@theholocron/astromech 5.0.0-alpha.147 → 5.0.0-alpha.148

package/dist/config/index.d.mts

@@ -1,4 +1,4 @@
-import { i as normalizeTaskEntry, n as TaskEntry, r as TasksConfig, t as TaskConfigItem } from "../schema-BDld3xq1.mjs";
+import { n as TaskEntry, r as TasksConfig, t as TaskConfigItem } from "../schema.type-BUiSrwS5.mjs";
 //#region src/config/define.d.ts
 /**
  * Typed identity helper for `astromech.config.ts`:
@@ -14,13 +14,6 @@ import { i as normalizeTaskEntry, n as TaskEntry, r as TasksConfig, t as TaskCon
 declare const defineConfig: <C extends TasksConfig>(config: C) => C;
 //#endregion
 //#region src/config/load.d.ts
-/**
- * The `tasks` value in each source. A dedicated `astromech.config.*`
- * default-exports the full {@link TasksConfig} object; the `tasks` key of
- * `holocron.config.*` is the bare item array (it mirrors the old
- * `workflows` key). Either form is accepted from either source.
- */
-type TasksInput = TasksConfig | TaskConfigItem[];
 /**
  * Resolve the task manifest for a repo: the `tasks` key of
  * `holocron.config.*`, then a dedicated `astromech.config.*` merged on
@@ -32,6 +25,17 @@ type TasksInput = TasksConfig | TaskConfigItem[];
  * boundary; see `@theholocron/datapad`'s own doc comment).
  */
 declare function loadTasksConfig(cwd: string): Promise<TasksConfig>;
+//#endregion
+//#region src/config/load.type.d.ts
+/**
+ * The `tasks` value in each source. A dedicated `astromech.config.*`
+ * default-exports the full {@link TasksConfig} object; the `tasks` key of
+ * `holocron.config.*` is the bare item array (it mirrors the old
+ * `workflows` key). Either form is accepted from either source.
+ */
+type TasksInput = TasksConfig | TaskConfigItem[];
+//#endregion
+//#region src/config/merge-tasks-layers.d.ts
 /**
  * The merge step of {@link loadTasksConfig}, for callers that load the two
  * sources some other way (Sentinel reads them from the GitHub API, not
@@ -41,4 +45,16 @@ declare function loadTasksConfig(cwd: string): Promise<TasksConfig>;
  */
 declare function mergeTasksLayers(parentTasks: TasksInput | undefined, dedicated: TasksInput | undefined): TasksConfig;
 //#endregion
+//#region src/config/schema.d.ts
+/**
+ * The `tasks` config shape — the single manifest of what a repo runs.
+ * Read from a dedicated `astromech.config.*` file or the `tasks` key of
+ * `holocron.config.*` (see {@link loadTasksConfig}).
+ *
+ * Runtime validation is the loader's job, not this type's — the type only
+ * describes what an author writes.
+ */
+/** Normalise a `TaskConfigItem` to a full {@link TaskEntry} with defaults applied. */
+declare function normalizeTaskEntry(item: TaskConfigItem): Required<Pick<TaskEntry, "name" | "ci" | "local">> & TaskEntry;
+//#endregion
 export { type TaskConfigItem, type TaskEntry, type TasksConfig, defineConfig, loadTasksConfig, mergeTasksLayers, normalizeTaskEntry };

package/dist/config/index.mjs

@@ -1,4 +1,4 @@
-import { n as mergeTasksLayers, r as normalizeTaskEntry, t as loadTasksConfig } from "../load-ytspboBj.mjs";
+import { n as mergeTasksLayers, r as normalizeTaskEntry, t as loadTasksConfig } from "../load-BqpxDjMJ.mjs";
 import { createDefineConfig } from "@theholocron/datapad";
 //#region src/config/define.ts
 /**

package/dist/index.d.mts

@@ -1,55 +1,5 @@
-import { r as TasksConfig } from "./schema-BDld3xq1.mjs";
-//#region src/generators/github-action-thin-callers.d.ts
-/**
- * Workflow templates + thin-caller generation.
- *
- * `WORKFLOW_TEMPLATES` holds each reusable `.github/workflows/<name>.yml`
- * (synced to `theholocron/.github`); `generateThinCallerContent` wraps one
- * into the thin caller `holocron repo setup` / `holocron repo sync` write locally.
- */
-declare const WORKFLOW_TEMPLATES: Record<string, string>;
-declare const KNOWN_WORKFLOWS: Set<string>;
-/**
- * The GitHub status-check context a `required` task contributes to branch
- * protection. Format: `"{workflow name} / {job name}"`.
- *
- * Most of these are single-job workflows now (D3's decomposition split what
- * used to be multi-job `lint`/`audit` into one task per concern) — the
- * context names that job directly, no `Conclusion` aggregator needed; a
- * single job's own conclusion already *is* the workflow's conclusion.
- * `Conclusion` fan-in jobs are kept only where a task genuinely has several
- * conditionally-run jobs feeding one required check:
- * `verification.unitTests` (unit / Storybook / Chromatic / interaction /
- * user-flow, each gated by its own `run-*` input) and
- * `platform.repoValidation` (its three script jobs all must pass). Only
- * merge-gating workflows are listed. `astromech.requiredChecks()` reads this
- * for every `required` task.
- */
-declare const WORKFLOW_CHECK_CONTEXTS: Partial<Record<string, string>>;
-/**
- * Generate the thin caller content for a workflow, optionally injecting or
- * merging `with:` overrides into the jobs block.
- *
- * Two strategies are used depending on the template:
- * - Templates that already have a `with:` block (e.g. lint):
- *   the override entries are merged in, replacing existing keys and appending
- *   new ones.
- * - Templates that end with `    secrets: inherit`: a new `with:` block is
- *   injected immediately before `secrets: inherit`.
- * If neither pattern matches the template, a warning is emitted and the
- * base template is returned unchanged.
- */
-declare function generateThinCallerContent(name: string, withOverrides?: Record<string, unknown>, additionalPaths?: string[],
-/** Optional sink for the "could not inject `with:`" warning. */
-logger?: {
-  warn(obj: Record<string, unknown>, msg: string): void;
-},
-/**
- * `with:` key → a `# comment` line rendered immediately above that entry.
- * Only honored when injecting a fresh `with:` block (no template today
- * ships one), which is the path `lint` takes.
- */
-comments?: Record<string, string>): string;
+import { r as TasksConfig } from "./schema.type-BUiSrwS5.mjs";
+//#region src/generators/github-action-thin-callers.type.d.ts
 interface PreviewConfig {
   /** Cloudflare Pages project name shared across all repos for previews. */
   project: string;
@@ -72,46 +22,8 @@ interface OrgContext {
   /** Project name — injected as the `name` input to the deploy reusable when `docs: true`. */
   repoName?: string;
 }
-/**
- * Extract the Cloudflare Pages preview config from a deploy workflow's `with:` object.
- *
- * Accepts three forms:
- * - `preview: true` — derive both project and domain from org context
- * - `preview: { project: "..." }` — explicit project; domain derived from context if omitted
- * - `preview: { project: "...", domain: "..." }` — fully explicit
- *
- * Returns null when `preview:` is absent, false, or can't be resolved.
- */
-declare function extractPreviewConfig(raw: Record<string, unknown>, ctx?: OrgContext): PreviewConfig | null;
-/**
- * Generate the full thin-caller YAML for a `deploy.yml` that handles both
- * production (push to main → GitHub Pages) and preview (pull_request →
- * Cloudflare Pages) in a single file.
- *
- * Both jobs receive the same docs/storybook `with:` inputs. If the per-repo
- * config supplies `cloudflare-project` it is forwarded; otherwise the reusable
- * falls back to the `CLOUDFLARE_PAGES_PROJECT` org variable — set that once and
- * all repos with a `deploy` workflow get previews without per-repo config.
- */
-declare function generateCombinedDeployContent(deployWith: Record<string, unknown>, paths: string[], preview: Pick<PreviewConfig, "project">): string;
-/**
- * Expand structured with-values to flat GitHub Actions inputs before
- * generating the thin caller. Handles:
- *   - deploy shorthand: docs/storybook → type + storybook-projects
- *   - preview: stripped (handled separately via extractPreviewConfig)
- *   - run-chromatic object → run-chromatic: true + chromatic-projects
- *   - plain arrays → JSON-stringified for YAML scalar quoting
- *
- * Used by both `holocron repo setup` and `sync-workflow-templates`.
