@theholocron/astromech 5.0.0-alpha.117 → 5.0.0-alpha.119

package/dist/index.d.mts

@@ -1,115 +1,5 @@
 import { r as TasksConfig } from "./schema-D01VYg43.mjs";
-//#region src/run.d.ts
-/**
- * `holocron run <task> [job] [-- <passthrough>]` — run a registry task (or one
- * of its sub-jobs) locally.
- *
- * A `job` argument only applies to tasks that declare `jobs`; for any other
- * task it is folded back into the passthrough (`holocron run delivery.build
- * src/`).
- *
- * Resolution:
- *
- *   J. job given                              → TASKS[task].jobs[job].local (unknown job → exit 1)
- *   1. turbo.json defines the task            → `turbo run <task>`
- *   2. package.json has a `<task>` script     → `<pm> run <task>`
- *      (unless it's the `holocron run …` thin caller — that recurses)
- *   3. TASKS[task].local resolves             → `<tool> <args> <org-flags> <passthrough>`
- *   3b. TASKS[task].linterGroup               → run each resolved linter natively (see below)
- *   4. TASKS[task].jobs has entries           → run each job in declared order
- *   5. TASKS[task].local === null             → "enforced in CI" (skip, even with --required)
- *   5b. known task, nothing resolved          → "no <task> task" (exit 0, or 1 with --required)
- *   6. unknown task                           → "unknown task" (exit 1)
- *
- * A `linterGroup` task (`sourceQuality.staticAnalysis`, etc.) runs its fixed
- * set of `linters.ts` entries, each still gated by that linter's own
- * `detect`/`always` rule — every entry runs its `localBin` natively when
- * found on PATH. Missing tools are flagged; the exit code is the worst of
- * the lot. Unlike the old single `lint` task, this check runs *after*
- * turbo/`package.json` resolution (step 3b, not step 0) — a `linterGroup`
- * task is a normal turbo-delegatable task like any other.
- */
-/** Minimal structural logger — `@theholocron/observability`'s `Logger` satisfies it. */
-interface RunLogger {
-  debug(obj: Record<string, unknown>, msg?: string): void;
-  warn(obj: Record<string, unknown>, msg?: string): void;
-}
-type ExecFn = (cmd: string, args: string[], opts: {
-  cwd: string;
-}) => {
-  exitCode: number;
-};
-/**
- * Everything `runTask` needs from the outside world. `createAstromech`
- * fills these with real implementations (or the caller's injected ones);
- * `runTask` never reaches for a global itself, so it has no default
- * branches to leave untested.
- */
-interface RunDeps {
-  print: (line: string) => void;
-  logger: RunLogger;
-  exec: ExecFn;
-  readFile: (path: string) => string;
-  fileExists: (path: string) => boolean;
-  listDir: (path: string) => string[];
-  /** `node_modules/.bin/<bin>` or a PATH entry; `null` when not runnable. */
-  lookPath: (cwd: string, bin: string) => string | null;
-}
-interface RunTaskInput extends RunDeps {
-  /** Registry task name, e.g. `"test"`. */
-  task: string;
-  /**
-   * Sub-job within the task, e.g. `"performance"` in `holocron run audit
-   * performance`. Ignored (folded into `passthrough`) for tasks with no `jobs`.
-   */
-  job?: string;
-  /** Directory to run in. */
-  cwd: string;
-  /** Args after `--` on the command line, forwarded to the tool / turbo / script. */
-  passthrough?: string[];
-  /** Print the resolved command without running it. */
-  dryRun?: boolean;
-  /** Turn "no such task for this repo" (normally exit 0) into a failure. */
-  required?: boolean;
-  /** `turbo --filter=<pkg>` passthrough (monorepo). Ignored when the repo has no `turbo.json`. */
-  filter?: string;
-}
-interface RunTaskReport {
-  status: "ok" | "fail" | "skip" | "dry-run" | "unknown";
-  /** Resolved command, for the caller / tests. */
-  command?: string;
-  message?: string;
-}
-declare function runTask(input: RunTaskInput): RunTaskReport;
-//#endregion
-//#region src/ci.d.ts
-interface CiOptions {
-  /** Print the plan without running anything. */
-  dryRun?: boolean;
-  /** `turbo --filter=<pkg>` passthrough (monorepo). */
-  filter?: string;
-  /** `"required"` (default) or `"all"` (every `ci: true` task). */
-  scope?: "required" | "all";
-}
-interface CiJobReport {
-  task: string;
-  /** The branch-protection check context, or `null` for a non-gating task. */
-  checkContext: string | null;
-  status: "ok" | "fail" | "skip" | "dry-run";
-  command?: string;
-  message?: string;
-}
-interface CiReport {
-  status: "ok" | "fail";
-  jobs: CiJobReport[];
-}
-interface CiInput extends RunDeps, CiOptions {
-  cwd: string;
-  config: TasksConfig;
-}
-declare function runCi(input: CiInput): CiReport;
-//#endregion
-//#region src/thin-callers.d.ts
+//#region src/generators/github-action-thin-callers.d.ts
 /**
  * Workflow templates + thin-caller generation.
