@theholocron/cli 2.0.0-alpha.63 → 2.0.0-alpha.65

package/dist/cli.mjs

@@ -3,11 +3,13 @@ import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSy
 import path, { basename, dirname, join } from "node:path";
 import yargs from "yargs";
 import { hideBin } from "yargs/helpers";
+import { createInterface } from "node:readline";
+import { stdin, stdout } from "node:process";
 import { ProviderApiError, ProviderApiError as ProviderApiError$1 } from "@theholocron/http-client";
 import { Entry, findCredentials } from "@napi-rs/keyring";
 import { createHash } from "node:crypto";
 import { createGitHubClient } from "@theholocron/github-client";
-import { execFile, spawnSync } from "node:child_process";
+import { execFile, execFileSync, spawnSync } from "node:child_process";
 import { access, readFile, readdir, stat, writeFile } from "node:fs/promises";
 import { pathToFileURL } from "node:url";
 import { promisify } from "node:util";
@@ -834,879 +836,132 @@ async function runUpgradeNode(input) {
 	};
 }
 //#endregion
+//#region src/templates/actions/setup.yml
+var setup_default = "name: Setup\ndescription: Prepare the environment and install project dependencies.\n\ninputs:\n  node-version:\n    description: Node.js version\n    required: false\n    default: \"22.x\"\n\nruns:\n  using: composite\n\n  steps:\n    - uses: theholocron/.github/.github/actions/setup-node@main\n      with:\n        node-version: ${{ inputs.node-version }}\n\n    - uses: theholocron/.github/.github/actions/install@main\n";
+//#endregion
+//#region src/templates/actions/install.yml
+var install_default = "name: Install dependencies\ndescription: Install project dependencies with pnpm frozen lockfile.\n\nruns:\n  using: composite\n\n  steps:\n    - name: Install dependencies\n      if: ${{ hashFiles('pnpm-lock.yaml') != '' }}\n      shell: bash\n      run: pnpm install --frozen-lockfile\n";
+//#endregion
+//#region src/templates/actions/setup-node.yml
+var setup_node_default = "name: Setup Node\ndescription: Install pnpm and Node.js with pnpm dependency caching.\n\ninputs:\n  node-version:\n    description: Node.js version\n    required: false\n    default: \"22.x\"\n\nruns:\n  using: composite\n\n  steps:\n    - name: Setup pnpm\n      if: ${{ hashFiles('pnpm-lock.yaml') != '' }}\n      uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4\n\n    - name: Setup Node.js\n      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4\n      with:\n        node-version: ${{ hashFiles('.node-version') != '' && '' || inputs.node-version }}\n        node-version-file: ${{ hashFiles('.node-version') != '' && '.node-version' || '' }}\n        cache: ${{ hashFiles('pnpm-lock.yaml') != '' && 'pnpm' || '' }}\n\n    - name: Add node_modules/.bin to PATH\n      shell: bash\n      run: echo \"$GITHUB_WORKSPACE/node_modules/.bin\" >> $GITHUB_PATH\n";
+//#endregion
+//#region src/templates/workflows/audit.yml
+var audit_default$1 = "name: Audit\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      build-script:\n        description: Script to build and upload bundle stats to Codecov\n        type: string\n        required: false\n        default: pnpm build\n    secrets:\n      CODECOV_TOKEN:\n        required: false\n\njobs:\n  bundle-size:\n    name: Audit the bundle size\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    concurrency:\n      group: audit-${{ github.ref }}\n      cancel-in-progress: true\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: eval \"$BUILD_SCRIPT\"\n        name: Build and upload bundle stats\n        env:\n          BUILD_SCRIPT: ${{ inputs.build-script }}\n          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}\n";
+//#endregion
+//#region src/templates/workflows/bookkeeping.yml
+var bookkeeping_default$1 = "name: Bookkeeping\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      configuration-path:\n        description: Path to the labeler configuration file in the calling repo\n        type: string\n        required: false\n        default: .github/labeler.yml\n\njobs:\n  label:\n    name: Apply Labels\n    permissions:\n      contents: read\n      issues: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    concurrency:\n      group: bookkeeping-${{ github.event.pull_request.number || github.event.issue.number }}\n      cancel-in-progress: true\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          sparse-checkout: ${{ inputs.configuration-path || '.github/labeler.yml' }}\n          sparse-checkout-cone-mode: false\n\n      - uses: github/issue-labeler@c1b0f9f52a63158c4adc09425e858e87b32e9685 # v3.4\n        if: ${{ hashFiles(inputs.configuration-path || '.github/labeler.yml') != '' }}\n        # v3.4 bundles Node 20; allow it to run under Actions' current default.\n        env:\n          ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true\n        with:\n          # Fall back to default path when triggered directly (not via workflow_call)\n          # because inputs.* defaults only apply on workflow_call events.\n          configuration-path: ${{ inputs.configuration-path || '.github/labeler.yml' }}\n          include-title: 1\n          include-body: 0\n          sync-labels: 1\n          enable-versioned-regex: 0\n          repo-token: ${{ github.token }}\n";
+//#endregion
+//#region src/templates/workflows/codeql.yml
+var codeql_default$1 = "name: CodeQL\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      language:\n        description: CodeQL language to analyze\n        type: string\n        required: false\n        default: javascript-typescript\n\njobs:\n  analyze:\n    name: Analyze (${{ inputs.language }})\n    permissions:\n      actions: read\n      contents: read\n      security-events: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 45\n    # Do not cancel in-progress security scans.\n    concurrency:\n      group: codeql-${{ github.ref }}\n      cancel-in-progress: false\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0\n        name: Initialize CodeQL\n        with:\n          languages: ${{ inputs.language }}\n\n      - uses: github/codeql-action/autobuild@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0\n        name: Autobuild\n\n      - uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0\n        name: Analyze\n        with:\n          category: /language:${{ inputs.language }}\n";
+//#endregion
+//#region src/templates/workflows/dependencies.yml
+var dependencies_default$1 = "name: Dependencies\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      merge-token:\n        description: >\n          Optional privileged token for auto-merge. Falls back to GITHUB_TOKEN.\n          Required when branch protection enforces required reviews — GITHUB_TOKEN\n          cannot approve its own PRs.\n        required: false\n\njobs:\n  dependabot:\n    name: Update the dependencies\n    permissions:\n      contents: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    concurrency:\n      group: dependencies-${{ github.event.pull_request.number }}\n      cancel-in-progress: true\n    if: github.event.pull_request.user.login == 'dependabot[bot]'\n    steps:\n      - uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0\n        name: Fetch Dependabot metadata\n        id: metadata\n\n      - run: gh pr merge --auto --squash \"$PR_URL\"\n        # --squash is intentional: repo protection sets allow_merge_commit: false,\n        # so --merge would fail on any repo using the standard preset.\n        name: Enable auto-merge for Dependabot PRs\n        if: steps.metadata.outputs.update-type == 'version-update:semver-patch'\n        env:\n          PR_URL: ${{ github.event.pull_request.html_url }}\n          GH_TOKEN: ${{ secrets.merge-token || github.token }}\n";
+//#endregion
+//#region src/templates/workflows/greetings.yml
+var greetings_default$1 = "name: Greetings\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n\njobs:\n  greeting:\n    name: Greet first-time contributors\n    permissions:\n      issues: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    # Group by the issue/PR number so duplicate events don't race each other.\n    concurrency:\n      group: greetings-${{ github.event.issue.number || github.event.pull_request.number }}\n      cancel-in-progress: false\n    steps:\n      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n        name: Greet on first contribution\n        with:\n          script: |\n            // Only greet on the initial open — ignore synchronize, reopened, etc.\n            if (context.payload.action !== 'opened') return;\n\n            const actor = context.actor;\n            const { owner, repo } = context.repo;\n\n            // Payload inspection is more reliable than context.eventName for detecting\n            // whether this is an issue vs. PR event — works regardless of how GitHub\n            // propagates event names through workflow_call chains.\n            const isIssue = !!context.payload.issue && !context.payload.pull_request;\n            // listForRepo returns both issues and PRs (GitHub treats PRs as issues),\n            // sorted newest-first. Filter by type to track first-issue and first-PR\n            // independently, and avoid search-index eventual-consistency lag.\n            const { data: recent } = await github.rest.issues.listForRepo({\n              owner, repo,\n              creator: actor,\n              state: 'all',\n              per_page: 100\n            });\n\n            const sameType = recent.filter(item =>\n              isIssue ? !item.pull_request : !!item.pull_request\n            );\n\n            if (sameType.length !== 1) return;\n            const body = isIssue\n              ? `Hey @${actor}!\\n\\nWe really appreciate you taking the time to report an issue. The collaborators on this project attempt to help as many people as possible, but we are a limited number of volunteers, so it is possible that this will not be addressed as swiftly.\\n\\nYour patience is much appreciated and we will get back to you as quickly as possible.`\n              : `Hey @${actor}!\\n\\nWe really appreciate you taking the time to help out with this PR. The collaborators on this project attempt to help as many people as possible, but we are a limited number of volunteers, so it is possible that this will not be addressed as swiftly.\\n\\nYour patience is much appreciated and we will get back to you as quickly as possible.`;\n\n            await github.rest.issues.createComment({\n              owner,\n              repo,\n              issue_number: context.issue.number,\n              body\n            });\n";
