@theholocron/cli 2.0.0-alpha.7 → 2.0.0-alpha.70

package/dist/cli.mjs

@@ -1,12 +1,260 @@
-#!/usr/bin/env -S tsx
-import { n as ProviderApiError, t as CARDINALITY } from "./capabilities-DapaKOlX.mjs";
-import { a as ConfigError, c as resolvePluginPackage, i as setToken, n as getToken, o as resolveConfig, r as listStoredProviders, t as deleteToken } from "./keyring-DwNEmrBc.mjs";
+#!/usr/bin/env node
+import { createRequire } from "node:module";
 import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
+import path, { basename, dirname, join, relative } from "node:path";
 import yargs from "yargs";
 import { hideBin } from "yargs/helpers";
-import path, { join } from "node:path";
-import { spawnSync } from "node:child_process";
-import { readFile, stat } from "node:fs/promises";
+import { createInterface } from "node:readline";
+import { stdin, stdout } from "node:process";
+import { AuthError, ProviderApiError, ProviderApiError as ProviderApiError$1 } from "@theholocron/http-client";
+import { Entry, findCredentials } from "@napi-rs/keyring";
+import ora from "ora";
+import chalk from "chalk";
+import { createHash } from "node:crypto";
+import { createGitHubClient } from "@theholocron/github-client";
+import { execFile, execFileSync, spawnSync } from "node:child_process";
+import { access, copyFile, mkdir, readFile, readdir, rm, stat, symlink, unlink, writeFile } from "node:fs/promises";
+import { pathToFileURL } from "node:url";
+import { promisify } from "node:util";
+//#region src/capabilities/index.ts
+const CARDINALITY = {
+	source: "single",
+	ci: "single",
+	secrets: "single",
+	environments: "single",
+	issues: "single",
+	deployment: "single",
+	storage: "single",
+	auth: "single",
+	vault: "single",
+	dns: "single",
+	tooling: "many",
+	notifications: "many",
+	analytics: "many",
+	observability: "many"
+};
+/**
+* No capabilities are strictly required — repos without secrets (e.g. org
+* community health repos) legitimately omit vault. Plugins validate their
+* own requirements at call time.
+*/
+const REQUIRED_CAPABILITIES = [];
+//#endregion
+//#region src/config.ts
+/**
+* `holocron.config.json` schema, parser, and provider resolution.
+*
+* ESLint-style entry forms:
+*
+*   "source": "github"                              ← single, short
+*   "deployment": ["vercel", { team: "rando" }]    ← single, with options
+*   "notifications": ["slack", "discord"]          ← multi, short
+*   "notifications": [
+*     ["slack",   { channel: "#ops" }],
+*     ["discord", { webhook: "env:HOOK" }]
+*   ]                                              ← multi, with options
+*
+* Discriminator: an array entry is a `[provider, options]` tuple when
+* the length is 2 AND element[1] is a non-array, non-null object.
+* Otherwise it's a multi-provider list (string[] or tuple[]).
+*
+* Validation rules:
+*   - `vault` is REQUIRED (every project has secrets somewhere)
+*   - Entries for `'many'` capabilities are normalized to an array of
+*     normalized tuples; entries for `'single'` capabilities are
+*     normalized to one tuple
+*   - Tokens / secret values never appear in config — providers read
+*     them from env (or pull from `vault` at runtime)
+*/
+var ConfigError = class extends Error {
+	name = "ConfigError";
+};
+const PLUGIN_PREFIX = "@theholocron/holocron-plugin-";
+const COMMUNITY_PREFIX = "holocron-plugin-";
+/**
+* Resolve `"github"` → `"@theholocron/holocron-plugin-github"`.
+* Fully-qualified names (scoped or not) are honored verbatim, which
+* is how third-party plugins published outside the org work.
+*/
+function resolvePluginPackage(provider) {
+	if (!provider) throw new ConfigError("provider name is empty");
+	if (provider.startsWith("@")) return provider;
+	if (provider.startsWith(COMMUNITY_PREFIX)) return provider;
+	if (provider.includes("/")) return provider;
+	return PLUGIN_PREFIX + provider;
+}
+/** A bare `[provider, options]` tuple, with both elements present? */
+function isOptionsTuple(value) {
+	if (!Array.isArray(value)) return false;
+	if (value.length !== 2) return false;
+	if (typeof value[0] !== "string") return false;
+	const opt = value[1];
+	return typeof opt === "object" && opt !== null && !Array.isArray(opt);
+}
+function normalizeEntry(entry) {
+	if (typeof entry === "string") return {
+		provider: entry,
+		packageName: resolvePluginPackage(entry),
+		options: {}
+	};
+	const [provider, options] = entry;
+	return {
+		provider,
+		packageName: resolvePluginPackage(provider),
+		options
+	};
+}
+function resolveEntry(key, raw) {
+	const cardinality = CARDINALITY[key];
+	if (typeof raw === "string") {
+		if (cardinality === "many") throw new ConfigError(`\`${key}\` accepts multiple providers; wrap a single one in an array: ["${raw}"]`);
+		return {
+			cardinality: "single",
+			tuple: normalizeEntry(raw)
+		};
+	}
+	if (!Array.isArray(raw)) throw new ConfigError(`\`${key}\` entry must be a string or array, got ${typeof raw}`);
+	if (isOptionsTuple(raw)) {
+		if (cardinality === "many") return {
+			cardinality: "many",
+			tuples: [normalizeEntry(raw)]
+		};
+		return {
+			cardinality: "single",
+			tuple: normalizeEntry(raw)
+		};
+	}
+	if (cardinality === "single") throw new ConfigError(`\`${key}\` accepts exactly one provider; got a multi-provider list with ${raw.length} entries`);
+	return {
+		cardinality: "many",
+		tuples: raw.map((entry, idx) => {
+			if (typeof entry === "string") return normalizeEntry(entry);
+			if (isOptionsTuple(entry)) return normalizeEntry(entry);
+			throw new ConfigError(`\`${key}[${idx}]\` must be a provider string or [provider, options] tuple`);
+		})
+	};
+}
+function resolveConfig(raw) {
+	if (!raw.name) throw new ConfigError("`name` is required");
+	if (!raw.providers || typeof raw.providers !== "object") throw new ConfigError("`providers` block is required");
+	const providers = {};
+	for (const [key, entry] of Object.entries(raw.providers)) {
+		if (entry === void 0) continue;
+		providers[key] = resolveEntry(key, entry);
+	}
+	for (const required of REQUIRED_CAPABILITIES) if (!providers[required]) throw new ConfigError(`required capability \`${required}\` is missing from providers`);
+	return {
+		name: raw.name,
+		description: raw.description,
+		repo: raw.repo,
+		workflows: raw.workflows,
+		providers,
+		apps: raw.apps ?? [],
+		doctor: raw.doctor ?? {},
+		agent: raw.agent,
+		skills: raw.skills
+	};
+}
+//#endregion
+//#region src/keyring.ts
+/**
+* Keyring-backed bootstrap credential store.
+*
+* Every holocron plugin's bootstrap token (the one it needs before it
+* can talk to its vendor's API) can be stored in the OS keyring under
+* a single reverse-DNS service scope. Managed via `holocron auth`
+* subcommands; consulted at position 4 in every plugin's auth
+* precedence chain (after --token / HOLOCRON_<X>_TOKEN / <native>_TOKEN).
+*
+* See `.notes/tech-auth-bootstrap.spec.md` for the design rationale.
+*
+* Failure model: keyring access is best-effort. Platforms without a
+* supported credential store (some Linux CI images, sandboxed
+* environments) will throw from the underlying library. Every export
+* here catches and returns a null/empty result rather than propagating
+* — the plugin's precedence chain then falls through to
+* env-var-only paths, which is exactly how CI is meant to work.
+*/
+const SERVICE = "com.theholocron.cli";
+/**
+* Store or overwrite a bootstrap token for a provider. Returns true on
+* success, false when the underlying keyring is unsupported or errored.
+*/
+function setToken(provider, token) {
+	try {
+		new Entry(SERVICE, provider).setPassword(token);
+		return true;
+	} catch {
+		return false;
+	}
+}
+/**
+* Read the bootstrap token for a provider. Returns `null` for both
+* "not stored" and "keyring unavailable" — callers can treat them the
+* same way (fall through to env-var precedence).
+*/
+function getToken(provider) {
+	try {
+		return new Entry(SERVICE, provider).getPassword();
+	} catch {
+		return null;
+	}
+}
+/**
+* Delete a stored token. Returns true when a token was removed, false
+* when there was nothing to delete or the keyring is unavailable.
+* Distinguishing the two cases isn't worth the surface area — the
+* command output makes the situation clear either way.
+*/
+function deleteToken(provider) {
+	try {
+		return new Entry(SERVICE, provider).deletePassword();
+	} catch {
+		return false;
+	}
+}
+/**
+* List provider slugs with a stored token in this service scope.
+* Uses the library's `findCredentials(service)` — supported on all
+* platforms the underlying credential store supports.
+*/
+function listStoredProviders() {
+	try {
+		return findCredentials(SERVICE).map((c) => c.account);
+	} catch {
+		return [];
+	}
+}
+//#endregion
+//#region src/ui/progress.ts
+/**
+* Runs `fn`, showing an ora spinner for its duration in TTY environments.
+* In non-TTY environments (CI, pipes, tests) the spinner is skipped entirely.
