PATH}}\"\n          fi\n          if [ -z \"$PREVIEW_URL\" ]; then\n            echo \"::warning::no preview URL parsed from Fern output and no fern-org fallback — skipping the deployment widget\"\n            exit 0\n          fi\n          PAYLOAD=$(printf '{\"ref\":\"%s\",\"environment\":\"wiki (Preview)\",\"description\":\"Wiki\",\"production_environment\":false,\"auto_merge\":false,\"required_contexts\":[]}' \\\n            \"$GITHUB_HEAD_REF\")\n          DEPLOY_ID=$(printf '%s\\n' \"$PAYLOAD\" | gh api \"repos/${GITHUB_REPOSITORY}/deployments\" \\\n            --method POST --input - | jq -r '.id')\n          gh api \"repos/${GITHUB_REPOSITORY}/deployments/${DEPLOY_ID}/statuses\" \\\n            --method POST --field state=success --field environment_url=\"$PREVIEW_URL\"\n",
-	bookkeeping: "name: Bookkeeping\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      configuration-path:\n        description: Path to the labeler configuration file in the calling repo\n        type: string\n        required: false\n        default: .github/labeler.yml\n\njobs:\n  label:\n    name: Apply Labels\n    permissions:\n      contents: read\n      issues: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          sparse-checkout: ${{ inputs.configuration-path || '.github/labeler.yml' }}\n          sparse-checkout-cone-mode: false\n\n      - uses: github/issue-labeler@c1b0f9f52a63158c4adc09425e858e87b32e9685 # v3.4\n        if: ${{ github.event_name == 'pull_request' && hashFiles(inputs.configuration-path || '.github/labeler.yml') != '' }}\n        # v3.4 bundles Node 20; allow it to run under Actions' current default.\n        env:\n          ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true\n        with:\n          # Fall back to default path when triggered directly (not via workflow_call)\n          # because inputs.* defaults only apply on workflow_call events.\n          configuration-path: ${{ inputs.configuration-path || '.github/labeler.yml' }}\n          include-title: 1\n          include-body: 0\n          sync-labels: 1\n          enable-versioned-regex: 0\n          repo-token: ${{ github.token }}\n",
-	dependencies: "name: Dependencies\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      merge-token:\n        description: >\n          Optional privileged token for auto-merge. Falls back to GITHUB_TOKEN.\n          Required when branch protection enforces required reviews — GITHUB_TOKEN\n          cannot approve its own PRs.\n        required: false\n\njobs:\n  dependabot:\n    name: Update the dependencies\n    permissions:\n      contents: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    if: github.event.pull_request.user.login == 'dependabot[bot]'\n    steps:\n      - uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0\n        name: Fetch Dependabot metadata\n        id: metadata\n\n      - run: gh pr merge --auto --squash \"$PR_URL\"\n        # --squash is intentional: repo protection sets allow_merge_commit: false,\n        # so --merge would fail on any repo using the standard preset.\n        name: Enable auto-merge for Dependabot PRs\n        if: steps.metadata.outputs.update-type == 'version-update:semver-patch'\n        env:\n          PR_URL: ${{ github.event.pull_request.html_url }}\n          GH_TOKEN: ${{ secrets.merge-token || github.token }}\n",
-	preview: "name: Preview\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      type:\n        description: \"Type of deployment: docs or storybook\"\n        required: true\n        type: string\n      name:\n        description: Repo name prefix used to filter the docs site package (<name>-site); omit to run pnpm -C docs build\n        required: false\n        type: string\n        default: \"\"\n      storybook-projects:\n        description: >\n          JSON array of { \"name\"?, \"workingDir\", \"outputDir\"? } objects for storybook deploys.\n          Each is built via `pnpm -C <workingDir> build:storybook`. If \"name\" is provided the\n          output is placed under `sandbox/<name>/`; omit \"name\" for single-repo deploys and the\n          output lands directly in `sandbox/`.\n        type: string\n        required: false\n        default: \"[]\"\n      build-script:\n        description: pnpm script that builds the Storybook static output (single storybook, type:storybook only)\n        type: string\n        required: false\n        default: build:storybook\n      output-dir:\n        description: Directory where Storybook writes its static output (single storybook, type:storybook only)\n        type: string\n        required: false\n        default: storybook-static\n      cloudflare-project:\n        description: >\n          Cloudflare Pages project name. Falls back to the CLOUDFLARE_PAGES_PROJECT\n          org variable when omitted — set that variable once and all repos get previews\n          without per-repo config.\n        required: false\n        type: string\n        default: \"\"\n\njobs:\n  deploy-preview:\n    name: Preview\n    if: ${{ github.event.action != 'closed' }}\n    runs-on: ubuntu-latest\n    permissions:\n      contents: read\n      deployments: write\n      pull-requests: write\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - name: Build workspace dependencies\n        # The docs site imports workspace packages (e.g. a shared theme) via\n        # `workspace:*` — its exports map points at dist/, which doesn't\n        # exist until something builds it. Nothing else in this job does,\n        # so without this step Vite fails to resolve the import entirely.\n        if: ${{ inputs.type == 'docs' }}\n        run: pnpm run build\n\n      - name: Build docs site\n        if: ${{ inputs.type == 'docs' && inputs.name != '' }}\n        env:\n          SITE_NAME: ${{ inputs.name }}\n        run: pnpm --filter @theholocron/\"$SITE_NAME\"-site build\n\n      - name: Build docs site\n        if: ${{ inputs.type == 'docs' && inputs.name == '' }}\n        run: pnpm -C docs build\n\n      - name: Build Storybook projects\n        if: ${{ inputs.storybook-projects != '[]' }}\n        env:\n          PROJECTS: ${{ inputs.storybook-projects }}\n        run: |\n          echo \"$PROJECTS\" | jq -c '.[]' | while IFS= read -r project; do\n            workingDir=$(echo \"$project\" | jq -r '.workingDir')\n            pnpm -C \"$workingDir\" build:storybook\n          done\n\n      - name: Build Storybook\n        if: ${{ inputs.type == 'storybook' && inputs.storybook-projects == '[]' }}\n        env:\n          BUILD_SCRIPT: ${{ inputs.build-script }}\n        run: pnpm run \"$BUILD_SCRIPT\"\n\n      - name: Assemble site\n        env:\n          DEPLOY_TYPE: ${{ inputs.type }}\n          SITE_NAME: ${{ inputs.name }}\n          PROJECTS: ${{ inputs.storybook-projects }}\n          STORYBOOK_OUTPUT_DIR: ${{ inputs.output-dir }}\n        run: |\n          mkdir -p _site\n          if [ \"$DEPLOY_TYPE\" = \"docs\" ]; then\n            if [ -n \"$SITE_NAME\" ]; then\n              # Site built with base: /<name>/ — nest under _site/<name>/ so asset\n              # paths match (/name/_astro/... → served at /name/_astro/...).\n              mkdir -p \"_site/${SITE_NAME}\"\n              cp -r docs/dist/. \"_site/${SITE_NAME}/\"\n              # Redirect root to the base path so the preview URL lands correctly.\n              printf \"/ /%s/ 301\\n\" \"$SITE_NAME\" > _site/_redirects\n            else\n              cp -r docs/dist/. _site/\n            fi\n          fi\n          if [ \"$PROJECTS\" != \"[]\" ]; then\n            echo \"$PROJECTS\" | jq -c '.[]' | while IFS= read -r project; do\n              name=$(echo \"$project\" | jq -r '.name // \"\"')\n              workingDir=$(echo \"$project\" | jq -r '.workingDir')\n              outputDir=$(echo \"$project\" | jq -r '.outputDir // \"storybook-static\"')\n              if [ -n \"$name\" ]; then\n                target=\"_site/sandbox/${name}\"\n              else\n                target=\"_site/sandbox\"\n              fi\n              mkdir -p \"$target\"\n              cp -r \"${workingDir}/${outputDir}/.\" \"$target/\"\n            done\n          elif [ \"$DEPLOY_TYPE\" = \"storybook\" ]; then\n            mkdir -p _site/sandbox\n            cp -r \"${STORYBOOK_OUTPUT_DIR}/.\" _site/sandbox/\n          fi\n\n      - name: Install Wrangler\n        # The action's install step runs npm/pnpm in the repo root; pnpm fails\n        # because it rejects adding to a workspace root without -w, and npm fails\n        # because package.json contains pnpm catalog: references it cannot parse.\n        # Pre-installing from /tmp (no package.json) lets the action find wrangler\n        # already on PATH and skip its own install entirely.\n        working-directory: /tmp\n        run: npm install -g wrangler@4\n\n      - uses: cloudflare/wrangler-action@ebbaa1584979971c8614a24965b4405ff95890e0 # v4.0.0\n        id: deploy\n        name: Deploy to Cloudflare Pages\n        # Skip when neither the per-repo input nor the org variable is set.