@theholocron/astromech 5.0.0-alpha.145 → 5.0.0-alpha.147

package/dist/index.mjs

@@ -2,6 +2,7 @@ import { r as normalizeTaskEntry, t as loadTasksConfig } from "./load-ytspboBj.m
 import { spawnSync } from "node:child_process";
 import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { join, relative } from "node:path";
+import { stringifyJson } from "@theholocron/json-utils";
 //#region src/templates/codecov/codecov.yml
 var codecov_default = "codecov:\n  require_ci_to_pass: true\n\ncoverage:\n  precision: 2\n  round: down\n  status:\n    project:\n      default:\n        target: auto\n        threshold: 2%\n        # Infra-only PRs (dep bumps, config, lockfile) touch no coverable code,\n        # so codecov produces no report to compare. Pass instead of blocking\n        # forever on a required check that will never post.\n        if_not_found: success\n    patch:\n      default:\n        target: 80%\n        if_not_found: success\n\ncomment:\n  layout: \"reach,diff,flags,components\"\n  behavior: default\n  require_changes: true\n\ncomponent_management:\n  default_rules:\n    statuses:\n      - type: patch\n        target: 80%\n        if_not_found: success\n  individual_components:\n";
 //#endregion
@@ -150,7 +151,7 @@ var delivery_deploy_default$1 = "name: Deploy\n\non: # yamllint disable-line rul
 var delivery_previewCheck_default$1 = "name: Preview Check\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      preview-url:\n        description: The PR's Vercel preview deployment URL, extracted from the triggering `deployment_status` event.\n        required: true\n        type: string\n      sha:\n        description: The deployed commit SHA — checked out explicitly, since GitHub evaluates which version of this workflow file to run from the default branch for a deployment_status event (unlike push/pull_request), and actions/checkout defaults to that same ref absent an explicit override.\n        required: true\n        type: string\n      cwd:\n        description: Directory to run the check from — the opted-in package's own directory in a monorepo. Defaults to the repo root.\n        required: false\n        type: string\n        default: \".\"\n\njobs:\n  preview-check:\n    name: Run monitoring checks against the preview deployment\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    steps:\n      - name: Validate the preview URL\n        id: validate\n        env:\n          CANDIDATE: ${{ inputs.preview-url }}\n        run: |\n          # `preview-url` comes from the triggering deployment_status\n          # event's environment_url -- set by whoever created that\n          # deployment status, not necessarily this repo's own\n          # delivery.previewDeploy job (anyone with `deployments: write`\n          # could create one directly via the API). Validated here,\n          # independently of the event's origin, before this runner\n          # ever issues an HTTP request to it (the monitoring check\n          # below): without this, a crafted environment_url could point\n          # the runner at an internal or attacker-controlled host\n          # (SSRF) instead of a real Vercel preview. Forwarding the\n          # re-serialized `url.href` rather than the raw input also\n          # closes off argument injection through embedded whitespace\n          # or shell metacharacters -- a string that parses can't carry\n          # either.\n          host=$(node -e 'try { process.stdout.write(new URL(process.argv[1]).hostname) } catch { process.exit(1) }' \"$CANDIDATE\") || host=\"\"\n          if [[ \"$host\" != *.vercel.app ]]; then\n            echo \"::error::preview-url '$CANDIDATE' does not parse to a *.vercel.app host (parsed host: '${host:-<unparseable>}')\"\n            exit 1\n          fi\n          url=$(node -e 'const u = new URL(process.argv[1]); if (u.protocol !== \"https:\") process.exit(1); process.stdout.write(u.href)' \"$CANDIDATE\") || {\n            echo \"::error::preview-url '$CANDIDATE' did not parse to an https:// URL\"\n            exit 1\n          }\n          echo \"url=$url\" >> \"$GITHUB_OUTPUT\"\n\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          ref: ${{ inputs.sha }}\n          # This checks out and runs a PR's own holocron.config.ts —\n          # untrusted until reviewed. Never leave a credential sitting\n          # in .git/config for that code to read and exfiltrate; no\n          # later step in this job needs to push or pull authenticated.\n          persist-credentials: false\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Run monitoring checks against the preview deployment\n        with:\n          command: monitoring check\n          args: --cwd=${{ inputs.cwd }} ${{ steps.validate.outputs.url }}\n";
 //#endregion
 //#region src/templates/reusable/delivery.previewDeploy.yml