+//#endregion
+//#region src/templates/workflows/lint.yml
+var lint_default$1 = "name: Lint\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      prettier-config:\n        type: string\n        required: false\n        default: prettier.config.js\n      yaml-config:\n        type: string\n        required: false\n        default: yamllint.config.yml\n      enable-auto-commit:\n        description: Auto-commit super-linter fixes via GPG-signed commit\n        type: boolean\n        required: false\n        default: false\n    secrets:\n      SUPER_LINTER_GPG_PRIVATE_KEY:\n        required: false\n      SUPER_LINTER_GPG_PASSPHRASE:\n        required: false\n\njobs:\n  super-lint:\n    name: Lint entire codebase\n    permissions:\n      contents: write\n      statuses: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    env:\n      GPG_KEY_SET: ${{ secrets.SUPER_LINTER_GPG_PRIVATE_KEY != '' }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n          token: ${{ github.token }}\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n        if: ${{ hashFiles('pnpm-lock.yaml') != '' }}\n\n      - uses: super-linter/super-linter/slim@4ce20838b8ab83717e78138c5b3a1407148e0918 # v8.7.0\n        name: Run Super Linter\n        env:\n          GITHUB_TOKEN: ${{ github.token }}\n          DEFAULT_BRANCH: ${{ github.event.pull_request.base.ref || github.event.repository.default_branch }}\n          ANNOTATE_ONLY: true\n          DISABLE_COMMENTS: false\n          IGNORE_GITIGNORED_FILES: true\n          LINTER_RULES_PATH: /\n          EDITORCONFIG_FILE_NAME: \".editorconfig-checker.json\"\n          FIX_ENV: true\n          FIX_GRAPHQL_PRETTIER: true\n          FIX_HTML_PRETTIER: true\n          FIX_JAVASCRIPT_PRETTIER: true\n          FIX_JSX_PRETTIER: true\n          FIX_MARKDOWN_PRETTIER: true\n          FIX_TSX: true\n          FIX_TYPESCRIPT_PRETTIER: true\n          PRETTIER_CONFIG: ${{ inputs.prettier-config }}\n          VALIDATE_DOCKERFILE: true\n          VALIDATE_EDITORCONFIG: true\n          VALIDATE_ENV: true\n          VALIDATE_GIT_COMMITLINT: true\n          VALIDATE_GIT_MERGE_CONFLICT_MARKERS: true\n          VALIDATE_GITHUB_ACTIONS: true\n          VALIDATE_GITLEAKS: true\n          VALIDATE_GRAPHQL_PRETTIER: true\n          VALIDATE_HTML_PRETTIER: true\n          VALIDATE_JAVASCRIPT_PRETTIER: true\n          VALIDATE_JSX_PRETTIER: true\n          VALIDATE_MARKDOWN_PRETTIER: true\n          VALIDATE_TSX: true\n          VALIDATE_TYPESCRIPT_PRETTIER: true\n          VALIDATE_YAML: true\n          YAML_CONFIG_FILE: ${{ inputs.yaml-config }}\n\n      - uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0\n        name: Import GPG Key\n        # Conditions mirror auto-commit exactly — no point importing GPG if the\n        # commit step will be skipped (fork PR, default branch, or secret unset).\n        if: >\n          inputs.enable-auto-commit == true &&\n          github.event.pull_request != null &&\n          github.event.pull_request.head.repo.full_name == github.repository &&\n          github.ref_name != github.event.repository.default_branch &&\n          env.GPG_KEY_SET == 'true'\n        with:\n          git_user_signingkey: true\n          git_commit_gpgsign: true\n          GPG_PRIVATE_KEY: ${{ secrets.SUPER_LINTER_GPG_PRIVATE_KEY }}\n          PASSPHRASE: ${{ secrets.SUPER_LINTER_GPG_PASSPHRASE }}\n\n      - uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d # v7.2.0\n        name: Commit and push linting fixes\n        if: >\n          inputs.enable-auto-commit == true &&\n          github.event.pull_request != null &&\n          github.event.pull_request.head.repo.full_name == github.repository &&\n          github.ref_name != github.event.repository.default_branch &&\n          env.GPG_KEY_SET == 'true'\n        with:\n          branch: ${{ github.event.pull_request.head.ref || github.head_ref || github.ref }}\n          commit_message: \"chore: fix linting issues\\n\\nSigned-off-by: super-linter <super-linter@super-linter.dev>\"\n          commit_options: \"--no-verify\"\n          commit_user_name: super-linter\n          commit_user_email: super-linter@super-linter.dev\n";
+//#endregion
+//#region src/templates/workflows/release.yml
+var release_default$1 = "name: Release\n\n# Semantic-release with OIDC Trusted Publishing — no NPM_TOKEN required.\n# The calling repo must have a .releaserc.json that configures branches,\n# plugins, and any publish options. npm@11+ is installed to support OIDC.\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      run-build:\n        description: Run `pnpm build` before releasing\n        type: boolean\n        required: false\n        default: true\n    secrets:\n      SYNC_TOKEN:\n        description: >\n          Optional PAT with Contents write access. Required when the default\n          branch is protected by a ruleset — github.token cannot push through\n          rulesets, but a PAT with admin bypass can. Falls back to github.token.\n        required: false\n\njobs:\n  release:\n    name: Semantic release\n    permissions:\n      contents: write\n      id-token: write\n      issues: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    # Do not cancel in-progress releases — a partial release is worse than a slow one.\n    concurrency:\n      group: release-${{ github.ref }}\n      cancel-in-progress: false\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n          # Use SYNC_TOKEN when available — git push (tags, release commits)\n          # uses the checkout credential, not GITHUB_TOKEN env var. The\n          # built-in github.token cannot push through branch protection rulesets.\n          token: ${{ secrets.SYNC_TOKEN || github.token }}\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - name: Configure git identity\n        run: |\n          GIT_NAME=$(gh api user --jq .name 2>/dev/null || echo \"github-actions[bot]\")\n          GIT_EMAIL=$(gh api user --jq '\"\\(.id)+\\(.login)@users.noreply.github.com\"' 2>/dev/null || echo \"41898282+github-actions[bot]@users.noreply.github.com\")\n          git config --global user.name \"$GIT_NAME\"\n          git config --global user.email \"$GIT_EMAIL\"\n          git config --global format.signoff true\n        env:\n          GH_TOKEN: ${{ secrets.SYNC_TOKEN || github.token }}\n\n      - run: npm install -g npm@11 sigstore\n        name: Upgrade npm for OIDC support\n        # sigstore is required by libnpmpublish/provenance.js at module parse\n        # time — before any config takes effect. Some npm 11.x builds stopped\n        # bundling it; installing it globally into the same prefix ensures it\n        # resolves regardless of npm version. (Discovered 2026-07-09.)\n\n      - run: pnpm build\n        name: Build\n        if: ${{ inputs.run-build == true }}\n\n      - run: npx semantic-release\n        name: Release\n        env:\n          # Prefer SYNC_TOKEN (a PAT with Contents write) when available —\n          # the built-in github.token cannot push to protected default branches\n          # because rulesets block non-PAT pushes. Falls back to github.token\n          # for repos without branch protection.\n          GITHUB_TOKEN: ${{ secrets.SYNC_TOKEN || github.token }}\n          NPM_CONFIG_PROVENANCE: true\n";
+//#endregion
+//#region src/templates/workflows/review.yml
+var review_default$1 = "name: Review\n\n# ReviewDog is the annotation layer — posts inline PR diff annotations.\n# Runs on pull_request only: inline annotations require PR context,\n# and branch protection ensures all changes go through PRs anyway.\n# super-linter (lint.yml) is the CI gate covering push + PR events.\n# Gitleaks and YAML are intentionally duplicated: super-linter gates\n# merges; ReviewDog surfaces exact line annotations in the PR diff.\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n\nconcurrency:\n  group: review-${{ github.workflow }}-${{ github.ref }}\n  cancel-in-progress: true\n\njobs:\n  reviewdog:\n    name: Review PRs\n    runs-on: ubuntu-latest\n    timeout-minutes: 20\n    permissions:\n      contents: read\n      checks: write\n      pull-requests: write\n\n    steps:\n      - name: Checkout repository\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          fetch-depth: 0\n\n      - name: Setup\n        if: ${{ hashFiles('pnpm-lock.yaml') != '' }}\n        uses: theholocron/.github/.github/actions/setup@main\n\n      - name: Install ReviewDog\n        uses: reviewdog/action-setup@d8a7baabd7f3e8544ee4dbde3ee41d0011c3a93f # v1\n        with:\n          reviewdog_version: latest\n\n      # Detect which tools are relevant for this repo, excluding node_modules.\n      # hashFiles('**/*') recurses into node_modules/.pnpm and produces false\n      # positives for repos that don't own those file types.\n      # -print -quit stops find after the first match without a pipe, avoiding\n      # the SIGPIPE/pipefail exit-141 that find|head-1 triggers under\n      # GitHub Actions' default bash --noprofile --norc -e -o pipefail mode.