@theholocron/astromech 5.0.0-alpha.20 → 5.0.0-alpha.201

package/dist/index.mjs

@@ -1,8 +1,636 @@
-import { t as normalizeTaskEntry } from "./schema-Cf5dfaDO.mjs";
-import { spawnSync } from "node:child_process";
+import { r as normalizeTaskEntry, t as loadTasksConfig } from "./load-DdHEVFlG.mjs";
+import { n as alexrc_default, t as editorconfig_checker_default } from "./editorconfig-checker-DPejtR5z.mjs";
 import { existsSync, readFileSync, readdirSync } from "node:fs";
-import { join } from "node:path";
-//#region src/registry.ts
+import { dependencyNames, detectPackageManager, listWorkspacePackagesSync, readPackageJsonSync } from "@theholocron/pkg-utils";
+import { stringifyJson } from "@theholocron/json-utils";
+import { join, relative } from "node:path";
+import { spawnSync } from "node:child_process";
+import { findExecutableSync } from "@theholocron/fs-utils";
+//#region src/templates/codecov/codecov.yml
+var codecov_default = "codecov:\n  require_ci_to_pass: true\n\ncoverage:\n  precision: 2\n  round: down\n  status:\n    project:\n      default:\n        target: auto\n        threshold: 2%\n        # Infra-only PRs (dep bumps, config, lockfile) touch no coverable code,\n        # so codecov produces no report to compare. Pass instead of blocking\n        # forever on a required check that will never post.\n        if_not_found: success\n    patch:\n      default:\n        target: 80%\n        if_not_found: success\n\ncomment:\n  layout: \"reach,diff,flags,components\"\n  behavior: default\n  require_changes: true\n\ncomponent_management:\n  default_rules:\n    statuses:\n      - type: patch\n        target: 80%\n        if_not_found: success\n  individual_components:\n";
+//#endregion
+//#region src/generators/codecov/codecov.ts
+/**
+* `codecov.yml` generation — a manifest-derived artifact (component `paths`
+* come from workspace packages; the status targets track the `test` task's
+* coverage setup), the same category as the reusable `test.yml` this package
+* also generates. Moved out of `@theholocron/cli` (theholocron/holocron#650)
+* — `holocron repo setup`'s codecov step now calls {@link codecovConfig} instead
+* of importing this logic directly.
+*/
+const INDIVIDUAL_COMPONENTS_MARKER = "  individual_components:";
+function scaffoldHeader() {
+	return [
+		`# Scaffolded by holocron repo setup — edit this file freely.`,
+		`# Source:  theholocron/holocron · packages/astromech/src/generators/codecov/codecov.ts`,
+		``
+	].join("\n");
+}
+function codecovComponentBlock(packages) {
+	if (packages.length === 0) return "\n    []\n";
+	return "\n" + packages.flatMap(({ slug, dir }) => [
+		`    - component_id: ${slug}`,
+		`      name: "${slug}"`,
+		`      paths:`,
+		`        - ${dir ?? "packages"}/${slug}/**`,
+		``
+	]).join("\n");
+}
+/**
+* Ensure every codecov status default carries `if_not_found: success`, so an
+* infra-only PR (dep bump, config, lockfile — no coverable change) passes
+* instead of hanging forever on a required check codecov never posts.
+*
+* Injects the key on the line after each `target:` that sits inside a status
+* block (`coverage.status.*.default` or a `statuses:` list item — indent ≥ 8,
+* or ≥ 8 for a `- type:` list entry), when the immediate sibling lines do not
+* already declare it.
+*/
+function ensureIfNotFound(yaml) {
+	const lines = yaml.split("\n");
+	const out = [];
+	for (let i = 0; i < lines.length; i++) {
+		const line = lines[i];
+		out.push(line);
+		const m = /^(\s{8,})target:\s+\S+\s*$/.exec(line);
+		if (!m) continue;
+		const indent = m[1];
+		let alreadySet = false;
+		for (let j = i + 1; j < lines.length; j++) {
+			const sib = lines[j];
+			if (sib.trim() === "") continue;
+			const sibIndent = sib.match(/^\s*/)[0].length;
+			if (sibIndent < indent.length) break;
+			if (sibIndent === indent.length && /^\s*if_not_found\s*:/.test(sib)) {
+				alreadySet = true;
+				break;
+			}
+			if (sibIndent === indent.length && /^\s*(- |\w)/.test(sib) && !/^\s*(threshold|flags|paths|branches)\s*:/.test(sib)) break;
+		}
+		if (!alreadySet) out.push(`${indent}if_not_found: success`);
+	}
+	return out.join("\n");
+}
+function mergeCodecovComponents(existing, packages) {
+	const idx = existing.indexOf(INDIVIDUAL_COMPONENTS_MARKER);
+	if (idx === -1) return ensureIfNotFound(existing);
+	return ensureIfNotFound(existing.slice(0, idx + 24)) + codecovComponentBlock(packages);
+}
+/**
+* Every public `packages/*`, `apps/*`, and `plugins/*` workspace, sorted by
+* slug. `[]` when none of the three directories exist. Monorepo templates
+* (Next.js, React, …) ship user-facing code under `apps/` alongside library
+* code under `packages/`; `holocron` itself splits vendor plugin packages
+* into their own `plugins/*` root — every recognized root needs a codecov
+* component so `codecov/patch/<slug>` actually posts for each.
+*/
+function readWorkspacePackages(repoRoot) {
+	return listWorkspacePackagesSync(repoRoot, { roots: [
+		"packages",
+		"apps",
+		"plugins"
+	] }).flatMap(({ name, relativeDir }) => {
+		const [dir, slug] = relativeDir.split("/");
+		return name ? [{
+			slug,
+			name,
+			dir
+		}] : [];
+	}).sort((a, b) => a.slug.localeCompare(b.slug));
+}
+/** A brand-new `codecov.yml` — the scaffold header + the base template + this repo's component list. */
+function createCodecovConfig(packages) {
+	return `${scaffoldHeader()}${codecov_default.trimEnd()}${codecovComponentBlock(packages)}`;
+}
+/**
+* The full pipeline `holocron repo setup` needs: read this repo's public
+* `packages/*`, then either merge them into an `existing` `codecov.yml` or
+* scaffold a new one.
+*/
+function codecovConfig(repoRoot, existing) {
+	const packages = readWorkspacePackages(repoRoot);
+	return existing != null ? mergeCodecovComponents(existing, packages) : createCodecovConfig(packages);
+}
+//#endregion
+//#region src/templates/reusable/actions/auto-commit.yml
+var auto_commit_default = "name: Auto Commit\ndescription: >\n  Commit and push any file changes using stefanzweifel/git-auto-commit-action.\n  If a branch name is provided and differs from the current branch, a new branch\n  is created automatically.\n\ninputs:\n  token:\n    description: >\n      GitHub token with push access to the target branch. Used to authenticate\n      the git remote so the commit can be pushed.\n    required: true\n  branch:\n    description: >\n      Branch to commit to. Leave empty to commit to the current branch (useful\n      in PR contexts). Provide an explicit name (e.g. chore/auto-sync-<sha>) to push\n      to a separate branch.\n    required: false\n    default: \"\"\n  commit-message:\n    description: Commit message.\n    required: true\n  commit-options:\n    description: >\n      Additional options passed to git commit (e.g. --no-verify).\n    required: false\n    default: \"\"\n  commit-user-name:\n    description: Git user.name for the commit.\n    required: false\n    default: \"github-actions[bot]\"\n  commit-user-email:\n    description: Git user.email for the commit.\n    required: false\n    default: \"41898282+github-actions[bot]@users.noreply.github.com\"\n  commit-author:\n    description: >\n      Git author string in \"Name <email>\" format.\n    required: false\n    default: \"github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\"\n\noutputs:\n  changes-detected:\n    description: \"'true' if any files were committed, 'false' otherwise.\"\n    value: ${{ steps.commit.outputs.changes_detected }}\n\nruns:\n  using: composite\n  steps:\n    - name: Configure git remote with token\n      shell: bash\n      run: |\n        REMOTE_URL=$(git remote get-url origin)\n        AUTHED_URL=$(echo \"$REMOTE_URL\" | sed \"s|https://|https://x-access-token:${TOKEN}@|\")\n        git remote set-url origin \"$AUTHED_URL\"\n      env:\n        TOKEN: ${{ inputs.token }}\n\n    - name: Reset branch to current HEAD\n      if: ${{ inputs.branch != '' }}\n      shell: bash\n      run: git checkout -B \"$BRANCH\"\n      env:\n        BRANCH: ${{ inputs.branch }}\n\n    - name: Build signed commit message\n      id: msg\n      shell: bash\n      run: |\n        TRAILER=\"Signed-off-by: ${COMMIT_USER_NAME} <${COMMIT_USER_EMAIL}>\"\n        if echo \"$COMMIT_MESSAGE\" | grep -qF \"$TRAILER\"; then\n          FINAL=\"$COMMIT_MESSAGE\"\n        else\n          FINAL=\"${COMMIT_MESSAGE}\"$'\\n\\n'\"${TRAILER}\"\n        fi\n        {\n          echo \"value<<EOF_TRAILER\"\n          printf '%s' \"$FINAL\"\n          echo \"\"\n          echo \"EOF_TRAILER\"\n        } >> \"$GITHUB_OUTPUT\"\n      env:\n        COMMIT_MESSAGE: ${{ inputs.commit-message }}\n        COMMIT_USER_NAME: ${{ inputs.commit-user-name }}\n        COMMIT_USER_EMAIL: ${{ inputs.commit-user-email }}\n\n    - uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d # v7.2.0\n      id: commit\n      with:\n        branch: ${{ inputs.branch }}\n        commit_message: ${{ steps.msg.outputs.value }}\n        commit_options: ${{ inputs.commit-options }}\n        commit_user_name: ${{ inputs.commit-user-name }}\n        commit_user_email: ${{ inputs.commit-user-email }}\n        commit_author: ${{ inputs.commit-author }}\n";
+//#endregion
+//#region src/templates/reusable/actions/holocron.yml
+var holocron_default = "name: Holocron\ndescription: >\n  Run the Holocron CLI — `holocron run <task> [job]` by default, or any other\n  subcommand via `command:` (`repo sync`, `sync github`, …). Resolves\n  `@theholocron/cli` from `node_modules` (published tarball) or builds it from\n  source when it resolves to an unbuilt workspace checkout (the holocron repo\n  itself). Requires dependencies to be installed already (run the setup action\n  first).\n\ninputs:\n  command:\n    description: >\n      Holocron subcommand. Default `run` — then `task` (and optional `job`)\n      name the manifest task. Set to `repo sync` / `sync github` / … to run that\n      subcommand directly; `args` becomes everything after it.\n    required: false\n    default: run\n  task:\n    description: >\n      Manifest task to run when command is run — typecheck, test, build, audit.\n    required: false\n    default: \"\"\n  job:\n    description: Optional sub-job within the task (e.g. knip, performance for audit).\n    required: false\n    default: \"\"\n  args:\n    description: >\n      For `command: run`, extra arguments forwarded to the tool after `--`.\n      For any other command, the arguments passed straight to it.\n    required: false\n    default: \"\"\n\noutputs:\n  log-file:\n    description: >\n      Path to a file holding the full captured stdout+stderr of this\n      invocation — the same text the live Actions log shows, saved for a\n      caller that wants to ship it elsewhere (e.g. Sentinel's dispatched\n      checks shipping it to Axiom, holocron#769/#794).\n    value: ${{ steps.run.outputs.log-file }}\n\nruns:\n  using: composite\n\n  steps:\n    - name: Build the workspace when the CLI resolves to an unbuilt checkout\n      shell: bash\n      # The holocron repo carries @theholocron/cli as `workspace:*`; its bin\n      # (dist/cli.mjs) does not exist on a fresh checkout. `pnpm build` is a\n      # turbo run — cached and cheap once warm. A no-op everywhere else, where\n      # the published tarball already ships dist/.\n      #\n      # pnpm creates every workspace package's node_modules/.bin/holocron shim\n      # once, during the setup action's earlier `pnpm install` — before this\n      # build has run, so every one of them is silently skipped (\"Failed to\n      # create bin ... ENOENT\"), not just @theholocron/cli's own. That's a\n      # one-time decision: a later build doesn't retroactively fix a shim that\n      # was never created. Re-running `pnpm install` here (fast — the lockfile\n      # hasn't changed, so it only re-links `.bin`) is what actually fixes it,\n      # confirmed against a real cold install: `holocron` stays unresolvable\n      # from inside any package until this second install runs.\n      run: |\n        if [ ! -f node_modules/@theholocron/cli/dist/cli.mjs ]; then\n          echo \"→ @theholocron/cli dist/ missing — building the workspace from source\" >&2\n          pnpm build\n          echo \"→ re-linking node_modules/.bin — pnpm skipped it pre-build\" >&2\n          pnpm install --frozen-lockfile\n        fi\n\n    - name: holocron ${{ inputs.command }} ${{ inputs.task }}\n      id: run\n      shell: bash\n      env:\n        HOLOCRON_COMMAND: ${{ inputs.command }}\n        HOLOCRON_TASK: ${{ inputs.task }}\n        HOLOCRON_JOB: ${{ inputs.job }}\n        HOLOCRON_ARGS: ${{ inputs.args }}\n      run: |\n        if [ \"$HOLOCRON_COMMAND\" = \"run\" ]; then\n          set -- run \"$HOLOCRON_TASK\"\n          [ -n \"$HOLOCRON_JOB\" ] && set -- \"$@\" \"$HOLOCRON_JOB\"\n          # shellcheck disable=SC2086\n          [ -n \"$HOLOCRON_ARGS\" ] && set -- \"$@\" -- $HOLOCRON_ARGS\n        else\n          # `command` may be a multi-word path (`repo sync`, `deploy on-release`):\n          # word-split it so each token is its own argument.\n          # shellcheck disable=SC2086\n          set -- $HOLOCRON_COMMAND $HOLOCRON_ARGS\n        fi\n        # Invoke the built entry directly. `pnpm exec holocron` relies on a\n        # node_modules/.bin/holocron shim that pnpm does not create for a\n        # workspace package whose dist/ was absent at install time (the holocron\n        # repo itself). Resolving the package's main export gives dist/index.mjs;\n        # the bin sits next to it as dist/cli.mjs. This is `require.resolve` from\n        # node_modules — it works in the holocron monorepo AND in every consumer\n        # repo (theholocron/holocron#655), unlike a hard-coded `packages/cli/…`.\n        cli=\"$(dirname \"$(node -e 'process.stdout.write(require.resolve(\"@theholocron/cli\"))')\")/cli.mjs\"\n        if [ ! -f \"$cli\" ]; then\n          echo \"::error::@theholocron/cli entry not found at $cli — is the workspace built?\" >&2\n          exit 1\n        fi\n        echo \"→ $cli $*\" >&2\n        # `tee` keeps the live Actions log streaming exactly as before while\n        # also capturing it to a file callers can ship elsewhere (log-file\n        # output, above). PIPESTATUS[0] -- not $? -- is `node`'s own exit\n        # code; $? after a pipe is tee's, which succeeds even when node fails.\n        log_file=\"${RUNNER_TEMP}/holocron-output.log\"\n        node \"$cli\" \"$@\" 2>&1 | tee \"$log_file\"\n        exit_code=${PIPESTATUS[0]}\n        echo \"log-file=$log_file\" >> \"$GITHUB_OUTPUT\"\n        exit \"$exit_code\"\n";
+//#endregion
+//#region src/templates/reusable/actions/install.yml
+var install_default = "name: Install dependencies\ndescription: Install project dependencies with pnpm frozen lockfile.\n\nruns:\n  using: composite\n\n  steps:\n    - name: Install dependencies\n      if: ${{ hashFiles('pnpm-lock.yaml') != '' }}\n      shell: bash\n      run: pnpm install --frozen-lockfile\n";
+//#endregion
+//#region src/templates/reusable/actions/notify.yml
+var notify_default = "name: Notify\ndescription: >\n  Post a message to a chat channel through an incoming webhook. The request\n  body is Discord-compatible (`content`, `username`, `allowed_mentions`), so\n  the webhook must accept that shape. Does nothing (and never fails the\n  calling job) when no webhook is provided, so repos that haven't set one up\n  are unaffected. Set `strict` for a check whose only purpose is to prove the\n  notification works: it then fails when the webhook is missing or rejects the post.\n\ninputs:\n  webhook:\n    description: >\n      Incoming webhook URL for the target channel.\n      A webhook posts to exactly one channel, so pass the secret for the\n      channel this message belongs in (for example\n      `secrets.HOLOCRON_NOTIFY_WEBHOOK_ALERTS`). Empty = skip.\n    required: false\n    default: \"\"\n  message:\n    description: Message text. Truncated to 2000 characters.\n    required: true\n  mention:\n    description: >\n      Optional role id (digits only) to ping. Only that one role can\n      be mentioned; anything else in the message never pings.\n    required: false\n    default: \"\"\n  username:\n    description: Display name for the post.\n    required: false\n    default: \"Holocron\"\n  strict:\n    description: >\n      \"true\" fails the step when no webhook is set or the post is rejected.\n      Off by default: a notification problem must never fail the job it reports on.\n    required: false\n    default: \"false\"\n\nruns:\n  using: composite\n  steps:\n    - name: Post the notification\n      shell: bash\n      run: |\n        if [ -z \"$WEBHOOK\" ]; then\n          if [ \"$STRICT\" = \"true\" ]; then\n            echo \"::error::No notification webhook set.\"\n            exit 1\n          fi\n          echo \"::notice::No notification webhook set — skipping notification.\"\n          exit 0\n        fi\n        echo \"::add-mask::$WEBHOOK\"\n        # allowed_mentions.parse = [] so message text can never ping @everyone\n        # or a role; only the explicit `mention` role id is allowed through. The\n        # body is built with jq so quotes/newlines in the message can't break the JSON.\n        content=\"$MESSAGE\"\n        roles='[]'\n        # A mention that is not a role id is dropped, which is right for a real\n        # notification but would let a check pass without ever pinging anyone.\n        if [ \"$STRICT\" = \"true\" ] && [ -n \"$MENTION\" ] && ! [[ \"$MENTION\" =~ ^[0-9]+$ ]]; then\n          echo \"::error::The mention is not a role id (digits only).\"\n          exit 1\n        fi\n        if [[ \"$MENTION\" =~ ^[0-9]+$ ]]; then\n          content=\"<@&$MENTION> $MESSAGE\"\n          roles=$(jq -cn --arg r \"$MENTION\" '[$r]')\n        fi\n        body=$(jq -n --arg content \"${content:0:2000}\" --arg username \"$USERNAME\" --argjson roles \"$roles\" \\\n          '{content: $content, username: $username, allowed_mentions: {parse: [], roles: $roles}}')\n        status=$(curl -sS -o /dev/null -w '%{http_code}' --max-time 15 \\\n          -H 'Content-Type: application/json' -d \"$body\" \"$WEBHOOK\" || true)\n        case \"${status:-000}\" in\n          2??) echo \"Notification posted.\" ;;\n          *)\n            if [ \"$STRICT\" = \"true\" ]; then\n              echo \"::error::Notification failed (HTTP ${status:-000}).\"\n              exit 1\n            fi\n            echo \"::warning::Notification failed (HTTP ${status:-000}).\"\n            ;;\n        esac\n      env:\n        WEBHOOK: ${{ inputs.webhook }}\n        MESSAGE: ${{ inputs.message }}\n        MENTION: ${{ inputs.mention }}\n        USERNAME: ${{ inputs.username }}\n        STRICT: ${{ inputs.strict }}\n";
+//#endregion
+//#region src/templates/reusable/actions/setup.yml
+var setup_default = "name: Setup\ndescription: Prepare the environment and install project dependencies.\n\ninputs:\n  node-version:\n    description: Node.js version\n    required: false\n    default: \"22.x\"\n\nruns:\n  using: composite\n\n  steps:\n    - uses: theholocron/.github/.github/actions/setup-node@main\n      with:\n        node-version: ${{ inputs.node-version }}\n\n    - uses: theholocron/.github/.github/actions/install@main\n\n    # `@theholocron/cli`'s `dist/cli.mjs` doesn't exist yet at this point, so\n    # pnpm's workspace bin-linking can't create `node_modules/.bin/holocron`\n    # (silent `WARN ... ENOENT`, not a hard failure). Every package whose\n    # scripts delegate via `holocron run <task> --` then fails at run time\n    # with `holocron: not found` (#698). Same fix the `holocron` composite\n    # action already applies for its own direct invocation (see its \"Build\n    # the workspace when the CLI resolves to an unbuilt checkout\" step) —\n    # mirrored here so it also covers *nested* `holocron run <task> --`\n    # calls from inside package.json scripts, which that action's own guard\n    # doesn't reach. `pnpm build` (not a scoped `--filter`) so the CLI's own\n    # workspace dependencies (e.g. astromech) build\n    # in topological order too — a scoped build skips them and fails.\n    # No-op in every consumer repo, where the published tarball already\n    # ships `dist/`.\n    - name: Build the Holocron CLI\n      shell: bash\n      run: |\n        if [ ! -f node_modules/@theholocron/cli/dist/cli.mjs ]; then\n          echo \"→ @theholocron/cli dist/ missing — building the workspace from source\" >&2\n          pnpm build\n          echo \"→ re-linking node_modules/.bin — pnpm skipped it pre-build\" >&2\n          pnpm install --frozen-lockfile\n        fi\n\n    - name: Cache Turbo artifacts\n      if: ${{ hashFiles('turbo.json') != '' }}\n      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0\n      with:\n        path: .turbo\n        key: turbo-${{ runner.os }}-${{ github.sha }}\n        restore-keys: |\n          turbo-${{ runner.os }}-\n";
+//#endregion
+//#region src/templates/reusable/actions/setup-node.yml
+var setup_node_default = "name: Setup Node\ndescription: Install pnpm and Node.js with pnpm dependency caching.\n\ninputs:\n  node-version:\n    description: Node.js version\n    required: false\n    default: \"22.x\"\nruns:\n  using: composite\n\n  steps:\n    - name: Setup pnpm\n      if: ${{ hashFiles('pnpm-lock.yaml') != '' }}\n      uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4\n\n    - name: Setup Node.js\n      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0\n      with:\n        node-version: ${{ hashFiles('.node-version') != '' && '' || inputs.node-version }}\n        node-version-file: ${{ hashFiles('.node-version') != '' && '.node-version' || '' }}\n        cache: ${{ hashFiles('pnpm-lock.yaml') != '' && 'pnpm' || '' }}\n        # Do NOT add registry-url here. setup-node writes .npmrc with\n        # _authToken=${NODE_AUTH_TOKEN} and sets NPM_CONFIG_USERCONFIG to it.\n        # pnpm reads that file, fails env-var substitution when the token is\n        # empty, and loses auth entirely. Without registry-url, pnpm 10.15+\n        # handles Trusted Publishing via its own native OIDC exchange.\n\n    - name: Add node_modules/.bin to PATH\n      shell: bash\n      run: echo \"$GITHUB_WORKSPACE/node_modules/.bin\" >> $GITHUB_PATH\n";
+//#endregion
+//#region src/templates/reusable/bookkeeping.yml
+var bookkeeping_default$1 = "name: Bookkeeping\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      configuration-path:\n        description: Path to the labeler configuration file in the calling repo\n        type: string\n        required: false\n        default: .github/labeler.yml\n\njobs:\n  label:\n    name: Apply Labels\n    permissions:\n      contents: read\n      issues: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          sparse-checkout: ${{ inputs.configuration-path || '.github/labeler.yml' }}\n          sparse-checkout-cone-mode: false\n\n      - uses: github/issue-labeler@c1b0f9f52a63158c4adc09425e858e87b32e9685 # v3.4\n        if: ${{ github.event_name == 'pull_request' && hashFiles(inputs.configuration-path || '.github/labeler.yml') != '' }}\n        # v3.4 bundles Node 20; allow it to run under Actions' current default.\n        env:\n          ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true\n        with:\n          # Fall back to default path when triggered directly (not via workflow_call)\n          # because inputs.* defaults only apply on workflow_call events.\n          configuration-path: ${{ inputs.configuration-path || '.github/labeler.yml' }}\n          include-title: 1\n          include-body: 0\n          sync-labels: 1\n          enable-versioned-regex: 0\n          repo-token: ${{ github.token }}\n";
+//#endregion
+//#region src/templates/reusable/delivery.build.yml
+var delivery_build_default$1 = "name: Build\n\n# Sanity check that every workspace actually compiles to dist/ — doesn't\n# upload or publish anything. delivery.publish builds again before\n# publishing; this just answers \"does it build?\" on every push/PR.\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  build:\n    name: Build every workspace\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Build\n        with:\n          task: delivery.build\n";
+//#endregion
+//#region src/templates/reusable/delivery.bundleSize.yml
+var delivery_bundleSize_default$1 = "name: Audit the Bundle Size\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      CODECOV_TOKEN:\n        required: false\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  bundle-size:\n    name: Upload bundle stats to Codecov\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n      # Read by the bundle-stats uploader inside `holocron run delivery.build`.\n      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Build and upload bundle stats\n        with:\n          task: delivery.build\n";
+//#endregion
+//#region src/templates/reusable/delivery.deploy.yml
+var delivery_deploy_default$1 = "name: Deploy\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      type:\n        description: \"Type of deployment: docs or storybook\"\n        required: true\n        type: string\n      storybook-projects:\n        description: >\n          JSON array of { \"name\"?, \"workingDir\", \"outputDir\"? } objects for storybook deploys.\n          Each is built via `pnpm -C <workingDir> build:storybook`. If \"name\" is provided the\n          output is placed under `sandbox/<name>/`; omit \"name\" for single-repo deploys and the\n          output lands directly in `sandbox/`.\n        type: string\n        required: false\n        default: \"[]\"\n      build-script:\n        description: pnpm script that builds the Storybook static output (single storybook, type:storybook only)\n        type: string\n        required: false\n        default: build:storybook\n      output-dir:\n        description: Directory where Storybook writes its static output (single storybook, type:storybook only)\n        type: string\n        required: false\n        default: storybook-static\n\njobs:\n  deploy:\n    name: Deploy\n    runs-on: ubuntu-latest\n    permissions:\n      contents: read\n      pages: write\n      id-token: write\n    environment:\n      name: github-pages\n      url: ${{ steps.deployment.outputs.page_url }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - name: Build docs site\n        if: ${{ inputs.type == 'docs' }}\n        run: pnpm -C docs build\n\n      - name: Build Storybook projects\n        if: ${{ inputs.storybook-projects != '[]' }}\n        env:\n          PROJECTS: ${{ inputs.storybook-projects }}\n        run: |\n          echo \"$PROJECTS\" | jq -c '.[]' | while IFS= read -r project; do\n            workingDir=$(echo \"$project\" | jq -r '.workingDir')\n            pnpm -C \"$workingDir\" build:storybook\n          done\n\n      - name: Build Storybook\n        if: ${{ inputs.type == 'storybook' && inputs.storybook-projects == '[]' }}\n        env:\n          BUILD_SCRIPT: ${{ inputs.build-script }}\n        run: pnpm run \"$BUILD_SCRIPT\"\n\n      - name: Assemble site\n        env:\n          DEPLOY_TYPE: ${{ inputs.type }}\n          PROJECTS: ${{ inputs.storybook-projects }}\n          STORYBOOK_OUTPUT_DIR: ${{ inputs.output-dir }}\n        run: |\n          mkdir -p _site\n          if [ \"$DEPLOY_TYPE\" = \"docs\" ]; then\n            cp -r docs/dist/. _site/\n          fi\n          if [ \"$PROJECTS\" != \"[]\" ]; then\n            echo \"$PROJECTS\" | jq -c '.[]' | while IFS= read -r project; do\n              name=$(echo \"$project\" | jq -r '.name // \"\"')\n              workingDir=$(echo \"$project\" | jq -r '.workingDir')\n              outputDir=$(echo \"$project\" | jq -r '.outputDir // \"storybook-static\"')\n              if [ -n \"$name\" ]; then\n                target=\"_site/sandbox/${name}\"\n              else\n                target=\"_site/sandbox\"\n              fi\n              mkdir -p \"$target\"\n              cp -r \"${workingDir}/${outputDir}/.\" \"$target/\"\n            done\n          elif [ \"$DEPLOY_TYPE\" = \"storybook\" ]; then\n            mkdir -p _site/sandbox\n            cp -r \"${STORYBOOK_OUTPUT_DIR}/.\" _site/sandbox/\n          fi\n\n      - uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1\n        name: Upload pages artifact\n        with:\n          path: _site\n\n      - uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5\n        id: deployment\n        name: Deploy to GitHub Pages\n";
+//#endregion
+//#region src/templates/reusable/delivery.previewCheck.yml
+var delivery_previewCheck_default$1 = "name: Preview Check\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      preview-url:\n        description: The PR's Vercel preview deployment URL, extracted from the triggering `deployment_status` event.\n        required: true\n        type: string\n      sha:\n        description: The deployed commit SHA — checked out explicitly, since GitHub evaluates which version of this workflow file to run from the default branch for a deployment_status event (unlike push/pull_request), and actions/checkout defaults to that same ref absent an explicit override.\n        required: true\n        type: string\n      cwd:\n        description: Directory to run the check from — the opted-in package's own directory in a monorepo. Defaults to the repo root.\n        required: false\n        type: string\n        default: \".\"\n      vercel-project:\n        description: >\n          Expected Vercel project id/name the preview URL must resolve\n          to (verified live via Vercel's API) before\n          VERCEL_PROTECTION_BYPASS_SECRET is ever attached to a request\n          (holocron#1032 review) — a bare *.vercel.app hostname proves\n          nothing on its own, since anyone can register their own\n          Vercel project. Omitted → the bypass secret is never\n          attached, regardless of whether it's configured.\n        required: false\n        type: string\n        default: \"\"\n    secrets:\n      VERCEL_TOKEN:\n        description: >\n          Required alongside vercel-project to verify deployment\n          ownership via Vercel's API (read-only use here). Not required\n          when vercel-project is omitted.\n        required: false\n      VERCEL_PROTECTION_BYPASS_SECRET:\n        description: >\n          Vercel's \"Protection Bypass for Automation\" secret for the\n          target project (holocron#1030) — sent as the\n          x-vercel-protection-bypass header so this check's request\n          isn't redirected to Vercel's own SSO login by Deployment\n          Protection, which is on by default for Preview deployments.\n          Optional: a check against a URL with protection disabled (or\n          a provider other than Vercel) needs nothing here.\n        required: false\n\njobs:\n  preview-check:\n    name: Run monitoring checks against the preview deployment\n    permissions:\n      contents: read\n      # Both read-only, needed by the \"Resolve author trust\" step\n      # below: pull-requests to find which PR `inputs.sha` belongs to,\n      # and the collaborators/permission lookup (Metadata: read on a\n      # PAT, already covered by contents) that step makes against the\n      # real PR author.\n      pull-requests: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    steps:\n      - name: Validate the preview URL\n        id: validate\n        env:\n          CANDIDATE: ${{ inputs.preview-url }}\n        run: |\n          # `preview-url` comes from the triggering deployment_status\n          # event's environment_url -- set by whoever created that\n          # deployment status, not necessarily this repo's own\n          # delivery.previewDeploy job (anyone with `deployments: write`\n          # could create one directly via the API). Validated here,\n          # independently of the event's origin, before this runner\n          # ever issues an HTTP request to it (the monitoring check\n          # below): without this, a crafted environment_url could point\n          # the runner at an internal or attacker-controlled host\n          # (SSRF) instead of a real Vercel preview. Forwarding the\n          # re-serialized `url.href` rather than the raw input also\n          # closes off argument injection through embedded whitespace\n          # or shell metacharacters -- a string that parses can't carry\n          # either.\n          host=$(node -e 'try { process.stdout.write(new URL(process.argv[1]).hostname) } catch { process.exit(1) }' \"$CANDIDATE\") || host=\"\"\n          if [[ \"$host\" != *.vercel.app ]]; then\n            echo \"::error::preview-url '$CANDIDATE' does not parse to a *.vercel.app host (parsed host: '${host:-<unparseable>}')\"\n            exit 1\n          fi\n          url=$(node -e 'const u = new URL(process.argv[1]); if (u.protocol !== \"https:\") process.exit(1); process.stdout.write(u.href)' \"$CANDIDATE\") || {\n            echo \"::error::preview-url '$CANDIDATE' did not parse to an https:// URL\"\n            exit 1\n          }\n          echo \"url=$url\" >> \"$GITHUB_OUTPUT\"\n\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          ref: ${{ inputs.sha }}\n          # This checks out and runs a PR's own holocron.config.ts —\n          # untrusted until reviewed. Never leave a credential sitting\n          # in .git/config for that code to read and exfiltrate; no\n          # later step in this job needs to push or pull authenticated.\n          persist-credentials: false\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - name: Resolve author trust\n        id: trust\n        env:\n          # Ambient, always-available -- no new secret. Only used for\n          # two read-only lookups, both within what this token already\n          # has by default.\n          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n          SHA: ${{ inputs.sha }}\n        run: |\n          # Deliberately NOT a value carried in through the\n          # deployment's own `payload` field (sourcery review on\n          # #1058's first attempt): that field is attacker-controlled\n          # by anyone with `deployments: write` -- same precondition\n          # already needed to create a deployment_status event at all\n          # -- so trusting whatever it claims would let that same\n          # attacker forge payload.collaborator_permission = \"admin\"\n          # on their own crafted deployment and unlock the bypass\n          # secret regardless of who actually authored the code. This\n          # step derives trust itself, from data it verifies\n          # independently: which real PR `inputs.sha` belongs to, and\n          # that PR's real author's current push-access level -- an\n          # attacker can't forge either without already having\n          # genuine write access to this repo.\n          #\n          # First attempt used\n          # github.event.pull_request.author_association instead, and\n          # separately turned out to be wrong for a different reason:\n          # that field only reports MEMBER for a *publicly visible* org\n          # membership, so a maintainer with private org membership\n          # reads as CONTRIBUTOR and would wrongly fail-closed on their\n          # own PRs (confirmed live on this exact repo, holocron#1057\n          # follow-up). This lookup has neither problem: it reflects\n          # real access -- direct collaborator, team membership, or\n          # org default -- independent of any profile visibility\n          # setting, and needs only \"Pull requests: read\" plus the\n          # baseline \"Metadata: read\" every token already has.\n          #\n          # No PR found for this SHA, or no login on it -> \"none\" ->\n          # untrusted. admin/maintain/write are the three roles GitHub\n          # itself treats as push-capable. Missing or unrecognized ->\n          # untrusted (fail-closed): an absent credential is safer\n          # than a wrongly granted one.\n          author=$(gh api \"repos/${GITHUB_REPOSITORY}/commits/${SHA}/pulls\" --jq '(.[0] // {}) | .user.login // empty' 2>/dev/null) || author=\"\"\n          permission=\"none\"\n          if [ -n \"$author\" ]; then\n            permission=$(gh api \"repos/${GITHUB_REPOSITORY}/collaborators/${author}/permission\" --jq '.permission // \"none\"' 2>/dev/null) || permission=\"none\"\n          fi\n          case \"$permission\" in\n            admin | maintain | write) trusted=true ;;\n            *) trusted=false ;;\n          esac\n          echo \"trusted=$trusted\" >> \"$GITHUB_OUTPUT\"\n\n      - name: Resolve monitoring checks\n        id: resolve\n        # Untrusted: loads and runs a PR's own holocron.config.ts, same\n        # as the checkout above. No secrets in this step's env at all\n        # (holocron#1032 review) -- VERCEL_TOKEN and\n        # VERCEL_PROTECTION_BYPASS_SECRET live only on the step below,\n        # which never loads this repo's config and so never runs a\n        # single line of PR-authored code.\n        uses: theholocron/.github/.github/actions/holocron@main\n        with:\n          command: monitoring resolve-checks\n          args: --cwd=${{ inputs.cwd }} --out=${{ runner.temp }}/monitoring-checks.json\n\n      - name: Verify project and run monitoring checks\n        env:\n          # Read directly by `monitoring run-resolved`\n          # (packages/cli/src/cli.ts) -- not part of the CLI's own\n          # `--token`-resolution chain, since neither is a vendor API\n          # credential this command calls anything with: VERCEL_TOKEN\n          # only verifies, read-only, that the preview URL resolves to\n          # vercel-project before VERCEL_PROTECTION_BYPASS_SECRET (a\n          # plain header forwarded as-is) is ever attached. The command\n          # itself never attaches the bypass header when vercel-project\n          # is empty, regardless of whether these secrets are\n          # configured -- never attached to an unverified URL.\n          #\n          # Both gated on `steps.trust.outputs.trusted` (holocron#1057):\n          # confirmed live that Vercel forwards this header straight\n          # through to the deployed function, so an untrusted PR's own\n          # code could read and exfiltrate it off its own incoming\n          # request. An untrusted deployment gets neither secret.\n          VERCEL_TOKEN: ${{ steps.trust.outputs.trusted == 'true' && secrets.VERCEL_TOKEN || '' }}\n          VERCEL_PROTECTION_BYPASS_SECRET: ${{ steps.trust.outputs.trusted == 'true' && secrets.VERCEL_PROTECTION_BYPASS_SECRET || '' }}\n        uses: theholocron/.github/.github/actions/holocron@main\n        with:\n          command: monitoring run-resolved\n          # vercel-project is NOT gated on trust (sourcery review on\n          # #1058's first attempt) -- it isn't a secret, and clearing\n          # it for an untrusted deployment would make\n          # resolveVercelBypassHeaders treat \"no project given\" as\n          # trivially verified (its early-return for an omitted\n          # project), skipping ownership verification entirely rather\n          # than failing. Always passing the real project here means\n          # an untrusted deployment instead hits the \"project given\n          # but no token\" branch -- VERCEL_TOKEN is empty above --\n          # which fails the check outright, before ever issuing the\n          # request, rather than letting an unverified host's response\n          # (e.g. a 3xx redirect a status-less assertion wouldn't\n          # catch) report green.\n          args: --checks-file=${{ runner.temp }}/monitoring-checks.json --vercel-project=${{ inputs.vercel-project }} ${{ steps.validate.outputs.url }}\n";
+//#endregion
+//#region src/templates/reusable/delivery.previewDeploy.yml
+var delivery_previewDeploy_default$1 = "name: Preview Deploy\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      cwd:\n        description: Directory to run the delivery.previewDeploy task from — the opted-in package's own directory in a monorepo. Defaults to the repo root.\n        required: false\n        type: string\n        default: \".\"\n      paths:\n        description: >\n          JSON array of repo-relative path prefixes (each ending in \"/\") --\n          a PR touching none of them skips the actual deploy work instead\n          of spinning up a Vercel preview for every PR in the monorepo\n          regardless of relevance (holocron#1023). Defaults to an empty\n          array: no filter, every PR is relevant -- correct for a\n          single-repo consumer, where every PR IS a PR to that package.\n        required: false\n        type: string\n        default: \"[]\"\n    secrets:\n      VERCEL_TOKEN:\n        required: false\n      HOLOCRON_DEPLOYMENTS_TOKEN:\n        description: >\n          A dedicated fine-grained PAT (Deployments: read/write only — see\n          docs/tokens.md), not the default GITHUB_TOKEN — GitHub does not\n          start a new workflow run for a deployment_status event created\n          using a run's own GITHUB_TOKEN, which would make a\n          deployment_status-triggered check (e.g. delivery.previewCheck)\n          silently never fire. No existing HOLOCRON_<FEATURE>_TOKEN carries\n          the Deployments permission, so `secrets: inherit` on the thin\n          caller forwards nothing for this unless a repo/org secret\n          literally named HOLOCRON_DEPLOYMENTS_TOKEN has been provisioned.\n        required: false\n\njobs:\n  # Two jobs, deliberately not one: \"report\" never checks out the repo at\n  # all, so it never runs a single line of this PR's own code. \"deploy\"\n  # does — it has to, to build and stage the preview — and runs with\n  # VERCEL_TOKEN present for that (tracked as a residual risk, #1020: the\n  # build step still runs this monorepo's own PR-affectable CLI build,\n  # pre-review). Without the split, a malicious build/stage script could\n  # persist a `gh` shim onto $GITHUB_PATH (or similar runner-state\n  # tampering) that a LATER step in the SAME job — the one that finally\n  # gets GH_TOKEN — would then execute instead of the real `gh` CLI,\n  # stealing that token too. Separate jobs run on separate, fresh\n  # runners; \"report\" has nothing of the first job's runner state to\n  # inherit.\n  deploy:\n    name: Deploy preview\n    runs-on: ubuntu-latest\n    # Setup/build/stage, plus the deploy capability's own\n    # wait-for-ready polling (up to 10 minutes by itself) — 10 would kill\n    # this before that polling could even finish.\n    timeout-minutes: 20\n    permissions:\n      contents: read\n      # Listing the PR's changed files (below, via `gh api`) needs this —\n      # must be granted here too, not only on the thin caller: GitHub\n      # hard-fails the whole run at startup, zero jobs dispatched, if a\n      # called reusable workflow's job asks for more than the caller\n      # grants (holocron#1058).\n      pull-requests: read\n    outputs:\n      url: ${{ steps.extract.outputs.url }}\n    steps:\n      - name: Check whether the PR touches any watched path\n        id: filter\n        env:\n          GH_TOKEN: ${{ github.token }}\n          PATHS: ${{ inputs.paths }}\n        run: |\n          # No checkout needed — the PR's changed-file list comes from the\n          # API, not local git history (which this job's later shallow\n          # checkout, below, doesn't have enough of to diff against the\n          # base branch anyway).\n          #\n          # `jq -e` both parses PATHS and rejects anything that isn't a\n          # JSON array (holocron#1069 review) -- a malformed input (bad\n          # JSON, or valid JSON that isn't an array) fails the job loudly\n          # instead of the process-substitution loop below silently\n          # reading zero prefixes and skipping the deploy with a green\n          # check and no explanation.\n          paths=$(echo \"$PATHS\" | jq -e 'if type != \"array\" then error(\"paths input is not a JSON array\") else . end') || {\n            echo \"::error::delivery.previewDeploy's paths input is not a valid JSON array: $PATHS\"\n            exit 1\n          }\n          # `jq 'length'` on the PARSED value, not a comparison against the\n          # literal string \"[]\" -- any valid JSON encoding of an empty\n          # array (e.g. \" [ ] \") means the same \"no filter\" thing.\n          if [ \"$(echo \"$paths\" | jq 'length')\" = \"0\" ]; then\n            echo \"relevant=true\" >> \"$GITHUB_OUTPUT\"\n            exit 0\n          fi\n          # Both the new name AND the old one for a rename -- a file\n          # renamed OUT of a watched package (old path matches, new\n          # doesn't) is still a real change to that package's tree.\n          files=$(gh api \"repos/${GITHUB_REPOSITORY}/pulls/${{ github.event.pull_request.number }}/files\" --paginate --jq '.[] | .filename, (.previous_filename // empty)')\n          file_count=$(echo \"$files\" | grep -c . || true)\n          if [ \"$file_count\" -ge 3000 ]; then\n            # The pulls-files endpoint caps out at 3,000 entries even with\n            # --paginate -- past that, a watched path could be among the\n            # files we never saw. Can't prove the PR irrelevant, so fail\n            # safe to relevant rather than risk silently skipping a real\n            # deploy.\n            echo \"::warning::PR has >= 3000 changed files -- can't reliably determine path relevance, treating as relevant\"\n            echo \"relevant=true\" >> \"$GITHUB_OUTPUT\"\n            exit 0\n          fi\n          relevant=false\n          while IFS= read -r prefix; do\n            [ -z \"$prefix\" ] && continue\n            while IFS= read -r file; do\n              [ -z \"$file\" ] && continue\n              # Unquoted $prefix (deliberately) -- case pattern-matches it\n              # as a glob, anchored at the START of the repo-relative path\n              # (holocron#1069 review: grep -F matched the prefix as a\n              # literal substring anywhere in the filename, and couldn't\n              # match a configured glob like \"custom/**\" at all). The\n              # trailing `*` covers a plain directory prefix like\n              # \"apps/sentinel/\"; a caller-supplied prefix that already\n              # has its own wildcards (e.g. \"custom/**\") just gets one\n              # more, harmlessly.\n              case \"$file\" in\n                $prefix*) relevant=true; break 2 ;;\n              esac\n            done <<< \"$files\"\n          done < <(echo \"$paths\" | jq -r '.[]')\n          echo \"relevant=$relevant\" >> \"$GITHUB_OUTPUT\"\n\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        if: ${{ steps.filter.outputs.relevant == 'true' }}\n        with:\n          # The PR's exact head SHA, not the default pull_request\n          # merge-commit ref — what gets built and deployed must be the\n          # exact commit the PR actually points at.\n          ref: ${{ github.event.pull_request.head.sha }}\n          persist-credentials: false\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n        if: ${{ steps.filter.outputs.relevant == 'true' }}\n\n      - name: Check deploy credentials are available\n        if: ${{ steps.filter.outputs.relevant == 'true' }}\n        id: creds\n        env:\n          VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}\n        run: |\n          # `secrets` isn't valid in a step `if:` (actionlint-enforced) —\n          # a fork PR never receives this secret, so the deploy step below\n          # skips cleanly on an empty token instead of failing on a\n          # missing credential -- correct, and must stay that way: a\n          # fork-triggered pull_request run never gets a write-scoped\n          # token either, so there's no way to post a PR comment or check\n          # run from here regardless (that needs a separate,\n          # pull_request_target-triggered job in the base repo's\n          # context -- a real feature with its own review surface, not\n          # this step; holocron#1027 explicitly scoped this fix to\n          # observability only). The ::notice:: below needs no extra\n          # permission -- it's a log annotation the runner itself renders,\n          # not an API write -- so it's the cheap half of #1027 that IS\n          # worth doing here: a visible, on-PR explanation instead of\n          # silence.\n          if [ -n \"$VERCEL_TOKEN\" ]; then\n            echo \"available=true\" >> \"$GITHUB_OUTPUT\"\n          else\n            echo \"available=false\" >> \"$GITHUB_OUTPUT\"\n            echo \"::notice title=No preview deployed::This run has no VERCEL_TOKEN available, so no preview was deployed -- most commonly because GitHub withholds repository secrets from a pull_request run triggered by a fork, though any run missing this secret ends up here the same way. Since this run creates no deployment, it won't trigger delivery.previewCheck for this PR. A maintainer can deploy one manually if needed.\"\n          fi\n\n      - name: Deploy preview\n        id: deploy\n        if: ${{ steps.creds.outputs.available == 'true' }}\n        env:\n          VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}\n        uses: theholocron/.github/.github/actions/holocron@main\n        with:\n          command: run delivery.previewDeploy\n          args: --cwd=${{ inputs.cwd }}\n\n      - name: Extract and validate the preview URL\n        id: extract\n        # Only after a real deploy — false both when the step above\n        # failed and when it skipped cleanly (fork PR, no credential).\n        if: ${{ steps.deploy.outcome == 'success' }}\n        env:\n          LOG_FILE: ${{ steps.deploy.outputs.log-file }}\n        run: |\n          # A loose https://\\S+ grab would match whatever text follows an\n          # attacker-chosen URL this log happens to contain; grabbing\n          # candidate text here and separately requiring the PARSED\n          # hostname end in .vercel.app (below) closes that regardless of\n          # how the candidate text is shaped — e.g. a userinfo trick like\n          # \"https://x.vercel.app@127.0.0.1/\" would satisfy almost any\n          # hand-written regex character class while actually parsing to\n          # host 127.0.0.1, which a naive regex-only check already missed\n          # once.\n          candidate=$(grep -oE 'https://[^[:space:]\"]+' \"$LOG_FILE\" | tail -1)\n          if [ -z \"$candidate\" ]; then\n            echo \"::error::deploy succeeded but no https:// URL was found in its output\"\n            exit 1\n          fi\n          host=$(node -e 'try { process.stdout.write(new URL(process.argv[1]).hostname) } catch { process.exit(1) }' \"$candidate\") || host=\"\"\n          if [[ \"$host\" != *.vercel.app ]]; then\n            echo \"::error::extracted URL '$candidate' does not parse to a *.vercel.app host (parsed host: '${host:-<unparseable>}')\"\n            exit 1\n          fi\n          echo \"url=$candidate\" >> \"$GITHUB_OUTPUT\"\n\n  report:\n    name: Report deployment status\n    needs: deploy\n    if: ${{ needs.deploy.outputs.url != '' }}\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    permissions:\n      deployments: write\n    steps:\n      - name: Create GitHub deployment and report status\n        env:\n          # gh reads GH_TOKEN as its auto-auth env var by its own\n          # convention -- the secret feeding it is named\n          # HOLOCRON_DEPLOYMENTS_TOKEN, matching this org's\n          # HOLOCRON_<FEATURE>_TOKEN naming (docs/tokens.md).\n          GH_TOKEN: ${{ secrets.HOLOCRON_DEPLOYMENTS_TOKEN }}\n          # The PR's head BRANCH, not its SHA — GitHub's PR \"Environments\"\n          # widget associates a Deployment with a PR by matching `ref` to\n          # the PR's own branch name, not by SHA. GitHub resolves the\n          # branch to whatever commit it points to AT CREATION TIME,\n          # though, which is a separate moment from the deploy job's own\n          # checkout (below, SHA) -- cross-checked after creation rather\n          # than assumed.\n          REF: ${{ github.event.pull_request.head.ref }}\n          # The exact commit the deploy job checked out and built,\n          # captured from the same frozen event payload this whole run\n          # was triggered by -- stays constant for the run's lifetime\n          # even if the PR branch itself moves while this job is running.\n          SHA: ${{ github.event.pull_request.head.sha }}\n          URL: ${{ needs.deploy.outputs.url }}\n        run: |\n          if [ -z \"$GH_TOKEN\" ]; then\n            echo \"::error::HOLOCRON_DEPLOYMENTS_TOKEN secret is not set -- posting this status with the default GITHUB_TOKEN would not trigger a deployment_status-triggered check\"\n            exit 1\n          fi\n\n          post_status() {\n            gh api \"repos/${GITHUB_REPOSITORY}/deployments/${deploy_id}/statuses\" \\\n              --method POST --field state=\"$1\" --field environment_url=\"$URL\" >/dev/null\n          }\n          latest_status() {\n            gh api \"repos/${GITHUB_REPOSITORY}/deployments/${deploy_id}/statuses\" --jq '.[0].state // empty' 2>/dev/null\n          }\n          # A deployment this very run may have already created\n          # server-side on an earlier attempt whose client-side response\n          # got lost (e.g. a dropped connection) -- reused instead of\n          # creating a second one, which would leave the first\n          # permanently pending (nothing ever posts its status). Scoped\n          # to the last 2 minutes so an OLDER deployment for the same\n          # ref/environment (a previous, unrelated run) is never\n          # mistaken for this one.\n          find_recent_deployment() {\n            gh api \"repos/${GITHUB_REPOSITORY}/deployments\" --method GET -f ref=\"$REF\" -f environment=Preview --jq '\n              [.[] | select((now - (.created_at | fromdateiso8601)) < 120)] | sort_by(.created_at) | last | .id // empty' 2>/dev/null\n          }\n\n          # jq, not a hand-built string -- a branch name containing a\n          # literal double quote (git allows it; GitHub's branch-naming\n          # rules don't forbid it either) would otherwise break out of a\n          # printf-constructed JSON string and produce an invalid payload\n          # gh api can't send.\n          payload=$(jq -n --arg ref \"$REF\" '{\n            ref: $ref,\n            environment: \"Preview\",\n            description: \"Vercel Preview (file deploy)\",\n            production_environment: false,\n            auto_merge: false,\n            required_contexts: []\n          }')\n          deploy_id=\"\"\n          for attempt in 1 2 3; do\n            deploy_id=$(find_recent_deployment)\n            if [ -n \"$deploy_id\" ]; then\n              echo \"reusing deployment ${deploy_id} created by an earlier attempt of this run\" >&2\n              break\n            fi\n            deploy_id=$(echo \"$payload\" | gh api \"repos/${GITHUB_REPOSITORY}/deployments\" --method POST --input - | jq -r '.id // empty')\n            if [ -n \"$deploy_id\" ]; then break; fi\n            echo \"deployment creation failed (attempt ${attempt}/3) -- retrying...\" >&2\n            sleep 5\n          done\n          if [ -z \"$deploy_id\" ]; then\n            echo \"::error::failed to create a GitHub deployment after 3 attempts -- Vercel already has the preview, but nothing will report or check it\"\n            exit 1\n          fi\n\n          # `ref` resolves to the branch's CURRENT tip at creation time --\n          # only guaranteed to be the commit this job actually built if\n          # the branch hasn't moved since the triggering push. A push to\n          # the same PR while this job was still running would otherwise\n          # silently associate the preview URL (built from the OLD\n          # commit) with the NEW commit's deployment. A newer workflow\n          # run already covers that new commit (cancel-in-progress:\n          # false queues rather than cancels), so failing this stale one\n          # loses nothing.\n          deployed_sha=$(gh api \"repos/${GITHUB_REPOSITORY}/deployments/${deploy_id}\" --jq '.sha // empty')\n          if [ \"$deployed_sha\" != \"$SHA\" ]; then\n            echo \"::error::deployment ${deploy_id} resolved to ${deployed_sha}, not the deployed commit ${SHA} -- the PR branch moved while this job was running; a newer run already covers the new commit\"\n            exit 1\n          fi\n\n          for attempt in 1 2 3; do\n            if post_status success; then\n              exit 0\n            fi\n            # The POST may have actually succeeded server-side even though\n            # this client call reported failure (e.g. a dropped connection\n            # after GitHub processed it) — checked before retrying, so a\n            # transient client-side error never posts a second success and\n            # fires delivery.previewCheck twice for the same preview.\n            if [ \"$(latest_status)\" = \"success\" ]; then\n              exit 0\n            fi\n            echo \"status POST failed (attempt ${attempt}/3) for deployment ${deploy_id} -- retrying...\" >&2\n            sleep 5\n          done\n\n          # Exhausted retries — one last attempt to mark the deployment\n          # failed rather than leaving it permanently \"pending\" in GitHub's\n          # UI; best-effort, its own failure doesn't change this step's\n          # already-failed outcome.\n          post_status error || true\n          echo \"::error::failed to post a success status for deployment ${deploy_id} after 3 attempts -- marked it failed instead of leaving it pending\"\n          exit 1\n";