- */
-declare function normalizeWorkflowWith(raw: Record<string, unknown>): Record<string, unknown>;
-/**
- * Derive on.push.paths entries from the deploy with: shorthand.
- * Used by both `holocron repo setup` and `sync-workflow-templates`.
- */
-declare function deriveDeployPaths(raw: Record<string, unknown>): string[];
 //#endregion
-//#region src/generators/turbo.d.ts
+//#region src/generators/turbo.type.d.ts
 interface EnsureRootWorkspaceMemberResult {
   content: string;
   changed: boolean;
@@ -121,36 +33,7 @@ interface EnsureTurboDependencyResult {
   changed: boolean;
 }
 //#endregion
-//#region src/tasks/run/run.d.ts
-/**
- * `holocron run <task> [job] [-- <passthrough>]` — run a registry task (or one
- * of its sub-jobs) locally.
- *
- * A `job` argument only applies to tasks that declare `jobs`; for any other
- * task it is folded back into the passthrough (`holocron run delivery.build
- * src/`).
- *
- * Resolution:
- *
- *   J. job given                              → TASKS[task].jobs[job].local (unknown job → exit 1)
- *   1. turbo.json defines the task            → `turbo run <task>`
- *   2. package.json has a `<task>` script     → `<pm> run <task>`
- *      (unless it's the `holocron run …` thin caller — that recurses)
- *   3. TASKS[task].local resolves             → `<tool> <args> <org-flags> <passthrough>`
- *   3b. TASKS[task].linterGroup               → run each resolved linter natively (see below)
- *   4. TASKS[task].jobs has entries           → run each job in declared order
- *   5. TASKS[task].local === null             → "enforced in CI" (skip, even with --required)
- *   5b. known task, nothing resolved          → "no <task> task" (exit 0, or 1 with --required)
- *   6. unknown task                           → "unknown task" (exit 1)
- *
- * A `linterGroup` task (`sourceQuality.staticAnalysis`, etc.) runs its fixed
- * set of `linters.ts` entries, each still gated by that linter's own
- * `detect`/`always` rule — every entry runs its `localBin` natively when
- * found on PATH. Missing tools are flagged; the exit code is the worst of
- * the lot. Unlike the old single `lint` task, this check runs *after*
- * turbo/`package.json` resolution (step 3b, not step 0) — a `linterGroup`
- * task is a normal turbo-delegatable task like any other.
- */
+//#region src/tasks/run/run.type.d.ts
 /** Minimal structural logger — `@theholocron/observability`'s `Logger` satisfies it. */
 interface RunLogger {
   debug(obj: Record<string, unknown>, msg?: string): void;
@@ -202,9 +85,8 @@ interface RunTaskReport {
   command?: string;
   message?: string;
 }
-declare function runTask(input: RunTaskInput): RunTaskReport;
 //#endregion
-//#region src/tasks/ci.d.ts
+//#region src/tasks/ci.type.d.ts
 interface CiOptions {
   /** Print the plan without running anything. */
   dryRun?: boolean;
@@ -229,9 +111,8 @@ interface CiInput extends RunDeps, CiOptions {
   cwd: string;
   config: TasksConfig;
 }
-declare function runCi(input: CiInput): CiReport;
 //#endregion
-//#region src/tasks/group.d.ts
+//#region src/tasks/group.type.d.ts
 interface GroupOptions {
   /** Print the resolved commands without running anything. */
   dryRun?: boolean;
@@ -255,11 +136,8 @@ interface GroupInput extends RunDeps, GroupOptions {
   /** The bare namespace, e.g. `"sourceQuality"` — matched against `"sourceQuality."`-prefixed task names. */
   namespace: string;
 }
-/** Every configured task whose name starts with `"<namespace>."`, in manifest declaration order. */
-declare function matchNamespace(config: TasksConfig, namespace: string): string[];
-declare function runGroup(input: GroupInput): GroupReport;
 //#endregion
-//#region src/astromech.d.ts
+//#region src/astromech.type.d.ts
 interface AstromechOptions {
   /** Repo root. */
   cwd: string;
@@ -395,23 +273,19 @@ interface Astromech {
    */
   ensureTurboDependency(packageJson: string, workspaceYaml: string): EnsureTurboDependencyResult;
 }
+//#endregion
+//#region src/astromech.d.ts
 declare function createAstromech(options: AstromechOptions): Astromech;
 //#endregion
-//#region src/generators/codecov.d.ts
-/**
- * `codecov.yml` generation — a manifest-derived artifact (component `paths`
- * come from workspace packages; the status targets track the `test` task's
- * coverage setup), the same category as the reusable `test.yml` this package
- * also generates. Moved out of `@theholocron/cli` (theholocron/holocron#650)
- * — `holocron repo setup`'s codecov step now calls {@link codecovConfig} instead
- * of importing this logic directly.
- */
+//#region src/generators/codecov.type.d.ts
 interface WorkspacePackage {
   slug: string;
   name: string;
   /** Which workspace root the package was discovered under. Defaults to `"packages"`. */
   dir?: "packages" | "apps" | "plugins";
 }
+//#endregion
+//#region src/generators/codecov.d.ts
 declare function codecovComponentBlock(packages: WorkspacePackage[]): string;
 /**
  * Ensure every codecov status default carries `if_not_found: success`, so an
@@ -470,52 +344,94 @@ declare const WORKFLOW_TEMPLATE_PROPERTIES: Record<string, string>;
  */
 declare function reusableTemplates(): Map<string, string>;
 //#endregion
-//#region src/generators/required-checks.d.ts
-/** Ordered (task contexts in {@link CI_ORDER}, then extras), de-duplicated. */
-declare function requiredChecks(config: TasksConfig): string[];
-//#endregion
-//#region src/generators/tsconfig.d.ts
+//#region src/generators/github-action-thin-callers.d.ts
+declare const WORKFLOW_TEMPLATES: Record<string, string>;
+declare const KNOWN_WORKFLOWS: Set<string>;
 /**
- * `tsconfig.json` generation — Bucket B (config-resolution workstream, #676):
- * the file must stay committed (the TypeScript language server discovers it
- * directly from disk, no `--config` override mechanism to hand it a path
- * instead), but its content is fully derivable, so it's generated rather
- * than hand-authored — the same category as `.editorconfig`
- * ({@link "./templates/configs/editorconfig/create-config.js" createConfig})
- * and {@link codecovConfig}.
+ * The GitHub status-check context a `required` task contributes to branch
+ * protection. Format: `"{workflow name} / {job name}"`.
  *
- * Surveyed every package-level `tsconfig.json` across the org (`holocron`,
- * `clients`, `utils` — 20+ packages). `extends: "@theholocron/tsconfig/
- * node-lts"`, `compilerOptions.baseUrl: "./"`, `compilerOptions.outDir:
- * "./dist"`, `include: ["src/**\/*.ts"]`, and `exclude: ["node_modules",
- * "dist"]` are uniform in every one — safe defaults here. `paths` (a `@/*`
- * → `./src/*` import alias) is a real per-package choice, present in
- * roughly 40% of packages checked — an opt-in parameter, not a default.
+ * Most of these are single-job workflows now (D3's decomposition split what
+ * used to be multi-job `lint`/`audit` into one task per concern) — the
+ * context names that job directly, no `Conclusion` aggregator needed; a
+ * single job's own conclusion already *is* the workflow's conclusion.
+ * `Conclusion` fan-in jobs are kept only where a task genuinely has several
+ * conditionally-run jobs feeding one required check:
+ * `verification.unitTests` (unit / Storybook / Chromatic / interaction /
+ * user-flow, each gated by its own `run-*` input) and
+ * `platform.repoValidation` (its three script jobs all must pass). Only
+ * merge-gating workflows are listed. `astromech.requiredChecks()` reads this
+ * for every `required` task.
+ */
+declare const WORKFLOW_CHECK_CONTEXTS: Partial<Record<string, string>>;
+/**
+ * Generate the thin caller content for a workflow, optionally injecting or
+ * merging `with:` overrides into the jobs block.
+ *
+ * Two strategies are used depending on the template:
+ * - Templates that already have a `with:` block (e.g. lint):
+ *   the override entries are merged in, replacing existing keys and appending
+ *   new ones.
+ * - Templates that end with `    secrets: inherit`: a new `with:` block is
+ *   injected immediately before `secrets: inherit`.