-var delivery_previewDeploy_default$1 = "name: Preview Deploy\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      cwd:\n        description: Directory to run the delivery.previewDeploy task from — the opted-in package's own directory in a monorepo. Defaults to the repo root.\n        required: false\n        type: string\n        default: \".\"\n    secrets:\n      VERCEL_TOKEN:\n        required: false\n      HOLOCRON_DEPLOYMENTS_TOKEN:\n        description: >\n          A dedicated fine-grained PAT (Deployments: read/write only — see\n          docs/tokens.md), not the default GITHUB_TOKEN — GitHub does not\n          start a new workflow run for a deployment_status event created\n          using a run's own GITHUB_TOKEN, which would make a\n          deployment_status-triggered check (e.g. delivery.previewCheck)\n          silently never fire. No existing HOLOCRON_<FEATURE>_TOKEN carries\n          the Deployments permission, so `secrets: inherit` on the thin\n          caller forwards nothing for this unless a repo/org secret\n          literally named HOLOCRON_DEPLOYMENTS_TOKEN has been provisioned.\n        required: false\n\njobs:\n  # Two jobs, deliberately not one: \"report\" never checks out the repo at\n  # all, so it never runs a single line of this PR's own code. \"deploy\"\n  # does — it has to, to build and stage the preview — and runs with\n  # VERCEL_TOKEN present for that (tracked as a residual risk, #1020: the\n  # build step still runs this monorepo's own PR-affectable CLI build,\n  # pre-review). Without the split, a malicious build/stage script could\n  # persist a `gh` shim onto $GITHUB_PATH (or similar runner-state\n  # tampering) that a LATER step in the SAME job — the one that finally\n  # gets GH_TOKEN — would then execute instead of the real `gh` CLI,\n  # stealing that token too. Separate jobs run on separate, fresh\n  # runners; \"report\" has nothing of the first job's runner state to\n  # inherit.\n  deploy:\n    name: Deploy preview\n    runs-on: ubuntu-latest\n    # Setup/build/stage, plus the deploy capability's own\n    # wait-for-ready polling (up to 10 minutes by itself) — 10 would kill\n    # this before that polling could even finish.\n    timeout-minutes: 20\n    permissions:\n      contents: read\n    outputs:\n      url: ${{ steps.extract.outputs.url }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          # The PR's exact head SHA, not the default pull_request\n          # merge-commit ref — what gets built and deployed must be the\n          # exact commit the PR actually points at.\n          ref: ${{ github.event.pull_request.head.sha }}\n          persist-credentials: false\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - name: Check deploy credentials are available\n        id: creds\n        env:\n          VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}\n        run: |\n          # `secrets` isn't valid in a step `if:` (actionlint-enforced) —\n          # a fork PR never receives this secret, so the deploy step below\n          # skips cleanly on an empty token instead of failing on a\n          # missing credential. That skip is silent to the fork\n          # contributor -- no preview, no explanation why -- tracked\n          # as #1027 rather than fixed here (the real fix needs either\n          # a status comment or a maintainer-gated trusted-deploy path,\n          # not a quick addition to this step).\n          echo \"available=$([ -n \"$VERCEL_TOKEN\" ] && echo true || echo false)\" >> \"$GITHUB_OUTPUT\"\n\n      - name: Deploy preview\n        id: deploy\n        if: ${{ steps.creds.outputs.available == 'true' }}\n        env:\n          VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}\n        uses: theholocron/.github/.github/actions/holocron@main\n        with:\n          command: run delivery.previewDeploy\n          args: --cwd=${{ inputs.cwd }}\n\n      - name: Extract and validate the preview URL\n        id: extract\n        # Only after a real deploy — false both when the step above\n        # failed and when it skipped cleanly (fork PR, no credential).\n        if: ${{ steps.deploy.outcome == 'success' }}\n        env:\n          LOG_FILE: ${{ steps.deploy.outputs.log-file }}\n        run: |\n          # A loose https://\\S+ grab would match whatever text follows an\n          # attacker-chosen URL this log happens to contain; grabbing\n          # candidate text here and separately requiring the PARSED\n          # hostname end in .vercel.app (below) closes that regardless of\n          # how the candidate text is shaped — e.g. a userinfo trick like\n          # \"https://x.vercel.app@127.0.0.1/\" would satisfy almost any\n          # hand-written regex character class while actually parsing to\n          # host 127.0.0.1, which a naive regex-only check already missed\n          # once.\n          candidate=$(grep -oE 'https://[^[:space:]\"]+' \"$LOG_FILE\" | tail -1)\n          if [ -z \"$candidate\" ]; then\n            echo \"::error::deploy succeeded but no https:// URL was found in its output\"\n            exit 1\n          fi\n          host=$(node -e 'try { process.stdout.write(new URL(process.argv[1]).hostname) } catch { process.exit(1) }' \"$candidate\") || host=\"\"\n          if [[ \"$host\" != *.vercel.app ]]; then\n            echo \"::error::extracted URL '$candidate' does not parse to a *.vercel.app host (parsed host: '${host:-<unparseable>}')\"\n            exit 1\n          fi\n          echo \"url=$candidate\" >> \"$GITHUB_OUTPUT\"\n\n  report:\n    name: Report deployment status\n    needs: deploy\n    if: ${{ needs.deploy.outputs.url != '' }}\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    permissions:\n      deployments: write\n    steps:\n      - name: Create GitHub deployment and report status\n        env:\n          # gh reads GH_TOKEN as its auto-auth env var by its own\n          # convention -- the secret feeding it is named\n          # HOLOCRON_DEPLOYMENTS_TOKEN, matching this org's\n          # HOLOCRON_<FEATURE>_TOKEN naming (docs/tokens.md).\n          GH_TOKEN: ${{ secrets.HOLOCRON_DEPLOYMENTS_TOKEN }}\n          # The PR's head BRANCH, not its SHA — GitHub's PR \"Environments\"\n          # widget associates a Deployment with a PR by matching `ref` to\n          # the PR's own branch name, not by SHA. GitHub still resolves\n          # and records the exact commit as the deployment's own `.sha`\n          # field from this ref, so delivery.previewCheck's `sha` input\n          # (read from `github.event.deployment.sha`) stays accurate.