\n        if: ${{ inputs.cloudflare-project != '' || vars.CLOUDFLARE_PAGES_PROJECT != '' }}\n        with:\n          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}\n          accountId: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}\n          packageManager: npm\n          command: >-\n            pages deploy _site\n            --project-name ${{ inputs.cloudflare-project || vars.CLOUDFLARE_PAGES_PROJECT }}\n            --branch ${{ github.event.repository.name }}-pr-${{ github.event.pull_request.number }}\n            --commit-dirty=true\n\n      - name: Report preview URL\n        if: ${{ steps.deploy.outputs.pages-deployment-alias-url != '' }}\n        env:\n          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n          ALIAS: ${{ steps.deploy.outputs.pages-deployment-alias-url }}\n          SITE_NAME: ${{ inputs.name }}\n          PROJECT: ${{ inputs.cloudflare-project || vars.CLOUDFLARE_PAGES_PROJECT }}\n        run: |\n          PREVIEW_URL=\"${ALIAS%/}${SITE_NAME:+/${SITE_NAME}}/\"\n          # GITHUB_HEAD_REF is the PR branch name — links the deployment to this PR's sidebar widget.\n          PAYLOAD=$(printf '{\"ref\":\"%s\",\"environment\":\"%s\",\"description\":\"Cloudflare Pages\",\"production_environment\":false,\"auto_merge\":false,\"required_contexts\":[]}' \\\n            \"$GITHUB_HEAD_REF\" \"${PROJECT} (Preview)\")\n          DEPLOY_ID=$(echo \"$PAYLOAD\" | gh api \"repos/${GITHUB_REPOSITORY}/deployments\" \\\n            --method POST --input - | jq -r '.id')\n          gh api \"repos/${GITHUB_REPOSITORY}/deployments/${DEPLOY_ID}/statuses\" \\\n            --method POST --field state=success --field environment_url=\"${PREVIEW_URL}\"\n\n  cleanup:\n    name: Clean up Preview\n    if: ${{ github.event.action == 'closed' }}\n    runs-on: ubuntu-latest\n    permissions:\n      contents: read\n      deployments: write\n      pull-requests: write\n    steps:\n      - name: Delete Cloudflare Pages deployments for branch\n        if: ${{ inputs.cloudflare-project != '' || vars.CLOUDFLARE_PAGES_PROJECT != '' }}\n        env:\n          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}\n          CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}\n          PROJECT: ${{ inputs.cloudflare-project || vars.CLOUDFLARE_PAGES_PROJECT }}\n          BRANCH: ${{ github.event.repository.name }}-pr-${{ github.event.pull_request.number }}\n          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n        run: |\n          DEPLOYMENTS=$(curl -s \\\n            \"https://api.cloudflare.com/client/v4/accounts/${CLOUDFLARE_ACCOUNT_ID}/pages/projects/${PROJECT}/deployments\" \\\n            -H \"Authorization: Bearer ${CLOUDFLARE_API_TOKEN}\" \\\n            | jq -r --arg b \"$BRANCH\" \\\n              '.result[] | select(.deployment_trigger.metadata.branch == $b) | .id')\n\n          if [ -z \"$DEPLOYMENTS\" ]; then\n            echo \"No deployments found for branch ${BRANCH} — nothing to clean up.\"\n            exit 0\n          fi\n\n          for id in $DEPLOYMENTS; do\n            echo \"Deleting CF Pages deployment: $id\"\n            curl -s -X DELETE \\\n              \"https://api.cloudflare.com/client/v4/accounts/${CLOUDFLARE_ACCOUNT_ID}/pages/projects/${PROJECT}/deployments/${id}?force=true\" \\\n              -H \"Authorization: Bearer ${CLOUDFLARE_API_TOKEN}\" | jq -r 'if .success then \"  ✓ deleted\" else \"  ✗ \\(.errors[0].message)\" end'\n          done\n\n          # Mark the GitHub Deployment environment as inactive.\n          ENV_NAME=\"${PROJECT} (Preview)\"\n          gh api \"repos/${GITHUB_REPOSITORY}/deployments\" \\\n            | jq -r \".[] | select(.environment == \\\"${ENV_NAME}\\\") | .id\" \\\n            | while read -r deploy_id; do\n                gh api \"repos/${GITHUB_REPOSITORY}/deployments/${deploy_id}/statuses\" \\\n                  --method POST --field state=inactive 2>/dev/null || true\n              done\n",
-	greetings: "name: Greetings\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n\njobs:\n  greeting:\n    name: Greet first-time contributors\n    permissions:\n      issues: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    # Group by the issue/PR number so duplicate events don't race each other.\n    steps:\n      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n        name: Greet on first contribution\n        with:\n          script: |\n            // Only greet on the initial open — ignore synchronize, reopened, etc.\n            if (context.payload.action !== 'opened') return;\n\n            const actor = context.actor;\n            const { owner, repo } = context.repo;\n\n            // Payload inspection is more reliable than context.eventName for detecting\n            // whether this is an issue vs. PR event — works regardless of how GitHub\n            // propagates event names through workflow_call chains.\n            const isIssue = !!context.payload.issue && !context.payload.pull_request;\n            // listForRepo returns both issues and PRs (GitHub treats PRs as issues),\n            // sorted newest-first. Filter by type to track first-issue and first-PR\n            // independently, and avoid search-index eventual-consistency lag.\n            const { data: recent } = await github.rest.issues.listForRepo({\n              owner, repo,\n              creator: actor,\n              state: 'all',\n              per_page: 100\n            });\n\n            const sameType = recent.filter(item =>\n              isIssue ? !item.pull_request : !!item.pull_request\n            );\n\n            if (sameType.length !== 1) return;\n            const body = isIssue\n              ? `Hey @${actor}!\\n\\nWe really appreciate you taking the time to report an issue. The collaborators on this project attempt to help as many people as possible, but we are a limited number of volunteers, so it is possible that this will not be addressed as swiftly.\\n\\nYour patience is much appreciated and we will get back to you as quickly as possible.`\n              : `Hey @${actor}!\\n\\nWe really appreciate you taking the time to help out with this PR. The collaborators on this project attempt to help as many people as possible, but we are a limited number of volunteers, so it is possible that this will not be addressed as swiftly.\\n\\nYour patience is much appreciated and we will get back to you as quickly as possible.`;\n\n            await github.rest.issues.createComment({\n              owner,\n              repo,\n              issue_number: context.issue.number,\n              body\n            });\n",
-	review: "name: Review\n\n# ReviewDog is the annotation layer — posts inline PR diff annotations.\n# Runs on pull_request only: inline annotations require PR context,\n# and branch protection ensures all changes go through PRs anyway.\n# security.secretDetection.yml / sourceQuality.structuredDataValidation.yml\n# are the CI gates covering push + PR events. Gitleaks and YAML are\n# intentionally duplicated: those gate merges; ReviewDog surfaces exact\n# line annotations in the PR diff.\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n\njobs:\n  reviewdog:\n    name: Post inline lint annotations\n    runs-on: ubuntu-latest\n    timeout-minutes: 20\n    permissions:\n      contents: read\n      pull-requests: write\n\n    steps:\n      - name: Checkout repository\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          fetch-depth: 0\n\n      - name: Setup\n        if: ${{ hashFiles('pnpm-lock.yaml') != '' }}\n        uses: theholocron/.github/.github/actions/setup@main\n\n      - name: Install ReviewDog\n        uses: reviewdog/action-setup@d8a7baabd7f3e8544ee4dbde3ee41d0011c3a93f # v1\n        with:\n          reviewdog_version: latest\n\n      # Detect which tools are relevant for this repo, excluding node_modules.\n      # hashFiles('**/*') recurses into node_modules/.pnpm and produces false\n      # positives for repos that don't own those file types.\n      # -print -quit stops find after the first match without a pipe, avoiding\n      # the SIGPIPE/pipefail exit-141 that find|head-1 triggers under\n      # GitHub Actions' default bash --noprofile --norc -e -o pipefail mode.