+//#endregion
+//#region src/templates/reusable/delivery.publish.yml
+var delivery_publish_default$1 = "name: Release\n\n# Semantic-release with OIDC Trusted Publishing.\n# actions/setup-node writes a default NODE_AUTH_TOKEN=${{ github.token }}\n# which shadows OIDC auth. We explicitly clear it so npm falls through to\n# the Trusted Publisher OIDC exchange.\n# The calling repo must have a .releaserc.json that configures branches,\n# plugins, and any publish options. npm@11+ is installed to support OIDC.\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      dry-run:\n        description: >\n          When true, runs semantic-release --dry-run: analyzes commits and\n          previews the next release without git writes or publish. Only\n          meaningful for workflow_dispatch triggers; push-triggered runs\n          always run fully.\n        type: boolean\n        required: false\n        default: false\n      post-release:\n        description: >\n          When true, dispatches a readme sync broadcast after a successful\n          release. Enable for packages consumed by other repos via the\n          registry-doc system so downstream README installation blocks\n          stay current.\n        type: boolean\n        required: false\n        default: false\n      run-build:\n        description: Run `pnpm build` before releasing\n        type: boolean\n        required: false\n        default: true\n      deploy-on-release:\n        description: >\n          When true, runs a separate `deploy` job after a successful release\n          (holocron#930): `holocron deploy on-release` deploys every workspace\n          package whose `delivery.deploy` task is `with: { on: release }`, when\n          the release is on its channel and changes its paths. The job is its\n          own check, re-runnable on its own, and gets VERCEL_TOKEN; the release\n          job never sees it. Off by default, so a repo that doesn't deploy from\n          its release never exposes the token.\n        type: boolean\n        required: false\n        default: false\n      sentry-project:\n        description: >\n          Sentry project slug for sourcemap upload and release creation after\n          publishing. Omit to skip the Sentry release step entirely.\n        type: string\n        required: false\n        default: \"\"\n    secrets:\n      HOLOCRON_RELEASE_TOKEN:\n        description: >\n          Fine-grained PAT (Contents + Issues + Pull requests: write) owned by\n          an admin. Required when the default branch is protected by a ruleset —\n          github.token cannot push through rulesets, but an admin PAT can.\n          Takes priority over HOLOCRON_SYNC_TOKEN. Falls back to github.token.\n        required: false\n      HOLOCRON_SYNC_TOKEN:\n        description: >\n          Legacy alias for HOLOCRON_RELEASE_TOKEN — kept for backward compatibility.\n          Prefer HOLOCRON_RELEASE_TOKEN for new repos.\n        required: false\n      HOLOCRON_READ_TOKEN:\n        description: >\n          Fine-grained PAT for read-only GitHub API calls (e.g. resolving git\n          committer identity via `gh api user`). Falls back to github.token.\n        required: false\n      GH_TOKEN:\n        description: >\n          Generic GitHub token fallback for `gh` CLI calls. Used when\n          HOLOCRON_READ_TOKEN is not set.\n        required: false\n      SENTRY_AUTH_TOKEN:\n        description: >\n          Sentry auth token for sourcemap upload and release creation.\n          Required when sentry-project is set. Use the org-level secret.\n        required: false\n      TURBO_TOKEN:\n        required: false\n      VERCEL_TOKEN:\n        description: >\n          Vercel token for the deploy job. Only used when deploy-on-release is\n          true, and only by that job.\n        required: false\n\njobs:\n  release:\n    name: Semantic release\n    permissions:\n      contents: write\n      id-token: write\n      issues: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    outputs:\n      # Read by the deploy job (holocron#930). Empty unless semantic-release\n      # published: `commit` is the release commit, `previous` the commit of\n      # the release before it (to diff against), `channel` the new version's\n      # prerelease identifier (`alpha`), empty for a stable release (`main`).\n      commit: ${{ steps.release.outputs.commit }}\n      previous: ${{ steps.release.outputs.previous }}\n      channel: ${{ steps.release.outputs.channel }}\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    # Do not cancel in-progress releases — a partial release is worse than a slow one.\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n          persist-credentials: false\n          # Use HOLOCRON_RELEASE_TOKEN when available — git push (tags, release commits)\n          # uses the checkout credential, not GITHUB_TOKEN env var. The\n          # built-in github.token cannot push through branch protection rulesets.\n          token: ${{ secrets.HOLOCRON_RELEASE_TOKEN || secrets.HOLOCRON_SYNC_TOKEN || github.token }}\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - name: Configure git identity\n        run: |\n          GIT_NAME=$(gh api user --jq .name 2>/dev/null || echo \"github-actions[bot]\")\n          GIT_EMAIL=$(gh api user --jq '\"\\(.id)+\\(.login)@users.noreply.github.com\"' 2>/dev/null || echo \"41898282+github-actions[bot]@users.noreply.github.com\")\n          git config --global user.name \"$GIT_NAME\"\n          git config --global user.email \"$GIT_EMAIL\"\n          git config --global format.signoff true\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_READ_TOKEN || secrets.GH_TOKEN || github.token }}\n\n      - name: Upgrade npm for OIDC support\n        run: npm install -g npm@11 sigstore\n        # sigstore is required by libnpmpublish/provenance.js at module parse\n        # time — before any config takes effect. Some npm 11.x builds stopped\n        # bundling it; installing it globally into the same prefix ensures it\n        # resolves regardless of npm version. (Discovered 2026-07-09.)\n\n      - run: pnpm build\n        name: Build\n        if: ${{ inputs.run-build == true }}\n\n      - name: Release\n        id: release\n        run: |\n          BEFORE=$(git rev-parse HEAD)\n          PREVIOUS_TAG=$(git describe --tags --abbrev=0 2>/dev/null || true)\n          PREVIOUS=\"\"\n          if [ -n \"$PREVIOUS_TAG\" ]; then PREVIOUS=$(git rev-list -n 1 \"$PREVIOUS_TAG\"); fi\n          if [ \"$DRY_RUN\" = \"true\" ]; then\n            npx semantic-release --dry-run\n          else\n            npx semantic-release\n          fi\n          AFTER=$(git rev-parse HEAD)\n          # semantic-release only commits (`chore(release): … [skip ci]`) when it\n          # actually publishes. That commit gets no CI (and so no coverage\n          # upload), which makes the next PR's `codecov/project` compare a full\n          # report against a stale ancestor — a phantom drop (holocron#644).\n          # Emit the new SHA so the steps below upload coverage for it.\n          if [ \"$BEFORE\" != \"$AFTER\" ]; then\n            echo \"commit=$AFTER\" >> \"$GITHUB_OUTPUT\"\n            echo \"previous=$PREVIOUS\" >> \"$GITHUB_OUTPUT\"\n            # The new version's channel: the prerelease identifier of its tag\n            # (v5.0.0-alpha.108 -> alpha), empty for a stable release.\n            VERSION=$(git describe --tags --abbrev=0)\n            VERSION=${VERSION#v}\n            CHANNEL=\"\"\n            case \"$VERSION\" in *-*) PRE=${VERSION#*-}; CHANNEL=${PRE%%.*} ;; esac\n            echo \"channel=$CHANNEL\" >> \"$GITHUB_OUTPUT\"\n          fi\n        env:\n          DRY_RUN: ${{ inputs.dry-run }}\n          # Prefer HOLOCRON_RELEASE_TOKEN (fine-grained PAT, Contents+Issues+PRs write,\n          # owned by an admin with ruleset bypass) so @semantic-release/git can\n          # push the version-bump commit through branch protection. Falls back to\n          # HOLOCRON_SYNC_TOKEN (legacy) then github.token for unprotected repos.\n          GITHUB_TOKEN: ${{ secrets.HOLOCRON_RELEASE_TOKEN || secrets.HOLOCRON_SYNC_TOKEN || github.token }}\n          HUSKY: \"0\"\n          NPM_CONFIG_PROVENANCE: true\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Coverage for the release commit\n        if: ${{ steps.release.outputs.commit != '' }}\n        with:\n          task: verification.unitTests\n\n      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0\n        name: Upload release-commit coverage to Codecov\n        if: ${{ steps.release.outputs.commit != '' }}\n        # fail_ci_if_error makes a failed upload fail this step, so it is visible, but\n        # continue-on-error keeps it from failing the job: the release has already\n        # published, and the Sentry release steps below must still run (holocron#934).\n        continue-on-error: true\n        with:\n          use_oidc: true\n          fail_ci_if_error: true\n          override_commit: ${{ steps.release.outputs.commit }}\n          override_branch: ${{ github.ref_name }}\n\n      - name: Get release version\n        id: release_version\n        if: ${{ inputs.sentry-project != '' && inputs.dry-run != true }}\n        env:\n          SENTRY_PROJECT: ${{ inputs.sentry-project }}\n        run: |\n          TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo \"\")\n          if [ -n \"$TAG\" ]; then\n            echo \"release=${SENTRY_PROJECT}@${TAG#v}\" >> \"$GITHUB_OUTPUT\"\n          fi\n\n      - name: Create Sentry release\n        if: ${{ inputs.sentry-project != '' && steps.release_version.outputs.release != '' && inputs.dry-run != true }}\n        uses: getsentry/action-release@ff07929a6537bac57790c3451cf4d364aca38528 # v3\n        env:\n          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}\n          SENTRY_ORG: theholocron\n          SENTRY_PROJECT: ${{ inputs.sentry-project }}\n        with:\n          environment: production\n          version: ${{ steps.release_version.outputs.release }}\n          sourcemaps: \"**/dist\"\n\n  deploy:\n    name: Deploy\n    needs: release\n    # Only after a release that actually published (`commit` is empty on a dry\n    # run or when nothing was released). A failed deploy fails only this job:\n    # the release is already on npm, and this job re-runs on its own.\n    if: ${{ inputs.deploy-on-release == true && inputs.dry-run != true && needs.release.outputs.commit != '' }}\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout the release commit\n        with:\n          ref: ${{ needs.release.outputs.commit }}\n          fetch-depth: 0\n          persist-credentials: false\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Deploy packages that deploy on release\n        env:\n          VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}\n        with:\n          command: deploy on-release\n          args: >-\n            --channel=${{ needs.release.outputs.channel }}\n            --from=${{ needs.release.outputs.previous }}\n            --to=${{ needs.release.outputs.commit }}\n\n  sync-readme:\n    name: Post-release readme sync\n    needs: release\n    if: ${{ inputs.post-release == true && inputs.dry-run != true }}\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    steps:\n      - name: Trigger broadcast readme sync\n        run: |\n          gh workflow run sync-dispatch.yml \\\n            --repo theholocron/.github \\\n            --field \"steps=readme\"\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN }}\n";
+//#endregion
+//#region src/templates/reusable/dependencies.yml
+var dependencies_default$1 = "name: Dependencies\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      merge-token:\n        description: >\n          Optional privileged token for auto-merge. Falls back to GITHUB_TOKEN.\n          Required when branch protection enforces required reviews — GITHUB_TOKEN\n          cannot approve its own PRs.\n        required: false\n\njobs:\n  dependabot:\n    name: Update the dependencies\n    permissions:\n      contents: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    if: github.event.pull_request.user.login == 'dependabot[bot]'\n    steps:\n      - uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0\n        name: Fetch Dependabot metadata\n        id: metadata\n\n      - run: gh pr merge --auto --squash \"$PR_URL\"\n        # --squash is intentional: repo protection sets allow_merge_commit: false,\n        # so --merge would fail on any repo using the standard preset.\n        name: Enable auto-merge for Dependabot PRs\n        if: steps.metadata.outputs.update-type == 'version-update:semver-patch'\n        env:\n          PR_URL: ${{ github.event.pull_request.html_url }}\n          GH_TOKEN: ${{ secrets.merge-token || github.token }}\n";
+//#endregion
+//#region src/templates/reusable/greetings.yml
+var greetings_default$1 = "name: Greetings\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n\njobs:\n  greeting:\n    name: Greet first-time contributors\n    permissions:\n      issues: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    # Group by the issue/PR number so duplicate events don't race each other.\n    steps:\n      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n        name: Greet on first contribution\n        with:\n          script: |\n            // Only greet on the initial open — ignore synchronize, reopened, etc.\n            if (context.payload.action !== 'opened') return;\n\n            const actor = context.actor;\n            const { owner, repo } = context.repo;\n\n            // Payload inspection is more reliable than context.eventName for detecting\n            // whether this is an issue vs. PR event — works regardless of how GitHub\n            // propagates event names through workflow_call chains.\n            const isIssue = !!context.payload.issue && !context.payload.pull_request;\n            // listForRepo returns both issues and PRs (GitHub treats PRs as issues),\n            // sorted newest-first. Filter by type to track first-issue and first-PR\n            // independently, and avoid search-index eventual-consistency lag.\n            const { data: recent } = await github.rest.issues.listForRepo({\n              owner, repo,\n              creator: actor,\n              state: 'all',\n              per_page: 100\n            });\n\n            const sameType = recent.filter(item =>\n              isIssue ? !item.pull_request : !!item.pull_request\n            );\n\n            if (sameType.length !== 1) return;\n            const body = isIssue\n              ? `Hey @${actor}!\\n\\nWe really appreciate you taking the time to report an issue. The collaborators on this project attempt to help as many people as possible, but we are a limited number of volunteers, so it is possible that this will not be addressed as swiftly.\\n\\nYour patience is much appreciated and we will get back to you as quickly as possible.`\n              : `Hey @${actor}!\\n\\nWe really appreciate you taking the time to help out with this PR. The collaborators on this project attempt to help as many people as possible, but we are a limited number of volunteers, so it is possible that this will not be addressed as swiftly.\\n\\nYour patience is much appreciated and we will get back to you as quickly as possible.`;\n\n            await github.rest.issues.createComment({\n              owner,\n              repo,\n              issue_number: context.issue.number,\n              body\n            });\n";
+//#endregion
+//#region src/templates/reusable/knowledge.wiki.yml
+var knowledge_wiki_default$1 = "name: Wiki\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      fern-version:\n        description: >\n          Fern CLI version to install. Pin this to avoid breaking changes when\n          Fern updates their config schema.\n        type: string\n        required: false\n        default: \"5.114.1\"\n      preview:\n        description: >\n          When true, publishes a preview instead of production.\n          Requires preview-id to be set.\n        type: boolean\n        required: false\n        default: false\n      preview-id:\n        description: >\n          Stable ID for the preview build. Use the PR number (e.g. \"pr-123\")\n          so the same preview URL is reused on every push to the branch.\n        type: string\n        required: false\n        default: \"\"\n      fern-org:\n        description: >\n          DEPRECATED — the preview URL is now read from Fern's own output.\n          Kept as a fallback for building the URL when that parse fails, and so\n          existing callers do not error.\n        type: string\n        required: false\n        default: \"\"\n      base-path:\n        description: >\n          DEPRECATED — see fern-org. Basepath appended to the fallback preview\n          URL (e.g. \"holocron\" for multi-source routing).\n        type: string\n        required: false\n        default: \"\"\n    secrets:\n      HOLOCRON_FERN_TOKEN:\n        required: false\n      FERN_TOKEN:\n        required: false\n\njobs:\n  publish:\n    name: Publish to Fern\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    permissions:\n      contents: read\n      deployments: write\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - name: Install Fern CLI\n        run: npm install -g \"fern-api@$FERN_VERSION\"\n        env:\n          FERN_VERSION: ${{ inputs.fern-version }}\n\n      - name: Publish docs\n        if: ${{ !inputs.preview }}\n        run: fern generate --docs\n        env:\n          FERN_TOKEN: ${{ secrets.HOLOCRON_FERN_TOKEN || secrets.FERN_TOKEN }}\n\n      - name: Preview docs\n        id: preview\n        if: ${{ inputs.preview && inputs.preview-id != '' }}\n        env:\n          FERN_TOKEN: ${{ secrets.HOLOCRON_FERN_TOKEN || secrets.FERN_TOKEN }}\n          PREVIEW_ID: ${{ inputs.preview-id }}\n        run: |\n          out=$(fern generate --docs --preview --id \"$PREVIEW_ID\" 2>&1) || { printf '%s\\n' \"$out\"; exit 1; }\n          printf '%s\\n' \"$out\"\n          # Fern prints \"Published docs to https://<org>-preview-<id>.docs.buildwithfern.com/<path>\"\n          url=$(printf '%s\\n' \"$out\" | grep -oiE 'https://[a-z0-9.-]+\\.docs\\.buildwithfern\\.com[^ )]*' | head -n1)\n          echo \"url=$url\" >> \"$GITHUB_OUTPUT\"\n\n      - name: Report preview URL\n        if: ${{ inputs.preview && inputs.preview-id != '' }}\n        env:\n          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n          CAPTURED_URL: ${{ steps.preview.outputs.url }}\n          FERN_ORG: ${{ inputs.fern-org }}\n          PREVIEW_ID: ${{ inputs.preview-id }}\n          BASE_PATH: ${{ inputs.base-path }}\n        run: |\n          PREVIEW_URL=\"$CAPTURED_URL\"\n          if [ -z \"$PREVIEW_URL\" ] && [ -n \"$FERN_ORG\" ]; then\n            PREVIEW_URL=\"https://${FERN_ORG}-preview-${PREVIEW_ID}.docs.buildwithfern.com${BASE_PATH:+/${BASE_PATH}}\"\n          fi\n          if [ -z \"$PREVIEW_URL\" ]; then\n            echo \"::warning::no preview URL parsed from Fern output and no fern-org fallback — skipping the deployment widget\"\n            exit 0\n          fi\n          PAYLOAD=$(printf '{\"ref\":\"%s\",\"environment\":\"wiki (Preview)\",\"description\":\"Wiki\",\"production_environment\":false,\"auto_merge\":false,\"required_contexts\":[]}' \\\n            \"$GITHUB_HEAD_REF\")\n          DEPLOY_ID=$(printf '%s\\n' \"$PAYLOAD\" | gh api \"repos/${GITHUB_REPOSITORY}/deployments\" \\\n            --method POST --input - | jq -r '.id')\n          gh api \"repos/${GITHUB_REPOSITORY}/deployments/${DEPLOY_ID}/statuses\" \\\n            --method POST --field state=success --field environment_url=\"$PREVIEW_URL\"\n";
+//#endregion
+//#region src/templates/reusable/platform.commitStandards.yml
+var platform_commitStandards_default$1 = "name: Commit Standards\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  commit-standards:\n    name: Run commitlint\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      # No local equivalent (linters.ts: commitlint has no localBin — enforced\n      # only at commit time via the commit-msg hook, and here in CI over the\n      # PR's commit range). Not run through the holocron composite action.\n      #\n      # --config <resolved shared path> (config-resolution workstream, #676)\n      # — falls back to commitlint's own auto-discovery of a local\n      # commitlint.config.ts when the shared package's built dist/ isn't\n      # present, same guard as the commit-msg hook.\n      - name: Run commitlint over the PR range\n        if: github.event_name == 'pull_request'\n        run: |\n          COMMITLINT_CONFIG=\"node_modules/@theholocron/commitlint-config/dist/index.js\"\n          if [ -f \"$COMMITLINT_CONFIG\" ]; then\n            pnpm exec commitlint --config \"$COMMITLINT_CONFIG\" --from \"${{ github.event.pull_request.base.sha }}\" --to \"${{ github.sha }}\"\n          else\n            pnpm exec commitlint --from \"${{ github.event.pull_request.base.sha }}\" --to \"${{ github.sha }}\"\n          fi\n";
+//#endregion
+//#region src/templates/reusable/platform.dispatchedCheck.yml
+var platform_dispatchedCheck_default = "name: Dispatched Check\n\non: # yamllint disable-line rule:truthy\n  workflow_dispatch:\n    inputs:\n      repo:\n        description: Target repo, \"owner/name\", to check out and run the task against.\n        type: string\n        required: true\n      ref:\n        description: Git ref (branch or commit SHA) to check out.\n        type: string\n        required: true\n      task:\n        description: The holocron task name to run (e.g. \"verification.typeSafety\").\n        type: string\n        required: true\n      check-run-id:\n        description: >\n          ID of the check run already posted as \"queued\" on the target repo —\n          patched to \"completed\" once the task finishes.\n        type: string\n        required: true\n\npermissions:\n  contents: read\n\njobs:\n  run-task:\n    name: Run a Sentinel-dispatched task against another repo\n    runs-on: ubuntu-latest\n    timeout-minutes: 20\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      # actions/create-github-app-token defaults to scoping its token to the\n      # *current* repo (.github, where this workflow runs) when owner/\n      # repositories are omitted — useless here, since every real use of this\n      # token targets inputs.repo instead. Split \"owner/name\" up front so the\n      # token step below can scope explicitly to the actual target.\n      - name: Parse target repo\n        id: target\n        run: |\n          echo \"owner=${INPUT_REPO%%/*}\" >> \"$GITHUB_OUTPUT\"\n          echo \"name=${INPUT_REPO##*/}\" >> \"$GITHUB_OUTPUT\"\n        env:\n          INPUT_REPO: ${{ inputs.repo }}\n\n      # Sentinel's own dispatch call only carries plain, non-secret inputs\n      # (repo/ref/task/check-run-id — all visible in the Actions UI/logs).\n      # This step mints a fresh, short-lived installation token here instead,\n      # scoped by the same App's stored credentials — never a raw token\n      # passed through a dispatch input.\n      - name: Generate installation token\n        id: app-token\n        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0\n        with:\n          app-id: ${{ secrets.SENTINEL_APP_ID }}\n          private-key: ${{ secrets.SENTINEL_APP_PRIVATE_KEY }}\n          owner: ${{ steps.target.outputs.owner }}\n          repositories: ${{ steps.target.outputs.name }}\n\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout target repository\n        with:\n          repository: ${{ inputs.repo }}\n          ref: ${{ inputs.ref }}\n          token: ${{ steps.app-token.outputs.token }}\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - name: Run the task\n        id: run-task\n        continue-on-error: true\n        uses: theholocron/.github/.github/actions/holocron@main\n        with:\n          task: ${{ inputs.task }}\n\n      # A bare .../actions/runs/<id> link lands on the run summary, one click\n      # short of the actual step-by-step log a normal check's details_url\n      # points at. This job is always alone in its run, so the first (only)\n      # job in the run's own job list is unambiguously this one.\n      - name: Resolve this job's numeric ID\n        id: job-info\n        if: always()\n        run: |\n          job_id=$(gh api \"repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/jobs\" --jq '.jobs[0].id')\n          echo \"job_id=$job_id\" >> \"$GITHUB_OUTPUT\"\n        env:\n          GH_TOKEN: ${{ steps.app-token.outputs.token }}\n\n      # Ships the task's real captured output (tsc/vitest/etc — whatever\n      # `holocron run` actually printed) to the same Axiom dataset Sentinel's\n      # own structured logs already flow into, tagged so it's queryable by\n      # this exact run. Reuses the existing dataset rather than provisioning\n      # a new one — a prototype-stage call, revisit if CI-log volume ever\n      # warrants a dedicated dataset. Builds a permalink filtered to this\n      # run's own logs (Axiom's own \"copy query link\" URL shape:\n      # /<org>/query?initForm={\"apl\":\"...\"} ) so a viewer lands directly on\n      # the relevant lines, not a bare dataset view.\n      - name: Ship task output to Axiom\n        id: axiom\n        if: always()\n        run: |\n          message=$(tail -c 40000 \"$LOG_FILE\" 2>/dev/null || echo \"(no output captured)\")\n          # \"level\" is one of the field names Axiom's Stream/Query tabs\n          # recognize for severity-color highlighting (docs: level, @level,\n          # severity, @severity, status.code) -- conclusion alone isn't.\n          level=$([ \"$CONCLUSION\" = \"success\" ] && echo \"info\" || echo \"error\")\n          event=$(jq -cn \\\n            --arg time \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\" \\\n            --arg repo \"$REPO\" --arg task \"$TASK\" --arg run_id \"$GITHUB_RUN_ID\" \\\n            --arg job_id \"$JOB_ID\" --arg check_run_id \"$CHECK_RUN_ID\" \\\n            --arg conclusion \"$CONCLUSION\" --arg level \"$level\" --arg message \"$message\" \\\n            '{_time: $time, source: \"dispatched-check\", repo: $repo, task: $task,\n              run_id: $run_id, job_id: $job_id, check_run_id: $check_run_id,\n              conclusion: $conclusion, level: $level, message: $message}')\n          curl -sf -X POST \"https://api.axiom.co/v1/datasets/${AXIOM_DATASET}/ingest\" \\\n            -H \"Authorization: Bearer ${AXIOM_TOKEN}\" \\\n            -H \"Content-Type: application/json\" \\\n            -d \"[${event}]\" || echo \"::warning::Axiom ingest failed — continuing, the check itself still reports the real result\"\n\n          # The ['...'] is Axiom's own APL array-dataset-reference syntax, not\n          # a shell quote boundary — $AXIOM_DATASET/$CHECK_RUN_ID both expand\n          # fine here; shellcheck's single-quote heuristic just can't tell.\n          # shellcheck disable=SC2016\n          apl=\"['${AXIOM_DATASET}'] | where check_run_id == \\\"${CHECK_RUN_ID}\\\"\"\n          init_form=$(jq -cn --arg apl \"$apl\" '{apl: $apl}')\n          encoded=$(jq -rn --arg s \"$init_form\" '$s | @uri')\n          echo \"query-url=https://app.axiom.co/${AXIOM_ORG}/query?initForm=${encoded}\" >> \"$GITHUB_OUTPUT\"\n        env:\n          LOG_FILE: ${{ steps.run-task.outputs.log-file }}\n          REPO: ${{ inputs.repo }}\n          TASK: ${{ inputs.task }}\n          JOB_ID: ${{ steps.job-info.outputs.job_id }}\n          CHECK_RUN_ID: ${{ inputs.check-run-id }}\n          CONCLUSION: ${{ steps.run-task.outcome == 'success' && 'success' || 'failure' }}\n          AXIOM_ORG: the-holocron-7bbe\n          AXIOM_DATASET: holocron-sentinel\n          AXIOM_TOKEN: ${{ secrets.SENTINEL_AXIOM_INGEST_TOKEN }}\n\n      # Always runs, success or failure — the queued check run on the target\n      # repo must be resolved either way, not left hanging. Full JSON body via\n      # jq + --input, not -f flags: output.text needs real nesting (gh api -f\n      # has no dot-notation for that), and the captured task output can\n      # contain characters (quotes, $, backticks) that would break a\n      # hand-built -f string.\n      - name: Report result to the target repo's check run\n        if: always()\n        run: |\n          excerpt=$(tail -c 3000 \"$LOG_FILE\" 2>/dev/null || echo \"(no output captured)\")\n          # The single-quoted format string is intentional — every %s fills\n          # via printf's own args below, not shell expansion; nothing in it\n          # needs to expand.\n          # shellcheck disable=SC2016\n          text=$(printf '**Task:** `%s`\\n\\n**Result:** %s\\n\\n[Full logs on Axiom](%s)\\n\\n### Last output\\n\\n```\\n%s\\n```\\n' \\\n            \"$TASK\" \"$CONCLUSION\" \"$QUERY_URL\" \"$excerpt\")\n          body=$(jq -n \\\n            --arg conclusion \"$CONCLUSION\" \\\n            --arg details_url \"$RUN_URL\" \\\n            --arg title \"$TASK ($CONCLUSION)\" \\\n            --arg summary \"Dispatched via theholocron/.github — see the log excerpt below, or the full run/Axiom links.\" \\\n            --arg text \"$text\" \\\n            '{status: \"completed\", conclusion: $conclusion, details_url: $details_url,\n              output: {title: $title, summary: $summary, text: $text}}')\n          echo \"$body\" | gh api --method PATCH \"/repos/${REPO}/check-runs/${CHECK_RUN_ID}\" --input -\n        env:\n          # `GH_TOKEN` is the literal name `gh api` requires to auto-authenticate\n          # -- not a stand-in for a shared/blanket credential. Its value is the\n          # short-lived, Sentinel-App-scoped token minted above, same as the\n          # checkout step uses; never secrets.HOLOCRON_SYNC_TOKEN (the one\n          # genuinely shared PAT in this org, used by sync-dispatch.yml).\n          GH_TOKEN: ${{ steps.app-token.outputs.token }}\n          REPO: ${{ inputs.repo }}\n          TASK: ${{ inputs.task }}\n          CHECK_RUN_ID: ${{ inputs.check-run-id }}\n          CONCLUSION: ${{ steps.run-task.outcome == 'success' && 'success' || 'failure' }}\n          LOG_FILE: ${{ steps.run-task.outputs.log-file }}\n          QUERY_URL: ${{ steps.axiom.outputs.query-url }}\n          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}/job/${{ steps.job-info.outputs.job_id }}\n";
+//#endregion
+//#region src/templates/reusable/platform.notifyCheck.yml
+var platform_notifyCheck_default$1 = "name: Notify Check\n\n# Proves the notification path end to end, from a real run: that each channel's\n# webhook secret exists, that its webhook accepts a post, and that the alert\n# role ping resolves. It posts one clearly labelled test message per channel and\n# fails the matching job when any step does not work, so a red job names the\n# channel to fix. Manual (workflow_dispatch) only: it posts real messages.\n#\n# Each channel names its own webhook secret, because `notifications setup` lets a\n# layout override the default name (and normalises punctuation), so deriving the\n# name from the channel would miss those. A channel with `\"mention\": true` also\n# requires the role-id secret and pings it: a webhook accepting the post proves\n# the channel works, not that the role ping does, so a missing or malformed role\n# id fails that job instead of passing quietly. Whether Discord lets that role be\n# mentioned at all is checked by `holocron doctor notifications`, not here.\n#\n# Secrets reach this workflow through `secrets: inherit`, so any secret named in\n# `channels` is readable; the declared list below is for callers that pass secrets\n# explicitly.\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      channels:\n        description: >\n          JSON array of channels to check, each `{ \"name\", \"secret\", \"mention\" }`:\n          `secret` is the org secret holding that channel's webhook URL and\n          `mention: true` also requires and pings the role in\n          HOLOCRON_NOTIFY_ALERT_ROLE.\n        type: string\n        required: false\n        default: >-\n          [{\"name\":\"sync\",\"secret\":\"HOLOCRON_NOTIFY_WEBHOOK_SYNC\"},\n          {\"name\":\"alerts\",\"secret\":\"HOLOCRON_NOTIFY_WEBHOOK_ALERTS\",\"mention\":true},\n          {\"name\":\"errors\",\"secret\":\"HOLOCRON_NOTIFY_WEBHOOK_ERRORS\"},\n          {\"name\":\"uptime\",\"secret\":\"HOLOCRON_NOTIFY_WEBHOOK_UPTIME\"},\n          {\"name\":\"releases\",\"secret\":\"HOLOCRON_NOTIFY_WEBHOOK_RELEASES\"},\n          {\"name\":\"deploys\",\"secret\":\"HOLOCRON_NOTIFY_WEBHOOK_DEPLOYS\"}]\n    secrets:\n      HOLOCRON_NOTIFY_WEBHOOK_SYNC:\n        description: Webhook for the sync channel.\n        required: false\n      HOLOCRON_NOTIFY_WEBHOOK_ALERTS:\n        description: Webhook for the alerts channel.\n        required: false\n      HOLOCRON_NOTIFY_WEBHOOK_ERRORS:\n        description: Webhook for the errors channel.\n        required: false\n      HOLOCRON_NOTIFY_WEBHOOK_UPTIME:\n        description: Webhook for the uptime channel.\n        required: false\n      HOLOCRON_NOTIFY_WEBHOOK_RELEASES:\n        description: Webhook for the releases channel.\n        required: false\n      HOLOCRON_NOTIFY_WEBHOOK_DEPLOYS:\n        description: Webhook for the deploys channel.\n        required: false\n      HOLOCRON_NOTIFY_ALERT_ROLE:\n        description: Id of the role to mention on the alerts channel's test message. Optional.\n        required: false\n\njobs:\n  check:\n    name: Check ${{ matrix.channel.name }}\n    runs-on: ubuntu-latest\n    timeout-minutes: 2\n    permissions: {}\n    strategy:\n      # One channel failing must not hide the others: the point is the full picture.\n      fail-fast: false\n      matrix:\n        channel: ${{ fromJSON(inputs.channels) }}\n    steps:\n      - name: Require the alert role id\n        if: matrix.channel.mention\n        run: |\n          if [ -z \"$ROLE\" ]; then\n            echo \"::error::HOLOCRON_NOTIFY_ALERT_ROLE is not set, so the ping on #$CHANNEL cannot be checked.\"\n            exit 1\n          fi\n        env:\n          ROLE: ${{ secrets.HOLOCRON_NOTIFY_ALERT_ROLE }}\n          CHANNEL: ${{ matrix.channel.name }}\n\n      - uses: theholocron/.github/.github/actions/notify@main\n        name: Post a test message to ${{ matrix.channel.name }}\n        with:\n          strict: \"true\"\n          webhook: ${{ secrets[matrix.channel.secret] }}\n          # Only a channel marked `mention` pings, and strict mode rejects a malformed id.\n          mention: ${{ matrix.channel.mention && secrets.HOLOCRON_NOTIFY_ALERT_ROLE || '' }}\n          message: \"🧪 notify check — #${{ matrix.channel.name }} is wired up (${{ github.repository }}, ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})\"\n";
+//#endregion
+//#region src/templates/reusable/platform.repoSync.yml
+var platform_repoSync_default$1 = "name: Sync\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      steps:\n        description: >\n          Sync steps to run (default: all). Valid values:\n          labels, properties, teams, topics, keywords, description, homepage, readme, workflows, wiki.\n          Pass a space-separated list to run a subset, e.g. \"readme\" or \"readme wiki\".\n        type: string\n        required: false\n    secrets:\n      HOLOCRON_ADMIN_TOKEN:\n        description: Fine-grained PAT with admin scopes (labels, properties, teams).\n        required: false\n      HOLOCRON_AXIOM_TOKEN:\n        description: >\n          Axiom API token. When set alongside the HOLOCRON_AXIOM_DATASET\n          repo/org variable, the CLI ships this run's structured logs to Axiom.\n          Falls back to the vendor-native AXIOM_TOKEN secret.\n        required: false\n      AXIOM_TOKEN:\n        description: Vendor-native fallback for HOLOCRON_AXIOM_TOKEN.\n        required: false\n      HOLOCRON_DEPLOY_TOKEN:\n        description: Fine-grained PAT for GitHub Pages configuration.\n        required: false\n      HOLOCRON_ISSUES_TOKEN:\n        description: Fine-grained PAT for issue management.\n        required: false\n      HOLOCRON_ORG_TOKEN:\n        description: Org-scoped fine-grained PAT for team sync and org properties.\n        required: false\n      HOLOCRON_READ_TOKEN:\n        description: Fine-grained PAT for read-only GitHub API calls.\n        required: false\n      HOLOCRON_SYNC_TOKEN:\n        required: false\n      HOLOCRON_NOTIFY_WEBHOOK_SYNC:\n        description: >\n          Webhook for the sync channel: a sync PR opened and its\n          auto-merge result. Unset = no post.\n        required: false\n      HOLOCRON_NOTIFY_WEBHOOK_ALERTS:\n        description: >\n          Webhook for the alerts channel: a failed sync run, or a sync\n          PR that needs a manual merge. Unset = no post. The optional\n          HOLOCRON_NOTIFY_ALERT_ROLE secret (a role id) makes these posts\n          mention that role.\n        required: false\n      HOLOCRON_NOTIFY_ALERT_ROLE:\n        description: >\n          Id of the role to mention on alerts. Written by `holocron\n          notifications setup`; not sensitive, kept as a secret so the same\n          token that writes the webhook secrets can write it. Optional.\n        required: false\n      GH_TOKEN:\n        description: >\n          Generic GitHub token fallback for gh CLI calls. Used when\n          HOLOCRON_SYNC_TOKEN is not set.\n        required: false\n\njobs:\n  sync:\n    name: Run holocron repo sync\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    # Serialise the find-or-create-PR and supersede steps repo-wide: the caller's\n    # concurrency key is per ref, so runs from different refs could otherwise\n    # interleave and leave several sync PRs open.\n    concurrency:\n      group: repo-sync-pr-${{ github.repository }}\n      cancel-in-progress: false\n    permissions:\n      contents: write\n      pull-requests: write\n    # Job-level so the `holocron` composite action's steps inherit them.\n    env:\n      HOLOCRON_ADMIN_TOKEN: ${{ secrets.HOLOCRON_ADMIN_TOKEN }}\n      HOLOCRON_AXIOM_TOKEN: ${{ secrets.HOLOCRON_AXIOM_TOKEN || secrets.AXIOM_TOKEN }}\n      HOLOCRON_AXIOM_DATASET: ${{ vars.HOLOCRON_AXIOM_DATASET || vars.AXIOM_DATASET }}\n      POSTHOG_PROJECT_TOKEN: ${{ vars.POSTHOG_PROJECT_TOKEN }}\n      HOLOCRON_DEPLOY_TOKEN: ${{ secrets.HOLOCRON_DEPLOY_TOKEN }}\n      HOLOCRON_ISSUES_TOKEN: ${{ secrets.HOLOCRON_ISSUES_TOKEN }}\n      HOLOCRON_ORG_TOKEN: ${{ secrets.HOLOCRON_ORG_TOKEN }}\n      HOLOCRON_READ_TOKEN: ${{ secrets.HOLOCRON_READ_TOKEN }}\n      HOLOCRON_SYNC_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          token: ${{ secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN || github.token }}\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - name: Run holocron repo sync\n        # The `holocron` action resolves @theholocron/cli from node_modules (or\n        # builds the workspace when it's an unbuilt checkout — the holocron repo\n        # itself). `inputs.steps` is a space-separated list or empty; the\n        # `--steps <list>` arg is omitted when empty.\n        uses: theholocron/.github/.github/actions/holocron@main\n        with:\n          command: repo sync\n          args: ${{ inputs.steps != '' && format('--steps {0}', inputs.steps) || '' }}\n\n      - name: Format generated files\n        run: |\n          pnpm exec prettier --write README.md docs/src/content/docs/index.mdx 2>/dev/null || true\n          # `holocron repo sync` writes package.json fields (keywords, description,\n          # homepage) with a plain assignment, which appends new keys at the\n          # end — re-apply the canonical order the lint config enforces.\n          pnpm exec eslint --fix --no-warn-ignored package.json 2>/dev/null || true\n\n      - uses: theholocron/.github/.github/actions/auto-commit@main\n        id: auto-commit\n        name: Commit sync changes\n        with:\n          token: ${{ secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN || github.token }}\n          # One branch per source commit (full SHA, so distinct commits never collide): a PR left unreviewed never blocks the\n          # next sync, and a re-run for the same commit updates its own branch.\n          branch: ${{ format('chore/auto-sync-{0}', github.sha) }}\n          commit-message: \"chore: sync from holocron.config\"\n          commit-options: \"--no-verify\"\n\n      - name: Open PR and enable auto-merge\n        id: pr\n        if: steps.auto-commit.outputs.changes-detected == 'true'\n        run: |\n          # Find or create this run's PR first: older PRs are only closed once\n          # a replacement exists, so a failure here never leaves the changes\n          # without an open PR.\n          url=$(gh pr view \"$BRANCH\" --json url --jq .url 2>/dev/null || gh pr create \\\n            --title \"chore: sync README and repo metadata\" \\\n            --body \"Automated sync from holocron.config. Auto-merges once required checks pass.\" \\\n            --base main \\\n            --head \"$BRANCH\")\n          created=$(gh pr view \"$url\" --json createdAt --jq .createdAt)\n\n          # Supersede older sync PRs: same-repo only, exact generated or legacy\n          # branch name, and created before this one (a slow older run can\n          # never close a newer PR). --limit covers more than the default page.\n          gh pr list --state open --limit 200 --json number,headRefName,isCrossRepository,createdAt \\\n            --jq \".[] | select(.isCrossRepository | not) | select(.headRefName == \\\"chore/auto-sync\\\" or (.headRefName | test(\\\"^chore/auto-sync-[0-9a-f]{40}$\\\"))) | select(.headRefName != \\\"$BRANCH\\\") | select(.createdAt < \\\"$created\\\") | .number\" |\n            while read -r n; do\n              gh pr close \"$n\" --delete-branch --comment \"Superseded by $url.\" || true\n            done\n\n          # Delete pushed sync branches that never got a PR (e.g. a run\n          # cancelled between push and PR creation). The repo-wide concurrency\n          # group means no other run is mid-flight here.\n          open=$(gh pr list --state open --limit 200 --json headRefName --jq '.[].headRefName')\n          git ls-remote --heads origin 'refs/heads/chore/auto-sync-*' | sed 's|.*refs/heads/||' |\n            while read -r b; do\n              [ \"$b\" = \"$BRANCH\" ] && continue\n              echo \"$b\" | grep -Eq '^chore/auto-sync-[0-9a-f]{40}$' || continue\n              echo \"$open\" | grep -qxF \"$b\" || git push origin --delete \"$b\" || true\n            done\n\n          # A PR opened with the default GITHUB_TOKEN does not trigger\n          # pull_request workflows, so required checks would never start and\n          # auto-merge would wait forever.\n          if [ \"$HAS_PAT\" != \"true\" ]; then\n            echo \"::warning::Sync PR $url opened with GITHUB_TOKEN: checks will not run and auto-merge is skipped. Set HOLOCRON_SYNC_TOKEN.\"\n            echo \"Sync PR $url — needs manual merge (no PAT).\" >> \"$GITHUB_STEP_SUMMARY\"\n            result=\"needs a manual merge (no PAT, so checks will not run)\"\n            attention=true\n          elif gh pr merge \"$url\" --auto --squash; then\n            echo \"Sync PR $url — auto-merge enabled.\" | tee -a \"$GITHUB_STEP_SUMMARY\"\n            result=\"auto-merge enabled\"\n          else\n            echo \"::warning::Sync PR $url opened but auto-merge could not be enabled; merge it manually.\"\n            echo \"Sync PR $url — needs manual merge.\" >> \"$GITHUB_STEP_SUMMARY\"\n            result=\"needs a manual merge (auto-merge could not be enabled)\"\n            attention=true\n          fi\n          {\n            echo \"url=$url\"\n            echo \"result=$result\"\n            echo \"attention=${attention:-false}\"\n          } >> \"$GITHUB_OUTPUT\"\n        env:\n          BRANCH: ${{ format('chore/auto-sync-{0}', github.sha) }}\n          HAS_PAT: ${{ secrets.HOLOCRON_SYNC_TOKEN != '' || secrets.GH_TOKEN != '' }}\n          GH_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN || github.token }}\n\n      - uses: theholocron/.github/.github/actions/notify@main\n        name: Notify of the sync PR\n        if: steps.pr.outputs.url != '' && steps.pr.outputs.attention != 'true'\n        with:\n          webhook: ${{ secrets.HOLOCRON_NOTIFY_WEBHOOK_SYNC }}\n          message: \"🔄 ${{ github.repository }}: sync PR ${{ steps.pr.outputs.url }} — ${{ steps.pr.outputs.result }}${{ github.run_attempt > 1 && format(' (attempt {0})', github.run_attempt) || '' }}\"\n\n      - uses: theholocron/.github/.github/actions/notify@main\n        name: Notify that a sync PR needs attention\n        if: steps.pr.outputs.attention == 'true'\n        with:\n          webhook: ${{ secrets.HOLOCRON_NOTIFY_WEBHOOK_ALERTS }}\n          mention: ${{ secrets.HOLOCRON_NOTIFY_ALERT_ROLE }}\n          message: \"⚠️ ${{ github.repository }}: sync PR ${{ steps.pr.outputs.url }} — ${{ steps.pr.outputs.result }}${{ github.run_attempt > 1 && format(' (attempt {0})', github.run_attempt) || '' }}\"\n\n      - name: Broadcast wiki sync if navbar changed\n        if: >-\n          steps.auto-commit.outputs.changes-detected == 'true' &&\n          github.event_name == 'push' &&\n          (inputs.steps == '' || contains(inputs.steps, 'wiki'))\n        run: |\n          if git diff HEAD~1 --name-only | grep -q 'fern/docs.yml'; then\n            gh workflow run sync-dispatch.yml \\\n              --repo theholocron/.github \\\n              --field \"steps=wiki\" \\\n            || echo \"skipping broadcast — insufficient permissions\"\n          fi\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN || github.token }}\n\n  # A separate job, not a final step: a job-level timeout cancels the sync job\n  # before any later step in it can run, so an in-job `if: failure()` step would\n  # stay silent on exactly the hang we most want to hear about. `!cancelled()` is\n  # false when the whole run was cancelled (a newer run superseded this one), so\n  # that expected case stays quiet, while a failed or timed-out sync job alerts.\n  notify-failure:\n    name: Notify of a failed sync\n    needs: sync\n    if: ${{ !cancelled() && (needs.sync.result == 'failure' || needs.sync.result == 'cancelled') }}\n    runs-on: ubuntu-latest\n    timeout-minutes: 2\n    permissions: {}\n    steps:\n      - uses: theholocron/.github/.github/actions/notify@main\n        name: Notify of a failed sync\n        with:\n          webhook: ${{ secrets.HOLOCRON_NOTIFY_WEBHOOK_ALERTS }}\n          mention: ${{ secrets.HOLOCRON_NOTIFY_ALERT_ROLE }}\n          message: \"❌ ${{ github.repository }}: repo sync ${{ needs.sync.result == 'cancelled' && 'timed out or was cancelled' || 'failed' }} — ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}${{ github.run_attempt > 1 && format(' (attempt {0})', github.run_attempt) || '' }}\"\n";