+*/
+async function withSpinner(label, fn) {
+	if (!process.stdout.isTTY) return fn();
+	const spinner = ora(label).start();
+	try {
+		const result = await fn();
+		spinner.succeed();
+		return result;
+	} catch (err) {
+		spinner.fail();
+		throw err;
+	}
+}
+//#endregion
+//#region src/ui/style.ts
+const style = {
+	success: (msg) => `${chalk.green("✓")} ${msg}`,
+	warn: (msg) => `${chalk.yellow("⚠")} ${msg}`,
+	fail: (msg) => `${chalk.red("✗")} ${msg}`,
+	step: (msg) => `${chalk.cyan("→")} ${msg}`,
+	hint: (msg) => chalk.dim(msg),
+	dim: (msg) => chalk.dim(msg),
+	header: (msg) => chalk.bold(msg)
+};
+//#endregion
 //#region src/commands/auth.ts
 /**
 * `holocron auth <subcommand>` — manage bootstrap credentials in the
@@ -49,11 +297,11 @@ async function runAuthSet(input) {
 	});
 	const packageName = resolvePluginPackage(provider);
 	if (!token) {
-		print(`no token supplied for \`${provider}\`.`);
-		print(`  pass as positional arg: holocron auth set ${provider} <token>`);
-		print(`  or via env: HOLOCRON_${provider.toUpperCase()}_TOKEN / ${provider.toUpperCase()}_TOKEN`);
+		print(style.fail(`no token supplied for \`${provider}\`.`));
+		print(style.hint(`  pass as positional arg: holocron auth set ${provider} <token>`));
+		print(style.hint(`  or via env: HOLOCRON_${provider.toUpperCase()}_TOKEN / ${provider.toUpperCase()}_TOKEN`));
 		const hint = await tryLoadHint(importer, packageName);
-		if (hint) print(`  hint: ${hint}`);
+		if (hint) print(style.hint(`  hint: ${hint}`));
 		return {
 			status: "fail",
 			message: "no token supplied"
@@ -65,27 +313,28 @@ async function runAuthSet(input) {
 		if (typeof module.verifyToken === "function") {
 			const verified = await module.verifyToken(token);
 			if (!verified.ok) {
-				print(`token rejected by ${provider}: ${verified.message}`);
-				if (module.AUTH_HINT) print(`  hint: ${module.AUTH_HINT}`);
+				print(style.fail(`token rejected by ${provider}: ${verified.message}`));
+				if (module.AUTH_HINT) print(style.hint(`  hint: ${module.AUTH_HINT}`));
 				return {
 					status: "fail",
 					message: verified.message
 				};
 			}
 			subject = verified.subject;
-		} else print(`(${provider} plugin has no verifyToken; storing without verification)`);
+		} else print(style.warn(`${provider} plugin has no verifyToken; storing without verification`));
 	} catch (err) {
-		print(`cannot verify token — failed to load ${packageName}: ${err instanceof Error ? err.message : String(err)}`);
-		print(`  storing token anyway; run 'holocron auth check ${provider}' once the plugin is installed`);
+		const msg = err instanceof Error ? err.message : String(err);
+		print(style.warn(`cannot verify token — failed to load ${packageName}: ${msg}`));
+		print(style.hint(`  storing token anyway; run 'holocron auth check ${provider}' once the plugin is installed`));
 	}
 	if (!setToken(provider, token)) {
-		print(`keyring unavailable — token not stored. Use env vars instead.`);
+		print(style.fail(`keyring unavailable — token not stored. Use env vars instead.`));
 		return {
 			status: "fail",
 			message: "keyring unavailable"
 		};
 	}
-	print(`stored ${provider} token${subject ? ` (${subject})` : ""}`);
+	print(style.success(`stored ${provider} token${subject ? ` (${subject})` : ""}`));
 	return {
 		status: "ok",
 		...subject ? { message: subject } : {}
@@ -94,10 +343,10 @@ async function runAuthSet(input) {
 function runAuthUnset(input) {
 	const print = input.print ?? ((l) => console.log(l));
 	if (deleteToken(input.provider)) {
-		print(`removed ${input.provider} token`);
+		print(style.success(`removed ${input.provider} token`));
 		return { status: "ok" };
 	}
-	print(`no stored token for ${input.provider}`);
+	print(style.dim(`no stored token for ${input.provider}`));
 	return {
 		status: "skip",
 		message: "nothing to remove"
@@ -109,7 +358,7 @@ async function runAuthCheck(input) {
 	const { provider } = input;
 	const token = getToken(provider);
 	if (!token) {
-		print(`no stored token for ${provider}`);
+		print(style.dim(`no stored token for ${provider}`));
 		return {
 			status: "skip",
 			message: "no stored token"
@@ -119,29 +368,30 @@ async function runAuthCheck(input) {
 	try {
 		const module = await importer(packageName);
 		if (typeof module.verifyToken !== "function") {
-			print(`${provider}: token stored (plugin has no verifyToken; can't confirm validity)`);
+			print(style.warn(`${provider}: token stored (plugin has no verifyToken; can't confirm validity)`));
 			return {
 				status: "ok",
 				message: "stored, unverified"
 			};
 		}
-		const verified = await module.verifyToken(token);
+		const verify = () => module.verifyToken(token);
+		const verified = input.showSpinner !== false ? await withSpinner(`Verifying ${provider} token…`, verify) : await verify();
 		if (verified.ok) {
-			print(`${provider}: ok — ${verified.subject}`);
+			print(style.success(`${provider}: ok — ${verified.subject}`));
 			return {
 				status: "ok",
 				message: verified.subject
 			};
 		}
-		print(`${provider}: rejected — ${verified.message}`);
-		if (module.AUTH_HINT) print(`  hint: ${module.AUTH_HINT}`);
+		print(style.fail(`${provider}: rejected — ${verified.message}`));
+		if (module.AUTH_HINT) print(style.hint(`  hint: ${module.AUTH_HINT}`));
 		return {
 			status: "fail",
 			message: verified.message
 		};
 	} catch (err) {
 		const msg = err instanceof Error ? err.message : String(err);
-		print(`${provider}: cannot verify — ${msg}`);
+		print(style.fail(`${provider}: cannot verify — ${msg}`));
 		return {
 			status: "fail",
 			message: msg
@@ -153,8 +403,8 @@ async function runAuthList(input = {}) {
 	const importer = input.importer ?? defaultImporter$1;
 	const providers = listStoredProviders();
 	if (providers.length === 0) {
-		print("no stored tokens.");
-		print("run: holocron auth set <provider> <token>");
+		print(style.dim("no stored tokens."));
+		print(style.hint("run: holocron auth set <provider> <token>"));
 		return {
 			status: "ok",
 			message: "none"
@@ -164,9 +414,13 @@ async function runAuthList(input = {}) {
 		const check = await runAuthCheck({
 			provider,
 			importer,
-			print: () => {}
+			print: () => {},
+			showSpinner: false
 		});
-		print(`  ${check.status === "ok" ? "✓" : check.status === "fail" ? "✗" : "·"} ${provider}${check.message ? ` — ${check.message}` : ""}`);
+		const label = `${provider}${check.message ? ` — ${check.message}` : ""}`;
+		if (check.status === "ok") print(`  ${style.success(label)}`);
+		else if (check.status === "fail") print(`  ${style.fail(label)}`);
+		else print(`  ${style.dim(`· ${label}`)}`);
 	}
 	return { status: "ok" };
 }
@@ -225,17 +479,30 @@ var PluginLoader = class {
 	}
 	/** Internal — invoke a plugin's capability factory and return the impl. */
 	async loadOne(key, tuple) {
-		const module = await this.importer(tuple.packageName).catch((err) => {
+		const mod = await this.importer(tuple.packageName).catch((err) => {
 			throw new LoaderError(`failed to import \`${tuple.packageName}\` for capability \`${key}\`: ${err instanceof Error ? err.message : String(err)}`);
 		});
-		if (typeof module.createPlugin !== "function") throw new LoaderError(`\`${tuple.packageName}\` does not export \`createPlugin(options)\``);
-		const factory = module.createPlugin({
-			...this.projectDefaults(),
-			...this.context,
-			...tuple.options
-		}).capabilities[key];
-		if (typeof factory !== "function") throw new LoaderError(`\`${tuple.packageName}\` does not implement the \`${key}\` capability`);
-		return factory();
+		if (isPluginModule(mod)) {
+			const factory = mod.createPlugin({
+				...this.projectDefaults(),
+				...this.context,
+				...tuple.options
+			}).capabilities[key];
+			if (typeof factory !== "function") throw new LoaderError(`\`${tuple.packageName}\` does not implement the \`${key}\` capability`);
+			return factory();
+		}
+		if (isCapabilityConfigModule(mod)) {
+			const cap = mod.default;
+			return this.loadOne(key, {
+				provider: cap.provider,
+				packageName: resolvePluginPackage(cap.provider),
+				options: {
+					...cap.options,
+					...tuple.options
+				}
+			});
+		}
+		throw new LoaderError(`\`${tuple.packageName}\` does not export \`createPlugin(options)\` or a capability config ({ provider, options? })`);
 	}
 	/**
 	* Project-level defaults that get merged into every plugin's options
@@ -244,14 +511,20 @@ var PluginLoader = class {
 	*/
 	projectDefaults() {
 		const defaults = {};
-		if (this.config.project.repo) defaults.repo = this.config.project.repo;
+		if (this.config.repo?.name) defaults.repo = this.config.repo.name;
 		return defaults;
 	}
 };
 /** Default importer — native dynamic import. */
 const defaultImporter = async (pkg) => {
-	return await import(pkg);
+	return import(pkg);
 };
+function isPluginModule(mod) {
+	return typeof mod.createPlugin === "function";
+}
+function isCapabilityConfigModule(mod) {
+	return typeof mod.default?.provider === "string";
+}
 //#endregion
 //#region src/commands/deploy.ts
 async function runDeploy(input) {
@@ -259,12 +532,12 @@ async function runDeploy(input) {
 	const loader = input.loader ?? new PluginLoader(input.loaded.resolved, input.context);
 	await loader.load();
 	const dryRun = input.context.dryRun ?? false;
-	print(`Holocron deploy — branch=${input.branch}${input.target ? `, target=${input.target}` : " (preview)"}${dryRun ? " (dry-run)" : ""}`);
+	print(style.header(`Holocron deploy — branch=${input.branch}${input.target ? `, target=${input.target}` : " (preview)"}${dryRun ? " (dry-run)" : ""}`));
 	if (!loader.has("deployment")) throw new Error("deployment capability is not configured — add a `deployment` provider to holocron.config.json");
 	const deploy = loader.get("deployment");
 	if (dryRun) {
 		const message = `would: ${deploy.providerName}.triggerDeployment(projectId=${input.projectId}, branch=${input.branch}${input.target ? `, target=${input.target}` : ""})`;
-		print(`  … ${message}`);
+		print(`  ${style.dim(`… ${message}`)}`);
 		return {
 			deployment: null,
 			status: "dry-run",
@@ -272,19 +545,19 @@ async function runDeploy(input) {
 		};
 	}
 	try {
-		const record = await deploy.triggerDeployment({
+		const record = await withSpinner(`Deploying ${input.branch}${input.target ? ` → ${input.target}` : ""}…`, () => deploy.triggerDeployment({
 			projectId: input.projectId,
 			branch: input.branch,
 			...input.target ? { target: input.target } : {}
-		});
-		print(`  ✓ ${record.status} — ${record.url}`);
+		}));
+		print(`  ${style.success(`${record.status} — ${record.url}`)}`);
 		return {
 			deployment: record,
 			status: "ok"
 		};
 	} catch (err) {
 		const message = err instanceof Error ? err.message : String(err);
-		print(`  ✗ ${message}`);
+		print(`  ${style.fail(message)}`);
 		return {
 			deployment: null,
 			status: "fail",
@@ -297,11 +570,11 @@ async function runDeploy(input) {
 async function runDoctor(input) {