\n      - name: Detect project features\n        id: detect\n        shell: bash\n        run: |\n          has() { find . -not -path '*/node_modules/*' -name \"$1\" -print -quit 2>/dev/null | grep -q .; }\n          has_ext() { find . -not -path '*/node_modules/*' -name \"$1\" -print -quit 2>/dev/null | grep -q .; }\n          { { has 'eslint.config.js' || has 'eslint.config.mjs' || has 'eslint.config.cjs' || \\\n              has 'eslint.config.ts' || has '.eslintrc' || has '.eslintrc.js' || \\\n              has '.eslintrc.cjs' || has '.eslintrc.json' || has '.eslintrc.yaml' || \\\n              has '.eslintrc.yml'; } && grep -qF '\"eslint\":' package.json 2>/dev/null; } && echo \"eslint=true\" >> \"$GITHUB_OUTPUT\" || echo \"eslint=false\" >> \"$GITHUB_OUTPUT\"\n          { has 'tsconfig.json' && grep -qF '\"typescript\":' package.json 2>/dev/null; } && echo \"tsconfig=true\" >> \"$GITHUB_OUTPUT\" || echo \"tsconfig=false\" >> \"$GITHUB_OUTPUT\"\n          has_ext '*.sh' && echo \"shell=true\" >> \"$GITHUB_OUTPUT\" || echo \"shell=false\" >> \"$GITHUB_OUTPUT\"\n          has 'Dockerfile' || has_ext '*.Dockerfile' || has 'Containerfile' && \\\n            echo \"docker=true\" >> \"$GITHUB_OUTPUT\" || echo \"docker=false\" >> \"$GITHUB_OUTPUT\"\n          has_ext '.env*' && echo \"dotenv=true\" >> \"$GITHUB_OUTPUT\" || echo \"dotenv=false\" >> \"$GITHUB_OUTPUT\"\n          has_ext '*.md' && echo \"markdown=true\" >> \"$GITHUB_OUTPUT\" || echo \"markdown=false\" >> \"$GITHUB_OUTPUT\"\n\n      #\n      # Always applicable\n      #\n\n      - name: Gitleaks (secrets)\n        uses: reviewdog/action-gitleaks@2b7b5685e3e3eecddab5d30cfa04f18123031421 # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / gitleaks\"\n          fail_level: error\n          gitleaks_flags: --log-opts=${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }}\n\n      - name: YamlLint\n        if: ${{ hashFiles('.yamllint.yml') != '' }}\n        uses: reviewdog/action-yamllint@b5f7217d8c815ae374d1d55840d5e569d82f01f0 # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / yamllint\"\n          fail_level: error\n          yamllint_flags: -c ${{ github.workspace }}/.yamllint.yml ${{ github.workspace }}\n\n      - name: ActionLint (GitHub Actions)\n        if: ${{ hashFiles('.github/workflows/*.yml', '.github/workflows/*.yaml') != '' }}\n        uses: reviewdog/action-actionlint@6fb7acc99f4a1008869fa8a0f09cfca740837d9d # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / actionlint\"\n          fail_level: error\n\n      #\n      # TypeScript / JavaScript\n      #\n\n      - name: ESLint\n        if: steps.detect.outputs.eslint == 'true'\n        uses: reviewdog/action-eslint@556a3fdaf8b4201d4d74d406013386aa4f7dab96 # v1.34.0\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / eslint\"\n          fail_level: error\n          eslint_flags: .\n\n      - name: TypeScript\n        if: steps.detect.outputs.tsconfig == 'true'\n        uses: EPMatt/reviewdog-action-tsc@63d923a3c5b4497671940b8874f58a404e2351b5 # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / tsc\"\n          fail_level: error\n\n      #\n      # Shell\n      #\n\n      - name: ShellCheck\n        if: steps.detect.outputs.shell == 'true'\n        uses: reviewdog/action-shellcheck@4c07458293ac342d477251099501a718ae5ef86e # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / shellcheck\"\n          fail_level: none\n\n      #\n      # Docker\n      #\n\n      - name: Hadolint\n        if: steps.detect.outputs.docker == 'true'\n        uses: reviewdog/action-hadolint@1b2cfa6ba72072ad35158d7ff3aa49bbdc03506d # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / hadolint\"\n          fail_level: none\n\n      #\n      # Environment files\n      #\n\n      - name: dotenv-linter\n        if: steps.detect.outputs.dotenv == 'true'\n        uses: dotenv-linter/action-dotenv-linter@afde61cfda2ecffe7bea35837b6f20b956c88689 # v3.0.0\n        with:\n          reporter: github-code-suggestions\n\n      #\n      # Documentation\n      #\n\n      - name: Alex (inclusive language)\n        if: steps.detect.outputs.markdown == 'true'\n        uses: reviewdog/action-alex@347481655add010a2ae302df34b57c9bcfa0d6e4 # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / alex\"\n",
-	stale: "name: Stale\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      days-before-stale:\n        description: Days of inactivity before an issue or PR is marked stale (applies to both unless type-specific value is set)\n        type: number\n        required: false\n        default: 30\n      days-before-close:\n        description: Days after stale label before closing (applies to both unless type-specific value is set)\n        type: number\n        required: false\n        default: 5\n      days-before-issue-stale:\n        description: Days of inactivity before an issue is marked stale; overrides days-before-stale when set to a non-negative value\n        type: number\n        required: false\n        default: -1\n      days-before-issue-close:\n        description: Days after stale label before closing an issue; overrides days-before-close when set to a non-negative value\n        type: number\n        required: false\n        default: -1\n      days-before-pr-stale:\n        description: Days of inactivity before a PR is marked stale; overrides days-before-stale when set to a non-negative value\n        type: number\n        required: false\n        default: -1\n      days-before-pr-close:\n        description: Days after stale label before closing a PR; overrides days-before-close when set to a non-negative value\n        type: number\n        required: false\n        default: -1\n      exempt-issue-labels:\n        description: Comma-separated labels that exempt an issue from being marked stale\n        type: string\n        required: false\n        default: \"in-progress,wip\"\n      exempt-pr-labels:\n        description: Comma-separated labels that exempt a PR from being marked stale\n        type: string\n        required: false\n        default: \"\"\n      exempt-all-issue-milestones:\n        description: Issues assigned to any milestone are never marked stale\n        type: boolean\n        required: false\n        default: true\n      exempt-all-pr-milestones:\n        description: PRs assigned to any milestone are never marked stale\n        type: boolean\n        required: false\n        default: true\n      exempt-all-issue-projects:\n        description: Issues assigned to any project are never marked stale\n        type: boolean\n        required: false\n        default: true\n      exempt-all-pr-projects:\n        description: PRs assigned to any project are never marked stale\n        type: boolean\n        required: false\n        default: true\n\njobs:\n  stale:\n    name: Mark stale issues and pull requests\n    permissions:\n      contents: write\n      issues: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    steps:\n      - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0\n        name: Run Stale\n        with:\n          close-issue-message: >\n            This issue was closed because it has been stalled for\n            ${{ inputs.days-before-close }} days with no activity.\n          days-before-close: ${{ inputs.days-before-close }}\n          days-before-issue-close: ${{ inputs.days-before-issue-close }}\n          days-before-issue-stale: ${{ inputs.days-before-issue-stale }}\n          days-before-pr-close: ${{ inputs.days-before-pr-close }}\n          days-before-pr-stale: ${{ inputs.days-before-pr-stale }}\n          days-before-stale: ${{ inputs.days-before-stale }}\n          exempt-all-issue-milestones: ${{ inputs.exempt-all-issue-milestones }}\n          exempt-all-issue-projects: ${{ inputs.exempt-all-issue-projects }}\n          exempt-all-pr-milestones: ${{ inputs.exempt-all-pr-milestones }}\n          exempt-all-pr-projects: ${{ inputs.exempt-all-pr-projects }}\n          exempt-issue-labels: ${{ inputs.exempt-issue-labels }}\n          exempt-pr-labels: ${{ inputs.exempt-pr-labels }}\n          stale-issue-label: wontfix\n          stale-issue-message: >\n            This issue is stale because it has been open ${{ inputs.days-before-stale }}\n            days with no activity. Remove the stale label or comment, or this will be\n            closed in ${{ inputs.days-before-close }} days.\n          stale-pr-label: wontfix\n          stale-pr-message: >\n            This PR is stale because it has been open ${{ inputs.days-before-stale }}\n            days with no activity. Remove the stale label or comment, or this will be\n            closed in ${{ inputs.days-before-close }} days.\n",
-	"sync-dispatch": "name: Sync Dispatch\n\non: # yamllint disable-line rule:truthy\n  workflow_dispatch:\n    inputs:\n      steps:\n        description: >\n          Sync steps to pass to each repo's sync.yml. Default is \"readme\"\n          (only README marker blocks are updated).\n        type: string\n        required: false\n        default: readme\n\npermissions:\n  contents: read\n\njobs:\n  broadcast:\n    name: Broadcast sync to all repos\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    steps:\n      - name: Dispatch sync to all repos with sync.yml\n        run: |\n          gh api /orgs/theholocron/repos --paginate --jq '.[].name' \\\n            | while IFS= read -r repo; do\n              gh api \"/repos/theholocron/$repo/contents/.github/workflows/sync.yml\" --silent 2>/dev/null || continue\n              echo \"Dispatching sync to theholocron/$repo\"\n              gh workflow run sync.yml \\\n                --repo \"theholocron/$repo\" \\\n                --field \"steps=$STEPS\" \\\n              || echo \"Warning: could not dispatch to theholocron/$repo — skipping\"\n            done\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN }}\n          STEPS: ${{ inputs.steps }}\n",