  *
@@ -221,7 +111,7 @@ declare function normalizeWorkflowWith(raw: Record<string, unknown>): Record<str
  */
 declare function deriveDeployPaths(raw: Record<string, unknown>): string[];
 //#endregion
-//#region src/turbo.d.ts
+//#region src/generators/turbo.d.ts
 interface EnsureRootWorkspaceMemberResult {
   content: string;
   changed: boolean;
@@ -231,6 +121,116 @@ interface EnsureTurboDependencyResult {
   changed: boolean;
 }
 //#endregion
+//#region src/tasks/run/run.d.ts
+/**
+ * `holocron run <task> [job] [-- <passthrough>]` — run a registry task (or one
+ * of its sub-jobs) locally.
+ *
+ * A `job` argument only applies to tasks that declare `jobs`; for any other
+ * task it is folded back into the passthrough (`holocron run delivery.build
+ * src/`).
+ *
+ * Resolution:
+ *
+ *   J. job given                              → TASKS[task].jobs[job].local (unknown job → exit 1)
+ *   1. turbo.json defines the task            → `turbo run <task>`
+ *   2. package.json has a `<task>` script     → `<pm> run <task>`
+ *      (unless it's the `holocron run …` thin caller — that recurses)
+ *   3. TASKS[task].local resolves             → `<tool> <args> <org-flags> <passthrough>`
+ *   3b. TASKS[task].linterGroup               → run each resolved linter natively (see below)
+ *   4. TASKS[task].jobs has entries           → run each job in declared order
+ *   5. TASKS[task].local === null             → "enforced in CI" (skip, even with --required)
+ *   5b. known task, nothing resolved          → "no <task> task" (exit 0, or 1 with --required)
+ *   6. unknown task                           → "unknown task" (exit 1)
+ *
+ * A `linterGroup` task (`sourceQuality.staticAnalysis`, etc.) runs its fixed
+ * set of `linters.ts` entries, each still gated by that linter's own
+ * `detect`/`always` rule — every entry runs its `localBin` natively when
+ * found on PATH. Missing tools are flagged; the exit code is the worst of
+ * the lot. Unlike the old single `lint` task, this check runs *after*
+ * turbo/`package.json` resolution (step 3b, not step 0) — a `linterGroup`
+ * task is a normal turbo-delegatable task like any other.
+ */
+/** Minimal structural logger — `@theholocron/observability`'s `Logger` satisfies it. */
+interface RunLogger {
+  debug(obj: Record<string, unknown>, msg?: string): void;
+  warn(obj: Record<string, unknown>, msg?: string): void;
+}
+type ExecFn = (cmd: string, args: string[], opts: {
+  cwd: string;
+}) => {
+  exitCode: number;
+};
+/**
+ * Everything `runTask` needs from the outside world. `createAstromech`
+ * fills these with real implementations (or the caller's injected ones);
+ * `runTask` never reaches for a global itself, so it has no default
+ * branches to leave untested.
+ */
+interface RunDeps {
+  print: (line: string) => void;
+  logger: RunLogger;
+  exec: ExecFn;
+  readFile: (path: string) => string;
+  fileExists: (path: string) => boolean;
+  listDir: (path: string) => string[];
+  /** `node_modules/.bin/<bin>` or a PATH entry; `null` when not runnable. */
+  lookPath: (cwd: string, bin: string) => string | null;
+}
+interface RunTaskInput extends RunDeps {
+  /** Registry task name, e.g. `"test"`. */
+  task: string;
+  /**
+   * Sub-job within the task, e.g. `"performance"` in `holocron run audit
+   * performance`. Ignored (folded into `passthrough`) for tasks with no `jobs`.