 	const print = input.print ?? ((line) => console.log(line));
 	const loader = input.loader ?? new PluginLoader(input.loaded.resolved, input.context);
-	await loader.load();
+	await withSpinner("Loading plugins…", () => loader.load());
 	const rows = [];
 	const config = input.loaded.resolved;
-	print(`Holocron doctor — ${config.project.name}`);
-	print(`  config: ${input.loaded.filepath}`);
+	print(style.header(`Holocron doctor — ${config.name}`));
+	print(style.dim(`  config: ${input.loaded.filepath}`));
 	print("");
 	for (const key of loader.loadedKeys()) {
 		const cardinality = CARDINALITY[key];
@@ -321,7 +594,12 @@ async function runDoctor(input) {
 			rows.push(row);
 		}
 	}
-	for (const row of rows) print(`  ${row.status === "ok" ? "✓" : row.status === "fail" ? "✗" : "·"} ${pad(row.capability, 14)} via ${pad(row.provider, 14)}  ${row.message}`);
+	for (const row of rows) {
+		const label = `${pad(row.capability, 14)} via ${pad(row.provider, 14)}  ${row.message}`;
+		if (row.status === "ok") print(`  ${style.success(label)}`);
+		else if (row.status === "fail") print(`  ${style.fail(label)}`);
+		else print(`  ${style.dim(`· ${label}`)}`);
+	}
 	const summary = rows.reduce((acc, r) => {
 		acc[r.status] += 1;
 		return acc;
@@ -330,8 +608,9 @@ async function runDoctor(input) {
 		fail: 0,
 		skip: 0
 	});
+	const summaryLine = `${summary.ok} ok, ${summary.fail} fail, ${summary.skip} skipped`;
 	print("");
-	print(`  ${summary.ok} ok, ${summary.fail} fail, ${summary.skip} skipped`);
+	print(summary.fail > 0 ? style.fail(summaryLine) : style.success(summaryLine));
 	return {
 		rows,
 		summary
@@ -446,6 +725,669 @@ async function runNpmBumpVersions(input) {
 	};
 }
 //#endregion
+//#region src/commands/upgrade-node.ts
+const SKIP_DIRS = /* @__PURE__ */ new Set([
+	"node_modules",
+	".git",
+	"dist",
+	"coverage",
+	"build",
+	".turbo",
+	".next",
+	"out"
+]);
+function patchPackageJson(content, from, to) {
+	let pkg;
+	try {
+		pkg = JSON.parse(content);
+	} catch {
+		return null;
+	}
+	let changed = false;
+	const engines = pkg.engines;
+	if (engines?.node && /^>=\d+(?:\.0\.0)?$/.test(engines.node)) {
+		if (parseInt(engines.node.match(/\d+/)[0], 10) === from) {
+			engines.node = `>=${to}.0.0`;
+			changed = true;
+		}
+	}
+	for (const field of ["devDependencies", "dependencies"]) {
+		const deps = pkg[field];
+		if (!deps?.["@types/node"]) continue;
+		if (deps["@types/node"] === `^${from}.0.0`) {
+			deps["@types/node"] = `^${to}.0.0`;
+			changed = true;
+		}
+	}
+	return changed ? JSON.stringify(pkg, null, 2) + "\n" : null;
+}
+function patchYaml(content, from, to) {
+	const updated = content.replace(/node-version:\s+['"]?(\d+)['"]?/g, (match, ver) => ver === String(from) ? match.replace(String(from), String(to)) : match);
+	return updated !== content ? updated : null;
+}
+function patchPinFile(content, from, to) {
+	const trimmed = content.trim();
+	if (trimmed === String(from) || trimmed.startsWith(`${from}.`)) return `${to}\n`;
+	return null;
+}
+function patchDockerfile(content, from, to) {
+	const updated = content.replace(/^(FROM\s+node:)(\d+)/gm, (match, prefix, ver) => ver === String(from) ? `${prefix}${to}` : match);
+	return updated !== content ? updated : null;
+}
+function patchToolVersions(content, from, to) {
+	const updated = content.replace(/^(nodejs\s+)(\d+)/gm, (match, prefix, ver) => ver === String(from) ? `${prefix}${to}` : match);
+	return updated !== content ? updated : null;
+}
+const PATTERNS = [
+	{
+		matches: (n) => n === "package.json",
+		patch: patchPackageJson
+	},
+	{
+		matches: (n) => n.endsWith(".yml") || n.endsWith(".yaml"),
+		patch: patchYaml
+	},
+	{
+		matches: (n) => n === ".nvmrc" || n === ".node-version",
+		patch: patchPinFile
+	},
+	{
+		matches: (n) => n === "Dockerfile" || n.startsWith("Dockerfile."),
+		patch: patchDockerfile
+	},
+	{
+		matches: (n) => n === ".tool-versions",
+		patch: patchToolVersions
+	}
+];
+function detectFrom(cwd, _readFile) {
+	for (const name of [".nvmrc", ".node-version"]) try {
+		const major = parseInt(_readFile(join(cwd, name)).trim(), 10);
+		if (!isNaN(major)) return major;
+	} catch {}
+	try {
+		const node = JSON.parse(_readFile(join(cwd, "package.json"))).engines?.node;
+		if (node) {
+			const m = node.match(/(\d+)/);
+			if (m) return parseInt(m[1], 10);
+		}
+	} catch {}
+	return null;
+}
+function defaultWalkFiles(dir) {
+	const results = [];
+	function walk(current) {
+		let entries;
+		try {
+			entries = readdirSync(current);
+		} catch {
+			return;
+		}
+		for (const entry of entries) {
+			if (SKIP_DIRS.has(entry)) continue;
+			const abs = join(current, entry);
+			try {
+				if (statSync(abs).isDirectory()) walk(abs);
+				else results.push(abs);
+			} catch {}
+		}
+	}
+	walk(dir);
+	return results;
+}
+async function runUpgradeNode(input) {
+	const print = input.print ?? ((line) => console.log(line));
+	const cwd = input.cwd ?? process.cwd();
+	const { to, dryRun = false, extra = [] } = input;
+	const _readFile = input.readFile ?? ((p) => readFileSync(p, "utf8"));
+	const _writeFile = input.writeFile ?? ((p, c) => writeFileSync(p, c));
+	const _walkFiles = input.walkFiles ?? defaultWalkFiles;
+	const from = input.from ?? detectFrom(cwd, _readFile);
+	if (from === null) return {
+		status: "fail",
+		updated: [],
+		message: "could not detect current Node version — pass --from <major>"
+	};
+	if (from === to) {
+		print(`Already at Node.js ${to} — nothing to do.`);
+		return {
+			status: "ok",
+			updated: []
+		};
+	}
+	print(`Upgrading Node.js ${from} → ${to}${dryRun ? " (dry-run)" : ""}…`);
+	const updated = [];
+	const scanned = [..._walkFiles(cwd), ...extra.map((p) => join(cwd, p))];
+	for (const abs of scanned) {
+		const name = basename(abs);
+		const pattern = PATTERNS.find((p) => p.matches(name));
+		if (!pattern) continue;
+		let content;
+		try {
+			content = _readFile(abs);
+		} catch {
+			continue;
+		}
+		const patched = pattern.patch(content, from, to);
+		if (patched === null) continue;
+		const rel = abs.startsWith(cwd + "/") ? abs.slice(cwd.length + 1) : abs;
+		if (!dryRun) _writeFile(abs, patched);
+		print(`  ${dryRun ? "~" : "✓"} ${rel}`);
+		updated.push(rel);
+	}
+	if (updated.length === 0) print(`  · no files contained Node.js ${from} pins`);
+	return {
+		status: dryRun ? "dry-run" : "ok",
+		updated
+	};
+}
+//#endregion
+//#region src/templates/actions/setup.yml
+var setup_default = "name: Setup\ndescription: Prepare the environment and install project dependencies.\n\ninputs:\n  node-version:\n    description: Node.js version\n    required: false\n    default: \"22.x\"\n\nruns:\n  using: composite\n\n  steps:\n    - uses: theholocron/.github/.github/actions/setup-node@main\n      with:\n        node-version: ${{ inputs.node-version }}\n\n    - uses: theholocron/.github/.github/actions/install@main\n";
+//#endregion
+//#region src/templates/actions/install.yml
+var install_default = "name: Install dependencies\ndescription: Install project dependencies with pnpm frozen lockfile.\n\nruns:\n  using: composite\n\n  steps:\n    - name: Install dependencies\n      if: ${{ hashFiles('pnpm-lock.yaml') != '' }}\n      shell: bash\n      run: pnpm install --frozen-lockfile\n";
+//#endregion
+//#region src/templates/actions/setup-node.yml
+var setup_node_default = "name: Setup Node\ndescription: Install pnpm and Node.js with pnpm dependency caching.\n\ninputs:\n  node-version:\n    description: Node.js version\n    required: false\n    default: \"22.x\"\n\nruns:\n  using: composite\n\n  steps:\n    - name: Setup pnpm\n      if: ${{ hashFiles('pnpm-lock.yaml') != '' }}\n      uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4\n\n    - name: Setup Node.js\n      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4\n      with:\n        node-version: ${{ hashFiles('.node-version') != '' && '' || inputs.node-version }}\n        node-version-file: ${{ hashFiles('.node-version') != '' && '.node-version' || '' }}\n        cache: ${{ hashFiles('pnpm-lock.yaml') != '' && 'pnpm' || '' }}\n\n    - name: Add node_modules/.bin to PATH\n      shell: bash\n      run: echo \"$GITHUB_WORKSPACE/node_modules/.bin\" >> $GITHUB_PATH\n";
+//#endregion
+//#region src/templates/workflows/audit.yml
+var audit_default$1 = "name: Audit\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      build-script:\n        description: Script to build and upload bundle stats to Codecov\n        type: string\n        required: false\n        default: pnpm build\n    secrets:\n      CODECOV_TOKEN:\n        required: false\n\njobs:\n  bundle-size:\n    name: Audit the bundle size\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    concurrency:\n      group: audit-${{ github.ref }}\n      cancel-in-progress: true\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: eval \"$BUILD_SCRIPT\"\n        name: Build and upload bundle stats\n        env:\n          BUILD_SCRIPT: ${{ inputs.build-script }}\n          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}\n";
+//#endregion
+//#region src/templates/workflows/bookkeeping.yml
+var bookkeeping_default$1 = "name: Bookkeeping\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      configuration-path:\n        description: Path to the labeler configuration file in the calling repo\n        type: string\n        required: false\n        default: .github/labeler.yml\n\njobs:\n  label:\n    name: Apply Labels\n    permissions:\n      contents: read\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    concurrency:\n      group: bookkeeping-${{ github.event.pull_request.number || github.event.issue.number }}\n      cancel-in-progress: true\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          sparse-checkout: ${{ inputs.configuration-path || '.github/labeler.yml' }}\n          sparse-checkout-cone-mode: false\n\n      - uses: github/issue-labeler@c1b0f9f52a63158c4adc09425e858e87b32e9685 # v3.4\n        if: ${{ github.event_name == 'pull_request' && hashFiles(inputs.configuration-path || '.github/labeler.yml') != '' }}\n        # v3.4 bundles Node 20; allow it to run under Actions' current default.\n        env:\n          ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true\n        with:\n          # Fall back to default path when triggered directly (not via workflow_call)\n          # because inputs.* defaults only apply on workflow_call events.\n          configuration-path: ${{ inputs.configuration-path || '.github/labeler.yml' }}\n          include-title: 1\n          include-body: 0\n          sync-labels: 1\n          enable-versioned-regex: 0\n          repo-token: ${{ github.token }}\n";
+//#endregion
+//#region src/templates/workflows/codeql.yml