\n      - name: Detect project features\n        id: detect\n        shell: bash\n        run: |\n          has() { find . -not -path '*/node_modules/*' -name \"$1\" -print -quit 2>/dev/null | grep -q .; }\n          has_ext() { find . -not -path '*/node_modules/*' -name \"$1\" -print -quit 2>/dev/null | grep -q .; }\n          { { has 'eslint.config.js' || has 'eslint.config.mjs' || has 'eslint.config.cjs' || \\\n              has 'eslint.config.ts' || has '.eslintrc' || has '.eslintrc.js' || \\\n              has '.eslintrc.cjs' || has '.eslintrc.json' || has '.eslintrc.yaml' || \\\n              has '.eslintrc.yml'; } && grep -qF '\"eslint\":' package.json 2>/dev/null; } && echo \"eslint=true\" >> \"$GITHUB_OUTPUT\" || echo \"eslint=false\" >> \"$GITHUB_OUTPUT\"\n          { has 'tsconfig.json' && grep -qF '\"typescript\":' package.json 2>/dev/null; } && echo \"tsconfig=true\" >> \"$GITHUB_OUTPUT\" || echo \"tsconfig=false\" >> \"$GITHUB_OUTPUT\"\n          has_ext '*.sh' && echo \"shell=true\" >> \"$GITHUB_OUTPUT\" || echo \"shell=false\" >> \"$GITHUB_OUTPUT\"\n          has 'Dockerfile' || has_ext '*.Dockerfile' || has 'Containerfile' && \\\n            echo \"docker=true\" >> \"$GITHUB_OUTPUT\" || echo \"docker=false\" >> \"$GITHUB_OUTPUT\"\n          has_ext '.env*' && echo \"dotenv=true\" >> \"$GITHUB_OUTPUT\" || echo \"dotenv=false\" >> \"$GITHUB_OUTPUT\"\n          has_ext '*.md' && echo \"markdown=true\" >> \"$GITHUB_OUTPUT\" || echo \"markdown=false\" >> \"$GITHUB_OUTPUT\"\n\n      #\n      # Always applicable\n      #\n\n      - name: Gitleaks (secrets)\n        uses: reviewdog/action-gitleaks@2b7b5685e3e3eecddab5d30cfa04f18123031421 # v1\n        with:\n          reporter: github-pr-check\n          gitleaks_flags: --log-opts=${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }}\n\n      - name: YamlLint\n        if: ${{ hashFiles('yamllint.config.yml') != '' }}\n        uses: reviewdog/action-yamllint@b5f7217d8c815ae374d1d55840d5e569d82f01f0 # v1\n        with:\n          reporter: github-pr-check\n          yamllint_flags: -c ${{ github.workspace }}/yamllint.config.yml ${{ github.workspace }}\n\n      - name: ActionLint (GitHub Actions)\n        if: ${{ hashFiles('.github/workflows/*.yml', '.github/workflows/*.yaml') != '' }}\n        uses: reviewdog/action-actionlint@6fb7acc99f4a1008869fa8a0f09cfca740837d9d # v1\n        with:\n          reporter: github-pr-check\n\n      #\n      # TypeScript / JavaScript\n      #\n\n      - name: ESLint\n        if: steps.detect.outputs.eslint == 'true'\n        uses: reviewdog/action-eslint@556a3fdaf8b4201d4d74d406013386aa4f7dab96 # v1.34.0\n        with:\n          reporter: github-pr-check\n          eslint_flags: .\n\n      - name: TypeScript\n        if: steps.detect.outputs.tsconfig == 'true'\n        uses: EPMatt/reviewdog-action-tsc@63d923a3c5b4497671940b8874f58a404e2351b5 # v1\n        with:\n          reporter: github-pr-check\n\n      #\n      # Shell\n      #\n\n      - name: ShellCheck\n        if: steps.detect.outputs.shell == 'true'\n        uses: reviewdog/action-shellcheck@4c07458293ac342d477251099501a718ae5ef86e # v1\n        with:\n          reporter: github-pr-check\n          fail_level: none\n\n      #\n      # Docker\n      #\n\n      - name: Hadolint\n        if: steps.detect.outputs.docker == 'true'\n        uses: reviewdog/action-hadolint@1b2cfa6ba72072ad35158d7ff3aa49bbdc03506d # v1\n        with:\n          reporter: github-pr-check\n          fail_level: none\n\n      #\n      # Environment files\n      #\n\n      - name: dotenv-linter\n        if: steps.detect.outputs.dotenv == 'true'\n        uses: dotenv-linter/action-dotenv-linter@afde61cfda2ecffe7bea35837b6f20b956c88689 # v3.0.0\n        with:\n          reporter: github-code-suggestions\n\n      #\n      # Documentation\n      #\n\n      - name: Alex (inclusive language)\n        if: steps.detect.outputs.markdown == 'true'\n        uses: reviewdog/action-alex@347481655add010a2ae302df34b57c9bcfa0d6e4 # v1\n        with:\n          reporter: github-pr-check\n";
+//#endregion
+//#region src/templates/workflows/stale.yml
+var stale_default$1 = "name: Stale\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      days-before-stale:\n        description: Days of inactivity before an issue is marked stale\n        type: number\n        required: false\n        default: 30\n      days-before-close:\n        description: Days of inactivity after stale label before closing\n        type: number\n        required: false\n        default: 5\n\njobs:\n  stale:\n    name: Mark stale issues and pull requests\n    permissions:\n      contents: write\n      issues: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    steps:\n      - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0\n        name: Run Stale\n        with:\n          close-issue-message: >\n            This issue was closed because it has been stalled for\n            ${{ inputs.days-before-close }} days with no activity.\n          days-before-close: ${{ inputs.days-before-close }}\n          days-before-stale: ${{ inputs.days-before-stale }}\n          exempt-all-pr-milestones: true\n          stale-issue-label: wontfix\n          stale-issue-message: >\n            This issue is stale because it has been open ${{ inputs.days-before-stale }}\n            days with no activity. Remove the stale label or comment, or this will be\n            closed in ${{ inputs.days-before-close }} days.\n          stale-pr-label: wontfix\n          stale-pr-message: >\n            This PR is stale because it has been open ${{ inputs.days-before-stale }}\n            days with no activity. Remove the stale label or comment, or this will be\n            closed in ${{ inputs.days-before-close }} days.\n";
+//#endregion
+//#region src/templates/workflows/sync-github.yml
+var sync_github_default$1 = "name: Sync GitHub Templates\n\n# Builds the holocron CLI from source and pushes updated workflow templates\n# and composite actions to downstream .github repos. Runs whenever the\n# template source files change on main or alpha.\n#\n# Secrets required:\n#   SYNC_TOKEN — fine-grained PAT (resource owner: org) with:\n#                  Contents:      Read and write  (git trees, blobs, refs)\n#                  Pull requests: Read and write  (open sync PR)\n#                  Workflows:     Read and write  (write .github/workflows/*.yml)\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      primary-repo:\n        description: >\n          Primary .github repo — receives composite actions, reusable workflows,\n          and thin-caller templates. Requires a PR (branch protection assumed).\n        type: string\n        required: false\n        default: theholocron/.github\n      secondary-repos:\n        description: >\n          Space-separated list of secondary repos (reusable workflows + thin\n          callers only, no composite actions). Changes are delivered via pull\n          request, same as the primary repo.\n        type: string\n        required: false\n        default: \"\"\n      sync-branch:\n        description: Branch name used for the primary and secondary repo PRs\n        type: string\n        required: false\n        default: chore/sync-templates\n    secrets:\n      SYNC_TOKEN:\n        required: true\n\njobs:\n  sync:\n    name: Sync templates\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    permissions:\n      contents: read\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: pnpm build\n        name: Build CLI\n\n      - name: Validate generated workflows\n        run: |\n          node packages/cli/dist/cli.mjs sync-github \\\n            --repo \"$PRIMARY_REPO\" \\\n            --output-dir /tmp/sync-validate\n          curl -fsSL https://github.com/rhysd/actionlint/releases/download/v1.7.7/actionlint_1.7.7_linux_amd64.tar.gz \\\n            | tar -xz -C /tmp actionlint\n          /tmp/actionlint /tmp/sync-validate/.github/workflows/*.yml\n        env:\n          PRIMARY_REPO: ${{ inputs.primary-repo }}\n\n      - name: Sync primary repo (PR)\n        run: |\n          GIT_NAME=$(gh api user --jq .name 2>/dev/null || echo \"github-actions[bot]\")\n          GIT_EMAIL=$(gh api user --jq '\"\\(.id)+\\(.login)@users.noreply.github.com\"' 2>/dev/null || echo \"41898282+github-actions[bot]@users.noreply.github.com\")\n          COMMIT_MSG=\"chore: sync from theholocron/holocron\"$'\\n\\n'\"Signed-off-by: $GIT_NAME <$GIT_EMAIL>\"\n          node packages/cli/dist/cli.mjs sync-github \\\n            --repo \"$PRIMARY_REPO\" \\\n            --branch \"$SYNC_BRANCH\" \\\n            --pr \\\n            --message \"$COMMIT_MSG\"\n        env:\n          GITHUB_TOKEN: ${{ secrets.SYNC_TOKEN }}\n          GH_TOKEN: ${{ secrets.SYNC_TOKEN }}\n          PRIMARY_REPO: ${{ inputs.primary-repo }}\n          SYNC_BRANCH: ${{ inputs.sync-branch }}\n\n      - name: Sync secondary repos (PR)\n        if: ${{ inputs.secondary-repos != '' }}\n        run: |\n          GIT_NAME=$(gh api user --jq .name 2>/dev/null || echo \"github-actions[bot]\")\n          GIT_EMAIL=$(gh api user --jq '\"\\(.id)+\\(.login)@users.noreply.github.com\"' 2>/dev/null || echo \"41898282+github-actions[bot]@users.noreply.github.com\")\n          COMMIT_MSG=\"chore: sync from theholocron/holocron\"$'\\n\\n'\"Signed-off-by: $GIT_NAME <$GIT_EMAIL>\"\n          for repo in $SECONDARY_REPOS; do\n            node packages/cli/dist/cli.mjs sync-github \\\n              --repo \"$repo\" \\\n              --branch \"$SYNC_BRANCH\" \\\n              --pr \\\n              --message \"$COMMIT_MSG\"\n          done\n        env:\n          GITHUB_TOKEN: ${{ secrets.SYNC_TOKEN }}\n          GH_TOKEN: ${{ secrets.SYNC_TOKEN }}\n          SECONDARY_REPOS: ${{ inputs.secondary-repos }}\n          SYNC_BRANCH: ${{ inputs.sync-branch }}\n";
+//#endregion
+//#region src/templates/workflows/test.yml
+var test_default$1 = "name: Test\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      CODECOV_TOKEN:\n        required: false\n\njobs:\n  unit:\n    name: Run tests and collect coverage\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: pnpm test -- --coverage\n        name: Run tests with coverage\n\n      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0\n        name: Upload coverage to Codecov\n        with:\n          token: ${{ secrets.CODECOV_TOKEN }}\n\n      - uses: codecov/test-results-action@0fa95f0e1eeaafde2c782583b36b28ad0d8c77d3 # v1\n        name: Upload test results to Codecov\n        if: ${{ !cancelled() }}\n        with:\n          token: ${{ secrets.CODECOV_TOKEN }}\n          files: '**/test-report.junit.xml'\n";
+//#endregion
+//#region src/templates/workflows/typecheck.yml
+var typecheck_default$1 = "name: Typecheck\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n\njobs:\n  typecheck:\n    name: tsc --noEmit\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: pnpm typecheck\n        name: Type check\n";
+//#endregion
 //#region src/templates/index.ts
 /**
 * All reusable workflow and composite action content bundled as string
 * constants so the CLI can push them to theholocron/.github without
 * needing filesystem access at runtime.