+//#endregion
+//#region src/templates/reusable/platform.repoValidation.yml
+var platform_repoValidation_default$1 = "name: Repo Validation\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  adrs:\n    name: Validate ADRs and specs\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Validate ADR and spec frontmatter\n        with:\n          task: platform.repoValidation\n          job: adrs\n\n  registry:\n    name: Validate registry consistency\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Validate registry consistency\n        with:\n          task: platform.repoValidation\n          job: registry\n\n  docs-presence:\n    name: Validate docs presence\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Validate docs presence for new packages\n        with:\n          task: platform.repoValidation\n          job: docsPresence\n        env:\n          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}\n\n  conclusion:\n    name: Conclusion\n    runs-on: ubuntu-latest\n    if: always()\n    needs: [adrs, registry, docs-presence]\n    steps:\n      - name: Check job statuses\n        run: |\n          if [[ \"$RESULTS\" == *\"failure\"* ]] || [[ \"$RESULTS\" == *\"cancelled\"* ]]; then\n            exit 1\n          fi\n        env:\n          RESULTS: ${{ join(needs.*.result, ',') }}\n";
+//#endregion
+//#region src/templates/reusable/platform.syncTemplates.yml
+var platform_syncTemplates_default$1 = "name: Sync Templates\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      HOLOCRON_SYNC_TOKEN:\n        description: >\n          Fine-grained PAT (resource owner org) with BOTH contents:write and\n          workflows:write on theholocron/.github — contents:write alone is\n          rejected for anything under .github/workflows/, a GitHub\n          fine-grained-PAT restriction independent of repo permissions.\n        required: false\n      GH_TOKEN:\n        description: >\n          Fallback PAT with the same two permissions, used only when\n          HOLOCRON_SYNC_TOKEN is not set. The default GITHUB_TOKEN is never\n          an acceptable fallback here — it cannot write to a different repo\n          no matter what this job's own `permissions:` block grants, so it\n          is deliberately not offered as a third fallback; the CLI's own\n          token resolver already fails with a clear, actionable message\n          when both secrets above are unset.\n        required: false\n\njobs:\n  sync-templates:\n    name: Run holocron sync github\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    permissions:\n      contents: read\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - name: Run holocron sync github\n        # No local commit, no branch, no PR — pushes directly to\n        # theholocron/.github's own default branch.\n        #\n        # HOLOCRON_SYNC_TOKEN is scoped to ONLY this step, not the job —\n        # \"Setup\" (above) runs this ref's own pnpm install, and the\n        # \"Build the workspace\" step this composite action may run (an\n        # unbuilt workspace checkout — the holocron repo itself) runs this\n        # ref's own build, including any postinstall/build-time script a\n        # malicious push could carry. Neither sees a write credential.\n        uses: theholocron/.github/.github/actions/holocron@main\n        env:\n          HOLOCRON_SYNC_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN }}\n        with:\n          command: sync github\n";
+//#endregion
+//#region src/templates/reusable/preview.yml
+var preview_default$1 = "name: Preview\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      type:\n        description: \"Type of deployment: docs or storybook\"\n        required: true\n        type: string\n      name:\n        description: Repo name prefix used to filter the docs site package (<name>-site); omit to run pnpm -C docs build\n        required: false\n        type: string\n        default: \"\"\n      storybook-projects:\n        description: >\n          JSON array of { \"name\"?, \"workingDir\", \"outputDir\"? } objects for storybook deploys.\n          Each is built via `pnpm -C <workingDir> build:storybook`. If \"name\" is provided the\n          output is placed under `sandbox/<name>/`; omit \"name\" for single-repo deploys and the\n          output lands directly in `sandbox/`.\n        type: string\n        required: false\n        default: \"[]\"\n      build-script:\n        description: pnpm script that builds the Storybook static output (single storybook, type:storybook only)\n        type: string\n        required: false\n        default: build:storybook\n      output-dir:\n        description: Directory where Storybook writes its static output (single storybook, type:storybook only)\n        type: string\n        required: false\n        default: storybook-static\n      cloudflare-project:\n        description: >\n          Cloudflare Pages project name. Falls back to the CLOUDFLARE_PAGES_PROJECT\n          org variable when omitted — set that variable once and all repos get previews\n          without per-repo config.\n        required: false\n        type: string\n        default: \"\"\n\njobs:\n  deploy-preview:\n    name: Preview\n    if: ${{ github.event.action != 'closed' }}\n    runs-on: ubuntu-latest\n    permissions:\n      contents: read\n      deployments: write\n      pull-requests: write\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - name: Build workspace dependencies\n        # The docs site imports workspace packages (e.g. a shared theme) via\n        # `workspace:*` — its exports map points at dist/, which doesn't\n        # exist until something builds it. Nothing else in this job does,\n        # so without this step Vite fails to resolve the import entirely.\n        if: ${{ inputs.type == 'docs' }}\n        run: pnpm run build\n\n      - name: Build docs site\n        if: ${{ inputs.type == 'docs' && inputs.name != '' }}\n        env:\n          SITE_NAME: ${{ inputs.name }}\n        run: pnpm --filter @theholocron/\"$SITE_NAME\"-site build\n\n      - name: Build docs site\n        if: ${{ inputs.type == 'docs' && inputs.name == '' }}\n        run: pnpm -C docs build\n\n      - name: Build Storybook projects\n        if: ${{ inputs.storybook-projects != '[]' }}\n        env:\n          PROJECTS: ${{ inputs.storybook-projects }}\n        run: |\n          echo \"$PROJECTS\" | jq -c '.[]' | while IFS= read -r project; do\n            workingDir=$(echo \"$project\" | jq -r '.workingDir')\n            pnpm -C \"$workingDir\" build:storybook\n          done\n\n      - name: Build Storybook\n        if: ${{ inputs.type == 'storybook' && inputs.storybook-projects == '[]' }}\n        env:\n          BUILD_SCRIPT: ${{ inputs.build-script }}\n        run: pnpm run \"$BUILD_SCRIPT\"\n\n      - name: Assemble site\n        env:\n          DEPLOY_TYPE: ${{ inputs.type }}\n          SITE_NAME: ${{ inputs.name }}\n          PROJECTS: ${{ inputs.storybook-projects }}\n          STORYBOOK_OUTPUT_DIR: ${{ inputs.output-dir }}\n        run: |\n          mkdir -p _site\n          if [ \"$DEPLOY_TYPE\" = \"docs\" ]; then\n            if [ -n \"$SITE_NAME\" ]; then\n              # Site built with base: /<name>/ — nest under _site/<name>/ so asset\n              # paths match (/name/_astro/... → served at /name/_astro/...).\n              mkdir -p \"_site/${SITE_NAME}\"\n              cp -r docs/dist/. \"_site/${SITE_NAME}/\"\n              # Redirect root to the base path so the preview URL lands correctly.\n              printf \"/ /%s/ 301\\n\" \"$SITE_NAME\" > _site/_redirects\n            else\n              cp -r docs/dist/. _site/\n            fi\n          fi\n          if [ \"$PROJECTS\" != \"[]\" ]; then\n            echo \"$PROJECTS\" | jq -c '.[]' | while IFS= read -r project; do\n              name=$(echo \"$project\" | jq -r '.name // \"\"')\n              workingDir=$(echo \"$project\" | jq -r '.workingDir')\n              outputDir=$(echo \"$project\" | jq -r '.outputDir // \"storybook-static\"')\n              if [ -n \"$name\" ]; then\n                target=\"_site/sandbox/${name}\"\n              else\n                target=\"_site/sandbox\"\n              fi\n              mkdir -p \"$target\"\n              cp -r \"${workingDir}/${outputDir}/.\" \"$target/\"\n            done\n          elif [ \"$DEPLOY_TYPE\" = \"storybook\" ]; then\n            mkdir -p _site/sandbox\n            cp -r \"${STORYBOOK_OUTPUT_DIR}/.\" _site/sandbox/\n          fi\n\n      - name: Install Wrangler\n        # The action's install step runs npm/pnpm in the repo root; pnpm fails\n        # because it rejects adding to a workspace root without -w, and npm fails\n        # because package.json contains pnpm catalog: references it cannot parse.\n        # Pre-installing from /tmp (no package.json) lets the action find wrangler\n        # already on PATH and skip its own install entirely.\n        working-directory: /tmp\n        run: npm install -g wrangler@4\n\n      - uses: cloudflare/wrangler-action@ebbaa1584979971c8614a24965b4405ff95890e0 # v4.0.0\n        id: deploy\n        name: Deploy to Cloudflare Pages\n        # Skip when neither the per-repo input nor the org variable is set.\n        if: ${{ inputs.cloudflare-project != '' || vars.CLOUDFLARE_PAGES_PROJECT != '' }}\n        with:\n          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}\n          accountId: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}\n          packageManager: npm\n          command: >-\n            pages deploy _site\n            --project-name ${{ inputs.cloudflare-project || vars.CLOUDFLARE_PAGES_PROJECT }}\n            --branch ${{ github.event.repository.name }}-pr-${{ github.event.pull_request.number }}\n            --commit-dirty=true\n\n      - name: Report preview URL\n        if: ${{ steps.deploy.outputs.pages-deployment-alias-url != '' }}\n        env:\n          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n          ALIAS: ${{ steps.deploy.outputs.pages-deployment-alias-url }}\n          SITE_NAME: ${{ inputs.name }}\n          PROJECT: ${{ inputs.cloudflare-project || vars.CLOUDFLARE_PAGES_PROJECT }}\n        run: |\n          PREVIEW_URL=\"${ALIAS%/}${SITE_NAME:+/${SITE_NAME}}/\"\n          # GITHUB_HEAD_REF is the PR branch name — links the deployment to this PR's sidebar widget.\n          PAYLOAD=$(printf '{\"ref\":\"%s\",\"environment\":\"%s\",\"description\":\"Cloudflare Pages\",\"production_environment\":false,\"auto_merge\":false,\"required_contexts\":[]}' \\\n            \"$GITHUB_HEAD_REF\" \"${PROJECT} (Preview)\")\n          DEPLOY_ID=$(echo \"$PAYLOAD\" | gh api \"repos/${GITHUB_REPOSITORY}/deployments\" \\\n            --method POST --input - | jq -r '.id')\n          gh api \"repos/${GITHUB_REPOSITORY}/deployments/${DEPLOY_ID}/statuses\" \\\n            --method POST --field state=success --field environment_url=\"${PREVIEW_URL}\"\n\n  cleanup:\n    name: Clean up Preview\n    if: ${{ github.event.action == 'closed' }}\n    runs-on: ubuntu-latest\n    permissions:\n      contents: read\n      deployments: write\n      pull-requests: write\n    steps:\n      - name: Delete Cloudflare Pages deployments for branch\n        if: ${{ inputs.cloudflare-project != '' || vars.CLOUDFLARE_PAGES_PROJECT != '' }}\n        env:\n          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}\n          CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}\n          PROJECT: ${{ inputs.cloudflare-project || vars.CLOUDFLARE_PAGES_PROJECT }}\n          BRANCH: ${{ github.event.repository.name }}-pr-${{ github.event.pull_request.number }}\n          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n        run: |\n          DEPLOYMENTS=$(curl -s \\\n            \"https://api.cloudflare.com/client/v4/accounts/${CLOUDFLARE_ACCOUNT_ID}/pages/projects/${PROJECT}/deployments\" \\\n            -H \"Authorization: Bearer ${CLOUDFLARE_API_TOKEN}\" \\\n            | jq -r --arg b \"$BRANCH\" \\\n              '.result[] | select(.deployment_trigger.metadata.branch == $b) | .id')\n\n          if [ -z \"$DEPLOYMENTS\" ]; then\n            echo \"No deployments found for branch ${BRANCH} — nothing to clean up.\"\n            exit 0\n          fi\n\n          for id in $DEPLOYMENTS; do\n            echo \"Deleting CF Pages deployment: $id\"\n            curl -s -X DELETE \\\n              \"https://api.cloudflare.com/client/v4/accounts/${CLOUDFLARE_ACCOUNT_ID}/pages/projects/${PROJECT}/deployments/${id}?force=true\" \\\n              -H \"Authorization: Bearer ${CLOUDFLARE_API_TOKEN}\" | jq -r 'if .success then \"  ✓ deleted\" else \"  ✗ \\(.errors[0].message)\" end'\n          done\n\n          # Mark the GitHub Deployment environment as inactive.\n          ENV_NAME=\"${PROJECT} (Preview)\"\n          gh api \"repos/${GITHUB_REPOSITORY}/deployments\" \\\n            | jq -r \".[] | select(.environment == \\\"${ENV_NAME}\\\") | .id\" \\\n            | while read -r deploy_id; do\n                gh api \"repos/${GITHUB_REPOSITORY}/deployments/${deploy_id}/statuses\" \\\n                  --method POST --field state=inactive 2>/dev/null || true\n              done\n";
+//#endregion
+//#region src/templates/reusable/review.yml
+var review_default$1 = "name: Review\n\n# ReviewDog is the annotation layer — posts inline PR diff annotations.\n# Runs on pull_request only: inline annotations require PR context,\n# and branch protection ensures all changes go through PRs anyway.\n# security.secretDetection.yml / sourceQuality.structuredDataValidation.yml\n# are the CI gates covering push + PR events. Gitleaks and YAML are\n# intentionally duplicated: those gate merges; ReviewDog surfaces exact\n# line annotations in the PR diff.\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n\njobs:\n  reviewdog:\n    name: Post inline lint annotations\n    runs-on: ubuntu-latest\n    timeout-minutes: 20\n    permissions:\n      contents: read\n      pull-requests: write\n\n    steps:\n      - name: Checkout repository\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          fetch-depth: 0\n\n      - name: Setup\n        if: ${{ hashFiles('pnpm-lock.yaml') != '' }}\n        uses: theholocron/.github/.github/actions/setup@main\n\n      - name: Install ReviewDog\n        uses: reviewdog/action-setup@d8a7baabd7f3e8544ee4dbde3ee41d0011c3a93f # v1\n        with:\n          reviewdog_version: latest\n\n      # Detect which tools are relevant for this repo, excluding node_modules.\n      # hashFiles('**/*') recurses into node_modules/.pnpm and produces false\n      # positives for repos that don't own those file types.\n      # -print -quit stops find after the first match without a pipe, avoiding\n      # the SIGPIPE/pipefail exit-141 that find|head-1 triggers under\n      # GitHub Actions' default bash --noprofile --norc -e -o pipefail mode.\n      - name: Detect project features\n        id: detect\n        shell: bash\n        run: |\n          has() { find . -not -path '*/node_modules/*' -name \"$1\" -print -quit 2>/dev/null | grep -q .; }\n          has_ext() { find . -not -path '*/node_modules/*' -name \"$1\" -print -quit 2>/dev/null | grep -q .; }\n          { { has 'eslint.config.js' || has 'eslint.config.mjs' || has 'eslint.config.cjs' || \\\n              has 'eslint.config.ts' || has '.eslintrc' || has '.eslintrc.js' || \\\n              has '.eslintrc.cjs' || has '.eslintrc.json' || has '.eslintrc.yaml' || \\\n              has '.eslintrc.yml'; } && grep -qF '\"eslint\":' package.json 2>/dev/null; } && echo \"eslint=true\" >> \"$GITHUB_OUTPUT\" || echo \"eslint=false\" >> \"$GITHUB_OUTPUT\"\n          { has 'tsconfig.json' && grep -qF '\"typescript\":' package.json 2>/dev/null; } && echo \"tsconfig=true\" >> \"$GITHUB_OUTPUT\" || echo \"tsconfig=false\" >> \"$GITHUB_OUTPUT\"\n          has_ext '*.sh' && echo \"shell=true\" >> \"$GITHUB_OUTPUT\" || echo \"shell=false\" >> \"$GITHUB_OUTPUT\"\n          has 'Dockerfile' || has_ext '*.Dockerfile' || has 'Containerfile' && \\\n            echo \"docker=true\" >> \"$GITHUB_OUTPUT\" || echo \"docker=false\" >> \"$GITHUB_OUTPUT\"\n          has_ext '.env*' && echo \"dotenv=true\" >> \"$GITHUB_OUTPUT\" || echo \"dotenv=false\" >> \"$GITHUB_OUTPUT\"\n          has_ext '*.md' && echo \"markdown=true\" >> \"$GITHUB_OUTPUT\" || echo \"markdown=false\" >> \"$GITHUB_OUTPUT\"\n\n      #\n      # Always applicable\n      #\n\n      - name: Gitleaks (secrets)\n        uses: reviewdog/action-gitleaks@2b7b5685e3e3eecddab5d30cfa04f18123031421 # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / gitleaks\"\n          fail_level: error\n          gitleaks_flags: --log-opts=${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }}\n\n      - name: YamlLint\n        if: ${{ hashFiles('.yamllint.yml') != '' }}\n        uses: reviewdog/action-yamllint@b5f7217d8c815ae374d1d55840d5e569d82f01f0 # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / yamllint\"\n          fail_level: error\n          yamllint_flags: -c ${{ github.workspace }}/.yamllint.yml ${{ github.workspace }}\n\n      - name: ActionLint (GitHub Actions)\n        if: ${{ hashFiles('.github/workflows/*.yml', '.github/workflows/*.yaml') != '' }}\n        uses: reviewdog/action-actionlint@6fb7acc99f4a1008869fa8a0f09cfca740837d9d # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / actionlint\"\n          fail_level: error\n\n      #\n      # TypeScript / JavaScript\n      #\n\n      - name: ESLint\n        if: steps.detect.outputs.eslint == 'true'\n        uses: reviewdog/action-eslint@556a3fdaf8b4201d4d74d406013386aa4f7dab96 # v1.34.0\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / eslint\"\n          fail_level: error\n          eslint_flags: .\n\n      - name: TypeScript\n        if: steps.detect.outputs.tsconfig == 'true'\n        uses: EPMatt/reviewdog-action-tsc@63d923a3c5b4497671940b8874f58a404e2351b5 # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / tsc\"\n          fail_level: error\n\n      #\n      # Shell\n      #\n\n      - name: ShellCheck\n        if: steps.detect.outputs.shell == 'true'\n        uses: reviewdog/action-shellcheck@4c07458293ac342d477251099501a718ae5ef86e # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / shellcheck\"\n          fail_level: none\n\n      #\n      # Docker\n      #\n\n      - name: Hadolint\n        if: steps.detect.outputs.docker == 'true'\n        uses: reviewdog/action-hadolint@1b2cfa6ba72072ad35158d7ff3aa49bbdc03506d # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / hadolint\"\n          fail_level: none\n\n      #\n      # Environment files\n      #\n\n      - name: dotenv-linter\n        if: steps.detect.outputs.dotenv == 'true'\n        uses: dotenv-linter/action-dotenv-linter@afde61cfda2ecffe7bea35837b6f20b956c88689 # v3.0.0\n        with:\n          reporter: github-code-suggestions\n\n      #\n      # Documentation\n      #\n\n      - name: Alex (inclusive language)\n        if: steps.detect.outputs.markdown == 'true'\n        uses: reviewdog/action-alex@347481655add010a2ae302df34b57c9bcfa0d6e4 # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / alex\"\n";
+//#endregion
+//#region src/templates/reusable/security.codeScanning.yml
+var security_codeScanning_default$1 = "name: Security\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      language:\n        description: CodeQL language to analyze\n        type: string\n        required: false\n        default: javascript-typescript\n\njobs:\n  analyze:\n    name: Analyze (${{ inputs.language }})\n    permissions:\n      actions: read\n      contents: read\n      security-events: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 45\n    # Do not cancel in-progress security scans.\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0\n        name: Initialize CodeQL\n        with:\n          languages: ${{ inputs.language }}\n\n      - uses: github/codeql-action/autobuild@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0\n        name: Autobuild\n\n      - uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0\n        name: Analyze\n        with:\n          category: /language:${{ inputs.language }}\n";
+//#endregion
+//#region src/templates/reusable/security.secretDetection.yml
+var security_secretDetection_default$1 = "name: Secret Detection\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  secret-detection:\n    name: Run gitleaks\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n\n      # gitleaks has no npm distribution — install the prebuilt binary via\n      # the maintainer's own documented install script.\n      # NOTE: unverified against a live CI run at authoring time (D12) — flag\n      # here if this needs adjustment.\n      - name: Install gitleaks\n        run: |\n          curl -sSfL https://raw.githubusercontent.com/gitleaks/gitleaks/master/install.sh | sh -s -- -b /usr/local/bin\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Run gitleaks\n        with:\n          task: security.secretDetection\n";
+//#endregion
+//#region src/templates/reusable/sourceQuality.deadCodeAnalysis.yml
+var sourceQuality_deadCodeAnalysis_default$1 = "name: Dead Code Analysis\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  dead-code-analysis:\n    name: Run knip\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          persist-credentials: false\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Run knip\n        with:\n          task: sourceQuality.deadCodeAnalysis\n";
+//#endregion
+//#region src/templates/reusable/sourceQuality.formatting.yml
+var sourceQuality_formatting_default$1 = "name: Formatting\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      enable-auto-commit:\n        description: >\n          Auto-commit prettier/editorconfig/markdownlint --fix results as a\n          verified commit via a GitHub App (same App used across every\n          formatting-capable task — D12).\n        type: boolean\n        required: false\n        default: false\n    secrets:\n      SUPER_LINTER_APP_ID:\n        required: false\n      SUPER_LINTER_PRIVATE_KEY:\n        required: false\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  formatting:\n    name: Run prettier, editorconfig-checker, markdownlint\n    permissions:\n      contents: write\n      statuses: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n      APP_ID_SET: ${{ secrets.SUPER_LINTER_APP_ID != '' }}\n    steps:\n      - name: Generate GitHub App token\n        id: app-token\n        if: >\n          inputs.enable-auto-commit == true &&\n          github.event.pull_request != null &&\n          github.event.pull_request.head.repo.full_name == github.repository &&\n          github.ref_name != github.event.repository.default_branch &&\n          env.APP_ID_SET == 'true'\n        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0\n        with:\n          app-id: ${{ secrets.SUPER_LINTER_APP_ID }}\n          private-key: ${{ secrets.SUPER_LINTER_PRIVATE_KEY }}\n\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n          token: ${{ steps.app-token.outputs.token || github.token }}\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      # editorconfig-checker has no npm distribution — install the prebuilt\n      # binary from its release tarball (v4.0.1+ ships the binary at the\n      # tarball root as `editorconfig-checker`, not `bin/ec-<os>-<arch>` —\n      # confirmed against a live CI run; the old asset name/path 404s now).\n      - name: Install editorconfig-checker\n        run: |\n          curl -sSL https://github.com/editorconfig-checker/editorconfig-checker/releases/latest/download/editorconfig-checker-linux-amd64.tar.gz \\\n            | tar xz -C /usr/local/bin editorconfig-checker\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Run prettier, editorconfig-checker, markdownlint\n        with:\n          task: sourceQuality.formatting\n\n      - uses: theholocron/.github/.github/actions/auto-commit@main\n        name: Commit and push formatting fixes\n        if: >\n          inputs.enable-auto-commit == true &&\n          github.event.pull_request != null &&\n          github.event.pull_request.head.repo.full_name == github.repository &&\n          github.ref_name != github.event.repository.default_branch &&\n          env.APP_ID_SET == 'true' &&\n          steps.app-token.conclusion == 'success'\n        with:\n          token: ${{ steps.app-token.outputs.token }}\n          branch: ${{ github.event.pull_request.head.ref || github.head_ref || github.ref }}\n          commit-message: \"chore: fix formatting issues\"\n          commit-options: \"--no-verify\"\n";
+//#endregion
+//#region src/templates/reusable/sourceQuality.staticAnalysis.yml
+var sourceQuality_staticAnalysis_default$1 = "name: Static Analysis\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      enable-auto-commit:\n        description: >\n          Auto-commit eslint --fix results as a verified commit via a GitHub App.\n          Requires SUPER_LINTER_APP_ID and SUPER_LINTER_PRIVATE_KEY secrets\n          (same App used across every formatting-capable task — D12).\n        type: boolean\n        required: false\n        default: false\n    secrets:\n      SUPER_LINTER_APP_ID:\n        required: false\n      SUPER_LINTER_PRIVATE_KEY:\n        required: false\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  static-analysis:\n    name: Run eslint and actionlint\n    permissions:\n      contents: write\n      statuses: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n      APP_ID_SET: ${{ secrets.SUPER_LINTER_APP_ID != '' }}\n    steps:\n      - name: Generate GitHub App token\n        id: app-token\n        if: >\n          inputs.enable-auto-commit == true &&\n          github.event.pull_request != null &&\n          github.event.pull_request.head.repo.full_name == github.repository &&\n          github.ref_name != github.event.repository.default_branch &&\n          env.APP_ID_SET == 'true'\n        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0\n        with:\n          app-id: ${{ secrets.SUPER_LINTER_APP_ID }}\n          private-key: ${{ secrets.SUPER_LINTER_PRIVATE_KEY }}\n\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n          token: ${{ steps.app-token.outputs.token || github.token }}\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      # actionlint has no npm distribution — install the prebuilt binary via\n      # the maintainer's own documented download script.\n      # NOTE: unverified against a live CI run at authoring time (D12) — flag\n      # here if this needs adjustment.\n      - name: Install actionlint\n        run: |\n          bash <(curl -sSf https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)\n          sudo mv ./actionlint /usr/local/bin/actionlint\n\n      - name: Check for merge-conflict markers\n        # No package distributes this as a standalone tool — a plain grep for\n        # the marker lines (the same check the old bundled linter ran, D12).\n        run: |\n          if grep -rlnE '^(<{7}|={7}|>{7})( |$)' \\\n            --exclude-dir=.git --exclude-dir=node_modules .; then\n            echo \"::error::merge-conflict markers found\"\n            exit 1\n          fi\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Run eslint and actionlint\n        with:\n          task: sourceQuality.staticAnalysis\n\n      - uses: theholocron/.github/.github/actions/auto-commit@main\n        name: Commit and push eslint --fix\n        if: >\n          inputs.enable-auto-commit == true &&\n          github.event.pull_request != null &&\n          github.event.pull_request.head.repo.full_name == github.repository &&\n          github.ref_name != github.event.repository.default_branch &&\n          env.APP_ID_SET == 'true' &&\n          steps.app-token.conclusion == 'success'\n        with:\n          token: ${{ steps.app-token.outputs.token }}\n          branch: ${{ github.event.pull_request.head.ref || github.head_ref || github.ref }}\n          commit-message: \"chore: fix static-analysis issues\"\n          commit-options: \"--no-verify\"\n";
+//#endregion
+//#region src/templates/reusable/sourceQuality.structuredDataValidation.yml
+var sourceQuality_structuredDataValidation_default$1 = "name: Structured Data Validation\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  structured-data-validation:\n    name: Run yamllint\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      # yamllint has no npm distribution — Python ships preinstalled on\n      # ubuntu-latest runners.\n      - name: Install yamllint\n        run: pip install --user yamllint\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Run yamllint\n        with:\n          task: sourceQuality.structuredDataValidation\n";
+//#endregion
+//#region src/templates/reusable/stale.yml
+var stale_default$1 = "name: Stale\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      days-before-stale:\n        description: Days of inactivity before an issue or PR is marked stale (applies to both unless type-specific value is set)\n        type: number\n        required: false\n        default: 30\n      days-before-close:\n        description: Days after stale label before closing (applies to both unless type-specific value is set)\n        type: number\n        required: false\n        default: 5\n      days-before-issue-stale:\n        description: Days of inactivity before an issue is marked stale; overrides days-before-stale when set to a non-negative value\n        type: number\n        required: false\n        default: -1\n      days-before-issue-close:\n        description: Days after stale label before closing an issue; overrides days-before-close when set to a non-negative value\n        type: number\n        required: false\n        default: -1\n      days-before-pr-stale:\n        description: Days of inactivity before a PR is marked stale; overrides days-before-stale when set to a non-negative value\n        type: number\n        required: false\n        default: -1\n      days-before-pr-close:\n        description: Days after stale label before closing a PR; overrides days-before-close when set to a non-negative value\n        type: number\n        required: false\n        default: -1\n      exempt-issue-labels:\n        description: Comma-separated labels that exempt an issue from being marked stale\n        type: string\n        required: false\n        default: \"in-progress,wip\"\n      exempt-pr-labels:\n        description: Comma-separated labels that exempt a PR from being marked stale\n        type: string\n        required: false\n        default: \"\"\n      exempt-all-issue-milestones:\n        description: Issues assigned to any milestone are never marked stale\n        type: boolean\n        required: false\n        default: true\n      exempt-all-pr-milestones:\n        description: PRs assigned to any milestone are never marked stale\n        type: boolean\n        required: false\n        default: true\n      exempt-all-issue-projects:\n        description: Issues assigned to any project are never marked stale\n        type: boolean\n        required: false\n        default: true\n      exempt-all-pr-projects:\n        description: PRs assigned to any project are never marked stale\n        type: boolean\n        required: false\n        default: true\n\njobs:\n  stale:\n    name: Mark stale issues and pull requests\n    permissions:\n      contents: write\n      issues: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    steps:\n      - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0\n        name: Run Stale\n        with:\n          close-issue-message: >\n            This issue was closed because it has been stalled for\n            ${{ inputs.days-before-close }} days with no activity.\n          days-before-close: ${{ inputs.days-before-close }}\n          days-before-issue-close: ${{ inputs.days-before-issue-close }}\n          days-before-issue-stale: ${{ inputs.days-before-issue-stale }}\n          days-before-pr-close: ${{ inputs.days-before-pr-close }}\n          days-before-pr-stale: ${{ inputs.days-before-pr-stale }}\n          days-before-stale: ${{ inputs.days-before-stale }}\n          exempt-all-issue-milestones: ${{ inputs.exempt-all-issue-milestones }}\n          exempt-all-issue-projects: ${{ inputs.exempt-all-issue-projects }}\n          exempt-all-pr-milestones: ${{ inputs.exempt-all-pr-milestones }}\n          exempt-all-pr-projects: ${{ inputs.exempt-all-pr-projects }}\n          exempt-issue-labels: ${{ inputs.exempt-issue-labels }}\n          exempt-pr-labels: ${{ inputs.exempt-pr-labels }}\n          stale-issue-label: wontfix\n          stale-issue-message: >\n            This issue is stale because it has been open ${{ inputs.days-before-stale }}\n            days with no activity. Remove the stale label or comment, or this will be\n            closed in ${{ inputs.days-before-close }} days.\n          stale-pr-label: wontfix\n          stale-pr-message: >\n            This PR is stale because it has been open ${{ inputs.days-before-stale }}\n            days with no activity. Remove the stale label or comment, or this will be\n            closed in ${{ inputs.days-before-close }} days.\n";
+//#endregion
+//#region src/templates/reusable/sync-dispatch.yml
+var sync_dispatch_default = "name: Sync Dispatch\n\non: # yamllint disable-line rule:truthy\n  workflow_dispatch:\n    inputs:\n      steps:\n        description: >\n          Sync steps to pass to each repo's sync.yml. Default is \"readme\"\n          (only README marker blocks are updated).\n        type: string\n        required: false\n        default: readme\n\npermissions:\n  contents: read\n\njobs:\n  broadcast:\n    name: Broadcast sync to all repos\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    steps:\n      - name: Dispatch sync to all repos with sync.yml\n        run: |\n          gh api /orgs/theholocron/repos --paginate --jq '.[].name' \\\n            | while IFS= read -r repo; do\n              gh api \"/repos/theholocron/$repo/contents/.github/workflows/sync.yml\" --silent 2>/dev/null || continue\n              echo \"Dispatching sync to theholocron/$repo\"\n              gh workflow run sync.yml \\\n                --repo \"theholocron/$repo\" \\\n                --field \"steps=$STEPS\" \\\n              || echo \"Warning: could not dispatch to theholocron/$repo — skipping\"\n            done\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN }}\n          STEPS: ${{ inputs.steps }}\n";
+//#endregion
+//#region src/templates/reusable/sync-github.yml
+var sync_github_default = "name: Sync workflow templates\n\n# Builds the holocron CLI from source and pushes updated workflow templates\n# and composite actions to downstream .github repos. Runs whenever the\n# template source files change on main or alpha.\n#\n# Secrets required:\n#   HOLOCRON_SYNC_TOKEN — fine-grained PAT (resource owner: org) with:\n#                  Actions:       Read and write  (dispatch workflow runs via gh workflow run)\n#                  Contents:      Read and write  (git trees, blobs, refs)\n#                  Pull requests: Read and write  (open sync PR)\n#                  Workflows:     Read and write  (write .github/workflows/*.yml)\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      primary-repo:\n        description: >\n          Primary .github repo — receives composite actions, reusable workflows,\n          and thin-caller templates. Requires a PR (branch protection assumed).\n        type: string\n        required: false\n        default: theholocron/.github\n      secondary-repos:\n        description: >\n          Space-separated list of secondary repos (reusable workflows + thin\n          callers only, no composite actions). Changes are delivered via pull\n          request, same as the primary repo.\n        type: string\n        required: false\n        default: \"\"\n      sync-branch:\n        description: Branch name used for the primary and secondary repo PRs\n        type: string\n        required: false\n        default: chore/sync-templates\n    secrets:\n      HOLOCRON_SYNC_TOKEN:\n        required: true\n      HOLOCRON_READ_TOKEN:\n        description: >\n          Fine-grained PAT for read-only GitHub API calls (e.g. resolving git\n          committer identity via `gh api user`). Falls back to HOLOCRON_SYNC_TOKEN.\n        required: false\n      GH_TOKEN:\n        description: >\n          Generic GitHub token fallback for `gh` CLI calls. Used when neither\n          HOLOCRON_READ_TOKEN nor HOLOCRON_SYNC_TOKEN is set.\n        required: false\n      HOLOCRON_AXIOM_TOKEN:\n        description: >\n          Axiom API token. When set alongside the HOLOCRON_AXIOM_DATASET\n          repo/org variable, the CLI ships this run's structured logs to Axiom.\n          Falls back to the vendor-native AXIOM_TOKEN secret.\n        required: false\n      AXIOM_TOKEN:\n        description: Vendor-native fallback for HOLOCRON_AXIOM_TOKEN.\n        required: false\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  sync:\n    name: Sync templates\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    permissions:\n      contents: read\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n      HOLOCRON_AXIOM_TOKEN: ${{ secrets.HOLOCRON_AXIOM_TOKEN || secrets.AXIOM_TOKEN }}\n      HOLOCRON_AXIOM_DATASET: ${{ vars.HOLOCRON_AXIOM_DATASET || vars.AXIOM_DATASET }}\n      POSTHOG_PROJECT_TOKEN: ${{ vars.POSTHOG_PROJECT_TOKEN }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: pnpm build\n        name: Build CLI\n\n      - name: Cache actionlint\n        id: cache-actionlint\n        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0\n        with:\n          path: /tmp/actionlint\n          key: actionlint-v1.7.7-linux-amd64\n\n      - name: Download actionlint\n        if: steps.cache-actionlint.outputs.cache-hit != 'true'\n        run: |\n          curl -fsSL https://github.com/rhysd/actionlint/releases/download/v1.7.7/actionlint_1.7.7_linux_amd64.tar.gz \\\n            | tar -xz -C /tmp actionlint\n\n      - name: Validate generated workflows\n        run: |\n          node packages/cli/dist/cli.mjs sync github \\\n            --repo \"$PRIMARY_REPO\" \\\n            --output-dir /tmp/sync-validate\n          /tmp/actionlint /tmp/sync-validate/.github/workflows/*.yml\n        env:\n          PRIMARY_REPO: ${{ inputs.primary-repo }}\n\n      - name: Sync primary repo (PR)\n        run: |\n          GIT_NAME=$(gh api user --jq .name 2>/dev/null || echo \"github-actions[bot]\")\n          GIT_EMAIL=$(gh api user --jq '\"\\(.id)+\\(.login)@users.noreply.github.com\"' 2>/dev/null || echo \"41898282+github-actions[bot]@users.noreply.github.com\")\n          COMMIT_MSG=\"chore: sync from theholocron/holocron\"$'\\n\\n'\"Signed-off-by: $GIT_NAME <$GIT_EMAIL>\"\n          node packages/cli/dist/cli.mjs sync github \\\n            --repo \"$PRIMARY_REPO\" \\\n            --branch \"$SYNC_BRANCH\" \\\n            --pr \\\n            --message \"$COMMIT_MSG\"\n          GH_TOKEN=\"$HOLOCRON_SYNC_TOKEN\" gh pr merge --auto --squash \\\n            --repo \"$PRIMARY_REPO\" \"$SYNC_BRANCH\" 2>/dev/null || true\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_READ_TOKEN || secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN }}\n          HOLOCRON_SYNC_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN }}\n          PRIMARY_REPO: ${{ inputs.primary-repo }}\n          SYNC_BRANCH: ${{ inputs.sync-branch }}\n\n      - name: Sync secondary repos (PR)\n        if: ${{ inputs.secondary-repos != '' }}\n        run: |\n          GIT_NAME=$(gh api user --jq .name 2>/dev/null || echo \"github-actions[bot]\")\n          GIT_EMAIL=$(gh api user --jq '\"\\(.id)+\\(.login)@users.noreply.github.com\"' 2>/dev/null || echo \"41898282+github-actions[bot]@users.noreply.github.com\")\n          COMMIT_MSG=\"chore: sync from theholocron/holocron\"$'\\n\\n'\"Signed-off-by: $GIT_NAME <$GIT_EMAIL>\"\n          for repo in $SECONDARY_REPOS; do\n            node packages/cli/dist/cli.mjs sync github \\\n              --repo \"$repo\" \\\n              --branch \"$SYNC_BRANCH\" \\\n              --pr \\\n              --message \"$COMMIT_MSG\"\n            GH_TOKEN=\"$HOLOCRON_SYNC_TOKEN\" gh pr merge --auto --squash \\\n              --repo \"$repo\" \"$SYNC_BRANCH\" 2>/dev/null || true\n          done\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_READ_TOKEN || secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN }}\n          HOLOCRON_SYNC_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN }}\n          SECONDARY_REPOS: ${{ inputs.secondary-repos }}\n          SYNC_BRANCH: ${{ inputs.sync-branch }}\n";
+//#endregion
+//#region src/templates/reusable/tag.yml
+var tag_default = "name: Tag\n\n# Release Please — fully automated tag and GitHub Release from Conventional Commits.\n# No package.json or npm publishing required. Operates in \"simple\" mode by default:\n# analyzes commits since the last tag, maintains a rolling Release PR, and creates\n# a tag + GitHub Release when that PR is merged.\n#\n# The calling repo must have two files at the root:\n#   release-please-config.json    — declares packages and release-type\n#   .release-please-manifest.json — tracks the current version\n\non: # yamllint disable-line rule:truthy\n  # Self-trigger: when this workflow lives in theholocron/.github itself,\n  # push to main runs Release Please for that repo's own releases.\n  push:\n    branches:\n      - main\n  workflow_call:\n    inputs:\n      release-type:\n        description: Release Please release type (simple, node, python, etc.)\n        type: string\n        required: false\n        default: simple\n      config-file:\n        description: Path to release-please-config.json\n        type: string\n        required: false\n        default: release-please-config.json\n      manifest-file:\n        description: Path to .release-please-manifest.json\n        type: string\n        required: false\n        default: .release-please-manifest.json\n\njobs:\n  tag:\n    name: Tag release\n    permissions:\n      contents: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    steps:\n      - uses: google-github-actions/release-please-action@e4dc86ba9405554aeba3c6bb2d169500e7d3b4ee # v4.1.1\n        name: Run Release Please\n        with:\n          release-type: ${{ inputs.release-type }}\n          config-file: ${{ inputs.config-file }}\n          manifest-file: ${{ inputs.manifest-file }}\n";
+//#endregion
+//#region src/templates/reusable/verification.performance.yml
+var verification_performance_default$1 = "name: Audit the Performance\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      lighthouse-config:\n        description: >\n          Path to the Lighthouse CI config file, forwarded to `holocron run\n          verification.performance -- --config`. Defaults to\n          lighthouse.config.cjs (the org standard).\n        type: string\n        required: false\n        default: lighthouse.config.cjs\n    secrets:\n      LHCI_GITHUB_APP_TOKEN:\n        required: false\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  performance:\n    name: Run Lighthouse CI\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n      # Read by `lhci autorun` inside `holocron run verification.performance`.\n      LHCI_GITHUB_APP_TOKEN: ${{ secrets.LHCI_GITHUB_APP_TOKEN }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: npm install -g @lhci/cli@0.14.x\n        name: Install Lighthouse CLI\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Run Lighthouse CI\n        with:\n          task: verification.performance\n          args: --config=${{ inputs.lighthouse-config }}\n";
+//#endregion
+//#region src/templates/reusable/verification.typeSafety.yml
+var verification_typeSafety_default$1 = "name: Typecheck\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  typecheck:\n    name: Run tsc --noEmit\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Type check\n        with:\n          task: verification.typeSafety\n";
+//#endregion
+//#region src/templates/reusable/verification.unitTests.yml
+var verification_unitTests_default$1 = "name: Test\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      run-unit:\n        description: Run unit tests with coverage (disable for UI-only repos that use Storybook testing exclusively)\n        type: boolean\n        required: false\n        default: true\n      run-storybook:\n        description: Run Storybook vitest interaction tests (requires .storybook/ setup)\n        type: boolean\n        required: false\n        default: false\n      run-interaction:\n        description: Run Storybook interaction and accessibility tests with Playwright\n        type: boolean\n        required: false\n        default: false\n      run-user-flow:\n        description: Run Cypress E2E user-flow tests (requires cypress.config.*)\n        type: boolean\n        required: false\n        default: false\n      wait-on-url:\n        description: URL to wait for before running Cypress tests (default is Vite dev server; override for non-Vite stacks e.g. http://localhost:3000 for Next.js)\n        type: string\n        required: false\n        default: \"http://localhost:5173\"\n    secrets:\n      CYPRESS_RECORD_KEY:\n        required: false\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  unit:\n    name: Run unit tests and collect coverage\n    if: ${{ inputs.run-unit }}\n    permissions:\n      contents: read\n      id-token: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Run tests with coverage\n        with:\n          task: verification.unitTests\n\n      # A Codecov upload must not fail silently. fail_ci_if_error makes a failed\n      # upload fail this step (the action's default is to log the error and pass),\n      # which fails the job and so the `Test / Conclusion` check. Whether that\n      # blocks a merge is up to whether the check is required, not this workflow\n      # (holocron#934).\n      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0\n        name: Upload coverage to Codecov\n        with:\n          use_oidc: true\n          fail_ci_if_error: true\n\n      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0\n        name: Upload test results to Codecov\n        if: ${{ !cancelled() }}\n        with:\n          use_oidc: true\n          fail_ci_if_error: true\n          report_type: test_results\n          files: \"**/test-report.junit.xml\"\n\n  storybook:\n    name: Run Storybook interaction tests\n    if: ${{ inputs.run-storybook }}\n    permissions:\n      contents: read\n      id-token: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: pnpm exec playwright install chromium --with-deps\n        name: Install Playwright\n\n      - run: pnpm test:storybook\n        name: Run Storybook tests\n\n      # A Codecov upload must not fail silently. fail_ci_if_error makes a failed\n      # upload fail this step (the action's default is to log the error and pass),\n      # which fails the job and so the `Test / Conclusion` check. Whether that\n      # blocks a merge is up to whether the check is required, not this workflow\n      # (holocron#934).\n      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0\n        name: Upload coverage to Codecov\n        with:\n          use_oidc: true\n          fail_ci_if_error: true\n\n      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0\n        name: Upload test results to Codecov\n        if: ${{ !cancelled() }}\n        with:\n          use_oidc: true\n          fail_ci_if_error: true\n          report_type: test_results\n          files: \"**/test-report.junit.xml\"\n\n  interaction-and-accessibility:\n    name: Run interactions and accessibility tests\n    if: ${{ inputs.run-interaction }}\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: pnpm exec playwright install --with-deps\n        name: Install Playwright\n\n      - run: pnpm test:storybook\n        name: Run interaction and accessibility tests\n\n  user-flow:\n    name: Run user flow tests\n    if: ${{ inputs.run-user-flow }}\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    strategy:\n      fail-fast: false\n      matrix:\n        containers: [1, 2]\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: pnpm exec cypress install\n        name: Install Cypress binary\n\n      - uses: cypress-io/github-action@1052aa98bbbe4f55210f844878213c07d9c8c399 # v6.7.13\n        name: Cypress run\n        with:\n          start: pnpm dev\n          wait-on: ${{ inputs.wait-on-url }}\n          record: true\n          parallel: true\n        env:\n          CYPRESS_RECORD_KEY: ${{ secrets.CYPRESS_RECORD_KEY }}\n          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n\n  conclusion:\n    name: Conclusion\n    runs-on: ubuntu-latest\n    if: always()\n    needs: [unit, storybook, interaction-and-accessibility, user-flow]\n    steps:\n      - name: Check job statuses\n        run: |\n          if [[ \"$RESULTS\" == *\"failure\"* ]] || [[ \"$RESULTS\" == *\"cancelled\"* ]]; then\n            exit 1\n          fi\n        env:\n          RESULTS: ${{ join(needs.*.result, ',') }}\n";
+//#endregion
+//#region src/templates/reusable/verification.visualRegression.yml
+var verification_visualRegression_default$1 = "name: Visual Regression\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      chromatic-projects:\n        description: >\n          JSON array of Chromatic projects to build, one matrix job per entry.\n          Each entry: { \"tokenName\": \"WEB\", \"workingDir\": \"apps/web\", \"buildScript\": \"build:storybook\" }.\n          tokenName maps to secret CHROMATIC_PROJECT_TOKEN_<TOKENNAME>; use \"default\"\n          (or omit for the legacy empty-string form) to use the bare CHROMATIC_PROJECT_TOKEN\n          secret for single-project repos.\n          buildScript defaults to \"build:storybook\" when omitted.\n          Required -- this task only exists in a repo's workflow list when it\n          opts into Chromatic at all (holocron#394/#1062): GitHub evaluates a\n          job's `if:` before expanding its `strategy.matrix`, so no default\n          here (empty or otherwise) can make a *disabled* Chromatic job\n          disappear from PR checks -- only not generating this job's thin\n          caller in the first place can. A repo that doesn't want Chromatic\n          simply omits `verification.visualRegression` from its `tasks:`.\n        type: string\n        required: true\n    secrets:\n      CHROMATIC_PROJECT_TOKEN:\n        required: false\n\njobs:\n  visual-and-composition:\n    name: Run visual and composition tests\n    strategy:\n      fail-fast: false\n      matrix:\n        project: ${{ fromJSON(inputs.chromatic-projects) }}\n    permissions:\n      contents: read\n      statuses: write\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: chromaui/action@14cfaef73576e69f95f47f60058063f46ca38719 # v18\n        name: Publish to Chromatic\n        with:\n          projectToken: ${{ (matrix.project.tokenName == 'default' || matrix.project.tokenName == '') && secrets.CHROMATIC_PROJECT_TOKEN || secrets[format('CHROMATIC_PROJECT_TOKEN_{0}', matrix.project.tokenName)] }}\n          token: ${{ github.token }}\n          buildScriptName: ${{ matrix.project.buildScript || 'build:storybook' }}\n          workingDir: ${{ matrix.project.workingDir || '.' }}\n          storybookBaseDir: ${{ matrix.project.storybookBaseDir || '' }}\n          untraced: ${{ matrix.project.untraced || '' }}\n          onlyStoryFiles: ${{ matrix.project.onlyStoryFiles || '' }}\n          exitZeroOnChanges: ${{ matrix.project.exitZeroOnChanges || false }}\n";
+//#endregion
+//#region src/generators/github-action-thin-callers/github-action-thin-callers.ts
+/**
+* Workflow templates + thin-caller generation.
+*
+* `WORKFLOW_TEMPLATES` holds each reusable `.github/workflows/<name>.yml`
+* (synced to `theholocron/.github`); `generateThinCallerContent` wraps one
+* into the thin caller `holocron repo setup` / `holocron repo sync` write locally.