+   */
+  job?: string;
+  /** Directory to run in. */
+  cwd: string;
+  /** Args after `--` on the command line, forwarded to the tool / turbo / script. */
+  passthrough?: string[];
+  /** Print the resolved command without running it. */
+  dryRun?: boolean;
+  /** Turn "no such task for this repo" (normally exit 0) into a failure. */
+  required?: boolean;
+  /** `turbo --filter=<pkg>` passthrough (monorepo). Ignored when the repo has no `turbo.json`. */
+  filter?: string;
+}
+interface RunTaskReport {
+  status: "ok" | "fail" | "skip" | "dry-run" | "unknown";
+  /** Resolved command, for the caller / tests. */
+  command?: string;
+  message?: string;
+}
+declare function runTask(input: RunTaskInput): RunTaskReport;
+//#endregion
+//#region src/tasks/ci.d.ts
+interface CiOptions {
+  /** Print the plan without running anything. */
+  dryRun?: boolean;
+  /** `turbo --filter=<pkg>` passthrough (monorepo). */
+  filter?: string;
+  /** `"required"` (default) or `"all"` (every `ci: true` task). */
+  scope?: "required" | "all";
+}
+interface CiJobReport {
+  task: string;
+  /** The branch-protection check context, or `null` for a non-gating task. */
+  checkContext: string | null;
+  status: "ok" | "fail" | "skip" | "dry-run";
+  command?: string;
+  message?: string;
+}
+interface CiReport {
+  status: "ok" | "fail";
+  jobs: CiJobReport[];
+}
+interface CiInput extends RunDeps, CiOptions {
+  cwd: string;
+  config: TasksConfig;
+}
+declare function runCi(input: CiInput): CiReport;
+//#endregion
 //#region src/astromech.d.ts
 interface AstromechOptions {
   /** Repo root. */
@@ -353,7 +353,7 @@ interface Astromech {
 }
 declare function createAstromech(options: AstromechOptions): Astromech;
 //#endregion
-//#region src/codecov.d.ts
+//#region src/generators/codecov.d.ts
 /**
  * `codecov.yml` generation — a manifest-derived artifact (component `paths`
  * come from workspace packages; the status targets track the `test` task's
@@ -398,133 +398,105 @@ declare function createCodecovConfig(packages: WorkspacePackage[]): string;
  */
 declare function codecovConfig(repoRoot: string, existing: string | null): string;
 //#endregion
-//#region src/deploy-on-release.d.ts
-interface SpawnResult {
-  status: number | null;
-  stdout: string;
-  stderr: string;
-}
-type Run = (command: string, args: string[], options: Record<string, unknown>) => SpawnResult;
-interface Tree {
-  readJson: (path: string) => unknown;
-  listDirs: (path: string) => string[];
-}
-interface DeployOnReleaseOptions {
-  cwd: string;
-  /** The release's channel: its prerelease identifier (`alpha`); empty or `main` for a stable release. */
-  channel: string;
-  /** The previous release's commit; omitted when there is none, so every deploying channel match deploys. */
-  from?: string;
-  /** The release commit. Default `HEAD`. */
-  to?: string;
-  /** Where progress lines go (stdout in the CLI). */
-  print: (line: string) => void;
-  dryRun?: boolean;
-}
-interface DeployOnReleaseDeps extends Partial<Tree> {
-  run?: Run;
-  sleep?: (ms: number) => Promise<void>;
-  now?: () => number;
-  /** Reads a package folder's task manifest; `loadTasksConfig` by default. */
-  loadTasks?: (dir: string) => Promise<TasksConfig>;
-}
-interface DeployOnReleaseResult {
-  pkg: string;
-  status: "ok" | "fail" | "skip" | "dry-run";
-  message: string;
-}
-interface DeployOnReleaseReport {
-  /** `fail` if any package's deploy failed; `skip` if none applied to this release; else `ok`. */
-  status: "ok" | "fail" | "skip";
-  results: DeployOnReleaseResult[];
-}
+//#region src/generators/github-action-reusable-workflows.d.ts
 /**
- * Deploys every package whose manifest declares a release-time deploy that
- * applies to this release. Never throws for a deploy problem: each package's
- * outcome is in the report, and `status: "fail"` is the caller's exit code.
+ * The **reusable** GitHub Actions surface pushed to `theholocron/.github` by
+ * `holocron sync-github` — the `workflow_call` implementations and composite
+ * actions that every repo's thin callers delegate to.