 *
-* These are the sources of truth — the YAML files in this directory
-* have been removed in favour of these constants.
+* Content lives in standalone .yml files; the rawYml rollup plugin
+* inlines them as string exports at build time.
 */
 const ACTIONS = {
-	"setup/action": `\
-name: Setup
-description: Prepare the environment and install project dependencies.
-
-inputs:
-  node-version:
-    description: Node.js version
-    required: false
-    default: "22.x"
-
-runs:
-  using: composite
-
-  steps:
-    - uses: theholocron/.github/.github/actions/setup-node@main
-      with:
-        node-version: \${{ inputs.node-version }}
-
-    - uses: theholocron/.github/.github/actions/install@main
-`,
-	"install/action": `\
-name: Install dependencies
-description: Install project dependencies with pnpm frozen lockfile.
-
-runs:
-  using: composite
-
-  steps:
-    - name: Install dependencies
-      if: \${{ hashFiles('pnpm-lock.yaml') != '' }}
-      shell: bash
-      run: pnpm install --frozen-lockfile
-`,
-	"setup-node/action": `\
-name: Setup Node
-description: Install pnpm and Node.js with pnpm dependency caching.
-
-inputs:
-  node-version:
-    description: Node.js version
-    required: false
-    default: "22.x"
-
-runs:
-  using: composite
-
-  steps:
-    - name: Setup pnpm
-      if: \${{ hashFiles('pnpm-lock.yaml') != '' }}
-      uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
-
-    - name: Setup Node.js
-      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-      with:
-        node-version: \${{ hashFiles('.node-version') != '' && '' || inputs.node-version }}
-        node-version-file: \${{ hashFiles('.node-version') != '' && '.node-version' || '' }}
-        cache: \${{ hashFiles('pnpm-lock.yaml') != '' && 'pnpm' || '' }}
-
-    - name: Add node_modules/.bin to PATH
-      shell: bash
-      run: echo "$GITHUB_WORKSPACE/node_modules/.bin" >> $GITHUB_PATH
-`
+	"setup/action": setup_default,
+	"install/action": install_default,
+	"setup-node/action": setup_node_default
 };
 const REUSABLE_WORKFLOWS = {
-	audit: `\
-name: Audit
-
-on: # yamllint disable-line rule:truthy
-  workflow_call:
-    inputs:
-      build-script:
-        description: Script to build and upload bundle stats to Codecov
-        type: string
-        required: false
-        default: pnpm build
-    secrets:
-      CODECOV_TOKEN:
-        required: false
-
-jobs:
-  bundle-size:
-    name: Audit the bundle size
-    permissions:
-      contents: read
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    concurrency:
-      group: audit-\${{ github.ref }}
-      cancel-in-progress: true
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        name: Checkout repository
-        with:
-          fetch-depth: 0
-
-      - uses: theholocron/.github/.github/actions/setup@main
-        name: Setup
-
-      - run: eval "$BUILD_SCRIPT"
-        name: Build and upload bundle stats
-        env:
-          BUILD_SCRIPT: \${{ inputs.build-script }}
-          CODECOV_TOKEN: \${{ secrets.CODECOV_TOKEN }}
-`,
-	bookkeeping: `\
-name: Bookkeeping
-
-on: # yamllint disable-line rule:truthy
-  workflow_call:
-    inputs:
-      configuration-path:
-        description: Path to the labeler configuration file in the calling repo
-        type: string
-        required: false
-        default: .github/labeler.yml
-
-jobs:
-  label:
-    name: Apply Labels
-    permissions:
-      contents: read
-      issues: write
-      pull-requests: write
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    concurrency:
-      group: bookkeeping-\${{ github.event.pull_request.number || github.event.issue.number }}
-      cancel-in-progress: true
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          sparse-checkout: \${{ inputs.configuration-path || '.github/labeler.yml' }}
-          sparse-checkout-cone-mode: false
-
-      - uses: github/issue-labeler@c1b0f9f52a63158c4adc09425e858e87b32e9685 # v3.4
-        if: \${{ hashFiles(inputs.configuration-path || '.github/labeler.yml') != '' }}
-        # v3.4 bundles Node 20; allow it to run under Actions' current default.
-        env:
-          ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true
-        with:
-          # Fall back to default path when triggered directly (not via workflow_call)
-          # because inputs.* defaults only apply on workflow_call events.
-          configuration-path: \${{ inputs.configuration-path || '.github/labeler.yml' }}
-          include-title: 1
-          include-body: 0
-          sync-labels: 1
-          enable-versioned-regex: 0
-          repo-token: \${{ github.token }}
-`,
-	codeql: `\
-name: CodeQL
-
-on: # yamllint disable-line rule:truthy
-  workflow_call:
-    inputs:
-      language:
-        description: CodeQL language to analyze
-        type: string
-        required: false
-        default: javascript-typescript
-
-jobs:
-  analyze:
-    name: Analyze (\${{ inputs.language }})
-    permissions:
-      actions: read
-      contents: read
-      security-events: write
-    runs-on: ubuntu-latest
-    timeout-minutes: 45
-    # Do not cancel in-progress security scans.
-    concurrency:
-      group: codeql-\${{ github.ref }}
-      cancel-in-progress: false
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        name: Checkout repository
-
-      - uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
-        name: Initialize CodeQL
-        with:
-          languages: \${{ inputs.language }}
-
-      - uses: github/codeql-action/autobuild@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
-        name: Autobuild
-
-      - uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
-        name: Analyze
-        with:
-          category: /language:\${{ inputs.language }}
-`,
-	dependencies: `\
-name: Dependencies
-
-on: # yamllint disable-line rule:truthy
-  workflow_call:
-    secrets:
-      merge-token:
-        description: >
-          Optional privileged token for auto-merge. Falls back to GITHUB_TOKEN.
-          Required when branch protection enforces required reviews — GITHUB_TOKEN
-          cannot approve its own PRs.
-        required: false
-
-jobs:
-  dependabot:
-    name: Update the dependencies
-    permissions:
-      contents: write
-      pull-requests: write
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    concurrency:
-      group: dependencies-\${{ github.event.pull_request.number }}
-      cancel-in-progress: true
-    if: github.event.pull_request.user.login == 'dependabot[bot]'
-    steps:
-      - uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
-        name: Fetch Dependabot metadata
-        id: metadata
-
-      - run: gh pr merge --auto --squash "$PR_URL"
-        # --squash is intentional: repo protection sets allow_merge_commit: false,
-        # so --merge would fail on any repo using the standard preset.
-        name: Enable auto-merge for Dependabot PRs
-        if: steps.metadata.outputs.update-type == 'version-update:semver-patch'
-        env:
-          PR_URL: \${{ github.event.pull_request.html_url }}
-          GH_TOKEN: \${{ secrets.merge-token || github.token }}
-`,
-	greetings: `\
-name: Greetings
-
-on: # yamllint disable-line rule:truthy
-  workflow_call:
-
-jobs:
-  greeting:
-    name: Greet first-time contributors
-    permissions:
-      issues: write
-      pull-requests: write
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    # Group by the issue/PR number so duplicate events don't race each other.
-    concurrency:
-      group: greetings-\${{ github.event.issue.number || github.event.pull_request.number }}
-      cancel-in-progress: false
-    steps:
-      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        name: Greet on first contribution
-        with:
-          script: |
-            // Only greet on the initial open — ignore synchronize, reopened, etc.
-            if (context.payload.action !== 'opened') return;
-
-            const actor = context.actor;
-            const { owner, repo } = context.repo;
-
-            // Payload inspection is more reliable than context.eventName for detecting
-            // whether this is an issue vs. PR event — works regardless of how GitHub
-            // propagates event names through workflow_call chains.
-            const isIssue = !!context.payload.issue && !context.payload.pull_request;
-            // listForRepo returns both issues and PRs (GitHub treats PRs as issues),
-            // sorted newest-first. Filter by type to track first-issue and first-PR
-            // independently, and avoid search-index eventual-consistency lag.