+var codeql_default$1 = "name: CodeQL\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      language:\n        description: CodeQL language to analyze\n        type: string\n        required: false\n        default: javascript-typescript\n\njobs:\n  analyze:\n    name: Analyze (${{ inputs.language }})\n    permissions:\n      actions: read\n      contents: read\n      security-events: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 45\n    # Do not cancel in-progress security scans.\n    concurrency:\n      group: codeql-${{ github.ref }}\n      cancel-in-progress: false\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0\n        name: Initialize CodeQL\n        with:\n          languages: ${{ inputs.language }}\n\n      - uses: github/codeql-action/autobuild@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0\n        name: Autobuild\n\n      - uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0\n        name: Analyze\n        with:\n          category: /language:${{ inputs.language }}\n";
+//#endregion
+//#region src/templates/workflows/dependencies.yml
+var dependencies_default$1 = "name: Dependencies\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      merge-token:\n        description: >\n          Optional privileged token for auto-merge. Falls back to GITHUB_TOKEN.\n          Required when branch protection enforces required reviews — GITHUB_TOKEN\n          cannot approve its own PRs.\n        required: false\n\njobs:\n  dependabot:\n    name: Update the dependencies\n    permissions:\n      contents: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    concurrency:\n      group: dependencies-${{ github.event.pull_request.number }}\n      cancel-in-progress: true\n    if: github.event.pull_request.user.login == 'dependabot[bot]'\n    steps:\n      - uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0\n        name: Fetch Dependabot metadata\n        id: metadata\n\n      - run: gh pr merge --auto --squash \"$PR_URL\"\n        # --squash is intentional: repo protection sets allow_merge_commit: false,\n        # so --merge would fail on any repo using the standard preset.\n        name: Enable auto-merge for Dependabot PRs\n        if: steps.metadata.outputs.update-type == 'version-update:semver-patch'\n        env:\n          PR_URL: ${{ github.event.pull_request.html_url }}\n          GH_TOKEN: ${{ secrets.merge-token || github.token }}\n";
+//#endregion
+//#region src/templates/workflows/greetings.yml
+var greetings_default$1 = "name: Greetings\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n\njobs:\n  greeting:\n    name: Greet first-time contributors\n    permissions:\n      issues: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    # Group by the issue/PR number so duplicate events don't race each other.\n    concurrency:\n      group: greetings-${{ github.event.issue.number || github.event.pull_request.number }}\n      cancel-in-progress: false\n    steps:\n      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n        name: Greet on first contribution\n        with:\n          script: |\n            // Only greet on the initial open — ignore synchronize, reopened, etc.\n            if (context.payload.action !== 'opened') return;\n\n            const actor = context.actor;\n            const { owner, repo } = context.repo;\n\n            // Payload inspection is more reliable than context.eventName for detecting\n            // whether this is an issue vs. PR event — works regardless of how GitHub\n            // propagates event names through workflow_call chains.\n            const isIssue = !!context.payload.issue && !context.payload.pull_request;\n            // listForRepo returns both issues and PRs (GitHub treats PRs as issues),\n            // sorted newest-first. Filter by type to track first-issue and first-PR\n            // independently, and avoid search-index eventual-consistency lag.\n            const { data: recent } = await github.rest.issues.listForRepo({\n              owner, repo,\n              creator: actor,\n              state: 'all',\n              per_page: 100\n            });\n\n            const sameType = recent.filter(item =>\n              isIssue ? !item.pull_request : !!item.pull_request\n            );\n\n            if (sameType.length !== 1) return;\n            const body = isIssue\n              ? `Hey @${actor}!\\n\\nWe really appreciate you taking the time to report an issue. The collaborators on this project attempt to help as many people as possible, but we are a limited number of volunteers, so it is possible that this will not be addressed as swiftly.\\n\\nYour patience is much appreciated and we will get back to you as quickly as possible.`\n              : `Hey @${actor}!\\n\\nWe really appreciate you taking the time to help out with this PR. The collaborators on this project attempt to help as many people as possible, but we are a limited number of volunteers, so it is possible that this will not be addressed as swiftly.\\n\\nYour patience is much appreciated and we will get back to you as quickly as possible.`;\n\n            await github.rest.issues.createComment({\n              owner,\n              repo,\n              issue_number: context.issue.number,\n              body\n            });\n";
+//#endregion
+//#region src/templates/workflows/lint.yml
+var lint_default$1 = "name: Lint\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      prettier-config:\n        type: string\n        required: false\n        default: prettier.config.js\n      yaml-config:\n        type: string\n        required: false\n        default: yamllint.config.yml\n      enable-auto-commit:\n        description: Auto-commit super-linter fixes via GPG-signed commit\n        type: boolean\n        required: false\n        default: false\n    secrets:\n      SUPER_LINTER_GPG_PRIVATE_KEY:\n        required: false\n      SUPER_LINTER_GPG_PASSPHRASE:\n        required: false\n\njobs:\n  super-lint:\n    name: Lint entire codebase\n    permissions:\n      contents: write\n      statuses: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    env:\n      GPG_KEY_SET: ${{ secrets.SUPER_LINTER_GPG_PRIVATE_KEY != '' }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n          token: ${{ github.token }}\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n        if: ${{ hashFiles('pnpm-lock.yaml') != '' }}\n\n      - uses: super-linter/super-linter/slim@4ce20838b8ab83717e78138c5b3a1407148e0918 # v8.7.0\n        name: Run Super Linter\n        env:\n          GITHUB_TOKEN: ${{ github.token }}\n          DEFAULT_BRANCH: ${{ github.event.pull_request.base.ref || github.event.repository.default_branch }}\n          ANNOTATE_ONLY: true\n          DISABLE_COMMENTS: false\n          IGNORE_GITIGNORED_FILES: true\n          LINTER_RULES_PATH: /\n          EDITORCONFIG_FILE_NAME: \".editorconfig-checker.json\"\n          FIX_ENV: true\n          FIX_GRAPHQL_PRETTIER: true\n          FIX_HTML_PRETTIER: true\n          FIX_JAVASCRIPT_PRETTIER: true\n          FIX_JSX_PRETTIER: true\n          FIX_MARKDOWN_PRETTIER: true\n          FIX_TSX: true\n          FIX_TYPESCRIPT_PRETTIER: true\n          PRETTIER_CONFIG: ${{ inputs.prettier-config }}\n          VALIDATE_DOCKERFILE: true\n          VALIDATE_EDITORCONFIG: true\n          VALIDATE_ENV: true\n          VALIDATE_GIT_COMMITLINT: true\n          VALIDATE_GIT_MERGE_CONFLICT_MARKERS: true\n          VALIDATE_GITHUB_ACTIONS: true\n          VALIDATE_GITLEAKS: true\n          VALIDATE_GRAPHQL_PRETTIER: true\n          VALIDATE_HTML_PRETTIER: true\n          VALIDATE_JAVASCRIPT_PRETTIER: true\n          VALIDATE_JSX_PRETTIER: true\n          VALIDATE_MARKDOWN_PRETTIER: true\n          VALIDATE_TSX: true\n          VALIDATE_TYPESCRIPT_PRETTIER: true\n          VALIDATE_YAML: true\n          YAML_CONFIG_FILE: ${{ inputs.yaml-config }}\n\n      - uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0\n        name: Import GPG Key\n        # Conditions mirror auto-commit exactly — no point importing GPG if the\n        # commit step will be skipped (fork PR, default branch, or secret unset).\n        if: >\n          inputs.enable-auto-commit == true &&\n          github.event.pull_request != null &&\n          github.event.pull_request.head.repo.full_name == github.repository &&\n          github.ref_name != github.event.repository.default_branch &&\n          env.GPG_KEY_SET == 'true'\n        with:\n          git_user_signingkey: true\n          git_commit_gpgsign: true\n          GPG_PRIVATE_KEY: ${{ secrets.SUPER_LINTER_GPG_PRIVATE_KEY }}\n          PASSPHRASE: ${{ secrets.SUPER_LINTER_GPG_PASSPHRASE }}\n\n      - uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d # v7.2.0\n        name: Commit and push linting fixes\n        if: >\n          inputs.enable-auto-commit == true &&\n          github.event.pull_request != null &&\n          github.event.pull_request.head.repo.full_name == github.repository &&\n          github.ref_name != github.event.repository.default_branch &&\n          env.GPG_KEY_SET == 'true'\n        with:\n          branch: ${{ github.event.pull_request.head.ref || github.head_ref || github.ref }}\n          commit_message: \"chore: fix linting issues\\n\\nSigned-off-by: super-linter <super-linter@super-linter.dev>\"\n          commit_options: \"--no-verify\"\n          commit_user_name: super-linter\n          commit_user_email: super-linter@super-linter.dev\n";
+//#endregion
+//#region src/templates/workflows/release.yml
+var release_default$1 = "name: Release\n\n# Semantic-release with OIDC Trusted Publishing — no NPM_TOKEN required.\n# The calling repo must have a .releaserc.json that configures branches,\n# plugins, and any publish options. npm@11+ is installed to support OIDC.\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      run-build:\n        description: Run `pnpm build` before releasing\n        type: boolean\n        required: false\n        default: true\n    secrets:\n      SYNC_TOKEN:\n        description: >\n          Optional PAT with Contents write access. Required when the default\n          branch is protected by a ruleset — github.token cannot push through\n          rulesets, but a PAT with admin bypass can. Falls back to github.token.\n        required: false\n\njobs:\n  release:\n    name: Semantic release\n    permissions:\n      contents: write\n      id-token: write\n      issues: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    # Do not cancel in-progress releases — a partial release is worse than a slow one.\n    concurrency:\n      group: release-${{ github.ref }}\n      cancel-in-progress: false\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n          # Use SYNC_TOKEN when available — git push (tags, release commits)\n          # uses the checkout credential, not GITHUB_TOKEN env var. The\n          # built-in github.token cannot push through branch protection rulesets.\n          token: ${{ secrets.SYNC_TOKEN || github.token }}\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - name: Configure git identity\n        run: |\n          GIT_NAME=$(gh api user --jq .name 2>/dev/null || echo \"github-actions[bot]\")\n          GIT_EMAIL=$(gh api user --jq '\"\\(.id)+\\(.login)@users.noreply.github.com\"' 2>/dev/null || echo \"41898282+github-actions[bot]@users.noreply.github.com\")\n          git config --global user.name \"$GIT_NAME\"\n          git config --global user.email \"$GIT_EMAIL\"\n          git config --global format.signoff true\n        env:\n          GH_TOKEN: ${{ secrets.SYNC_TOKEN || github.token }}\n\n      - run: npm install -g npm@11 sigstore\n        name: Upgrade npm for OIDC support\n        # sigstore is required by libnpmpublish/provenance.js at module parse\n        # time — before any config takes effect. Some npm 11.x builds stopped\n        # bundling it; installing it globally into the same prefix ensures it\n        # resolves regardless of npm version. (Discovered 2026-07-09.)\n\n      - run: pnpm build\n        name: Build\n        if: ${{ inputs.run-build == true }}\n\n      - run: npx semantic-release\n        name: Release\n        env:\n          # Prefer SYNC_TOKEN (a PAT with Contents write) when available —\n          # the built-in github.token cannot push to protected default branches\n          # because rulesets block non-PAT pushes. Falls back to github.token\n          # for repos without branch protection.\n          GITHUB_TOKEN: ${{ secrets.SYNC_TOKEN || github.token }}\n          NPM_CONFIG_PROVENANCE: true\n";