+ *
+ * `theholocron/.github` is a **pure sync target**: `.github/workflows/*`,
+ * `.github/actions/*` and `workflow-templates/*` there are generated from the
+ * `.yml` files in `src/templates/reusable/` and pushed verbatim (with a
+ * "do not edit" header). Never hand-edit them in `.github`.
+ *
+ * Not to be confused with `WORKFLOW_TEMPLATES` in `github-action-thin-callers.ts` — those are
+ * the *thin-caller bases* written into each consumer repo's `.github/workflows/`.
  */
-declare function deployOnRelease(options: DeployOnReleaseOptions, { run, readJson, listDirs, sleep, now, loadTasks }?: DeployOnReleaseDeps): Promise<DeployOnReleaseReport>;
+/** `workflow_call` implementations → `.github/workflows/<name>.yml`. */
+declare const REUSABLE_WORKFLOWS: Record<string, string>;
+/** Composite actions → `.github/actions/<name>/action.yml` (key includes `/action`). */
+declare const REUSABLE_ACTIONS: Record<string, string>;
+/** GitHub starter-workflow metadata → `workflow-templates/<name>.properties.json`. */
+declare const WORKFLOW_TEMPLATE_PROPERTIES: Record<string, string>;
+/**
+ * The complete file batch `holocron sync-github` pushes to `theholocron/.github`:
+ * path → content. YAML gets the "do not edit" header; the starter-workflow
+ * `.properties.json` files are left bare (native JSON, not a commented file).
+ */
+declare function reusableTemplates(): Map<string, string>;
+//#endregion
+//#region src/generators/required-checks.d.ts
+/** Ordered (task contexts in {@link CI_ORDER}, then extras), de-duplicated. */
+declare function requiredChecks(config: TasksConfig): string[];
 //#endregion
-//#region src/linters.d.ts
+//#region src/generators/tsconfig.d.ts
 /**
- * The linter registry — one list of linter names (from `config.tasks`'
- * `{ name: "lint", linters: [...] }`, or auto-detected) maps to both the
- * CI super-linter `VALIDATE_*` env and the native local run. This table is
- * the single source of truth for that mapping; {@link superLinterConfig}
- * (CI) and the `holocron run lint` aggregate (local) both read it.
+ * `tsconfig.json` generation — Bucket B (config-resolution workstream, #676):
+ * the file must stay committed (the TypeScript language server discovers it
+ * directly from disk, no `--config` override mechanism to hand it a path
+ * instead), but its content is fully derivable, so it's generated rather
+ * than hand-authored — the same category as `.editorconfig`
+ * ({@link "./templates/configs/editorconfig/create-config.js" createConfig})
+ * and {@link codecovConfig}.
  *
- * Spec: `docs/wiki/specifications/tech-astromech-task-runner.spec.md` "Lint parity".
+ * Surveyed every package-level `tsconfig.json` across the org (`holocron`,
+ * `clients`, `utils` — 20+ packages). `extends: "@theholocron/tsconfig/
+ * node-lts"`, `compilerOptions.baseUrl: "./"`, `compilerOptions.outDir:
+ * "./dist"`, `include: ["src/**\/*.ts"]`, and `exclude: ["node_modules",
+ * "dist"]` are uniform in every one — safe defaults here. `paths` (a `@/*`
+ * → `./src/*` import alias) is a real per-package choice, present in
+ * roughly 40% of packages checked — an opt-in parameter, not a default.
+ *
+ * Two fields checked and deliberately *not* absorbed as defaults, unlike
+ * `eslint-config`'s `tsconfigRootDir`/`settings.node` (which turned out
+ * redundant with the shared package's own behavior, `configs`#461):
+ * `compilerOptions.module`/`moduleResolution` (only `@theholocron/cli`
+ * overrides these, to `esnext`/`bundler` — a genuine deviation from the
+ * shared `node-lts` preset's `nodenext`/`nodenext`, needed for its bundler
+ * tooling, not something every package should inherit) and
+ * `compilerOptions.rootDir` (present in exactly two packages, always the
+ * same value `./src` that `include` already implies — an unnecessary
+ * override wherever it appears, not a pattern worth generalizing).
+ *
+ * Monorepo *root* `tsconfig.json` (a TS project-references "solution
+ * file" — `holocron`'s own root is `{ files: [], references: [...] }`,
+ * listing which packages to build) is a structurally different, genuinely
+ * per-repo document — out of scope here, same as Bucket C content.