\n          REF: ${{ github.event.pull_request.head.ref }}\n          URL: ${{ needs.deploy.outputs.url }}\n        run: |\n          if [ -z \"$GH_TOKEN\" ]; then\n            echo \"::error::HOLOCRON_DEPLOYMENTS_TOKEN secret is not set -- posting this status with the default GITHUB_TOKEN would not trigger a deployment_status-triggered check\"\n            exit 1\n          fi\n\n          post_status() {\n            gh api \"repos/${GITHUB_REPOSITORY}/deployments/${deploy_id}/statuses\" \\\n              --method POST --field state=\"$1\" --field environment_url=\"$URL\" >/dev/null\n          }\n          latest_status() {\n            gh api \"repos/${GITHUB_REPOSITORY}/deployments/${deploy_id}/statuses\" --jq '.[0].state // empty' 2>/dev/null\n          }\n\n          payload=$(printf '{\"ref\":\"%s\",\"environment\":\"Preview\",\"description\":\"Vercel Preview (file deploy)\",\"production_environment\":false,\"auto_merge\":false,\"required_contexts\":[]}' \"$REF\")\n          deploy_id=\"\"\n          for attempt in 1 2 3; do\n            deploy_id=$(echo \"$payload\" | gh api \"repos/${GITHUB_REPOSITORY}/deployments\" --method POST --input - | jq -r '.id // empty')\n            if [ -n \"$deploy_id\" ]; then break; fi\n            echo \"deployment creation failed (attempt ${attempt}/3) -- retrying...\" >&2\n            sleep 5\n          done\n          if [ -z \"$deploy_id\" ]; then\n            echo \"::error::failed to create a GitHub deployment after 3 attempts -- Vercel already has the preview, but nothing will report or check it\"\n            exit 1\n          fi\n\n          for attempt in 1 2 3; do\n            if post_status success; then\n              exit 0\n            fi\n            # The POST may have actually succeeded server-side even though\n            # this client call reported failure (e.g. a dropped connection\n            # after GitHub processed it) — checked before retrying, so a\n            # transient client-side error never posts a second success and\n            # fires delivery.previewCheck twice for the same preview.\n            if [ \"$(latest_status)\" = \"success\" ]; then\n              exit 0\n            fi\n            echo \"status POST failed (attempt ${attempt}/3) for deployment ${deploy_id} -- retrying...\" >&2\n            sleep 5\n          done\n\n          # Exhausted retries — one last attempt to mark the deployment\n          # failed rather than leaving it permanently \"pending\" in GitHub's\n          # UI; best-effort, its own failure doesn't change this step's\n          # already-failed outcome.\n          post_status error || true\n          echo \"::error::failed to post a success status for deployment ${deploy_id} after 3 attempts -- marked it failed instead of leaving it pending\"\n          exit 1\n";
+var delivery_previewDeploy_default$1 = "name: Preview Deploy\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      cwd:\n        description: Directory to run the delivery.previewDeploy task from — the opted-in package's own directory in a monorepo. Defaults to the repo root.\n        required: false\n        type: string\n        default: \".\"\n    secrets:\n      VERCEL_TOKEN:\n        required: false\n      HOLOCRON_DEPLOYMENTS_TOKEN:\n        description: >\n          A dedicated fine-grained PAT (Deployments: read/write only — see\n          docs/tokens.md), not the default GITHUB_TOKEN — GitHub does not\n          start a new workflow run for a deployment_status event created\n          using a run's own GITHUB_TOKEN, which would make a\n          deployment_status-triggered check (e.g. delivery.previewCheck)\n          silently never fire. No existing HOLOCRON_<FEATURE>_TOKEN carries\n          the Deployments permission, so `secrets: inherit` on the thin\n          caller forwards nothing for this unless a repo/org secret\n          literally named HOLOCRON_DEPLOYMENTS_TOKEN has been provisioned.\n        required: false\n\njobs:\n  # Two jobs, deliberately not one: \"report\" never checks out the repo at\n  # all, so it never runs a single line of this PR's own code. \"deploy\"\n  # does — it has to, to build and stage the preview — and runs with\n  # VERCEL_TOKEN present for that (tracked as a residual risk, #1020: the\n  # build step still runs this monorepo's own PR-affectable CLI build,\n  # pre-review). Without the split, a malicious build/stage script could\n  # persist a `gh` shim onto $GITHUB_PATH (or similar runner-state\n  # tampering) that a LATER step in the SAME job — the one that finally\n  # gets GH_TOKEN — would then execute instead of the real `gh` CLI,\n  # stealing that token too. Separate jobs run on separate, fresh\n  # runners; \"report\" has nothing of the first job's runner state to\n  # inherit.\n  deploy:\n    name: Deploy preview\n    runs-on: ubuntu-latest\n    # Setup/build/stage, plus the deploy capability's own\n    # wait-for-ready polling (up to 10 minutes by itself) — 10 would kill\n    # this before that polling could even finish.\n    timeout-minutes: 20\n    permissions:\n      contents: read\n    outputs:\n      url: ${{ steps.extract.outputs.url }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          # The PR's exact head SHA, not the default pull_request\n          # merge-commit ref — what gets built and deployed must be the\n          # exact commit the PR actually points at.