+//#endregion
+//#region src/templates/workflows/review.yml
+var review_default$1 = "name: Review\n\n# ReviewDog is the annotation layer — posts inline PR diff annotations.\n# Runs on pull_request only: inline annotations require PR context,\n# and branch protection ensures all changes go through PRs anyway.\n# super-linter (lint.yml) is the CI gate covering push + PR events.\n# Gitleaks and YAML are intentionally duplicated: super-linter gates\n# merges; ReviewDog surfaces exact line annotations in the PR diff.\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n\nconcurrency:\n  group: review-${{ github.workflow }}-${{ github.ref }}\n  cancel-in-progress: true\n\njobs:\n  reviewdog:\n    name: Review PRs\n    runs-on: ubuntu-latest\n    timeout-minutes: 20\n    permissions:\n      contents: read\n      checks: write\n      pull-requests: write\n\n    steps:\n      - name: Checkout repository\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          fetch-depth: 0\n\n      - name: Setup\n        if: ${{ hashFiles('pnpm-lock.yaml') != '' }}\n        uses: theholocron/.github/.github/actions/setup@main\n\n      - name: Install ReviewDog\n        uses: reviewdog/action-setup@d8a7baabd7f3e8544ee4dbde3ee41d0011c3a93f # v1\n        with:\n          reviewdog_version: latest\n\n      # Detect which tools are relevant for this repo, excluding node_modules.\n      # hashFiles('**/*') recurses into node_modules/.pnpm and produces false\n      # positives for repos that don't own those file types.\n      # -print -quit stops find after the first match without a pipe, avoiding\n      # the SIGPIPE/pipefail exit-141 that find|head-1 triggers under\n      # GitHub Actions' default bash --noprofile --norc -e -o pipefail mode.\n      - name: Detect project features\n        id: detect\n        shell: bash\n        run: |\n          has() { find . -not -path '*/node_modules/*' -name \"$1\" -print -quit 2>/dev/null | grep -q .; }\n          has_ext() { find . -not -path '*/node_modules/*' -name \"$1\" -print -quit 2>/dev/null | grep -q .; }\n          { { has 'eslint.config.js' || has 'eslint.config.mjs' || has 'eslint.config.cjs' || \\\n              has 'eslint.config.ts' || has '.eslintrc' || has '.eslintrc.js' || \\\n              has '.eslintrc.cjs' || has '.eslintrc.json' || has '.eslintrc.yaml' || \\\n              has '.eslintrc.yml'; } && grep -qF '\"eslint\":' package.json 2>/dev/null; } && echo \"eslint=true\" >> \"$GITHUB_OUTPUT\" || echo \"eslint=false\" >> \"$GITHUB_OUTPUT\"\n          { has 'tsconfig.json' && grep -qF '\"typescript\":' package.json 2>/dev/null; } && echo \"tsconfig=true\" >> \"$GITHUB_OUTPUT\" || echo \"tsconfig=false\" >> \"$GITHUB_OUTPUT\"\n          has_ext '*.sh' && echo \"shell=true\" >> \"$GITHUB_OUTPUT\" || echo \"shell=false\" >> \"$GITHUB_OUTPUT\"\n          has 'Dockerfile' || has_ext '*.Dockerfile' || has 'Containerfile' && \\\n            echo \"docker=true\" >> \"$GITHUB_OUTPUT\" || echo \"docker=false\" >> \"$GITHUB_OUTPUT\"\n          has_ext '.env*' && echo \"dotenv=true\" >> \"$GITHUB_OUTPUT\" || echo \"dotenv=false\" >> \"$GITHUB_OUTPUT\"\n          has_ext '*.md' && echo \"markdown=true\" >> \"$GITHUB_OUTPUT\" || echo \"markdown=false\" >> \"$GITHUB_OUTPUT\"\n\n      #\n      # Always applicable\n      #\n\n      - name: Gitleaks (secrets)\n        uses: reviewdog/action-gitleaks@2b7b5685e3e3eecddab5d30cfa04f18123031421 # v1\n        with:\n          reporter: github-pr-check\n          gitleaks_flags: --log-opts=${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }}\n\n      - name: YamlLint\n        if: ${{ hashFiles('yamllint.config.yml') != '' }}\n        uses: reviewdog/action-yamllint@b5f7217d8c815ae374d1d55840d5e569d82f01f0 # v1\n        with:\n          reporter: github-pr-check\n          yamllint_flags: -c ${{ github.workspace }}/yamllint.config.yml ${{ github.workspace }}\n\n      - name: ActionLint (GitHub Actions)\n        if: ${{ hashFiles('.github/workflows/*.yml', '.github/workflows/*.yaml') != '' }}\n        uses: reviewdog/action-actionlint@6fb7acc99f4a1008869fa8a0f09cfca740837d9d # v1\n        with:\n          reporter: github-pr-check\n\n      #\n      # TypeScript / JavaScript\n      #\n\n      - name: ESLint\n        if: steps.detect.outputs.eslint == 'true'\n        uses: reviewdog/action-eslint@556a3fdaf8b4201d4d74d406013386aa4f7dab96 # v1.34.0\n        with:\n          reporter: github-pr-check\n          eslint_flags: .\n\n      - name: TypeScript\n        if: steps.detect.outputs.tsconfig == 'true'\n        uses: EPMatt/reviewdog-action-tsc@63d923a3c5b4497671940b8874f58a404e2351b5 # v1\n        with:\n          reporter: github-pr-check\n\n      #\n      # Shell\n      #\n\n      - name: ShellCheck\n        if: steps.detect.outputs.shell == 'true'\n        uses: reviewdog/action-shellcheck@4c07458293ac342d477251099501a718ae5ef86e # v1\n        with:\n          reporter: github-pr-check\n          fail_level: none\n\n      #\n      # Docker\n      #\n\n      - name: Hadolint\n        if: steps.detect.outputs.docker == 'true'\n        uses: reviewdog/action-hadolint@1b2cfa6ba72072ad35158d7ff3aa49bbdc03506d # v1\n        with:\n          reporter: github-pr-check\n          fail_level: none\n\n      #\n      # Environment files\n      #\n\n      - name: dotenv-linter\n        if: steps.detect.outputs.dotenv == 'true'\n        uses: dotenv-linter/action-dotenv-linter@afde61cfda2ecffe7bea35837b6f20b956c88689 # v3.0.0\n        with:\n          reporter: github-code-suggestions\n\n      #\n      # Documentation\n      #\n\n      - name: Alex (inclusive language)\n        if: steps.detect.outputs.markdown == 'true'\n        uses: reviewdog/action-alex@347481655add010a2ae302df34b57c9bcfa0d6e4 # v1\n        with:\n          reporter: github-pr-check\n";
+//#endregion
+//#region src/templates/workflows/stale.yml
+var stale_default$1 = "name: Stale\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      days-before-stale:\n        description: Days of inactivity before an issue is marked stale\n        type: number\n        required: false\n        default: 30\n      days-before-close:\n        description: Days of inactivity after stale label before closing\n        type: number\n        required: false\n        default: 5\n\njobs:\n  stale:\n    name: Mark stale issues and pull requests\n    permissions:\n      contents: write\n      issues: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    steps:\n      - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0\n        name: Run Stale\n        with:\n          close-issue-message: >\n            This issue was closed because it has been stalled for\n            ${{ inputs.days-before-close }} days with no activity.\n          days-before-close: ${{ inputs.days-before-close }}\n          days-before-stale: ${{ inputs.days-before-stale }}\n          exempt-all-pr-milestones: true\n          stale-issue-label: wontfix\n          stale-issue-message: >\n            This issue is stale because it has been open ${{ inputs.days-before-stale }}\n            days with no activity. Remove the stale label or comment, or this will be\n            closed in ${{ inputs.days-before-close }} days.\n          stale-pr-label: wontfix\n          stale-pr-message: >\n            This PR is stale because it has been open ${{ inputs.days-before-stale }}\n            days with no activity. Remove the stale label or comment, or this will be\n            closed in ${{ inputs.days-before-close }} days.\n";
+//#endregion
+//#region src/templates/workflows/sync-github.yml
+var sync_github_default$1 = "name: Sync GitHub Templates\n\n# Builds the holocron CLI from source and pushes updated workflow templates\n# and composite actions to downstream .github repos. Runs whenever the\n# template source files change on main or alpha.\n#\n# Secrets required:\n#   SYNC_TOKEN — fine-grained PAT (resource owner: org) with:\n#                  Contents:      Read and write  (git trees, blobs, refs)\n#                  Pull requests: Read and write  (open sync PR)\n#                  Workflows:     Read and write  (write .github/workflows/*.yml)\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      primary-repo:\n        description: >\n          Primary .github repo — receives composite actions, reusable workflows,\n          and thin-caller templates. Requires a PR (branch protection assumed).\n        type: string\n        required: false\n        default: theholocron/.github\n      secondary-repos:\n        description: >\n          Space-separated list of secondary repos (reusable workflows + thin\n          callers only, no composite actions). Changes are delivered via pull\n          request, same as the primary repo.