+ * If neither pattern matches the template, a warning is emitted and the
+ * base template is returned unchanged.
+ */
+declare function generateThinCallerContent(name: string, withOverrides?: Record<string, unknown>, additionalPaths?: string[],
+/** Optional sink for the "could not inject `with:`" warning. */
+logger?: {
+  warn(obj: Record<string, unknown>, msg: string): void;
+},
+/**
+ * `with:` key → a `# comment` line rendered immediately above that entry.
+ * Only honored when injecting a fresh `with:` block (no template today
+ * ships one), which is the path `lint` takes.
+ */
+comments?: Record<string, string>): string;
+/**
+ * Extract the Cloudflare Pages preview config from a deploy workflow's `with:` object.
+ *
+ * Accepts three forms:
+ * - `preview: true` — derive both project and domain from org context
+ * - `preview: { project: "..." }` — explicit project; domain derived from context if omitted
+ * - `preview: { project: "...", domain: "..." }` — fully explicit
  *
- * Two fields checked and deliberately *not* absorbed as defaults, unlike
- * `eslint-config`'s `tsconfigRootDir`/`settings.node` (which turned out
- * redundant with the shared package's own behavior, `configs`#461):
- * `compilerOptions.module`/`moduleResolution` (only `@theholocron/cli`
- * overrides these, to `esnext`/`bundler` — a genuine deviation from the
- * shared `node-lts` preset's `nodenext`/`nodenext`, needed for its bundler
- * tooling, not something every package should inherit) and
- * `compilerOptions.rootDir` (present in exactly two packages, always the
- * same value `./src` that `include` already implies — an unnecessary
- * override wherever it appears, not a pattern worth generalizing).
+ * Returns null when `preview:` is absent, false, or can't be resolved.
+ */
+declare function extractPreviewConfig(raw: Record<string, unknown>, ctx?: OrgContext): PreviewConfig | null;
+/**
+ * Generate the full thin-caller YAML for a `deploy.yml` that handles both
+ * production (push to main → GitHub Pages) and preview (pull_request →
+ * Cloudflare Pages) in a single file.
  *
- * Monorepo *root* `tsconfig.json` (a TS project-references "solution
- * file" — `holocron`'s own root is `{ files: [], references: [...] }`,
- * listing which packages to build) is a structurally different, genuinely
- * per-repo document — out of scope here, same as Bucket C content.
+ * Both jobs receive the same docs/storybook `with:` inputs. If the per-repo
+ * config supplies `cloudflare-project` it is forwarded; otherwise the reusable
+ * falls back to the `CLOUDFLARE_PAGES_PROJECT` org variable — set that once and
+ * all repos with a `deploy` workflow get previews without per-repo config.
+ */
+declare function generateCombinedDeployContent(deployWith: Record<string, unknown>, paths: string[], preview: Pick<PreviewConfig, "project">): string;
+/**
+ * Expand structured with-values to flat GitHub Actions inputs before
+ * generating the thin caller. Handles:
+ *   - deploy shorthand: docs/storybook → type + storybook-projects
+ *   - preview: stripped (handled separately via extractPreviewConfig)
+ *   - run-chromatic object → run-chromatic: true + chromatic-projects
+ *   - plain arrays → JSON-stringified for YAML scalar quoting
  *
- * Not yet wired into `holocron repo setup`'s per-package write loop (every
- * other Bucket B file there is a single repo-root file, safely
- * overwritten every run — `tsconfig.json` is per-package, and most
- * packages' files still carry real hand-authored content today, not yet
- * migrated to a fully-generated state). That per-package iteration +
- * safe-migration design is `#680`'s job, not duplicated here — this is
- * the generator itself, ready for it to call.
+ * Used by both `holocron repo setup` and `sync-workflow-templates`.
+ */
+declare function normalizeWorkflowWith(raw: Record<string, unknown>): Record<string, unknown>;
+/**
+ * Derive on.push.paths entries from the deploy with: shorthand.
+ * Used by both `holocron repo setup` and `sync-workflow-templates`.
  */
+declare function deriveDeployPaths(raw: Record<string, unknown>): string[];
+//#endregion
+//#region src/generators/required-checks.d.ts
+/** Ordered (task contexts in {@link CI_ORDER}, then extras), de-duplicated. */
+declare function requiredChecks(config: TasksConfig): string[];
+//#endregion
+//#region src/generators/tsconfig.type.d.ts
 interface TsconfigOptions {
   /** Human-readable name for the `display` field — the package's own name is the usual choice. */
   display: string;
@@ -532,6 +448,8 @@ interface TsconfigOptions {
    */
   paths?: boolean;
 }
+//#endregion
+//#region src/generators/tsconfig.d.ts
 /**
  * A package-level `tsconfig.json` — the uniform shape confirmed across
  * every package checked, parameterized only by the two fields that
@@ -543,28 +461,7 @@ interface TsconfigOptions {
  */
 declare function createTsconfig(options: TsconfigOptions): string;
 //#endregion
-//#region src/registry.d.ts
-/**
- * The task registry — how each task runs *locally*, without GitHub
- * Actions. `holocron run <task>` and `holocron run ci` resolve against this;
- * adding a task here gives every repo that task.
- *
- * Keyed identically to the workflow templates — a task IS a workflow. This
- * is the canonical vocabulary table (epic #672, D11): every other artifact
- * (`KNOWN_TASKS`, `thin-callers.ts`'s `KNOWN_WORKFLOWS`/`WORKFLOW_CHECK_CONTEXTS`,
- * `CI_ORDER`) derives from these keys rather than hand-duplicating them —
- * including the future GitHub App (#679), which imports this same table for
- * config-schema validation instead of reimplementing its own copy.
- *
- * Task names are an intent-facing vocabulary (`verification.*`,
- * `sourceQuality.*`, `security.*`, `delivery.*`, `platform.*`,
- * `knowledge.*`), not tool names — `eslint`/`vitest`/`tsdown`/… stay
- * internal to this file and `theholocron/configs`. See
- * `docs/wiki/specifications/tech-vocabulary-rename.spec.md` (#675) for the full mapping and
- * the reasoning behind each namespace and decomposition.
- *
- * Spec: `docs/wiki/specifications/tech-astromech-task-runner.spec.md` (epic #581).
- */
+//#region src/registry.type.d.ts
 /** How to run one task (or job) locally. */
 interface LocalRunner {
   /** Binary to invoke — resolved from `node_modules/.bin` then PATH. */
@@ -640,6 +537,29 @@ interface TaskDef {
   /** Turborepo fan-out config for this task — see {@link TurboTaskConfig}. Omitted for whole-repo, non-fan-out tasks. */
   turbo?: TurboTaskConfig;
 }
+//#endregion
+//#region src/registry.d.ts
+/**
+ * The task registry — how each task runs *locally*, without GitHub
+ * Actions. `holocron run <task>` and `holocron run ci` resolve against this;
+ * adding a task here gives every repo that task.
+ *
+ * Keyed identically to the workflow templates — a task IS a workflow. This
+ * is the canonical vocabulary table (epic #672, D11): every other artifact
+ * (`KNOWN_TASKS`, `thin-callers.ts`'s `KNOWN_WORKFLOWS`/`WORKFLOW_CHECK_CONTEXTS`,
+ * `CI_ORDER`) derives from these keys rather than hand-duplicating them —
+ * including the future GitHub App (#679), which imports this same table for
+ * config-schema validation instead of reimplementing its own copy.
+ *
+ * Task names are an intent-facing vocabulary (`verification.*`,
+ * `sourceQuality.*`, `security.*`, `delivery.*`, `platform.*`,
+ * `knowledge.*`), not tool names — `eslint`/`vitest`/`tsdown`/… stay
+ * internal to this file and `theholocron/configs`. See
+ * `docs/wiki/specifications/tech-vocabulary-rename.spec.md` (#675) for the full mapping and
+ * the reasoning behind each namespace and decomposition.
+ *
+ * Spec: `docs/wiki/specifications/tech-astromech-task-runner.spec.md` (epic #581).