+ *
+ * Not yet wired into `holocron setup`'s per-package write loop (every
+ * other Bucket B file there is a single repo-root file, safely
+ * overwritten every run — `tsconfig.json` is per-package, and most
+ * packages' files still carry real hand-authored content today, not yet
+ * migrated to a fully-generated state). That per-package iteration +
+ * safe-migration design is `#680`'s job, not duplicated here — this is
+ * the generator itself, ready for it to call.
  */
-interface LinterDef {
-  /**
-   * super-linter `VALIDATE_*` keys this linter turns on. Setting any
-   * `VALIDATE_*` puts super-linter in allow-list mode, so emitting only the
-   * enabled keys makes it run exactly this set.
-   */
-  validate: string[];
-  /** super-linter `FIX_*` keys (auto-commit / `--write` parity). */
-  fix?: string[];
-  /**
-   * Local binary, resolved from `node_modules/.bin` then `PATH`. Absent →
-   * the linter has no meaningful local run (`holocron run lint` prints
-   * "CI only"); CI still enforces it.
-   */
-  localBin?: string;
-  /** Args for `localBin` in CHECK mode — never `--write` / `--fix`. */
-  localArgs?: string[];
+interface TsconfigOptions {
+  /** Human-readable name for the `display` field — the package's own name is the usual choice. */
+  display: string;
   /**
-   * Shown by `holocron run lint` when `localBin` is set but not found on
-   * PATH — the "you're missing a tool the repo needs" nudge.
+   * `@theholocron/tsconfig` variant. Defaults to `"node-lts"` — every
+   * checked package uses it; the other three (`astro`, `nextjs`, `react`)
+   * exist for a template repo's app-shaped packages, not the plain
+   * Node.js library packages this org's currently-migrated repos ship.
    */
-  installHint?: string;
+  variant?: "astro" | "nextjs" | "node-lts" | "react";
   /**
-   * Repo-root filenames that auto-enable this linter when the `lint` task
-   * has no explicit `linters` list. Ignored when {@link always} is set.
+   * Add a `@/*` → `./src/*` path alias. A real per-package choice, not a
+   * default — roughly 40% of packages checked use one, the rest don't.
    */
-  detect?: string[];
-  /** Enabled regardless of detection (the org baseline). */
-  always?: boolean;
-  /** Reusable-workflow config-file input this linter honors, if any. */
-  configInput?: "eslint-config" | "prettier-config" | "yaml-config";
+  paths?: boolean;
 }
 /**
- * Known linters, in execution order. `always` entries are the current
- * hard-coded super-linter baseline; `prettier` is always-on because the org
- * applies it universally (super-linter only lints files that exist).
- */
-declare const LINTERS: Record<string, LinterDef>;
-/** Every linter name the registry knows. */
-declare const LINTER_NAMES: ReadonlySet<string>;
-/**
- * Resolve the linter set for a repo. An `explicit` list (from `config.tasks`)
- * picks the candidate set; otherwise the candidates are every `always` linter
- * plus every `detect`-gated linter whose filenames are present at the repo
- * root, OR whose mapped `@theholocron/*-config` package resolves per
- * {@link sharedConfigAvailable} — a repo can't run eslint with genuinely no
- * config anywhere (super-linter FATALs if you ask it to,
- * theholocron/holocron#654), but a *shared* one it has installed counts
- * (holocron#795: proving `clients`' eslint.config.ts files reduce to zero
- * remaining content is only half the story — the file itself was still load-
- * bearing here as the sole "eslint is even configured" signal until this
- * fallback existed). `always` linters are unconditional. Result is ordered
- * by {@link LINTERS} declaration order.
- *
- * `sharedConfigAvailable` is caller-computed (`run.ts`'s `runLinterGroup`
- * already resolves each linter's `resolveToolConfig()` per member to build
- * its actual command — reusing that instead of duplicating the package-
- * resolution logic here keeps this function itself pure and file-I/O-free).
- *
- * @throws when an `explicit` name is not in the registry — a typo is a
- * config bug, not a linter to silently skip.
+ * A package-level `tsconfig.json` — the uniform shape confirmed across
+ * every package checked, parameterized only by the two fields that
+ * genuinely vary (`display`, `paths`). No scaffold/workflow header (matches
+ * `.alexrc.json`'s existing precedent for a strict-JSON Bucket B file —
+ * JSON has no comment syntax to carry one, and TypeScript's own tolerance
+ * for JSONC comments in `tsconfig.json` isn't worth relying on for a file
+ * this thin).