-	tag: "name: Tag\n\n# Release Please — fully automated tag and GitHub Release from Conventional Commits.\n# No package.json or npm publishing required. Operates in \"simple\" mode by default:\n# analyzes commits since the last tag, maintains a rolling Release PR, and creates\n# a tag + GitHub Release when that PR is merged.\n#\n# The calling repo must have two files at the root:\n#   release-please-config.json    — declares packages and release-type\n#   .release-please-manifest.json — tracks the current version\n\non: # yamllint disable-line rule:truthy\n  # Self-trigger: when this workflow lives in theholocron/.github itself,\n  # push to main runs Release Please for that repo's own releases.\n  push:\n    branches:\n      - main\n  workflow_call:\n    inputs:\n      release-type:\n        description: Release Please release type (simple, node, python, etc.)\n        type: string\n        required: false\n        default: simple\n      config-file:\n        description: Path to release-please-config.json\n        type: string\n        required: false\n        default: release-please-config.json\n      manifest-file:\n        description: Path to .release-please-manifest.json\n        type: string\n        required: false\n        default: .release-please-manifest.json\n\njobs:\n  tag:\n    name: Tag release\n    permissions:\n      contents: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    steps:\n      - uses: google-github-actions/release-please-action@e4dc86ba9405554aeba3c6bb2d169500e7d3b4ee # v4.1.1\n        name: Run Release Please\n        with:\n          release-type: ${{ inputs.release-type }}\n          config-file: ${{ inputs.config-file }}\n          manifest-file: ${{ inputs.manifest-file }}\n",
-	"sync-github": "name: Sync workflow templates\n\n# Builds the holocron CLI from source and pushes updated workflow templates\n# and composite actions to downstream .github repos. Runs whenever the\n# template source files change on main or alpha.\n#\n# Secrets required:\n#   HOLOCRON_SYNC_TOKEN — fine-grained PAT (resource owner: org) with:\n#                  Actions:       Read and write  (dispatch workflow runs via gh workflow run)\n#                  Contents:      Read and write  (git trees, blobs, refs)\n#                  Pull requests: Read and write  (open sync PR)\n#                  Workflows:     Read and write  (write .github/workflows/*.yml)\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      primary-repo:\n        description: >\n          Primary .github repo — receives composite actions, reusable workflows,\n          and thin-caller templates. Requires a PR (branch protection assumed).\n        type: string\n        required: false\n        default: theholocron/.github\n      secondary-repos:\n        description: >\n          Space-separated list of secondary repos (reusable workflows + thin\n          callers only, no composite actions). Changes are delivered via pull\n          request, same as the primary repo.\n        type: string\n        required: false\n        default: \"\"\n      sync-branch:\n        description: Branch name used for the primary and secondary repo PRs\n        type: string\n        required: false\n        default: chore/sync-templates\n    secrets:\n      HOLOCRON_SYNC_TOKEN:\n        required: true\n      HOLOCRON_READ_TOKEN:\n        description: >\n          Fine-grained PAT for read-only GitHub API calls (e.g. resolving git\n          committer identity via `gh api user`). Falls back to HOLOCRON_SYNC_TOKEN.\n        required: false\n      GH_TOKEN:\n        description: >\n          Generic GitHub token fallback for `gh` CLI calls. Used when neither\n          HOLOCRON_READ_TOKEN nor HOLOCRON_SYNC_TOKEN is set.\n        required: false\n      HOLOCRON_AXIOM_TOKEN:\n        description: >\n          Axiom API token. When set alongside the HOLOCRON_AXIOM_DATASET\n          repo/org variable, the CLI ships this run's structured logs to Axiom.\n          Falls back to the vendor-native AXIOM_TOKEN secret.\n        required: false\n      AXIOM_TOKEN:\n        description: Vendor-native fallback for HOLOCRON_AXIOM_TOKEN.\n        required: false\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  sync:\n    name: Sync templates\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    permissions:\n      contents: read\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n      HOLOCRON_AXIOM_TOKEN: ${{ secrets.HOLOCRON_AXIOM_TOKEN || secrets.AXIOM_TOKEN }}\n      HOLOCRON_AXIOM_DATASET: ${{ vars.HOLOCRON_AXIOM_DATASET || vars.AXIOM_DATASET }}\n      POSTHOG_PROJECT_TOKEN: ${{ vars.POSTHOG_PROJECT_TOKEN }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: pnpm build\n        name: Build CLI\n\n      - name: Cache actionlint\n        id: cache-actionlint\n        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0\n        with:\n          path: /tmp/actionlint\n          key: actionlint-v1.7.7-linux-amd64\n\n      - name: Download actionlint\n        if: steps.cache-actionlint.outputs.cache-hit != 'true'\n        run: |\n          curl -fsSL https://github.com/rhysd/actionlint/releases/download/v1.7.7/actionlint_1.7.7_linux_amd64.tar.gz \\\n            | tar -xz -C /tmp actionlint\n\n      - name: Validate generated workflows\n        run: |\n          node packages/cli/dist/cli.mjs sync-github \\\n            --repo \"$PRIMARY_REPO\" \\\n            --output-dir /tmp/sync-validate\n          /tmp/actionlint /tmp/sync-validate/.github/workflows/*.yml\n        env:\n          PRIMARY_REPO: ${{ inputs.primary-repo }}\n\n      - name: Sync primary repo (PR)\n        run: |\n          GIT_NAME=$(gh api user --jq .name 2>/dev/null || echo \"github-actions[bot]\")\n          GIT_EMAIL=$(gh api user --jq '\"\\(.id)+\\(.login)@users.noreply.github.com\"' 2>/dev/null || echo \"41898282+github-actions[bot]@users.noreply.github.com\")\n          COMMIT_MSG=\"chore: sync from theholocron/holocron\"$'\\n\\n'\"Signed-off-by: $GIT_NAME <$GIT_EMAIL>\"\n          node packages/cli/dist/cli.mjs sync-github \\\n            --repo \"$PRIMARY_REPO\" \\\n            --branch \"$SYNC_BRANCH\" \\\n            --pr \\\n            --message \"$COMMIT_MSG\"\n          GH_TOKEN=\"$HOLOCRON_SYNC_TOKEN\" gh pr merge --auto --squash \\\n            --repo \"$PRIMARY_REPO\" \"$SYNC_BRANCH\" 2>/dev/null || true\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_READ_TOKEN || secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN }}\n          HOLOCRON_SYNC_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN }}\n          PRIMARY_REPO: ${{ inputs.primary-repo }}\n          SYNC_BRANCH: ${{ inputs.sync-branch }}\n\n      - name: Sync secondary repos (PR)\n        if: ${{ inputs.secondary-repos != '' }}\n        run: |\n          GIT_NAME=$(gh api user --jq .name 2>/dev/null || echo \"github-actions[bot]\")\n          GIT_EMAIL=$(gh api user --jq '\"\\(.id)+\\(.login)@users.noreply.github.com\"' 2>/dev/null || echo \"41898282+github-actions[bot]@users.noreply.github.com\")\n          COMMIT_MSG=\"chore: sync from theholocron/holocron\"$'\\n\\n'\"Signed-off-by: $GIT_NAME <$GIT_EMAIL>\"\n          for repo in $SECONDARY_REPOS; do\n            node packages/cli/dist/cli.mjs sync-github \\\n              --repo \"$repo\" \\\n              --branch \"$SYNC_BRANCH\" \\\n              --pr \\\n              --message \"$COMMIT_MSG\"\n            GH_TOKEN=\"$HOLOCRON_SYNC_TOKEN\" gh pr merge --auto --squash \\\n              --repo \"$repo\" \"$SYNC_BRANCH\" 2>/dev/null || true\n          done\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_READ_TOKEN || secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN }}\n          HOLOCRON_SYNC_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN }}\n          SECONDARY_REPOS: ${{ inputs.secondary-repos }}\n          SYNC_BRANCH: ${{ inputs.sync-branch }}\n"
-};
-/** Composite actions → `.github/actions/<name>/action.yml` (key includes `/action`). */
-const REUSABLE_ACTIONS = {
-	"auto-commit/action": auto_commit_default,
-	"holocron/action": holocron_default,
-	"install/action": install_default,
-	"setup/action": setup_default,
-	"setup-node/action": setup_node_default
-};
-/** GitHub starter-workflow metadata → `workflow-templates/<name>.properties.json`. */
-const WORKFLOW_TEMPLATE_PROPERTIES = { bookkeeping: JSON.stringify({
-	name: "Bookkeeping",
-	description: "Label and track issues and pull requests.",
-	iconName: "octicon tag"
-}, null, 2) };
-const SOURCE = "packages/astromech/src/reusable.ts";
+function resolveExportEntry(entry) {
+	if (typeof entry === "string") return entry;
+	if (entry === null || typeof entry !== "object") return void 0;
+	const conditions = entry;
+	const value = conditions.import ?? conditions.default ?? conditions.require;
+	if (typeof value === "string") return value;
+	if (typeof value === "object" && value !== null) return resolveExportEntry(value);
+}
 /**
-* "AUTO-GENERATED — do not edit" header for the YAML pushed to
-* `theholocron/.github`. Matches `createHeader().workflowHeader({ forPrimary: true })`
-* field-for-field, minus any timestamp — a live `Synced:` line makes the content
-* hash change on every run and defeats `sync-github`'s unchanged-file skip.