+ */
 declare const TASKS: Record<string, TaskDef>;
 /** Every task name the registry knows. */
 declare const KNOWN_TASKS: Set<string>;
@@ -651,17 +571,24 @@ declare const KNOWN_TASKS: Set<string>;
  */
 declare const CI_ORDER: string[];
 //#endregion
-//#region src/tasks/deploy-on-release.d.ts
+//#region src/tasks/ci.d.ts
+declare function runCi(input: CiInput): CiReport;
+//#endregion
+//#region src/utils/default-run.type.d.ts
 interface SpawnResult {
   status: number | null;
   stdout: string;
   stderr: string;
 }
 type Run = (command: string, args: string[], options: Record<string, unknown>) => SpawnResult;
+//#endregion
+//#region src/tasks/deploy-on-release/workspace-packages.type.d.ts
 interface Tree {
   readJson: (path: string) => unknown;
   listDirs: (path: string) => string[];
 }
+//#endregion
+//#region src/tasks/deploy-on-release/deploy-on-release.type.d.ts
 interface DeployOnReleaseOptions {
   cwd: string;
   /** The release's channel: its prerelease identifier (`alpha`); empty or `main` for a stable release. */
@@ -691,6 +618,8 @@ interface DeployOnReleaseReport {
   status: "ok" | "fail" | "skip";
   results: DeployOnReleaseResult[];
 }
+//#endregion
+//#region src/tasks/deploy-on-release/deploy-on-release.d.ts
 /**
  * Deploys every package whose manifest declares a release-time deploy that
  * applies to this release. Never throws for a deploy problem: each package's
@@ -698,4 +627,14 @@ interface DeployOnReleaseReport {
  */
 declare function deployOnRelease(options: DeployOnReleaseOptions, { run, readJson, listDirs, sleep, now, loadTasks }?: DeployOnReleaseDeps): Promise<DeployOnReleaseReport>;
 //#endregion
+//#region src/tasks/group.d.ts
+declare function runGroup(input: GroupInput): GroupReport;
+//#endregion
+//#region src/tasks/match-namespace.d.ts
+/** Every configured task whose name starts with `"<namespace>."`, in manifest declaration order. */
+declare function matchNamespace(config: TasksConfig, namespace: string): string[];
+//#endregion
+//#region src/tasks/run/run.d.ts
+declare function runTask(input: RunTaskInput): RunTaskReport;
+//#endregion
 export { type Astromech, type AstromechOptions, CI_ORDER, type CiJobReport, type CiOptions, type CiReport, type DeployOnReleaseOptions, type DeployOnReleaseReport, type DeployOnReleaseResult, type ExecFn, type GroupJobReport, type GroupOptions, type GroupReport, type JobDef, KNOWN_TASKS, KNOWN_WORKFLOWS, type LocalRunner, type OrgContext, type PreviewConfig, REUSABLE_ACTIONS, REUSABLE_WORKFLOWS, type RunLogger, type RunOptions, type RunTaskInput, type RunTaskReport, TASKS, type TaskDef, type TsconfigOptions, WORKFLOW_CHECK_CONTEXTS, WORKFLOW_TEMPLATES, WORKFLOW_TEMPLATE_PROPERTIES, type WorkspacePackage, codecovComponentBlock, codecovConfig, createAstromech, createCodecovConfig, createTsconfig, deployOnRelease, deriveDeployPaths, ensureIfNotFound, extractPreviewConfig, generateCombinedDeployContent, generateThinCallerContent, matchNamespace, mergeCodecovComponents, normalizeWorkflowWith, readWorkspacePackages, requiredChecks, reusableTemplates, runCi, runGroup, runTask };

package/dist/index.mjs

@@ -1,8 +1,10 @@
-import { r as normalizeTaskEntry, t as loadTasksConfig } from "./load-ytspboBj.mjs";
-import { spawnSync } from "node:child_process";
+import { r as normalizeTaskEntry, t as loadTasksConfig } from "./load-BqpxDjMJ.mjs";
 import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { join, relative } from "node:path";
 import { stringifyJson } from "@theholocron/json-utils";
+import { dependencyNames, detectPackageManager, readPackageJsonSync } from "@theholocron/pkg-utils";
+import { spawnSync } from "node:child_process";
+import { findExecutableSync } from "@theholocron/fs-utils";
 //#region src/templates/codecov/codecov.yml
 var codecov_default = "codecov:\n  require_ci_to_pass: true\n\ncoverage:\n  precision: 2\n  round: down\n  status:\n    project:\n      default:\n        target: auto\n        threshold: 2%\n        # Infra-only PRs (dep bumps, config, lockfile) touch no coverable code,\n        # so codecov produces no report to compare. Pass instead of blocking\n        # forever on a required check that will never post.\n        if_not_found: success\n    patch:\n      default:\n        target: 80%\n        if_not_found: success\n\ncomment:\n  layout: \"reach,diff,flags,components\"\n  behavior: default\n  require_changes: true\n\ncomponent_management:\n  default_rules:\n    statuses:\n      - type: patch\n        target: 80%\n        if_not_found: success\n  individual_components:\n";
 //#endregion
@@ -608,6 +610,27 @@ function reusableTemplates() {
 }
 //#endregion
 //#region src/registry.ts
+/**
+* The task registry — how each task runs *locally*, without GitHub
+* Actions. `holocron run <task>` and `holocron run ci` resolve against this;
+* adding a task here gives every repo that task.
+*
+* Keyed identically to the workflow templates — a task IS a workflow. This
+* is the canonical vocabulary table (epic #672, D11): every other artifact
+* (`KNOWN_TASKS`, `thin-callers.ts`'s `KNOWN_WORKFLOWS`/`WORKFLOW_CHECK_CONTEXTS`,
+* `CI_ORDER`) derives from these keys rather than hand-duplicating them —
+* including the future GitHub App (#679), which imports this same table for
+* config-schema validation instead of reimplementing its own copy.
+*
+* Task names are an intent-facing vocabulary (`verification.*`,
+* `sourceQuality.*`, `security.*`, `delivery.*`, `platform.*`,
+* `knowledge.*`), not tool names — `eslint`/`vitest`/`tsdown`/… stay
+* internal to this file and `theholocron/configs`. See
+* `docs/wiki/specifications/tech-vocabulary-rename.spec.md` (#675) for the full mapping and
+* the reasoning behind each namespace and decomposition.
+*
+* Spec: `docs/wiki/specifications/tech-astromech-task-runner.spec.md` (epic #581).
+*/
 const TASKS = {
 	"verification.unitTests": {
 		local: {
@@ -1022,6 +1045,15 @@ function ensureTurboDependency(packageJson, workspaceYaml) {
 //#endregion
 //#region src/tasks/run/linters.ts
 /**
+* The linter registry — one list of linter names (from `config.tasks`'
+* `{ name: "lint", linters: [...] }`, or auto-detected) maps to both the
+* CI super-linter `VALIDATE_*` env and the native local run. This table is
+* the single source of truth for that mapping; {@link superLinterConfig}
+* (CI) and the `holocron run lint` aggregate (local) both read it.
+*
+* Spec: `docs/wiki/specifications/tech-astromech-task-runner.spec.md` "Lint parity".
+*/
+/**
 * Known linters, in execution order. `always` entries are the current
 * hard-coded super-linter baseline; `prettier` is always-on because the org
 * applies it universally (super-linter only lints files that exist).
@@ -1165,7 +1197,79 @@ function resolveLinters(opts) {
 	}));
 }
 //#endregion
-//#region src/tasks/run/resolver.ts
+//#region src/tasks/run/resolve-bin.ts
+/** `<cwd>/node_modules/.bin/<tool>` when it exists, else the bare `tool` name (left to `PATH`). */
+function resolveBin(cwd, tool, fileExists) {
+	const local = join(cwd, "node_modules", ".bin", tool);
+	return fileExists(local) ? local : tool;
+}
+//#endregion
+//#region src/tasks/run/resolve-runner.ts
+const mkRunner = (tool, args = []) => ({
+	tool,
+	args
+});
+/**
+* Resolve `{ tool, args }` for a runner, applying `detect[]` against repo
+* files, falling back (#750) to each candidate's `tool` name against
+* `package.json`'s own declared dependencies when neither matches by
+* filename. Only called for `tool` / `detect` runners — the caller handles
+* `command` runners itself, so `local.detect` is present whenever
+* `local.tool` is not.
+*
+* The dependency fallback matters once a Bucket A migration (#680) deletes
+* a build tool's own config file (`tsdown.config.ts`, `vite.config.ts`, …):
+* that file was the *only* signal `detect[]` had to offer, so removing it
+* used to make `delivery.build` report "no task for this repo" and silently
+* skip the build, even though the tool is still very much in use — a
+* package can't actually build with `tsdown` without it in
+* `dependencies`/`devDependencies`, so that's a signal at least as reliable
+* as the config file, and one deleting the file doesn't remove.