-            const { data: recent } = await github.rest.issues.listForRepo({
-              owner, repo,
-              creator: actor,
-              state: 'all',
-              per_page: 100
-            });
-
-            const sameType = recent.filter(item =>
-              isIssue ? !item.pull_request : !!item.pull_request
-            );
-
-            if (sameType.length !== 1) return;
-            const body = isIssue
-              ? \`Hey @\${actor}!\\n\\nWe really appreciate you taking the time to report an issue. The collaborators on this project attempt to help as many people as possible, but we are a limited number of volunteers, so it is possible that this will not be addressed as swiftly.\\n\\nYour patience is much appreciated and we will get back to you as quickly as possible.\`
-              : \`Hey @\${actor}!\\n\\nWe really appreciate you taking the time to help out with this PR. The collaborators on this project attempt to help as many people as possible, but we are a limited number of volunteers, so it is possible that this will not be addressed as swiftly.\\n\\nYour patience is much appreciated and we will get back to you as quickly as possible.\`;
-
-            await github.rest.issues.createComment({
-              owner,
-              repo,
-              issue_number: context.issue.number,
-              body
-            });
-`,
-	lint: `\
-name: Lint
-
-on: # yamllint disable-line rule:truthy
-  workflow_call:
-    inputs:
-      prettier-config:
-        type: string
-        required: false
-        default: prettier.config.js
-      yaml-config:
-        type: string
-        required: false
-        default: yamllint.config.yml
-      enable-auto-commit:
-        description: Auto-commit super-linter fixes via GPG-signed commit
-        type: boolean
-        required: false
-        default: false
-    secrets:
-      SUPER_LINTER_GPG_PRIVATE_KEY:
-        required: false
-      SUPER_LINTER_GPG_PASSPHRASE:
-        required: false
-
-jobs:
-  super-lint:
-    name: Lint entire codebase
-    permissions:
-      contents: write
-      statuses: write
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    env:
-      GPG_KEY_SET: \${{ secrets.SUPER_LINTER_GPG_PRIVATE_KEY != '' }}
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        name: Checkout repository
-        with:
-          fetch-depth: 0
-          token: \${{ github.token }}
-
-      - uses: theholocron/.github/.github/actions/setup@main
-        name: Setup
-        if: \${{ hashFiles('pnpm-lock.yaml') != '' }}
-
-      - uses: super-linter/super-linter/slim@4ce20838b8ab83717e78138c5b3a1407148e0918 # v8.7.0
-        name: Run Super Linter
-        env:
-          GITHUB_TOKEN: \${{ github.token }}
-          DEFAULT_BRANCH: \${{ github.event.pull_request.base.ref || github.event.repository.default_branch }}
-          ANNOTATE_ONLY: true
-          DISABLE_COMMENTS: false
-          IGNORE_GITIGNORED_FILES: true
-          LINTER_RULES_PATH: /
-          EDITORCONFIG_FILE_NAME: ".editorconfig-checker.json"
-          FIX_ENV: true
-          FIX_GRAPHQL_PRETTIER: true
-          FIX_HTML_PRETTIER: true
-          FIX_JAVASCRIPT_PRETTIER: true
-          FIX_JSX_PRETTIER: true
-          FIX_MARKDOWN_PRETTIER: true
-          FIX_TSX: true
-          FIX_TYPESCRIPT_PRETTIER: true
-          PRETTIER_CONFIG: \${{ inputs.prettier-config }}
-          VALIDATE_DOCKERFILE: true
-          VALIDATE_EDITORCONFIG: true
-          VALIDATE_ENV: true
-          VALIDATE_GIT_COMMITLINT: true
-          VALIDATE_GIT_MERGE_CONFLICT_MARKERS: true
-          VALIDATE_GITHUB_ACTIONS: true
-          VALIDATE_GITLEAKS: true
-          VALIDATE_GRAPHQL_PRETTIER: true
-          VALIDATE_HTML_PRETTIER: true
-          VALIDATE_JAVASCRIPT_PRETTIER: true
-          VALIDATE_JSX_PRETTIER: true
-          VALIDATE_MARKDOWN_PRETTIER: true
-          VALIDATE_TSX: true
-          VALIDATE_TYPESCRIPT_PRETTIER: true
-          VALIDATE_YAML: true
-          YAML_CONFIG_FILE: \${{ inputs.yaml-config }}
-
-      - uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0
-        name: Import GPG Key
-        # Conditions mirror auto-commit exactly — no point importing GPG if the
-        # commit step will be skipped (fork PR, default branch, or secret unset).
-        if: >
-          inputs.enable-auto-commit == true &&
-          github.event.pull_request != null &&
-          github.event.pull_request.head.repo.full_name == github.repository &&
-          github.ref_name != github.event.repository.default_branch &&
-          env.GPG_KEY_SET == 'true'
-        with:
-          git_user_signingkey: true
-          git_commit_gpgsign: true
-          GPG_PRIVATE_KEY: \${{ secrets.SUPER_LINTER_GPG_PRIVATE_KEY }}
-          PASSPHRASE: \${{ secrets.SUPER_LINTER_GPG_PASSPHRASE }}
-
-      - uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d # v7.2.0
-        name: Commit and push linting fixes
-        if: >
-          inputs.enable-auto-commit == true &&
-          github.event.pull_request != null &&
-          github.event.pull_request.head.repo.full_name == github.repository &&
-          github.ref_name != github.event.repository.default_branch &&
-          env.GPG_KEY_SET == 'true'
-        with:
-          branch: \${{ github.event.pull_request.head.ref || github.head_ref || github.ref }}
-          commit_message: "chore: fix linting issues\\n\\nSigned-off-by: super-linter <super-linter@super-linter.dev>"
-          commit_options: "--no-verify"
-          commit_user_name: super-linter
-          commit_user_email: super-linter@super-linter.dev
-`,
-	release: `\
-name: Release
-
-# Semantic-release with OIDC Trusted Publishing — no NPM_TOKEN required.
-# The calling repo must have a .releaserc.json that configures branches,
-# plugins, and any publish options. npm@11+ is installed to support OIDC.
-
-on: # yamllint disable-line rule:truthy
-  workflow_call:
-    inputs:
-      run-build:
-        description: Run \`pnpm build\` before releasing
-        type: boolean
-        required: false
-        default: true
-    secrets:
-      SYNC_TOKEN:
-        description: >
-          Optional PAT with Contents write access. Required when the default
-          branch is protected by a ruleset — github.token cannot push through
-          rulesets, but a PAT with admin bypass can. Falls back to github.token.
-        required: false
-
-jobs:
-  release:
-    name: Semantic release
-    permissions:
-      contents: write
-      id-token: write
-      issues: write
-      pull-requests: write
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    # Do not cancel in-progress releases — a partial release is worse than a slow one.
-    concurrency:
-      group: release-\${{ github.ref }}
-      cancel-in-progress: false
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        name: Checkout repository
-        with:
-          fetch-depth: 0
-          # Use SYNC_TOKEN when available — git push (tags, release commits)
-          # uses the checkout credential, not GITHUB_TOKEN env var. The
-          # built-in github.token cannot push through branch protection rulesets.
-          token: \${{ secrets.SYNC_TOKEN || github.token }}
-
-      - uses: theholocron/.github/.github/actions/setup@main
-        name: Setup
-
-      - name: Configure git identity
-        run: |
-          GIT_NAME=$(gh api user --jq .name 2>/dev/null || echo "github-actions[bot]")
-          GIT_EMAIL=$(gh api user --jq '"\\(.id)+\\(.login)@users.noreply.github.com"' 2>/dev/null || echo "41898282+github-actions[bot]@users.noreply.github.com")
-          git config --global user.name "$GIT_NAME"
-          git config --global user.email "$GIT_EMAIL"
-          git config --global format.signoff true
-        env:
-          GH_TOKEN: \${{ secrets.SYNC_TOKEN || github.token }}
-
-      - run: npm install -g npm@11 sigstore
-        name: Upgrade npm for OIDC support
-        # sigstore is required by libnpmpublish/provenance.js at module parse
-        # time — before any config takes effect. Some npm 11.x builds stopped
-        # bundling it; installing it globally into the same prefix ensures it
-        # resolves regardless of npm version. (Discovered 2026-07-09.)
-
-      - run: pnpm build
-        name: Build
-        if: \${{ inputs.run-build == true }}
-
-      - run: npx semantic-release
-        name: Release
-        env:
-          # Prefer SYNC_TOKEN (a PAT with Contents write) when available —
-          # the built-in github.token cannot push to protected default branches
-          # because rulesets block non-PAT pushes. Falls back to github.token
-          # for repos without branch protection.
-          GITHUB_TOKEN: \${{ secrets.SYNC_TOKEN || github.token }}
-          NPM_CONFIG_PROVENANCE: true
-`,
-	review: `\
-name: Review
-
-# ReviewDog is the annotation layer — posts inline PR diff annotations.
-# Runs on pull_request only: inline annotations require PR context,
-# and branch protection ensures all changes go through PRs anyway.
-# super-linter (lint.yml) is the CI gate covering push + PR events.
-# Gitleaks and YAML are intentionally duplicated: super-linter gates
-# merges; ReviewDog surfaces exact line annotations in the PR diff.
-
-on: # yamllint disable-line rule:truthy
-  workflow_call:
-
-concurrency:
-  group: review-\${{ github.workflow }}-\${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  reviewdog:
-    name: Review PRs
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    permissions:
-      contents: read
-      checks: write
-      pull-requests: write
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          fetch-depth: 0
-
-      - name: Setup
-        if: \${{ hashFiles('pnpm-lock.yaml') != '' }}
-        uses: theholocron/.github/.github/actions/setup@main
-
-      - name: Install ReviewDog
-        uses: reviewdog/action-setup@d8a7baabd7f3e8544ee4dbde3ee41d0011c3a93f # v1
-        with:
-          reviewdog_version: latest
-
-      # Detect which tools are relevant for this repo, excluding node_modules.
-      # hashFiles('**/*') recurses into node_modules/.pnpm and produces false
-      # positives for repos that don't own those file types.
-      # -print -quit stops find after the first match without a pipe, avoiding
-      # the SIGPIPE/pipefail exit-141 that find|head-1 triggers under
-      # GitHub Actions' default bash --noprofile --norc -e -o pipefail mode.
-      - name: Detect project features
-        id: detect
-        shell: bash
-        run: |
-          has() { find . -not -path '*/node_modules/*' -name "$1" -print -quit 2>/dev/null | grep -q .; }
-          has_ext() { find . -not -path '*/node_modules/*' -name "$1" -print -quit 2>/dev/null | grep -q .; }
-          { { has 'eslint.config.js' || has 'eslint.config.mjs' || has 'eslint.config.cjs' || \\
-              has 'eslint.config.ts' || has '.eslintrc' || has '.eslintrc.js' || \\
-              has '.eslintrc.cjs' || has '.eslintrc.json' || has '.eslintrc.yaml' || \\
-              has '.eslintrc.yml'; } && grep -qF '"eslint":' package.json 2>/dev/null; } && echo "eslint=true" >> "$GITHUB_OUTPUT" || echo "eslint=false" >> "$GITHUB_OUTPUT"
-          { has 'tsconfig.json' && grep -qF '"typescript":' package.json 2>/dev/null; } && echo "tsconfig=true" >> "$GITHUB_OUTPUT" || echo "tsconfig=false" >> "$GITHUB_OUTPUT"
-          has_ext '*.sh' && echo "shell=true" >> "$GITHUB_OUTPUT" || echo "shell=false" >> "$GITHUB_OUTPUT"
-          has 'Dockerfile' || has_ext '*.Dockerfile' || has 'Containerfile' && \\
-            echo "docker=true" >> "$GITHUB_OUTPUT" || echo "docker=false" >> "$GITHUB_OUTPUT"
-          has_ext '.env*' && echo "dotenv=true" >> "$GITHUB_OUTPUT" || echo "dotenv=false" >> "$GITHUB_OUTPUT"
-          has_ext '*.md' && echo "markdown=true" >> "$GITHUB_OUTPUT" || echo "markdown=false" >> "$GITHUB_OUTPUT"
-
-      #
-      # Always applicable
-      #
-
-      - name: Gitleaks (secrets)
-        uses: reviewdog/action-gitleaks@2b7b5685e3e3eecddab5d30cfa04f18123031421 # v1
-        with:
-          reporter: github-pr-check
-          gitleaks_flags: --log-opts=\${{ github.event.pull_request.base.sha }}..\${{ github.event.pull_request.head.sha }}
-
-      - name: YamlLint
-        if: \${{ hashFiles('yamllint.config.yml') != '' }}
-        uses: reviewdog/action-yamllint@b5f7217d8c815ae374d1d55840d5e569d82f01f0 # v1
-        with:
-          reporter: github-pr-check
-          yamllint_flags: -c \${{ github.workspace }}/yamllint.config.yml \${{ github.workspace }}
-
-      - name: ActionLint (GitHub Actions)
-        if: \${{ hashFiles('.github/workflows/*.yml', '.github/workflows/*.yaml') != '' }}
-        uses: reviewdog/action-actionlint@6fb7acc99f4a1008869fa8a0f09cfca740837d9d # v1
-        with:
-          reporter: github-pr-check
-
-      #
-      # TypeScript / JavaScript
-      #
-
-      - name: ESLint
-        if: steps.detect.outputs.eslint == 'true'
-        uses: reviewdog/action-eslint@556a3fdaf8b4201d4d74d406013386aa4f7dab96 # v1.34.0
-        with:
-          reporter: github-pr-check
-          eslint_flags: .