+* A minimal, POSIX-safe `path.join` — avoids importing `node:path` just for
+* this. Every path in play here is either already POSIX (a `package.json`
+* `exports` value, always forward-slashed regardless of platform) or built
+* from platform-neutral segments (`cwd`, `"node_modules"`, a scoped package
+* name split on `/`), so a manual join is safe and keeps this module
+* dependency-free like the rest of `run.ts`'s helpers.
 */
-function reusableHeader() {
-	return [
-		`# AUTO-GENERATED — do not edit in theholocron/.github directly.`,
-		`# Source:  theholocron/holocron · ${SOURCE}`,
-		`# Tool:    holocron sync-github`,
-		`# Changes: edit source in theholocron/holocron`,
-		``
-	].join("\n");
+function joinPath(...segments) {
+	return segments.map((s, i) => i === 0 ? s.replace(/\/+$/, "") : s.replace(/^\/+|\/+$/g, "")).filter(Boolean).join("/");
 }
+//#endregion
+//#region src/tasks/run/run.ts
 /**
-* The complete file batch `holocron sync-github` pushes to `theholocron/.github`:
-* path → content. YAML gets the "do not edit" header; the starter-workflow
-* `.properties.json` files are left bare (native JSON, not a commented file).
+* `holocron run <task> [job] [-- <passthrough>]` — run a registry task (or one
+* of its sub-jobs) locally.
+*
+* A `job` argument only applies to tasks that declare `jobs`; for any other
+* task it is folded back into the passthrough (`holocron run delivery.build
+* src/`).
+*
+* Resolution:
+*
+*   J. job given                              → TASKS[task].jobs[job].local (unknown job → exit 1)
+*   1. turbo.json defines the task            → `turbo run <task>`
+*   2. package.json has a `<task>` script     → `<pm> run <task>`
+*      (unless it's the `holocron run …` thin caller — that recurses)
+*   3. TASKS[task].local resolves             → `<tool> <args> <org-flags> <passthrough>`
+*   3b. TASKS[task].linterGroup               → run each resolved linter natively (see below)
+*   4. TASKS[task].jobs has entries           → run each job in declared order
+*   5. TASKS[task].local === null             → "enforced in CI" (skip, even with --required)
+*   5b. known task, nothing resolved          → "no <task> task" (exit 0, or 1 with --required)
+*   6. unknown task                           → "unknown task" (exit 1)
+*
+* A `linterGroup` task (`sourceQuality.staticAnalysis`, etc.) runs its fixed
+* set of `linters.ts` entries, each still gated by that linter's own
+* `detect`/`always` rule — every entry runs its `localBin` natively when
+* found on PATH. Missing tools are flagged; the exit code is the worst of
+* the lot. Unlike the old single `lint` task, this check runs *after*
+* turbo/`package.json` resolution (step 3b, not step 0) — a `linterGroup`
+* task is a normal turbo-delegatable task like any other.
 */
-function reusableTemplates() {
-	const out = /* @__PURE__ */ new Map();
-	const header = reusableHeader();
-	for (const [name, body] of Object.entries(REUSABLE_ACTIONS)) out.set(`.github/actions/${name}.yml`, `${header}${body}`);
-	for (const [name, body] of Object.entries(REUSABLE_WORKFLOWS)) out.set(`.github/workflows/${name}.yml`, `${header}${body}`);
-	for (const [name, body] of Object.entries(WORKFLOW_TEMPLATES)) {
-		out.set(`workflow-templates/${name}.yml`, `${header}${body}`);
-		const props = WORKFLOW_TEMPLATE_PROPERTIES[name];
-		if (props) out.set(`workflow-templates/${name}.properties.json`, props);
+/** The per-command runner — `runTask` and `runLintAggregate` share it. */
+function makeRunOne(input) {
+	const { print, logger, exec, task, cwd } = input;
+	const dryRun = input.dryRun ?? false;
+	return (cmd, args) => {
+		const command = [cmd, ...args].join(" ");
+		if (dryRun) {
+			print(`would run: ${command}`);
+			logger.debug({
+				task,
+				command,
+				status: "dry-run"
+			}, `run: ${task}`);
+			return {
+				status: "dry-run",
+				command
+			};
+		}
+		print(`→ ${command}`);
+		const { exitCode } = exec(cmd, args, { cwd });
+		const status = exitCode === 0 ? "ok" : "fail";
+		logger[status === "fail" ? "warn" : "debug"]({
+			task,
+			command,
+			exitCode,
+			status
+		}, `run: ${task}`);
+		return {
+			status,
+			command,
+			...status === "fail" ? { message: `\`${command}\` exited ${exitCode}` } : {}
+		};
+	};
+}
+function runTask(input) {
+	const { print, logger, readFile, fileExists, listDir, task, cwd } = input;
+	const def = TASKS[task];
+	let job = input.job;
+	let passthrough = input.passthrough ?? [];
+	if (job !== void 0 && !def?.jobs) {
+		passthrough = [job, ...passthrough];
+		job = void 0;
 	}
-	return out;
+	if (job !== void 0) {
+		const jobDef = def.jobs[job];
+		if (!jobDef) {
+			const known = Object.keys(def.jobs).join(", ");
+			print(`✗ unknown job "${job}" for "${task}" (known: ${known})`);
+			logger.warn({
+				task,
+				job,
+				status: "unknown"
+			}, `run: ${task} ${job}`);
+			return {
+				status: "unknown",
+				message: `unknown job "${task} ${job}"`
+			};
+		}
+		const label = `${task} ${job}`;
+		return runUnit(input, label, jobDef.local, makeRunOne({
+			...input,
+			task: label
+		}), passthrough);
+	}
+	const run = makeRunOne(input);
+	if (turboDefinesTask(cwd, task, readFile, fileExists)) {
+		const filterArg = input.filter ? [`--filter=${input.filter}`] : [];
+		const forwarded = [...def?.local && !def.local.command && def.local.tool ? def.flags?.[def.local.tool] ?? [] : [], ...passthrough];
+		const args = [
+			"run",
+			task,
+			...filterArg,
+			...forwarded.length ? ["--", ...forwarded] : []
+		];
+		return run(resolveBin(cwd, "turbo", fileExists), args);
+	}
+	const script = packageJsonScript(cwd, task, readFile, fileExists);
+	if (script && !/^holocron run\b/.test(script.trim())) return run(packageManager(cwd, readFile, fileExists), [
+		"run",
+		task,
+		...passthrough.length ? ["--", ...passthrough] : []
+	]);
+	if (def?.local) {
+		if (def.local.command) return run(process.execPath, [
+			process.argv[1],
+			def.local.command,
+			...passthrough
+		]);
+		const runner = resolveRunner(def.local, cwd, listDir, readFile);
+		if (runner) {
+			const flags = (def.flags?.[runner.tool] ?? []).filter((f) => !passthrough.includes(f));
+			const configFlags = resolveToolConfig(runner.tool, cwd, {
+				readFile,
+				fileExists
+			});
+			return run(resolveBin(cwd, runner.tool, fileExists), [
+				...runner.args,
+				...configFlags,
+				...flags,
+				...passthrough
+			]);
+		}
+	}
+	if (def?.linterGroup) return runLinterGroup(input, def.linterGroup, passthrough);
+	if (def?.jobs && Object.keys(def.jobs).length > 0) return runAllJobs(input, def.jobs, passthrough);
+	if (def?.local === null) {
+		const msg = `no local equivalent for ${task} — enforced in CI`;
+		print(`· ${msg}`);
+		logger.debug({
+			task,
+			status: "skip"
+		}, `run: ${task}`);
+		return {
+			status: "skip",
+			message: msg
+		};
+	}
+	if (KNOWN_TASKS.has(task)) {
+		const msg = `no ${task} task for this repo`;
+		print(input.required ? `✗ ${msg} (required)` : `· ${msg}`);
+		logger[input.required ? "warn" : "debug"]({
+			task,
+			status: input.required ? "fail" : "skip"
+		}, `run: ${task}`);
+		return {
+			status: input.required ? "fail" : "skip",
+			message: msg
+		};
+	}
+	print(`✗ unknown task "${task}"`);
+	logger.warn({
+		task,
+		status: "unknown"
+	}, `run: ${task}`);
+	return {
+		status: "unknown",
+		message: `unknown task "${task}"`
+	};
 }
-//#endregion
-//#region src/turbo.ts
 /**
-* `turboConfig(config)` — the generated `turbo.json` for a repo's task
-* manifest, epic #672 D9 (#681). Every workspace, monorepo or single-package
-* (Turborepo's single-package mode), gets this from the same `tasks` array
-* that already drives thin callers / required checks / package scripts —
-* never hand-authored.