  */
-declare function resolveLinters(opts: {
-  explicit?: string[];
-  rootFiles: string[];
-  sharedConfigAvailable?: ReadonlySet<string>;
-}): Array<{
-  name: string;
-  def: LinterDef;
-}>;
+declare function createTsconfig(options: TsconfigOptions): string;
 //#endregion
 //#region src/registry.d.ts
 /**
@@ -634,156 +606,51 @@ declare const KNOWN_TASKS: Set<string>;
  */
 declare const CI_ORDER: string[];
 //#endregion
-//#region src/required-checks.d.ts
-/** Ordered (task contexts in {@link CI_ORDER}, then extras), de-duplicated. */
-declare function requiredChecks(config: TasksConfig): string[];
-//#endregion
-//#region src/resolver.d.ts
-/**
- * Resolves the absolute path to a Bucket A tool's shared `@theholocron/*-config`
- * entry point, installed in the consuming repo's own `node_modules` — and the
- * CLI flag(s) to hand it via (`--config`, `--extends`, …). `run.ts` splices the
- * result into the command it builds for a tool/detect runner or a linter-group
- * entry, right after the tool's own args.
- *
- * Every mapped package's resolved entry point already carries a ready-to-use
- * default export (a plain re-export for `prettier`/`commitlint`; an invoked,
- * zero-arg preset for `eslint`/`vitest`/`tsdown` — verified end-to-end against
- * each tool's real `--config`/`--extends` loader, not just the file's shape).
- * A repo doesn't need this package installed at all — every lookup degrades to
- * `[]` (no flag added, the tool falls back to its own auto-discovery of a
- * local file, unchanged from today) rather than throwing.
- *
- * **Local file wins.** A `<tool>.config.*` sitting in `cwd` (whether it's
- * pure boilerplate or has real per-package customization on top of the
- * shared bundle, e.g. `mergeConfig(base, { test: { coverage: { exclude }
- * } })`) always skips the splice, even when the shared package is also
- * installed — an explicit `--config <shared path>` flag beats a tool's own
- * auto-discovery every time, so splicing it unconditionally would silently
- * discard that customization the file is still sitting right there on disk.
- * The shared bundle is only ever the fallback for a package with *no* local
- * file at all — that's still the "delete the file to go fully shared" path
- * this was designed for (#676); it just isn't unconditional (#749).
- *
- * `semantic-release`, `devmoji`, `editorconfig-checker`, and `knip` are
- * deliberately absent — `semantic-release-config`'s `defineConfig()` needs
- * real per-repo data (branches, npm options) a static `--extends <path>` can't
- * carry; `devmoji` runs through a git hook template, not `holocron run
- * <task>`; `editorconfig-checker` has no shared-config package yet; `knip` is
- * repo-specific by nature, never a shared-config candidate. See
- * `.notes/tech-config-resolution.spec.md` (#676).
- */
-interface ResolverDeps {
-  readFile: (path: string) => string;
-  fileExists: (path: string) => boolean;
+//#region src/tasks/deploy-on-release.d.ts
+interface SpawnResult {
+  status: number | null;
+  stdout: string;
+  stderr: string;
 }
-/** Every tool name the resolver knows how to point at a shared config. */
-declare const RESOLVABLE_TOOLS: ReadonlySet<string>;
-/**
- * `<flag> <absolute path>` for `tool`, resolved against `cwd`'s
- * `node_modules` — or `[]` when the tool isn't mapped, `cwd` already has its
- * own local config file for it (#749 — local always wins, customized or
- * not), the shared package isn't installed, its `package.json` doesn't
- * declare the export subpath this needs, or the resolved file doesn't
- * actually exist on disk (a stale install, or a package version that
- * predates the export existing).
- */
-declare function resolveToolConfig(tool: string, cwd: string, deps: ResolverDeps): string[];
-//#endregion
-//#region src/reusable.d.ts
-/**
- * The **reusable** GitHub Actions surface pushed to `theholocron/.github` by
- * `holocron sync-github` — the `workflow_call` implementations and composite
- * actions that every repo's thin callers delegate to.
- *
- * `theholocron/.github` is a **pure sync target**: `.github/workflows/*`,
- * `.github/actions/*` and `workflow-templates/*` there are generated from the
- * `.yml` files in `src/templates/reusable/` and pushed verbatim (with a
- * "do not edit" header). Never hand-edit them in `.github`.
- *
- * Not to be confused with `WORKFLOW_TEMPLATES` in `thin-callers.ts` — those are
- * the *thin-caller bases* written into each consumer repo's `.github/workflows/`.