-
-      - name: TypeScript
-        if: steps.detect.outputs.tsconfig == 'true'
-        uses: EPMatt/reviewdog-action-tsc@63d923a3c5b4497671940b8874f58a404e2351b5 # v1
-        with:
-          reporter: github-pr-check
-
-      #
-      # Shell
-      #
-
-      - name: ShellCheck
-        if: steps.detect.outputs.shell == 'true'
-        uses: reviewdog/action-shellcheck@4c07458293ac342d477251099501a718ae5ef86e # v1
-        with:
-          reporter: github-pr-check
-          fail_level: none
-
-      #
-      # Docker
-      #
-
-      - name: Hadolint
-        if: steps.detect.outputs.docker == 'true'
-        uses: reviewdog/action-hadolint@1b2cfa6ba72072ad35158d7ff3aa49bbdc03506d # v1
-        with:
-          reporter: github-pr-check
-          fail_level: none
-
-      #
-      # Environment files
-      #
-
-      - name: dotenv-linter
-        if: steps.detect.outputs.dotenv == 'true'
-        uses: dotenv-linter/action-dotenv-linter@afde61cfda2ecffe7bea35837b6f20b956c88689 # v3.0.0
-        with:
-          reporter: github-code-suggestions
-
-      #
-      # Documentation
-      #
-
-      - name: Alex (inclusive language)
-        if: steps.detect.outputs.markdown == 'true'
-        uses: reviewdog/action-alex@347481655add010a2ae302df34b57c9bcfa0d6e4 # v1
-        with:
-          reporter: github-pr-check
-`,
-	stale: `\
-name: Stale
-
-on: # yamllint disable-line rule:truthy
-  workflow_call:
-    inputs:
-      days-before-stale:
-        description: Days of inactivity before an issue is marked stale
-        type: number
-        required: false
-        default: 30
-      days-before-close:
-        description: Days of inactivity after stale label before closing
-        type: number
-        required: false
-        default: 5
-
-jobs:
-  stale:
-    name: Mark stale issues and pull requests
-    permissions:
-      contents: write
-      issues: write
-      pull-requests: write
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0
-        name: Run Stale
-        with:
-          close-issue-message: >
-            This issue was closed because it has been stalled for
-            \${{ inputs.days-before-close }} days with no activity.
-          days-before-close: \${{ inputs.days-before-close }}
-          days-before-stale: \${{ inputs.days-before-stale }}
-          exempt-all-pr-milestones: true
-          stale-issue-label: wontfix
-          stale-issue-message: >
-            This issue is stale because it has been open \${{ inputs.days-before-stale }}
-            days with no activity. Remove the stale label or comment, or this will be
-            closed in \${{ inputs.days-before-close }} days.
-          stale-pr-label: wontfix
-          stale-pr-message: >
-            This PR is stale because it has been open \${{ inputs.days-before-stale }}
-            days with no activity. Remove the stale label or comment, or this will be
-            closed in \${{ inputs.days-before-close }} days.
-`,
-	test: `\
-name: Test
-
-on: # yamllint disable-line rule:truthy
-  workflow_call:
-    secrets:
-      CODECOV_TOKEN:
-        required: false
-
-jobs:
-  unit:
-    name: Run tests and collect coverage
-    permissions:
-      contents: read
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        name: Checkout repository
-        with:
-          fetch-depth: 0
-
-      - uses: theholocron/.github/.github/actions/setup@main
-        name: Setup
-
-      - run: pnpm test -- --coverage
-        name: Run tests with coverage
-
-      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
-        name: Upload coverage to Codecov
-        with:
-          token: \${{ secrets.CODECOV_TOKEN }}
-
-      - uses: codecov/test-results-action@0fa95f0e1eeaafde2c782583b36b28ad0d8c77d3 # v1
-        name: Upload test results to Codecov
-        if: \${{ !cancelled() }}
-        with:
-          token: \${{ secrets.CODECOV_TOKEN }}
-          files: '**/test-report.junit.xml'
-`,
-	"sync-github": `\
-name: Sync GitHub Templates
-
-# Builds the holocron CLI from source and pushes updated workflow templates
-# and composite actions to downstream .github repos. Runs whenever the
-# template source files change on main or alpha.
-#
-# Secrets required:
-#   SYNC_TOKEN — fine-grained PAT (resource owner: org) with:
-#                  Contents:      Read and write  (git trees, blobs, refs)
-#                  Pull requests: Read and write  (open sync PR)
-#                  Workflows:     Read and write  (write .github/workflows/*.yml)
-
-on: # yamllint disable-line rule:truthy
-  workflow_call:
-    inputs:
-      primary-repo:
-        description: >
-          Primary .github repo — receives composite actions, reusable workflows,
-          and thin-caller templates. Requires a PR (branch protection assumed).
-        type: string
-        required: false
-        default: theholocron/.github
-      secondary-repos:
-        description: >
-          Space-separated list of secondary repos (reusable workflows + thin
-          callers only, no composite actions). Changes are delivered via pull
-          request, same as the primary repo.
-        type: string
-        required: false
-        default: ""
-      sync-branch:
-        description: Branch name used for the primary and secondary repo PRs
-        type: string
-        required: false
-        default: chore/sync-templates
-    secrets:
-      SYNC_TOKEN:
-        required: true
-
-jobs:
-  sync:
-    name: Sync templates
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        name: Checkout repository
-
-      - uses: theholocron/.github/.github/actions/setup@main
-        name: Setup
-
-      - run: pnpm build
-        name: Build CLI
-
-      - name: Validate generated workflows
-        run: |
-          node packages/cli/dist/cli.mjs sync-github \\
-            --repo "$PRIMARY_REPO" \\
-            --output-dir /tmp/sync-validate
-          curl -fsSL https://github.com/rhysd/actionlint/releases/download/v1.7.7/actionlint_1.7.7_linux_amd64.tar.gz \\
-            | tar -xz -C /tmp actionlint
-          /tmp/actionlint /tmp/sync-validate/.github/workflows/*.yml
-        env:
-          PRIMARY_REPO: \${{ inputs.primary-repo }}
-
-      - name: Sync primary repo (PR)
-        run: |
-          GIT_NAME=$(gh api user --jq .name 2>/dev/null || echo "github-actions[bot]")
-          GIT_EMAIL=$(gh api user --jq '"\\(.id)+\\(.login)@users.noreply.github.com"' 2>/dev/null || echo "41898282+github-actions[bot]@users.noreply.github.com")
-          COMMIT_MSG="chore: sync from theholocron/holocron"$'\\n\\n'"Signed-off-by: $GIT_NAME <$GIT_EMAIL>"
-          node packages/cli/dist/cli.mjs sync-github \\
-            --repo "$PRIMARY_REPO" \\
-            --branch "$SYNC_BRANCH" \\
-            --pr \\
-            --message "$COMMIT_MSG"
-        env:
-          GITHUB_TOKEN: \${{ secrets.SYNC_TOKEN }}
-          GH_TOKEN: \${{ secrets.SYNC_TOKEN }}
-          PRIMARY_REPO: \${{ inputs.primary-repo }}
-          SYNC_BRANCH: \${{ inputs.sync-branch }}
-
-      - name: Sync secondary repos (PR)
-        if: \${{ inputs.secondary-repos != '' }}
-        run: |
-          GIT_NAME=$(gh api user --jq .name 2>/dev/null || echo "github-actions[bot]")
-          GIT_EMAIL=$(gh api user --jq '"\\(.id)+\\(.login)@users.noreply.github.com"' 2>/dev/null || echo "41898282+github-actions[bot]@users.noreply.github.com")
-          COMMIT_MSG="chore: sync from theholocron/holocron"$'\\n\\n'"Signed-off-by: $GIT_NAME <$GIT_EMAIL>"
-          for repo in $SECONDARY_REPOS; do
-            node packages/cli/dist/cli.mjs sync-github \\
-              --repo "$repo" \\