\n          ref: ${{ github.event.pull_request.head.sha }}\n          persist-credentials: false\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - name: Check deploy credentials are available\n        id: creds\n        env:\n          VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}\n        run: |\n          # `secrets` isn't valid in a step `if:` (actionlint-enforced) —\n          # a fork PR never receives this secret, so the deploy step below\n          # skips cleanly on an empty token instead of failing on a\n          # missing credential. That skip is silent to the fork\n          # contributor -- no preview, no explanation why -- tracked\n          # as #1027 rather than fixed here (the real fix needs either\n          # a status comment or a maintainer-gated trusted-deploy path,\n          # not a quick addition to this step).\n          echo \"available=$([ -n \"$VERCEL_TOKEN\" ] && echo true || echo false)\" >> \"$GITHUB_OUTPUT\"\n\n      - name: Deploy preview\n        id: deploy\n        if: ${{ steps.creds.outputs.available == 'true' }}\n        env:\n          VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}\n        uses: theholocron/.github/.github/actions/holocron@main\n        with:\n          command: run delivery.previewDeploy\n          args: --cwd=${{ inputs.cwd }}\n\n      - name: Extract and validate the preview URL\n        id: extract\n        # Only after a real deploy — false both when the step above\n        # failed and when it skipped cleanly (fork PR, no credential).\n        if: ${{ steps.deploy.outcome == 'success' }}\n        env:\n          LOG_FILE: ${{ steps.deploy.outputs.log-file }}\n        run: |\n          # A loose https://\\S+ grab would match whatever text follows an\n          # attacker-chosen URL this log happens to contain; grabbing\n          # candidate text here and separately requiring the PARSED\n          # hostname end in .vercel.app (below) closes that regardless of\n          # how the candidate text is shaped — e.g. a userinfo trick like\n          # \"https://x.vercel.app@127.0.0.1/\" would satisfy almost any\n          # hand-written regex character class while actually parsing to\n          # host 127.0.0.1, which a naive regex-only check already missed\n          # once.\n          candidate=$(grep -oE 'https://[^[:space:]\"]+' \"$LOG_FILE\" | tail -1)\n          if [ -z \"$candidate\" ]; then\n            echo \"::error::deploy succeeded but no https:// URL was found in its output\"\n            exit 1\n          fi\n          host=$(node -e 'try { process.stdout.write(new URL(process.argv[1]).hostname) } catch { process.exit(1) }' \"$candidate\") || host=\"\"\n          if [[ \"$host\" != *.vercel.app ]]; then\n            echo \"::error::extracted URL '$candidate' does not parse to a *.vercel.app host (parsed host: '${host:-<unparseable>}')\"\n            exit 1\n          fi\n          echo \"url=$candidate\" >> \"$GITHUB_OUTPUT\"\n\n  report:\n    name: Report deployment status\n    needs: deploy\n    if: ${{ needs.deploy.outputs.url != '' }}\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    permissions:\n      deployments: write\n    steps:\n      - name: Create GitHub deployment and report status\n        env:\n          # gh reads GH_TOKEN as its auto-auth env var by its own\n          # convention -- the secret feeding it is named\n          # HOLOCRON_DEPLOYMENTS_TOKEN, matching this org's\n          # HOLOCRON_<FEATURE>_TOKEN naming (docs/tokens.md).\n          GH_TOKEN: ${{ secrets.HOLOCRON_DEPLOYMENTS_TOKEN }}\n          # The PR's head BRANCH, not its SHA — GitHub's PR \"Environments\"\n          # widget associates a Deployment with a PR by matching `ref` to\n          # the PR's own branch name, not by SHA. GitHub resolves the\n          # branch to whatever commit it points to AT CREATION TIME,\n          # though, which is a separate moment from the deploy job's own\n          # checkout (below, SHA) -- cross-checked after creation rather\n          # than assumed.\n          REF: ${{ github.event.pull_request.head.ref }}\n          # The exact commit the deploy job checked out and built,\n          # captured from the same frozen event payload this whole run\n          # was triggered by -- stays constant for the run's lifetime\n          # even if the PR branch itself moves while this job is running.\n          SHA: ${{ github.event.pull_request.head.sha }}\n          URL: ${{ needs.deploy.outputs.url }}\n        run: |\n          if [ -z \"$GH_TOKEN\" ]; then\n            echo \"::error::HOLOCRON_DEPLOYMENTS_TOKEN secret is not set -- posting this status with the default GITHUB_TOKEN would not trigger a deployment_status-triggered check\"\n            exit 1\n          fi\n\n          post_status() {\n            gh api \"repos/${GITHUB_REPOSITORY}/deployments/${deploy_id}/statuses\" \\\n              --method POST --field state=\"$1\" --field environment_url=\"$URL\" >/dev/null\n          }\n          latest_status() {\n            gh api \"repos/${GITHUB_REPOSITORY}/deployments/${deploy_id}/statuses\" --jq '.[0].state // empty' 2>/dev/null\n          }\n          # A deployment this very run may have already created\n          # server-side on an earlier attempt whose client-side response\n          # got lost (e.g. a dropped connection) -- reused instead of\n          # creating a second one, which would leave the first\n          # permanently pending (nothing ever posts its status). Scoped\n          # to the last 2 minutes so an OLDER deployment for the same\n          # ref/environment (a previous, unrelated run) is never\n          # mistaken for this one.