+*
+* **Per-candidate, not two full passes** (#750 follow-up — the first
+* shipped version got this wrong): `delivery.build`'s own `detect[]` ends
+* with `{ when: /^tsconfig\.json$/, tool: "tsc" }` as its last-resort
+* fallback, and `tsconfig.json` exists in essentially every package
+* regardless of build tool. A "check every candidate's filename, *then*
+* check every candidate's dependency" two-pass design would let that
+* always-present fallback file win over a real `tsdown`/`vite`/`rollup`
+* dependency match, the moment the earlier candidates' own config files are
+* gone — exactly backwards. Checking `(file match) || (dependency match)`
+* together for each candidate before moving to the next preserves the
+* intended precedence: a real signal for an *earlier* candidate, by either
+* means, still wins over a later candidate's mere filename presence.
+*/
+function resolveRunner(local, cwd, listDir, readFile) {
+	if (local.tool) return mkRunner(local.tool, local.args);
+	let files;
+	try {
+		files = listDir(cwd);
+	} catch {
+		files = [];
+	}
+	const deps = dependencyNames(readPackageJsonSync(cwd, { readFile }));
+	for (const candidate of local.detect) if (files.some((f) => candidate.when.test(f)) || deps.has(candidate.tool)) return mkRunner(candidate.tool, candidate.args);
+}
+//#endregion
+//#region src/tasks/run/resolve-export-entry.ts
+/**
+* Unwrap a `package.json#exports` subpath entry down to its file path —
+* either a bare string, or an object with condition keys (`import`,
+* `default`, `require`, …) that may themselves nest one level (`{ import: {
+* types, default } }`, the shape every `@theholocron/*-config` package
+* actually uses). Prefers `import` (this org ships ESM), then `default`,
+* then `require` as a last resort.
+*/
+function resolveExportEntry(entry) {
+	if (typeof entry === "string") return entry;
+	if (entry === null || typeof entry !== "object") return void 0;
+	const conditions = entry;
+	const value = conditions.import ?? conditions.default ?? conditions.require;
+	if (typeof value === "string") return value;
+	if (typeof value === "object" && value !== null) return resolveExportEntry(value);
+}
+//#endregion
+//#region src/tasks/run/tool-configs.ts
 /**
 * `library` is every mapped tool's org-wide default variant today — every
 * currently-migrated repo (`holocron`, `clients`, `utils`, `configs`,
@@ -1242,7 +1346,42 @@ const LOCAL_CONFIG_FILES = {
 		"commitlint.config.cjs"
 	]
 };
-new Set(Object.keys(TOOL_CONFIGS));
+//#endregion
+//#region src/tasks/run/resolve-tool-config.ts
+/**
+* Resolves the absolute path to a Bucket A tool's shared `@theholocron/*-config`
+* entry point, installed in the consuming repo's own `node_modules` — and the
+* CLI flag(s) to hand it via (`--config`, `--extends`, …). `run.ts` splices the
+* result into the command it builds for a tool/detect runner or a linter-group
+* entry, right after the tool's own args.
+*
+* Every mapped package's resolved entry point already carries a ready-to-use
+* default export (a plain re-export for `prettier`/`commitlint`; an invoked,
+* zero-arg preset for `eslint`/`vitest`/`tsdown` — verified end-to-end against
+* each tool's real `--config`/`--extends` loader, not just the file's shape).
+* A repo doesn't need this package installed at all — every lookup degrades to
+* `[]` (no flag added, the tool falls back to its own auto-discovery of a
+* local file, unchanged from today) rather than throwing.
+*
+* **Local file wins.** A `<tool>.config.*` sitting in `cwd` (whether it's
+* pure boilerplate or has real per-package customization on top of the
+* shared bundle, e.g. `mergeConfig(base, { test: { coverage: { exclude }
+* } })`) always skips the splice, even when the shared package is also
+* installed — an explicit `--config <shared path>` flag beats a tool's own
+* auto-discovery every time, so splicing it unconditionally would silently
+* discard that customization the file is still sitting right there on disk.
+* The shared bundle is only ever the fallback for a package with *no* local
+* file at all — that's still the "delete the file to go fully shared" path
+* this was designed for (#676); it just isn't unconditional (#749).
+*
+* `semantic-release`, `devmoji`, `editorconfig-checker`, and `knip` are
+* deliberately absent — `semantic-release-config`'s `defineConfig()` needs
+* real per-repo data (branches, npm options) a static `--extends <path>` can't
+* carry; `devmoji` runs through a git hook template, not `holocron run
+* <task>`; `editorconfig-checker` has no shared-config package yet; `knip` is
+* repo-specific by nature, never a shared-config candidate. See
+* `.notes/tech-config-resolution.spec.md` (#676).
+*/
 /**
 * `<flag> <absolute path>` for `tool`, resolved against `cwd`'s
 * `node_modules` — or `[]` when the tool isn't mapped, `cwd` already has its
@@ -1255,9 +1394,9 @@ new Set(Object.keys(TOOL_CONFIGS));
 function resolveToolConfig(tool, cwd, deps) {
 	const spec = TOOL_CONFIGS[tool];
 	if (!spec) return [];
-	if ((LOCAL_CONFIG_FILES[tool] ?? []).some((name) => deps.fileExists(joinPath(cwd, name)))) return [];
-	const pkgDir = joinPath(cwd, "node_modules", ...spec.package.split("/"));
-	const pkgJsonPath = joinPath(pkgDir, "package.json");
+	if ((LOCAL_CONFIG_FILES[tool] ?? []).some((name) => deps.fileExists(join(cwd, name)))) return [];
+	const pkgDir = join(cwd, "node_modules", ...spec.package.split("/"));
+	const pkgJsonPath = join(pkgDir, "package.json");
 	if (!deps.fileExists(pkgJsonPath)) return [];
 	let pkg;
 	try {
@@ -1267,36 +1406,21 @@ function resolveToolConfig(tool, cwd, deps) {
 	}
 	const relative = resolveExportEntry(pkg.exports?.[spec.exportPath]);
 	if (!relative) return [];
-	const absolute = joinPath(pkgDir, relative.replace(/^\.\//, ""));
+	const absolute = join(pkgDir, relative);
 	if (!deps.fileExists(absolute)) return [];
 	return [...spec.flag, absolute];
 }
-/**
-* Unwrap a `package.json#exports` subpath entry down to its file path —
-* either a bare string, or an object with condition keys (`import`,
-* `default`, `require`, …) that may themselves nest one level (`{ import: {
-* types, default } }`, the shape every `@theholocron/*-config` package
-* actually uses). Prefers `import` (this org ships ESM), then `default`,
-* then `require` as a last resort.
-*/
-function resolveExportEntry(entry) {
-	if (typeof entry === "string") return entry;
-	if (entry === null || typeof entry !== "object") return void 0;
-	const conditions = entry;
-	const value = conditions.import ?? conditions.default ?? conditions.require;
-	if (typeof value === "string") return value;
-	if (typeof value === "object" && value !== null) return resolveExportEntry(value);
-}
-/**
-* A minimal, POSIX-safe `path.join` — avoids importing `node:path` just for
-* this. Every path in play here is either already POSIX (a `package.json`
-* `exports` value, always forward-slashed regardless of platform) or built
-* from platform-neutral segments (`cwd`, `"node_modules"`, a scoped package
-* name split on `/`), so a manual join is safe and keeps this module
-* dependency-free like the rest of `run.ts`'s helpers.