\n        type: string\n        required: false\n        default: \"\"\n      sync-branch:\n        description: Branch name used for the primary and secondary repo PRs\n        type: string\n        required: false\n        default: chore/sync-templates\n    secrets:\n      SYNC_TOKEN:\n        required: true\n\njobs:\n  sync:\n    name: Sync templates\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    permissions:\n      contents: read\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: pnpm build\n        name: Build CLI\n\n      - name: Validate generated workflows\n        run: |\n          node packages/cli/dist/cli.mjs sync-github \\\n            --repo \"$PRIMARY_REPO\" \\\n            --output-dir /tmp/sync-validate\n          curl -fsSL https://github.com/rhysd/actionlint/releases/download/v1.7.7/actionlint_1.7.7_linux_amd64.tar.gz \\\n            | tar -xz -C /tmp actionlint\n          /tmp/actionlint /tmp/sync-validate/.github/workflows/*.yml\n        env:\n          PRIMARY_REPO: ${{ inputs.primary-repo }}\n\n      - name: Sync primary repo (PR)\n        run: |\n          GIT_NAME=$(gh api user --jq .name 2>/dev/null || echo \"github-actions[bot]\")\n          GIT_EMAIL=$(gh api user --jq '\"\\(.id)+\\(.login)@users.noreply.github.com\"' 2>/dev/null || echo \"41898282+github-actions[bot]@users.noreply.github.com\")\n          COMMIT_MSG=\"chore: sync from theholocron/holocron\"$'\\n\\n'\"Signed-off-by: $GIT_NAME <$GIT_EMAIL>\"\n          node packages/cli/dist/cli.mjs sync-github \\\n            --repo \"$PRIMARY_REPO\" \\\n            --branch \"$SYNC_BRANCH\" \\\n            --pr \\\n            --message \"$COMMIT_MSG\"\n        env:\n          GITHUB_TOKEN: ${{ secrets.SYNC_TOKEN }}\n          GH_TOKEN: ${{ secrets.SYNC_TOKEN }}\n          PRIMARY_REPO: ${{ inputs.primary-repo }}\n          SYNC_BRANCH: ${{ inputs.sync-branch }}\n\n      - name: Sync secondary repos (PR)\n        if: ${{ inputs.secondary-repos != '' }}\n        run: |\n          GIT_NAME=$(gh api user --jq .name 2>/dev/null || echo \"github-actions[bot]\")\n          GIT_EMAIL=$(gh api user --jq '\"\\(.id)+\\(.login)@users.noreply.github.com\"' 2>/dev/null || echo \"41898282+github-actions[bot]@users.noreply.github.com\")\n          COMMIT_MSG=\"chore: sync from theholocron/holocron\"$'\\n\\n'\"Signed-off-by: $GIT_NAME <$GIT_EMAIL>\"\n          for repo in $SECONDARY_REPOS; do\n            node packages/cli/dist/cli.mjs sync-github \\\n              --repo \"$repo\" \\\n              --branch \"$SYNC_BRANCH\" \\\n              --pr \\\n              --message \"$COMMIT_MSG\"\n          done\n        env:\n          GITHUB_TOKEN: ${{ secrets.SYNC_TOKEN }}\n          GH_TOKEN: ${{ secrets.SYNC_TOKEN }}\n          SECONDARY_REPOS: ${{ inputs.secondary-repos }}\n          SYNC_BRANCH: ${{ inputs.sync-branch }}\n";
+//#endregion
+//#region src/templates/workflows/test.yml
+var test_default$1 = "name: Test\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      CODECOV_TOKEN:\n        required: false\n\njobs:\n  unit:\n    name: Run tests and collect coverage\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: pnpm test -- --coverage\n        name: Run tests with coverage\n\n      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0\n        name: Upload coverage to Codecov\n        with:\n          token: ${{ secrets.CODECOV_TOKEN }}\n\n      - uses: codecov/test-results-action@0fa95f0e1eeaafde2c782583b36b28ad0d8c77d3 # v1\n        name: Upload test results to Codecov\n        if: ${{ !cancelled() }}\n        with:\n          token: ${{ secrets.CODECOV_TOKEN }}\n          files: '**/test-report.junit.xml'\n";
+//#endregion
+//#region src/templates/workflows/typecheck.yml
+var typecheck_default$1 = "name: Typecheck\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n\njobs:\n  typecheck:\n    name: tsc --noEmit\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: pnpm typecheck\n        name: Type check\n";
+//#endregion
+//#region src/templates/index.ts
+/**
+* All reusable workflow and composite action content bundled as string
+* constants so the CLI can push them to theholocron/.github without
+* needing filesystem access at runtime.
+*
+* Content lives in standalone .yml files; the rawYml rollup plugin
+* inlines them as string exports at build time.
+*/
+const ACTIONS = {
+	"setup/action": setup_default,
+	"install/action": install_default,
+	"setup-node/action": setup_node_default
+};
+const REUSABLE_WORKFLOWS = {
+	audit: audit_default$1,
+	bookkeeping: bookkeeping_default$1,
+	codeql: codeql_default$1,
+	dependencies: dependencies_default$1,
+	greetings: greetings_default$1,
+	lint: lint_default$1,
+	release: release_default$1,
+	review: review_default$1,
+	stale: stale_default$1,
+	"sync-github": sync_github_default$1,
+	test: test_default$1,
+	typecheck: typecheck_default$1
+};
+const WORKFLOW_TEMPLATE_PROPERTIES = {
+	bookkeeping: JSON.stringify({
+		name: "Bookkeeping",
+		description: "Label and track issues and pull requests.",
+		iconName: "octicon tag"
+	}, null, 2),
+	"sync-github": JSON.stringify({
+		name: "Sync GitHub Templates",
+		description: "Sync workflow templates and composite actions from the holocron CLI.",
+		iconName: "octicon sync"
+	}, null, 2)
+};
+//#endregion
+//#region src/commands/dependabot.yml
+var dependabot_default = "# AUTO-GENERATED by holocron — run `holocron setup` to regenerate.\nversion: 2\nupdates:\n  - package-ecosystem: npm\n    directory: /\n    schedule:\n      interval: weekly\n    groups:\n      security-patches:\n        applies-to: security-updates\n        patterns:\n          - \"*\"\n      all-dependencies:\n        update-types:\n          - minor\n          - patch\n\n  - package-ecosystem: github-actions\n    directory: /\n    schedule:\n      interval: weekly\n    groups:\n      all-actions:\n        patterns:\n          - \"*\"\n";
+//#endregion
+//#region src/commands/workflows/audit.yml
+var audit_default = "name: Audit\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\npermissions:\n  contents: read\n\njobs:\n  audit:\n    uses: theholocron/.github/.github/workflows/audit.yml@main\n    secrets: inherit\n";
+//#endregion
+//#region src/commands/workflows/bookkeeping.yml
+var bookkeeping_default = "name: Bookkeeping\n\non: # yamllint disable-line rule:truthy\n  pull_request:\n    types:\n      - opened\n      - edited\n\npermissions:\n  contents: read\n  pull-requests: write\n\njobs:\n  bookkeeping:\n    uses: theholocron/.github/.github/workflows/bookkeeping.yml@main\n    secrets: inherit\n";
+//#endregion
+//#region src/commands/workflows/codeql.yml
+var codeql_default = "name: CodeQL\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches:\n      - main\n  pull_request:\n    branches:\n      - main\n  schedule:\n    - cron: \"0 0 * * 1\"\n\npermissions:\n  actions: read\n  contents: read\n  security-events: write\n\njobs:\n  codeql:\n    uses: theholocron/.github/.github/workflows/codeql.yml@main\n    secrets: inherit\n";
+//#endregion
+//#region src/commands/workflows/dependencies.yml
+var dependencies_default = "name: Dependencies\n\non: # yamllint disable-line rule:truthy\n  pull_request:\n\npermissions:\n  contents: write\n  pull-requests: write\n\njobs:\n  dependencies:\n    uses: theholocron/.github/.github/workflows/dependencies.yml@main\n    secrets: inherit\n";
+//#endregion
+//#region src/commands/workflows/greetings.yml
+var greetings_default = "name: Greetings\n\non: # yamllint disable-line rule:truthy\n  pull_request:\n  issues:\n\npermissions:\n  issues: write\n  pull-requests: write\n\njobs:\n  greetings:\n    uses: theholocron/.github/.github/workflows/greetings.yml@main\n    secrets: inherit\n";
+//#endregion
+//#region src/commands/workflows/lint.yml
+var lint_default = "name: Lint\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\nconcurrency:\n  group: lint-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: write\n  statuses: write\n\njobs:\n  lint:\n    name: Lint\n    uses: theholocron/.github/.github/workflows/lint.yml@main\n    secrets: inherit\n    with:\n      enable-auto-commit: true\n";
+//#endregion
+//#region src/commands/workflows/release.yml
+var release_default = "name: Release\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches:\n      - main\n      - alpha\n  workflow_dispatch:\n\npermissions:\n  contents: write\n  id-token: write\n  issues: write\n  pull-requests: write\n\nconcurrency:\n  group: ${{ github.workflow }}-${{ github.ref }}\n  cancel-in-progress: false\n\njobs:\n  release:\n    uses: theholocron/.github/.github/workflows/release.yml@main\n    secrets: inherit\n";
+//#endregion
+//#region src/commands/workflows/review.yml
+var review_default = "name: Review\n\non: # yamllint disable-line rule:truthy\n  pull_request:\n\nconcurrency:\n  group: review-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n  checks: write\n  pull-requests: write\n\njobs:\n  review:\n    name: Review\n    uses: theholocron/.github/.github/workflows/review.yml@main\n    secrets: inherit\n";
+//#endregion
+//#region src/commands/workflows/stale.yml
+var stale_default = "name: Stale\n\non: # yamllint disable-line rule:truthy\n  schedule:\n    - cron: \"30 1 * * *\"\n\npermissions:\n  contents: write\n  issues: write\n  pull-requests: write\n\njobs:\n  stale:\n    uses: theholocron/.github/.github/workflows/stale.yml@main\n    secrets: inherit\n";
+//#endregion
+//#region src/commands/workflows/sync-github.yml
+var sync_github_default = "name: Sync GitHub Templates\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n    paths:\n      - packages/cli/src/templates/index.ts\n      - packages/cli/src/commands/setup-workflows.ts\n\nconcurrency:\n  group: sync-github-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n\njobs:\n  sync:\n    name: Sync\n    uses: theholocron/.github/.github/workflows/sync-github.yml@main\n    with:\n      secondary-repos: theholocron/.github-private\n    secrets:\n      SYNC_TOKEN: ${{ secrets.SYNC_TOKEN }}\n";
+//#endregion
+//#region src/commands/workflows/test.yml
+var test_default = "name: Test\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\nconcurrency:\n  group: test-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n\njobs:\n  test:\n    name: Test\n    uses: theholocron/.github/.github/workflows/test.yml@main\n    secrets: inherit\n";
+//#endregion
+//#region src/commands/workflows/typecheck.yml
+var typecheck_default = "name: Typecheck\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\nconcurrency:\n  group: typecheck-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n\njobs:\n  typecheck:\n    name: Typecheck\n    uses: theholocron/.github/.github/workflows/typecheck.yml@main\n    secrets: inherit\n";
+//#endregion
+//#region src/commands/setup-workflows.ts
+/** Header prepended when holocron setup writes a thin caller to a repo. */
+function workflowHeader() {
+	return [
+		`# AUTO-GENERATED — do not edit directly.`,
+		`# Source:  theholocron/holocron · packages/cli/src/commands/setup-workflows.ts`,
+		`# Synced:  ${(/* @__PURE__ */ new Date()).toISOString()}`,
+		`# Tool:    holocron setup`,
+		`# Changes: run \`holocron setup\` to regenerate.`,
+		``
+	].join("\n");
+}
+const WORKFLOW_TEMPLATES = {
+	lint: lint_default,
+	test: test_default,
+	typecheck: typecheck_default,
+	codeql: codeql_default,
+	review: review_default,
+	release: release_default,
+	stale: stale_default,
+	greetings: greetings_default,
+	dependencies: dependencies_default,
+	bookkeeping: bookkeeping_default,
+	audit: audit_default,
+	"sync-github": sync_github_default
+};
+const KNOWN_WORKFLOWS = new Set(Object.keys(WORKFLOW_TEMPLATES));
+/**
+* GitHub check context name each CI workflow produces on a PR.