\n          find_recent_deployment() {\n            gh api \"repos/${GITHUB_REPOSITORY}/deployments\" --method GET -f ref=\"$REF\" -f environment=Preview --jq '\n              [.[] | select((now - (.created_at | fromdateiso8601)) < 120)] | sort_by(.created_at) | last | .id // empty' 2>/dev/null\n          }\n\n          # jq, not a hand-built string -- a branch name containing a\n          # literal double quote (git allows it; GitHub's branch-naming\n          # rules don't forbid it either) would otherwise break out of a\n          # printf-constructed JSON string and produce an invalid payload\n          # gh api can't send.\n          payload=$(jq -n --arg ref \"$REF\" '{\n            ref: $ref,\n            environment: \"Preview\",\n            description: \"Vercel Preview (file deploy)\",\n            production_environment: false,\n            auto_merge: false,\n            required_contexts: []\n          }')\n          deploy_id=\"\"\n          for attempt in 1 2 3; do\n            deploy_id=$(find_recent_deployment)\n            if [ -n \"$deploy_id\" ]; then\n              echo \"reusing deployment ${deploy_id} created by an earlier attempt of this run\" >&2\n              break\n            fi\n            deploy_id=$(echo \"$payload\" | gh api \"repos/${GITHUB_REPOSITORY}/deployments\" --method POST --input - | jq -r '.id // empty')\n            if [ -n \"$deploy_id\" ]; then break; fi\n            echo \"deployment creation failed (attempt ${attempt}/3) -- retrying...\" >&2\n            sleep 5\n          done\n          if [ -z \"$deploy_id\" ]; then\n            echo \"::error::failed to create a GitHub deployment after 3 attempts -- Vercel already has the preview, but nothing will report or check it\"\n            exit 1\n          fi\n\n          # `ref` resolves to the branch's CURRENT tip at creation time --\n          # only guaranteed to be the commit this job actually built if\n          # the branch hasn't moved since the triggering push. A push to\n          # the same PR while this job was still running would otherwise\n          # silently associate the preview URL (built from the OLD\n          # commit) with the NEW commit's deployment. A newer workflow\n          # run already covers that new commit (cancel-in-progress:\n          # false queues rather than cancels), so failing this stale one\n          # loses nothing.\n          deployed_sha=$(gh api \"repos/${GITHUB_REPOSITORY}/deployments/${deploy_id}\" --jq '.sha // empty')\n          if [ \"$deployed_sha\" != \"$SHA\" ]; then\n            echo \"::error::deployment ${deploy_id} resolved to ${deployed_sha}, not the deployed commit ${SHA} -- the PR branch moved while this job was running; a newer run already covers the new commit\"\n            exit 1\n          fi\n\n          for attempt in 1 2 3; do\n            if post_status success; then\n              exit 0\n            fi\n            # The POST may have actually succeeded server-side even though\n            # this client call reported failure (e.g. a dropped connection\n            # after GitHub processed it) — checked before retrying, so a\n            # transient client-side error never posts a second success and\n            # fires delivery.previewCheck twice for the same preview.\n            if [ \"$(latest_status)\" = \"success\" ]; then\n              exit 0\n            fi\n            echo \"status POST failed (attempt ${attempt}/3) for deployment ${deploy_id} -- retrying...\" >&2\n            sleep 5\n          done\n\n          # Exhausted retries — one last attempt to mark the deployment\n          # failed rather than leaving it permanently \"pending\" in GitHub's\n          # UI; best-effort, its own failure doesn't change this step's\n          # already-failed outcome.\n          post_status error || true\n          echo \"::error::failed to post a success status for deployment ${deploy_id} after 3 attempts -- marked it failed instead of leaving it pending\"\n          exit 1\n";
 //#endregion
 //#region src/templates/reusable/delivery.publish.yml
 var delivery_publish_default$1 = "name: Release\n\n# Semantic-release with OIDC Trusted Publishing.\n# actions/setup-node writes a default NODE_AUTH_TOKEN=${{ github.token }}\n# which shadows OIDC auth. We explicitly clear it so npm falls through to\n# the Trusted Publisher OIDC exchange.\n# The calling repo must have a .releaserc.json that configures branches,\n# plugins, and any publish options. npm@11+ is installed to support OIDC.\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      dry-run:\n        description: >\n          When true, runs semantic-release --dry-run: analyzes commits and\n          previews the next release without git writes or publish. Only\n          meaningful for workflow_dispatch triggers; push-triggered runs\n          always run fully.\n        type: boolean\n        required: false\n        default: false\n      post-release:\n        description: >\n          When true, dispatches a readme sync broadcast after a successful\n          release. Enable for packages consumed by other repos via the\n          registry-doc system so downstream README installation blocks\n          stay current.