-              --branch "$SYNC_BRANCH" \\
-              --pr \\
-              --message "$COMMIT_MSG"
-          done
-        env:
-          GITHUB_TOKEN: \${{ secrets.SYNC_TOKEN }}
-          GH_TOKEN: \${{ secrets.SYNC_TOKEN }}
-          SECONDARY_REPOS: \${{ inputs.secondary-repos }}
-          SYNC_BRANCH: \${{ inputs.sync-branch }}
-`,
-	typecheck: `\
-name: Typecheck
-
-on: # yamllint disable-line rule:truthy
-  workflow_call:
-
-jobs:
-  typecheck:
-    name: tsc --noEmit
-    permissions:
-      contents: read
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        name: Checkout repository
-
-      - uses: theholocron/.github/.github/actions/setup@main
-        name: Setup
-
-      - run: pnpm typecheck
-        name: Type check
-`
+	audit: audit_default$1,
+	bookkeeping: bookkeeping_default$1,
+	codeql: codeql_default$1,
+	dependencies: dependencies_default$1,
+	greetings: greetings_default$1,
+	lint: lint_default$1,
+	release: release_default$1,
+	review: review_default$1,
+	stale: stale_default$1,
+	"sync-github": sync_github_default$1,
+	test: test_default$1,
+	typecheck: typecheck_default$1
+};
+const WORKFLOW_TEMPLATE_PROPERTIES = {
+	bookkeeping: JSON.stringify({
+		name: "Bookkeeping",
+		description: "Label and track issues and pull requests.",
+		iconName: "octicon tag"
+	}, null, 2),
+	"sync-github": JSON.stringify({
+		name: "Sync GitHub Templates",
+		description: "Sync workflow templates and composite actions from the holocron CLI.",
+		iconName: "octicon sync"
+	}, null, 2)
 };
-const WORKFLOW_TEMPLATE_PROPERTIES = { "sync-github": JSON.stringify({
-	name: "Sync GitHub Templates",
-	description: "Sync workflow templates and composite actions from the holocron CLI.",
-	iconName: "octicon sync"
-}, null, 2) };
+//#endregion
+//#region src/commands/dependabot.yml
+var dependabot_default = "# AUTO-GENERATED by holocron — run `holocron setup` to regenerate.\nversion: 2\nupdates:\n  - package-ecosystem: npm\n    directory: /\n    schedule:\n      interval: weekly\n    groups:\n      security-patches:\n        applies-to: security-updates\n        patterns:\n          - \"*\"\n      all-dependencies:\n        update-types:\n          - minor\n          - patch\n\n  - package-ecosystem: github-actions\n    directory: /\n    schedule:\n      interval: weekly\n    groups:\n      all-actions:\n        patterns:\n          - \"*\"\n";
+//#endregion
+//#region src/commands/workflows/audit.yml
+var audit_default = "name: Audit\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\npermissions:\n  contents: read\n\njobs:\n  audit:\n    uses: theholocron/.github/.github/workflows/audit.yml@main\n    secrets: inherit\n";
+//#endregion
+//#region src/commands/workflows/bookkeeping.yml
+var bookkeeping_default = "name: Bookkeeping\n\non: # yamllint disable-line rule:truthy\n  pull_request:\n    types:\n      - opened\n      - edited\n  issues:\n    types:\n      - opened\n      - edited\n\npermissions:\n  contents: read\n  issues: write\n  pull-requests: write\n\njobs:\n  bookkeeping:\n    uses: theholocron/.github/.github/workflows/bookkeeping.yml@main\n    secrets: inherit\n";
+//#endregion
+//#region src/commands/workflows/codeql.yml
+var codeql_default = "name: CodeQL\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches:\n      - main\n  pull_request:\n    branches:\n      - main\n  schedule:\n    - cron: \"0 0 * * 1\"\n\npermissions:\n  actions: read\n  contents: read\n  security-events: write\n\njobs:\n  codeql:\n    uses: theholocron/.github/.github/workflows/codeql.yml@main\n    secrets: inherit\n";
+//#endregion
+//#region src/commands/workflows/dependencies.yml
+var dependencies_default = "name: Dependencies\n\non: # yamllint disable-line rule:truthy\n  pull_request:\n\npermissions:\n  contents: write\n  pull-requests: write\n\njobs:\n  dependencies:\n    uses: theholocron/.github/.github/workflows/dependencies.yml@main\n    secrets: inherit\n";
+//#endregion
+//#region src/commands/workflows/greetings.yml
+var greetings_default = "name: Greetings\n\non: # yamllint disable-line rule:truthy\n  pull_request:\n  issues:\n\npermissions:\n  issues: write\n  pull-requests: write\n\njobs:\n  greetings:\n    uses: theholocron/.github/.github/workflows/greetings.yml@main\n    secrets: inherit\n";
+//#endregion
+//#region src/commands/workflows/lint.yml
+var lint_default = "name: Lint\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\nconcurrency:\n  group: lint-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: write\n  statuses: write\n\njobs:\n  lint:\n    name: Lint\n    uses: theholocron/.github/.github/workflows/lint.yml@main\n    secrets: inherit\n    with:\n      enable-auto-commit: true\n";
+//#endregion
+//#region src/commands/workflows/release.yml
+var release_default = "name: Release\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches:\n      - main\n      - alpha\n  workflow_dispatch:\n\npermissions:\n  contents: write\n  id-token: write\n  issues: write\n  pull-requests: write\n\nconcurrency:\n  group: ${{ github.workflow }}-${{ github.ref }}\n  cancel-in-progress: false\n\njobs:\n  release:\n    uses: theholocron/.github/.github/workflows/release.yml@main\n    secrets: inherit\n";
+//#endregion
+//#region src/commands/workflows/review.yml
+var review_default = "name: Review\n\non: # yamllint disable-line rule:truthy\n  pull_request:\n\nconcurrency:\n  group: review-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n  checks: write\n  pull-requests: write\n\njobs:\n  review:\n    name: Review\n    uses: theholocron/.github/.github/workflows/review.yml@main\n    secrets: inherit\n";
+//#endregion
+//#region src/commands/workflows/stale.yml
+var stale_default = "name: Stale\n\non: # yamllint disable-line rule:truthy\n  schedule:\n    - cron: \"30 1 * * *\"\n\npermissions:\n  contents: write\n  issues: write\n  pull-requests: write\n\njobs:\n  stale:\n    uses: theholocron/.github/.github/workflows/stale.yml@main\n    secrets: inherit\n";
+//#endregion
+//#region src/commands/workflows/sync-github.yml
+var sync_github_default = "name: Sync GitHub Templates\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n    paths:\n      - packages/cli/src/templates/index.ts\n      - packages/cli/src/commands/setup-workflows.ts\n\nconcurrency:\n  group: sync-github-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n\njobs:\n  sync:\n    name: Sync\n    uses: theholocron/.github/.github/workflows/sync-github.yml@main\n    with:\n      secondary-repos: theholocron/.github-private\n    secrets:\n      SYNC_TOKEN: ${{ secrets.SYNC_TOKEN }}\n";
+//#endregion
+//#region src/commands/workflows/test.yml
+var test_default = "name: Test\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\nconcurrency:\n  group: test-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n\njobs:\n  test:\n    name: Test\n    uses: theholocron/.github/.github/workflows/test.yml@main\n    secrets: inherit\n";
+//#endregion
+//#region src/commands/workflows/typecheck.yml
+var typecheck_default = "name: Typecheck\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\nconcurrency:\n  group: typecheck-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n\njobs:\n  typecheck:\n    name: Typecheck\n    uses: theholocron/.github/.github/workflows/typecheck.yml@main\n    secrets: inherit\n";
 //#endregion
 //#region src/commands/setup-workflows.ts
-/**
-* Thin workflow wrapper templates for `holocron setup`.
-*
-* Each entry is a complete `.github/workflows/<name>.yml` that delegates
-* to the corresponding reusable `ci-<name>.yml` in `theholocron/.github`.
-* Files are overwritten on each setup run — they are generated artifacts.