+*
+* The format is "{caller-workflow-name} / {reusable-job-name}". The caller
+* job's own `name:` field does NOT appear in the external check name — only
+* the calling workflow's top-level `name:` and the inner reusable-workflow
+* job name matter. Only workflows that gate merges are listed here.
+*/
+const WORKFLOW_CHECK_CONTEXTS = {
+	lint: "Lint / Lint entire codebase",
+	test: "Test / Run tests and collect coverage",
+	typecheck: "Typecheck / tsc --noEmit"
+};
+/**
+* Generate the thin caller content for a workflow, optionally injecting or
+* merging `with:` overrides into the jobs block.
+*
+* Two strategies are used depending on the template:
+* - Templates that already have a `with:` block (e.g. lint, sync-github):
+*   the override entries are merged in, replacing existing keys and appending
+*   new ones.
+* - Templates that end with `    secrets: inherit`: a new `with:` block is
+*   injected immediately before `secrets: inherit`.
+* If neither pattern matches the template, a warning is emitted and the
+* base template is returned unchanged.
+*/
+function generateThinCallerContent(name, withOverrides) {
+	const base = WORKFLOW_TEMPLATES[name];
+	if (!base) return "";
+	if (!withOverrides || Object.keys(withOverrides).length === 0) return base;
+	const fmt = (k, v) => `      ${k}: ${v === true ? "true" : v === false ? "false" : String(v)}`;
+	const withBlockRe = /( {4}with:\n)((?:[ ]{6}[^\n]+\n)*)/;
+	const existingMatch = base.match(withBlockRe);
+	if (existingMatch) {
+		const existingEntries = new Map(existingMatch[2].split("\n").filter(Boolean).map((line) => {
+			const m = line.match(/^ {6}([^:]+):\s*(.*)/);
+			return m ? [m[1].trim(), m[2].trim()] : null;
+		}).filter((e) => e !== null));
+		for (const [k, v] of Object.entries(withOverrides)) existingEntries.set(k, v === true ? "true" : v === false ? "false" : String(v));
+		const merged = [...existingEntries.entries()].map(([k, v]) => `      ${k}: ${v}`).join("\n");
+		return base.replace(withBlockRe, `    with:\n${merged}\n`);
+	}
+	const withBlock = Object.entries(withOverrides).map(([k, v]) => fmt(k, v)).join("\n");
+	const result = base.replace(/ {4}secrets: inherit\n$/, `    with:\n${withBlock}\n    secrets: inherit\n`);
+	if (result === base) console.warn(`[generateThinCallerContent] could not inject with: overrides into "${name}" template`);
+	return result;
+}
+//#endregion
+//#region src/commands/sync-github.ts
+const DEFAULT_REPO = "theholocron/.github";
+/**
+* Extracts the `workflows` array from a `holocron.config.ts` source string.
+* Handles both plain string entries and `{ name, with }` object entries.
+* Falls back to an empty array if the array cannot be found or parsed.
+*/
+function parseWorkflowsFromTs(source) {
+	const keyMatch = source.match(/\bworkflows\s*:\s*\[/);
+	if (!keyMatch) return [];
+	const start = keyMatch.index + keyMatch[0].length;
+	let depth = 1;
+	let i = start;
+	while (i < source.length && depth > 0) {
+		if (source[i] === "[") depth++;
+		else if (source[i] === "]") depth--;
+		i++;
+	}
+	const body = source.slice(start, i - 1);
+	const entries = [];
+	const objSpans = [];
+	const objRe = /\{\s*name\s*:\s*"([^"]+)"(?:\s*,\s*with\s*:\s*(\{[^}]*\}))?\s*\}/g;
+	let m;
+	while ((m = objRe.exec(body)) !== null) {
+		objSpans.push([m.index, m.index + m[0].length]);
+		let withObj;
+		if (m[2]) try {
+			withObj = JSON.parse(m[2]);
+		} catch {}
+		entries.push({
+			pos: m.index,
+			entry: {
+				name: m[1],
+				...withObj && { with: withObj }
+			}
+		});
+	}
+	const strRe = /"([^"]+)"/g;
+	while ((m = strRe.exec(body)) !== null) if (!objSpans.some(([s, e]) => m.index >= s && m.index < e)) entries.push({
+		pos: m.index,
+		entry: { name: m[1] }
+	});
+	entries.sort((a, b) => a.pos - b.pos);
+	return entries.map(({ entry }) => entry);
+}
+function reusableHeader(source) {
+	return [
+		`# AUTO-GENERATED — do not edit in theholocron/.github directly.`,
+		`# Source:  theholocron/holocron · ${source}`,
+		`# Synced:  ${(/* @__PURE__ */ new Date()).toISOString()}`,
+		`# Tool:    holocron sync-github`,
+		`# Changes: edit source in theholocron/holocron and push to alpha or main.`,
+		``
+	].join("\n");
+}
+function thinCallerHeader(forPrimary = false) {
+	return [
+		forPrimary ? `# AUTO-GENERATED — do not edit in theholocron/.github directly.` : `# AUTO-GENERATED — do not edit directly.`,
+		`# Source:  theholocron/holocron · packages/cli/src/commands/setup-workflows.ts`,
+		`# Synced:  ${(/* @__PURE__ */ new Date()).toISOString()}`,
+		`# Tool:    holocron sync-github`,
+		`# Changes: edit source in theholocron/holocron and push to alpha or main.`,
+		``
+	].join("\n");
+}
+function buildBatch(repo, allowedWorkflows, withOverrides) {
+	const files = [];
+	const isPrimaryGithubRepo = repo === DEFAULT_REPO;
+	if (isPrimaryGithubRepo) for (const [name, content] of Object.entries(ACTIONS)) files.push({
+		path: `.github/actions/${name}.yml`,
+		content: reusableHeader(`packages/cli/src/templates/index.ts`) + content
+	});
+	if (isPrimaryGithubRepo) {
+		for (const [name, content] of Object.entries(REUSABLE_WORKFLOWS)) files.push({
+			path: `.github/workflows/${name}.yml`,
+			content: reusableHeader(`packages/cli/src/templates/index.ts`) + content
+		});
+		for (const [name, content] of Object.entries(WORKFLOW_TEMPLATES)) {
+			files.push({
+				path: `workflow-templates/${name}.yml`,
+				content: thinCallerHeader(true) + content
+			});
+			const props = WORKFLOW_TEMPLATE_PROPERTIES[name];
+			if (props) files.push({
+				path: `workflow-templates/${name}.properties.json`,
+				content: props
+			});
+		}
+	} else for (const name of Object.keys(REUSABLE_WORKFLOWS)) {
+		if (allowedWorkflows && !allowedWorkflows.has(name)) continue;
+		const content = generateThinCallerContent(name, withOverrides?.get(name));
+		if (!content) continue;
+		files.push({
+			path: `.github/workflows/${name}.yml`,
+			content: thinCallerHeader() + content
+		});
+	}
+	return files;
+}
+/** Git blob SHA: sha1("blob {len}\0{content}") — used to detect unchanged files. */
+function gitBlobSha(content) {
+	const buf = Buffer.from(content, "utf8");
+	return createHash("sha1").update(`blob ${buf.length}\0`).update(buf).digest("hex");
+}
+async function runSyncGithub(input) {
+	const print = input.print ?? ((line) => console.log(line));
+	const repo = input.repo ?? DEFAULT_REPO;
+	const { token, dryRun = false, branch, createPr = false } = input;
+	const message = input.message ?? `chore: sync from theholocron/holocron`;
+	const client = createGitHubClient({
+		token,
+		fetch: input.fetch
+	});
+	print(`holocron sync-github${dryRun ? " (dry-run)" : ""}`);
+	print(`  repo:   ${repo}`);
+	if (branch) print(`  branch: ${branch}`);
+	print("");
+	if (input.outputDir) {
+		const batch = buildBatch(repo);
+		for (const file of batch) {
+			const dest = join(input.outputDir, file.path);
+			mkdirSync(dirname(dest), { recursive: true });
+			writeFileSync(dest, file.content, "utf8");
+		}
+		print(`  ${batch.length} files written to ${input.outputDir}`);
+		return {
+			status: "ok",
+			created: batch.length,
+			updated: 0,
+			unchanged: 0
+		};
+	}
+	let targetBranch = branch;
+	let defaultBranch;
+	if (!targetBranch || createPr) try {
+		defaultBranch = (await client.repos.getRepo(repo)).default_branch;
+		if (!targetBranch) targetBranch = defaultBranch;
+	} catch {
+		const msg = "failed to fetch repo metadata";
+		print(`  ✗ ${msg}`);
+		return {
+			status: "fail",
+			created: 0,
+			updated: 0,
+			unchanged: 0,
+			message: msg
+		};
+	}
+	const baseBranch = createPr && defaultBranch ? defaultBranch : targetBranch;
+	let headSha;
+	let baseTreeSha;
+	let existingBlobs;
+	try {
+		headSha = (await client.git.getRef(repo, baseBranch)).object.sha;
+		baseTreeSha = (await client.git.getCommit(repo, headSha)).tree.sha;
+		const treeData = await client.git.getTree(repo, baseTreeSha, true);
+		existingBlobs = new Map(treeData.tree.filter((i) => i.type === "blob").map((i) => [i.path, i.sha]));
+	} catch (err) {
+		const msg = err instanceof Error ? err.message : `Branch ${baseBranch} not found`;
+		print(`  ✗ ${msg}`);
+		return {
+			status: "fail",
+			created: 0,
+			updated: 0,
+			unchanged: 0,
+			message: msg
+		};
+	}