\n        type: boolean\n        required: false\n        default: false\n      run-build:\n        description: Run `pnpm build` before releasing\n        type: boolean\n        required: false\n        default: true\n      deploy-on-release:\n        description: >\n          When true, runs a separate `deploy` job after a successful release\n          (holocron#930): `holocron deploy on-release` deploys every workspace\n          package whose `delivery.deploy` task is `with: { on: release }`, when\n          the release is on its channel and changes its paths. The job is its\n          own check, re-runnable on its own, and gets VERCEL_TOKEN; the release\n          job never sees it. Off by default, so a repo that doesn't deploy from\n          its release never exposes the token.\n        type: boolean\n        required: false\n        default: false\n      sentry-project:\n        description: >\n          Sentry project slug for sourcemap upload and release creation after\n          publishing. Omit to skip the Sentry release step entirely.\n        type: string\n        required: false\n        default: \"\"\n    secrets:\n      HOLOCRON_RELEASE_TOKEN:\n        description: >\n          Fine-grained PAT (Contents + Issues + Pull requests: write) owned by\n          an admin. Required when the default branch is protected by a ruleset —\n          github.token cannot push through rulesets, but an admin PAT can.\n          Takes priority over HOLOCRON_SYNC_TOKEN. Falls back to github.token.\n        required: false\n      HOLOCRON_SYNC_TOKEN:\n        description: >\n          Legacy alias for HOLOCRON_RELEASE_TOKEN — kept for backward compatibility.\n          Prefer HOLOCRON_RELEASE_TOKEN for new repos.\n        required: false\n      HOLOCRON_READ_TOKEN:\n        description: >\n          Fine-grained PAT for read-only GitHub API calls (e.g. resolving git\n          committer identity via `gh api user`). Falls back to github.token.\n        required: false\n      GH_TOKEN:\n        description: >\n          Generic GitHub token fallback for `gh` CLI calls. Used when\n          HOLOCRON_READ_TOKEN is not set.\n        required: false\n      SENTRY_AUTH_TOKEN:\n        description: >\n          Sentry auth token for sourcemap upload and release creation.\n          Required when sentry-project is set. Use the org-level secret.\n        required: false\n      TURBO_TOKEN:\n        required: false\n      VERCEL_TOKEN:\n        description: >\n          Vercel token for the deploy job. Only used when deploy-on-release is\n          true, and only by that job.\n        required: false\n\njobs:\n  release:\n    name: Semantic release\n    permissions:\n      contents: write\n      id-token: write\n      issues: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    outputs:\n      # Read by the deploy job (holocron#930). Empty unless semantic-release\n      # published: `commit` is the release commit, `previous` the commit of\n      # the release before it (to diff against), `channel` the new version's\n      # prerelease identifier (`alpha`), empty for a stable release (`main`).\n      commit: ${{ steps.release.outputs.commit }}\n      previous: ${{ steps.release.outputs.previous }}\n      channel: ${{ steps.release.outputs.channel }}\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    # Do not cancel in-progress releases — a partial release is worse than a slow one.\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n          persist-credentials: false\n          # Use HOLOCRON_RELEASE_TOKEN when available — git push (tags, release commits)\n          # uses the checkout credential, not GITHUB_TOKEN env var. The\n          # built-in github.token cannot push through branch protection rulesets.\n          token: ${{ secrets.HOLOCRON_RELEASE_TOKEN || secrets.HOLOCRON_SYNC_TOKEN || github.token }}\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - name: Configure git identity\n        run: |\n          GIT_NAME=$(gh api user --jq .name 2>/dev/null || echo \"github-actions[bot]\")\n          GIT_EMAIL=$(gh api user --jq '\"\\(.id)+\\(.login)@users.noreply.github.com\"' 2>/dev/null || echo \"41898282+github-actions[bot]@users.noreply.github.com\")\n          git config --global user.name \"$GIT_NAME\"\n          git config --global user.email \"$GIT_EMAIL\"\n          git config --global format.signoff true\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_READ_TOKEN || secrets.GH_TOKEN || github.token }}\n\n      - name: Upgrade npm for OIDC support\n        run: npm install -g npm@11 sigstore\n        # sigstore is required by libnpmpublish/provenance.js at module parse\n        # time — before any config takes effect. Some npm 11.x builds stopped\n        # bundling it; installing it globally into the same prefix ensures it\n        # resolves regardless of npm version. (Discovered 2026-07-09.)\n\n      - run: pnpm build\n        name: Build\n        if: ${{ inputs.run-build == true }}\n\n      - name: Release\n        id: release\n        run: |\n          BEFORE=$(git rev-parse HEAD)\n          PREVIOUS_TAG=$(git describe --tags --abbrev=0 2>/dev/null || true)\n          PREVIOUS=\"\"\n          if [ -n \"$PREVIOUS_TAG\" ]; then PREVIOUS=$(git rev-list -n 1 \"$PREVIOUS_TAG\"); fi\n          if [ \"$DRY_RUN\" = \"true\" ]; then\n            npx semantic-release --dry-run\n          else\n            npx semantic-release\n          fi\n          AFTER=$(git rev-parse HEAD)\n          # semantic-release only commits (`chore(release): … [skip ci]`) when it\n          # actually publishes. That commit gets no CI (and so no coverage\n          # upload), which makes the next PR's `codecov/project` compare a full\n          # report against a stale ancestor — a phantom drop (holocron#644).\n          # Emit the new SHA so the steps below upload coverage for it.