+*/
+const WORKFLOW_TEMPLATES = {
+	"verification.unitTests": "name: Verification\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\nconcurrency:\n  group: test-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n  id-token: write\n  statuses: write\n\njobs:\n  test:\n    name: Test\n    uses: theholocron/.github/.github/workflows/verification.unitTests.yml@main\n    with:\n      run-unit: true\n    secrets: inherit\n",
+	"verification.visualRegression": "name: Visual Regression\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\npermissions:\n  contents: read\n  statuses: write\n\njobs:\n  visual-and-composition:\n    name: Visual Regression\n    uses: theholocron/.github/.github/workflows/verification.visualRegression.yml@main\n    secrets: inherit\n",
+	"verification.typeSafety": "name: Verification\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\nconcurrency:\n  group: typecheck-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n\njobs:\n  typecheck:\n    name: Typecheck\n    uses: theholocron/.github/.github/workflows/verification.typeSafety.yml@main\n    secrets: inherit\n",
+	"verification.performance": "name: Verification\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\npermissions:\n  contents: read\n\njobs:\n  performance:\n    name: Audit the Performance\n    uses: theholocron/.github/.github/workflows/verification.performance.yml@main\n    secrets: inherit\n",
+	"sourceQuality.staticAnalysis": "name: Source Quality\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\nconcurrency:\n  group: source-quality-static-analysis-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: write\n  statuses: write\n\njobs:\n  static-analysis:\n    name: Static Analysis\n    uses: theholocron/.github/.github/workflows/sourceQuality.staticAnalysis.yml@main\n    secrets: inherit\n",
+	"sourceQuality.formatting": "name: Source Quality\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\nconcurrency:\n  group: source-quality-formatting-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: write\n  statuses: write\n\njobs:\n  formatting:\n    name: Formatting\n    uses: theholocron/.github/.github/workflows/sourceQuality.formatting.yml@main\n    secrets: inherit\n",
+	"sourceQuality.structuredDataValidation": "name: Source Quality\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\nconcurrency:\n  group: source-quality-structured-data-validation-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n\njobs:\n  structured-data-validation:\n    name: Structured Data Validation\n    uses: theholocron/.github/.github/workflows/sourceQuality.structuredDataValidation.yml@main\n    secrets: inherit\n",
+	"sourceQuality.deadCodeAnalysis": "name: Source Quality\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\npermissions:\n  contents: read\n\njobs:\n  dead-code-analysis:\n    name: Dead Code Analysis\n    uses: theholocron/.github/.github/workflows/sourceQuality.deadCodeAnalysis.yml@main\n    secrets: inherit\n",
+	"security.secretDetection": "name: Security\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\nconcurrency:\n  group: security-secret-detection-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n\njobs:\n  secret-detection:\n    name: Secret Detection\n    uses: theholocron/.github/.github/workflows/security.secretDetection.yml@main\n    secrets: inherit\n",
+	"security.codeScanning": "name: Security\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches:\n      - main\n  pull_request:\n    branches:\n      - main\n  schedule:\n    - cron: \"0 0 * * 1\"\n\npermissions:\n  actions: read\n  contents: read\n  security-events: write\n\njobs:\n  security:\n    name: Code Scanning\n    uses: theholocron/.github/.github/workflows/security.codeScanning.yml@main\n    secrets: inherit\n",
+	"delivery.build": "name: Delivery\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches-ignore:\n      - main # delivery.publish builds before publishing\n  pull_request:\n    branches:\n      - main\n\nconcurrency:\n  group: delivery.build-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n\njobs:\n  build:\n    name: Build\n    uses: theholocron/.github/.github/workflows/delivery.build.yml@main\n    secrets: inherit\n",
+	"delivery.publish": "name: Delivery\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches:\n      - main\n      - alpha\n  workflow_dispatch:\n    inputs:\n      dry_run:\n        description: >\n          Dry run — analyze commits and preview the release without git writes\n          or publish. Push-triggered runs always run fully; this only applies\n          to manual workflow_dispatch triggers.\n        required: false\n        default: true\n        type: boolean\n\npermissions:\n  contents: write\n  id-token: write\n  issues: write\n  pull-requests: write\n\nconcurrency:\n  group: ${{ github.workflow }}-${{ github.ref }}\n  cancel-in-progress: false\n\njobs:\n  release:\n    name: Release\n    uses: theholocron/.github/.github/workflows/delivery.publish.yml@main\n    with:\n      dry-run: ${{ inputs.dry_run == true }}\n    secrets: inherit\n",
+	"delivery.deploy": "name: Delivery\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main]\n  workflow_dispatch:\n\nconcurrency:\n  group: pages\n  cancel-in-progress: false\n\npermissions:\n  contents: read\n  pages: write\n  id-token: write\n\njobs:\n  deploy:\n    name: Deploy\n    uses: theholocron/.github/.github/workflows/delivery.deploy.yml@main\n    secrets: inherit\n",
+	"delivery.bundleSize": "name: Delivery\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\npermissions:\n  contents: read\n\njobs:\n  bundle-size:\n    name: Audit the Bundle Size\n    uses: theholocron/.github/.github/workflows/delivery.bundleSize.yml@main\n    secrets: inherit\n",
+	"delivery.previewCheck": "name: Delivery\n\non: # yamllint disable-line rule:truthy\n  deployment_status:\n\npermissions:\n  contents: read\n  # Must be a superset of what the reusable workflow's own job\n  # requests (holocron#1058) -- GitHub hard-fails the whole run at\n  # startup, zero jobs dispatched, if the callee asks for more than\n  # the caller grants. Needed for the author-trust step's\n  # commits/{sha}/pulls lookup.\n  pull-requests: read\n\njobs:\n  preview-check:\n    name: Preview Check\n    # environment_url is the only field documented to point at the live\n    # app — target_url can point at a deployment-details page instead,\n    # so there's no safe fallback to it. No environment_url means\n    # nothing to check; skip the job entirely rather than hit the wrong\n    # page.\n    if: >-\n      github.event.deployment_status.state == 'success' &&\n      github.event.deployment.environment == 'Preview' &&\n      github.event.deployment_status.environment_url != ''\n    uses: theholocron/.github/.github/workflows/delivery.previewCheck.yml@main\n    with:\n      preview-url: ${{ github.event.deployment_status.environment_url }}\n      # GitHub evaluates which version of this workflow file to run\n      # from the default branch for a deployment_status event (unlike\n      # push/pull_request) -- without this, the reusable workflow's\n      # checkout would default to that same ref instead of the PR's\n      # actual deployed commit.\n      sha: ${{ github.event.deployment.sha }}\n    secrets:\n      # Named explicitly, not `secrets: inherit` -- this job needs only\n      # these two secrets (holocron#1030/#1032), not every secret this\n      # workflow's caller context has access to (e.g.\n      # HOLOCRON_DEPLOYMENTS_TOKEN). VERCEL_TOKEN here is read-only use\n      # (verifying deployment ownership), never a write/deploy\n      # credential.\n      VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}\n      VERCEL_PROTECTION_BYPASS_SECRET: ${{ secrets.VERCEL_PROTECTION_BYPASS_SECRET }}\n",
+	"delivery.previewDeploy": "name: Delivery\n\non: # yamllint disable-line rule:truthy\n  pull_request: {}\n\nconcurrency:\n  group: preview-deploy-${{ github.event.pull_request.number }}\n  # Not true: a cancelled run could land between Vercel accepting the\n  # upload and the report job posting a status, leaving a real preview\n  # deployment with no corresponding GitHub check — worse than letting an\n  # overlapping run for the same PR simply queue.\n  cancel-in-progress: false\n\npermissions:\n  contents: read\n  deployments: write\n  # Must be a superset of what the reusable workflow's own job requests\n  # (holocron#1058) -- its new path-relevance check lists the PR's\n  # changed files via the API (holocron#1023).\n  pull-requests: read\n\njobs:\n  preview-deploy:\n    name: Preview Deploy\n    uses: theholocron/.github/.github/workflows/delivery.previewDeploy.yml@main\n    with:\n      cwd: \".\"\n    secrets: inherit\n",
+	"platform.repoSync": "name: Platform\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main]\n    paths:\n      - holocron.config.ts\n      - package.json\n      - pnpm-workspace.yaml\n  workflow_dispatch:\n    inputs:\n      steps:\n        description: \"Sync steps to run (default: all)\"\n        type: string\n        required: false\n\nconcurrency:\n  group: sync-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: write\n  pull-requests: write\n\njobs:\n  sync:\n    name: Sync\n    uses: theholocron/.github/.github/workflows/platform.repoSync.yml@main\n    with:\n      steps: ${{ inputs.steps }}\n    secrets: inherit\n",
+	"platform.notifyCheck": "name: Platform\n\non: # yamllint disable-line rule:truthy\n  workflow_dispatch: {}\n\npermissions: {}\n\njobs:\n  notify-check:\n    name: Notify Check\n    uses: theholocron/.github/.github/workflows/platform.notifyCheck.yml@main\n    secrets: inherit\n",
+	"platform.commitStandards": "name: Platform\n\non: # yamllint disable-line rule:truthy\n  pull_request:\n\nconcurrency:\n  group: platform-commit-standards-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n\njobs:\n  commit-standards:\n    name: Commit Standards\n    uses: theholocron/.github/.github/workflows/platform.commitStandards.yml@main\n    secrets: inherit\n",
+	"platform.repoValidation": "name: Platform\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\npermissions:\n  contents: read\n\njobs:\n  repo-validation:\n    name: Repo Validation\n    uses: theholocron/.github/.github/workflows/platform.repoValidation.yml@main\n    secrets: inherit\n",
+	"platform.syncTemplates": "name: Platform\n\n# Bootstrap note: this `uses:` a reusable workflow that must already exist\n# on theholocron/.github's main branch to resolve at all — a brand-new\n# reusable workflow here needs ONE manual `holocron sync github` run\n# (pushing directly to theholocron/.github) before this thin caller can\n# ever successfully trigger it, since GitHub resolves `uses:` at run time,\n# not at merge time. Same deadlock every reusable workflow added here hits\n# on its first introduction.\non: # yamllint disable-line rule:truthy\n  push:\n    # main only — this publishes to theholocron/.github, consumed by every\n    # other repo's CI. alpha is the prerelease channel; publishing from it\n    # would let unreleased/unstable template changes overwrite what main\n    # just published, the same stable-vs-prerelease split this org already\n    # enforces for npm's dist-tags and Sentinel's own deploy trigger.\n    branches: [main]\n    paths:\n      - packages/astromech/src/templates/**\n      - packages/astromech/src/generators/**\n      - packages/astromech/src/registry/**\n      - packages/cli/src/templates/**\n  workflow_dispatch: {}\n\nconcurrency:\n  group: sync-templates\n  cancel-in-progress: false\n\npermissions:\n  contents: read\n\njobs:\n  sync-templates:\n    name: Sync Templates\n    # workflow_dispatch can target ANY ref, not only main — without this,\n    # anyone able to dispatch this workflow (a broader group than who can\n    # push to main) could run it against an arbitrary branch, checking out\n    # and building that ref's own code with the sync token present, then\n    # publishing that ref's templates to theholocron/.github.\n    if: github.ref == 'refs/heads/main'\n    uses: theholocron/.github/.github/workflows/platform.syncTemplates.yml@main\n    secrets: inherit\n",
+	"knowledge.wiki": "name: Knowledge\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main]\n  pull_request:\n    branches: [main]\n\nconcurrency:\n  group: ${{ github.event_name == 'pull_request' && format('wiki-preview-{0}', github.event.pull_request.number) || 'wiki' }}\n  cancel-in-progress: ${{ github.event_name == 'pull_request' }}\n\npermissions:\n  contents: read\n  deployments: write\n\njobs:\n  publish:\n    name: Publish\n    if: ${{ github.event_name != 'pull_request' }}\n    uses: theholocron/.github/.github/workflows/knowledge.wiki.yml@main\n    secrets: inherit\n\n  preview:\n    name: Preview\n    if: ${{ github.event_name == 'pull_request' }}\n    uses: theholocron/.github/.github/workflows/knowledge.wiki.yml@main\n    with:\n      preview: true\n      preview-id: pr-${{ github.event.pull_request.number }}\n    secrets: inherit\n",
+	preview: "name: Preview\n\non: # yamllint disable-line rule:truthy\n  pull_request:\n    branches: [main]\n\nconcurrency:\n  group: preview-${{ github.event.pull_request.number }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n  deployments: write\n  pull-requests: write\n\njobs:\n  preview:\n    name: Preview\n    uses: theholocron/.github/.github/workflows/preview.yml@main\n    secrets: inherit\n",
+	review: "name: Source Quality\n\non: # yamllint disable-line rule:truthy\n  pull_request:\n\nconcurrency:\n  group: review-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n  checks: write\n  pull-requests: write\n\njobs:\n  review:\n    name: Annotations\n    uses: theholocron/.github/.github/workflows/review.yml@main\n    secrets: inherit\n",
+	stale: "name: Stale\n\non: # yamllint disable-line rule:truthy\n  schedule:\n    - cron: \"30 1 * * *\"\n\npermissions:\n  contents: write\n  issues: write\n  pull-requests: write\n\njobs:\n  stale:\n    uses: theholocron/.github/.github/workflows/stale.yml@main\n    with:\n      exempt-issue-labels: \"in-progress,wip\"\n      exempt-all-issue-milestones: true\n      exempt-all-issue-projects: true\n      exempt-all-pr-projects: true\n    secrets: inherit\n",
+	greetings: "name: Platform\n\non: # yamllint disable-line rule:truthy\n  pull_request:\n  issues:\n\npermissions:\n  issues: write\n  pull-requests: write\n\njobs:\n  greetings:\n    name: Greetings\n    uses: theholocron/.github/.github/workflows/greetings.yml@main\n    secrets: inherit\n",
+	dependencies: "name: Platform\n\non: # yamllint disable-line rule:truthy\n  pull_request:\n\npermissions:\n  contents: write\n  pull-requests: write\n\njobs:\n  dependencies:\n    name: Dependencies\n    uses: theholocron/.github/.github/workflows/dependencies.yml@main\n    secrets: inherit\n",
+	bookkeeping: "name: Platform\n\non: # yamllint disable-line rule:truthy\n  pull_request:\n    types:\n      - opened\n      - edited\n\npermissions:\n  contents: read\n  issues: write\n  pull-requests: write\n\njobs:\n  bookkeeping:\n    name: Bookkeeping\n    uses: theholocron/.github/.github/workflows/bookkeeping.yml@main\n    secrets: inherit\n"
+};
+const KNOWN_WORKFLOWS = new Set(Object.keys(WORKFLOW_TEMPLATES));
+/**
+* The GitHub status-check context a `required` task contributes to branch
+* protection. Format: `"{workflow name} / {job name}"`.
+*
+* Most of these are single-job workflows now (D3's decomposition split what
+* used to be multi-job `lint`/`audit` into one task per concern) — the
+* context names that job directly, no `Conclusion` aggregator needed; a
+* single job's own conclusion already *is* the workflow's conclusion.
+* `Conclusion` fan-in jobs are kept only where a task genuinely has several
+* conditionally-run jobs feeding one required check:
+* `verification.unitTests` (unit / Storybook / Chromatic / interaction /
+* user-flow, each gated by its own `run-*` input) and
+* `platform.repoValidation` (its three script jobs all must pass). Only
+* merge-gating workflows are listed. `astromech.requiredChecks()` reads this
+* for every `required` task.
+*/
+const WORKFLOW_CHECK_CONTEXTS = {
+	"delivery.build": "Build / Build every workspace",
+	"verification.unitTests": "Test / Conclusion",
+	"verification.typeSafety": "Typecheck / Run tsc --noEmit",
+	"verification.performance": "Audit the Performance / Run Lighthouse CI",
+	"sourceQuality.staticAnalysis": "Static Analysis / Run eslint and actionlint",
+	"sourceQuality.formatting": "Formatting / Run prettier, editorconfig-checker, markdownlint",
+	"sourceQuality.structuredDataValidation": "Structured Data Validation / Run yamllint",
+	"sourceQuality.deadCodeAnalysis": "Dead Code Analysis / Run knip",
+	"security.secretDetection": "Secret Detection / Run gitleaks",
+	"platform.commitStandards": "Commit Standards / Run commitlint",
+	"platform.repoValidation": "Repo Validation / Conclusion",
+	"delivery.bundleSize": "Audit the Bundle Size / Upload bundle stats to Codecov"
+};
+/**
+* Generate the thin caller content for a workflow, optionally injecting or
+* merging `with:` overrides into the jobs block.
+*
+* Two strategies are used depending on the template:
+* - Templates that already have a `with:` block (e.g. lint):
+*   the override entries are merged in, replacing existing keys and appending
+*   new ones.
+* - Templates that end with `    secrets: inherit`: a new `with:` block is
+*   injected immediately before `secrets: inherit`.
+* If neither pattern matches the template, a warning is emitted and the
+* base template is returned unchanged.
+*/
+function generateThinCallerContent(name, withOverrides, additionalPaths, logger, comments) {
+	const base = WORKFLOW_TEMPLATES[name];
+	if (!base) return "";
+	const yamlScalar = (v) => {
+		if (v === true) return "true";
+		if (v === false) return "false";
+		const s = String(v);
+		return s.startsWith("[") || s.startsWith("{") ? `'${s}'` : s;
+	};
+	const fmt = (k, v) => {
+		const line = `      ${k}: ${yamlScalar(v)}`;
+		return comments?.[k] ? `      # ${comments[k]}\n${line}` : line;
+	};
+	let result = base;
+	if (additionalPaths && additionalPaths.length > 0) {
+		const pathsBlockRe = /( {4}paths:\n)((?:[ ]{6}- [^\n]+\n)+)/;
+		if (pathsBlockRe.test(result)) result = result.replace(pathsBlockRe, (_, header, existing) => {
+			const existingPaths = new Set([...existing.matchAll(/- (.+)/g)].map((m) => m[1]));
+			const newEntries = additionalPaths.filter((p) => !existingPaths.has(p)).map((p) => `      - ${p}\n`).join("");
+			return header + existing + newEntries;
+		});
+		else {
+			const pathsBlock = `    paths:\n${additionalPaths.map((p) => `      - ${p}\n`).join("")}`;
+			result = result.replace(/( {4}branches: \[main\]\n)/, `$1${pathsBlock}`);
+		}
+	}
+	if (!withOverrides || Object.keys(withOverrides).length === 0) return result;
+	const withBlockRe = /( {4}with:\n)((?:[ ]{6}[^\n]+\n)*)/;
+	const existingMatch = result.match(withBlockRe);
+	if (existingMatch) {
+		const existingEntries = new Map(existingMatch[2].split("\n").filter(Boolean).filter((line) => !line.trim().startsWith("#")).map((line) => {
+			const m = line.match(/^ {6}([^:]+):\s*(.*)/);
+			return m ? [m[1].trim(), m[2].trim()] : null;
+		}).filter((e) => e !== null));
+		for (const [k, v] of Object.entries(withOverrides)) existingEntries.set(k, yamlScalar(v));
+		const merged = [...existingEntries.entries()].map(([k, v]) => `      ${k}: ${v}`).join("\n");
+		return result.replace(withBlockRe, `    with:\n${merged}\n`);
+	}
+	const withBlock = Object.entries(withOverrides).map(([k, v]) => fmt(k, v)).join("\n");
+	const injected = result.replace(/ {4}secrets: inherit\n$/, `    with:\n${withBlock}\n    secrets: inherit\n`);
+	if (injected === result) logger?.warn({ template: name }, "generateThinCallerContent: could not inject `with:` overrides");
+	return injected;
+}
+/**
+* Extract the Cloudflare Pages preview config from a deploy workflow's `with:` object.
+*
+* Accepts three forms:
+* - `preview: true` — derive both project and domain from org context
+* - `preview: { project: "..." }` — explicit project; domain derived from context if omitted
+* - `preview: { project: "...", domain: "..." }` — fully explicit
+*
+* Returns null when `preview:` is absent, false, or can't be resolved.
+*/
+function extractPreviewConfig(raw, ctx = {}) {
+	const preview = raw["preview"];
+	if (!preview) return null;
+	if (preview === true) {
+		const project = ctx.org ? `${ctx.org}-preview` : null;
+		const domain = ctx.domain ? `preview.${ctx.domain}` : void 0;
+		if (!project) return null;
+		return {
+			project,
+			...domain ? { domain } : {}
+		};
+	}
+	if (typeof preview !== "object") return null;
+	const p = preview;
+	const project = typeof p["project"] === "string" && p["project"] ? p["project"] : ctx.org ? `${ctx.org}-preview` : null;
+	if (!project) return null;
+	const domain = typeof p["domain"] === "string" && p["domain"] ? p["domain"] : ctx.domain ? `preview.${ctx.domain}` : void 0;
+	return {
+		project,
+		...domain ? { domain } : {}
+	};
+}
+/**
+* Generate the full thin-caller YAML for a `deploy.yml` that handles both
+* production (push to main → GitHub Pages) and preview (pull_request →
+* Cloudflare Pages) in a single file.
+*
+* Both jobs receive the same docs/storybook `with:` inputs. If the per-repo
+* config supplies `cloudflare-project` it is forwarded; otherwise the reusable
+* falls back to the `CLOUDFLARE_PAGES_PROJECT` org variable — set that once and
+* all repos with a `deploy` workflow get previews without per-repo config.
+*/
+function generateCombinedDeployContent(deployWith, paths, preview) {
+	const yamlScalar = (v) => {
+		if (v === true) return "true";
+		if (v === false) return "false";
+		const s = String(v);
+		return s.startsWith("[") || s.startsWith("{") ? `'${s}'` : s;
+	};
+	const withLines = (entries) => Object.entries(entries).map(([k, v]) => `      ${k}: ${yamlScalar(v)}`).join("\n");
+	const pathsBlock = paths.length > 0 ? `    paths:\n${paths.map((p) => `      - ${p}\n`).join("")}` : "";
+	const previewWith = {
+		...deployWith,
+		"cloudflare-project": preview.project
+	};
+	const deployWithBlock = Object.keys(deployWith).length > 0 ? `    with:\n${withLines(deployWith)}\n` : "";
+	const previewWithBlock = `    with:\n${withLines(previewWith)}\n`;
+	return [
+		`name: Deploy`,
+		``,
+		`on: # yamllint disable-line rule:truthy`,
+		`  push:`,
+		`    branches: [main]`,
+		...pathsBlock ? [`${pathsBlock}`] : [],
+		`  pull_request:`,
+		`    branches: [main]`,
+		`    types: [opened, synchronize, reopened, closed]`,
+		...pathsBlock ? [`${pathsBlock}`] : [],
+		`  workflow_dispatch:`,
+		``,
+		`concurrency:`,
+		`  group: $\{{ github.event_name == 'pull_request' && format('preview-{0}', github.event.pull_request.number) || 'pages' }}`,
+		`  cancel-in-progress: $\{{ github.event_name == 'pull_request' && github.event.action != 'closed' }}`,
+		``,
+		`permissions:`,
+		`  contents: read`,
+		`  deployments: write`,
+		`  pages: write`,
+		`  id-token: write`,
+		`  pull-requests: write`,
+		``,
+		`jobs:`,
+		`  deploy:`,
+		`    name: Deploy`,
+		`    if: \${{ github.event_name != 'pull_request' }}`,
+		`    uses: theholocron/.github/.github/workflows/delivery.deploy.yml@main`,
+		...deployWithBlock ? [deployWithBlock.trimEnd()] : [],
+		`    secrets: inherit`,
+		``,
+		`  preview:`,
+		`    name: Preview`,
+		`    if: \${{ github.event_name == 'pull_request' }}`,
+		`    uses: theholocron/.github/.github/workflows/preview.yml@main`,
+		previewWithBlock.trimEnd(),
+		`    secrets: inherit`,
+		``
+	].join("\n");
+}
+/**
+* Expand structured with-values to flat GitHub Actions inputs before
+* generating the thin caller. Handles:
+*   - deploy shorthand: docs/storybook → type + storybook-projects
+*   - preview: stripped (handled separately via extractPreviewConfig)
+*   - chromatic-projects entries' untraced array → newline-joined string
+*   - plain arrays → JSON-stringified for YAML scalar quoting
+*
+* Used by both `holocron repo setup` and `sync-workflow-templates`.
+*/
+function normalizeWorkflowWith(raw) {
+	const result = { ...raw };
+	delete result["preview"];
+	const hasDocs = raw["docs"] === true || raw["docs"] !== null && typeof raw["docs"] === "object";
+	const storybookProjects = raw["storybook"];
+	if (hasDocs) {
+		result["type"] = "docs";
+		delete result["docs"];
+	}
+	if (Array.isArray(storybookProjects)) {
+		if (!hasDocs) result["type"] = "storybook";
+		result["storybook-projects"] = JSON.stringify(storybookProjects.map(({ name, path = "." }) => ({
+			name,
+			workingDir: path
+		})));
+		delete result["storybook"];
+	}
+	const chromaticProjects = raw["chromatic-projects"];
+	if (Array.isArray(chromaticProjects)) result["chromatic-projects"] = chromaticProjects.map((p) => ({
+		...p,
+		...Array.isArray(p.untraced) ? { untraced: p.untraced.join("\n") } : {}
+	}));
+	for (const [k, v] of Object.entries(result)) if (Array.isArray(v)) result[k] = JSON.stringify(v);
+	return result;
+}
+/**
+* Derive on.push.paths entries from the deploy with: shorthand.
+* Used by both `holocron repo setup` and `sync-workflow-templates`.
+*/
+function deriveDeployPaths(raw) {
+	const paths = [];
+	const docs = raw["docs"];
+	if (docs === true) {
+		paths.push("docs/**");
+		paths.push("astro.config.ts");
+		paths.push("pnpm-workspace.yaml");
+		paths.push("pnpm-lock.yaml");
+	} else if (docs !== null && typeof docs === "object" && "path" in docs) {
+		const p = docs.path;
+		if (p && p !== ".") paths.push(`${p}/**`);
+	}
+	const storybookProjects = raw["storybook"];
+	if (Array.isArray(storybookProjects)) for (const s of storybookProjects) {
+		const p = s.path || ".";
+		if (p === ".") {
+			paths.push("src/**");
+			paths.push(".storybook/**");
+		} else paths.push(`${p}/**`);
+	}
+	return paths;
+}
+//#endregion
+//#region src/generators/github-action-reusable-workflows/github-action-reusable-workflows.ts
+/**
+* The **reusable** GitHub Actions surface pushed to `theholocron/.github` by
+* `holocron sync github` — the `workflow_call` implementations and composite
+* actions that every repo's thin callers delegate to.
+*
+* `theholocron/.github` is a **pure sync target**: `.github/workflows/*`,
+* `.github/actions/*` and `workflow-templates/*` there are generated from the
+* `.yml` files in `src/templates/reusable/` and pushed verbatim (with a
+* "do not edit" header). Never hand-edit them in `.github`.
+*
+* Not to be confused with `WORKFLOW_TEMPLATES` in `github-action-thin-callers.ts` — those are
+* the *thin-caller bases* written into each consumer repo's `.github/workflows/`.
+*/
+/** `workflow_call` implementations → `.github/workflows/<name>.yml`. */
+const REUSABLE_WORKFLOWS = {
+	"verification.unitTests": verification_unitTests_default$1,
+	"verification.visualRegression": verification_visualRegression_default$1,
+	"verification.typeSafety": verification_typeSafety_default$1,
+	"verification.performance": verification_performance_default$1,
+	"sourceQuality.staticAnalysis": sourceQuality_staticAnalysis_default$1,
+	"sourceQuality.formatting": sourceQuality_formatting_default$1,
+	"sourceQuality.structuredDataValidation": sourceQuality_structuredDataValidation_default$1,
+	"sourceQuality.deadCodeAnalysis": sourceQuality_deadCodeAnalysis_default$1,
+	"security.secretDetection": security_secretDetection_default$1,
+	"security.codeScanning": security_codeScanning_default$1,
+	"delivery.build": delivery_build_default$1,
+	"delivery.publish": delivery_publish_default$1,
+	"delivery.deploy": delivery_deploy_default$1,
+	"delivery.bundleSize": delivery_bundleSize_default$1,
+	"delivery.previewCheck": delivery_previewCheck_default$1,
+	"delivery.previewDeploy": delivery_previewDeploy_default$1,
+	"platform.repoSync": platform_repoSync_default$1,
+	"platform.notifyCheck": platform_notifyCheck_default$1,
+	"platform.commitStandards": platform_commitStandards_default$1,
+	"platform.repoValidation": platform_repoValidation_default$1,
+	"platform.syncTemplates": platform_syncTemplates_default$1,
+	"platform.dispatchedCheck": platform_dispatchedCheck_default,
+	"knowledge.wiki": knowledge_wiki_default$1,
+	bookkeeping: bookkeeping_default$1,
+	dependencies: dependencies_default$1,
+	preview: preview_default$1,
+	greetings: greetings_default$1,
+	review: review_default$1,
+	stale: stale_default$1,
+	"sync-dispatch": sync_dispatch_default,
+	tag: tag_default,
+	"sync-github": sync_github_default
+};
+/** Composite actions → `.github/actions/<name>/action.yml` (key includes `/action`). */
+const REUSABLE_ACTIONS = {
+	"auto-commit/action": auto_commit_default,
+	"holocron/action": holocron_default,
+	"install/action": install_default,
+	"notify/action": notify_default,
+	"setup/action": setup_default,
+	"setup-node/action": setup_node_default
+};
+/** GitHub starter-workflow metadata → `workflow-templates/<name>.properties.json`. */
+const WORKFLOW_TEMPLATE_PROPERTIES = { bookkeeping: JSON.stringify({
+	name: "Bookkeeping",
+	description: "Label and track issues and pull requests.",
+	iconName: "octicon tag"
+}, null, 2) };
+const SOURCE = "packages/astromech/src/generators/github-action-reusable-workflows/github-action-reusable-workflows.ts";
+/**
+* "AUTO-GENERATED — do not edit" header for the YAML pushed to
+* `theholocron/.github`. Matches `createHeader().workflowHeader({ forPrimary: true })`
+* field-for-field, minus any timestamp — a live `Synced:` line makes the content
+* hash change on every run and defeats `sync github`'s unchanged-file skip.
+*/
+function reusableHeader() {
+	return [
+		`# AUTO-GENERATED — do not edit in theholocron/.github directly.`,
+		`# Source:  theholocron/holocron · ${SOURCE}`,
+		`# Tool:    holocron sync github`,
+		`# Changes: edit source in theholocron/holocron`,
+		``
+	].join("\n");
+}
+/**
+* The complete file batch `holocron sync github` pushes to `theholocron/.github`:
+* path → content. YAML gets the "do not edit" header; the starter-workflow
+* `.properties.json` files are left bare (native JSON, not a commented file).
+*/
+function reusableTemplates() {
+	const out = /* @__PURE__ */ new Map();
+	const header = reusableHeader();
+	for (const [name, body] of Object.entries(REUSABLE_ACTIONS)) out.set(`.github/actions/${name}.yml`, `${header}${body}`);
+	for (const [name, body] of Object.entries(REUSABLE_WORKFLOWS)) out.set(`.github/workflows/${name}.yml`, `${header}${body}`);
+	for (const [name, body] of Object.entries(WORKFLOW_TEMPLATES)) {
+		out.set(`workflow-templates/${name}.yml`, `${header}${body}`);
+		const props = WORKFLOW_TEMPLATE_PROPERTIES[name];
+		if (props) out.set(`workflow-templates/${name}.properties.json`, props);
+	}
+	return out;
+}
+//#endregion
+//#region src/registry/registry.ts
+/**
+* The task registry — how each task runs *locally*, without GitHub
+* Actions. `holocron run <task>` and `holocron run ci` resolve against this;
+* adding a task here gives every repo that task.
+*
+* Keyed identically to the workflow templates — a task IS a workflow. This
+* is the canonical vocabulary table (epic #672, D11): every other artifact
+* (`KNOWN_TASKS`, `thin-callers.ts`'s `KNOWN_WORKFLOWS`/`WORKFLOW_CHECK_CONTEXTS`,
+* `CI_ORDER`) derives from these keys rather than hand-duplicating them —
+* including the future GitHub App (#679), which imports this same table for
+* config-schema validation instead of reimplementing its own copy.
+*
+* Task names are an intent-facing vocabulary (`verification.*`,
+* `sourceQuality.*`, `security.*`, `delivery.*`, `platform.*`,
+* `knowledge.*`), not tool names — `eslint`/`vitest`/`tsdown`/… stay
+* internal to this file and `theholocron/configs`. See
+* `docs/wiki/specifications/tech-vocabulary-rename.spec.md` (#675) for the full mapping and
+* the reasoning behind each namespace and decomposition.
+*
+* Spec: `docs/wiki/specifications/tech-astromech-task-runner.spec.md` (epic #581).
+*/
 const TASKS = {
 	"verification.unitTests": {
 		local: {
@@ -33,6 +661,7 @@ const TASKS = {
 			dependsOn: ["^delivery.build"]
 		}
 	},
+	"verification.visualRegression": { local: null },
 	"verification.performance": { local: { detect: [{
 		when: /^lighthouse\.config\.(cjs|js|mjs|ts)$/,
 		tool: "lhci",
@@ -101,683 +730,783 @@ const TASKS = {
 				args: ["-b"]
 			}
 		] },
-		turbo: {
-			inputs: [
-				"src/**",
-				"package.json",
-				"tsdown.config.ts",
-				"vite.config.ts",
-				"rollup.config.ts",
-				"tsconfig.json"
-			],
-			outputs: ["dist/**"],
-			dependsOn: ["^delivery.build"]
-		}
-	},
-	"delivery.publish": {
-		local: null,
-		preview: true
-	},
-	"delivery.deploy": {
-		local: null,
-		preview: true
-	},
-	"delivery.bundleSize": { local: null },
-	"platform.repoSync": { local: { command: "sync" } },
-	"platform.commitStandards": {
-		local: null,
-		linterGroup: ["commitlint"]
-	},
-	"platform.repoValidation": {
-		local: null,
-		jobs: {
-			adrs: {
-				local: {
-					tool: "node",
-					args: ["scripts/validate-adrs.mjs"]
-				},
-				checkContext: "platform.repoValidation / Validate ADRs and specs"
-			},
-			registry: {
-				local: {
-					tool: "node",
-					args: ["scripts/validate-registry.mjs"]
-				},
-				checkContext: "platform.repoValidation / Validate registry consistency"
-			},
-			docsPresence: {
-				local: {
-					tool: "node",
-					args: ["scripts/validate-docs-presence.mjs"]
-				},
-				checkContext: "platform.repoValidation / Validate docs presence"
-			}
-		}
-	},
-	"knowledge.wiki": {
-		local: { command: "sync-wiki" },
-		preview: true
-	},
-	"knowledge.docs": {
-		local: null,
-		preview: true
-	},
-	"knowledge.components": {
-		local: null,
-		preview: true
-	}
-};
-/** Every task name the registry knows. */
-const KNOWN_TASKS = new Set(Object.keys(TASKS));
-/**
-* The order `holocron ci` runs tasks in — cheapest / fastest signal first, so
-* an agent or a `pre-push` hook fails early. Tasks not listed here run last, in
-* manifest order. (The generated thin callers carry no `needs:` — cross-workflow
-* ordering lives in `theholocron/.github` — so `holocron ci` declares its own.)
-*/
-const CI_ORDER = [
-	"verification.typeSafety",
-	"sourceQuality.staticAnalysis",
-	"sourceQuality.formatting",
-	"sourceQuality.structuredDataValidation",
-	"security.secretDetection",
-	"platform.commitStandards",
-	"platform.repoValidation",
-	"verification.unitTests",
-	"delivery.build",
-	"sourceQuality.deadCodeAnalysis",
-	"delivery.bundleSize",
-	"verification.performance",
-	"security.codeScanning",
-	"delivery.deploy"
-];
-//#endregion
-//#region src/linters.ts
-/**
-* Known linters, in execution order. `always` entries are the current
-* hard-coded super-linter baseline; `prettier` is always-on because the org
-* applies it universally (super-linter only lints files that exist).
-*/
-const LINTERS = {
-	eslint: {
-		validate: ["VALIDATE_JAVASCRIPT_ES", "VALIDATE_TYPESCRIPT_ES"],
-		localBin: "eslint",
-		localArgs: ["."],
-		detect: [
-			"eslint.config.ts",
-			"eslint.config.js",
-			"eslint.config.mjs",
-			"eslint.config.cjs",
-			".eslintrc",
-			".eslintrc.json",
-			".eslintrc.yml",
-			".eslintrc.yaml",
-			".eslintrc.cjs"
-		],
-		configInput: "eslint-config"
-	},
-	prettier: {
-		validate: [
-			"VALIDATE_JAVASCRIPT_PRETTIER",
-			"VALIDATE_JSX_PRETTIER",
-			"VALIDATE_TYPESCRIPT_PRETTIER",
-			"VALIDATE_TSX",
-			"VALIDATE_MARKDOWN_PRETTIER"
-		],
-		fix: [
-			"FIX_JAVASCRIPT_PRETTIER",
-			"FIX_JSX_PRETTIER",
-			"FIX_TYPESCRIPT_PRETTIER",
-			"FIX_TSX",
-			"FIX_MARKDOWN_PRETTIER"
-		],
-		always: true,
-		localBin: "prettier",
-		localArgs: ["--check", "."],
-		configInput: "prettier-config"
-	},
-	yamllint: {
-		validate: ["VALIDATE_YAML"],
-		always: true,
-		localBin: "yamllint",
-		localArgs: ["."],
-		installHint: "brew install yamllint",
-		configInput: "yaml-config"
-	},
-	actionlint: {
-		validate: ["VALIDATE_GITHUB_ACTIONS"],
-		always: true,
-		localBin: "actionlint",
-		localArgs: [],
-		installHint: "brew install actionlint"
-	},
-	gitleaks: {
-		validate: ["VALIDATE_GITLEAKS"],
-		always: true,
-		localBin: "gitleaks",
-		localArgs: [
-			"dir",
-			"--no-banner",
-			"--config",
-			".gitleaks.toml"
-		],
-		installHint: "brew install gitleaks"
-	},
-	editorconfig: {
-		validate: ["VALIDATE_EDITORCONFIG"],
-		always: true,
-		localBin: "editorconfig-checker",
-		localArgs: [],
-		installHint: "brew install editorconfig-checker"
-	},
-	commitlint: {
-		validate: ["VALIDATE_GIT_COMMITLINT"],
-		always: true
-	},
-	"git-merge-conflict-markers": {
-		validate: ["VALIDATE_GIT_MERGE_CONFLICT_MARKERS"],
-		always: true
-	},
-	markdownlint: {
-		validate: ["VALIDATE_MARKDOWN"],
-		localBin: "markdownlint-cli2",
-		localArgs: ["**/*.md"],
-		detect: [
-			".markdownlint.json",
-			".markdownlint.jsonc",
-			".markdownlint.yaml",
-			".markdownlint.yml",
-			".markdownlint-cli2.jsonc",
-			".markdownlint-cli2.yaml",
-			".markdownlint-cli2.mjs"
-		]
-	}
-};
-/** Every linter name the registry knows. */
-const LINTER_NAMES = new Set(Object.keys(LINTERS));
-/**
-* Resolve the linter set for a repo. An `explicit` list (from `config.tasks`)
-* picks the candidate set; otherwise the candidates are every `always` linter
-* plus every `detect`-gated linter whose filenames are present at the repo
-* root. Either way, a `detect`-gated linter (eslint, markdownlint) only makes
-* the final set when its config file is actually present — a repo can't run
-* eslint without an `eslint.config.*`, and super-linter FATALs if you ask it
-* to (theholocron/holocron#654). `always` linters are unconditional. Result
-* is ordered by {@link LINTERS} declaration order.
-*
-* @throws when an `explicit` name is not in the registry — a typo is a
-* config bug, not a linter to silently skip.
-*/
-function resolveLinters(opts) {
-	const order = Object.keys(LINTERS);
-	const present = new Set(opts.rootFiles);
-	const configPresent = (def) => def.always === true || (def.detect ?? []).some((f) => present.has(f));
-	if (opts.explicit && opts.explicit.length > 0) {
-		const unknown = opts.explicit.filter((n) => !LINTER_NAMES.has(n));
-		if (unknown.length > 0) throw new Error(`unknown linter${unknown.length > 1 ? "s" : ""} ${unknown.map((n) => `"${n}"`).join(", ")} — known: ${order.join(", ")}`);
-		const wanted = new Set(opts.explicit);
-		return order.filter((n) => wanted.has(n) && configPresent(LINTERS[n])).map((name) => ({
-			name,
-			def: LINTERS[name]
-		}));
-	}
-	return order.filter((name) => configPresent(LINTERS[name])).map((name) => ({
-		name,
-		def: LINTERS[name]
-	}));
-}
-//#endregion
-//#region src/resolver.ts
-/**
-* `library` is every mapped tool's org-wide default variant today — every
-* currently-migrated repo (`holocron`, `clients`, `utils`, `configs`,
-* `themes`, `observability`, `skills`) is a publishable library package, and
-* `eslint-config`/`vitest-config`/`tsdown-config` all name their
-* general-purpose preset exactly that. Picking a different variant per repo
-* (an app-type template, say) needs new `holocron.config.ts` surface this
-* doesn't add yet — deliberately out of scope until a real consumer needs it.
-*/
-const TOOL_CONFIGS = {
-	eslint: {
-		package: "@theholocron/eslint-config",
-		exportPath: "./bundles/library",
-		flag: ["--config"]
+		turbo: {
+			inputs: [
+				"src/**",
+				"package.json",
+				"tsdown.config.ts",
+				"vite.config.ts",
+				"rollup.config.ts",
+				"tsconfig.json"
+			],
+			outputs: ["dist/**"],
+			dependsOn: ["^delivery.build"]
+		}
 	},
-	prettier: {
-		package: "@theholocron/prettier-config",
-		exportPath: ".",
-		flag: ["--config"]
+	"delivery.publish": {
+		local: null,
+		preview: true
 	},
-	vitest: {
-		package: "@theholocron/vitest-config",
-		exportPath: "./bundles/library",
-		flag: ["--config"]
+	"delivery.deploy": {
+		local: null,
+		preview: true
 	},
-	tsdown: {
-		package: "@theholocron/tsdown-config",
-		exportPath: "./presets/library",
-		flag: ["--config"]
+	"delivery.bundleSize": { local: null },
+	"delivery.previewCheck": { local: null },
+	"delivery.previewDeploy": { local: null },
+	"platform.repoSync": { local: { command: "sync" } },
+	"platform.notifyCheck": { local: null },
+	"platform.syncTemplates": { local: { command: "sync github" } },
+	"platform.commitStandards": {
+		local: null,
+		linterGroup: ["commitlint"]
 	},
-	commitlint: {
-		package: "@theholocron/commitlint-config",
-		exportPath: ".",
-		flag: ["--config"]
+	"platform.repoValidation": {
+		local: null,
+		jobs: {
+			adrs: {
+				local: {
+					tool: "node",
+					args: ["scripts/validate-adrs.mjs"]
+				},
+				checkContext: "platform.repoValidation / Validate ADRs and specs"
+			},
+			registry: {
+				local: {
+					tool: "node",
+					args: ["scripts/validate-registry.mjs"]
+				},
+				checkContext: "platform.repoValidation / Validate registry consistency"
+			},
+			docsPresence: {
+				local: {
+					tool: "node",
+					args: ["scripts/validate-docs-presence.mjs"]
+				},
+				checkContext: "platform.repoValidation / Validate docs presence"
+			}
+		}
+	},
+	"knowledge.wiki": {
+		local: { command: "sync-wiki" },
+		preview: true
+	},
+	"knowledge.docs": {
+		local: null,
+		preview: true
+	},
+	"knowledge.components": {
+		local: null,
+		preview: true
 	}
 };
-/** Every tool name the resolver knows how to point at a shared config. */
-const RESOLVABLE_TOOLS = new Set(Object.keys(TOOL_CONFIGS));
-/**
-* `<flag> <absolute path>` for `tool`, resolved against `cwd`'s
-* `node_modules` — or `[]` when the tool isn't mapped, the package isn't
-* installed, its `package.json` doesn't declare the export subpath this
-* needs, or the resolved file doesn't actually exist on disk (a stale
-* install, or a package version that predates the export existing).
-*/
-function resolveToolConfig(tool, cwd, deps) {
-	const spec = TOOL_CONFIGS[tool];
-	if (!spec) return [];
-	const pkgDir = joinPath(cwd, "node_modules", ...spec.package.split("/"));
-	const pkgJsonPath = joinPath(pkgDir, "package.json");
-	if (!deps.fileExists(pkgJsonPath)) return [];
-	let pkg;
-	try {
-		pkg = JSON.parse(deps.readFile(pkgJsonPath));
-	} catch {
-		return [];
-	}
-	const relative = resolveExportEntry(pkg.exports?.[spec.exportPath]);
-	if (!relative) return [];
-	const absolute = joinPath(pkgDir, relative.replace(/^\.\//, ""));
-	if (!deps.fileExists(absolute)) return [];
-	return [...spec.flag, absolute];
-}
-/**
-* Unwrap a `package.json#exports` subpath entry down to its file path —
-* either a bare string, or an object with condition keys (`import`,
-* `default`, `require`, …) that may themselves nest one level (`{ import: {
-* types, default } }`, the shape every `@theholocron/*-config` package
-* actually uses). Prefers `import` (this org ships ESM), then `default`,
-* then `require` as a last resort.
-*/
-function resolveExportEntry(entry) {
-	if (typeof entry === "string") return entry;
-	if (entry === null || typeof entry !== "object") return void 0;
-	const conditions = entry;
-	const value = conditions.import ?? conditions.default ?? conditions.require;
-	if (typeof value === "string") return value;
-	if (typeof value === "object" && value !== null) return resolveExportEntry(value);
-}
+/** Every task name the registry knows. */
+const KNOWN_TASKS = new Set(Object.keys(TASKS));
 /**
-* A minimal, POSIX-safe `path.join` — avoids importing `node:path` just for
-* this. Every path in play here is either already POSIX (a `package.json`
-* `exports` value, always forward-slashed regardless of platform) or built
-* from platform-neutral segments (`cwd`, `"node_modules"`, a scoped package
-* name split on `/`), so a manual join is safe and keeps this module
-* dependency-free like the rest of `run.ts`'s helpers.
+* The order `holocron run ci` runs tasks in — cheapest / fastest signal first, so
+* an agent or a `pre-push` hook fails early. Tasks not listed here run last, in
+* manifest order. (The generated thin callers carry no `needs:` — cross-workflow
+* ordering lives in `theholocron/.github` — so `holocron run ci` declares its own.)
 */
-function joinPath(...segments) {
-	return segments.map((s, i) => i === 0 ? s.replace(/\/+$/, "") : s.replace(/^\/+|\/+$/g, "")).filter(Boolean).join("/");
-}
+const CI_ORDER = [
+	"verification.typeSafety",
+	"sourceQuality.staticAnalysis",
+	"sourceQuality.formatting",
+	"sourceQuality.structuredDataValidation",
+	"security.secretDetection",
+	"platform.commitStandards",
+	"platform.repoValidation",
+	"verification.unitTests",
+	"delivery.build",
+	"sourceQuality.deadCodeAnalysis",
+	"delivery.bundleSize",
+	"verification.performance",
+	"security.codeScanning",
+	"delivery.deploy"
+];
 //#endregion
-//#region src/run.ts
+//#region src/generators/required-checks/required-checks.ts
 /**
-* `holocron run <task> [job] [-- <passthrough>]` — run a registry task (or one
-* of its sub-jobs) locally.
-*
-* A `job` argument only applies to tasks that declare `jobs`; for any other
-* task it is folded back into the passthrough (`holocron run delivery.build
-* src/`).
-*
-* Resolution:
-*
-*   J. job given                              → TASKS[task].jobs[job].local (unknown job → exit 1)
-*   1. turbo.json defines the task            → `turbo run <task>`
-*   2. package.json has a `<task>` script     → `<pm> run <task>`
-*      (unless it's the `holocron run …` thin caller — that recurses)
-*   3. TASKS[task].local resolves             → `<tool> <args> <org-flags> <passthrough>`
-*   3b. TASKS[task].linterGroup               → run each resolved linter natively (see below)
-*   4. TASKS[task].jobs has entries           → run each job in declared order
-*   5. TASKS[task].local === null             → "enforced in CI" (skip, even with --required)
-*   5b. known task, nothing resolved          → "no <task> task" (exit 0, or 1 with --required)
-*   6. unknown task                           → "unknown task" (exit 1)
-*
-* A `linterGroup` task (`sourceQuality.staticAnalysis`, etc.) runs its fixed
-* set of `linters.ts` entries, each still gated by that linter's own
-* `detect`/`always` rule — every entry runs its `localBin` natively when
-* found on PATH. Missing tools are flagged; the exit code is the worst of
-* the lot. Unlike the old single `lint` task, this check runs *after*
-* turbo/`package.json` resolution (step 3b, not step 0) — a `linterGroup`
-* task is a normal turbo-delegatable task like any other.
-*/
-/** The per-command runner — `runTask` and `runLintAggregate` share it. */
-function makeRunOne(input) {
-	const { print, logger, exec, task, cwd } = input;
-	const dryRun = input.dryRun ?? false;
-	return (cmd, args) => {
-		const command = [cmd, ...args].join(" ");
-		if (dryRun) {
-			print(`would run: ${command}`);
-			logger.debug({
-				task,
-				command,
-				status: "dry-run"
-			}, `run: ${task}`);
-			return {
-				status: "dry-run",
-				command
-			};
-		}
-		print(`→ ${command}`);
-		const { exitCode } = exec(cmd, args, { cwd });
-		const status = exitCode === 0 ? "ok" : "fail";
-		logger[status === "fail" ? "warn" : "debug"]({
-			task,
-			command,
-			exitCode,
-			status
-		}, `run: ${task}`);
-		return {
-			status,
-			command,
-			...status === "fail" ? { message: `\`${command}\` exited ${exitCode}` } : {}
-		};
-	};
-}
-function runTask(input) {
-	const { print, logger, readFile, fileExists, listDir, task, cwd } = input;
-	const def = TASKS[task];
-	let job = input.job;
-	let passthrough = input.passthrough ?? [];
-	if (job !== void 0 && !def?.jobs) {
-		passthrough = [job, ...passthrough];
-		job = void 0;
-	}
-	if (job !== void 0) {
-		const jobDef = def.jobs[job];
-		if (!jobDef) {
-			const known = Object.keys(def.jobs).join(", ");
-			print(`✗ unknown job "${job}" for "${task}" (known: ${known})`);
-			logger.warn({
-				task,
-				job,
-				status: "unknown"
-			}, `run: ${task} ${job}`);
-			return {
-				status: "unknown",
-				message: `unknown job "${task} ${job}"`
-			};
-		}
-		const label = `${task} ${job}`;
-		return runUnit(input, label, jobDef.local, makeRunOne({
-			...input,
-			task: label
-		}), passthrough);
-	}
-	const run = makeRunOne(input);
-	if (turboDefinesTask(cwd, task, readFile, fileExists)) {
-		const filterArg = input.filter ? [`--filter=${input.filter}`] : [];
-		const forwarded = [...def?.local && !def.local.command && def.local.tool ? def.flags?.[def.local.tool] ?? [] : [], ...passthrough];
-		const args = [
-			"run",
-			task,
-			...filterArg,
-			...forwarded.length ? ["--", ...forwarded] : []
-		];
-		return run(resolveBin(cwd, "turbo", fileExists), args);
-	}
-	const script = packageJsonScript(cwd, task, readFile, fileExists);
-	if (script && !/^holocron run\b/.test(script.trim())) return run(packageManager(cwd, readFile, fileExists), [
-		"run",
-		task,
-		...passthrough.length ? ["--", ...passthrough] : []
-	]);
-	if (def?.local) {
-		if (def.local.command) return run(process.execPath, [
-			process.argv[1],
-			def.local.command,
-			...passthrough
-		]);
-		const runner = resolveRunner(def.local, cwd, listDir);
-		if (runner) {
-			const flags = (def.flags?.[runner.tool] ?? []).filter((f) => !passthrough.includes(f));
-			const configFlags = resolveToolConfig(runner.tool, cwd, {
-				readFile,
-				fileExists
-			});
-			return run(resolveBin(cwd, runner.tool, fileExists), [
-				...runner.args,
-				...configFlags,
-				...flags,
-				...passthrough
-			]);
+* `requiredChecks(config)` — the branch-protection required-status-check list,
+* derived from the task manifest. Every `required: true` task contributes its
+* {@link WORKFLOW_CHECK_CONTEXTS} entry; `config.extraRequiredChecks` adds
+* contexts not backed by a task (codecov, DCO is prepended by the caller).
+*
+* `@theholocron/cli`'s `holocron repo setup` calls this instead of the old
+* hand-maintained `repo.requiredChecks` array. Policy-free — it only knows the
+* manifest.
+*/
+/** Ordered (task contexts in {@link CI_ORDER}, then extras), de-duplicated. */
+function requiredChecks(config) {
+	const entries = (config.tasks ?? []).map(normalizeTaskEntry);
+	const seen = /* @__PURE__ */ new Set();
+	const out = [];
+	for (const name of CI_ORDER) {
+		const context = entries.some((e) => e.name === name && e.required === true) ? WORKFLOW_CHECK_CONTEXTS[name] : void 0;
+		if (context && !seen.has(context)) {
+			seen.add(context);
+			out.push(context);
 		}
 	}
-	if (def?.linterGroup) return runLinterGroup(input, def.linterGroup, passthrough);
-	if (def?.jobs && Object.keys(def.jobs).length > 0) return runAllJobs(input, def.jobs, passthrough);
-	if (def?.local === null) {
-		const msg = `no local equivalent for ${task} — enforced in CI`;
-		print(`· ${msg}`);
-		logger.debug({
-			task,
-			status: "skip"
-		}, `run: ${task}`);
-		return {
-			status: "skip",
-			message: msg
-		};
-	}
-	if (KNOWN_TASKS.has(task)) {
-		const msg = `no ${task} task for this repo`;
-		print(input.required ? `✗ ${msg} (required)` : `· ${msg}`);
-		logger[input.required ? "warn" : "debug"]({
-			task,
-			status: input.required ? "fail" : "skip"
-		}, `run: ${task}`);
-		return {
-			status: input.required ? "fail" : "skip",
-			message: msg
-		};
+	for (const context of config.extraRequiredChecks ?? []) if (!seen.has(context)) {
+		seen.add(context);
+		out.push(context);
 	}
-	print(`✗ unknown task "${task}"`);
-	logger.warn({
-		task,
-		status: "unknown"
-	}, `run: ${task}`);
-	return {
-		status: "unknown",
-		message: `unknown task "${task}"`
+	return out;
+}
+//#endregion
+//#region src/generators/tsconfig/tsconfig.ts
+/**
+* `tsconfig.json` generation — Bucket B (config-resolution workstream, #676):
+* the file must stay committed (the TypeScript language server discovers it
+* directly from disk, no `--config` override mechanism to hand it a path
+* instead), but its content is fully derivable, so it's generated rather
+* than hand-authored — the same category as `.editorconfig`
+* ({@link "../../templates/configs/editorconfig/create-config.js" createConfig})
+* and {@link codecovConfig}.
+*
+* Surveyed every package-level `tsconfig.json` across the org (`holocron`,
+* `clients`, `utils` — 20+ packages). `extends: "@theholocron/tsconfig/
+* node-lts"`, `compilerOptions.baseUrl: "./"`, `compilerOptions.outDir:
+* "./dist"`, `include: ["src/**\/*.ts"]`, and `exclude: ["node_modules",
+* "dist"]` are uniform in every one — safe defaults here. `paths` (a `@/*`
+* → `./src/*` import alias) is a real per-package choice, present in
+* roughly 40% of packages checked — an opt-in parameter, not a default.
+*
+* Two fields checked and deliberately *not* absorbed as defaults, unlike
+* `eslint-config`'s `tsconfigRootDir`/`settings.node` (which turned out
+* redundant with the shared package's own behavior, `configs`#461):
+* `compilerOptions.module`/`moduleResolution` (only `@theholocron/cli`
+* overrides these, to `esnext`/`bundler` — a genuine deviation from the
+* shared `node-lts` preset's `nodenext`/`nodenext`, needed for its bundler
+* tooling, not something every package should inherit) and
+* `compilerOptions.rootDir` (present in exactly two packages, always the
+* same value `./src` that `include` already implies — an unnecessary
+* override wherever it appears, not a pattern worth generalizing).
+*
+* Monorepo *root* `tsconfig.json` (a TS project-references "solution
+* file" — `holocron`'s own root is `{ files: [], references: [...] }`,
+* listing which packages to build) is a structurally different, genuinely
+* per-repo document — out of scope here, same as Bucket C content.
+*
+* Not yet wired into `holocron repo setup`'s per-package write loop (every
+* other Bucket B file there is a single repo-root file, safely
+* overwritten every run — `tsconfig.json` is per-package, and most
+* packages' files still carry real hand-authored content today, not yet
+* migrated to a fully-generated state). That per-package iteration +
+* safe-migration design is `#680`'s job, not duplicated here — this is
+* the generator itself, ready for it to call.
+*/
+/**
+* A package-level `tsconfig.json` — the uniform shape confirmed across
+* every package checked, parameterized only by the two fields that
+* genuinely vary (`display`, `paths`). No scaffold/workflow header (matches
+* `.alexrc.json`'s existing precedent for a strict-JSON Bucket B file —
+* JSON has no comment syntax to carry one, and TypeScript's own tolerance
+* for JSONC comments in `tsconfig.json` isn't worth relying on for a file
+* this thin).