-*/
-function joinPath(...segments) {
-	return segments.map((s, i) => i === 0 ? s.replace(/\/+$/, "") : s.replace(/^\/+|\/+$/g, "")).filter(Boolean).join("/");
+//#endregion
+//#region src/tasks/run/turbo-defines-task.ts
+/** `true` when `<cwd>/turbo.json` declares `task` (under `tasks`, or turbo 1.x's `pipeline`). */
+function turboDefinesTask(cwd, task, readFile, fileExists) {
+	if (!fileExists(join(cwd, "turbo.json"))) return false;
+	try {
+		const turbo = JSON.parse(readFile(join(cwd, "turbo.json")));
+		return Boolean(turbo.tasks?.[task] ?? turbo.pipeline?.[task]);
+	} catch {
+		return false;
+	}
 }
 //#endregion
 //#region src/tasks/run/run.ts
@@ -1405,8 +1529,11 @@ function runTask(input) {
 		];
 		return run(resolveBin(cwd, "turbo", fileExists), args);
 	}
-	const script = packageJsonScript(cwd, task, readFile, fileExists);
-	if (script && !/^holocron run\b/.test(script.trim())) return run(packageManager(cwd, readFile, fileExists), [
+	const script = readPackageJsonSync(cwd, { readFile })?.scripts?.[task];
+	if (script && !/^holocron run\b/.test(script.trim())) return run(detectPackageManager(cwd, {
+		readFile,
+		fileExists
+	}), [
 		"run",
 		task,
 		...passthrough.length ? ["--", ...passthrough] : []
@@ -1628,92 +1755,6 @@ function runLinterGroup(input, names, passthrough) {
 		command
 	};
 }
-const mkRunner = (tool, args = []) => ({
-	tool,
-	args
-});
-/**
-* Resolve `{ tool, args }` for a runner, applying `detect[]` against repo
-* files, falling back (#750) to each candidate's `tool` name against
-* `package.json`'s own declared dependencies when neither matches by
-* filename. Only called for `tool` / `detect` runners — the caller handles
-* `command` runners itself, so `local.detect` is present whenever
-* `local.tool` is not.
-*
-* The dependency fallback matters once a Bucket A migration (#680) deletes
-* a build tool's own config file (`tsdown.config.ts`, `vite.config.ts`, …):
-* that file was the *only* signal `detect[]` had to offer, so removing it
-* used to make `delivery.build` report "no task for this repo" and silently
-* skip the build, even though the tool is still very much in use — a
-* package can't actually build with `tsdown` without it in
-* `dependencies`/`devDependencies`, so that's a signal at least as reliable
-* as the config file, and one deleting the file doesn't remove.
-*
-* **Per-candidate, not two full passes** (#750 follow-up — the first
-* shipped version got this wrong): `delivery.build`'s own `detect[]` ends
-* with `{ when: /^tsconfig\.json$/, tool: "tsc" }` as its last-resort
-* fallback, and `tsconfig.json` exists in essentially every package
-* regardless of build tool. A "check every candidate's filename, *then*
-* check every candidate's dependency" two-pass design would let that
-* always-present fallback file win over a real `tsdown`/`vite`/`rollup`
-* dependency match, the moment the earlier candidates' own config files are
-* gone — exactly backwards. Checking `(file match) || (dependency match)`
-* together for each candidate before moving to the next preserves the
-* intended precedence: a real signal for an *earlier* candidate, by either
-* means, still wins over a later candidate's mere filename presence.
-*/
-function resolveRunner(local, cwd, listDir, readFile) {
-	if (local.tool) return mkRunner(local.tool, local.args);
-	let files;
-	try {
-		files = listDir(cwd);
-	} catch {
-		files = [];
-	}
-	const deps = packageJsonDependencies(cwd, readFile);
-	for (const candidate of local.detect) if (files.some((f) => candidate.when.test(f)) || deps.has(candidate.tool)) return mkRunner(candidate.tool, candidate.args);
-}
-/** Every key from `package.json`'s `dependencies` + `devDependencies`, or an empty set on any read/parse failure. */
-function packageJsonDependencies(cwd, readFile) {
-	try {
-		const pkg = JSON.parse(readFile(join(cwd, "package.json")));
-		return /* @__PURE__ */ new Set([...Object.keys(pkg.dependencies ?? {}), ...Object.keys(pkg.devDependencies ?? {})]);
-	} catch {
-		return /* @__PURE__ */ new Set();
-	}
-}
-function resolveBin(cwd, tool, fileExists) {
-	const local = join(cwd, "node_modules", ".bin", tool);
-	return fileExists(local) ? local : tool;
-}
-function packageManager(cwd, readFile, fileExists) {
-	try {
-		const pkg = JSON.parse(readFile(join(cwd, "package.json")));
-		if (typeof pkg.packageManager === "string") return pkg.packageManager.split("@")[0];
-	} catch {}
-	if (fileExists(join(cwd, "pnpm-lock.yaml"))) return "pnpm";
-	if (fileExists(join(cwd, "bun.lockb"))) return "bun";
-	if (fileExists(join(cwd, "yarn.lock"))) return "yarn";
-	if (fileExists(join(cwd, "package-lock.json"))) return "npm";
-	return "pnpm";
-}
-function turboDefinesTask(cwd, task, readFile, fileExists) {
-	if (!fileExists(join(cwd, "turbo.json"))) return false;
-	try {
-		const turbo = JSON.parse(readFile(join(cwd, "turbo.json")));
-		return Boolean(turbo.tasks?.[task] ?? turbo.pipeline?.[task]);
-	} catch {
-		return false;
-	}
-}
-function packageJsonScript(cwd, task, readFile, fileExists) {
-	if (!fileExists(join(cwd, "package.json"))) return void 0;
-	try {
-		return JSON.parse(readFile(join(cwd, "package.json"))).scripts?.[task];
-	} catch {
-		return;
-	}
-}
 //#endregion
 //#region src/tasks/ci.ts
 /**
@@ -1785,19 +1826,7 @@ function taskName(item) {
 	return typeof item === "string" ? item : item.name;
 }
 //#endregion
-//#region src/tasks/group.ts
-/**
-* `holocron run <namespace>` — run every configured task under one
-* namespace prefix (`sourceQuality.*`, `verification.*`, …) in sequence.
-* `Astromech.run()` falls back here whenever the given name isn't an exact
-* `TASKS` entry but matches the prefix of one or more configured tasks —
-* same "aggregate several real tasks into one report" shape `runCi` already
-* established, scoped to one namespace instead of the merge-gating set.
-*
-* Every task in the namespace always runs — one task's failure never skips
-* the rest, same as `runCi`'s own loop — so a single invocation surfaces
-* every problem in the namespace at once instead of stopping at the first.
-*/
+//#region src/tasks/match-namespace.ts
 /** Every configured task whose name starts with `"<namespace>."`, in manifest declaration order. */
 function matchNamespace(config, namespace) {
 	const prefix = `${namespace}.`;
@@ -1806,6 +1835,8 @@ function matchNamespace(config, namespace) {
 		return names;
 	}, []);
 }
+//#endregion
+//#region src/tasks/group.ts
 function runGroup(input) {
 	const { print, namespace } = input;
 	const names = matchNamespace(input.config, namespace);
@@ -1844,29 +1875,47 @@ function runGroup(input) {
 	};
 }
 //#endregion
-//#region src/astromech.ts
-/**
-* `createAstromech(options)` — the self-contained task runner.
-* `@theholocron/cli` instantiates it once and delegates the `run` /
-* `ci` / workflow-generation commands to it (like `@theholocron/observability`).
-*/
-const noopLogger = {
-	debug() {},
-	warn() {}
-};
+//#region src/utils/default-list-dirs.ts
+const defaultListDirs = (path) => readdirSync(path, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
+//#endregion
+//#region src/utils/default-read-json.ts
+const defaultReadJson = (path) => JSON.parse(readFileSync(path, "utf8"));
+//#endregion
+//#region src/utils/default-run.ts
+const defaultRun = (command, args, opts) => spawnSync(command, args, {
+	encoding: "utf8",
+	...opts
+});
+//#endregion
+//#region src/utils/default-sleep.ts
+const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+//#endregion
+//#region src/utils/exec.ts
+/** Runs `cmd` with the parent's stdio; a signal-killed or unspawnable process reports `-1`. */
 const realExec = (cmd, args, opts) => {
 	return { exitCode: spawnSync(cmd, args, {
 		cwd: opts.cwd,
 		stdio: "inherit"
 	}).status ?? -1 };
 };
+//#endregion
+//#region src/utils/look-path.ts
 /** `node_modules/.bin/<bin>`, else the first `PATH` entry that has it, else `null`. */
-const realLookPath = (cwd, bin) => {
-	const local = join(cwd, "node_modules", ".bin", bin);
-	if (existsSync(local)) return local;
-	for (const dir of (process.env["PATH"] ?? "").split(":")) if (dir && existsSync(join(dir, bin))) return join(dir, bin);
-	return null;
+const realLookPath = (cwd, bin) => findExecutableSync(bin, { path: join(cwd, "node_modules", ".bin") }) ?? findExecutableSync(bin) ?? null;
+//#endregion
+//#region src/utils/noop-logger.ts
+/** The `RunLogger` used when the caller injects none: drops every record. */
+const noopLogger = {
+	debug() {},
+	warn() {}
 };
+//#endregion
+//#region src/astromech.ts
+/**
+* `createAstromech(options)` — the self-contained task runner.