\n          if [ \"$BEFORE\" != \"$AFTER\" ]; then\n            echo \"commit=$AFTER\" >> \"$GITHUB_OUTPUT\"\n            echo \"previous=$PREVIOUS\" >> \"$GITHUB_OUTPUT\"\n            # The new version's channel: the prerelease identifier of its tag\n            # (v5.0.0-alpha.108 -> alpha), empty for a stable release.\n            VERSION=$(git describe --tags --abbrev=0)\n            VERSION=${VERSION#v}\n            CHANNEL=\"\"\n            case \"$VERSION\" in *-*) PRE=${VERSION#*-}; CHANNEL=${PRE%%.*} ;; esac\n            echo \"channel=$CHANNEL\" >> \"$GITHUB_OUTPUT\"\n          fi\n        env:\n          DRY_RUN: ${{ inputs.dry-run }}\n          # Prefer HOLOCRON_RELEASE_TOKEN (fine-grained PAT, Contents+Issues+PRs write,\n          # owned by an admin with ruleset bypass) so @semantic-release/git can\n          # push the version-bump commit through branch protection. Falls back to\n          # HOLOCRON_SYNC_TOKEN (legacy) then github.token for unprotected repos.\n          GITHUB_TOKEN: ${{ secrets.HOLOCRON_RELEASE_TOKEN || secrets.HOLOCRON_SYNC_TOKEN || github.token }}\n          HUSKY: \"0\"\n          NPM_CONFIG_PROVENANCE: true\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Coverage for the release commit\n        if: ${{ steps.release.outputs.commit != '' }}\n        with:\n          task: verification.unitTests\n\n      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0\n        name: Upload release-commit coverage to Codecov\n        if: ${{ steps.release.outputs.commit != '' }}\n        # fail_ci_if_error makes a failed upload fail this step, so it is visible, but\n        # continue-on-error keeps it from failing the job: the release has already\n        # published, and the Sentry release steps below must still run (holocron#934).\n        continue-on-error: true\n        with:\n          use_oidc: true\n          fail_ci_if_error: true\n          override_commit: ${{ steps.release.outputs.commit }}\n          override_branch: ${{ github.ref_name }}\n\n      - name: Get release version\n        id: release_version\n        if: ${{ inputs.sentry-project != '' && inputs.dry-run != true }}\n        env:\n          SENTRY_PROJECT: ${{ inputs.sentry-project }}\n        run: |\n          TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo \"\")\n          if [ -n \"$TAG\" ]; then\n            echo \"release=${SENTRY_PROJECT}@${TAG#v}\" >> \"$GITHUB_OUTPUT\"\n          fi\n\n      - name: Create Sentry release\n        if: ${{ inputs.sentry-project != '' && steps.release_version.outputs.release != '' && inputs.dry-run != true }}\n        uses: getsentry/action-release@ff07929a6537bac57790c3451cf4d364aca38528 # v3\n        env:\n          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}\n          SENTRY_ORG: theholocron\n          SENTRY_PROJECT: ${{ inputs.sentry-project }}\n        with:\n          environment: production\n          version: ${{ steps.release_version.outputs.release }}\n          sourcemaps: \"**/dist\"\n\n  deploy:\n    name: Deploy\n    needs: release\n    # Only after a release that actually published (`commit` is empty on a dry\n    # run or when nothing was released). A failed deploy fails only this job:\n    # the release is already on npm, and this job re-runs on its own.\n    if: ${{ inputs.deploy-on-release == true && inputs.dry-run != true && needs.release.outputs.commit != '' }}\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout the release commit\n        with:\n          ref: ${{ needs.release.outputs.commit }}\n          fetch-depth: 0\n          persist-credentials: false\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Deploy packages that deploy on release\n        env:\n          VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}\n        with:\n          command: deploy on-release\n          args: >-\n            --channel=${{ needs.release.outputs.channel }}\n            --from=${{ needs.release.outputs.previous }}\n            --to=${{ needs.release.outputs.commit }}\n\n  sync-readme:\n    name: Post-release readme sync\n    needs: release\n    if: ${{ inputs.post-release == true && inputs.dry-run != true }}\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    steps:\n      - name: Trigger broadcast readme sync\n        run: |\n          gh workflow run sync-dispatch.yml \\\n            --repo theholocron/.github \\\n            --field \"steps=readme\"\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN }}\n";
@@ -869,11 +870,11 @@ function turboConfig(config) {
 		} : turbo;
 	}
 	if (Object.keys(tasks).length === 0) return null;
-	return `${JSON.stringify({
+	return stringifyJson({
 		$schema: "https://turborepo.org/schema.json",
 		globalDependencies: GLOBAL_DEPENDENCIES,
 		tasks
-	}, null, 2)}\n`;
+	});
 }
 /**
 * Fixes #692: `turboConfig()` writes a `turbo.json` the moment *any* task in
@@ -1014,7 +1015,7 @@ function ensureTurboDependency(packageJson, workspaceYaml) {
 		devDependencies
 	};
 	return {
-		content: `${JSON.stringify(updated, null, 2)}\n`,
+		content: stringifyJson(updated, { like: packageJson }),
 		changed: true
 	};
 }
@@ -1980,6 +1981,47 @@ function createAstromech(options) {
 //#endregion
 //#region src/generators/tsconfig.ts
 /**
+* `tsconfig.json` generation — Bucket B (config-resolution workstream, #676):
+* the file must stay committed (the TypeScript language server discovers it
+* directly from disk, no `--config` override mechanism to hand it a path
+* instead), but its content is fully derivable, so it's generated rather
+* than hand-authored — the same category as `.editorconfig`
+* ({@link "./templates/configs/editorconfig/create-config.js" createConfig})
+* and {@link codecovConfig}.