-*
-* Only tasks with a {@link TurboTaskConfig} in the registry (real per-
-* workspace build/compile/test steps) get an entry. Whole-repo, single-run
-* tools (prettier, gitleaks, commitlint, yamllint, …) have none — they stay
-* off turbo.json entirely, same as today.
+* Run one registry unit — a task's own runner or a single sub-job. Resolution
+* is registry-only (`turbo` / `package.json` scripts are keyed by task, not
+* `task/job`). `label` names the unit in messages (`audit performance`).
 *
-* A task entry's own `turbo.passThroughEnv` (schema.ts) appends extra env
-* vars to the registry default's cache-key hashing — the one thing that's
-* genuinely per-repo (e.g. a package tagging Sentry releases during its own
-* build needs `SENTRY_AUTH_TOKEN` in its cache key; most repos don't).
-*/
-/** Filed once per repo, unconditionally — every generated turbo.json's root. */
-const GLOBAL_DEPENDENCIES = ["pnpm-workspace.yaml", "tsconfig.json"];
-/**
-* `turbo.json` content for this manifest, pretty-printed — write it
-* directly, no merge (matches `thinCallers()` / `reusableTemplates()`: this
-* file is generated, not hand-edited). `null` when no task in the manifest
-* has turbo fan-out config (nothing to write).
+* `local: null` → CI-only by design, always a skip (never a failure, even with
+* `--required`). A declared runner with no matching repo file, or whose tool
+* isn't installed locally → a skip (`--required` turns it into a failure — the
+* repo claims a check it can't back). Mirrors the lint aggregate: run what's
+* here, flag the rest, let CI enforce.
 */
-function turboConfig(config) {
-	const entries = (config.tasks ?? []).map(normalizeTaskEntry);
-	const tasks = {};
-	for (const entry of entries) {
-		if (entry.local === false) continue;
-		const turbo = TASKS[entry.name]?.turbo;
-		if (!turbo) continue;
-		const extraEnv = entry.turbo?.passThroughEnv;
-		tasks[entry.name] = extraEnv && extraEnv.length > 0 ? {
-			...turbo,
-			passThroughEnv: extraEnv
-		} : turbo;
+function runUnit(input, label, local, run, passthrough) {
+	const { print, logger, listDir, lookPath, cwd, readFile } = input;
+	const skip = (msg) => {
+		print(input.required ? `✗ ${msg} (required)` : `· ${msg}`);
+		logger[input.required ? "warn" : "debug"]({
+			task: label,
+			status: input.required ? "fail" : "skip"
+		}, `run: ${label}`);
+		return {
+			status: input.required ? "fail" : "skip",
+			message: msg
+		};
+	};
+	if (local) {
+		const runner = resolveRunner(local, cwd, listDir, readFile);
+		if (!runner) return skip(`no ${label} runner for this repo`);
+		const found = lookPath(cwd, runner.tool);
+		if (!found) return skip(`${runner.tool} not installed locally for ${label} — enforced in CI`);
+		return run(found, [...runner.args, ...passthrough]);
 	}
-	if (Object.keys(tasks).length === 0) return null;
-	return `${JSON.stringify({
-		$schema: "https://turborepo.org/schema.json",
-		globalDependencies: GLOBAL_DEPENDENCIES,
-		tasks
-	}, null, 2)}\n`;
+	const msg = `no local equivalent for ${label} — enforced in CI`;
+	print(`· ${msg}`);
+	logger.debug({
+		task: label,
+		status: "skip"
+	}, `run: ${label}`);
+	return {
+		status: "skip",
+		message: msg
+	};
 }
 /**
-* Fixes #692: `turboConfig()` writes a `turbo.json` the moment *any* task in
-* the manifest has fan-out config — with no check for whether the repo's own
-* root package is actually covered by `pnpm-workspace.yaml`'s `packages:`
-* list. A repo shaped like `observability` (the library lives at repo root;
-* `packages:` lists only an unrelated `docs` site) silently breaks the
-* instant `turbo.json` exists: `holocron run <task>` switches from running
-* root's own script directly to `turbo run <task>`, which only sees declared
-* workspace members — root vanishes, the task "succeeds" with zero real work
-* done (confirmed empirically: `Packages in scope: docs`, root never
-* mentioned, exit 0).
-*
-* Detection is narrow and specific: root only needs to be an explicit
-* workspace member if its *own* `package.json` has a script literally named
-* after one of the tasks turbo.json is about to fan out — a plain
-* orchestrator root (`holocron`'s own `"build": "turbo run delivery.build"`,
-* which has no `delivery.build` script itself) never trips this; only a root
-* that's genuinely a directly-buildable package does. Confirmed the fix
-* empirically too — adding `.` to `packages:` makes turbo pick root back up
-* (`Packages in scope: docs, root-lib`) without disturbing the sibling
-* package's own caching.
-*
-* A matching script key alone isn't enough — its *value* has to be a real
-* command, not the generated `holocron run <task> --` wrapper (#846, the
-* counterpart `mergePackageJsonScripts()` already had to learn for #747/
-* #748). A repo whose root predates this tooling can already have that exact
-* wrapper sitting in a task-name-matching script with nothing ever having
-* generated it this session; adding `.` there fires #747's recursion
-* immediately (`turbo run <task>` → root's own `<task>` script → the wrapper
-* → `holocron run <task>` sees `turbo.json` still defines it → `turbo run
-* <task>` again, forever). Only a matching script whose value is *not* that
-* wrapper counts as "root is genuinely a directly-buildable package".
-*
-* A targeted line-based edit, not a full YAML parse/reserialize — same
-* pattern `codecov.ts`'s `mergeCodecovComponents()` already uses for editing
-* an existing generated file. `pnpm-workspace.yaml` routinely carries a
-* `catalog:`/`catalogs:`/`overrides:` block after `packages:`; a real parser
-* round-trip risks reformatting or reordering content nobody asked to touch.
-* Only ever *adds* a line — never rewrites or reorders anything already
-* there — and is a no-op (`changed: false`) whenever root doesn't need it,
-* root is already listed, or `packages:` isn't in the plain block-list form
-* every repo checked actually uses.
+* `holocron run <task>` for a task that is a container of sub-jobs (`audit`) —
+* run each job in declared order. Status precedence: any `fail` → `fail`; else
+* any `ok` → `ok`; else any `dry-run` → `dry-run`; else `skip` (nothing ran).
 */
-function ensureRootWorkspaceMember(workspaceYaml, rootScripts, taskNames) {
-	if (!taskNames.some((t) => {
-		const script = rootScripts[t];
-		return script !== void 0 && !isGeneratedRunWrapper(script, t);
-	})) return {
-		content: workspaceYaml,
-		changed: false
-	};
-	const lines = workspaceYaml.split("\n");
-	const packagesLineIdx = lines.findIndex((l) => /^packages:\s*$/.test(l));
-	if (packagesLineIdx === -1) return {
-		content: workspaceYaml,
-		changed: false
+function runAllJobs(input, jobs, passthrough) {
+	const { print, task } = input;
+	const perJob = {
+		...input,
+		required: false
 	};
-	const items = [];
-	let cursor = packagesLineIdx + 1;
-	while (cursor < lines.length && /^\s*-\s*/.test(lines[cursor])) {
-		items.push(lines[cursor]);
-		cursor++;
+	const reports = [];
+	for (const [name, jobDef] of Object.entries(jobs)) {
+		const label = `${task} ${name}`;
+		print(`▶ ${jobDef.checkContext}`);
+		reports.push(runUnit(perJob, label, jobDef.local, makeRunOne({
+			...perJob,
+			task: label
+		}), passthrough));
 	}
-	if (items.some((item) => {
-		const value = item.replace(/^\s*-\s*/, "").replace(/^["']|["']$/g, "").trim();
-		return value === "." || value === "";
-	})) return {
-		content: workspaceYaml,
-		changed: false
+	const command = reports.map((r) => r.command).filter((c) => Boolean(c)).join(" && ");
+	const statuses = new Set(reports.map((r) => r.status));
+	if (statuses.has("fail")) return {
+		status: "fail",
+		command,
+		message: `one or more ${task} jobs failed`
+	};
+	if (statuses.has("ok")) return {
+		status: "ok",
+		command
+	};
+	if (statuses.has("dry-run")) return {
+		status: "dry-run",
+		command
 	};
-	const newLine = `${items[0]?.match(/^(\s*-\s*)/)?.[1] ?? "  - "}"."`;
 	return {
-		content: [
-			...lines.slice(0, packagesLineIdx + 1),
-			newLine,
-			...lines.slice(packagesLineIdx + 1)
-		].join("\n"),
-		changed: true
+		status: "skip",
+		message: `no ${task} job has a local equivalent — enforced in CI`
+	};
+}
+/**
+* `holocron run <task>` for a `linterGroup` task — the task's fixed linter
+* set, each still gated by its own `detect`/`always` rule, run natively.