+* `@theholocron/cli` instantiates it once and delegates the `run` /
+* `ci` / workflow-generation commands to it (like `@theholocron/observability`).
+*/
 function createAstromech(options) {
 	const deps = {
 		print: options.print ?? ((line) => console.log(line)),
@@ -2047,78 +2096,22 @@ function createTsconfig(options) {
 	return stringifyJson(config);
 }
 //#endregion
-//#region src/tasks/deploy-on-release.ts
-/**
-* Deploy workspace packages once a release has published (holocron#930).
-*
-* A package opts in with a `delivery.deploy` task in its own `holocron.config`
-* whose `with.on` is `"release"`:
-*
-* ```ts
-* // packages/<app>/holocron.config.ts
-* tasks: [{ name: "delivery.deploy", with: { on: "release", channel: "alpha" } }];
-* ```
-*
-* `channel` defaults to `main` (a stable release); set a prerelease identifier
-* such as `alpha` to deploy those releases instead.
-*
-* The shared `delivery.publish` workflow runs this (`holocron deploy on-release`)
-* as its own `deploy` job after the release job, so a deploy is a separate,
-* re-runnable check rather than a step buried in the release log. Each package
-* with such a task deploys when the release is on its `channel` and changes a file under its paths: the package itself plus its
-* `workspace:*` dependencies ({@link defaultPaths}), or an explicit
-* `with.paths`. It first waits for npm to serve the release's new versions of
-* those dependencies ({@link waitForPublished}) — the registry can lag a version
-* it has just accepted, and the deploy installs them — then runs
-* `pnpm --filter <package> delivery.deploy`.
-*
-* The release is already published by then, so a failed deploy can't undo it;
-* it fails this job instead, loudly and re-runnable on its own. A task is
-* `skip`ped (not failed) only when it doesn't apply to this release.
-*
-* A `delivery.deploy` task with `on: "release"` generates no CI workflow.
-*/
+//#region src/tasks/deploy-on-release/constants.ts
 /** A stable release (no prerelease identifier) is on `main`, the default channel for a task. */
 const MAIN_CHANNEL = "main";
 const DEPLOY_TASK = "delivery.deploy";
 /** How long to wait for npm to serve the release's versions, and how often to ask. */
 const WAIT_TIMEOUT_MS = 3e5;
 const WAIT_INTERVAL_MS = 1e4;
-function scanWorkspaceDir(dirPath, { readJson, listDirs }) {
-	let folders;
-	try {
-		folders = listDirs(dirPath);
-	} catch {
-		return [];
-	}
-	return folders.flatMap((folder) => {
-		try {
-			const manifest = readJson(join(dirPath, folder, "package.json"));
-			if (!manifest.name) return [];
-			return [{
-				name: manifest.name,
-				dir: join(dirPath, folder),
-				version: manifest.version,
-				dependencies: manifest.dependencies ?? {}
-			}];
-		} catch {
-			return [];
-		}
-	});
-}
-/**
-* Every package under `<repoRoot>/packages/*` and `<repoRoot>/plugins/*`
-* with a readable, named `package.json` — `holocron`'s own layout splits
-* vendor plugin packages into `plugins/*`, sibling to `packages/*`.
-*/
-function workspacePackages(repoRoot, tree) {
-	return [...scanWorkspaceDir(join(repoRoot, "packages"), tree), ...scanWorkspaceDir(join(repoRoot, "plugins"), tree)];
-}
+//#endregion
+//#region src/tasks/deploy-on-release/workspace-dependencies.ts
 /** The `workspace:*` dependencies of `pkg`, as workspace packages (with their current version). */
 function workspaceDependencies(pkg, all) {
 	const names = new Set(Object.entries(pkg.dependencies).filter(([, spec]) => String(spec).startsWith("workspace:")).map(([name]) => name));
 	return all.filter((candidate) => names.has(candidate.name));
 }
+//#endregion
+//#region src/tasks/deploy-on-release/default-paths.ts
 /**
 * The paths a release must touch to redeploy `pkg` when its manifest doesn't
 * list them: its own folder plus the folder of every
@@ -2130,6 +2123,8 @@ function workspaceDependencies(pkg, all) {
 function defaultPaths(repoRoot, pkg, all) {
 	return [pkg, ...workspaceDependencies(pkg, all)].map(({ dir }) => `${relative(repoRoot, dir)}/`);
 }
+//#endregion
+//#region src/tasks/deploy-on-release/deploy-targets.ts
 /**
 * The packages whose manifest declares a release-time `delivery.deploy`
 * (`with.on === "release"`), with the task's options resolved.
@@ -2137,7 +2132,7 @@ function defaultPaths(repoRoot, pkg, all) {
 function deployTargets(packages, manifests) {
 	return packages.flatMap((pkg) => (manifests.get(pkg.dir)?.tasks ?? []).flatMap((item) => {
 		const entry = normalizeTaskEntry(item);
-		if (entry.name !== DEPLOY_TASK || entry.with?.["on"] !== "release") return [];
+		if (entry.name !== "delivery.deploy" || entry.with?.["on"] !== "release") return [];
 		const { channel, paths } = entry.with;
 		return [{
 			pkg,
@@ -2146,6 +2141,32 @@ function deployTargets(packages, manifests) {
 		}];
 	}));
 }
+//#endregion
+//#region src/tasks/deploy-on-release/should-deploy.ts
+/**
+* @param channel The release's channel: its prerelease identifier (`alpha`), or `main` for a stable release.
+* @param changedFiles `undefined` when there's no previous release to diff against.
+*/
+function shouldDeploy({ channel, configuredChannel, changedFiles, paths }) {
+	if (channel !== configuredChannel) return {
+		deploy: false,
+		reason: `channel "${channel}" isn't "${configuredChannel}"`
+	};
+	if (changedFiles === void 0) return {
+		deploy: true,
+		reason: "no previous release to diff against"
+	};
+	const touched = changedFiles.find((file) => paths.some((path) => file.startsWith(path)));
+	return touched ? {
+		deploy: true,
+		reason: `the release changes ${touched}`
+	} : {
+		deploy: false,
+		reason: `the release changes nothing under ${paths.join(", ")}`
+	};
+}
+//#endregion
+//#region src/tasks/deploy-on-release/wait-for-published.ts
 /**
 * Waits until npm serves every `name@version` in `packages`, asking with
 * `npm view --prefer-online` (so npm's local cache can't answer for the
@@ -2171,35 +2192,70 @@ async function waitForPublished({ packages, run, sleep, now, cwd, timeoutMs = WA
 		await sleep(intervalMs);
 	}
 }
+//#endregion
+//#region src/tasks/deploy-on-release/workspace-packages.ts
+function scanWorkspaceDir(dirPath, { readJson, listDirs }) {
+	let folders;
+	try {
+		folders = listDirs(dirPath);
+	} catch {
+		return [];
+	}
+	return folders.flatMap((folder) => {
+		try {
+			const manifest = readJson(join(dirPath, folder, "package.json"));
+			if (!manifest.name) return [];
+			return [{
+				name: manifest.name,
+				dir: join(dirPath, folder),
+				version: manifest.version,
+				dependencies: manifest.dependencies ?? {}
+			}];
+		} catch {
+			return [];
+		}
+	});
+}
 /**
-* @param channel The release's channel: its prerelease identifier (`alpha`), or `main` for a stable release.
-* @param changedFiles `undefined` when there's no previous release to diff against.
+* Every package under `<repoRoot>/packages/*` and `<repoRoot>/plugins/*`
+* with a readable, named `package.json` — `holocron`'s own layout splits
+* vendor plugin packages into `plugins/*`, sibling to `packages/*`.