+*/
+function createTsconfig(options) {
+	const variant = options.variant ?? "node-lts";
+	const compilerOptions = {
+		baseUrl: "./",
+		outDir: "./dist"
+	};
+	if (options.paths) compilerOptions.paths = { "@/*": ["./src/*"] };
+	const config = {
+		display: options.display,
+		extends: `@theholocron/tsconfig/${variant}`,
+		compilerOptions,
+		include: ["src/**/*.ts"],
+		exclude: ["node_modules", "dist"]
 	};
+	return stringifyJson(config);
 }
+//#endregion
+//#region src/generators/turbo/turbo.ts
 /**
-* Run one registry unit — a task's own runner or a single sub-job. Resolution
-* is registry-only (`turbo` / `package.json` scripts are keyed by task, not
-* `task/job`). `label` names the unit in messages (`audit performance`).
+* `turboConfig(config)` — the generated `turbo.json` for a repo's task
+* manifest, epic #672 D9 (#681). Every workspace, monorepo or single-package
+* (Turborepo's single-package mode), gets this from the same `tasks` array
+* that already drives thin callers / required checks / package scripts —
+* never hand-authored.
 *
-* `local: null` → CI-only by design, always a skip (never a failure, even with
-* `--required`). A declared runner with no matching repo file, or whose tool
-* isn't installed locally → a skip (`--required` turns it into a failure — the
-* repo claims a check it can't back). Mirrors the lint aggregate: run what's
-* here, flag the rest, let CI enforce.
+* Only tasks with a {@link TurboTaskConfig} in the registry (real per-
+* workspace build/compile/test steps) get an entry. Whole-repo, single-run
+* tools (prettier, gitleaks, commitlint, yamllint, …) have none — they stay
+* off turbo.json entirely, same as today.
+*
+* A task entry's own `turbo.passThroughEnv` (schema.ts) appends extra env
+* vars to the registry default's cache-key hashing — the one thing that's
+* genuinely per-repo (e.g. a package tagging Sentry releases during its own
+* build needs `SENTRY_AUTH_TOKEN` in its cache key; most repos don't).
+* `turbo.inputs` (holocron#845) appends extra input globs the same way —
+* for a package whose layout the registry default doesn't cover (e.g. a
+* flat-layout package with no `src/` directory at all).
 */
-function runUnit(input, label, local, run, passthrough) {
-	const { print, logger, listDir, lookPath, cwd } = input;
-	const skip = (msg) => {
-		print(input.required ? `✗ ${msg} (required)` : `· ${msg}`);
-		logger[input.required ? "warn" : "debug"]({
-			task: label,
-			status: input.required ? "fail" : "skip"
-		}, `run: ${label}`);
-		return {
-			status: input.required ? "fail" : "skip",
-			message: msg
+/** Filed once per repo, unconditionally — every generated turbo.json's root. */
+const GLOBAL_DEPENDENCIES = ["pnpm-workspace.yaml", "tsconfig.json"];
+/**
+* Guards against a malformed `turbo.inputs`/`turbo.passThroughEnv` override
+* (review on holocron#845): a bare string instead of an array would
+* otherwise spread into individual characters
+* (`[..."**\/*.ts"]` → `["*", "*", "/", "*", ".", "t", "s"]`), silently
+* emitting garbage entries instead of the intended single glob/env-var —
+* the generated `turbo.json` would still be valid JSON, just wrong, with
+* nothing surfacing the mistake. Only a config loaded from JSON or plain JS
+* reaches this unchecked; a typed `holocron.config.ts` via `defineConfig`
+* already rejects the wrong shape at compile time.
+*/
+function validatedGlobList(value, taskName, field) {
+	if (value === void 0) return [];
+	if (!Array.isArray(value) || !value.every((item) => typeof item === "string")) throw new Error(`task "${taskName}": turbo.${field} must be an array of strings, got ${JSON.stringify(value)}`);
+	return value;
+}
+/**
+* `turbo.json` content for this manifest, pretty-printed — write it
+* directly, no merge (matches `thinCallers()` / `reusableTemplates()`: this
+* file is generated, not hand-edited). `null` when no task in the manifest
+* has turbo fan-out config (nothing to write).
+*/
+function turboConfig(config) {
+	const entries = (config.tasks ?? []).map(normalizeTaskEntry);
+	const tasks = {};
+	for (const entry of entries) {
+		if (entry.local === false) continue;
+		const turbo = TASKS[entry.name]?.turbo;
+		if (!turbo) continue;
+		const extraEnv = validatedGlobList(entry.turbo?.passThroughEnv, entry.name, "passThroughEnv");
+		const extraInputs = validatedGlobList(entry.turbo?.inputs, entry.name, "inputs");
+		const current = tasks[entry.name] ?? turbo;
+		const passThroughEnv = extraEnv.length > 0 ? [...current.passThroughEnv ?? [], ...extraEnv] : current.passThroughEnv;
+		const inputs = extraInputs.length > 0 ? [...current.inputs, ...extraInputs] : current.inputs;
+		tasks[entry.name] = {
+			...turbo,
+			inputs,
+			...passThroughEnv && passThroughEnv.length > 0 ? { passThroughEnv } : {}
 		};
-	};
-	if (local) {
-		const runner = resolveRunner(local, cwd, listDir);
-		if (!runner) return skip(`no ${label} runner for this repo`);
-		const found = lookPath(cwd, runner.tool);
-		if (!found) return skip(`${runner.tool} not installed locally for ${label} — enforced in CI`);
-		return run(found, [...runner.args, ...passthrough]);
 	}
-	const msg = `no local equivalent for ${label} — enforced in CI`;
-	print(`· ${msg}`);
-	logger.debug({
-		task: label,
-		status: "skip"
-	}, `run: ${label}`);
-	return {
-		status: "skip",
-		message: msg
-	};
+	if (Object.keys(tasks).length === 0) return null;
+	return stringifyJson({
+		$schema: "https://turborepo.org/schema.json",
+		globalDependencies: GLOBAL_DEPENDENCIES,
+		tasks
+	});
 }
 /**
-* `holocron run <task>` for a task that is a container of sub-jobs (`audit`) —
-* run each job in declared order. Status precedence: any `fail` → `fail`; else
-* any `ok` → `ok`; else any `dry-run` → `dry-run`; else `skip` (nothing ran).
+* Fixes #692: `turboConfig()` writes a `turbo.json` the moment *any* task in
+* the manifest has fan-out config — with no check for whether the repo's own
+* root package is actually covered by `pnpm-workspace.yaml`'s `packages:`
+* list. A repo shaped like `observability` (the library lives at repo root;
+* `packages:` lists only an unrelated `docs` site) silently breaks the
+* instant `turbo.json` exists: `holocron run <task>` switches from running
+* root's own script directly to `turbo run <task>`, which only sees declared
+* workspace members — root vanishes, the task "succeeds" with zero real work
+* done (confirmed empirically: `Packages in scope: docs`, root never
+* mentioned, exit 0).
+*
+* Detection is narrow and specific: root only needs to be an explicit
+* workspace member if its *own* `package.json` has a script literally named
+* after one of the tasks turbo.json is about to fan out — a plain
+* orchestrator root (`holocron`'s own `"build": "turbo run delivery.build"`,
+* which has no `delivery.build` script itself) never trips this; only a root
+* that's genuinely a directly-buildable package does. Confirmed the fix
+* empirically too — adding `.` to `packages:` makes turbo pick root back up
+* (`Packages in scope: docs, root-lib`) without disturbing the sibling
+* package's own caching.
+*
+* A matching script key alone isn't enough — its *value* has to be a real
+* command, not the generated `holocron run <task> --` wrapper (#846, the
+* counterpart `mergePackageJsonScripts()` already had to learn for #747/
+* #748). A repo whose root predates this tooling can already have that exact
+* wrapper sitting in a task-name-matching script with nothing ever having
+* generated it this session; adding `.` there fires #747's recursion
+* immediately (`turbo run <task>` → root's own `<task>` script → the wrapper
+* → `holocron run <task>` sees `turbo.json` still defines it → `turbo run
+* <task>` again, forever). Only a matching script whose value is *not* that
+* wrapper counts as "root is genuinely a directly-buildable package".
+*
+* A targeted line-based edit, not a full YAML parse/reserialize — same
+* pattern `codecov.ts`'s `mergeCodecovComponents()` already uses for editing
+* an existing generated file. `pnpm-workspace.yaml` routinely carries a
+* `catalog:`/`catalogs:`/`overrides:` block after `packages:`; a real parser
+* round-trip risks reformatting or reordering content nobody asked to touch.
+* Only ever *adds* a line — never rewrites or reorders anything already
+* there — and is a no-op (`changed: false`) whenever root doesn't need it,
+* root is already listed, or `packages:` isn't in the plain block-list form
+* every repo checked actually uses.
 */
-function runAllJobs(input, jobs, passthrough) {
-	const { print, task } = input;
-	const perJob = {
-		...input,
-		required: false
+function ensureRootWorkspaceMember(workspaceYaml, rootScripts, taskNames) {
+	if (!taskNames.some((t) => {
+		const script = rootScripts[t];
+		return script !== void 0 && !isGeneratedRunWrapper(script, t);
+	})) return {
+		content: workspaceYaml,
+		changed: false
 	};
-	const reports = [];
-	for (const [name, jobDef] of Object.entries(jobs)) {
-		const label = `${task} ${name}`;
-		print(`▶ ${jobDef.checkContext}`);
-		reports.push(runUnit(perJob, label, jobDef.local, makeRunOne({
-			...perJob,
-			task: label
-		}), passthrough));
+	const lines = workspaceYaml.split("\n");
+	const packagesLineIdx = lines.findIndex((l) => /^packages:\s*$/.test(l));
+	if (packagesLineIdx === -1) return {
+		content: workspaceYaml,
+		changed: false
+	};
+	const items = [];
+	let cursor = packagesLineIdx + 1;
+	while (cursor < lines.length && /^\s*-\s*/.test(lines[cursor])) {
+		items.push(lines[cursor]);
+		cursor++;
 	}
-	const command = reports.map((r) => r.command).filter((c) => Boolean(c)).join(" && ");
-	const statuses = new Set(reports.map((r) => r.status));
-	if (statuses.has("fail")) return {
-		status: "fail",
-		command,
-		message: `one or more ${task} jobs failed`
+	if (items.some((item) => {
+		const value = item.replace(/^\s*-\s*/, "").replace(/^["']|["']$/g, "").trim();
+		return value === "." || value === "";
+	})) return {
+		content: workspaceYaml,
+		changed: false
 	};
-	if (statuses.has("ok")) return {
-		status: "ok",
-		command
+	const newLine = `${items[0]?.match(/^(\s*-\s*)/)?.[1] ?? "  - "}"."`;
+	return {
+		content: [
+			...lines.slice(0, packagesLineIdx + 1),
+			newLine,
+			...lines.slice(packagesLineIdx + 1)
+		].join("\n"),
+		changed: true
 	};
-	if (statuses.has("dry-run")) return {
-		status: "dry-run",
-		command
+}
+/**
+* Matches the exact shape `packageScripts()` generates for `taskName` —
+* `<bin> run <taskName> --`, `<bin>` normally `holocron` but substitutable
+* (`holocronScript`, itself allowed to be multi-word, e.g. `"node
+* packages/cli/dist/cli.mjs"` — see its own test). Checking the *suffix*
+* rather than the whole string means an old wrapper survives a
+* `holocronScript` rename intact — it's still recognized as a wrapper (safe
+* to update to the new one), not mistaken for a real command. Mirrors
+* `sync.ts`'s private `isGeneratedRunWrapper()` — same predicate, needed on
+* both sides of #692/#747: whether to *write* the wrapper, and here, whether
+* an *existing* one should count as "root is directly buildable".
+*/
+function isGeneratedRunWrapper(command, taskName) {
+	return command.endsWith(` run ${taskName} --`);
+}
+/**
+* Fallback pin when a repo's own `pnpm-workspace.yaml` has no `turbo`
+* catalog entry yet — matches this repo's own catalog version (the
+* canonical source-of-truth repo for the whole org's tooling).
+*/
+const DEFAULT_TURBO_VERSION = "^2.10.12";
+/**
+* Ensures `turbo` is declared in `package.json#devDependencies` — found
+* the hard way rolling this out to `observability` (predates #691):
+* `turboConfig()` writes a `turbo.json` the moment any task has fan-out
+* config, but never touches `package.json`, so a repo that predates this
+* feature (or never had `turbo` installed for any other reason) ends up
+* with a `turbo.json` and nothing local to run it. `resolveBin()`
+* (`run.ts`) falls back to a bare `turbo` on `PATH` when
+* `node_modules/.bin/turbo` doesn't exist — on a machine with no global
+* `turbo` at all that's a hard failure for every task; on one that
+* happens to have an unrelated global install, silent version skew
+* (confirmed empirically: a global 2.6.0 rejected this repo's generated
+* `turbo.json` outright — `Found an unknown key "globalDependencies"`,
+* a schema key from a newer version than the one actually resolved).
+*
+* Prefers `"catalog:"` when the repo's own `pnpm-workspace.yaml` already
+* has a `turbo` catalog entry — matches every already-migrated repo
+* (`holocron`, `clients`, …) — falling back to a real pinned version
+* otherwise. Never touches an existing `devDependencies.turbo` entry, so
+* a repo pinning its own version on purpose is left alone — idempotent,
+* a no-op once set either way.
+*/
+function ensureTurboDependency(packageJson, workspaceYaml) {
+	const pkg = JSON.parse(packageJson);
+	if (typeof pkg.devDependencies?.turbo === "string") return {
+		content: packageJson,
+		changed: false
+	};
+	const hasTurboCatalogEntry = /^\s*turbo:\s*\S/m.test(workspaceYaml);
+	const devDependencies = {
+		...pkg.devDependencies,
+		turbo: hasTurboCatalogEntry ? "catalog:" : DEFAULT_TURBO_VERSION
+	};
+	const updated = {
+		...pkg,
+		devDependencies
 	};
 	return {
-		status: "skip",
-		message: `no ${task} job has a local equivalent — enforced in CI`
+		content: stringifyJson(updated, { like: packageJson }),
+		changed: true
 	};
 }
+//#endregion
+//#region src/tasks/run/linters/linters.ts
 /**
-* `holocron run <task>` for a `linterGroup` task — the task's fixed linter
-* set, each still gated by its own `detect`/`always` rule, run natively.
-* Worst exit code wins. Runs *after* the caller's own turbo/`package.json`
-* resolution (step 3b) — no per-linter turbo passthrough here, unlike the
-* old single `lint` task's eslint-only special case; the whole task is what
-* turbo/a package script would have already caught in steps 1–2.
+* The linter registry — one list of linter names (from `config.tasks`'
+* `{ name: "lint", linters: [...] }`, or auto-detected) maps to both the
+* CI super-linter `VALIDATE_*` env and the native local run. This table is
+* the single source of truth for that mapping; {@link superLinterConfig}
+* (CI) and the `holocron run lint` aggregate (local) both read it.
+*
+* Spec: `docs/wiki/specifications/tech-astromech-task-runner.spec.md` "Lint parity".
 */
-function runLinterGroup(input, names, passthrough) {
-	const { print, logger, listDir, lookPath, cwd, task, readFile, fileExists } = input;
-	const dryRun = input.dryRun ?? false;
-	const runOne = makeRunOne(input);
-	let rootFiles;
-	try {
-		rootFiles = listDir(cwd);
-	} catch {
-		rootFiles = [];
-	}
-	const resolved = resolveLinters({
-		explicit: names,
-		rootFiles
-	});
-	const reports = [];
-	let anyHasLocalBin = false;
-	for (const { name, def } of resolved) {
-		const bin = def.localBin;
-		if (!bin) {
-			print(`· ${name} (CI only)`);
-			continue;
-		}
-		anyHasLocalBin = true;
-		const found = lookPath(cwd, bin);
-		if (!found) {
-			print(`! ${name} — ${bin} not on PATH${def.installHint ? `. ${def.installHint}` : ""} (enforced in CI)`);
-			continue;
-		}
-		const configFlags = resolveToolConfig(name, cwd, {
-			readFile,
-			fileExists
-		});
-		reports.push(runOne(found, [
-			...configFlags,
-			...def.localArgs ?? [],
-			...passthrough
-		]));
+/**
+* Known linters, in execution order. `always` entries are the current
+* hard-coded super-linter baseline; `prettier` is always-on because the org
+* applies it universally (super-linter only lints files that exist).
+*/
+const LINTERS = {
+	eslint: {
+		validate: ["VALIDATE_JAVASCRIPT_ES", "VALIDATE_TYPESCRIPT_ES"],
+		localBin: "eslint",
+		localArgs: ["."],
+		detect: [
+			"eslint.config.ts",
+			"eslint.config.js",
+			"eslint.config.mjs",
+			"eslint.config.cjs",
+			".eslintrc",
+			".eslintrc.json",
+			".eslintrc.yml",
+			".eslintrc.yaml",
+			".eslintrc.cjs"
+		],
+		configInput: "eslint-config"
+	},
+	prettier: {
+		validate: [
+			"VALIDATE_JAVASCRIPT_PRETTIER",
+			"VALIDATE_JSX_PRETTIER",
+			"VALIDATE_TYPESCRIPT_PRETTIER",
+			"VALIDATE_TSX",
+			"VALIDATE_MARKDOWN_PRETTIER"
+		],
+		fix: [
+			"FIX_JAVASCRIPT_PRETTIER",
+			"FIX_JSX_PRETTIER",
+			"FIX_TYPESCRIPT_PRETTIER",
+			"FIX_TSX",
+			"FIX_MARKDOWN_PRETTIER"
+		],
+		always: true,
+		localBin: "prettier",
+		localArgs: ["--check", "."],
+		configInput: "prettier-config"
+	},
+	yamllint: {
+		validate: ["VALIDATE_YAML"],
+		always: true,
+		localBin: "yamllint",
+		localArgs: ["."],
+		installHint: "brew install yamllint",
+		configInput: "yaml-config"
+	},
+	actionlint: {
+		validate: ["VALIDATE_GITHUB_ACTIONS"],
+		always: true,
+		localBin: "actionlint",
+		localArgs: [],
+		installHint: "brew install actionlint"
+	},
+	gitleaks: {
+		validate: ["VALIDATE_GITLEAKS"],
+		always: true,
+		localBin: "gitleaks",
+		localArgs: [
+			"dir",
+			"--no-banner",
+			"--config",
+			".gitleaks.toml"
+		],
+		installHint: "brew install gitleaks"
+	},
+	editorconfig: {
+		validate: ["VALIDATE_EDITORCONFIG"],
+		always: true,
+		localBin: "editorconfig-checker",
+		localArgs: [],
+		installHint: "brew install editorconfig-checker"
+	},
+	commitlint: {
+		validate: ["VALIDATE_GIT_COMMITLINT"],
+		always: true
+	},
+	"git-merge-conflict-markers": {
+		validate: ["VALIDATE_GIT_MERGE_CONFLICT_MARKERS"],
+		always: true
+	},
+	markdownlint: {
+		validate: ["VALIDATE_MARKDOWN"],
+		localBin: "markdownlint-cli2",
+		localArgs: ["**/*.md"],
+		detect: [
+			".markdownlint.json",
+			".markdownlint.jsonc",
+			".markdownlint.yaml",
+			".markdownlint.yml",
+			".markdownlint-cli2.jsonc",
+			".markdownlint-cli2.yaml",
+			".markdownlint-cli2.mjs"
+		]
 	}
-	if (reports.length === 0) {
-		const required = input.required && anyHasLocalBin;
-		const msg = `no tooling available locally for ${task} — every linter in this group is CI-only here`;
-		print(required ? `✗ ${msg} (required)` : `· ${msg}`);
-		logger[required ? "warn" : "debug"]({
-			task,
-			status: required ? "fail" : "skip"
-		}, `run: ${task}`);
-		return {
-			status: required ? "fail" : "skip",
-			message: msg
-		};
+};
+/** Every linter name the registry knows. */
+const LINTER_NAMES = new Set(Object.keys(LINTERS));
+/**
+* Resolve the linter set for a repo. An `explicit` list (from `config.tasks`)
+* picks the candidate set; otherwise the candidates are every `always` linter
+* plus every `detect`-gated linter whose filenames are present at the repo
+* root, OR whose mapped `@theholocron/*-config` package resolves per
+* {@link sharedConfigAvailable} — a repo can't run eslint with genuinely no
+* config anywhere (super-linter FATALs if you ask it to,
+* theholocron/holocron#654), but a *shared* one it has installed counts
+* (holocron#795: proving `clients`' eslint.config.ts files reduce to zero
+* remaining content is only half the story — the file itself was still load-
+* bearing here as the sole "eslint is even configured" signal until this
+* fallback existed). `always` linters are unconditional. Result is ordered
+* by {@link LINTERS} declaration order.
+*
+* `sharedConfigAvailable` is caller-computed (`run.ts`'s `runLinterGroup`
+* already resolves each linter's `resolveToolConfig()` per member to build
+* its actual command — reusing that instead of duplicating the package-
+* resolution logic here keeps this function itself pure and file-I/O-free).
+*
+* @throws when an `explicit` name is not in the registry — a typo is a
+* config bug, not a linter to silently skip.
+*/
+function resolveLinters(opts) {
+	const order = Object.keys(LINTERS);
+	const present = new Set(opts.rootFiles);
+	const shared = opts.sharedConfigAvailable ?? /* @__PURE__ */ new Set();
+	const configPresent = (name, def) => def.always === true || (def.detect ?? []).some((f) => present.has(f)) || shared.has(name);
+	if (opts.explicit && opts.explicit.length > 0) {
+		const unknown = opts.explicit.filter((n) => !LINTER_NAMES.has(n));
+		if (unknown.length > 0) throw new Error(`unknown linter${unknown.length > 1 ? "s" : ""} ${unknown.map((n) => `"${n}"`).join(", ")} — known: ${order.join(", ")}`);
+		const wanted = new Set(opts.explicit);
+		return order.filter((n) => wanted.has(n) && configPresent(n, LINTERS[n])).map((name) => ({
+			name,
+			def: LINTERS[name]
+		}));
 	}
-	const command = reports.map((r) => r.command).filter((c) => Boolean(c)).join(" && ");
-	if (dryRun) return {
-		status: "dry-run",
-		command
-	};
-	return reports.some((r) => r.status === "fail") ? {
-		status: "fail",
-		command,
-		message: "one or more linters failed"
-	} : {
-		status: "ok",
-		command
-	};
+	return order.filter((name) => configPresent(name, LINTERS[name])).map((name) => ({
+		name,
+		def: LINTERS[name]
+	}));
+}
+//#endregion
+//#region src/tasks/run/resolve-bin/resolve-bin.ts
+/** `<cwd>/node_modules/.bin/<tool>` when it exists, else the bare `tool` name (left to `PATH`). */
+function resolveBin(cwd, tool, fileExists) {
+	const local = join(cwd, "node_modules", ".bin", tool);
+	return fileExists(local) ? local : tool;
 }
+//#endregion
+//#region src/tasks/run/resolve-runner/resolve-runner.ts
 const mkRunner = (tool, args = []) => ({
 	tool,
 	args
 });
 /**
-* Resolve `{ tool, args }` for a runner, applying `detect[]` against repo
-* files. Only called for `tool` / `detect` runners — the caller handles
-* `command` runners itself, so `local.detect` is present whenever
-* `local.tool` is not.
+* Resolve `{ tool, args }` for a runner, applying `detect[]` against repo
+* files, falling back (#750) to each candidate's `tool` name against
+* `package.json`'s own declared dependencies when neither matches by
+* filename. Only called for `tool` / `detect` runners — the caller handles
+* `command` runners itself, so `local.detect` is present whenever
+* `local.tool` is not.
+*
+* The dependency fallback matters once a Bucket A migration (#680) deletes
+* a build tool's own config file (`tsdown.config.ts`, `vite.config.ts`, …):
+* that file was the *only* signal `detect[]` had to offer, so removing it
+* used to make `delivery.build` report "no task for this repo" and silently
+* skip the build, even though the tool is still very much in use — a
+* package can't actually build with `tsdown` without it in
+* `dependencies`/`devDependencies`, so that's a signal at least as reliable
+* as the config file, and one deleting the file doesn't remove.
+*
+* **Per-candidate, not two full passes** (#750 follow-up — the first
+* shipped version got this wrong): `delivery.build`'s own `detect[]` ends
+* with `{ when: /^tsconfig\.json$/, tool: "tsc" }` as its last-resort
+* fallback, and `tsconfig.json` exists in essentially every package
+* regardless of build tool. A "check every candidate's filename, *then*
+* check every candidate's dependency" two-pass design would let that
+* always-present fallback file win over a real `tsdown`/`vite`/`rollup`
+* dependency match, the moment the earlier candidates' own config files are
+* gone — exactly backwards. Checking `(file match) || (dependency match)`
+* together for each candidate before moving to the next preserves the
+* intended precedence: a real signal for an *earlier* candidate, by either
+* means, still wins over a later candidate's mere filename presence.
+*/
+function resolveRunner(local, cwd, listDir, readFile) {
+	if (local.tool) return mkRunner(local.tool, local.args);
+	let files;
+	try {
+		files = listDir(cwd);
+	} catch {
+		files = [];
+	}
+	const deps = dependencyNames(readPackageJsonSync(cwd, { readFile }));
+	for (const candidate of local.detect) if (files.some((f) => candidate.when.test(f)) || deps.has(candidate.tool)) return mkRunner(candidate.tool, candidate.args);
+}
+//#endregion
+//#region src/tasks/run/resolve-export-entry/resolve-export-entry.ts
+/**
+* Unwrap a `package.json#exports` subpath entry down to its file path —
+* either a bare string, or an object with condition keys (`import`,
+* `default`, `require`, …) that may themselves nest one level (`{ import: {
+* types, default } }`, the shape every `@theholocron/*-config` package
+* actually uses). Prefers `import` (this org ships ESM), then `default`,
+* then `require` as a last resort.
+*/
+function resolveExportEntry(entry) {
+	if (typeof entry === "string") return entry;
+	if (entry === null || typeof entry !== "object") return void 0;
+	const conditions = entry;
+	const value = conditions.import ?? conditions.default ?? conditions.require;
+	if (typeof value === "string") return value;
+	if (typeof value === "object" && value !== null) return resolveExportEntry(value);
+}
+//#endregion
+//#region src/tasks/run/tool-configs/tool-configs.ts
+/**
+* `library` is every mapped tool's org-wide default variant today — every
+* currently-migrated repo (`holocron`, `clients`, `utils`, `configs`,
+* `themes`, `observability`, `skills`) is a publishable library package, and
+* `eslint-config`/`vitest-config`/`tsdown-config` all name their
+* general-purpose preset exactly that. Picking a different variant per repo
+* (an app-type template, say) needs new `holocron.config.ts` surface this
+* doesn't add yet — deliberately out of scope until a real consumer needs it.
+*/
+const TOOL_CONFIGS = {
+	eslint: {
+		package: "@theholocron/eslint-config",
+		exportPath: "./bundles/library",
+		flag: ["--config"]
+	},
+	prettier: {
+		package: "@theholocron/prettier-config",
+		exportPath: ".",
+		flag: ["--config"]
+	},
+	vitest: {
+		package: "@theholocron/vitest-config",
+		exportPath: "./bundles/library",
+		flag: ["--config"]
+	},
+	tsdown: {
+		package: "@theholocron/tsdown-config",
+		exportPath: "./presets/library",
+		flag: ["--config"]
+	},
+	commitlint: {
+		package: "@theholocron/commitlint-config",
+		exportPath: ".",
+		flag: ["--config"]
+	}
+};
+/**
+* Every filename a tool's own auto-discovery would pick up from `cwd` —
+* same extension set `registry.ts`'s `turbo.inputs`/`local.detect` entries
+* already use for these tools, kept in sync by hand (no shared source of
+* truth between the two today). Presence of any one of these means the
+* package has its own local config — customized or not, `resolveToolConfig`
+* can't tell the difference from the filename alone, so it defers to it
+* either way (#749).
 */
-function resolveRunner(local, cwd, listDir) {
-	if (local.tool) return mkRunner(local.tool, local.args);
-	let files;
+const LOCAL_CONFIG_FILES = {
+	eslint: [
+		"eslint.config.ts",
+		"eslint.config.js",
+		"eslint.config.mjs",
+		"eslint.config.cjs"
+	],
+	prettier: [
+		"prettier.config.ts",
+		"prettier.config.js",
+		"prettier.config.mjs",
+		"prettier.config.cjs"
+	],
+	vitest: [
+		"vitest.config.ts",
+		"vitest.config.js",
+		"vitest.config.mjs"
+	],
+	tsdown: [
+		"tsdown.config.ts",
+		"tsdown.config.js",
+		"tsdown.config.mjs",
+		"tsdown.config.cjs"
+	],
+	commitlint: [
+		"commitlint.config.ts",
+		"commitlint.config.js",
+		"commitlint.config.mjs",
+		"commitlint.config.cjs"
+	]
+};
+//#endregion
+//#region src/tasks/run/resolve-tool-config/resolve-tool-config.ts
+/**
+* Resolves the absolute path to a Bucket A tool's shared `@theholocron/*-config`
+* entry point, installed in the consuming repo's own `node_modules` — and the
+* CLI flag(s) to hand it via (`--config`, `--extends`, …). `run.ts` splices the
+* result into the command it builds for a tool/detect runner or a linter-group
+* entry, right after the tool's own args.
+*
+* Every mapped package's resolved entry point already carries a ready-to-use
+* default export (a plain re-export for `prettier`/`commitlint`; an invoked,
+* zero-arg preset for `eslint`/`vitest`/`tsdown` — verified end-to-end against
+* each tool's real `--config`/`--extends` loader, not just the file's shape).
+* A repo doesn't need this package installed at all — every lookup degrades to
+* `[]` (no flag added, the tool falls back to its own auto-discovery of a
+* local file, unchanged from today) rather than throwing.
+*
+* **Local file wins.** A `<tool>.config.*` sitting in `cwd` (whether it's
+* pure boilerplate or has real per-package customization on top of the
+* shared bundle, e.g. `mergeConfig(base, { test: { coverage: { exclude }
+* } })`) always skips the splice, even when the shared package is also
+* installed — an explicit `--config <shared path>` flag beats a tool's own
+* auto-discovery every time, so splicing it unconditionally would silently
+* discard that customization the file is still sitting right there on disk.
+* The shared bundle is only ever the fallback for a package with *no* local
+* file at all — that's still the "delete the file to go fully shared" path
+* this was designed for (#676); it just isn't unconditional (#749).
+*
+* `semantic-release`, `devmoji`, `editorconfig-checker`, and `knip` are
+* deliberately absent — `semantic-release-config`'s `defineConfig()` needs
+* real per-repo data (branches, npm options) a static `--extends <path>` can't
+* carry; `devmoji` runs through a git hook template, not `holocron run
+* <task>`; `editorconfig-checker` has no shared-config package yet; `knip` is
+* repo-specific by nature, never a shared-config candidate. See
+* `.notes/tech-config-resolution.spec.md` (#676).
+*/
+/**
+* `<flag> <absolute path>` for `tool`, resolved against `cwd`'s
+* `node_modules` — or `[]` when the tool isn't mapped, `cwd` already has its
+* own local config file for it (#749 — local always wins, customized or
+* not), the shared package isn't installed, its `package.json` doesn't
+* declare the export subpath this needs, or the resolved file doesn't
+* actually exist on disk (a stale install, or a package version that
+* predates the export existing).
+*/
+function resolveToolConfig(tool, cwd, deps) {
+	const spec = TOOL_CONFIGS[tool];
+	if (!spec) return [];
+	if ((LOCAL_CONFIG_FILES[tool] ?? []).some((name) => deps.fileExists(join(cwd, name)))) return [];
+	const pkgDir = join(cwd, "node_modules", ...spec.package.split("/"));
+	const pkgJsonPath = join(pkgDir, "package.json");
+	if (!deps.fileExists(pkgJsonPath)) return [];
+	let pkg;
 	try {
-		files = listDir(cwd);
+		pkg = JSON.parse(deps.readFile(pkgJsonPath));
 	} catch {
-		return;
+		return [];
 	}
-	for (const candidate of local.detect) if (files.some((f) => candidate.when.test(f))) return mkRunner(candidate.tool, candidate.args);
-}
-function resolveBin(cwd, tool, fileExists) {
-	const local = join(cwd, "node_modules", ".bin", tool);
-	return fileExists(local) ? local : tool;
-}
-function packageManager(cwd, readFile, fileExists) {
-	try {
-		const pkg = JSON.parse(readFile(join(cwd, "package.json")));
-		if (typeof pkg.packageManager === "string") return pkg.packageManager.split("@")[0];
-	} catch {}
-	if (fileExists(join(cwd, "pnpm-lock.yaml"))) return "pnpm";
-	if (fileExists(join(cwd, "bun.lockb"))) return "bun";
-	if (fileExists(join(cwd, "yarn.lock"))) return "yarn";
-	if (fileExists(join(cwd, "package-lock.json"))) return "npm";
-	return "pnpm";
+	const relative = resolveExportEntry(pkg.exports?.[spec.exportPath]);
+	if (!relative) return [];
+	const absolute = join(pkgDir, relative);
+	if (!deps.fileExists(absolute)) return [];
+	return [...spec.flag, absolute];
 }
+//#endregion
+//#region src/tasks/run/turbo-defines-task/turbo-defines-task.ts
+/** `true` when `<cwd>/turbo.json` declares `task` (under `tasks`, or turbo 1.x's `pipeline`). */
 function turboDefinesTask(cwd, task, readFile, fileExists) {
 	if (!fileExists(join(cwd, "turbo.json"))) return false;
 	try {
@@ -787,302 +1516,343 @@ function turboDefinesTask(cwd, task, readFile, fileExists) {
 		return false;
 	}
 }
-function packageJsonScript(cwd, task, readFile, fileExists) {
-	if (!fileExists(join(cwd, "package.json"))) return void 0;
-	try {
-		return JSON.parse(readFile(join(cwd, "package.json"))).scripts?.[task];
-	} catch {
-		return;
-	}
-}
 //#endregion
-//#region src/thin-callers.ts
+//#region src/tasks/run/run.ts
 /**
-* Workflow templates + thin-caller generation.
+* `holocron run <task> [job] [-- <passthrough>]` — run a registry task (or one
+* of its sub-jobs) locally.
 *
-* `WORKFLOW_TEMPLATES` holds each reusable `.github/workflows/<name>.yml`
-* (synced to `theholocron/.github`); `generateThinCallerContent` wraps one
-* into the thin caller `holocron setup` / `holocron sync` write locally.
-*/
-const WORKFLOW_TEMPLATES = {
-	"verification.unitTests": "name: Verification\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\nconcurrency:\n  group: test-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n  id-token: write\n  statuses: write\n\njobs:\n  test:\n    name: Test\n    uses: theholocron/.github/.github/workflows/verification.unitTests.yml@main\n    with:\n      run-unit: true\n    secrets: inherit\n",
-	"verification.typeSafety": "name: Verification\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\nconcurrency:\n  group: typecheck-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n\njobs:\n  typecheck:\n    name: Typecheck\n    uses: theholocron/.github/.github/workflows/verification.typeSafety.yml@main\n    secrets: inherit\n",
-	"verification.performance": "name: Verification\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\npermissions:\n  contents: read\n\njobs:\n  performance:\n    name: Audit the Performance\n    uses: theholocron/.github/.github/workflows/verification.performance.yml@main\n    secrets: inherit\n",
-	"sourceQuality.staticAnalysis": "name: Source Quality\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\nconcurrency:\n  group: source-quality-static-analysis-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: write\n  statuses: write\n\njobs:\n  static-analysis:\n    name: Static Analysis\n    uses: theholocron/.github/.github/workflows/sourceQuality.staticAnalysis.yml@main\n    secrets: inherit\n",
-	"sourceQuality.formatting": "name: Source Quality\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\nconcurrency:\n  group: source-quality-formatting-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: write\n  statuses: write\n\njobs:\n  formatting:\n    name: Formatting\n    uses: theholocron/.github/.github/workflows/sourceQuality.formatting.yml@main\n    secrets: inherit\n",
-	"sourceQuality.structuredDataValidation": "name: Source Quality\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\nconcurrency:\n  group: source-quality-structured-data-validation-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n\njobs:\n  structured-data-validation:\n    name: Structured Data Validation\n    uses: theholocron/.github/.github/workflows/sourceQuality.structuredDataValidation.yml@main\n    secrets: inherit\n",
-	"sourceQuality.deadCodeAnalysis": "name: Source Quality\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\npermissions:\n  contents: read\n\njobs:\n  dead-code-analysis:\n    name: Dead Code Analysis\n    uses: theholocron/.github/.github/workflows/sourceQuality.deadCodeAnalysis.yml@main\n    secrets: inherit\n",
-	"security.secretDetection": "name: Security\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\nconcurrency:\n  group: security-secret-detection-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n\njobs:\n  secret-detection:\n    name: Secret Detection\n    uses: theholocron/.github/.github/workflows/security.secretDetection.yml@main\n    secrets: inherit\n",
-	"security.codeScanning": "name: Security\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches:\n      - main\n  pull_request:\n    branches:\n      - main\n  schedule:\n    - cron: \"0 0 * * 1\"\n\npermissions:\n  actions: read\n  contents: read\n  security-events: write\n\njobs:\n  security:\n    name: Code Scanning\n    uses: theholocron/.github/.github/workflows/security.codeScanning.yml@main\n    secrets: inherit\n",
-	"delivery.build": "name: Delivery\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches-ignore:\n      - main # delivery.publish builds before publishing\n  pull_request:\n    branches:\n      - main\n\nconcurrency:\n  group: delivery.build-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n\njobs:\n  build:\n    name: Build\n    uses: theholocron/.github/.github/workflows/delivery.build.yml@main\n    secrets: inherit\n",
-	"delivery.publish": "name: Delivery\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches:\n      - main\n      - alpha\n  workflow_dispatch:\n    inputs:\n      dry_run:\n        description: >\n          Dry run — analyze commits and preview the release without git writes\n          or publish. Push-triggered runs always run fully; this only applies\n          to manual workflow_dispatch triggers.\n        required: false\n        default: true\n        type: boolean\n\npermissions:\n  contents: write\n  id-token: write\n  issues: write\n  pull-requests: write\n\nconcurrency:\n  group: ${{ github.workflow }}-${{ github.ref }}\n  cancel-in-progress: false\n\njobs:\n  release:\n    name: Release\n    uses: theholocron/.github/.github/workflows/delivery.publish.yml@main\n    with:\n      dry-run: ${{ inputs.dry_run == true }}\n    secrets: inherit\n",
-	"delivery.deploy": "name: Delivery\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main]\n  workflow_dispatch:\n\nconcurrency:\n  group: pages\n  cancel-in-progress: false\n\npermissions:\n  contents: read\n  pages: write\n  id-token: write\n\njobs:\n  deploy:\n    name: Deploy\n    uses: theholocron/.github/.github/workflows/delivery.deploy.yml@main\n    secrets: inherit\n",
-	"delivery.bundleSize": "name: Delivery\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\npermissions:\n  contents: read\n\njobs:\n  bundle-size:\n    name: Audit the Bundle Size\n    uses: theholocron/.github/.github/workflows/delivery.bundleSize.yml@main\n    secrets: inherit\n",
-	"platform.repoSync": "name: Platform\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main]\n    paths:\n      - holocron.config.ts\n      - package.json\n      - pnpm-workspace.yaml\n  workflow_dispatch:\n    inputs:\n      steps:\n        description: \"Sync steps to run (default: all)\"\n        type: string\n        required: false\n\nconcurrency:\n  group: sync-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: write\n  pull-requests: write\n\njobs:\n  sync:\n    name: Sync\n    uses: theholocron/.github/.github/workflows/platform.repoSync.yml@main\n    with:\n      steps: ${{ inputs.steps }}\n    secrets: inherit\n",
-	"platform.commitStandards": "name: Platform\n\non: # yamllint disable-line rule:truthy\n  pull_request:\n\nconcurrency:\n  group: platform-commit-standards-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n\njobs:\n  commit-standards:\n    name: Commit Standards\n    uses: theholocron/.github/.github/workflows/platform.commitStandards.yml@main\n    secrets: inherit\n",
-	"platform.repoValidation": "name: Platform\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\npermissions:\n  contents: read\n\njobs:\n  repo-validation:\n    name: Repo Validation\n    uses: theholocron/.github/.github/workflows/platform.repoValidation.yml@main\n    secrets: inherit\n",
-	"knowledge.wiki": "name: Knowledge\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main]\n  pull_request:\n    branches: [main]\n\nconcurrency:\n  group: ${{ github.event_name == 'pull_request' && format('wiki-preview-{0}', github.event.pull_request.number) || 'wiki' }}\n  cancel-in-progress: ${{ github.event_name == 'pull_request' }}\n\npermissions:\n  contents: read\n  deployments: write\n\njobs:\n  publish:\n    name: Publish\n    if: ${{ github.event_name != 'pull_request' }}\n    uses: theholocron/.github/.github/workflows/knowledge.wiki.yml@main\n    secrets: inherit\n\n  preview:\n    name: Preview\n    if: ${{ github.event_name == 'pull_request' }}\n    uses: theholocron/.github/.github/workflows/knowledge.wiki.yml@main\n    with:\n      preview: true\n      preview-id: pr-${{ github.event.pull_request.number }}\n    secrets: inherit\n",
-	preview: "name: Preview\n\non: # yamllint disable-line rule:truthy\n  pull_request:\n    branches: [main]\n\nconcurrency:\n  group: preview-${{ github.event.pull_request.number }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n  deployments: write\n  pull-requests: write\n\njobs:\n  preview:\n    name: Preview\n    uses: theholocron/.github/.github/workflows/preview.yml@main\n    secrets: inherit\n",
-	review: "name: Source Quality\n\non: # yamllint disable-line rule:truthy\n  pull_request:\n\nconcurrency:\n  group: review-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n  checks: write\n  pull-requests: write\n\njobs:\n  review:\n    name: Annotations\n    uses: theholocron/.github/.github/workflows/review.yml@main\n    secrets: inherit\n",
-	stale: "name: Stale\n\non: # yamllint disable-line rule:truthy\n  schedule:\n    - cron: \"30 1 * * *\"\n\npermissions:\n  contents: write\n  issues: write\n  pull-requests: write\n\njobs:\n  stale:\n    uses: theholocron/.github/.github/workflows/stale.yml@main\n    with:\n      exempt-issue-labels: \"in-progress,wip\"\n      exempt-all-issue-milestones: true\n      exempt-all-issue-projects: true\n      exempt-all-pr-projects: true\n    secrets: inherit\n",
-	greetings: "name: Platform\n\non: # yamllint disable-line rule:truthy\n  pull_request:\n  issues:\n\npermissions:\n  issues: write\n  pull-requests: write\n\njobs:\n  greetings:\n    name: Greetings\n    uses: theholocron/.github/.github/workflows/greetings.yml@main\n    secrets: inherit\n",
-	dependencies: "name: Platform\n\non: # yamllint disable-line rule:truthy\n  pull_request:\n\npermissions:\n  contents: write\n  pull-requests: write\n\njobs:\n  dependencies:\n    name: Dependencies\n    uses: theholocron/.github/.github/workflows/dependencies.yml@main\n    secrets: inherit\n",
-	bookkeeping: "name: Platform\n\non: # yamllint disable-line rule:truthy\n  pull_request:\n    types:\n      - opened\n      - edited\n\npermissions:\n  contents: read\n  issues: write\n  pull-requests: write\n\njobs:\n  bookkeeping:\n    name: Bookkeeping\n    uses: theholocron/.github/.github/workflows/bookkeeping.yml@main\n    secrets: inherit\n"
-};
-const KNOWN_WORKFLOWS = new Set(Object.keys(WORKFLOW_TEMPLATES));
-/**
-* The GitHub status-check context a `required` task contributes to branch
-* protection. Format: `"{workflow name} / {job name}"`.
+* A `job` argument only applies to tasks that declare `jobs`; for any other
+* task it is folded back into the passthrough (`holocron run delivery.build
+* src/`).
 *
-* Most of these are single-job workflows now (D3's decomposition split what
-* used to be multi-job `lint`/`audit` into one task per concern) — the
-* context names that job directly, no `Conclusion` aggregator needed; a
-* single job's own conclusion already *is* the workflow's conclusion.
-* `Conclusion` fan-in jobs are kept only where a task genuinely has several
-* conditionally-run jobs feeding one required check:
-* `verification.unitTests` (unit / Storybook / Chromatic / interaction /
-* user-flow, each gated by its own `run-*` input) and
-* `platform.repoValidation` (its three script jobs all must pass). Only
-* merge-gating workflows are listed. `astromech.requiredChecks()` reads this
-* for every `required` task.
-*/
-const WORKFLOW_CHECK_CONTEXTS = {
-	"delivery.build": "Build / Build every workspace",
-	"verification.unitTests": "Test / Conclusion",
-	"verification.typeSafety": "Typecheck / Run tsc --noEmit",
-	"verification.performance": "Audit the Performance / Run Lighthouse CI",
-	"sourceQuality.staticAnalysis": "Static Analysis / Run eslint and actionlint",
-	"sourceQuality.formatting": "Formatting / Run prettier, editorconfig-checker, markdownlint",
-	"sourceQuality.structuredDataValidation": "Structured Data Validation / Run yamllint",
-	"sourceQuality.deadCodeAnalysis": "Dead Code Analysis / Run knip",
-	"security.secretDetection": "Secret Detection / Run gitleaks",
-	"platform.commitStandards": "Commit Standards / Run commitlint",
-	"platform.repoValidation": "Repo Validation / Conclusion",
-	"delivery.bundleSize": "Audit the Bundle Size / Upload bundle stats to Codecov"
-};
-/**
-* Generate the thin caller content for a workflow, optionally injecting or
-* merging `with:` overrides into the jobs block.
+* Resolution:
 *
-* Two strategies are used depending on the template:
-* - Templates that already have a `with:` block (e.g. lint):
-*   the override entries are merged in, replacing existing keys and appending
-*   new ones.
-* - Templates that end with `    secrets: inherit`: a new `with:` block is
-*   injected immediately before `secrets: inherit`.
-* If neither pattern matches the template, a warning is emitted and the
-* base template is returned unchanged.
+*   J. job given                              → TASKS[task].jobs[job].local (unknown job → exit 1)
+*   1. turbo.json defines the task            → `turbo run <task>`
+*   2. package.json has a `<task>` script     → `<pm> run <task>`
+*      (unless it's the `holocron run …` thin caller — that recurses)
+*   3. TASKS[task].local resolves             → `<tool> <args> <org-flags> <passthrough>`
+*   3b. TASKS[task].linterGroup               → run each resolved linter natively (see below)
+*   4. TASKS[task].jobs has entries           → run each job in declared order
+*   5. TASKS[task].local === null             → "enforced in CI" (skip, even with --required)
+*   5b. known task, nothing resolved          → "no <task> task" (exit 0, or 1 with --required)
+*   6. unknown task                           → "unknown task" (exit 1)
+*
+* A `linterGroup` task (`sourceQuality.staticAnalysis`, etc.) runs its fixed
+* set of `linters.ts` entries, each still gated by that linter's own
+* `detect`/`always` rule — every entry runs its `localBin` natively when
+* found on PATH. Missing tools are flagged; the exit code is the worst of
+* the lot. Unlike the old single `lint` task, this check runs *after*
+* turbo/`package.json` resolution (step 3b, not step 0) — a `linterGroup`
+* task is a normal turbo-delegatable task like any other.
 */
-function generateThinCallerContent(name, withOverrides, additionalPaths, logger, comments) {
-	const base = WORKFLOW_TEMPLATES[name];
-	if (!base) return "";
-	const yamlScalar = (v) => {
-		if (v === true) return "true";
-		if (v === false) return "false";
-		const s = String(v);
-		return s.startsWith("[") || s.startsWith("{") ? `'${s}'` : s;
-	};
-	const fmt = (k, v) => {
-		const line = `      ${k}: ${yamlScalar(v)}`;
-		return comments?.[k] ? `      # ${comments[k]}\n${line}` : line;
+/** The per-command runner — `runTask` and `runLintAggregate` share it. */
+function makeRunOne(input) {
+	const { print, logger, exec, task, cwd } = input;
+	const dryRun = input.dryRun ?? false;
+	return (cmd, args) => {
+		const command = [cmd, ...args].join(" ");
+		if (dryRun) {
+			print(`would run: ${command}`);
+			logger.debug({
+				task,
+				command,
+				status: "dry-run"
+			}, `run: ${task}`);
+			return {
+				status: "dry-run",
+				command
+			};
+		}
+		print(`→ ${command}`);
+		const { exitCode } = exec(cmd, args, { cwd });
+		const status = exitCode === 0 ? "ok" : "fail";
+		logger[status === "fail" ? "warn" : "debug"]({
+			task,
+			command,
+			exitCode,
+			status
+		}, `run: ${task}`);
+		return {
+			status,
+			command,
+			...status === "fail" ? { message: `\`${command}\` exited ${exitCode}` } : {}
+		};
 	};
-	let result = base;
-	if (additionalPaths && additionalPaths.length > 0) {
-		const pathsBlockRe = /( {4}paths:\n)((?:[ ]{6}- [^\n]+\n)+)/;
-		if (pathsBlockRe.test(result)) result = result.replace(pathsBlockRe, (_, header, existing) => {
-			const existingPaths = new Set([...existing.matchAll(/- (.+)/g)].map((m) => m[1]));
-			const newEntries = additionalPaths.filter((p) => !existingPaths.has(p)).map((p) => `      - ${p}\n`).join("");
-			return header + existing + newEntries;
-		});
-		else {
-			const pathsBlock = `    paths:\n${additionalPaths.map((p) => `      - ${p}\n`).join("")}`;
-			result = result.replace(/( {4}branches: \[main\]\n)/, `$1${pathsBlock}`);
+}
+function runTask(input) {
+	const { print, logger, readFile, fileExists, listDir, task, cwd } = input;
+	const def = TASKS[task];
+	let job = input.job;
+	let passthrough = input.passthrough ?? [];
+	if (job !== void 0 && !def?.jobs) {
+		passthrough = [job, ...passthrough];
+		job = void 0;
+	}
+	if (job !== void 0) {
+		const jobDef = def.jobs[job];
+		if (!jobDef) {
+			const known = Object.keys(def.jobs).join(", ");
+			print(`✗ unknown job "${job}" for "${task}" (known: ${known})`);
+			logger.warn({
+				task,
+				job,
+				status: "unknown"
+			}, `run: ${task} ${job}`);
+			return {
+				status: "unknown",
+				message: `unknown job "${task} ${job}"`
+			};
+		}
+		const label = `${task} ${job}`;
+		return runUnit(input, label, jobDef.local, makeRunOne({
+			...input,
+			task: label
+		}), passthrough);
+	}
+	const run = makeRunOne(input);
+	if (turboDefinesTask(cwd, task, readFile, fileExists)) {
+		const filterArg = input.filter ? [`--filter=${input.filter}`] : [];
+		const forwarded = [...def?.local && !def.local.command && def.local.tool ? def.flags?.[def.local.tool] ?? [] : [], ...passthrough];
+		const args = [
+			"run",
+			task,
+			...filterArg,
+			...forwarded.length ? ["--", ...forwarded] : []
+		];
+		return run(resolveBin(cwd, "turbo", fileExists), args);
+	}
+	const script = readPackageJsonSync(cwd, { readFile })?.scripts?.[task];
+	if (script && !/^holocron run\b/.test(script.trim())) return run(detectPackageManager(cwd, {
+		readFile,
+		fileExists
+	}), [
+		"run",
+		task,
+		...passthrough.length ? ["--", ...passthrough] : []
+	]);
+	if (def?.local) {
+		if (def.local.command) return run(process.execPath, [
+			process.argv[1],
+			...def.local.command.split(" "),
+			...passthrough
+		]);
+		const runner = resolveRunner(def.local, cwd, listDir, readFile);
+		if (runner) {
+			const flags = (def.flags?.[runner.tool] ?? []).filter((f) => !passthrough.includes(f));
+			const configFlags = resolveToolConfig(runner.tool, cwd, {
+				readFile,
+				fileExists
+			});
+			return run(resolveBin(cwd, runner.tool, fileExists), [
+				...runner.args,
+				...configFlags,
+				...flags,
+				...passthrough
+			]);
 		}
 	}
-	if (!withOverrides || Object.keys(withOverrides).length === 0) return result;
-	const withBlockRe = /( {4}with:\n)((?:[ ]{6}[^\n]+\n)*)/;
-	const existingMatch = result.match(withBlockRe);
-	if (existingMatch) {
-		const existingEntries = new Map(existingMatch[2].split("\n").filter(Boolean).filter((line) => !line.trim().startsWith("#")).map((line) => {
-			const m = line.match(/^ {6}([^:]+):\s*(.*)/);
-			return m ? [m[1].trim(), m[2].trim()] : null;
-		}).filter((e) => e !== null));
-		for (const [k, v] of Object.entries(withOverrides)) existingEntries.set(k, yamlScalar(v));
-		const merged = [...existingEntries.entries()].map(([k, v]) => `      ${k}: ${v}`).join("\n");
-		return result.replace(withBlockRe, `    with:\n${merged}\n`);
+	if (def?.linterGroup) return runLinterGroup(input, def.linterGroup, passthrough);
+	if (def?.jobs && Object.keys(def.jobs).length > 0) return runAllJobs(input, def.jobs, passthrough);
+	if (def?.local === null) {
+		const msg = `no local equivalent for ${task} — enforced in CI`;
+		print(`· ${msg}`);
+		logger.debug({
+			task,
+			status: "skip"
+		}, `run: ${task}`);
+		return {
+			status: "skip",
+			message: msg
+		};
 	}
-	const withBlock = Object.entries(withOverrides).map(([k, v]) => fmt(k, v)).join("\n");
-	const injected = result.replace(/ {4}secrets: inherit\n$/, `    with:\n${withBlock}\n    secrets: inherit\n`);
-	if (injected === result) logger?.warn({ template: name }, "generateThinCallerContent: could not inject `with:` overrides");
-	return injected;
-}
-/**
-* Extract the Cloudflare Pages preview config from a deploy workflow's `with:` object.