+* Worst exit code wins. Runs *after* the caller's own turbo/`package.json`
+* resolution (step 3b) — no per-linter turbo passthrough here, unlike the
+* old single `lint` task's eslint-only special case; the whole task is what
+* turbo/a package script would have already caught in steps 1–2.
+*/
+function runLinterGroup(input, names, passthrough) {
+	const { print, logger, listDir, lookPath, cwd, task, readFile, fileExists } = input;
+	const dryRun = input.dryRun ?? false;
+	const runOne = makeRunOne(input);
+	let rootFiles;
+	try {
+		rootFiles = listDir(cwd);
+	} catch {
+		rootFiles = [];
+	}
+	const sharedConfigAvailable = new Set(names.filter((name) => resolveToolConfig(name, cwd, {
+		readFile,
+		fileExists
+	}).length > 0));
+	const resolved = resolveLinters({
+		explicit: names,
+		rootFiles,
+		sharedConfigAvailable
+	});
+	const reports = [];
+	let anyHasLocalBin = false;
+	for (const { name, def } of resolved) {
+		const bin = def.localBin;
+		if (!bin) {
+			print(`· ${name} (CI only)`);
+			continue;
+		}
+		anyHasLocalBin = true;
+		const found = lookPath(cwd, bin);
+		if (!found) {
+			print(`! ${name} — ${bin} not on PATH${def.installHint ? `. ${def.installHint}` : ""} (enforced in CI)`);
+			continue;
+		}
+		const configFlags = resolveToolConfig(name, cwd, {
+			readFile,
+			fileExists
+		});
+		reports.push(runOne(found, [
+			...configFlags,
+			...def.localArgs ?? [],
+			...passthrough
+		]));
+	}
+	if (reports.length === 0) {
+		const required = input.required && anyHasLocalBin;
+		const msg = `no tooling available locally for ${task} — every linter in this group is CI-only here`;
+		print(required ? `✗ ${msg} (required)` : `· ${msg}`);
+		logger[required ? "warn" : "debug"]({
+			task,
+			status: required ? "fail" : "skip"
+		}, `run: ${task}`);
+		return {
+			status: required ? "fail" : "skip",
+			message: msg
+		};
+	}
+	const command = reports.map((r) => r.command).filter((c) => Boolean(c)).join(" && ");
+	if (dryRun) return {
+		status: "dry-run",
+		command
+	};
+	return reports.some((r) => r.status === "fail") ? {
+		status: "fail",
+		command,
+		message: "one or more linters failed"
+	} : {
+		status: "ok",
+		command
 	};
 }
+const mkRunner = (tool, args = []) => ({
+	tool,
+	args
+});
 /**
-* Matches the exact shape `packageScripts()` generates for `taskName` —
-* `<bin> run <taskName> --`, `<bin>` normally `holocron` but substitutable
-* (`holocronScript`, itself allowed to be multi-word, e.g. `"node
-* packages/cli/dist/cli.mjs"` — see its own test). Checking the *suffix*
-* rather than the whole string means an old wrapper survives a
-* `holocronScript` rename intact — it's still recognized as a wrapper (safe
-* to update to the new one), not mistaken for a real command. Mirrors
-* `sync.ts`'s private `isGeneratedRunWrapper()` — same predicate, needed on
-* both sides of #692/#747: whether to *write* the wrapper, and here, whether
-* an *existing* one should count as "root is directly buildable".
+* Resolve `{ tool, args }` for a runner, applying `detect[]` against repo
+* files, falling back (#750) to each candidate's `tool` name against
+* `package.json`'s own declared dependencies when neither matches by
+* filename. Only called for `tool` / `detect` runners — the caller handles
+* `command` runners itself, so `local.detect` is present whenever
+* `local.tool` is not.
+*
+* The dependency fallback matters once a Bucket A migration (#680) deletes
+* a build tool's own config file (`tsdown.config.ts`, `vite.config.ts`, …):
+* that file was the *only* signal `detect[]` had to offer, so removing it
+* used to make `delivery.build` report "no task for this repo" and silently
+* skip the build, even though the tool is still very much in use — a
+* package can't actually build with `tsdown` without it in
+* `dependencies`/`devDependencies`, so that's a signal at least as reliable
+* as the config file, and one deleting the file doesn't remove.
+*
+* **Per-candidate, not two full passes** (#750 follow-up — the first
+* shipped version got this wrong): `delivery.build`'s own `detect[]` ends
+* with `{ when: /^tsconfig\.json$/, tool: "tsc" }` as its last-resort
+* fallback, and `tsconfig.json` exists in essentially every package
+* regardless of build tool. A "check every candidate's filename, *then*
+* check every candidate's dependency" two-pass design would let that
+* always-present fallback file win over a real `tsdown`/`vite`/`rollup`
+* dependency match, the moment the earlier candidates' own config files are
+* gone — exactly backwards. Checking `(file match) || (dependency match)`
+* together for each candidate before moving to the next preserves the
+* intended precedence: a real signal for an *earlier* candidate, by either
+* means, still wins over a later candidate's mere filename presence.
 */
-function isGeneratedRunWrapper(command, taskName) {
-	return command.endsWith(` run ${taskName} --`);
+function resolveRunner(local, cwd, listDir, readFile) {
+	if (local.tool) return mkRunner(local.tool, local.args);
+	let files;
+	try {
+		files = listDir(cwd);
+	} catch {
+		files = [];
+	}
+	const deps = packageJsonDependencies(cwd, readFile);
+	for (const candidate of local.detect) if (files.some((f) => candidate.when.test(f)) || deps.has(candidate.tool)) return mkRunner(candidate.tool, candidate.args);
 }
+/** Every key from `package.json`'s `dependencies` + `devDependencies`, or an empty set on any read/parse failure. */
+function packageJsonDependencies(cwd, readFile) {
+	try {
+		const pkg = JSON.parse(readFile(join(cwd, "package.json")));
+		return /* @__PURE__ */ new Set([...Object.keys(pkg.dependencies ?? {}), ...Object.keys(pkg.devDependencies ?? {})]);
+	} catch {
+		return /* @__PURE__ */ new Set();
+	}
+}
+function resolveBin(cwd, tool, fileExists) {
+	const local = join(cwd, "node_modules", ".bin", tool);
+	return fileExists(local) ? local : tool;
+}
+function packageManager(cwd, readFile, fileExists) {
+	try {
+		const pkg = JSON.parse(readFile(join(cwd, "package.json")));
+		if (typeof pkg.packageManager === "string") return pkg.packageManager.split("@")[0];
+	} catch {}
+	if (fileExists(join(cwd, "pnpm-lock.yaml"))) return "pnpm";
+	if (fileExists(join(cwd, "bun.lockb"))) return "bun";
+	if (fileExists(join(cwd, "yarn.lock"))) return "yarn";
+	if (fileExists(join(cwd, "package-lock.json"))) return "npm";
+	return "pnpm";
+}
+function turboDefinesTask(cwd, task, readFile, fileExists) {
+	if (!fileExists(join(cwd, "turbo.json"))) return false;
+	try {
+		const turbo = JSON.parse(readFile(join(cwd, "turbo.json")));
+		return Boolean(turbo.tasks?.[task] ?? turbo.pipeline?.[task]);
+	} catch {
+		return false;
+	}
+}
+function packageJsonScript(cwd, task, readFile, fileExists) {
+	if (!fileExists(join(cwd, "package.json"))) return void 0;
+	try {
+		return JSON.parse(readFile(join(cwd, "package.json"))).scripts?.[task];
+	} catch {
+		return;
+	}
+}
+//#endregion
+//#region src/tasks/ci.ts
 /**
-* Fallback pin when a repo's own `pnpm-workspace.yaml` has no `turbo`
-* catalog entry yet — matches this repo's own catalog version (the
-* canonical source-of-truth repo for the whole org's tooling).
-*/
-const DEFAULT_TURBO_VERSION = "^2.10.12";
-/**
-* Ensures `turbo` is declared in `package.json#devDependencies` — found
-* the hard way rolling this out to `observability` (predates #691):
-* `turboConfig()` writes a `turbo.json` the moment any task has fan-out
-* config, but never touches `package.json`, so a repo that predates this
-* feature (or never had `turbo` installed for any other reason) ends up
-* with a `turbo.json` and nothing local to run it. `resolveBin()`
-* (`run.ts`) falls back to a bare `turbo` on `PATH` when
-* `node_modules/.bin/turbo` doesn't exist — on a machine with no global
-* `turbo` at all that's a hard failure for every task; on one that
-* happens to have an unrelated global install, silent version skew
-* (confirmed empirically: a global 2.6.0 rejected this repo's generated
-* `turbo.json` outright — `Found an unknown key "globalDependencies"`,
-* a schema key from a newer version than the one actually resolved).