- */
-/** `workflow_call` implementations → `.github/workflows/<name>.yml`. */
-declare const REUSABLE_WORKFLOWS: Record<string, string>;
-/** Composite actions → `.github/actions/<name>/action.yml` (key includes `/action`). */
-declare const REUSABLE_ACTIONS: Record<string, string>;
-/** GitHub starter-workflow metadata → `workflow-templates/<name>.properties.json`. */
-declare const WORKFLOW_TEMPLATE_PROPERTIES: Record<string, string>;
-/**
- * The complete file batch `holocron sync-github` pushes to `theholocron/.github`:
- * path → content. YAML gets the "do not edit" header; the starter-workflow
- * `.properties.json` files are left bare (native JSON, not a commented file).
- */
-declare function reusableTemplates(): Map<string, string>;
-//#endregion
-//#region src/tsconfig.d.ts
-/**
- * `tsconfig.json` generation — Bucket B (config-resolution workstream, #676):
- * the file must stay committed (the TypeScript language server discovers it
- * directly from disk, no `--config` override mechanism to hand it a path
- * instead), but its content is fully derivable, so it's generated rather
- * than hand-authored — the same category as `.editorconfig`
- * ({@link "./templates/configs/editorconfig/create-config.js" createConfig})
- * and {@link codecovConfig}.
- *
- * Surveyed every package-level `tsconfig.json` across the org (`holocron`,
- * `clients`, `utils` — 20+ packages). `extends: "@theholocron/tsconfig/
- * node-lts"`, `compilerOptions.baseUrl: "./"`, `compilerOptions.outDir:
- * "./dist"`, `include: ["src/**\/*.ts"]`, and `exclude: ["node_modules",
- * "dist"]` are uniform in every one — safe defaults here. `paths` (a `@/*`
- * → `./src/*` import alias) is a real per-package choice, present in
- * roughly 40% of packages checked — an opt-in parameter, not a default.
- *
- * Two fields checked and deliberately *not* absorbed as defaults, unlike
- * `eslint-config`'s `tsconfigRootDir`/`settings.node` (which turned out
- * redundant with the shared package's own behavior, `configs`#461):
- * `compilerOptions.module`/`moduleResolution` (only `@theholocron/cli`
- * overrides these, to `esnext`/`bundler` — a genuine deviation from the
- * shared `node-lts` preset's `nodenext`/`nodenext`, needed for its bundler
- * tooling, not something every package should inherit) and
- * `compilerOptions.rootDir` (present in exactly two packages, always the
- * same value `./src` that `include` already implies — an unnecessary
- * override wherever it appears, not a pattern worth generalizing).
- *
- * Monorepo *root* `tsconfig.json` (a TS project-references "solution
- * file" — `holocron`'s own root is `{ files: [], references: [...] }`,
- * listing which packages to build) is a structurally different, genuinely
- * per-repo document — out of scope here, same as Bucket C content.
- *
- * Not yet wired into `holocron setup`'s per-package write loop (every
- * other Bucket B file there is a single repo-root file, safely
- * overwritten every run — `tsconfig.json` is per-package, and most
- * packages' files still carry real hand-authored content today, not yet
- * migrated to a fully-generated state). That per-package iteration +
- * safe-migration design is `#680`'s job, not duplicated here — this is
- * the generator itself, ready for it to call.
- */
-interface TsconfigOptions {
-  /** Human-readable name for the `display` field — the package's own name is the usual choice. */
-  display: string;
-  /**
-   * `@theholocron/tsconfig` variant. Defaults to `"node-lts"` — every
-   * checked package uses it; the other three (`astro`, `nextjs`, `react`)
-   * exist for a template repo's app-shaped packages, not the plain
-   * Node.js library packages this org's currently-migrated repos ship.
-   */
-  variant?: "astro" | "nextjs" | "node-lts" | "react";
-  /**
-   * Add a `@/*` → `./src/*` path alias. A real per-package choice, not a
-   * default — roughly 40% of packages checked use one, the rest don't.