-*
-* Accepts three forms:
-* - `preview: true` — derive both project and domain from org context
-* - `preview: { project: "..." }` — explicit project; domain derived from context if omitted
-* - `preview: { project: "...", domain: "..." }` — fully explicit
-*
-* Returns null when `preview:` is absent, false, or can't be resolved.
-*/
-function extractPreviewConfig(raw, ctx = {}) {
-	const preview = raw["preview"];
-	if (!preview) return null;
-	if (preview === true) {
-		const project = ctx.org ? `${ctx.org}-preview` : null;
-		const domain = ctx.domain ? `preview.${ctx.domain}` : void 0;
-		if (!project) return null;
+	if (KNOWN_TASKS.has(task)) {
+		const msg = `no ${task} task for this repo`;
+		print(input.required ? `✗ ${msg} (required)` : `· ${msg}`);
+		logger[input.required ? "warn" : "debug"]({
+			task,
+			status: input.required ? "fail" : "skip"
+		}, `run: ${task}`);
 		return {
-			project,
-			...domain ? { domain } : {}
+			status: input.required ? "fail" : "skip",
+			message: msg
 		};
 	}
-	if (typeof preview !== "object") return null;
-	const p = preview;
-	const project = typeof p["project"] === "string" && p["project"] ? p["project"] : ctx.org ? `${ctx.org}-preview` : null;
-	if (!project) return null;
-	const domain = typeof p["domain"] === "string" && p["domain"] ? p["domain"] : ctx.domain ? `preview.${ctx.domain}` : void 0;
+	print(`✗ unknown task "${task}"`);
+	logger.warn({
+		task,
+		status: "unknown"
+	}, `run: ${task}`);
 	return {
-		project,
-		...domain ? { domain } : {}
+		status: "unknown",
+		message: `unknown task "${task}"`
 	};
 }
 /**
-* Generate the full thin-caller YAML for a `deploy.yml` that handles both
-* production (push to main → GitHub Pages) and preview (pull_request →
-* Cloudflare Pages) in a single file.
+* Run one registry unit — a task's own runner or a single sub-job. Resolution
+* is registry-only (`turbo` / `package.json` scripts are keyed by task, not
+* `task/job`). `label` names the unit in messages (`audit performance`).
 *
-* Both jobs receive the same docs/storybook `with:` inputs. If the per-repo
-* config supplies `cloudflare-project` it is forwarded; otherwise the reusable
-* falls back to the `CLOUDFLARE_PAGES_PROJECT` org variable — set that once and
-* all repos with a `deploy` workflow get previews without per-repo config.
+* `local: null` → CI-only by design, always a skip (never a failure, even with
+* `--required`). A declared runner with no matching repo file, or whose tool
+* isn't installed locally → a skip (`--required` turns it into a failure — the
+* repo claims a check it can't back). Mirrors the lint aggregate: run what's
+* here, flag the rest, let CI enforce.
 */
-function generateCombinedDeployContent(deployWith, paths, preview) {
-	const yamlScalar = (v) => {
-		if (v === true) return "true";
-		if (v === false) return "false";
-		const s = String(v);
-		return s.startsWith("[") || s.startsWith("{") ? `'${s}'` : s;
+function runUnit(input, label, local, run, passthrough) {
+	const { print, logger, listDir, lookPath, cwd, readFile } = input;
+	const skip = (msg) => {
+		print(input.required ? `✗ ${msg} (required)` : `· ${msg}`);
+		logger[input.required ? "warn" : "debug"]({
+			task: label,
+			status: input.required ? "fail" : "skip"
+		}, `run: ${label}`);
+		return {
+			status: input.required ? "fail" : "skip",
+			message: msg
+		};
 	};
-	const withLines = (entries) => Object.entries(entries).map(([k, v]) => `      ${k}: ${yamlScalar(v)}`).join("\n");
-	const pathsBlock = paths.length > 0 ? `    paths:\n${paths.map((p) => `      - ${p}\n`).join("")}` : "";
-	const previewWith = {
-		...deployWith,
-		"cloudflare-project": preview.project
+	if (local) {
+		const runner = resolveRunner(local, cwd, listDir, readFile);
+		if (!runner) return skip(`no ${label} runner for this repo`);
+		const found = lookPath(cwd, runner.tool);
+		if (!found) return skip(`${runner.tool} not installed locally for ${label} — enforced in CI`);
+		return run(found, [...runner.args, ...passthrough]);
+	}
+	const msg = `no local equivalent for ${label} — enforced in CI`;
+	print(`· ${msg}`);
+	logger.debug({
+		task: label,
+		status: "skip"
+	}, `run: ${label}`);
+	return {
+		status: "skip",
+		message: msg
 	};
-	const deployWithBlock = Object.keys(deployWith).length > 0 ? `    with:\n${withLines(deployWith)}\n` : "";
-	const previewWithBlock = `    with:\n${withLines(previewWith)}\n`;
-	return [
-		`name: Deploy`,
-		``,
-		`on: # yamllint disable-line rule:truthy`,
-		`  push:`,
-		`    branches: [main]`,
-		...pathsBlock ? [`${pathsBlock}`] : [],
-		`  pull_request:`,
-		`    branches: [main]`,
-		`    types: [opened, synchronize, reopened, closed]`,
-		...pathsBlock ? [`${pathsBlock}`] : [],
-		`  workflow_dispatch:`,
-		``,
-		`concurrency:`,
-		`  group: $\{{ github.event_name == 'pull_request' && format('preview-{0}', github.event.pull_request.number) || 'pages' }}`,
-		`  cancel-in-progress: $\{{ github.event_name == 'pull_request' && github.event.action != 'closed' }}`,
-		``,
-		`permissions:`,
-		`  contents: read`,
-		`  deployments: write`,
-		`  pages: write`,
-		`  id-token: write`,
-		`  pull-requests: write`,
-		``,
-		`jobs:`,
-		`  deploy:`,
-		`    name: Deploy`,
-		`    if: \${{ github.event_name != 'pull_request' }}`,
-		`    uses: theholocron/.github/.github/workflows/delivery.deploy.yml@main`,
-		...deployWithBlock ? [deployWithBlock.trimEnd()] : [],
-		`    secrets: inherit`,
-		``,
-		`  preview:`,
-		`    name: Preview`,
-		`    if: \${{ github.event_name == 'pull_request' }}`,
-		`    uses: theholocron/.github/.github/workflows/preview.yml@main`,
-		previewWithBlock.trimEnd(),
-		`    secrets: inherit`,
-		``
-	].join("\n");
 }
 /**
-* Expand structured with-values to flat GitHub Actions inputs before
-* generating the thin caller. Handles:
-*   - deploy shorthand: docs/storybook → type + storybook-projects
-*   - preview: stripped (handled separately via extractPreviewConfig)
-*   - run-chromatic object → run-chromatic: true + chromatic-projects
-*   - plain arrays → JSON-stringified for YAML scalar quoting
-*
-* Used by both `holocron setup` and `sync-workflow-templates`.
+* `holocron run <task>` for a task that is a container of sub-jobs (`audit`) —
+* run each job in declared order. Status precedence: any `fail` → `fail`; else
+* any `ok` → `ok`; else any `dry-run` → `dry-run`; else `skip` (nothing ran).
 */
-function normalizeWorkflowWith(raw) {
-	const result = { ...raw };
-	delete result["preview"];
-	const hasDocs = raw["docs"] === true || raw["docs"] !== null && typeof raw["docs"] === "object";
-	const storybookProjects = raw["storybook"];
-	if (hasDocs) {
-		result["type"] = "docs";
-		delete result["docs"];
-	}
-	if (Array.isArray(storybookProjects)) {
-		if (!hasDocs) result["type"] = "storybook";
-		result["storybook-projects"] = JSON.stringify(storybookProjects.map(({ name, path = "." }) => ({
-			name,
-			workingDir: path
-		})));
-		delete result["storybook"];
-	}
-	const runChromatic = raw["run-chromatic"];
-	if (runChromatic !== null && typeof runChromatic === "object" && "projects" in runChromatic) {
-		result["run-chromatic"] = true;
-		const projects = runChromatic.projects.map((p) => ({
-			...p,
-			...Array.isArray(p.untraced) ? { untraced: p.untraced.join("\n") } : {}
-		}));
-		result["chromatic-projects"] = JSON.stringify(projects);
+function runAllJobs(input, jobs, passthrough) {
+	const { print, task } = input;
+	const perJob = {
+		...input,
+		required: false
+	};
+	const reports = [];
+	for (const [name, jobDef] of Object.entries(jobs)) {
+		const label = `${task} ${name}`;
+		print(`▶ ${jobDef.checkContext}`);
+		reports.push(runUnit(perJob, label, jobDef.local, makeRunOne({
+			...perJob,
+			task: label
+		}), passthrough));
 	}
-	for (const [k, v] of Object.entries(result)) if (Array.isArray(v)) result[k] = JSON.stringify(v);
-	return result;
+	const command = reports.map((r) => r.command).filter((c) => Boolean(c)).join(" && ");
+	const statuses = new Set(reports.map((r) => r.status));
+	if (statuses.has("fail")) return {
+		status: "fail",
+		command,
+		message: `one or more ${task} jobs failed`
+	};
+	if (statuses.has("ok")) return {
+		status: "ok",
+		command
+	};
+	if (statuses.has("dry-run")) return {
+		status: "dry-run",
+		command
+	};
+	return {
+		status: "skip",
+		message: `no ${task} job has a local equivalent — enforced in CI`
+	};
 }
 /**
-* Derive on.push.paths entries from the deploy with: shorthand.
-* Used by both `holocron setup` and `sync-workflow-templates`.
-*/
-function deriveDeployPaths(raw) {
-	const paths = [];
-	const docs = raw["docs"];
-	if (docs === true) {
-		paths.push("docs/**");
-		paths.push("astro.config.ts");
-		paths.push("pnpm-workspace.yaml");
-		paths.push("pnpm-lock.yaml");
-	} else if (docs !== null && typeof docs === "object" && "path" in docs) {
-		const p = docs.path;
-		if (p && p !== ".") paths.push(`${p}/**`);
+* `holocron run <task>` for a `linterGroup` task — the task's fixed linter
+* set, each still gated by its own `detect`/`always` rule, run natively.
+* Worst exit code wins. Runs *after* the caller's own turbo/`package.json`
+* resolution (step 3b) — no per-linter turbo passthrough here, unlike the
+* old single `lint` task's eslint-only special case; the whole task is what
+* turbo/a package script would have already caught in steps 1–2.
+*/
+function runLinterGroup(input, names, passthrough) {
+	const { print, logger, listDir, lookPath, cwd, task, readFile, fileExists } = input;
+	const dryRun = input.dryRun ?? false;
+	const runOne = makeRunOne(input);
+	let rootFiles;
+	try {
+		rootFiles = listDir(cwd);
+	} catch {
+		rootFiles = [];
 	}
-	const storybookProjects = raw["storybook"];
-	if (Array.isArray(storybookProjects)) for (const s of storybookProjects) {
-		const p = s.path || ".";
-		if (p === ".") {
-			paths.push("src/**");
-			paths.push(".storybook/**");
-		} else paths.push(`${p}/**`);
+	const sharedConfigAvailable = new Set(names.filter((name) => resolveToolConfig(name, cwd, {
+		readFile,
+		fileExists
+	}).length > 0));
+	const resolved = resolveLinters({
+		explicit: names,
+		rootFiles,
+		sharedConfigAvailable
+	});
+	const reports = [];
+	let anyHasLocalBin = false;
+	for (const { name, def } of resolved) {
+		const bin = def.localBin;
+		if (!bin) {
+			print(`· ${name} (CI only)`);
+			continue;
+		}
+		anyHasLocalBin = true;
+		const found = lookPath(cwd, bin);
+		if (!found) {
+			print(`! ${name} — ${bin} not on PATH${def.installHint ? `. ${def.installHint}` : ""} (enforced in CI)`);
+			continue;
+		}
+		const configFlags = resolveToolConfig(name, cwd, {
+			readFile,
+			fileExists
+		});
+		reports.push(runOne(found, [
+			...configFlags,
+			...def.localArgs ?? [],
+			...passthrough
+		]));
 	}
-	return paths;
+	if (reports.length === 0) {
+		const required = input.required && anyHasLocalBin;
+		const msg = `no tooling available locally for ${task} — every linter in this group is CI-only here`;
+		print(required ? `✗ ${msg} (required)` : `· ${msg}`);
+		logger[required ? "warn" : "debug"]({
+			task,
+			status: required ? "fail" : "skip"
+		}, `run: ${task}`);
+		return {
+			status: required ? "fail" : "skip",
+			message: msg
+		};
+	}
+	const command = reports.map((r) => r.command).filter((c) => Boolean(c)).join(" && ");
+	if (dryRun) return {
+		status: "dry-run",
+		command
+	};
+	return reports.some((r) => r.status === "fail") ? {
+		status: "fail",
+		command,
+		message: "one or more linters failed"
+	} : {
+		status: "ok",
+		command
+	};
 }
 //#endregion
-//#region src/ci.ts
+//#region src/tasks/ci/ci.ts
 /**
-* `holocron ci` / `astromech.ci()` — run the merge-gating checks locally, in CI
+* `holocron run ci` / `astromech.ci()` — run the merge-gating checks locally, in CI
 * order, and exit non-zero on the first failure. The "will CI pass?" command a
 * `pre-push` hook and the agent skills point at.
 *
@@ -1104,7 +1874,7 @@ function runCi(input) {
 	const fellBack = input.scope !== "all" && selected.length === 0 && all.length > 0;
 	if (fellBack) selected = all;
 	const ordered = [...selected].sort((a, b) => CI_ORDER.indexOf(a.name) - CI_ORDER.indexOf(b.name));
-	print(`holocron ci — ${input.scope === "all" ? "all CI checks" : "required checks"} (${ordered.length})`);
+	print(`holocron run ci — ${input.scope === "all" ? "all CI checks" : "required checks"} (${ordered.length})`);
 	if (fellBack) print("  (no required tasks in the manifest — running every CI task)");
 	print("");
 	const jobs = [];
@@ -1138,8 +1908,8 @@ function runCi(input) {
 	const passed = jobs.filter((j) => j.status === "ok" || j.status === "dry-run").length;
 	const skipped = jobs.filter((j) => j.status === "skip").length;
 	print("");
-	if (ordered.length === 0) print("holocron ci — nothing to run");
-	else if (failed > 0) print(`✗ ${failed} failed, ${passed} passed${skipped ? `, ${skipped} skipped` : ""}`);
+	if (ordered.length === 0) print("holocron run ci — nothing to run");
+	else if (failed > 0) print(`✗ ${passed} passed, ${failed} failed${skipped ? `, ${skipped} skipped` : ""}`);
 	else print(`✓ ${passed} passed${skipped ? `, ${skipped} skipped` : ""}${input.dryRun ? " (plan only)" : ""}`);
 	return {
 		status: failed > 0 ? "fail" : "ok",
@@ -1150,364 +1920,474 @@ function taskName(item) {
 	return typeof item === "string" ? item : item.name;
 }
 //#endregion
-//#region src/templates/codecov/codecov.yml
-var codecov_default = "codecov:\n  require_ci_to_pass: true\n\ncoverage:\n  precision: 2\n  round: down\n  status:\n    project:\n      default:\n        target: auto\n        threshold: 2%\n        # Infra-only PRs (dep bumps, config, lockfile) touch no coverable code,\n        # so codecov produces no report to compare. Pass instead of blocking\n        # forever on a required check that will never post.\n        if_not_found: success\n    patch:\n      default:\n        target: 80%\n        if_not_found: success\n\ncomment:\n  layout: \"reach,diff,flags,components\"\n  behavior: default\n  require_changes: true\n\ncomponent_management:\n  default_rules:\n    statuses:\n      - type: patch\n        target: 80%\n        if_not_found: success\n  individual_components:\n";
-//#endregion
-//#region src/codecov.ts
-/**
-* `codecov.yml` generation — a manifest-derived artifact (component `paths`
-* come from workspace packages; the status targets track the `test` task's
-* coverage setup), the same category as the reusable `test.yml` this package
-* also generates. Moved out of `@theholocron/cli` (theholocron/holocron#650)
-* — `holocron setup`'s codecov step now calls {@link codecovConfig} instead
-* of importing this logic directly.
-*/
-const INDIVIDUAL_COMPONENTS_MARKER = "  individual_components:";
-function scaffoldHeader() {
-	return [
-		`# Scaffolded by holocron setup — edit this file freely.`,
-		`# Source:  theholocron/holocron · packages/astromech/src/codecov.ts`,
-		``
-	].join("\n");
-}
-function codecovComponentBlock(packages) {
-	if (packages.length === 0) return "\n    []\n";
-	return "\n" + packages.flatMap(({ slug, dir }) => [
-		`    - component_id: ${slug}`,
-		`      name: "${slug}"`,
-		`      paths:`,
-		`        - ${dir ?? "packages"}/${slug}/**`,
-		``
-	]).join("\n");
-}
+//#region src/utils/create-header/create-header.ts
 /**
-* Ensure every codecov status default carries `if_not_found: success`, so an
-* infra-only PR (dep bump, config, lockfile — no coverable change) passes
-* instead of hanging forever on a required check codecov never posts.
+* Factory that binds `source` and `tool` once and returns all header
+* constructors for auto-generated files. Prefer this over passing source
+* as a positional argument at every call site.
 *
-* Injects the key on the line after each `target:` that sits inside a status
-* block (`coverage.status.*.default` or a `statuses:` list item — indent ≥ 8,
-* or ≥ 8 for a `- type:` list entry), when the immediate sibling lines do not
-* already declare it.
+* @example
+* const { workflowHeader, scaffoldHeader } = createHeader({
+*   source: "packages/astromech/src/templates/configs/editorconfig/create-config.ts",
+* });
+*
+* export function createConfig(): string {
+*   return `${workflowHeader()}${body}`;
+* }
+*
+* ## Which header to use
+*
+* | Function          | When to use                                        | User can edit? |
+* |-------------------|----------------------------------------------------|----------------|
+* | `workflowHeader`  | Files overwritten on every setup / sync-github run | No — "AUTO-GENERATED — do not edit" |
+* | `scaffoldHeader`  | Files written once; user takes ownership after     | Yes — "Scaffolded — edit this file freely" |
+*
+* ## `workflowHeader` formats
+*
+* | Format              | Comment style          | Used for                                              |
+* |---------------------|------------------------|-------------------------------------------------------|
+* | `"yaml"` (default)  | `# …` lines            | YAML workflows, ignore files, `.editorconfig`, labeler|
+* | `"cjs"`             | `/* … *\/` block       | CommonJS config files (`.cjs`)                        |
+* | `"shebang"`         | `#!/bin/sh` + `# …`    | Shell scripts (`prepare-commit-msg`, hooks)           |
 */
-function ensureIfNotFound(yaml) {
-	const lines = yaml.split("\n");
-	const out = [];
-	for (let i = 0; i < lines.length; i++) {
-		const line = lines[i];
-		out.push(line);
-		const m = /^(\s{8,})target:\s+\S+\s*$/.exec(line);
-		if (!m) continue;
-		const indent = m[1];
-		let alreadySet = false;
-		for (let j = i + 1; j < lines.length; j++) {
-			const sib = lines[j];
-			if (sib.trim() === "") continue;
-			const sibIndent = sib.match(/^\s*/)[0].length;
-			if (sibIndent < indent.length) break;
-			if (sibIndent === indent.length && /^\s*if_not_found\s*:/.test(sib)) {
-				alreadySet = true;
-				break;
-			}
-			if (sibIndent === indent.length && /^\s*(- |\w)/.test(sib) && !/^\s*(threshold|flags|paths|branches)\s*:/.test(sib)) break;
+function createHeader(options) {
+	const { source, tool = "holocron repo setup", forPrimary = false } = options;
+	const doNotEdit = forPrimary ? `AUTO-GENERATED — do not edit in theholocron/.github directly.` : `AUTO-GENERATED — do not edit directly.`;
+	return {
+		workflowHeader(format = "yaml") {
+			if (format === "cjs") return [
+				`/* ${doNotEdit}`,
+				` * Source:  theholocron/holocron · ${source}`,
+				` * Tool:    ${tool}`,
+				` * Changes: edit source in theholocron/holocron`,
+				` */`,
+				``
+			].join("\n");
+			const yamlLines = [
+				`# ${doNotEdit}`,
+				`# Source:  theholocron/holocron · ${source}`,
+				`# Tool:    ${tool}`,
+				`# Changes: edit source in theholocron/holocron`,
+				``
+			].join("\n");
+			if (format === "shebang") return `#!/bin/sh\n\n${yamlLines}`;
+			return yamlLines;
+		},
+		scaffoldHeader() {
+			return [
+				`# Scaffolded by holocron repo setup — edit this file freely.`,
+				`# Source:  theholocron/holocron · ${source}`,
+				``
+			].join("\n");
 		}
-		if (!alreadySet) out.push(`${indent}if_not_found: success`);
-	}
-	return out.join("\n");
-}
-function mergeCodecovComponents(existing, packages) {
-	const idx = existing.indexOf(INDIVIDUAL_COMPONENTS_MARKER);
-	if (idx === -1) return ensureIfNotFound(existing);
-	return ensureIfNotFound(existing.slice(0, idx + 24)) + codecovComponentBlock(packages);
-}
-function readWorkspaceDir(repoRoot, dir) {
-	const dirPath = join(repoRoot, dir);
-	if (!existsSync(dirPath)) return [];
-	const packages = [];
-	for (const entry of readdirSync(dirPath, { withFileTypes: true })) {
-		if (!entry.isDirectory()) continue;
-		try {
-			const raw = readFileSync(join(dirPath, entry.name, "package.json"), "utf8");
-			const pkg = JSON.parse(raw);
-			if (typeof pkg.name === "string") packages.push({
-				slug: entry.name,
-				name: pkg.name,
-				dir
-			});
-		} catch {}
-	}
-	return packages;
+	};
 }
+//#endregion
+//#region src/utils/default-list-dirs/default-list-dirs.ts
+const defaultListDirs = (path) => readdirSync(path, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
+//#endregion
+//#region src/utils/default-read-json/default-read-json.ts
+const defaultReadJson = (path) => JSON.parse(readFileSync(path, "utf8"));
+//#endregion
+//#region src/utils/default-run/default-run.ts
+const defaultRun = (command, args, opts) => spawnSync(command, args, {
+	encoding: "utf8",
+	...opts
+});
+//#endregion
+//#region src/utils/default-sleep/default-sleep.ts
+const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+//#endregion
+//#region src/utils/exec/exec.ts
+/** Runs `cmd` with the parent's stdio; a signal-killed or unspawnable process reports `-1`. */
+const realExec = (cmd, args, opts) => {
+	return { exitCode: spawnSync(cmd, args, {
+		cwd: opts.cwd,
+		stdio: "inherit"
+	}).status ?? -1 };
+};
+//#endregion
+//#region src/utils/look-path/look-path.ts
+/** `node_modules/.bin/<bin>`, else the first `PATH` entry that has it, else `null`. */
+const realLookPath = (cwd, bin) => findExecutableSync(bin, { path: join(cwd, "node_modules", ".bin") }) ?? findExecutableSync(bin) ?? null;
+//#endregion
+//#region src/utils/noop-logger/noop-logger.ts
+/** The `RunLogger` used when the caller injects none: drops every record. */
+const noopLogger = {
+	debug() {},
+	warn() {}
+};
+//#endregion
+//#region src/tasks/deploy-on-release/constants.ts
+/** A stable release (no prerelease identifier) is on `main`, the default channel for a task. */
+const MAIN_CHANNEL = "main";
+const DEPLOY_TASK = "delivery.deploy";
+/** How long to wait for npm to serve the release's versions, and how often to ask. */
+const WAIT_TIMEOUT_MS = 3e5;
+const WAIT_INTERVAL_MS = 1e4;
+//#endregion
+//#region src/tasks/deploy-on-release/workspace-dependencies/workspace-dependencies.ts
 /**
-* Every public `packages/*` and `apps/*` workspace, sorted by slug. `[]`
-* when neither directory exists. Monorepo templates (Next.js, React, …)
-* ship user-facing code under `apps/` alongside library code under
-* `packages/` — both need a codecov component so `codecov/patch/<slug>`
-* actually posts for each.
+* `pkg`'s direct `workspace:*` dependencies -- `dependencies`, plus
+* `devDependencies` when asked. `pkg.devDependencies` defaults to `{}`:
+* it's optional on `WorkspacePackage` precisely so a caller holding the
+* previous (dev-dependency-less) shape doesn't crash here.
 */
-function readWorkspacePackages(repoRoot) {
-	return [...readWorkspaceDir(repoRoot, "packages"), ...readWorkspaceDir(repoRoot, "apps")].sort((a, b) => a.slug.localeCompare(b.slug));
-}
-/** A brand-new `codecov.yml` — the scaffold header + the base template + this repo's component list. */
-function createCodecovConfig(packages) {
-	return `${scaffoldHeader()}${codecov_default.trimEnd()}${codecovComponentBlock(packages)}`;
+function directWorkspaceDependencies(pkg, all, includeDevDependencies) {
+	const entries = includeDevDependencies ? [...Object.entries(pkg.dependencies), ...Object.entries(pkg.devDependencies ?? {})] : Object.entries(pkg.dependencies);
+	const names = new Set(entries.filter(([, spec]) => String(spec).startsWith("workspace:")).map(([name]) => name));
+	return all.filter((candidate) => names.has(candidate.name));
 }
 /**
-* The full pipeline `holocron setup` needs: read this repo's public
-* `packages/*`, then either merge them into an `existing` `codecov.yml` or
-* scaffold a new one.
+* Every `workspace:*` dependency of `pkg`, transitively (holocron#1071) —
+* its own direct dependencies, and theirs, and so on — as workspace
+* packages (with their current version).
+*
+* `includeDevDependencies` defaults to `false`, matching the pre-#1071
+* behavior: a shared dev/build-time workspace package (a tsconfig, a
+* lint config, a build script) counts only when a caller opts in.
+* `defaultPaths` (computing paths that should trigger a rebuild) opts in;
+* `deployOnRelease`'s publish-wait list (waiting for npm to serve a
+* package's RUNTIME dependencies before deploying it) does not -- an
+* unpublished, possibly `private`, dev-only package would never satisfy
+* that wait and the deploy would time out (holocron#1071 review).
+*
+* A diamond (two packages depending on the same third one) contributes
+* that third package once, not twice — tracked by a visited set, seeded
+* with `pkg` itself so a dependency cycle (A -> B -> A) can't loop
+* forever either, even though a real workspace graph normally can't have
+* one.
 */
-function codecovConfig(repoRoot, existing) {
-	const packages = readWorkspacePackages(repoRoot);
-	return existing != null ? mergeCodecovComponents(existing, packages) : createCodecovConfig(packages);
+function workspaceDependencies(pkg, all, options) {
+	const includeDevDependencies = options?.includeDevDependencies ?? false;
+	const visited = /* @__PURE__ */ new Set([pkg.name]);
+	const result = [];
+	let frontier = directWorkspaceDependencies(pkg, all, includeDevDependencies);
+	while (frontier.length > 0) {
+		const next = [];
+		for (const dep of frontier) {
+			if (visited.has(dep.name)) continue;
+			visited.add(dep.name);
+			result.push(dep);
+			next.push(...directWorkspaceDependencies(dep, all, includeDevDependencies));
+		}
+		frontier = next;
+	}
+	return result;
 }
 //#endregion
-//#region src/required-checks.ts
+//#region src/tasks/deploy-on-release/default-paths/default-paths.ts
 /**
-* `requiredChecks(config)` — the branch-protection required-status-check list,
-* derived from the task manifest. Every `required: true` task contributes its
-* {@link WORKFLOW_CHECK_CONTEXTS} entry; `config.extraRequiredChecks` adds
-* contexts not backed by a task (codecov, DCO is prepended by the caller).
+* The paths a release must touch to redeploy `pkg` when its manifest doesn't
+* list them: its own folder plus the folder of every
+* {@link workspaceDependencies} entry. Derived rather than listed so a new or
+* dropped workspace dependency needs no second edit.
 *
-* `@theholocron/cli`'s `holocron setup` calls this instead of the old
-* hand-maintained `repo.requiredChecks` array. Policy-free — it only knows the
-* manifest.
+* @returns Repo-relative prefixes, each ending in `/`.
 */
-/** Ordered (task contexts in {@link CI_ORDER}, then extras), de-duplicated. */
-function requiredChecks(config) {
-	const entries = (config.tasks ?? []).map(normalizeTaskEntry);
-	const seen = /* @__PURE__ */ new Set();
-	const out = [];
-	for (const name of CI_ORDER) {
-		const context = entries.some((e) => e.name === name && e.required === true) ? WORKFLOW_CHECK_CONTEXTS[name] : void 0;
-		if (context && !seen.has(context)) {
-			seen.add(context);
-			out.push(context);
-		}
-	}
-	for (const context of config.extraRequiredChecks ?? []) if (!seen.has(context)) {
-		seen.add(context);
-		out.push(context);
-	}
-	return out;
+function defaultPaths(repoRoot, pkg, all) {
+	return [pkg, ...workspaceDependencies(pkg, all, { includeDevDependencies: true })].map(({ dir }) => `${relative(repoRoot, dir).replace(/\\/g, "/")}/`);
 }
 //#endregion
-//#region src/templates/reusable/actions/auto-commit.yml
-var auto_commit_default = "name: Auto Commit\ndescription: >\n  Commit and push any file changes using stefanzweifel/git-auto-commit-action.\n  If a branch name is provided and differs from the current branch, a new branch\n  is created automatically.\n\ninputs:\n  token:\n    description: >\n      GitHub token with push access to the target branch. Used to authenticate\n      the git remote so the commit can be pushed.\n    required: true\n  branch:\n    description: >\n      Branch to commit to. Leave empty to commit to the current branch (useful\n      in PR contexts). Provide an explicit name (e.g. chore/auto-sync) to push\n      to a separate branch.\n    required: false\n    default: \"\"\n  commit-message:\n    description: Commit message.\n    required: true\n  commit-options:\n    description: >\n      Additional options passed to git commit (e.g. --no-verify).\n    required: false\n    default: \"\"\n  commit-user-name:\n    description: Git user.name for the commit.\n    required: false\n    default: \"github-actions[bot]\"\n  commit-user-email:\n    description: Git user.email for the commit.\n    required: false\n    default: \"41898282+github-actions[bot]@users.noreply.github.com\"\n  commit-author:\n    description: >\n      Git author string in \"Name <email>\" format.\n    required: false\n    default: \"github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>\"\n\noutputs:\n  changes-detected:\n    description: \"'true' if any files were committed, 'false' otherwise.\"\n    value: ${{ steps.commit.outputs.changes_detected }}\n\nruns:\n  using: composite\n  steps:\n    - name: Configure git remote with token\n      shell: bash\n      run: |\n        REMOTE_URL=$(git remote get-url origin)\n        AUTHED_URL=$(echo \"$REMOTE_URL\" | sed \"s|https://|https://x-access-token:${TOKEN}@|\")\n        git remote set-url origin \"$AUTHED_URL\"\n      env:\n        TOKEN: ${{ inputs.token }}\n\n    - name: Reset branch to current HEAD\n      if: ${{ inputs.branch != '' }}\n      shell: bash\n      run: git checkout -B \"$BRANCH\"\n      env:\n        BRANCH: ${{ inputs.branch }}\n\n    - name: Build signed commit message\n      id: msg\n      shell: bash\n      run: |\n        TRAILER=\"Signed-off-by: ${COMMIT_USER_NAME} <${COMMIT_USER_EMAIL}>\"\n        if echo \"$COMMIT_MESSAGE\" | grep -qF \"$TRAILER\"; then\n          FINAL=\"$COMMIT_MESSAGE\"\n        else\n          FINAL=\"${COMMIT_MESSAGE}\"$'\\n\\n'\"${TRAILER}\"\n        fi\n        {\n          echo \"value<<EOF_TRAILER\"\n          printf '%s' \"$FINAL\"\n          echo \"\"\n          echo \"EOF_TRAILER\"\n        } >> \"$GITHUB_OUTPUT\"\n      env:\n        COMMIT_MESSAGE: ${{ inputs.commit-message }}\n        COMMIT_USER_NAME: ${{ inputs.commit-user-name }}\n        COMMIT_USER_EMAIL: ${{ inputs.commit-user-email }}\n\n    - uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d # v7.2.0\n      id: commit\n      with:\n        branch: ${{ inputs.branch }}\n        commit_message: ${{ steps.msg.outputs.value }}\n        commit_options: ${{ inputs.commit-options }}\n        commit_user_name: ${{ inputs.commit-user-name }}\n        commit_user_email: ${{ inputs.commit-user-email }}\n        commit_author: ${{ inputs.commit-author }}\n";
-//#endregion
-//#region src/templates/reusable/actions/holocron.yml
-var holocron_default = "name: Holocron\ndescription: >\n  Run the Holocron CLI — `holocron run <task> [job]` by default, or any other\n  subcommand via `command:` (`sync`, `sync-github`, …). Resolves\n  `@theholocron/cli` from `node_modules` (published tarball) or builds it from\n  source when it resolves to an unbuilt workspace checkout (the holocron repo\n  itself). Requires dependencies to be installed already (run the setup action\n  first).\n\ninputs:\n  command:\n    description: >\n      Holocron subcommand. Default `run` — then `task` (and optional `job`)\n      name the manifest task. Set to `sync` / `sync-github` / … to run that\n      subcommand directly; `args` becomes everything after it.\n    required: false\n    default: run\n  task:\n    description: >\n      Manifest task to run when command is run — typecheck, test, build, audit.\n    required: false\n    default: \"\"\n  job:\n    description: Optional sub-job within the task (e.g. knip, performance for audit).\n    required: false\n    default: \"\"\n  args:\n    description: >\n      For `command: run`, extra arguments forwarded to the tool after `--`.\n      For any other command, the arguments passed straight to it.\n    required: false\n    default: \"\"\n\nruns:\n  using: composite\n\n  steps:\n    - name: Build the workspace when the CLI resolves to an unbuilt checkout\n      shell: bash\n      # The holocron repo carries @theholocron/cli as `workspace:*`; its bin\n      # (dist/cli.mjs) does not exist on a fresh checkout. `pnpm build` is a\n      # turbo run — cached and cheap once warm. A no-op everywhere else, where\n      # the published tarball already ships dist/.\n      #\n      # pnpm creates every workspace package's node_modules/.bin/holocron shim\n      # once, during the setup action's earlier `pnpm install` — before this\n      # build has run, so every one of them is silently skipped (\"Failed to\n      # create bin ... ENOENT\"), not just @theholocron/cli's own. That's a\n      # one-time decision: a later build doesn't retroactively fix a shim that\n      # was never created. Re-running `pnpm install` here (fast — the lockfile\n      # hasn't changed, so it only re-links `.bin`) is what actually fixes it,\n      # confirmed against a real cold install: `holocron` stays unresolvable\n      # from inside any package until this second install runs.\n      run: |\n        if [ ! -f node_modules/@theholocron/cli/dist/cli.mjs ]; then\n          echo \"→ @theholocron/cli dist/ missing — building the workspace from source\" >&2\n          pnpm build\n          echo \"→ re-linking node_modules/.bin — pnpm skipped it pre-build\" >&2\n          pnpm install --frozen-lockfile\n        fi\n\n    - name: holocron ${{ inputs.command }} ${{ inputs.task }}\n      shell: bash\n      env:\n        HOLOCRON_COMMAND: ${{ inputs.command }}\n        HOLOCRON_TASK: ${{ inputs.task }}\n        HOLOCRON_JOB: ${{ inputs.job }}\n        HOLOCRON_ARGS: ${{ inputs.args }}\n      run: |\n        if [ \"$HOLOCRON_COMMAND\" = \"run\" ]; then\n          set -- run \"$HOLOCRON_TASK\"\n          [ -n \"$HOLOCRON_JOB\" ] && set -- \"$@\" \"$HOLOCRON_JOB\"\n          # shellcheck disable=SC2086\n          [ -n \"$HOLOCRON_ARGS\" ] && set -- \"$@\" -- $HOLOCRON_ARGS\n        else\n          # shellcheck disable=SC2086\n          set -- \"$HOLOCRON_COMMAND\" $HOLOCRON_ARGS\n        fi\n        # Invoke the built entry directly. `pnpm exec holocron` relies on a\n        # node_modules/.bin/holocron shim that pnpm does not create for a\n        # workspace package whose dist/ was absent at install time (the holocron\n        # repo itself). Resolving the package's main export gives dist/index.mjs;\n        # the bin sits next to it as dist/cli.mjs. This is `require.resolve` from\n        # node_modules — it works in the holocron monorepo AND in every consumer\n        # repo (theholocron/holocron#655), unlike a hard-coded `packages/cli/…`.\n        cli=\"$(dirname \"$(node -e 'process.stdout.write(require.resolve(\"@theholocron/cli\"))')\")/cli.mjs\"\n        if [ ! -f \"$cli\" ]; then\n          echo \"::error::@theholocron/cli entry not found at $cli — is the workspace built?\" >&2\n          exit 1\n        fi\n        echo \"→ $cli $*\" >&2\n        node \"$cli\" \"$@\"\n";
-//#endregion
-//#region src/templates/reusable/actions/install.yml
-var install_default = "name: Install dependencies\ndescription: Install project dependencies with pnpm frozen lockfile.\n\nruns:\n  using: composite\n\n  steps:\n    - name: Install dependencies\n      if: ${{ hashFiles('pnpm-lock.yaml') != '' }}\n      shell: bash\n      run: pnpm install --frozen-lockfile\n";
-//#endregion
-//#region src/templates/reusable/actions/setup.yml
-var setup_default = "name: Setup\ndescription: Prepare the environment and install project dependencies.\n\ninputs:\n  node-version:\n    description: Node.js version\n    required: false\n    default: \"22.x\"\n\nruns:\n  using: composite\n\n  steps:\n    - uses: theholocron/.github/.github/actions/setup-node@main\n      with:\n        node-version: ${{ inputs.node-version }}\n\n    - uses: theholocron/.github/.github/actions/install@main\n\n    # `@theholocron/cli`'s `dist/cli.mjs` doesn't exist yet at this point, so\n    # pnpm's workspace bin-linking can't create `node_modules/.bin/holocron`\n    # (silent `WARN ... ENOENT`, not a hard failure). Every package whose\n    # scripts delegate via `holocron run <task> --` then fails at run time\n    # with `holocron: not found` (#698). Same fix the `holocron` composite\n    # action already applies for its own direct invocation (see its \"Build\n    # the workspace when the CLI resolves to an unbuilt checkout\" step) —\n    # mirrored here so it also covers *nested* `holocron run <task> --`\n    # calls from inside package.json scripts, which that action's own guard\n    # doesn't reach. `pnpm build` (not a scoped `--filter`) so the CLI's own\n    # workspace dependencies (e.g. rollup-plugin-transform-template) build\n    # in topological order too — a scoped build skips them and fails.\n    # No-op in every consumer repo, where the published tarball already\n    # ships `dist/`.\n    - name: Build the Holocron CLI\n      shell: bash\n      run: |\n        if [ ! -f node_modules/@theholocron/cli/dist/cli.mjs ]; then\n          echo \"→ @theholocron/cli dist/ missing — building the workspace from source\" >&2\n          pnpm build\n          echo \"→ re-linking node_modules/.bin — pnpm skipped it pre-build\" >&2\n          pnpm install --frozen-lockfile\n        fi\n\n    - name: Cache Turbo artifacts\n      if: ${{ hashFiles('turbo.json') != '' }}\n      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0\n      with:\n        path: .turbo\n        key: turbo-${{ runner.os }}-${{ github.sha }}\n        restore-keys: |\n          turbo-${{ runner.os }}-\n";
-//#endregion
-//#region src/templates/reusable/actions/setup-node.yml
-var setup_node_default = "name: Setup Node\ndescription: Install pnpm and Node.js with pnpm dependency caching.\n\ninputs:\n  node-version:\n    description: Node.js version\n    required: false\n    default: \"22.x\"\nruns:\n  using: composite\n\n  steps:\n    - name: Setup pnpm\n      if: ${{ hashFiles('pnpm-lock.yaml') != '' }}\n      uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4\n\n    - name: Setup Node.js\n      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0\n      with:\n        node-version: ${{ hashFiles('.node-version') != '' && '' || inputs.node-version }}\n        node-version-file: ${{ hashFiles('.node-version') != '' && '.node-version' || '' }}\n        cache: ${{ hashFiles('pnpm-lock.yaml') != '' && 'pnpm' || '' }}\n        # Do NOT add registry-url here. setup-node writes .npmrc with\n        # _authToken=${NODE_AUTH_TOKEN} and sets NPM_CONFIG_USERCONFIG to it.\n        # pnpm reads that file, fails env-var substitution when the token is\n        # empty, and loses auth entirely. Without registry-url, pnpm 10.15+\n        # handles Trusted Publishing via its own native OIDC exchange.\n\n    - name: Add node_modules/.bin to PATH\n      shell: bash\n      run: echo \"$GITHUB_WORKSPACE/node_modules/.bin\" >> $GITHUB_PATH\n";
-//#endregion
-//#region src/reusable.ts
+//#region src/tasks/deploy-on-release/deploy-targets/deploy-targets.ts
 /**
-* The **reusable** GitHub Actions surface pushed to `theholocron/.github` by
-* `holocron sync-github` — the `workflow_call` implementations and composite
-* actions that every repo's thin callers delegate to.
-*
-* `theholocron/.github` is a **pure sync target**: `.github/workflows/*`,
-* `.github/actions/*` and `workflow-templates/*` there are generated from the
-* `.yml` files in `src/templates/reusable/` and pushed verbatim (with a
-* "do not edit" header). Never hand-edit them in `.github`.
-*
-* Not to be confused with `WORKFLOW_TEMPLATES` in `thin-callers.ts` — those are
-* the *thin-caller bases* written into each consumer repo's `.github/workflows/`.
+* The packages whose manifest declares a release-time `delivery.deploy`
+* (`with.on === "release"`), with the task's options resolved.