+*
+* Surveyed every package-level `tsconfig.json` across the org (`holocron`,
+* `clients`, `utils` — 20+ packages). `extends: "@theholocron/tsconfig/
+* node-lts"`, `compilerOptions.baseUrl: "./"`, `compilerOptions.outDir:
+* "./dist"`, `include: ["src/**\/*.ts"]`, and `exclude: ["node_modules",
+* "dist"]` are uniform in every one — safe defaults here. `paths` (a `@/*`
+* → `./src/*` import alias) is a real per-package choice, present in
+* roughly 40% of packages checked — an opt-in parameter, not a default.
+*
+* Two fields checked and deliberately *not* absorbed as defaults, unlike
+* `eslint-config`'s `tsconfigRootDir`/`settings.node` (which turned out
+* redundant with the shared package's own behavior, `configs`#461):
+* `compilerOptions.module`/`moduleResolution` (only `@theholocron/cli`
+* overrides these, to `esnext`/`bundler` — a genuine deviation from the
+* shared `node-lts` preset's `nodenext`/`nodenext`, needed for its bundler
+* tooling, not something every package should inherit) and
+* `compilerOptions.rootDir` (present in exactly two packages, always the
+* same value `./src` that `include` already implies — an unnecessary
+* override wherever it appears, not a pattern worth generalizing).
+*
+* Monorepo *root* `tsconfig.json` (a TS project-references "solution
+* file" — `holocron`'s own root is `{ files: [], references: [...] }`,
+* listing which packages to build) is a structurally different, genuinely
+* per-repo document — out of scope here, same as Bucket C content.
+*
+* Not yet wired into `holocron repo setup`'s per-package write loop (every
+* other Bucket B file there is a single repo-root file, safely
+* overwritten every run — `tsconfig.json` is per-package, and most
+* packages' files still carry real hand-authored content today, not yet
+* migrated to a fully-generated state). That per-package iteration +
+* safe-migration design is `#680`'s job, not duplicated here — this is
+* the generator itself, ready for it to call.
+*/
+/**
 * A package-level `tsconfig.json` — the uniform shape confirmed across
 * every package checked, parameterized only by the two fields that
 * genuinely vary (`display`, `paths`). No scaffold/workflow header (matches
@@ -2002,7 +2044,7 @@ function createTsconfig(options) {
 		include: ["src/**/*.ts"],
 		exclude: ["node_modules", "dist"]
 	};
-	return JSON.stringify(config, null, 2) + "\n";
+	return stringifyJson(config);
 }
 //#endregion
 //#region src/tasks/deploy-on-release.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theholocron/astromech",
-  "version": "5.0.0-alpha.145",
+  "version": "5.0.0-alpha.147",
   "description": "The Holocron task runner — one task manifest drives `holocron run`, `holocron run ci`, the CI workflows, package.json scripts, linters, and required checks.",
   "keywords": [
     "ci",
@@ -37,7 +37,8 @@
     "dist"
   ],
   "dependencies": {
-    "@theholocron/datapad": "5.0.0-alpha.145"
+    "@theholocron/json-utils": "^1.10.0",
+    "@theholocron/datapad": "5.0.0-alpha.147"
   },
   "devDependencies": {
     "@theholocron/eslint-config": "^8.7.1",
@@ -53,7 +54,7 @@
     "tsdown": "^0.22.14",
     "typescript": "^5.9.3",
     "vitest": "^4.1.11",
-    "@theholocron/rollup-plugin-transform-template": "5.0.0-alpha.145"
+    "@theholocron/rollup-plugin-transform-template": "5.0.0-alpha.147"
   },
   "engines": {
     "node": ">=22"