 */
-function shouldDeploy({ channel, configuredChannel, changedFiles, paths }) {
-	if (channel !== configuredChannel) return {
-		deploy: false,
-		reason: `channel "${channel}" isn't "${configuredChannel}"`
-	};
-	if (changedFiles === void 0) return {
-		deploy: true,
-		reason: "no previous release to diff against"
-	};
-	const touched = changedFiles.find((file) => paths.some((path) => file.startsWith(path)));
-	return touched ? {
-		deploy: true,
-		reason: `the release changes ${touched}`
-	} : {
-		deploy: false,
-		reason: `the release changes nothing under ${paths.join(", ")}`
-	};
+function workspacePackages(repoRoot, tree) {
+	return [...scanWorkspaceDir(join(repoRoot, "packages"), tree), ...scanWorkspaceDir(join(repoRoot, "plugins"), tree)];
 }
-const defaultRun = (command, args, opts) => spawnSync(command, args, {
-	encoding: "utf8",
-	...opts
-});
-const defaultReadJson = (path) => JSON.parse(readFileSync(path, "utf8"));
-const defaultListDirs = (path) => readdirSync(path, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
-const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+//#endregion
+//#region src/tasks/deploy-on-release/deploy-on-release.ts
+/**
+* Deploy workspace packages once a release has published (holocron#930).
+*
+* A package opts in with a `delivery.deploy` task in its own `holocron.config`
+* whose `with.on` is `"release"`:
+*
+* ```ts
+* // packages/<app>/holocron.config.ts
+* tasks: [{ name: "delivery.deploy", with: { on: "release", channel: "alpha" } }];
+* ```
+*
+* `channel` defaults to `main` (a stable release); set a prerelease identifier
+* such as `alpha` to deploy those releases instead.
+*
+* The shared `delivery.publish` workflow runs this (`holocron deploy on-release`)
+* as its own `deploy` job after the release job, so a deploy is a separate,
+* re-runnable check rather than a step buried in the release log. Each package
+* with such a task deploys when the release is on its `channel` and changes a file under its paths: the package itself plus its
+* `workspace:*` dependencies ({@link defaultPaths}), or an explicit
+* `with.paths`. It first waits for npm to serve the release's new versions of
+* those dependencies ({@link waitForPublished}) — the registry can lag a version
+* it has just accepted, and the deploy installs them — then runs
+* `pnpm --filter <package> delivery.deploy`.
+*
+* The release is already published by then, so a failed deploy can't undo it;
+* it fails this job instead, loudly and re-runnable on its own. A task is
+* `skip`ped (not failed) only when it doesn't apply to this release.
+*
+* A `delivery.deploy` task with `on: "release"` generates no CI workflow.
+*/
 /**
 * Deploys every package whose manifest declares a release-time deploy that
 * applies to this release. Never throws for a deploy problem: each package's
@@ -2207,7 +2263,7 @@ const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 */
 async function deployOnRelease(options, { run = defaultRun, readJson = defaultReadJson, listDirs = defaultListDirs, sleep = defaultSleep, now = Date.now, loadTasks = loadTasksConfig } = {}) {
 	const { cwd, from, print } = options;
-	const channel = options.channel || MAIN_CHANNEL;
+	const channel = options.channel || "main";
 	const to = options.to ?? "HEAD";
 	const packages = workspacePackages(cwd, {
 		readJson,

package/dist/{load-ytspboBj.mjs → load-BqpxDjMJ.mjs}

@@ -1,5 +1,13 @@
 import { loadConfigFile, mergeConfig } from "@theholocron/datapad";
 //#region src/config/schema.ts
+/**
+* The `tasks` config shape — the single manifest of what a repo runs.
+* Read from a dedicated `astromech.config.*` file or the `tasks` key of
+* `holocron.config.*` (see {@link loadTasksConfig}).
+*
+* Runtime validation is the loader's job, not this type's — the type only
+* describes what an author writes.
+*/
 /** Normalise a `TaskConfigItem` to a full {@link TaskEntry} with defaults applied. */
 function normalizeTaskEntry(item) {
 	return {
@@ -9,6 +17,25 @@ function normalizeTaskEntry(item) {
 	};
 }
 //#endregion
+//#region src/config/coerce-tasks.ts
+/** A bare item array is shorthand for `{ tasks: [...] }`. */
+function coerceTasks(value) {
+	if (value == null) return void 0;
+	return Array.isArray(value) ? { tasks: value } : value;
+}
+//#endregion
+//#region src/config/merge-tasks-layers.ts
+/**
+* The merge step of {@link loadTasksConfig}, for callers that load the two
+* sources some other way (Sentinel reads them from the GitHub API, not
+* from disk, holocron#916): `holocron.config.*`'s `tasks` value first,
+* then a dedicated `astromech.config.*`'s default export merged on top.
+* Either may be `undefined` (source absent); returns `{}` when both are.
+*/
+function mergeTasksLayers(parentTasks, dedicated) {
+	return [coerceTasks(parentTasks), coerceTasks(dedicated)].filter((layer) => layer !== void 0).reduce((acc, layer) => mergeConfig(acc, layer), {});
+}
+//#endregion
 //#region src/config/load.ts
 /**
 * Resolve the task manifest for a repo: the `tasks` key of
@@ -32,19 +59,5 @@ async function loadTasksConfig(cwd) {
 		walkUp: true
 	}))?.config.tasks, dedicated?.config);
 }
-/**
-* The merge step of {@link loadTasksConfig}, for callers that load the two
-* sources some other way (Sentinel reads them from the GitHub API, not
-* from disk, holocron#916): `holocron.config.*`'s `tasks` value first,
-* then a dedicated `astromech.config.*`'s default export merged on top.
-* Either may be `undefined` (source absent); returns `{}` when both are.
-*/
-function mergeTasksLayers(parentTasks, dedicated) {
-	return [coerce(parentTasks), coerce(dedicated)].filter((layer) => layer !== void 0).reduce((acc, layer) => mergeConfig(acc, layer), {});
-}
-function coerce(value) {
-	if (value == null) return void 0;
-	return Array.isArray(value) ? { tasks: value } : value;
-}
 //#endregion
 export { mergeTasksLayers as n, normalizeTaskEntry as r, loadTasksConfig as t };

package/dist/{schema-BDld3xq1.d.mts → schema.type-BUiSrwS5.d.mts}

@@ -1,12 +1,4 @@
-//#region src/config/schema.d.ts
-/**
- * The `tasks` config shape — the single manifest of what a repo runs.
- * Read from a dedicated `astromech.config.*` file or the `tasks` key of
- * `holocron.config.*` (see {@link loadTasksConfig}).
- *
- * Runtime validation is the loader's job, not this type's — the type only
- * describes what an author writes.
- */
+//#region src/config/schema.type.d.ts
 interface TaskEntry {
   /** Registry task name — `verification.unitTests`, `sourceQuality.staticAnalysis`, `delivery.build`, … */
   name: string;
@@ -71,7 +63,5 @@ interface TasksConfig {
     prePush?: boolean;
   };
 }
-/** Normalise a `TaskConfigItem` to a full {@link TaskEntry} with defaults applied. */
-declare function normalizeTaskEntry(item: TaskConfigItem): Required<Pick<TaskEntry, "name" | "ci" | "local">> & TaskEntry;
 //#endregion
-export { normalizeTaskEntry as i, TaskEntry as n, TasksConfig as r, TaskConfigItem as t };
+export { TaskEntry as n, TasksConfig as r, TaskConfigItem as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theholocron/astromech",
-  "version": "5.0.0-alpha.147",
+  "version": "5.0.0-alpha.148",
   "description": "The Holocron task runner — one task manifest drives `holocron run`, `holocron run ci`, the CI workflows, package.json scripts, linters, and required checks.",
   "keywords": [
     "ci",
@@ -37,8 +37,10 @@
     "dist"
   ],
   "dependencies": {
-    "@theholocron/json-utils": "^1.10.0",
-    "@theholocron/datapad": "5.0.0-alpha.147"
+    "@theholocron/fs-utils": "^1.12.0",
+    "@theholocron/json-utils": "^1.12.0",
+    "@theholocron/pkg-utils": "^1.12.0",
+    "@theholocron/datapad": "5.0.0-alpha.148"
   },
   "devDependencies": {
     "@theholocron/eslint-config": "^8.7.1",
@@ -54,7 +56,7 @@
     "tsdown": "^0.22.14",
     "typescript": "^5.9.3",
     "vitest": "^4.1.11",
-    "@theholocron/rollup-plugin-transform-template": "5.0.0-alpha.147"
+    "@theholocron/rollup-plugin-transform-template": "5.0.0-alpha.148"
   },
   "engines": {
     "node": ">=22"