 */
-/** `workflow_call` implementations → `.github/workflows/<name>.yml`. */
-const REUSABLE_WORKFLOWS = {
-	"verification.unitTests": "name: Test\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      run-unit:\n        description: Run unit tests with coverage (disable for UI-only repos that use Storybook testing exclusively)\n        type: boolean\n        required: false\n        default: true\n      run-storybook:\n        description: Run Storybook vitest interaction tests (requires .storybook/ setup)\n        type: boolean\n        required: false\n        default: false\n      run-interaction:\n        description: Run Storybook interaction and accessibility tests with Playwright\n        type: boolean\n        required: false\n        default: false\n      run-chromatic:\n        description: Publish Storybook to Chromatic for visual regression testing\n        type: boolean\n        required: false\n        default: false\n      chromatic-projects:\n        description: >\n          JSON array of Chromatic projects to build, one matrix job per entry.\n          Each entry: { \"tokenName\": \"WEB\", \"workingDir\": \"apps/web\", \"buildScript\": \"build:storybook\" }.\n          tokenName maps to secret CHROMATIC_PROJECT_TOKEN_<TOKENNAME>; use \"default\"\n          (or omit for the legacy empty-string form) to use the bare CHROMATIC_PROJECT_TOKEN\n          secret for single-project repos.\n          buildScript defaults to \"build:storybook\" when omitted.\n          Default runs a single job from the repo root using CHROMATIC_PROJECT_TOKEN.\n        type: string\n        required: false\n        default: '[{\"tokenName\":\"default\",\"workingDir\":\".\",\"buildScript\":\"build:storybook\"}]'\n      run-user-flow:\n        description: Run Cypress E2E user-flow tests (requires cypress.config.*)\n        type: boolean\n        required: false\n        default: false\n      wait-on-url:\n        description: URL to wait for before running Cypress tests (default is Vite dev server; override for non-Vite stacks e.g. http://localhost:3000 for Next.js)\n        type: string\n        required: false\n        default: \"http://localhost:5173\"\n    secrets:\n      CHROMATIC_PROJECT_TOKEN:\n        required: false\n      CYPRESS_RECORD_KEY:\n        required: false\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  unit:\n    name: Run unit tests and collect coverage\n    if: ${{ inputs.run-unit }}\n    permissions:\n      contents: read\n      id-token: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Run tests with coverage\n        with:\n          task: verification.unitTests\n\n      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0\n        name: Upload coverage to Codecov\n        with:\n          use_oidc: true\n\n      - uses: codecov/test-results-action@0fa95f0e1eeaafde2c782583b36b28ad0d8c77d3 # v1\n        name: Upload test results to Codecov\n        if: ${{ !cancelled() }}\n        with:\n          use_oidc: true\n          files: \"**/test-report.junit.xml\"\n\n  storybook:\n    name: Run Storybook interaction tests\n    if: ${{ inputs.run-storybook }}\n    permissions:\n      contents: read\n      id-token: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: pnpm exec playwright install chromium --with-deps\n        name: Install Playwright\n\n      - run: pnpm test:storybook\n        name: Run Storybook tests\n\n      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0\n        name: Upload coverage to Codecov\n        with:\n          use_oidc: true\n\n      - uses: codecov/test-results-action@0fa95f0e1eeaafde2c782583b36b28ad0d8c77d3 # v1\n        name: Upload test results to Codecov\n        if: ${{ !cancelled() }}\n        with:\n          use_oidc: true\n          files: \"**/test-report.junit.xml\"\n\n  visual-and-composition:\n    # No explicit matrix reference here — a skipped job (run-chromatic:\n    # false, the common case) never expands its matrix, so a `${{\n    # matrix.project.tokenName }}` in name: has nothing to resolve and\n    # shows as raw template text in the checks UI. GitHub auto-appends\n    # the matrix values in parens when the matrix *does* expand, so this\n    # loses no distinctness across multiple Chromatic projects.\n    name: Run visual and composition tests\n    if: ${{ inputs.run-chromatic }}\n    strategy:\n      fail-fast: false\n      matrix:\n        project: ${{ fromJSON(inputs.chromatic-projects) }}\n    permissions:\n      contents: read\n      statuses: write\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: chromaui/action@14cfaef73576e69f95f47f60058063f46ca38719 # v18\n        name: Publish to Chromatic\n        with:\n          projectToken: ${{ (matrix.project.tokenName == 'default' || matrix.project.tokenName == '') && secrets.CHROMATIC_PROJECT_TOKEN || secrets[format('CHROMATIC_PROJECT_TOKEN_{0}', matrix.project.tokenName)] }}\n          token: ${{ github.token }}\n          buildScriptName: ${{ matrix.project.buildScript || 'build:storybook' }}\n          workingDir: ${{ matrix.project.workingDir || '.' }}\n          storybookBaseDir: ${{ matrix.project.storybookBaseDir || '' }}\n          untraced: ${{ matrix.project.untraced || '' }}\n          onlyStoryFiles: ${{ matrix.project.onlyStoryFiles || '' }}\n          exitZeroOnChanges: ${{ matrix.project.exitZeroOnChanges || false }}\n\n  interaction-and-accessibility:\n    name: Run interactions and accessibility tests\n    if: ${{ inputs.run-interaction }}\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: pnpm exec playwright install --with-deps\n        name: Install Playwright\n\n      - run: pnpm test:storybook\n        name: Run interaction and accessibility tests\n\n  user-flow:\n    name: Run user flow tests\n    if: ${{ inputs.run-user-flow }}\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    strategy:\n      fail-fast: false\n      matrix:\n        containers: [1, 2]\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: pnpm exec cypress install\n        name: Install Cypress binary\n\n      - uses: cypress-io/github-action@1052aa98bbbe4f55210f844878213c07d9c8c399 # v6.7.13\n        name: Cypress run\n        with:\n          start: pnpm dev\n          wait-on: ${{ inputs.wait-on-url }}\n          record: true\n          parallel: true\n        env:\n          CYPRESS_RECORD_KEY: ${{ secrets.CYPRESS_RECORD_KEY }}\n          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n\n  conclusion:\n    name: Conclusion\n    runs-on: ubuntu-latest\n    if: always()\n    needs: [unit, storybook, visual-and-composition, interaction-and-accessibility, user-flow]\n    steps:\n      - name: Check job statuses\n        run: |\n          if [[ \"$RESULTS\" == *\"failure\"* ]] || [[ \"$RESULTS\" == *\"cancelled\"* ]]; then\n            exit 1\n          fi\n        env:\n          RESULTS: ${{ join(needs.*.result, ',') }}\n",
-	"verification.typeSafety": "name: Typecheck\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  typecheck:\n    name: Run tsc --noEmit\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Type check\n        with:\n          task: verification.typeSafety\n",
-	"verification.performance": "name: Audit the Performance\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      lighthouse-config:\n        description: >\n          Path to the Lighthouse CI config file, forwarded to `holocron run\n          verification.performance -- --config`. Defaults to\n          lighthouse.config.cjs (the org standard).\n        type: string\n        required: false\n        default: lighthouse.config.cjs\n    secrets:\n      LHCI_GITHUB_APP_TOKEN:\n        required: false\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  performance:\n    name: Run Lighthouse CI\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n      # Read by `lhci autorun` inside `holocron run verification.performance`.\n      LHCI_GITHUB_APP_TOKEN: ${{ secrets.LHCI_GITHUB_APP_TOKEN }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: npm install -g @lhci/cli@0.14.x\n        name: Install Lighthouse CLI\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Run Lighthouse CI\n        with:\n          task: verification.performance\n          args: --config=${{ inputs.lighthouse-config }}\n",
-	"sourceQuality.staticAnalysis": "name: Static Analysis\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      enable-auto-commit:\n        description: >\n          Auto-commit eslint --fix results as a verified commit via a GitHub App.\n          Requires SUPER_LINTER_APP_ID and SUPER_LINTER_PRIVATE_KEY secrets\n          (same App used across every formatting-capable task — D12).\n        type: boolean\n        required: false\n        default: false\n    secrets:\n      SUPER_LINTER_APP_ID:\n        required: false\n      SUPER_LINTER_PRIVATE_KEY:\n        required: false\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  static-analysis:\n    name: Run eslint and actionlint\n    permissions:\n      contents: write\n      statuses: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n      APP_ID_SET: ${{ secrets.SUPER_LINTER_APP_ID != '' }}\n    steps:\n      - name: Generate GitHub App token\n        id: app-token\n        if: >\n          inputs.enable-auto-commit == true &&\n          github.event.pull_request != null &&\n          github.event.pull_request.head.repo.full_name == github.repository &&\n          github.ref_name != github.event.repository.default_branch &&\n          env.APP_ID_SET == 'true'\n        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0\n        with:\n          app-id: ${{ secrets.SUPER_LINTER_APP_ID }}\n          private-key: ${{ secrets.SUPER_LINTER_PRIVATE_KEY }}\n\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n          token: ${{ steps.app-token.outputs.token || github.token }}\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      # actionlint has no npm distribution — install the prebuilt binary via\n      # the maintainer's own documented download script.\n      # NOTE: unverified against a live CI run at authoring time (D12) — flag\n      # here if this needs adjustment.\n      - name: Install actionlint\n        run: |\n          bash <(curl -sSf https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)\n          sudo mv ./actionlint /usr/local/bin/actionlint\n\n      - name: Check for merge-conflict markers\n        # No package distributes this as a standalone tool — a plain grep for\n        # the marker lines (the same check the old bundled linter ran, D12).\n        run: |\n          if grep -rlnE '^(<{7}|={7}|>{7})( |$)' \\\n            --exclude-dir=.git --exclude-dir=node_modules .; then\n            echo \"::error::merge-conflict markers found\"\n            exit 1\n          fi\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Run eslint and actionlint\n        with:\n          task: sourceQuality.staticAnalysis\n\n      - uses: theholocron/.github/.github/actions/auto-commit@main\n        name: Commit and push eslint --fix\n        if: >\n          inputs.enable-auto-commit == true &&\n          github.event.pull_request != null &&\n          github.event.pull_request.head.repo.full_name == github.repository &&\n          github.ref_name != github.event.repository.default_branch &&\n          env.APP_ID_SET == 'true' &&\n          steps.app-token.conclusion == 'success'\n        with:\n          token: ${{ steps.app-token.outputs.token }}\n          branch: ${{ github.event.pull_request.head.ref || github.head_ref || github.ref }}\n          commit-message: \"chore: fix static-analysis issues\"\n          commit-options: \"--no-verify\"\n",
-	"sourceQuality.formatting": "name: Formatting\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      enable-auto-commit:\n        description: >\n          Auto-commit prettier/editorconfig/markdownlint --fix results as a\n          verified commit via a GitHub App (same App used across every\n          formatting-capable task — D12).\n        type: boolean\n        required: false\n        default: false\n    secrets:\n      SUPER_LINTER_APP_ID:\n        required: false\n      SUPER_LINTER_PRIVATE_KEY:\n        required: false\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  formatting:\n    name: Run prettier, editorconfig-checker, markdownlint\n    permissions:\n      contents: write\n      statuses: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n      APP_ID_SET: ${{ secrets.SUPER_LINTER_APP_ID != '' }}\n    steps:\n      - name: Generate GitHub App token\n        id: app-token\n        if: >\n          inputs.enable-auto-commit == true &&\n          github.event.pull_request != null &&\n          github.event.pull_request.head.repo.full_name == github.repository &&\n          github.ref_name != github.event.repository.default_branch &&\n          env.APP_ID_SET == 'true'\n        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0\n        with:\n          app-id: ${{ secrets.SUPER_LINTER_APP_ID }}\n          private-key: ${{ secrets.SUPER_LINTER_PRIVATE_KEY }}\n\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n          token: ${{ steps.app-token.outputs.token || github.token }}\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      # editorconfig-checker has no npm distribution — install the prebuilt\n      # binary from its release tarball (v4.0.1+ ships the binary at the\n      # tarball root as `editorconfig-checker`, not `bin/ec-<os>-<arch>` —\n      # confirmed against a live CI run; the old asset name/path 404s now).\n      - name: Install editorconfig-checker\n        run: |\n          curl -sSL https://github.com/editorconfig-checker/editorconfig-checker/releases/latest/download/editorconfig-checker-linux-amd64.tar.gz \\\n            | tar xz -C /usr/local/bin editorconfig-checker\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Run prettier, editorconfig-checker, markdownlint\n        with:\n          task: sourceQuality.formatting\n\n      - uses: theholocron/.github/.github/actions/auto-commit@main\n        name: Commit and push formatting fixes\n        if: >\n          inputs.enable-auto-commit == true &&\n          github.event.pull_request != null &&\n          github.event.pull_request.head.repo.full_name == github.repository &&\n          github.ref_name != github.event.repository.default_branch &&\n          env.APP_ID_SET == 'true' &&\n          steps.app-token.conclusion == 'success'\n        with:\n          token: ${{ steps.app-token.outputs.token }}\n          branch: ${{ github.event.pull_request.head.ref || github.head_ref || github.ref }}\n          commit-message: \"chore: fix formatting issues\"\n          commit-options: \"--no-verify\"\n",
-	"sourceQuality.structuredDataValidation": "name: Structured Data Validation\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  structured-data-validation:\n    name: Run yamllint\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      # yamllint has no npm distribution — Python ships preinstalled on\n      # ubuntu-latest runners.\n      - name: Install yamllint\n        run: pip install --user yamllint\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Run yamllint\n        with:\n          task: sourceQuality.structuredDataValidation\n",
-	"sourceQuality.deadCodeAnalysis": "name: Dead Code Analysis\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  dead-code-analysis:\n    name: Run knip\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          persist-credentials: false\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Run knip\n        with:\n          task: sourceQuality.deadCodeAnalysis\n",
-	"security.secretDetection": "name: Secret Detection\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  secret-detection:\n    name: Run gitleaks\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n\n      # gitleaks has no npm distribution — install the prebuilt binary via\n      # the maintainer's own documented install script.\n      # NOTE: unverified against a live CI run at authoring time (D12) — flag\n      # here if this needs adjustment.\n      - name: Install gitleaks\n        run: |\n          curl -sSfL https://raw.githubusercontent.com/gitleaks/gitleaks/master/install.sh | sh -s -- -b /usr/local/bin\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Run gitleaks\n        with:\n          task: security.secretDetection\n",
-	"security.codeScanning": "name: Security\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      language:\n        description: CodeQL language to analyze\n        type: string\n        required: false\n        default: javascript-typescript\n\njobs:\n  analyze:\n    name: Analyze (${{ inputs.language }})\n    permissions:\n      actions: read\n      contents: read\n      security-events: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 45\n    # Do not cancel in-progress security scans.\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0\n        name: Initialize CodeQL\n        with:\n          languages: ${{ inputs.language }}\n\n      - uses: github/codeql-action/autobuild@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0\n        name: Autobuild\n\n      - uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0\n        name: Analyze\n        with:\n          category: /language:${{ inputs.language }}\n",
-	"delivery.build": "name: Build\n\n# Sanity check that every workspace actually compiles to dist/ — doesn't\n# upload or publish anything. delivery.publish builds again before\n# publishing; this just answers \"does it build?\" on every push/PR.\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  build:\n    name: Build every workspace\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Build\n        with:\n          task: delivery.build\n",
-	"delivery.publish": "name: Release\n\n# Semantic-release with OIDC Trusted Publishing.\n# actions/setup-node writes a default NODE_AUTH_TOKEN=${{ github.token }}\n# which shadows OIDC auth. We explicitly clear it so npm falls through to\n# the Trusted Publisher OIDC exchange.\n# The calling repo must have a .releaserc.json that configures branches,\n# plugins, and any publish options. npm@11+ is installed to support OIDC.\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      dry-run:\n        description: >\n          When true, runs semantic-release --dry-run: analyzes commits and\n          previews the next release without git writes or publish. Only\n          meaningful for workflow_dispatch triggers; push-triggered runs\n          always run fully.\n        type: boolean\n        required: false\n        default: false\n      post-release:\n        description: >\n          When true, dispatches a readme sync broadcast after a successful\n          release. Enable for packages consumed by other repos via the\n          registry-doc system so downstream README installation blocks\n          stay current.\n        type: boolean\n        required: false\n        default: false\n      run-build:\n        description: Run `pnpm build` before releasing\n        type: boolean\n        required: false\n        default: true\n      sentry-project:\n        description: >\n          Sentry project slug for sourcemap upload and release creation after\n          publishing. Omit to skip the Sentry release step entirely.\n        type: string\n        required: false\n        default: \"\"\n    secrets:\n      HOLOCRON_RELEASE_TOKEN:\n        description: >\n          Fine-grained PAT (Contents + Issues + Pull requests: write) owned by\n          an admin. Required when the default branch is protected by a ruleset —\n          github.token cannot push through rulesets, but an admin PAT can.\n          Takes priority over HOLOCRON_SYNC_TOKEN. Falls back to github.token.\n        required: false\n      HOLOCRON_SYNC_TOKEN:\n        description: >\n          Legacy alias for HOLOCRON_RELEASE_TOKEN — kept for backward compatibility.\n          Prefer HOLOCRON_RELEASE_TOKEN for new repos.\n        required: false\n      HOLOCRON_READ_TOKEN:\n        description: >\n          Fine-grained PAT for read-only GitHub API calls (e.g. resolving git\n          committer identity via `gh api user`). Falls back to github.token.\n        required: false\n      GH_TOKEN:\n        description: >\n          Generic GitHub token fallback for `gh` CLI calls. Used when\n          HOLOCRON_READ_TOKEN is not set.\n        required: false\n      SENTRY_AUTH_TOKEN:\n        description: >\n          Sentry auth token for sourcemap upload and release creation.\n          Required when sentry-project is set. Use the org-level secret.\n        required: false\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  release:\n    name: Semantic release\n    permissions:\n      contents: write\n      id-token: write\n      issues: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    # Do not cancel in-progress releases — a partial release is worse than a slow one.\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n          persist-credentials: false\n          # Use HOLOCRON_RELEASE_TOKEN when available — git push (tags, release commits)\n          # uses the checkout credential, not GITHUB_TOKEN env var. The\n          # built-in github.token cannot push through branch protection rulesets.\n          token: ${{ secrets.HOLOCRON_RELEASE_TOKEN || secrets.HOLOCRON_SYNC_TOKEN || github.token }}\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - name: Configure git identity\n        run: |\n          GIT_NAME=$(gh api user --jq .name 2>/dev/null || echo \"github-actions[bot]\")\n          GIT_EMAIL=$(gh api user --jq '\"\\(.id)+\\(.login)@users.noreply.github.com\"' 2>/dev/null || echo \"41898282+github-actions[bot]@users.noreply.github.com\")\n          git config --global user.name \"$GIT_NAME\"\n          git config --global user.email \"$GIT_EMAIL\"\n          git config --global format.signoff true\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_READ_TOKEN || secrets.GH_TOKEN || github.token }}\n\n      - name: Upgrade npm for OIDC support\n        run: npm install -g npm@11 sigstore\n        # sigstore is required by libnpmpublish/provenance.js at module parse\n        # time — before any config takes effect. Some npm 11.x builds stopped\n        # bundling it; installing it globally into the same prefix ensures it\n        # resolves regardless of npm version. (Discovered 2026-07-09.)\n\n      - run: pnpm build\n        name: Build\n        if: ${{ inputs.run-build == true }}\n\n      - name: Release\n        id: release\n        run: |\n          BEFORE=$(git rev-parse HEAD)\n          if [ \"$DRY_RUN\" = \"true\" ]; then\n            npx semantic-release --dry-run\n          else\n            npx semantic-release\n          fi\n          AFTER=$(git rev-parse HEAD)\n          # semantic-release only commits (`chore(release): … [skip ci]`) when it\n          # actually publishes. That commit gets no CI (and so no coverage\n          # upload), which makes the next PR's `codecov/project` compare a full\n          # report against a stale ancestor — a phantom drop (holocron#644).\n          # Emit the new SHA so the steps below upload coverage for it.\n          if [ \"$BEFORE\" != \"$AFTER\" ]; then echo \"commit=$AFTER\" >> \"$GITHUB_OUTPUT\"; fi\n        env:\n          DRY_RUN: ${{ inputs.dry-run }}\n          # Prefer HOLOCRON_RELEASE_TOKEN (fine-grained PAT, Contents+Issues+PRs write,\n          # owned by an admin with ruleset bypass) so @semantic-release/git can\n          # push the version-bump commit through branch protection. Falls back to\n          # HOLOCRON_SYNC_TOKEN (legacy) then github.token for unprotected repos.\n          GITHUB_TOKEN: ${{ secrets.HOLOCRON_RELEASE_TOKEN || secrets.HOLOCRON_SYNC_TOKEN || github.token }}\n          HUSKY: \"0\"\n          NPM_CONFIG_PROVENANCE: true\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Coverage for the release commit\n        if: ${{ steps.release.outputs.commit != '' }}\n        with:\n          task: verification.unitTests\n\n      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0\n        name: Upload release-commit coverage to Codecov\n        if: ${{ steps.release.outputs.commit != '' }}\n        with:\n          use_oidc: true\n          override_commit: ${{ steps.release.outputs.commit }}\n          override_branch: ${{ github.ref_name }}\n\n      - name: Get release version\n        id: release_version\n        if: ${{ inputs.sentry-project != '' && inputs.dry-run != true }}\n        env:\n          SENTRY_PROJECT: ${{ inputs.sentry-project }}\n        run: |\n          TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo \"\")\n          if [ -n \"$TAG\" ]; then\n            echo \"release=${SENTRY_PROJECT}@${TAG#v}\" >> \"$GITHUB_OUTPUT\"\n          fi\n\n      - name: Create Sentry release\n        if: ${{ inputs.sentry-project != '' && steps.release_version.outputs.release != '' && inputs.dry-run != true }}\n        uses: getsentry/action-release@ff07929a6537bac57790c3451cf4d364aca38528 # v3\n        env:\n          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}\n          SENTRY_ORG: theholocron\n          SENTRY_PROJECT: ${{ inputs.sentry-project }}\n        with:\n          environment: production\n          version: ${{ steps.release_version.outputs.release }}\n          sourcemaps: \"**/dist\"\n\n  sync-readme:\n    name: Post-release readme sync\n    needs: release\n    if: ${{ inputs.post-release == true && inputs.dry-run != true }}\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    steps:\n      - name: Trigger broadcast readme sync\n        run: |\n          gh workflow run sync-dispatch.yml \\\n            --repo theholocron/.github \\\n            --field \"steps=readme\"\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN }}\n",
-	"delivery.deploy": "name: Deploy\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      type:\n        description: \"Type of deployment: docs or storybook\"\n        required: true\n        type: string\n      storybook-projects:\n        description: >\n          JSON array of { \"name\"?, \"workingDir\", \"outputDir\"? } objects for storybook deploys.\n          Each is built via `pnpm -C <workingDir> build:storybook`. If \"name\" is provided the\n          output is placed under `sandbox/<name>/`; omit \"name\" for single-repo deploys and the\n          output lands directly in `sandbox/`.\n        type: string\n        required: false\n        default: \"[]\"\n      build-script:\n        description: pnpm script that builds the Storybook static output (single storybook, type:storybook only)\n        type: string\n        required: false\n        default: build:storybook\n      output-dir:\n        description: Directory where Storybook writes its static output (single storybook, type:storybook only)\n        type: string\n        required: false\n        default: storybook-static\n\njobs:\n  deploy:\n    name: Deploy\n    runs-on: ubuntu-latest\n    permissions:\n      contents: read\n      pages: write\n      id-token: write\n    environment:\n      name: github-pages\n      url: ${{ steps.deployment.outputs.page_url }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - name: Build docs site\n        if: ${{ inputs.type == 'docs' }}\n        run: pnpm -C docs build\n\n      - name: Build Storybook projects\n        if: ${{ inputs.storybook-projects != '[]' }}\n        env:\n          PROJECTS: ${{ inputs.storybook-projects }}\n        run: |\n          echo \"$PROJECTS\" | jq -c '.[]' | while IFS= read -r project; do\n            workingDir=$(echo \"$project\" | jq -r '.workingDir')\n            pnpm -C \"$workingDir\" build:storybook\n          done\n\n      - name: Build Storybook\n        if: ${{ inputs.type == 'storybook' && inputs.storybook-projects == '[]' }}\n        env:\n          BUILD_SCRIPT: ${{ inputs.build-script }}\n        run: pnpm run \"$BUILD_SCRIPT\"\n\n      - name: Assemble site\n        env:\n          DEPLOY_TYPE: ${{ inputs.type }}\n          PROJECTS: ${{ inputs.storybook-projects }}\n          STORYBOOK_OUTPUT_DIR: ${{ inputs.output-dir }}\n        run: |\n          mkdir -p _site\n          if [ \"$DEPLOY_TYPE\" = \"docs\" ]; then\n            cp -r docs/dist/. _site/\n          fi\n          if [ \"$PROJECTS\" != \"[]\" ]; then\n            echo \"$PROJECTS\" | jq -c '.[]' | while IFS= read -r project; do\n              name=$(echo \"$project\" | jq -r '.name // \"\"')\n              workingDir=$(echo \"$project\" | jq -r '.workingDir')\n              outputDir=$(echo \"$project\" | jq -r '.outputDir // \"storybook-static\"')\n              if [ -n \"$name\" ]; then\n                target=\"_site/sandbox/${name}\"\n              else\n                target=\"_site/sandbox\"\n              fi\n              mkdir -p \"$target\"\n              cp -r \"${workingDir}/${outputDir}/.\" \"$target/\"\n            done\n          elif [ \"$DEPLOY_TYPE\" = \"storybook\" ]; then\n            mkdir -p _site/sandbox\n            cp -r \"${STORYBOOK_OUTPUT_DIR}/.\" _site/sandbox/\n          fi\n\n      - uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1\n        name: Upload pages artifact\n        with:\n          path: _site\n\n      - uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5\n        id: deployment\n        name: Deploy to GitHub Pages\n",
-	"delivery.bundleSize": "name: Audit the Bundle Size\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      CODECOV_TOKEN:\n        required: false\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  bundle-size:\n    name: Upload bundle stats to Codecov\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n      # Read by the bundle-stats uploader inside `holocron run delivery.build`.\n      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Build and upload bundle stats\n        with:\n          task: delivery.build\n",
-	"platform.repoSync": "name: Sync\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      steps:\n        description: >\n          Sync steps to run (default: all). Valid values:\n          labels, properties, teams, topics, keywords, description, homepage, readme, workflows, wiki.\n          Pass a space-separated list to run a subset, e.g. \"readme\" or \"readme wiki\".\n        type: string\n        required: false\n    secrets:\n      HOLOCRON_ADMIN_TOKEN:\n        description: Fine-grained PAT with admin scopes (labels, properties, teams).\n        required: false\n      HOLOCRON_AXIOM_TOKEN:\n        description: >\n          Axiom API token. When set alongside the HOLOCRON_AXIOM_DATASET\n          repo/org variable, the CLI ships this run's structured logs to Axiom.\n          Falls back to the vendor-native AXIOM_TOKEN secret.\n        required: false\n      AXIOM_TOKEN:\n        description: Vendor-native fallback for HOLOCRON_AXIOM_TOKEN.\n        required: false\n      HOLOCRON_DEPLOY_TOKEN:\n        description: Fine-grained PAT for GitHub Pages configuration.\n        required: false\n      HOLOCRON_ISSUES_TOKEN:\n        description: Fine-grained PAT for issue management.\n        required: false\n      HOLOCRON_ORG_TOKEN:\n        description: Org-scoped fine-grained PAT for team sync and org properties.\n        required: false\n      HOLOCRON_READ_TOKEN:\n        description: Fine-grained PAT for read-only GitHub API calls.\n        required: false\n      HOLOCRON_SYNC_TOKEN:\n        required: false\n      GH_TOKEN:\n        description: >\n          Generic GitHub token fallback for gh CLI calls. Used when\n          HOLOCRON_SYNC_TOKEN is not set.\n        required: false\n\njobs:\n  sync:\n    name: Run holocron sync\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    permissions:\n      contents: write\n      pull-requests: write\n    # Job-level so the `holocron` composite action's steps inherit them.\n    env:\n      HOLOCRON_ADMIN_TOKEN: ${{ secrets.HOLOCRON_ADMIN_TOKEN }}\n      HOLOCRON_AXIOM_TOKEN: ${{ secrets.HOLOCRON_AXIOM_TOKEN || secrets.AXIOM_TOKEN }}\n      HOLOCRON_AXIOM_DATASET: ${{ vars.HOLOCRON_AXIOM_DATASET || vars.AXIOM_DATASET }}\n      POSTHOG_PROJECT_TOKEN: ${{ vars.POSTHOG_PROJECT_TOKEN }}\n      HOLOCRON_DEPLOY_TOKEN: ${{ secrets.HOLOCRON_DEPLOY_TOKEN }}\n      HOLOCRON_ISSUES_TOKEN: ${{ secrets.HOLOCRON_ISSUES_TOKEN }}\n      HOLOCRON_ORG_TOKEN: ${{ secrets.HOLOCRON_ORG_TOKEN }}\n      HOLOCRON_READ_TOKEN: ${{ secrets.HOLOCRON_READ_TOKEN }}\n      HOLOCRON_SYNC_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          token: ${{ secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN || github.token }}\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - name: Run holocron sync\n        # The `holocron` action resolves @theholocron/cli from node_modules (or\n        # builds the workspace when it's an unbuilt checkout — the holocron repo\n        # itself). `inputs.steps` is a space-separated list or empty; the\n        # `--steps <list>` arg is omitted when empty.\n        uses: theholocron/.github/.github/actions/holocron@main\n        with:\n          command: sync\n          args: ${{ inputs.steps != '' && format('--steps {0}', inputs.steps) || '' }}\n\n      - name: Format generated files\n        run: |\n          pnpm exec prettier --write README.md docs/src/content/docs/index.mdx 2>/dev/null || true\n          # `holocron sync` writes package.json fields (keywords, description,\n          # homepage) with a plain assignment, which appends new keys at the\n          # end — re-apply the canonical order the lint config enforces.\n          pnpm exec eslint --fix --no-warn-ignored package.json 2>/dev/null || true\n\n      - uses: theholocron/.github/.github/actions/auto-commit@main\n        id: auto-commit\n        name: Commit sync changes\n        with:\n          token: ${{ secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN || github.token }}\n          branch: chore/auto-sync\n          commit-message: \"chore: sync from holocron.config\"\n          commit-options: \"--no-verify\"\n\n      - name: Open PR if changes were committed\n        if: steps.auto-commit.outputs.changes-detected == 'true'\n        run: |\n          gh pr create \\\n            --title \"chore: sync README and repo metadata\" \\\n            --body \"Automated sync triggered by changes to config or package files. Merge to apply.\" \\\n            --base main \\\n            --head chore/auto-sync \\\n          || echo \"PR already open — branch updated.\"\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN || github.token }}\n\n      - name: Broadcast wiki sync if navbar changed\n        if: >-\n          steps.auto-commit.outputs.changes-detected == 'true' &&\n          github.event_name == 'push' &&\n          (inputs.steps == '' || contains(inputs.steps, 'wiki'))\n        run: |\n          if git diff HEAD~1 --name-only | grep -q 'fern/docs.yml'; then\n            gh workflow run sync-dispatch.yml \\\n              --repo theholocron/.github \\\n              --field \"steps=wiki\" \\\n            || echo \"skipping broadcast — insufficient permissions\"\n          fi\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN || github.token }}\n",
-	"platform.commitStandards": "name: Commit Standards\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  commit-standards:\n    name: Run commitlint\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      # No local equivalent (linters.ts: commitlint has no localBin — enforced\n      # only at commit time via the commit-msg hook, and here in CI over the\n      # PR's commit range). Not run through the holocron composite action.\n      #\n      # --config <resolved shared path> (config-resolution workstream, #676)\n      # — falls back to commitlint's own auto-discovery of a local\n      # commitlint.config.ts when the shared package's built dist/ isn't\n      # present, same guard as the commit-msg hook.\n      - name: Run commitlint over the PR range\n        if: github.event_name == 'pull_request'\n        run: |\n          COMMITLINT_CONFIG=\"node_modules/@theholocron/commitlint-config/dist/index.js\"\n          if [ -f \"$COMMITLINT_CONFIG\" ]; then\n            pnpm exec commitlint --config \"$COMMITLINT_CONFIG\" --from \"${{ github.event.pull_request.base.sha }}\" --to \"${{ github.sha }}\"\n          else\n            pnpm exec commitlint --from \"${{ github.event.pull_request.base.sha }}\" --to \"${{ github.sha }}\"\n          fi\n",
-	"platform.repoValidation": "name: Repo Validation\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  adrs:\n    name: Validate ADRs and specs\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Validate ADR and spec frontmatter\n        with:\n          task: platform.repoValidation\n          job: adrs\n\n  registry:\n    name: Validate registry consistency\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Validate registry consistency\n        with:\n          task: platform.repoValidation\n          job: registry\n\n  docs-presence:\n    name: Validate docs presence\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: theholocron/.github/.github/actions/holocron@main\n        name: Validate docs presence for new packages\n        with:\n          task: platform.repoValidation\n          job: docsPresence\n        env:\n          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}\n\n  conclusion:\n    name: Conclusion\n    runs-on: ubuntu-latest\n    if: always()\n    needs: [adrs, registry, docs-presence]\n    steps:\n      - name: Check job statuses\n        run: |\n          if [[ \"$RESULTS\" == *\"failure\"* ]] || [[ \"$RESULTS\" == *\"cancelled\"* ]]; then\n            exit 1\n          fi\n        env:\n          RESULTS: ${{ join(needs.*.result, ',') }}\n",
-	"knowledge.wiki": "name: Wiki\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      fern-version:\n        description: >\n          Fern CLI version to install. Pin this to avoid breaking changes when\n          Fern updates their config schema.\n        type: string\n        required: false\n        default: \"5.114.1\"\n      preview:\n        description: >\n          When true, publishes a preview instead of production.\n          Requires preview-id to be set.\n        type: boolean\n        required: false\n        default: false\n      preview-id:\n        description: >\n          Stable ID for the preview build. Use the PR number (e.g. \"pr-123\")\n          so the same preview URL is reused on every push to the branch.\n        type: string\n        required: false\n        default: \"\"\n      fern-org:\n        description: >\n          DEPRECATED — the preview URL is now read from Fern's own output.\n          Kept as a fallback for building the URL when that parse fails, and so\n          existing callers do not error.\n        type: string\n        required: false\n        default: \"\"\n      base-path:\n        description: >\n          DEPRECATED — see fern-org. Basepath appended to the fallback preview\n          URL (e.g. \"holocron\" for multi-source routing).\n        type: string\n        required: false\n        default: \"\"\n    secrets:\n      HOLOCRON_FERN_TOKEN:\n        required: false\n      FERN_TOKEN:\n        required: false\n\njobs:\n  publish:\n    name: Publish to Fern\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    permissions:\n      contents: read\n      deployments: write\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - name: Install Fern CLI\n        run: npm install -g \"fern-api@$FERN_VERSION\"\n        env:\n          FERN_VERSION: ${{ inputs.fern-version }}\n\n      - name: Publish docs\n        if: ${{ !inputs.preview }}\n        run: fern generate --docs\n        env:\n          FERN_TOKEN: ${{ secrets.HOLOCRON_FERN_TOKEN || secrets.FERN_TOKEN }}\n\n      - name: Preview docs\n        id: preview\n        if: ${{ inputs.preview && inputs.preview-id != '' }}\n        env:\n          FERN_TOKEN: ${{ secrets.HOLOCRON_FERN_TOKEN || secrets.FERN_TOKEN }}\n          PREVIEW_ID: ${{ inputs.preview-id }}\n        run: |\n          out=$(fern generate --docs --preview --id \"$PREVIEW_ID\" 2>&1) || { printf '%s\\n' \"$out\"; exit 1; }\n          printf '%s\\n' \"$out\"\n          # Fern prints \"Published docs to https://<org>-preview-<id>.docs.buildwithfern.com/<path>\"\n          url=$(printf '%s\\n' \"$out\" | grep -oiE 'https://[a-z0-9.-]+\\.docs\\.buildwithfern\\.com[^ )]*' | head -n1)\n          echo \"url=$url\" >> \"$GITHUB_OUTPUT\"\n\n      - name: Report preview URL\n        if: ${{ inputs.preview && inputs.preview-id != '' }}\n        env:\n          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n          CAPTURED_URL: ${{ steps.preview.outputs.url }}\n          FERN_ORG: ${{ inputs.fern-org }}\n          PREVIEW_ID: ${{ inputs.preview-id }}\n          BASE_PATH: ${{ inputs.base-path }}\n        run: |\n          PREVIEW_URL=\"$CAPTURED_URL\"\n          if [ -z \"$PREVIEW_URL\" ] && [ -n \"$FERN_ORG\" ]; then\n            PREVIEW_URL=\"https://${FERN_ORG}-preview-${PREVIEW_ID}.docs.buildwithfern.com${BASE_PATH:+/${BASE_PATH}}\"\n          fi\n          if [ -z \"$PREVIEW_URL\" ]; then\n            echo \"::warning::no preview URL parsed from Fern output and no fern-org fallback — skipping the deployment widget\"\n            exit 0\n          fi\n          PAYLOAD=$(printf '{\"ref\":\"%s\",\"environment\":\"wiki (Preview)\",\"description\":\"Wiki\",\"production_environment\":false,\"auto_merge\":false,\"required_contexts\":[]}' \\\n            \"$GITHUB_HEAD_REF\")\n          DEPLOY_ID=$(printf '%s\\n' \"$PAYLOAD\" | gh api \"repos/${GITHUB_REPOSITORY}/deployments\" \\\n            --method POST --input - | jq -r '.id')\n          gh api \"repos/${GITHUB_REPOSITORY}/deployments/${DEPLOY_ID}/statuses\" \\\n            --method POST --field state=success --field environment_url=\"$PREVIEW_URL\"\n",
-	bookkeeping: "name: Bookkeeping\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      configuration-path:\n        description: Path to the labeler configuration file in the calling repo\n        type: string\n        required: false\n        default: .github/labeler.yml\n\njobs:\n  label:\n    name: Apply Labels\n    permissions:\n      contents: read\n      issues: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          sparse-checkout: ${{ inputs.configuration-path || '.github/labeler.yml' }}\n          sparse-checkout-cone-mode: false\n\n      - uses: github/issue-labeler@c1b0f9f52a63158c4adc09425e858e87b32e9685 # v3.4\n        if: ${{ github.event_name == 'pull_request' && hashFiles(inputs.configuration-path || '.github/labeler.yml') != '' }}\n        # v3.4 bundles Node 20; allow it to run under Actions' current default.\n        env:\n          ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true\n        with:\n          # Fall back to default path when triggered directly (not via workflow_call)\n          # because inputs.* defaults only apply on workflow_call events.\n          configuration-path: ${{ inputs.configuration-path || '.github/labeler.yml' }}\n          include-title: 1\n          include-body: 0\n          sync-labels: 1\n          enable-versioned-regex: 0\n          repo-token: ${{ github.token }}\n",
-	dependencies: "name: Dependencies\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      merge-token:\n        description: >\n          Optional privileged token for auto-merge. Falls back to GITHUB_TOKEN.\n          Required when branch protection enforces required reviews — GITHUB_TOKEN\n          cannot approve its own PRs.\n        required: false\n\njobs:\n  dependabot:\n    name: Update the dependencies\n    permissions:\n      contents: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    if: github.event.pull_request.user.login == 'dependabot[bot]'\n    steps:\n      - uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0\n        name: Fetch Dependabot metadata\n        id: metadata\n\n      - run: gh pr merge --auto --squash \"$PR_URL\"\n        # --squash is intentional: repo protection sets allow_merge_commit: false,\n        # so --merge would fail on any repo using the standard preset.\n        name: Enable auto-merge for Dependabot PRs\n        if: steps.metadata.outputs.update-type == 'version-update:semver-patch'\n        env:\n          PR_URL: ${{ github.event.pull_request.html_url }}\n          GH_TOKEN: ${{ secrets.merge-token || github.token }}\n",
-	preview: "name: Preview\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      type:\n        description: \"Type of deployment: docs or storybook\"\n        required: true\n        type: string\n      name:\n        description: Repo name prefix used to filter the docs site package (<name>-site); omit to run pnpm -C docs build\n        required: false\n        type: string\n        default: \"\"\n      storybook-projects:\n        description: >\n          JSON array of { \"name\"?, \"workingDir\", \"outputDir\"? } objects for storybook deploys.\n          Each is built via `pnpm -C <workingDir> build:storybook`. If \"name\" is provided the\n          output is placed under `sandbox/<name>/`; omit \"name\" for single-repo deploys and the\n          output lands directly in `sandbox/`.\n        type: string\n        required: false\n        default: \"[]\"\n      build-script:\n        description: pnpm script that builds the Storybook static output (single storybook, type:storybook only)\n        type: string\n        required: false\n        default: build:storybook\n      output-dir:\n        description: Directory where Storybook writes its static output (single storybook, type:storybook only)\n        type: string\n        required: false\n        default: storybook-static\n      cloudflare-project:\n        description: >\n          Cloudflare Pages project name. Falls back to the CLOUDFLARE_PAGES_PROJECT\n          org variable when omitted — set that variable once and all repos get previews\n          without per-repo config.\n        required: false\n        type: string\n        default: \"\"\n\njobs:\n  deploy-preview:\n    name: Preview\n    if: ${{ github.event.action != 'closed' }}\n    runs-on: ubuntu-latest\n    permissions:\n      contents: read\n      deployments: write\n      pull-requests: write\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - name: Build workspace dependencies\n        # The docs site imports workspace packages (e.g. a shared theme) via\n        # `workspace:*` — its exports map points at dist/, which doesn't\n        # exist until something builds it. Nothing else in this job does,\n        # so without this step Vite fails to resolve the import entirely.\n        if: ${{ inputs.type == 'docs' }}\n        run: pnpm run build\n\n      - name: Build docs site\n        if: ${{ inputs.type == 'docs' && inputs.name != '' }}\n        env:\n          SITE_NAME: ${{ inputs.name }}\n        run: pnpm --filter @theholocron/\"$SITE_NAME\"-site build\n\n      - name: Build docs site\n        if: ${{ inputs.type == 'docs' && inputs.name == '' }}\n        run: pnpm -C docs build\n\n      - name: Build Storybook projects\n        if: ${{ inputs.storybook-projects != '[]' }}\n        env:\n          PROJECTS: ${{ inputs.storybook-projects }}\n        run: |\n          echo \"$PROJECTS\" | jq -c '.[]' | while IFS= read -r project; do\n            workingDir=$(echo \"$project\" | jq -r '.workingDir')\n            pnpm -C \"$workingDir\" build:storybook\n          done\n\n      - name: Build Storybook\n        if: ${{ inputs.type == 'storybook' && inputs.storybook-projects == '[]' }}\n        env:\n          BUILD_SCRIPT: ${{ inputs.build-script }}\n        run: pnpm run \"$BUILD_SCRIPT\"\n\n      - name: Assemble site\n        env:\n          DEPLOY_TYPE: ${{ inputs.type }}\n          SITE_NAME: ${{ inputs.name }}\n          PROJECTS: ${{ inputs.storybook-projects }}\n          STORYBOOK_OUTPUT_DIR: ${{ inputs.output-dir }}\n        run: |\n          mkdir -p _site\n          if [ \"$DEPLOY_TYPE\" = \"docs\" ]; then\n            if [ -n \"$SITE_NAME\" ]; then\n              # Site built with base: /<name>/ — nest under _site/<name>/ so asset\n              # paths match (/name/_astro/... → served at /name/_astro/...).\n              mkdir -p \"_site/${SITE_NAME}\"\n              cp -r docs/dist/. \"_site/${SITE_NAME}/\"\n              # Redirect root to the base path so the preview URL lands correctly.\n              printf \"/ /%s/ 301\\n\" \"$SITE_NAME\" > _site/_redirects\n            else\n              cp -r docs/dist/. _site/\n            fi\n          fi\n          if [ \"$PROJECTS\" != \"[]\" ]; then\n            echo \"$PROJECTS\" | jq -c '.[]' | while IFS= read -r project; do\n              name=$(echo \"$project\" | jq -r '.name // \"\"')\n              workingDir=$(echo \"$project\" | jq -r '.workingDir')\n              outputDir=$(echo \"$project\" | jq -r '.outputDir // \"storybook-static\"')\n              if [ -n \"$name\" ]; then\n                target=\"_site/sandbox/${name}\"\n              else\n                target=\"_site/sandbox\"\n              fi\n              mkdir -p \"$target\"\n              cp -r \"${workingDir}/${outputDir}/.\" \"$target/\"\n            done\n          elif [ \"$DEPLOY_TYPE\" = \"storybook\" ]; then\n            mkdir -p _site/sandbox\n            cp -r \"${STORYBOOK_OUTPUT_DIR}/.\" _site/sandbox/\n          fi\n\n      - name: Install Wrangler\n        # The action's install step runs npm/pnpm in the repo root; pnpm fails\n        # because it rejects adding to a workspace root without -w, and npm fails\n        # because package.json contains pnpm catalog: references it cannot parse.\n        # Pre-installing from /tmp (no package.json) lets the action find wrangler\n        # already on PATH and skip its own install entirely.\n        working-directory: /tmp\n        run: npm install -g wrangler@4\n\n      - uses: cloudflare/wrangler-action@ebbaa1584979971c8614a24965b4405ff95890e0 # v4.0.0\n        id: deploy\n        name: Deploy to Cloudflare Pages\n        # Skip when neither the per-repo input nor the org variable is set.\n        if: ${{ inputs.cloudflare-project != '' || vars.CLOUDFLARE_PAGES_PROJECT != '' }}\n        with:\n          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}\n          accountId: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}\n          packageManager: npm\n          command: >-\n            pages deploy _site\n            --project-name ${{ inputs.cloudflare-project || vars.CLOUDFLARE_PAGES_PROJECT }}\n            --branch ${{ github.event.repository.name }}-pr-${{ github.event.pull_request.number }}\n            --commit-dirty=true\n\n      - name: Report preview URL\n        if: ${{ steps.deploy.outputs.pages-deployment-alias-url != '' }}\n        env:\n          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n          ALIAS: ${{ steps.deploy.outputs.pages-deployment-alias-url }}\n          SITE_NAME: ${{ inputs.name }}\n          PROJECT: ${{ inputs.cloudflare-project || vars.CLOUDFLARE_PAGES_PROJECT }}\n        run: |\n          PREVIEW_URL=\"${ALIAS%/}${SITE_NAME:+/${SITE_NAME}}/\"\n          # GITHUB_HEAD_REF is the PR branch name — links the deployment to this PR's sidebar widget.\n          PAYLOAD=$(printf '{\"ref\":\"%s\",\"environment\":\"%s\",\"description\":\"Cloudflare Pages\",\"production_environment\":false,\"auto_merge\":false,\"required_contexts\":[]}' \\\n            \"$GITHUB_HEAD_REF\" \"${PROJECT} (Preview)\")\n          DEPLOY_ID=$(echo \"$PAYLOAD\" | gh api \"repos/${GITHUB_REPOSITORY}/deployments\" \\\n            --method POST --input - | jq -r '.id')\n          gh api \"repos/${GITHUB_REPOSITORY}/deployments/${DEPLOY_ID}/statuses\" \\\n            --method POST --field state=success --field environment_url=\"${PREVIEW_URL}\"\n\n  cleanup:\n    name: Clean up Preview\n    if: ${{ github.event.action == 'closed' }}\n    runs-on: ubuntu-latest\n    permissions:\n      contents: read\n      deployments: write\n      pull-requests: write\n    steps:\n      - name: Delete Cloudflare Pages deployments for branch\n        if: ${{ inputs.cloudflare-project != '' || vars.CLOUDFLARE_PAGES_PROJECT != '' }}\n        env:\n          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}\n          CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}\n          PROJECT: ${{ inputs.cloudflare-project || vars.CLOUDFLARE_PAGES_PROJECT }}\n          BRANCH: ${{ github.event.repository.name }}-pr-${{ github.event.pull_request.number }}\n          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n        run: |\n          DEPLOYMENTS=$(curl -s \\\n            \"https://api.cloudflare.com/client/v4/accounts/${CLOUDFLARE_ACCOUNT_ID}/pages/projects/${PROJECT}/deployments\" \\\n            -H \"Authorization: Bearer ${CLOUDFLARE_API_TOKEN}\" \\\n            | jq -r --arg b \"$BRANCH\" \\\n              '.result[] | select(.deployment_trigger.metadata.branch == $b) | .id')\n\n          if [ -z \"$DEPLOYMENTS\" ]; then\n            echo \"No deployments found for branch ${BRANCH} — nothing to clean up.\"\n            exit 0\n          fi\n\n          for id in $DEPLOYMENTS; do\n            echo \"Deleting CF Pages deployment: $id\"\n            curl -s -X DELETE \\\n              \"https://api.cloudflare.com/client/v4/accounts/${CLOUDFLARE_ACCOUNT_ID}/pages/projects/${PROJECT}/deployments/${id}?force=true\" \\\n              -H \"Authorization: Bearer ${CLOUDFLARE_API_TOKEN}\" | jq -r 'if .success then \"  ✓ deleted\" else \"  ✗ \\(.errors[0].message)\" end'\n          done\n\n          # Mark the GitHub Deployment environment as inactive.\n          ENV_NAME=\"${PROJECT} (Preview)\"\n          gh api \"repos/${GITHUB_REPOSITORY}/deployments\" \\\n            | jq -r \".[] | select(.environment == \\\"${ENV_NAME}\\\") | .id\" \\\n            | while read -r deploy_id; do\n                gh api \"repos/${GITHUB_REPOSITORY}/deployments/${deploy_id}/statuses\" \\\n                  --method POST --field state=inactive 2>/dev/null || true\n              done\n",
-	greetings: "name: Greetings\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n\njobs:\n  greeting:\n    name: Greet first-time contributors\n    permissions:\n      issues: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    # Group by the issue/PR number so duplicate events don't race each other.\n    steps:\n      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n        name: Greet on first contribution\n        with:\n          script: |\n            // Only greet on the initial open — ignore synchronize, reopened, etc.\n            if (context.payload.action !== 'opened') return;\n\n            const actor = context.actor;\n            const { owner, repo } = context.repo;\n\n            // Payload inspection is more reliable than context.eventName for detecting\n            // whether this is an issue vs. PR event — works regardless of how GitHub\n            // propagates event names through workflow_call chains.\n            const isIssue = !!context.payload.issue && !context.payload.pull_request;\n            // listForRepo returns both issues and PRs (GitHub treats PRs as issues),\n            // sorted newest-first. Filter by type to track first-issue and first-PR\n            // independently, and avoid search-index eventual-consistency lag.\n            const { data: recent } = await github.rest.issues.listForRepo({\n              owner, repo,\n              creator: actor,\n              state: 'all',\n              per_page: 100\n            });\n\n            const sameType = recent.filter(item =>\n              isIssue ? !item.pull_request : !!item.pull_request\n            );\n\n            if (sameType.length !== 1) return;\n            const body = isIssue\n              ? `Hey @${actor}!\\n\\nWe really appreciate you taking the time to report an issue. The collaborators on this project attempt to help as many people as possible, but we are a limited number of volunteers, so it is possible that this will not be addressed as swiftly.\\n\\nYour patience is much appreciated and we will get back to you as quickly as possible.`\n              : `Hey @${actor}!\\n\\nWe really appreciate you taking the time to help out with this PR. The collaborators on this project attempt to help as many people as possible, but we are a limited number of volunteers, so it is possible that this will not be addressed as swiftly.\\n\\nYour patience is much appreciated and we will get back to you as quickly as possible.`;\n\n            await github.rest.issues.createComment({\n              owner,\n              repo,\n              issue_number: context.issue.number,\n              body\n            });\n",
-	review: "name: Review\n\n# ReviewDog is the annotation layer — posts inline PR diff annotations.\n# Runs on pull_request only: inline annotations require PR context,\n# and branch protection ensures all changes go through PRs anyway.\n# security.secretDetection.yml / sourceQuality.structuredDataValidation.yml\n# are the CI gates covering push + PR events. Gitleaks and YAML are\n# intentionally duplicated: those gate merges; ReviewDog surfaces exact\n# line annotations in the PR diff.\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n\njobs:\n  reviewdog:\n    name: Post inline lint annotations\n    runs-on: ubuntu-latest\n    timeout-minutes: 20\n    permissions:\n      contents: read\n      pull-requests: write\n\n    steps:\n      - name: Checkout repository\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          fetch-depth: 0\n\n      - name: Setup\n        if: ${{ hashFiles('pnpm-lock.yaml') != '' }}\n        uses: theholocron/.github/.github/actions/setup@main\n\n      - name: Install ReviewDog\n        uses: reviewdog/action-setup@d8a7baabd7f3e8544ee4dbde3ee41d0011c3a93f # v1\n        with:\n          reviewdog_version: latest\n\n      # Detect which tools are relevant for this repo, excluding node_modules.\n      # hashFiles('**/*') recurses into node_modules/.pnpm and produces false\n      # positives for repos that don't own those file types.\n      # -print -quit stops find after the first match without a pipe, avoiding\n      # the SIGPIPE/pipefail exit-141 that find|head-1 triggers under\n      # GitHub Actions' default bash --noprofile --norc -e -o pipefail mode.\n      - name: Detect project features\n        id: detect\n        shell: bash\n        run: |\n          has() { find . -not -path '*/node_modules/*' -name \"$1\" -print -quit 2>/dev/null | grep -q .; }\n          has_ext() { find . -not -path '*/node_modules/*' -name \"$1\" -print -quit 2>/dev/null | grep -q .; }\n          { { has 'eslint.config.js' || has 'eslint.config.mjs' || has 'eslint.config.cjs' || \\\n              has 'eslint.config.ts' || has '.eslintrc' || has '.eslintrc.js' || \\\n              has '.eslintrc.cjs' || has '.eslintrc.json' || has '.eslintrc.yaml' || \\\n              has '.eslintrc.yml'; } && grep -qF '\"eslint\":' package.json 2>/dev/null; } && echo \"eslint=true\" >> \"$GITHUB_OUTPUT\" || echo \"eslint=false\" >> \"$GITHUB_OUTPUT\"\n          { has 'tsconfig.json' && grep -qF '\"typescript\":' package.json 2>/dev/null; } && echo \"tsconfig=true\" >> \"$GITHUB_OUTPUT\" || echo \"tsconfig=false\" >> \"$GITHUB_OUTPUT\"\n          has_ext '*.sh' && echo \"shell=true\" >> \"$GITHUB_OUTPUT\" || echo \"shell=false\" >> \"$GITHUB_OUTPUT\"\n          has 'Dockerfile' || has_ext '*.Dockerfile' || has 'Containerfile' && \\\n            echo \"docker=true\" >> \"$GITHUB_OUTPUT\" || echo \"docker=false\" >> \"$GITHUB_OUTPUT\"\n          has_ext '.env*' && echo \"dotenv=true\" >> \"$GITHUB_OUTPUT\" || echo \"dotenv=false\" >> \"$GITHUB_OUTPUT\"\n          has_ext '*.md' && echo \"markdown=true\" >> \"$GITHUB_OUTPUT\" || echo \"markdown=false\" >> \"$GITHUB_OUTPUT\"\n\n      #\n      # Always applicable\n      #\n\n      - name: Gitleaks (secrets)\n        uses: reviewdog/action-gitleaks@2b7b5685e3e3eecddab5d30cfa04f18123031421 # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / gitleaks\"\n          fail_level: error\n          gitleaks_flags: --log-opts=${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }}\n\n      - name: YamlLint\n        if: ${{ hashFiles('.yamllint.yml') != '' }}\n        uses: reviewdog/action-yamllint@b5f7217d8c815ae374d1d55840d5e569d82f01f0 # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / yamllint\"\n          fail_level: error\n          yamllint_flags: -c ${{ github.workspace }}/.yamllint.yml ${{ github.workspace }}\n\n      - name: ActionLint (GitHub Actions)\n        if: ${{ hashFiles('.github/workflows/*.yml', '.github/workflows/*.yaml') != '' }}\n        uses: reviewdog/action-actionlint@6fb7acc99f4a1008869fa8a0f09cfca740837d9d # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / actionlint\"\n          fail_level: error\n\n      #\n      # TypeScript / JavaScript\n      #\n\n      - name: ESLint\n        if: steps.detect.outputs.eslint == 'true'\n        uses: reviewdog/action-eslint@556a3fdaf8b4201d4d74d406013386aa4f7dab96 # v1.34.0\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / eslint\"\n          fail_level: error\n          eslint_flags: .\n\n      - name: TypeScript\n        if: steps.detect.outputs.tsconfig == 'true'\n        uses: EPMatt/reviewdog-action-tsc@63d923a3c5b4497671940b8874f58a404e2351b5 # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / tsc\"\n          fail_level: error\n\n      #\n      # Shell\n      #\n\n      - name: ShellCheck\n        if: steps.detect.outputs.shell == 'true'\n        uses: reviewdog/action-shellcheck@4c07458293ac342d477251099501a718ae5ef86e # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / shellcheck\"\n          fail_level: none\n\n      #\n      # Docker\n      #\n\n      - name: Hadolint\n        if: steps.detect.outputs.docker == 'true'\n        uses: reviewdog/action-hadolint@1b2cfa6ba72072ad35158d7ff3aa49bbdc03506d # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / hadolint\"\n          fail_level: none\n\n      #\n      # Environment files\n      #\n\n      - name: dotenv-linter\n        if: steps.detect.outputs.dotenv == 'true'\n        uses: dotenv-linter/action-dotenv-linter@afde61cfda2ecffe7bea35837b6f20b956c88689 # v3.0.0\n        with:\n          reporter: github-code-suggestions\n\n      #\n      # Documentation\n      #\n\n      - name: Alex (inclusive language)\n        if: steps.detect.outputs.markdown == 'true'\n        uses: reviewdog/action-alex@347481655add010a2ae302df34b57c9bcfa0d6e4 # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / alex\"\n",
-	stale: "name: Stale\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      days-before-stale:\n        description: Days of inactivity before an issue or PR is marked stale (applies to both unless type-specific value is set)\n        type: number\n        required: false\n        default: 30\n      days-before-close:\n        description: Days after stale label before closing (applies to both unless type-specific value is set)\n        type: number\n        required: false\n        default: 5\n      days-before-issue-stale:\n        description: Days of inactivity before an issue is marked stale; overrides days-before-stale when set to a non-negative value\n        type: number\n        required: false\n        default: -1\n      days-before-issue-close:\n        description: Days after stale label before closing an issue; overrides days-before-close when set to a non-negative value\n        type: number\n        required: false\n        default: -1\n      days-before-pr-stale:\n        description: Days of inactivity before a PR is marked stale; overrides days-before-stale when set to a non-negative value\n        type: number\n        required: false\n        default: -1\n      days-before-pr-close:\n        description: Days after stale label before closing a PR; overrides days-before-close when set to a non-negative value\n        type: number\n        required: false\n        default: -1\n      exempt-issue-labels:\n        description: Comma-separated labels that exempt an issue from being marked stale\n        type: string\n        required: false\n        default: \"in-progress,wip\"\n      exempt-pr-labels:\n        description: Comma-separated labels that exempt a PR from being marked stale\n        type: string\n        required: false\n        default: \"\"\n      exempt-all-issue-milestones:\n        description: Issues assigned to any milestone are never marked stale\n        type: boolean\n        required: false\n        default: true\n      exempt-all-pr-milestones:\n        description: PRs assigned to any milestone are never marked stale\n        type: boolean\n        required: false\n        default: true\n      exempt-all-issue-projects:\n        description: Issues assigned to any project are never marked stale\n        type: boolean\n        required: false\n        default: true\n      exempt-all-pr-projects:\n        description: PRs assigned to any project are never marked stale\n        type: boolean\n        required: false\n        default: true\n\njobs:\n  stale:\n    name: Mark stale issues and pull requests\n    permissions:\n      contents: write\n      issues: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    steps:\n      - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0\n        name: Run Stale\n        with:\n          close-issue-message: >\n            This issue was closed because it has been stalled for\n            ${{ inputs.days-before-close }} days with no activity.\n          days-before-close: ${{ inputs.days-before-close }}\n          days-before-issue-close: ${{ inputs.days-before-issue-close }}\n          days-before-issue-stale: ${{ inputs.days-before-issue-stale }}\n          days-before-pr-close: ${{ inputs.days-before-pr-close }}\n          days-before-pr-stale: ${{ inputs.days-before-pr-stale }}\n          days-before-stale: ${{ inputs.days-before-stale }}\n          exempt-all-issue-milestones: ${{ inputs.exempt-all-issue-milestones }}\n          exempt-all-issue-projects: ${{ inputs.exempt-all-issue-projects }}\n          exempt-all-pr-milestones: ${{ inputs.exempt-all-pr-milestones }}\n          exempt-all-pr-projects: ${{ inputs.exempt-all-pr-projects }}\n          exempt-issue-labels: ${{ inputs.exempt-issue-labels }}\n          exempt-pr-labels: ${{ inputs.exempt-pr-labels }}\n          stale-issue-label: wontfix\n          stale-issue-message: >\n            This issue is stale because it has been open ${{ inputs.days-before-stale }}\n            days with no activity. Remove the stale label or comment, or this will be\n            closed in ${{ inputs.days-before-close }} days.\n          stale-pr-label: wontfix\n          stale-pr-message: >\n            This PR is stale because it has been open ${{ inputs.days-before-stale }}\n            days with no activity. Remove the stale label or comment, or this will be\n            closed in ${{ inputs.days-before-close }} days.\n",
-	"sync-dispatch": "name: Sync Dispatch\n\non: # yamllint disable-line rule:truthy\n  workflow_dispatch:\n    inputs:\n      steps:\n        description: >\n          Sync steps to pass to each repo's sync.yml. Default is \"readme\"\n          (only README marker blocks are updated).\n        type: string\n        required: false\n        default: readme\n\npermissions:\n  contents: read\n\njobs:\n  broadcast:\n    name: Broadcast sync to all repos\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    steps:\n      - name: Dispatch sync to all repos with sync.yml\n        run: |\n          gh api /orgs/theholocron/repos --paginate --jq '.[].name' \\\n            | while IFS= read -r repo; do\n              gh api \"/repos/theholocron/$repo/contents/.github/workflows/sync.yml\" --silent 2>/dev/null || continue\n              echo \"Dispatching sync to theholocron/$repo\"\n              gh workflow run sync.yml \\\n                --repo \"theholocron/$repo\" \\\n                --field \"steps=$STEPS\" \\\n              || echo \"Warning: could not dispatch to theholocron/$repo — skipping\"\n            done\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN }}\n          STEPS: ${{ inputs.steps }}\n",
-	tag: "name: Tag\n\n# Release Please — fully automated tag and GitHub Release from Conventional Commits.\n# No package.json or npm publishing required. Operates in \"simple\" mode by default:\n# analyzes commits since the last tag, maintains a rolling Release PR, and creates\n# a tag + GitHub Release when that PR is merged.\n#\n# The calling repo must have two files at the root:\n#   release-please-config.json    — declares packages and release-type\n#   .release-please-manifest.json — tracks the current version\n\non: # yamllint disable-line rule:truthy\n  # Self-trigger: when this workflow lives in theholocron/.github itself,\n  # push to main runs Release Please for that repo's own releases.\n  push:\n    branches:\n      - main\n  workflow_call:\n    inputs:\n      release-type:\n        description: Release Please release type (simple, node, python, etc.)\n        type: string\n        required: false\n        default: simple\n      config-file:\n        description: Path to release-please-config.json\n        type: string\n        required: false\n        default: release-please-config.json\n      manifest-file:\n        description: Path to .release-please-manifest.json\n        type: string\n        required: false\n        default: .release-please-manifest.json\n\njobs:\n  tag:\n    name: Tag release\n    permissions:\n      contents: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    steps:\n      - uses: google-github-actions/release-please-action@e4dc86ba9405554aeba3c6bb2d169500e7d3b4ee # v4.1.1\n        name: Run Release Please\n        with:\n          release-type: ${{ inputs.release-type }}\n          config-file: ${{ inputs.config-file }}\n          manifest-file: ${{ inputs.manifest-file }}\n",
-	"sync-github": "name: Sync workflow templates\n\n# Builds the holocron CLI from source and pushes updated workflow templates\n# and composite actions to downstream .github repos. Runs whenever the\n# template source files change on main or alpha.\n#\n# Secrets required:\n#   HOLOCRON_SYNC_TOKEN — fine-grained PAT (resource owner: org) with:\n#                  Actions:       Read and write  (dispatch workflow runs via gh workflow run)\n#                  Contents:      Read and write  (git trees, blobs, refs)\n#                  Pull requests: Read and write  (open sync PR)\n#                  Workflows:     Read and write  (write .github/workflows/*.yml)\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      primary-repo:\n        description: >\n          Primary .github repo — receives composite actions, reusable workflows,\n          and thin-caller templates. Requires a PR (branch protection assumed).\n        type: string\n        required: false\n        default: theholocron/.github\n      secondary-repos:\n        description: >\n          Space-separated list of secondary repos (reusable workflows + thin\n          callers only, no composite actions). Changes are delivered via pull\n          request, same as the primary repo.\n        type: string\n        required: false\n        default: \"\"\n      sync-branch:\n        description: Branch name used for the primary and secondary repo PRs\n        type: string\n        required: false\n        default: chore/sync-templates\n    secrets:\n      HOLOCRON_SYNC_TOKEN:\n        required: true\n      HOLOCRON_READ_TOKEN:\n        description: >\n          Fine-grained PAT for read-only GitHub API calls (e.g. resolving git\n          committer identity via `gh api user`). Falls back to HOLOCRON_SYNC_TOKEN.\n        required: false\n      GH_TOKEN:\n        description: >\n          Generic GitHub token fallback for `gh` CLI calls. Used when neither\n          HOLOCRON_READ_TOKEN nor HOLOCRON_SYNC_TOKEN is set.\n        required: false\n      HOLOCRON_AXIOM_TOKEN:\n        description: >\n          Axiom API token. When set alongside the HOLOCRON_AXIOM_DATASET\n          repo/org variable, the CLI ships this run's structured logs to Axiom.\n          Falls back to the vendor-native AXIOM_TOKEN secret.\n        required: false\n      AXIOM_TOKEN:\n        description: Vendor-native fallback for HOLOCRON_AXIOM_TOKEN.\n        required: false\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  sync:\n    name: Sync templates\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    permissions:\n      contents: read\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n      HOLOCRON_AXIOM_TOKEN: ${{ secrets.HOLOCRON_AXIOM_TOKEN || secrets.AXIOM_TOKEN }}\n      HOLOCRON_AXIOM_DATASET: ${{ vars.HOLOCRON_AXIOM_DATASET || vars.AXIOM_DATASET }}\n      POSTHOG_PROJECT_TOKEN: ${{ vars.POSTHOG_PROJECT_TOKEN }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: pnpm build\n        name: Build CLI\n\n      - name: Cache actionlint\n        id: cache-actionlint\n        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0\n        with:\n          path: /tmp/actionlint\n          key: actionlint-v1.7.7-linux-amd64\n\n      - name: Download actionlint\n        if: steps.cache-actionlint.outputs.cache-hit != 'true'\n        run: |\n          curl -fsSL https://github.com/rhysd/actionlint/releases/download/v1.7.7/actionlint_1.7.7_linux_amd64.tar.gz \\\n            | tar -xz -C /tmp actionlint\n\n      - name: Validate generated workflows\n        run: |\n          node packages/cli/dist/cli.mjs sync-github \\\n            --repo \"$PRIMARY_REPO\" \\\n            --output-dir /tmp/sync-validate\n          /tmp/actionlint /tmp/sync-validate/.github/workflows/*.yml\n        env:\n          PRIMARY_REPO: ${{ inputs.primary-repo }}\n\n      - name: Sync primary repo (PR)\n        run: |\n          GIT_NAME=$(gh api user --jq .name 2>/dev/null || echo \"github-actions[bot]\")\n          GIT_EMAIL=$(gh api user --jq '\"\\(.id)+\\(.login)@users.noreply.github.com\"' 2>/dev/null || echo \"41898282+github-actions[bot]@users.noreply.github.com\")\n          COMMIT_MSG=\"chore: sync from theholocron/holocron\"$'\\n\\n'\"Signed-off-by: $GIT_NAME <$GIT_EMAIL>\"\n          node packages/cli/dist/cli.mjs sync-github \\\n            --repo \"$PRIMARY_REPO\" \\\n            --branch \"$SYNC_BRANCH\" \\\n            --pr \\\n            --message \"$COMMIT_MSG\"\n          GH_TOKEN=\"$HOLOCRON_SYNC_TOKEN\" gh pr merge --auto --squash \\\n            --repo \"$PRIMARY_REPO\" \"$SYNC_BRANCH\" 2>/dev/null || true\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_READ_TOKEN || secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN }}\n          HOLOCRON_SYNC_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN }}\n          PRIMARY_REPO: ${{ inputs.primary-repo }}\n          SYNC_BRANCH: ${{ inputs.sync-branch }}\n\n      - name: Sync secondary repos (PR)\n        if: ${{ inputs.secondary-repos != '' }}\n        run: |\n          GIT_NAME=$(gh api user --jq .name 2>/dev/null || echo \"github-actions[bot]\")\n          GIT_EMAIL=$(gh api user --jq '\"\\(.id)+\\(.login)@users.noreply.github.com\"' 2>/dev/null || echo \"41898282+github-actions[bot]@users.noreply.github.com\")\n          COMMIT_MSG=\"chore: sync from theholocron/holocron\"$'\\n\\n'\"Signed-off-by: $GIT_NAME <$GIT_EMAIL>\"\n          for repo in $SECONDARY_REPOS; do\n            node packages/cli/dist/cli.mjs sync-github \\\n              --repo \"$repo\" \\\n              --branch \"$SYNC_BRANCH\" \\\n              --pr \\\n              --message \"$COMMIT_MSG\"\n            GH_TOKEN=\"$HOLOCRON_SYNC_TOKEN\" gh pr merge --auto --squash \\\n              --repo \"$repo\" \"$SYNC_BRANCH\" 2>/dev/null || true\n          done\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_READ_TOKEN || secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN }}\n          HOLOCRON_SYNC_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN }}\n          SECONDARY_REPOS: ${{ inputs.secondary-repos }}\n          SYNC_BRANCH: ${{ inputs.sync-branch }}\n"
-};
-/** Composite actions → `.github/actions/<name>/action.yml` (key includes `/action`). */
-const REUSABLE_ACTIONS = {
-	"auto-commit/action": auto_commit_default,
-	"holocron/action": holocron_default,
-	"install/action": install_default,
-	"setup/action": setup_default,
-	"setup-node/action": setup_node_default
-};
-/** GitHub starter-workflow metadata → `workflow-templates/<name>.properties.json`. */
-const WORKFLOW_TEMPLATE_PROPERTIES = { bookkeeping: JSON.stringify({
-	name: "Bookkeeping",
-	description: "Label and track issues and pull requests.",
-	iconName: "octicon tag"
-}, null, 2) };
-const SOURCE = "packages/astromech/src/reusable.ts";
+function deployTargets(packages, manifests) {
+	return packages.flatMap((pkg) => (manifests.get(pkg.dir)?.tasks ?? []).flatMap((item) => {
+		const entry = normalizeTaskEntry(item);
+		if (entry.name !== "delivery.deploy" || entry.with?.["on"] !== "release") return [];
+		const { channel, paths } = entry.with;
+		return [{
+			pkg,
+			channel: typeof channel === "string" ? channel : MAIN_CHANNEL,
+			paths: Array.isArray(paths) ? paths.map(String) : void 0
+		}];
+	}));
+}
+//#endregion
+//#region src/tasks/deploy-on-release/should-deploy/should-deploy.ts
 /**
-* "AUTO-GENERATED — do not edit" header for the YAML pushed to
-* `theholocron/.github`. Matches `createHeader().workflowHeader({ forPrimary: true })`
-* field-for-field, minus any timestamp — a live `Synced:` line makes the content
-* hash change on every run and defeats `sync-github`'s unchanged-file skip.