-*/
-const WORKFLOW_REPO = "theholocron/.github";
-const WORKFLOW_REF = "main";
-function ref(name) {
-	return `${WORKFLOW_REPO}/.github/workflows/${name}.yml@${WORKFLOW_REF}`;
-}
 /** Header prepended when holocron setup writes a thin caller to a repo. */
 function workflowHeader() {
 	return [
@@ -1719,254 +974,18 @@ function workflowHeader() {
 	].join("\n");
 }
 const WORKFLOW_TEMPLATES = {
-	lint: `\
-name: Lint
-
-on: # yamllint disable-line rule:truthy
-  push:
-    branches: [main, alpha]
-  pull_request:
-
-concurrency:
-  group: lint-\${{ github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: write
-  statuses: write
-
-jobs:
-  lint:
-    name: Lint
-    uses: ${ref("lint")}
-    secrets: inherit
-    with:
-      enable-auto-commit: true
-`,
-	test: `\
-name: Test
-
-on: # yamllint disable-line rule:truthy
-  push:
-    branches: [main, alpha]
-  pull_request:
-
-concurrency:
-  group: test-\${{ github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  test:
-    name: Test
-    uses: ${ref("test")}
-    secrets: inherit
-`,
-	typecheck: `\
-name: Typecheck
-
-on: # yamllint disable-line rule:truthy
-  push:
-    branches: [main, alpha]
-  pull_request:
-
-concurrency:
-  group: typecheck-\${{ github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  typecheck:
-    name: Typecheck
-    uses: ${ref("typecheck")}
-    secrets: inherit
-`,
-	codeql: `\
-name: CodeQL
-
-on: # yamllint disable-line rule:truthy
-  push:
-    branches:
-      - main
-  pull_request:
-    branches:
-      - main
-  schedule:
-    - cron: "0 0 * * 1"
-
-permissions:
-  actions: read
-  contents: read
-  security-events: write
-
-jobs:
-  codeql:
-    uses: ${ref("codeql")}
-    secrets: inherit
-`,
-	review: `\
-name: Review
-
-on: # yamllint disable-line rule:truthy
-  pull_request:
-
-concurrency:
-  group: review-\${{ github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-  checks: write
-  pull-requests: write
-
-jobs:
-  review:
-    name: Review
-    uses: ${ref("review")}
-    secrets: inherit
-`,
-	release: `\
-name: Release
-
-on: # yamllint disable-line rule:truthy
-  push:
-    branches:
-      - main
-      - alpha
-  workflow_dispatch:
-
-permissions:
-  contents: write
-  id-token: write
-  issues: write
-  pull-requests: write
-
-concurrency:
-  group: \${{ github.workflow }}-\${{ github.ref }}
-  cancel-in-progress: false
-
-jobs:
-  release:
-    uses: ${ref("release")}
-    secrets: inherit
-`,
-	stale: `\
-name: Stale
-
-on: # yamllint disable-line rule:truthy
-  schedule:
-    - cron: "30 1 * * *"
-
-permissions:
-  contents: write
-  issues: write
-  pull-requests: write
-
-jobs:
-  stale:
-    uses: ${ref("stale")}
-    secrets: inherit
-`,
-	greetings: `\
-name: Greetings
-
-on: # yamllint disable-line rule:truthy
-  pull_request:
-  issues:
-
-permissions:
-  issues: write
-  pull-requests: write
-
-jobs:
-  greetings:
-    uses: ${ref("greetings")}
-    secrets: inherit
-`,
-	dependencies: `\
-name: Dependencies
-
-on: # yamllint disable-line rule:truthy
-  pull_request:
-
-permissions:
-  contents: write
-  pull-requests: write
-
-jobs:
-  dependencies:
-    uses: ${ref("dependencies")}
-    secrets: inherit
-`,
-	bookkeeping: `\
-name: Bookkeeping
-
-on: # yamllint disable-line rule:truthy
-  pull_request:
-    types:
-      - opened
-      - edited
-  issues:
-    types:
-      - opened
-      - edited
-
-permissions:
-  contents: read
-  issues: write
-  pull-requests: write
-
-jobs:
-  bookkeeping:
-    uses: ${ref("bookkeeping")}
-    secrets: inherit
-`,
-	audit: `\
-name: Audit
-
-on: # yamllint disable-line rule:truthy
-  push:
-    branches: [main, alpha]
-  pull_request:
-
-permissions:
-  contents: read
-
-jobs:
-  audit:
-    uses: ${ref("audit")}
-    secrets: inherit
-`,
-	"sync-github": `\
-name: Sync GitHub Templates
-
-on: # yamllint disable-line rule:truthy
-  push:
-    branches: [main, alpha]
-    paths:
-      - packages/cli/src/templates/index.ts
-      - packages/cli/src/commands/setup-workflows.ts
-
-concurrency:
-  group: sync-github-\${{ github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  sync:
-    name: Sync
-    uses: ${ref("sync-github")}
-    with:
-      secondary-repos: theholocron/.github-private
-    secrets:
-      SYNC_TOKEN: \${{ secrets.SYNC_TOKEN }}
-`
+	lint: lint_default,
+	test: test_default,
+	typecheck: typecheck_default,
+	codeql: codeql_default,
+	review: review_default,
+	release: release_default,
+	stale: stale_default,
+	greetings: greetings_default,
+	dependencies: dependencies_default,
+	bookkeeping: bookkeeping_default,
+	audit: audit_default,
+	"sync-github": sync_github_default
 };
 const KNOWN_WORKFLOWS = new Set(Object.keys(WORKFLOW_TEMPLATES));
 /**
@@ -2365,7 +1384,7 @@ async function runNpmPublishInitial(input = {}) {
 	const dryRun = input.dryRun ?? false;
 	const otp = input.otp;
 	const env = input.env ?? process.env;
-	const exec = input.exec ?? defaultExec;
+	const exec = input.exec ?? defaultExec$1;
 	const publishArgs = [
 		"-r",
 		"--filter=./packages/*",
@@ -2441,7 +1460,7 @@ function printNextSteps$1(print, env) {
 		print("    https://www.npmjs.com/settings/~/tokens");
 	}
 }
-const defaultExec = async (cmd, args, opts) => {
+const defaultExec$1 = async (cmd, args, opts) => {
 	const result = spawnSync(cmd, args, {
 		cwd: opts.cwd,
 		encoding: "utf8",
@@ -3292,13 +2311,11 @@ export default defineConfig({
 *   2. Slug collision — packages/holocron-plugin-<slug>/ must not exist.
 *   3. Capability sanity — must be one of the 14 known keys; warn for
 *      many-cardinality caps.
-*   4. Prompt — fill in any missing flags via cli-utils / inquirer
-*      (Phase B; Phase A takes fully-populated input).
-*   5. Generate — for each template, write to
+*   4. Generate — for each template, write to
 *      packages/holocron-plugin-<slug>/<path>.
-*   6. Verify (unless --no-verify) — Phase B; runs pnpm install +
+*   5. Verify (unless --no-verify) — runs pnpm install +
 *      pnpm --filter <pkg> typecheck lint test.
-*   7. Print next steps.
+*   6. Print next steps.
 */
 var PluginCreateError = class extends Error {
 	name = "PluginCreateError";
@@ -3421,6 +2438,51 @@ function runPluginCreate(input) {
 		}
 		filesWritten.push(resolvedPath);
 	}
+	if (!input.dryRun && !input.noVerify) {
+		const execFn = input.exec ?? defaultExec;
+		const pkg = `@theholocron/holocron-plugin-${inputs.slug}`;
+		print("");
+		print("  Verifying scaffold…");
+		try {
+			execFn("pnpm", ["install", "--frozen-lockfile=false"], {
+				cwd,
+				stdio: "inherit"
+			});
+			execFn("pnpm", [
+				"--filter",
+				pkg,
+				"typecheck"
+			], {
+				cwd,
+				stdio: "inherit"
+			});
+			execFn("pnpm", [
+				"--filter",
+				pkg,
+				"lint"
+			], {
+				cwd,
+				stdio: "inherit"
+			});
+			execFn("pnpm", [
+				"--filter",
+				pkg,
+				"test"
+			], {
+				cwd,
+				stdio: "inherit"
+			});
+			print("  ✓ scaffold verified");
+		} catch (err) {
+			print(`  ✗ verify failed — ${err instanceof Error ? err.message : String(err)}`);
+			return {
+				status: "fail",
+				packagePath: packageDir,
+				filesWritten,
+				message: "post-scaffold verify failed; inspect output above"
+			};
+		}
+	}
 	if (!input.dryRun) printNextSteps(print, inputs);
 	return {
 		status: "ok",
@@ -3464,6 +2526,12 @@ function defaultWrite(filepath, content) {
 	mkdirSync(path.dirname(filepath), { recursive: true });
 	writeFileSync(filepath, content, "utf8");
 }
+function defaultExec(cmd, args, opts) {
+	execFileSync(cmd, args, {
+		cwd: opts.cwd,
+		stdio: opts.stdio
+	});
+}
 function printNextSteps(print, inputs) {
 	print("");
 	print(`  Scaffolded @theholocron/holocron-plugin-${inputs.slug} (18 files).`);
@@ -3926,33 +2994,6 @@ function labelerConfig() {
 		``
 	].join("\n");
 }
-const DEPENDABOT_CONFIG = `\
-# AUTO-GENERATED by holocron — run \`holocron setup\` to regenerate.
-version: 2
-updates:
-  - package-ecosystem: npm
-    directory: /
-    schedule:
-      interval: weekly
-    groups:
-      security-patches:
-        applies-to: security-updates
-        patterns:
-          - "*"
-      all-dependencies:
-        update-types:
-          - minor
-          - patch
-
-  - package-ecosystem: github-actions
-    directory: /
-    schedule:
-      interval: weekly
-    groups:
-      all-actions:
-        patterns:
-          - "*"
-`;
 const RULESET_NAME = "holocron-default-branch";
 const BALANCED_REPO_SETTINGS = {
 	allow_squash_merge: true,
@@ -4162,7 +3203,7 @@ async function runSetup(input) {
 	if (loader.has("source") && effectivePreset !== "none") {
 		const source = loader.get("source");
 		steps.push(await runStep("source", "write .github/dependabot.yml", dryRun, async () => {
-			await source.writeRepoFile(".github/dependabot.yml", DEPENDABOT_CONFIG);
+			await source.writeRepoFile(".github/dependabot.yml", dependabot_default);
 		}));
 		print(formatStep(steps[steps.length - 1]));
 	}
@@ -4943,15 +3984,40 @@ await yargs(hideBin(process.argv)).scriptName("holocron").usage("$0 <command> [o
 	type: "boolean",
 	default: true,
 	describe: "Run post-scaffold pnpm install + typecheck + lint + test (default true; --no-verify skips)"
-}), (argv) => {
+}), async (argv) => {
 	try {
-		if (!argv.capability || !argv.vendorEnv || !argv.baseUrl) throw new PluginCreateError("Phase A: --capability, --vendor-env, and --base-url are required. Interactive prompts land in Phase B.");
+		const capabilityKeys = Object.keys(CARDINALITY).join(", ");
+		const needsPrompt = !argv.capability || !argv.vendorEnv || !argv.baseUrl;
+		let capability;
+		let vendorEnv;
+		let baseUrl;
+		if (needsPrompt) {
+			const rl = createInterface({
+				input: stdin,
+				output: stdout
+			});
+			const ask = (question) => new Promise((resolve) => rl.question(`  ${question} `, (answer) => resolve(answer.trim())));
+			try {
+				if (!argv.capability) {
+					console.log(`  Available capabilities: ${capabilityKeys}`);
+					capability = await ask("Capability:");
+				} else capability = argv.capability;
+				vendorEnv = argv.vendorEnv ? argv.vendorEnv : await ask(`Vendor-native env var for the ${argv.vendor} token (e.g. MYVENDOR_API_KEY):`);
+				baseUrl = argv.baseUrl ? argv.baseUrl : await ask(`REST base URL for the ${argv.vendor} API (e.g. https://api.myvendor.com):`);
+			} finally {
+				rl.close();
+			}
+		} else {
+			capability = argv.capability;
+			vendorEnv = argv.vendorEnv;
+			baseUrl = argv.baseUrl;
+		}
 		if (runPluginCreate({
 			slug: argv.slug,
 			vendorName: argv.vendor,
-			capability: argv.capability,
-			vendorEnv: argv.vendorEnv,
-			baseUrl: argv.baseUrl,
+			capability,
+			vendorEnv,
+			baseUrl,
 			...argv.tokenEnv ? { tokenEnv: argv.tokenEnv } : {},
 			dryRun: argv.dryRun,
 			noVerify: !argv.verify,