-   */
-  paths?: boolean;
+type Run = (command: string, args: string[], options: Record<string, unknown>) => SpawnResult;
+interface Tree {
+  readJson: (path: string) => unknown;
+  listDirs: (path: string) => string[];
+}
+interface DeployOnReleaseOptions {
+  cwd: string;
+  /** The release's channel: its prerelease identifier (`alpha`); empty or `main` for a stable release. */
+  channel: string;
+  /** The previous release's commit; omitted when there is none, so every deploying channel match deploys. */
+  from?: string;
+  /** The release commit. Default `HEAD`. */
+  to?: string;
+  /** Where progress lines go (stdout in the CLI). */
+  print: (line: string) => void;
+  dryRun?: boolean;
+}
+interface DeployOnReleaseDeps extends Partial<Tree> {
+  run?: Run;
+  sleep?: (ms: number) => Promise<void>;
+  now?: () => number;
+  /** Reads a package folder's task manifest; `loadTasksConfig` by default. */
+  loadTasks?: (dir: string) => Promise<TasksConfig>;
+}
+interface DeployOnReleaseResult {
+  pkg: string;
+  status: "ok" | "fail" | "skip" | "dry-run";
+  message: string;
+}
+interface DeployOnReleaseReport {
+  /** `fail` if any package's deploy failed; `skip` if none applied to this release; else `ok`. */
+  status: "ok" | "fail" | "skip";
+  results: DeployOnReleaseResult[];
 }
 /**
- * A package-level `tsconfig.json` — the uniform shape confirmed across
- * every package checked, parameterized only by the two fields that
- * genuinely vary (`display`, `paths`). No scaffold/workflow header (matches
- * `.alexrc.json`'s existing precedent for a strict-JSON Bucket B file —
- * JSON has no comment syntax to carry one, and TypeScript's own tolerance
- * for JSONC comments in `tsconfig.json` isn't worth relying on for a file
- * this thin).
+ * Deploys every package whose manifest declares a release-time deploy that
+ * applies to this release. Never throws for a deploy problem: each package's
+ * outcome is in the report, and `status: "fail"` is the caller's exit code.
  */
-declare function createTsconfig(options: TsconfigOptions): string;
+declare function deployOnRelease(options: DeployOnReleaseOptions, { run, readJson, listDirs, sleep, now, loadTasks }?: DeployOnReleaseDeps): Promise<DeployOnReleaseReport>;
 //#endregion
-export { type Astromech, type AstromechOptions, CI_ORDER, type CiJobReport, type CiOptions, type CiReport, type DeployOnReleaseOptions, type DeployOnReleaseReport, type DeployOnReleaseResult, type ExecFn, type JobDef, KNOWN_TASKS, KNOWN_WORKFLOWS, LINTERS, LINTER_NAMES, type LinterDef, type LocalRunner, type OrgContext, type PreviewConfig, RESOLVABLE_TOOLS, REUSABLE_ACTIONS, REUSABLE_WORKFLOWS, type ResolverDeps, type RunLogger, type RunOptions, type RunTaskInput, type RunTaskReport, TASKS, type TaskDef, type TsconfigOptions, WORKFLOW_CHECK_CONTEXTS, WORKFLOW_TEMPLATES, WORKFLOW_TEMPLATE_PROPERTIES, type WorkspacePackage, codecovComponentBlock, codecovConfig, createAstromech, createCodecovConfig, createTsconfig, deployOnRelease, deriveDeployPaths, ensureIfNotFound, extractPreviewConfig, generateCombinedDeployContent, generateThinCallerContent, mergeCodecovComponents, normalizeWorkflowWith, readWorkspacePackages, requiredChecks, resolveLinters, resolveToolConfig, reusableTemplates, runCi, runTask };
+export { type Astromech, type AstromechOptions, CI_ORDER, type CiJobReport, type CiOptions, type CiReport, type DeployOnReleaseOptions, type DeployOnReleaseReport, type DeployOnReleaseResult, type ExecFn, type JobDef, KNOWN_TASKS, KNOWN_WORKFLOWS, type LocalRunner, type OrgContext, type PreviewConfig, REUSABLE_ACTIONS, REUSABLE_WORKFLOWS, type RunLogger, type RunOptions, type RunTaskInput, type RunTaskReport, TASKS, type TaskDef, type TsconfigOptions, WORKFLOW_CHECK_CONTEXTS, WORKFLOW_TEMPLATES, WORKFLOW_TEMPLATE_PROPERTIES, type WorkspacePackage, codecovComponentBlock, codecovConfig, createAstromech, createCodecovConfig, createTsconfig, deployOnRelease, deriveDeployPaths, ensureIfNotFound, extractPreviewConfig, generateCombinedDeployContent, generateThinCallerContent, mergeCodecovComponents, normalizeWorkflowWith, readWorkspacePackages, requiredChecks, reusableTemplates, runCi, runTask };