+* @param channel The release's channel: its prerelease identifier (`alpha`), or `main` for a stable release.
+* @param changedFiles `undefined` when there's no previous release to diff against.
 */
-function reusableHeader() {
-	return [
-		`# AUTO-GENERATED — do not edit in theholocron/.github directly.`,
-		`# Source:  theholocron/holocron · ${SOURCE}`,
-		`# Tool:    holocron sync-github`,
-		`# Changes: edit source in theholocron/holocron`,
-		``
-	].join("\n");
+function shouldDeploy({ channel, configuredChannel, changedFiles, paths }) {
+	if (channel !== configuredChannel) return {
+		deploy: false,
+		reason: `channel "${channel}" isn't "${configuredChannel}"`
+	};
+	if (changedFiles === void 0) return {
+		deploy: true,
+		reason: "no previous release to diff against"
+	};
+	const touched = changedFiles.find((file) => paths.some((path) => file.startsWith(path)));
+	return touched ? {
+		deploy: true,
+		reason: `the release changes ${touched}`
+	} : {
+		deploy: false,
+		reason: `the release changes nothing under ${paths.join(", ")}`
+	};
 }
+//#endregion
+//#region src/tasks/deploy-on-release/wait-for-published/wait-for-published.ts
 /**
-* The complete file batch `holocron sync-github` pushes to `theholocron/.github`:
-* path → content. YAML gets the "do not edit" header; the starter-workflow
-* `.properties.json` files are left bare (native JSON, not a commented file).
+* Waits until npm serves every `name@version` in `packages`, asking with
+* `npm view --prefer-online` (so npm's local cache can't answer for the
+* registry) every `intervalMs`, for up to `timeoutMs`.
+*
+* @returns The specs npm still doesn't serve; empty once all are available.
 */
-function reusableTemplates() {
-	const out = /* @__PURE__ */ new Map();
-	const header = reusableHeader();
-	for (const [name, body] of Object.entries(REUSABLE_ACTIONS)) out.set(`.github/actions/${name}.yml`, `${header}${body}`);
-	for (const [name, body] of Object.entries(REUSABLE_WORKFLOWS)) out.set(`.github/workflows/${name}.yml`, `${header}${body}`);
-	for (const [name, body] of Object.entries(WORKFLOW_TEMPLATES)) {
-		out.set(`workflow-templates/${name}.yml`, `${header}${body}`);
-		const props = WORKFLOW_TEMPLATE_PROPERTIES[name];
-		if (props) out.set(`workflow-templates/${name}.properties.json`, props);
+async function waitForPublished({ packages, run, sleep, now, cwd, timeoutMs = WAIT_TIMEOUT_MS, intervalMs = WAIT_INTERVAL_MS }) {
+	const deadline = now() + timeoutMs;
+	let pending = packages.map(({ name, version }) => `${name}@${version}`);
+	for (;;) {
+		pending = pending.filter((spec) => {
+			const version = spec.slice(spec.lastIndexOf("@") + 1);
+			const result = run("npm", [
+				"view",
+				spec,
+				"version",
+				"--prefer-online"
+			], { cwd });
+			return !(result.status === 0 && result.stdout.trim() === version);
+		});
+		if (pending.length === 0 || now() + intervalMs > deadline) return pending;
+		await sleep(intervalMs);
 	}
-	return out;
 }
 //#endregion
-//#region src/turbo.ts
+//#region src/tasks/deploy-on-release/workspace-packages/workspace-packages.ts
 /**
-* `turboConfig(config)` — the generated `turbo.json` for a repo's task
-* manifest, epic #672 D9 (#681). Every workspace, monorepo or single-package
-* (Turborepo's single-package mode), gets this from the same `tasks` array
-* that already drives thin callers / required checks / package scripts —
-* never hand-authored.
+* Every package under `<repoRoot>/packages/*`, `<repoRoot>/apps/*` and
+* `<repoRoot>/plugins/*` with a readable, named `package.json` — `holocron`'s
+* own layout splits vendor plugin packages into `plugins/*` and deployable
+* apps into `apps/*`, siblings to `packages/*`.
+*/
+function workspacePackages(repoRoot, { readJson, listDirs }) {
+	return listWorkspacePackagesSync(repoRoot, {
+		roots: [
+			"packages",
+			"apps",
+			"plugins"
+		],
+		readFile: (path) => JSON.stringify(readJson(path)),
+		listDirs: (path) => {
+			try {
+				return listDirs(path);
+			} catch {
+				throw Object.assign(/* @__PURE__ */ new Error(`ENOENT: ${path}`), { code: "ENOENT" });
+			}
+		}
+	}).flatMap(({ name, dir, manifest }) => name ? [{
+		name,
+		dir,
+		version: manifest.version,
+		dependencies: manifest.dependencies ?? {},
+		devDependencies: manifest.devDependencies ?? {}
+	}] : []);
+}
+//#endregion
+//#region src/tasks/deploy-on-release/deploy-on-release.ts
+/**
+* Deploy workspace packages once a release has published (holocron#930).
 *
-* Only tasks with a {@link TurboTaskConfig} in the registry (real per-
-* workspace build/compile/test steps) get an entry. Whole-repo, single-run
-* tools (prettier, gitleaks, commitlint, yamllint, …) have none — they stay
-* off turbo.json entirely, same as today.
+* A package opts in with a `delivery.deploy` task in its own `holocron.config`
+* whose `with.on` is `"release"`:
 *
-* A task entry's own `turbo.passThroughEnv` (schema.ts) appends extra env
-* vars to the registry default's cache-key hashing — the one thing that's
-* genuinely per-repo (e.g. a package tagging Sentry releases during its own
-* build needs `SENTRY_AUTH_TOKEN` in its cache key; most repos don't).
+* ```ts
+* // packages/<app>/holocron.config.ts
+* tasks: [{ name: "delivery.deploy", with: { on: "release", channel: "alpha" } }];
+* ```
+*
+* `channel` defaults to `main` (a stable release); set a prerelease identifier
+* such as `alpha` to deploy those releases instead.
+*
+* The shared `delivery.publish` workflow runs this (`holocron deploy on-release`)
+* as its own `deploy` job after the release job, so a deploy is a separate,
+* re-runnable check rather than a step buried in the release log. Each package
+* with such a task deploys when the release is on its `channel` and changes a file under its paths: the package itself plus its
+* `workspace:*` dependencies ({@link defaultPaths}), or an explicit
+* `with.paths`. It first waits for npm to serve the release's new versions of
+* those dependencies ({@link waitForPublished}) — the registry can lag a version
+* it has just accepted, and the deploy installs them — then runs
+* `pnpm --filter <package> delivery.deploy`.
+*
+* The release is already published by then, so a failed deploy can't undo it;
+* it fails this job instead, loudly and re-runnable on its own. A task is
+* `skip`ped (not failed) only when it doesn't apply to this release.
+*
+* A `delivery.deploy` task with `on: "release"` generates no CI workflow.
 */
-/** Filed once per repo, unconditionally — every generated turbo.json's root. */
-const GLOBAL_DEPENDENCIES = ["pnpm-workspace.yaml", "tsconfig.json"];
 /**
-* `turbo.json` content for this manifest, pretty-printed — write it
-* directly, no merge (matches `thinCallers()` / `reusableTemplates()`: this
-* file is generated, not hand-edited). `null` when no task in the manifest
-* has turbo fan-out config (nothing to write).
+* Deploys every package whose manifest declares a release-time deploy that
+* applies to this release. Never throws for a deploy problem: each package's
+* outcome is in the report, and `status: "fail"` is the caller's exit code.
 */
-function turboConfig(config) {
-	const entries = (config.tasks ?? []).map(normalizeTaskEntry);
-	const tasks = {};
-	for (const entry of entries) {
-		if (entry.local === false) continue;
-		const turbo = TASKS[entry.name]?.turbo;
-		if (!turbo) continue;
-		const extraEnv = entry.turbo?.passThroughEnv;
-		tasks[entry.name] = extraEnv && extraEnv.length > 0 ? {
-			...turbo,
-			passThroughEnv: extraEnv
-		} : turbo;
+async function deployOnRelease(options, { run = defaultRun, readJson = defaultReadJson, listDirs = defaultListDirs, sleep = defaultSleep, now = Date.now, loadTasks = loadTasksConfig } = {}) {
+	const { cwd, from, print } = options;
+	const channel = options.channel || "main";
+	const to = options.to ?? "HEAD";
+	const packages = workspacePackages(cwd, {
+		readJson,
+		listDirs
+	});
+	const manifests = /* @__PURE__ */ new Map();
+	for (const pkg of packages) try {
+		manifests.set(pkg.dir, await loadTasks(pkg.dir));
+	} catch (err) {
+		print(`${pkg.name}: couldn't read its task manifest (${err.message}); not deploying it.`);
 	}
-	if (Object.keys(tasks).length === 0) return null;
-	return `${JSON.stringify({
-		$schema: "https://turborepo.org/schema.json",
-		globalDependencies: GLOBAL_DEPENDENCIES,
-		tasks
-	}, null, 2)}\n`;
+	const targets = deployTargets(packages, manifests);
+	if (targets.length === 0) {
+		print("No package declares a release-time delivery.deploy (with.on: release).");
+		return {
+			status: "skip",
+			results: []
+		};
+	}
+	let diff;
+	const changedFiles = () => {
+		if (diff) return diff;
+		if (!from) return diff = { files: void 0 };
+		const result = run("git", [
+			"diff",
+			"--name-only",
+			from,
+			to
+		], { cwd });
+		return diff = result.status === 0 ? { files: result.stdout.split("\n").filter(Boolean) } : {
+			files: [],
+			error: `git diff ${from} ${to} failed: ${result.stderr || result.status}`
+		};
+	};
+	const results = [];
+	const record = (pkg, status, message) => {
+		results.push({
+			pkg,
+			status,
+			message
+		});
+		print(`${status === "fail" ? "✗ " : ""}${pkg}: ${message}`);
+	};
+	for (const target of targets) {
+		const name = target.pkg.name;
+		const { files, error } = target.channel === channel ? changedFiles() : {
+			files: [],
+			error: void 0
+		};
+		if (error) {
+			record(name, "fail", error);
+			continue;
+		}
+		const decision = shouldDeploy({
+			channel,
+			configuredChannel: target.channel,
+			changedFiles: files,
+			paths: target.paths ?? defaultPaths(cwd, target.pkg, packages)
+		});
+		if (!decision.deploy) {
+			record(name, "skip", `not deploying: ${decision.reason}.`);
+			continue;
+		}
+		if (options.dryRun) {
+			record(name, "dry-run", `would deploy because ${decision.reason}.`);
+			continue;
+		}
+		const dependencies = workspaceDependencies(target.pkg, packages).flatMap(({ name: dep, version }) => version ? [{
+			name: dep,
+			version
+		}] : []);
+		print(`${name}: waiting for npm to serve ${dependencies.map((d) => `${d.name}@${d.version}`).join(", ") || "nothing"}.`);
+		const unpublished = await waitForPublished({
+			packages: dependencies,
+			run,
+			sleep,
+			now,
+			cwd
+		});
+		if (unpublished.length > 0) {
+			record(name, "fail", `npm still doesn't serve ${unpublished.join(", ")} after ${WAIT_TIMEOUT_MS / 6e4} minutes. Re-run this job once it does.`);
+			continue;
+		}
+		print(`${name}: deploying because ${decision.reason}.`);
+		const result = run("pnpm", [
+			"--filter",
+			name,
+			DEPLOY_TASK
+		], {
+			cwd,
+			env: process.env,
+			stdio: "inherit"
+		});
+		if (result.status === 0) record(name, "ok", "deployed.");
+		else record(name, "fail", `the deploy failed (exit ${result.status}).`);
+	}
+	return {
+		status: results.some((r) => r.status === "fail") ? "fail" : results.every((r) => r.status === "skip") ? "skip" : "ok",
+		results
+	};
 }
+//#endregion
+//#region src/tasks/match-namespace/match-namespace.ts
+/** Every configured task whose name starts with `"<namespace>."`, in manifest declaration order. */
+function matchNamespace(config, namespace) {
+	const prefix = `${namespace}.`;
+	return (config.tasks ?? []).map(normalizeTaskEntry).reduce((names, entry) => {
+		if (entry.name.startsWith(prefix) && !names.includes(entry.name)) names.push(entry.name);
+		return names;
+	}, []);
+}
+//#endregion
+//#region src/tasks/group/group.ts
 /**
-* Fixes #692: `turboConfig()` writes a `turbo.json` the moment *any* task in
-* the manifest has fan-out config — with no check for whether the repo's own
-* root package is actually covered by `pnpm-workspace.yaml`'s `packages:`
-* list. A repo shaped like `observability` (the library lives at repo root;
-* `packages:` lists only an unrelated `docs` site) silently breaks the
-* instant `turbo.json` exists: `holocron run <task>` switches from running
-* root's own script directly to `turbo run <task>`, which only sees declared
-* workspace members — root vanishes, the task "succeeds" with zero real work
-* done (confirmed empirically: `Packages in scope: docs`, root never
-* mentioned, exit 0).
-*
-* Detection is narrow and specific: root only needs to be an explicit
-* workspace member if its *own* `package.json` has a script literally named
-* after one of the tasks turbo.json is about to fan out — a plain
-* orchestrator root (`holocron`'s own `"build": "turbo run delivery.build"`,
-* which has no `delivery.build` script itself) never trips this; only a root
-* that's genuinely a directly-buildable package does. Confirmed the fix
-* empirically too — adding `.` to `packages:` makes turbo pick root back up
-* (`Packages in scope: docs, root-lib`) without disturbing the sibling
-* package's own caching.
+* `holocron run <namespace>` — run every configured task under one
+* namespace prefix (`sourceQuality.*`, `verification.*`, …) in sequence.
+* `Astromech.run()` falls back here whenever the given name isn't an exact
+* `TASKS` entry but matches the prefix of one or more configured tasks —
+* same "aggregate several real tasks into one report" shape `runCi` already
+* established, scoped to one namespace instead of the merge-gating set.
 *
-* A targeted line-based edit, not a full YAML parse/reserialize — same
-* pattern `codecov.ts`'s `mergeCodecovComponents()` already uses for editing
-* an existing generated file. `pnpm-workspace.yaml` routinely carries a
-* `catalog:`/`catalogs:`/`overrides:` block after `packages:`; a real parser
-* round-trip risks reformatting or reordering content nobody asked to touch.
-* Only ever *adds* a line — never rewrites or reorders anything already
-* there — and is a no-op (`changed: false`) whenever root doesn't need it,
-* root is already listed, or `packages:` isn't in the plain block-list form
-* every repo checked actually uses.
+* Every task in the namespace always runs — one task's failure never skips
+* the rest, same as `runCi`'s own loop — so a single invocation surfaces
+* every problem in the namespace at once instead of stopping at the first.
 */
-function ensureRootWorkspaceMember(workspaceYaml, rootScripts, taskNames) {
-	if (!taskNames.some((t) => rootScripts.includes(t))) return {
-		content: workspaceYaml,
-		changed: false
-	};
-	const lines = workspaceYaml.split("\n");
-	const packagesLineIdx = lines.findIndex((l) => /^packages:\s*$/.test(l));
-	if (packagesLineIdx === -1) return {
-		content: workspaceYaml,
-		changed: false
+function runGroup(input) {
+	const { print, namespace } = input;
+	const names = matchNamespace(input.config, namespace);
+	if (names.length === 0) return {
+		status: "unknown",
+		jobs: []
 	};
-	const items = [];
-	let cursor = packagesLineIdx + 1;
-	while (cursor < lines.length && /^\s*-\s*/.test(lines[cursor])) {
-		items.push(lines[cursor]);
-		cursor++;
+	print(`holocron run ${namespace} — ${names.length} task(s)`);
+	print("");
+	const jobs = [];
+	for (const name of names) {
+		print(`▶ ${name}`);
+		const r = runTask({
+			print: (line) => print(`  ${line}`),
+			logger: input.logger,
+			exec: input.exec,
+			readFile: input.readFile,
+			fileExists: input.fileExists,
+			listDir: input.listDir,
+			lookPath: input.lookPath,
+			task: name,
+			cwd: input.cwd,
+			dryRun: input.dryRun ?? false,
+			...input.filter ? { filter: input.filter } : {}
+		});
+		jobs.push({
+			task: name,
+			status: r.status,
+			command: r.command,
+			message: r.message
+		});
 	}
-	if (items.some((item) => {
-		const value = item.replace(/^\s*-\s*/, "").replace(/^["']|["']$/g, "").trim();
-		return value === "." || value === "";
-	})) return {
-		content: workspaceYaml,
-		changed: false
-	};
-	const newLine = `${items[0]?.match(/^(\s*-\s*)/)?.[1] ?? "  - "}"."`;
 	return {
-		content: [
-			...lines.slice(0, packagesLineIdx + 1),
-			newLine,
-			...lines.slice(packagesLineIdx + 1)
-		].join("\n"),
-		changed: true
+		status: jobs.some((j) => j.status === "fail") ? "fail" : jobs.every((j) => j.status === "dry-run") ? "dry-run" : "ok",
+		jobs
 	};
 }
 //#endregion
@@ -1517,23 +2397,6 @@ function ensureRootWorkspaceMember(workspaceYaml, rootScripts, taskNames) {
 * `@theholocron/cli` instantiates it once and delegates the `run` /
 * `ci` / workflow-generation commands to it (like `@theholocron/observability`).
 */
-const noopLogger = {
-	debug() {},
-	warn() {}
-};
-const realExec = (cmd, args, opts) => {
-	return { exitCode: spawnSync(cmd, args, {
-		cwd: opts.cwd,
-		stdio: "inherit"
-	}).status ?? -1 };
-};
-/** `node_modules/.bin/<bin>`, else the first `PATH` entry that has it, else `null`. */
-const realLookPath = (cwd, bin) => {
-	const local = join(cwd, "node_modules", ".bin", bin);
-	if (existsSync(local)) return local;
-	for (const dir of (process.env["PATH"] ?? "").split(":")) if (dir && existsSync(join(dir, bin))) return join(dir, bin);
-	return null;
-};
 function createAstromech(options) {
 	const deps = {
 		print: options.print ?? ((line) => console.log(line)),
@@ -1545,17 +2408,46 @@ function createAstromech(options) {
 		lookPath: options.lookPath ?? realLookPath
 	};
 	const items = () => (options.config?.tasks ?? []).map((i) => normalizeTaskEntry(i));
+	/**
+	* Task names this repo's manifest can actually run locally — shared by
+	* {@link packageScripts} and by `holocron`'s own interactive task picker.
+	* Deliberately independent of `syncScripts`/`holocronScript`/`hooks`:
+	* those govern whether/how `package.json` scripts get *written*, not
+	* which tasks exist to run. A repo with `syncScripts: false` (this repo
+	* itself, among others) still has real runnable tasks — found live when
+	* `packageScripts()`'s `{}` short-circuit silently emptied the picker too.
+	*/
+	const runnableTaskNames = () => {
+		const out = [];
+		for (const entry of items()) {
+			const def = TASKS[entry.name];
+			const hasNoLocalRunner = def?.local === null && !def.linterGroup && !def.jobs;
+			if (entry.local === false || !KNOWN_TASKS.has(entry.name) || hasNoLocalRunner) continue;
+			out.push(entry.name);
+		}
+		return out;
+	};
 	return {
-		run: (task, opts = {}) => runTask({
-			...deps,
-			task,
-			cwd: options.cwd,
-			...opts.job !== void 0 ? { job: opts.job } : {},
-			passthrough: opts.passthrough ?? [],
-			dryRun: opts.dryRun ?? false,
-			required: opts.required ?? false,
-			...opts.filter ? { filter: opts.filter } : {}
-		}),
+		run: (task, opts = {}) => {
+			if (!TASKS[task] && options.config && matchNamespace(options.config, task).length > 0) return runGroup({
+				...deps,
+				cwd: options.cwd,
+				config: options.config,
+				namespace: task,
+				dryRun: opts.dryRun ?? false,
+				...opts.filter ? { filter: opts.filter } : {}
+			});
+			return runTask({
+				...deps,
+				task,
+				cwd: options.cwd,
+				...opts.job !== void 0 ? { job: opts.job } : {},
+				passthrough: opts.passthrough ?? [],
+				dryRun: opts.dryRun ?? false,
+				required: opts.required ?? false,
+				...opts.filter ? { filter: opts.filter } : {}
+			});
+		},
 		ci: (opts = {}) => runCi({
 			...deps,
 			cwd: options.cwd,
@@ -1569,6 +2461,7 @@ function createAstromech(options) {
 				const isDocsSite = entry.name === "knowledge.docs";
 				const isComponents = entry.name === "knowledge.components";
 				if (entry.ci === false || !KNOWN_WORKFLOWS.has(entry.name) && !isDocsSite && !isComponents) continue;
+				if (entry.name === "delivery.deploy" && entry.with?.["on"] === "release") continue;
 				const rawWith = isDocsSite ? {
 					preview: true,
 					...entry.with,
@@ -1599,51 +2492,168 @@ function createAstromech(options) {
 			const out = {};
 			if (!options.config || options.config.syncScripts === false) return out;
 			out.holocron = options.config.holocronScript ?? "holocron";
-			for (const entry of items()) {
-				const def = TASKS[entry.name];
-				const hasNoLocalRunner = def?.local === null && !def.linterGroup && !def.jobs;
-				if (entry.local === false || !KNOWN_TASKS.has(entry.name) || hasNoLocalRunner) continue;
-				out[entry.name] = `holocron run ${entry.name} --`;
-			}
+			for (const name of runnableTaskNames()) out[name] = `holocron run ${name} --`;
 			const hooks = options.config.hooks;
 			if (hooks === true || typeof hooks === "object" && hooks.prePush !== false) out.prepare = "husky";
 			return out;
 		},
+		runnableTasks: () => runnableTaskNames(),
 		reusableTemplates: () => reusableTemplates(),
 		requiredChecks: () => requiredChecks(options.config ?? {}),
 		codecovConfig: (existing) => codecovConfig(options.cwd, existing),
 		turboConfig: () => turboConfig(options.config ?? {}),
 		ensureRootWorkspaceMember: (workspaceYaml, rootScripts) => {
 			return ensureRootWorkspaceMember(workspaceYaml, rootScripts, (options.config?.tasks ?? []).map(normalizeTaskEntry).filter((e) => e.local !== false).map((e) => e.name));
-		}
+		},
+		ensureTurboDependency: (packageJson, workspaceYaml) => ensureTurboDependency(packageJson, workspaceYaml)
 	};
 }
 //#endregion
-//#region src/tsconfig.ts
+//#region src/templates/configs/alexjs/alexignore
+var alexignore_default = ".github/*\nCHANGELOG.md\nLICENSE\n";
+//#endregion
+//#region src/templates/configs/alexjs/create-config.ts
+const { workflowHeader: workflowHeader$9 } = createHeader({ source: "packages/astromech/src/templates/configs/alexjs/create-config.ts" });
+function createRcConfig() {
+	return stringifyJson(alexrc_default);
+}
+function createIgnoreConfig() {
+	return `${workflowHeader$9()}${alexignore_default}`;
+}
+//#endregion
+//#region src/templates/configs/commit-msg/commit-msg
+var commit_msg_default = "__HOLOCRON_SCRIPT__ run lint commit-msg \"$1\"\n";
+//#endregion
+//#region src/templates/configs/commit-msg/create-config.ts
+const { workflowHeader: workflowHeader$8 } = createHeader({ source: "packages/astromech/src/templates/configs/commit-msg/create-config.ts" });
 /**
-* A package-level `tsconfig.json` — the uniform shape confirmed across
-* every package checked, parameterized only by the two fields that
-* genuinely vary (`display`, `paths`). No scaffold/workflow header (matches
-* `.alexrc.json`'s existing precedent for a strict-JSON Bucket B file —
-* JSON has no comment syntax to carry one, and TypeScript's own tolerance
-* for JSONC comments in `tsconfig.json` isn't worth relying on for a file
-* this thin).
+* `.husky/commit-msg` — lints the commit message via `holocron run lint
+* commit-msg` (holocron#789), the real programmatic replacement for
+* shelling out to `commitlint --edit`. Installed by `holocron repo setup` when
+* hooks are enabled. Same `__HOLOCRON_SCRIPT__` substitution as `pre-push`.
+*
+* @param holocronScript - the command that invokes the CLI. Defaults to
+*   `pnpm exec holocron`; the source repo passes `node packages/cli/dist/cli.mjs`.
 */
-function createTsconfig(options) {
-	const variant = options.variant ?? "node-lts";
-	const compilerOptions = {
-		baseUrl: "./",
-		outDir: "./dist"
-	};
-	if (options.paths) compilerOptions.paths = { "@/*": ["./src/*"] };
-	const config = {
-		display: options.display,
-		extends: `@theholocron/tsconfig/${variant}`,
-		compilerOptions,
-		include: ["src/**/*.ts"],
-		exclude: ["node_modules", "dist"]
-	};
-	return JSON.stringify(config, null, 2) + "\n";
+function createConfig(holocronScript = "pnpm exec holocron") {
+	return `${workflowHeader$8("shebang")}${commit_msg_default.replace("__HOLOCRON_SCRIPT__", holocronScript)}`;
+}
+//#endregion
+//#region src/templates/configs/dependabot/dependabot.yml
+var dependabot_default = "version: 2\nupdates:\n  - package-ecosystem: npm\n    directory: /\n    schedule:\n      interval: weekly\n    commit-message:\n      prefix: \"chore(deps)\"\n      prefix-development: \"chore(deps-dev)\"\n    groups:\n      security-patches:\n        applies-to: security-updates\n        patterns:\n          - \"*\"\n      all-dependencies:\n        update-types:\n          - minor\n          - patch\n\n  - package-ecosystem: github-actions\n    directory: /\n    schedule:\n      interval: weekly\n    commit-message:\n      prefix: \"chore(deps)\"\n    groups:\n      all-actions:\n        patterns:\n          - \"*\"\n";
+//#endregion
+//#region src/templates/configs/dependabot/create-config.ts
+const { workflowHeader: workflowHeader$7 } = createHeader({ source: "packages/astromech/src/templates/configs/dependabot/create-config.ts" });
+function createConfig$1() {
+	return `${workflowHeader$7()}${dependabot_default}`;
+}
+//#endregion
+//#region src/templates/configs/devmoji/create-config.ts
+const { workflowHeader: workflowHeader$6 } = createHeader({ source: "packages/astromech/src/templates/configs/devmoji/create-config.ts" });
+function createConfig$2() {
+	return [
+		workflowHeader$6("cjs"),
+		`/* eslint-disable */`,
+		`const { defineConfig } = require("@theholocron/devmoji-config");`,
+		`module.exports = defineConfig();`,
+		``
+	].join("\n");
+}
+//#endregion
+//#region src/templates/configs/editorconfig/editorconfig
+var editorconfig_default = "root = true\n\n[*]\nend_of_line = lf\ncharset = utf-8\ntrim_trailing_whitespace = true\ninsert_final_newline = true\nindent_style = tab\nindent_size = 4\n\n[.gitattributes]\nindent_style = space\nindent_size = 2\n\n[*.{json,yml,yaml}]\nindent_style = space\nindent_size = 2\n\n[*.{md,mdx}]\ntrim_trailing_whitespace = false\nindent_style = unset\n\n[.*{rc,ignore}]\nindent_style = space\nindent_size = 2\n";
+//#endregion
+//#region src/templates/configs/editorconfig/create-config.ts
+const { workflowHeader: workflowHeader$5 } = createHeader({ source: "packages/astromech/src/templates/configs/editorconfig/create-config.ts" });
+function createConfig$3() {
+	return `${workflowHeader$5()}${editorconfig_default}`;
+}
+//#endregion
+//#region src/templates/configs/editorconfig-checker/create-config.ts
+/**
+* The generated `.editorconfig-checker.json`.
+*
+* Deliberately carries no `"Version"` key: editorconfig-checker treats it as a
+* hard gate and exits non-zero the moment the running binary's version differs
+* — which it does the instant a contributor's local install (Homebrew tracks
+* latest) drifts from the version super-linter bundles in CI, breaking
+* `holocron run lint` / the pre-push hook for everyone (#618). The config
+* options here (`Exclude`, `Disable`) are stable across releases, so pinning
+* buys nothing.
+*/
+function createConfig$4() {
+	return stringifyJson(editorconfig_checker_default);
+}
+//#endregion
+//#region src/templates/configs/labeler/labeler.yml
+var labeler_default = "bug:\n  - \"^fix\"\n\nchore:\n  - '^chore(?!\\(deps)'\n\nci:\n  - \"^ci\"\n\ndependencies:\n  - '^chore\\(deps'\n\ndocumentation:\n  - \"^docs\"\n\nenhancement:\n  - \"^feat\"\n\nperformance:\n  - \"^perf\"\n\nrefactor:\n  - \"^refactor\"\n\ntest:\n  - \"^test\"\n";
+//#endregion
+//#region src/templates/configs/labeler/create-config.ts
+const { workflowHeader: workflowHeader$4 } = createHeader({ source: "packages/astromech/src/templates/configs/labeler/create-config.ts" });
+function createConfig$5() {
+	return `${workflowHeader$4()}${labeler_default}`;
+}
+//#endregion
+//#region src/templates/configs/pre-commit/pre-commit
+var pre_commit_default = "# Run GitLeaks against staged changes only — a full `gitleaks git` history\n# scan re-flags every pre-existing (already-merged) finding on every commit,\n# permanently blocking the repo once any false positive lands in history.\n# CI's super-linter GITLEAKS validator is likewise scoped to changed files.\ngitleaks protect --staged --no-banner\n\n# Exit with non-zero if secrets are detected by GitLeaks\nif [ $? -ne 0 ]; then\n	echo \"Secrets detected by GitLeaks, aborting commit!\"\n	exit 1\nfi\n\n# Run lint-staged with a custom config\nnpx lint-staged --config @theholocron/lint-staged-config\n";
+//#endregion
+//#region src/templates/configs/pre-commit/create-config.ts
+const { workflowHeader: workflowHeader$3 } = createHeader({ source: "packages/astromech/src/templates/configs/pre-commit/create-config.ts" });
+/**
+* `.husky/pre-commit` — runs GitLeaks (scoped to staged changes) and
+* lint-staged before every commit. Installed by `holocron repo setup` when hooks
+* are enabled (default for `protection: "strict"`). `git commit --no-verify`
+* bypasses it.
+*
+* `gitleaks protect --staged` (not `gitleaks git`) is deliberate: the latter
+* scans the entire commit history on every invocation, so once any false
+* positive lands in a past commit — a fake test token, an example key in a
+* doc — every future commit is permanently blocked, regardless of what's
+* actually staged.
+*/
+function createConfig$6() {
+	return `${workflowHeader$3("shebang")}${pre_commit_default}`;
+}
+//#endregion
+//#region src/templates/configs/pre-push/pre-push
+var pre_push_default = "# Run the merge-gating checks locally before pushing — the same set CI runs.\n# Bypass once with:  git push --no-verify\n\n# CI runners (semantic-release, super-linter auto-commit, bots) push without a\n# built dev environment — the hook has nothing to add there.\n[ -n \"$CI\" ] && exit 0\n\n__HOLOCRON_SCRIPT__ run ci\n";
+//#endregion
+//#region src/templates/configs/pre-push/create-config.ts
+const { workflowHeader: workflowHeader$2 } = createHeader({ source: "packages/astromech/src/templates/configs/pre-push/create-config.ts" });
+/**
+* `.husky/pre-push` — runs `holocron run ci` (the merge-gating checks, in CI order)
+* before every push. Installed by `holocron repo setup` when hooks are enabled
+* (default for `protection: "strict"`). `git push --no-verify` bypasses it.
+*
+* @param holocronScript - the command that invokes the CLI. Defaults to
+*   `pnpm exec holocron`; the source repo passes `node packages/cli/dist/cli.mjs`.
+*/
+function createConfig$7(holocronScript = "pnpm exec holocron") {
+	return `${workflowHeader$2("shebang")}${pre_push_default.replace("__HOLOCRON_SCRIPT__", holocronScript)}`;
+}
+//#endregion
+//#region src/templates/configs/prepare-commit-msg/prepare-commit-msg
+var prepare_commit_msg_default = "NAME=$(git config user.name)\nEMAIL=$(git config user.email)\n\nif [ -z \"$NAME\" ]; then\n	echo \"empty git config user.name\"\n	exit 1\nfi\n\nif [ -z \"$EMAIL\" ]; then\n	echo \"empty git config user.email\"\n	exit 1\nfi\n\ngit interpret-trailers --if-exists doNothing --trailer \\\n	\"Signed-off-by: $NAME <$EMAIL>\" \\\n	--in-place \"$1\"\n\n# --config <resolved shared path> (config-resolution workstream, #676) — falls\n# back to devmoji's own auto-discovery of a local devmoji.config.cjs when the\n# shared package's built dist/ isn't present (not installed, or a stale\n# install predating this file).\nDEVMOJI_CONFIG=\"node_modules/@theholocron/devmoji-config/dist/index.cjs\"\nif [ -f \"$DEVMOJI_CONFIG\" ]; then\n	npx devmoji --config \"$DEVMOJI_CONFIG\" -e\nelse\n	npx devmoji -e\nfi\n";
+//#endregion
+//#region src/templates/configs/prepare-commit-msg/create-config.ts
+const { workflowHeader: workflowHeader$1 } = createHeader({ source: "packages/astromech/src/templates/configs/prepare-commit-msg/create-config.ts" });
+function createConfig$8() {
+	return `${workflowHeader$1("shebang")}${prepare_commit_msg_default}`;
+}
+//#endregion
+//#region src/templates/configs/yamllint/.yamlignore
+var _yamlignore_default = "pnpm-lock.yaml\n";
+//#endregion
+//#region src/templates/configs/yamllint/.yamllint.yml
+var _yamllint_default = "---\nextends: default\n\nignore-from-file:\n  - .gitignore\n  - .yamlignore\n\nrules:\n  comments:\n    min-spaces-from-content: 1\n    require-starting-space: true\n\n  comments-indentation: {}\n\n  document-start:\n    ignore: |\n      .github/*.yml\n\n  indentation:\n    spaces: consistent\n    indent-sequences: consistent\n\n  line-length: disable\n";
+//#endregion
+//#region src/templates/configs/yamllint/create-config.ts
+const { workflowHeader } = createHeader({ source: "packages/astromech/src/templates/configs/yamllint/create-config.ts" });
+function createConfig$9() {
+	return `${workflowHeader()}${_yamllint_default}`;
+}
+function createIgnoreConfig$1() {
+	return `${workflowHeader()}${_yamlignore_default}`;
 }
 //#endregion
-export { CI_ORDER, KNOWN_TASKS, KNOWN_WORKFLOWS, LINTERS, LINTER_NAMES, RESOLVABLE_TOOLS, REUSABLE_ACTIONS, REUSABLE_WORKFLOWS, TASKS, WORKFLOW_CHECK_CONTEXTS, WORKFLOW_TEMPLATES, WORKFLOW_TEMPLATE_PROPERTIES, codecovComponentBlock, codecovConfig, createAstromech, createCodecovConfig, createTsconfig, deriveDeployPaths, ensureIfNotFound, extractPreviewConfig, generateCombinedDeployContent, generateThinCallerContent, mergeCodecovComponents, normalizeWorkflowWith, readWorkspacePackages, requiredChecks, resolveLinters, resolveToolConfig, reusableTemplates, runCi, runTask };
+export { CI_ORDER, KNOWN_TASKS, KNOWN_WORKFLOWS, REUSABLE_ACTIONS, REUSABLE_WORKFLOWS, TASKS, WORKFLOW_CHECK_CONTEXTS, WORKFLOW_TEMPLATES, WORKFLOW_TEMPLATE_PROPERTIES, codecovComponentBlock, codecovConfig, createIgnoreConfig as createAlexignore, createRcConfig as createAlexrc, createAstromech, createCodecovConfig, createConfig as createCommitMsg, createConfig$1 as createDependabot, createConfig$2 as createDevmoji, createConfig$3 as createEditorconfig, createConfig$4 as createEditorconfigChecker, createHeader, createConfig$5 as createLabeler, createConfig$6 as createPreCommit, createConfig$7 as createPrePush, createConfig$8 as createPrepareCommitMsg, createTsconfig, createIgnoreConfig$1 as createYamlignore, createConfig$9 as createYamllint, defaultListDirs, defaultPaths, defaultReadJson, deployOnRelease, deriveDeployPaths, ensureIfNotFound, extractPreviewConfig, generateCombinedDeployContent, generateThinCallerContent, matchNamespace, mergeCodecovComponents, normalizeWorkflowWith, readWorkspacePackages, requiredChecks, reusableTemplates, runCi, runGroup, runTask, workspacePackages };