+* `holocron ci` / `astromech.ci()` — run the merge-gating checks locally, in CI
+* order, and exit non-zero on the first failure. The "will CI pass?" command a
+* `pre-push` hook and the agent skills point at.
 *
-* Prefers `"catalog:"` when the repo's own `pnpm-workspace.yaml` already
-* has a `turbo` catalog entry — matches every already-migrated repo
-* (`holocron`, `clients`, …) — falling back to a real pinned version
-* otherwise. Never touches an existing `devDependencies.turbo` entry, so
-* a repo pinning its own version on purpose is left alone — idempotent,
-* a no-op once set either way.
+* Default scope: every `required: true` task. If the manifest marks nothing
+* required (an un-migrated repo), fall back to every `ci: true` task. `--all`
+* forces the full set. Each task runs through {@link runTask}: a `required`
+* task whose local runner can't run is a failure; a `local: null` task with
+* no turbo task / `package.json` script is skipped, never failed — even when
+* `required` (it's a CI-only check, not a local one).
 */
-function ensureTurboDependency(packageJson, workspaceYaml) {
-	const pkg = JSON.parse(packageJson);
-	if (typeof pkg.devDependencies?.turbo === "string") return {
-		content: packageJson,
-		changed: false
-	};
-	const hasTurboCatalogEntry = /^\s*turbo:\s*\S/m.test(workspaceYaml);
-	const devDependencies = {
-		...pkg.devDependencies,
-		turbo: hasTurboCatalogEntry ? "catalog:" : DEFAULT_TURBO_VERSION
-	};
-	const updated = {
-		...pkg,
-		devDependencies
-	};
+function runCi(input) {
+	const { print } = input;
+	const byName = /* @__PURE__ */ new Map();
+	for (const item of input.config?.tasks ?? []) byName.set(taskName(item), normalizeTaskEntry(item));
+	const gating = [...byName.values()].filter((e) => CI_ORDER.includes(e.name));
+	const all = gating.filter((e) => e.ci !== false);
+	const required = gating.filter((e) => e.required === true);
+	let selected = input.scope === "all" ? all : required;
+	const fellBack = input.scope !== "all" && selected.length === 0 && all.length > 0;
+	if (fellBack) selected = all;
+	const ordered = [...selected].sort((a, b) => CI_ORDER.indexOf(a.name) - CI_ORDER.indexOf(b.name));
+	print(`holocron ci — ${input.scope === "all" ? "all CI checks" : "required checks"} (${ordered.length})`);
+	if (fellBack) print("  (no required tasks in the manifest — running every CI task)");
+	print("");
+	const jobs = [];
+	for (const entry of ordered) {
+		const context = WORKFLOW_CHECK_CONTEXTS[entry.name] ?? null;
+		print(`▶ ${context ?? entry.name}`);
+		const r = runTask({
+			print: (line) => print(`  ${line}`),
+			logger: input.logger,
+			exec: input.exec,
+			readFile: input.readFile,
+			fileExists: input.fileExists,
+			listDir: input.listDir,
+			lookPath: input.lookPath,
+			task: entry.name,
+			cwd: input.cwd,
+			dryRun: input.dryRun ?? false,
+			required: entry.required === true,
+			...input.filter ? { filter: input.filter } : {}
+		});
+		const status = r.status;
+		jobs.push({
+			task: entry.name,
+			checkContext: context,
+			status,
+			command: r.command,
+			message: r.message
+		});
+	}
+	const failed = jobs.filter((j) => j.status === "fail").length;
+	const passed = jobs.filter((j) => j.status === "ok" || j.status === "dry-run").length;
+	const skipped = jobs.filter((j) => j.status === "skip").length;
+	print("");
+	if (ordered.length === 0) print("holocron ci — nothing to run");
+	else if (failed > 0) print(`✗ ${failed} failed, ${passed} passed${skipped ? `, ${skipped} skipped` : ""}`);
+	else print(`✓ ${passed} passed${skipped ? `, ${skipped} skipped` : ""}${input.dryRun ? " (plan only)" : ""}`);
 	return {
-		content: `${JSON.stringify(updated, null, 2)}\n`,
-		changed: true
+		status: failed > 0 ? "fail" : "ok",
+		jobs
 	};
 }
+function taskName(item) {
+	return typeof item === "string" ? item : item.name;
+}
 //#endregion
 //#region src/astromech.ts
 /**
@@ -1791,7 +1871,34 @@ function createAstromech(options) {
 	};
 }
 //#endregion
-//#region src/deploy-on-release.ts
+//#region src/generators/tsconfig.ts
+/**
+* A package-level `tsconfig.json` — the uniform shape confirmed across
+* every package checked, parameterized only by the two fields that
+* genuinely vary (`display`, `paths`). No scaffold/workflow header (matches
+* `.alexrc.json`'s existing precedent for a strict-JSON Bucket B file —
+* JSON has no comment syntax to carry one, and TypeScript's own tolerance
+* for JSONC comments in `tsconfig.json` isn't worth relying on for a file
+* this thin).
+*/
+function createTsconfig(options) {
+	const variant = options.variant ?? "node-lts";
+	const compilerOptions = {
+		baseUrl: "./",
+		outDir: "./dist"
+	};
+	if (options.paths) compilerOptions.paths = { "@/*": ["./src/*"] };
+	const config = {
+		display: options.display,
+		extends: `@theholocron/tsconfig/${variant}`,
+		compilerOptions,
+		include: ["src/**/*.ts"],
+		exclude: ["node_modules", "dist"]
+	};
+	return JSON.stringify(config, null, 2) + "\n";
+}
+//#endregion
+//#region src/tasks/deploy-on-release.ts
 /**
 * Deploy workspace packages once a release has published (holocron#930).
 *
@@ -2042,31 +2149,4 @@ async function deployOnRelease(options, { run = defaultRun, readJson = defaultRe
 	};
 }
 //#endregion
-//#region src/tsconfig.ts
-/**
-* A package-level `tsconfig.json` — the uniform shape confirmed across
-* every package checked, parameterized only by the two fields that
-* genuinely vary (`display`, `paths`). No scaffold/workflow header (matches
-* `.alexrc.json`'s existing precedent for a strict-JSON Bucket B file —
-* JSON has no comment syntax to carry one, and TypeScript's own tolerance
-* for JSONC comments in `tsconfig.json` isn't worth relying on for a file
-* this thin).
-*/
-function createTsconfig(options) {
-	const variant = options.variant ?? "node-lts";
-	const compilerOptions = {
-		baseUrl: "./",
-		outDir: "./dist"
-	};
-	if (options.paths) compilerOptions.paths = { "@/*": ["./src/*"] };
-	const config = {
-		display: options.display,
-		extends: `@theholocron/tsconfig/${variant}`,
-		compilerOptions,
-		include: ["src/**/*.ts"],
-		exclude: ["node_modules", "dist"]
-	};
-	return JSON.stringify(config, null, 2) + "\n";
-}
-//#endregion
-export { CI_ORDER, KNOWN_TASKS, KNOWN_WORKFLOWS, LINTERS, LINTER_NAMES, RESOLVABLE_TOOLS, REUSABLE_ACTIONS, REUSABLE_WORKFLOWS, TASKS, WORKFLOW_CHECK_CONTEXTS, WORKFLOW_TEMPLATES, WORKFLOW_TEMPLATE_PROPERTIES, codecovComponentBlock, codecovConfig, createAstromech, createCodecovConfig, createTsconfig, deployOnRelease, deriveDeployPaths, ensureIfNotFound, extractPreviewConfig, generateCombinedDeployContent, generateThinCallerContent, mergeCodecovComponents, normalizeWorkflowWith, readWorkspacePackages, requiredChecks, resolveLinters, resolveToolConfig, reusableTemplates, runCi, runTask };
+export { CI_ORDER, KNOWN_TASKS, KNOWN_WORKFLOWS, REUSABLE_ACTIONS, REUSABLE_WORKFLOWS, TASKS, WORKFLOW_CHECK_CONTEXTS, WORKFLOW_TEMPLATES, WORKFLOW_TEMPLATE_PROPERTIES, codecovComponentBlock, codecovConfig, createAstromech, createCodecovConfig, createTsconfig, deployOnRelease, deriveDeployPaths, ensureIfNotFound, extractPreviewConfig, generateCombinedDeployContent, generateThinCallerContent, mergeCodecovComponents, normalizeWorkflowWith, readWorkspacePackages, requiredChecks, reusableTemplates, runCi, runTask };