+	let allowedWorkflows;
+	let withOverrides;
+	if (repo !== DEFAULT_REPO) try {
+		let entries = [];
+		try {
+			const data = await client.git.getContents(repo, "holocron.config.json");
+			entries = (JSON.parse(Buffer.from(data.content.replace(/\n/g, ""), "base64").toString("utf8"))?.workflows ?? []).map((w) => typeof w === "string" ? { name: w } : w);
+		} catch (err) {
+			if (!(err instanceof ProviderApiError) || err.status !== 404) throw err;
+			try {
+				const data = await client.git.getContents(repo, "holocron.config.ts");
+				entries = parseWorkflowsFromTs(Buffer.from(data.content.replace(/\n/g, ""), "base64").toString("utf8"));
+			} catch {}
+		}
+		if (entries.length > 0) {
+			allowedWorkflows = new Set(entries.map((e) => e.name));
+			const overrideEntries = entries.filter((e) => e.with != null).map((e) => [e.name, e.with]);
+			if (overrideEntries.length > 0) withOverrides = new Map(overrideEntries);
+		}
+	} catch {}
+	const batch = buildBatch(repo, allowedWorkflows, withOverrides);
+	let created = 0;
+	let updated = 0;
+	let unchanged = 0;
+	const changedFiles = [];
+	for (const file of batch) {
+		const localSha = gitBlobSha(file.content);
+		const existingSha = existingBlobs.get(file.path);
+		if (existingSha === localSha) {
+			print(`  · unchanged  ${file.path}`);
+			unchanged++;
+		} else if (existingSha) {
+			print(`  ${dryRun ? "~" : "✓"} updated  ${file.path}`);
+			updated++;
+			if (!dryRun) changedFiles.push(file);
+		} else {
+			print(`  ${dryRun ? "~" : "✓"} created  ${file.path}`);
+			created++;
+			if (!dryRun) changedFiles.push(file);
+		}
+	}
+	print("");
+	print(`  ${created} created, ${updated} updated, ${unchanged} unchanged`);
+	if (dryRun || changedFiles.length === 0) return {
+		status: dryRun ? "dry-run" : "ok",
+		created,
+		updated,
+		unchanged
+	};
+	const treeEntries = [];
+	for (const file of changedFiles) try {
+		const blob = await client.git.createBlob(repo, file.content);
+		treeEntries.push({
+			path: file.path,
+			mode: "100644",
+			type: "blob",
+			sha: blob.sha
+		});
+	} catch (err) {
+		const msg = `failed to create blob for ${file.path}: ${err instanceof Error ? err.message : String(err)}`;
+		print(`  ✗ ${msg}`);
+		return {
+			status: "fail",
+			created,
+			updated,
+			unchanged,
+			message: msg
+		};
+	}
+	let newTreeSha;
+	try {
+		newTreeSha = (await client.git.createTree(repo, treeEntries, baseTreeSha)).sha;
+	} catch (err) {
+		const msg = `failed to create tree: ${err instanceof Error ? err.message : String(err)}`;
+		print(`  ✗ ${msg}`);
+		return {
+			status: "fail",
+			created,
+			updated,
+			unchanged,
+			message: msg
+		};
+	}
+	let newCommitSha;
+	try {
+		newCommitSha = (await client.git.createCommit(repo, message, newTreeSha, [headSha])).sha;
+	} catch (err) {
+		const msg = `failed to create commit: ${err instanceof Error ? err.message : String(err)}`;
+		print(`  ✗ ${msg}`);
+		return {
+			status: "fail",
+			created,
+			updated,
+			unchanged,
+			message: msg
+		};
+	}
+	try {
+		if (createPr && branch) try {
+			await client.git.createRef(repo, `refs/heads/${branch}`, newCommitSha);
+		} catch (err) {
+			if (!(err instanceof ProviderApiError) || err.status !== 422) throw err;
+			await client.git.updateRef(repo, `heads/${branch}`, newCommitSha, true);
+		}
+		else await client.git.updateRef(repo, `heads/${targetBranch}`, newCommitSha);
+	} catch (err) {
+		const msg = `failed to update ref: ${err instanceof Error ? err.message : String(err)}`;
+		print(`  ✗ ${msg}`);
+		return {
+			status: "fail",
+			created,
+			updated,
+			unchanged,
+			message: msg
+		};
+	}
+	let prUrl;
+	if (branch && createPr && !dryRun) try {
+		prUrl = (await client.git.createPull(repo, {
+			title: message.split("\n")[0],
+			head: branch,
+			base: "main",
+			body: "Auto-generated by `holocron sync-github`. Review and merge to apply template updates."
+		})).html_url;
+		print(`  → PR opened: ${prUrl}`);
+	} catch (err) {
+		if (err instanceof ProviderApiError && err.status === 422 && String(err.details).includes("already exists")) print(`  → PR already open for ${branch} — branch updated, ready to merge`);
+		else print(`  ⚠ PR creation failed: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	return {
+		status: "ok",
+		created,
+		updated,
+		unchanged,
+		prUrl
+	};
+}
+//#endregion
 //#region src/commands/npm-publish-initial.ts
 /**
 * `holocron npm publish-initial` — bottles up the chicken-and-egg
@@ -488,7 +1430,7 @@ async function runNpmPublishInitial(input = {}) {
 	const dryRun = input.dryRun ?? false;
 	const otp = input.otp;
 	const env = input.env ?? process.env;
-	const exec = input.exec ?? defaultExec;
+	const exec = input.exec ?? defaultExec$1;
 	const publishArgs = [
 		"-r",
 		"--filter=./packages/*",
@@ -564,7 +1506,7 @@ function printNextSteps$1(print, env) {
 		print("    https://www.npmjs.com/settings/~/tokens");
 	}
 }
-const defaultExec = async (cmd, args, opts) => {
+const defaultExec$1 = async (cmd, args, opts) => {
 	const result = spawnSync(cmd, args, {
 		cwd: opts.cwd,
 		encoding: "utf8",
@@ -583,7 +1525,7 @@ const defaultExec = async (cmd, args, opts) => {
 //#endregion
 //#region src/commands/plugin-create/template-inputs.ts
 /** Derive the standard defaults from a slug + vendor name. */
-function deriveDefaults(input) {
+function deriveDefaults$1(input) {
 	const vendorUpper = input.slug.toUpperCase().replace(/-/g, "_");
 	const capability = input.capability;
 	return {
@@ -596,48 +1538,19 @@ function deriveDefaults(input) {
 //#endregion
 //#region src/commands/plugin-create/templates/auth.ts
 function render$17(inputs) {
-	return `/**
- * Token resolution for the ${inputs.vendorName} plugin.
- *
- * Resolution order (matches the standard 4-step precedence set by
- * \`.notes/tech-auth-bootstrap.spec.md\`):
- *   1. explicit \`cliToken\` argument (from \`--token\` flag)
- *   2. ${inputs.tokenEnv} env var (preferred — explicit intent)
- *   3. ${inputs.vendorEnv} env var (vendor-native)
- *   4. keyring (com.theholocron.cli / "${inputs.slug}")
- *   5. AuthError naming all four options + the bootstrap hint
- */
-
-import { getToken as getKeyringToken } from "@theholocron/cli";
-
-export class AuthError extends Error {
-	override name = "AuthError";
-}
-
-export interface ResolveTokenInput {
-	/** From \`--token\` CLI flag. */
-	cliToken?: string;
-	/** Env vars; passed in for testability. Defaults to \`process.env\`. */
-	env?: NodeJS.ProcessEnv;
-	/** Keyring lookup fn; passed in for testability. Defaults to \`getToken(provider)\`. */
-	keyring?: (provider: string) => string | null;
-}
-
-export function resolveToken(input: ResolveTokenInput = {}): string {
-	const env = input.env ?? process.env;
-	const keyring = input.keyring ?? getKeyringToken;
-	// Bracket access so numeric-prefixed slugs (e.g., env.HOLOCRON_1PASSWORD_TOKEN
-	// which is invalid JS) still produce syntactically valid code.
-	const token =
-		input.cliToken || env["${inputs.tokenEnv}"] || env["${inputs.vendorEnv}"] || keyring("${inputs.slug}");
-	if (!token) {
-		throw new AuthError(
-			"no ${inputs.vendorName} token found. Pass --token <TOKEN>, set ${inputs.tokenEnv} / ${inputs.vendorEnv}, " +
-				"or run: holocron auth set ${inputs.slug} <TOKEN>"
-		);
-	}
-	return token;
-}
+	return `import { AuthError, createResolveToken, type ResolveTokenInput } from "@theholocron/cli";
+
+export { AuthError };
+export type { ResolveTokenInput };
+
+export const resolveToken = createResolveToken({
+\tenvName: "${inputs.tokenEnv}",
+\tvendorEnvName: "${inputs.vendorEnv}",
+\tkeyringService: "${inputs.slug}",
+\terrorMessage:
+\t\t"no ${inputs.vendorName} token found. Pass --token <TOKEN>, set ${inputs.tokenEnv} / ${inputs.vendorEnv}, " +
+\t\t"or run: holocron auth set ${inputs.slug} <TOKEN>",
+});
 `;
 }
 //#endregion
@@ -1063,148 +1976,79 @@ Not yet published; capability methods are stubs.
 //#endregion
 //#region src/commands/plugin-create/templates/rest.ts
 function render$7(inputs) {
-	const clientClass = `${inputs.vendorName}RestClient`;
-	return `/**
- * Thin REST wrapper around ${inputs.baseUrl}.
- *
- * Bearer auth, JSON-only bodies, transport-failure wrapping with
- * \`status: 0\` so orchestrator soft-skip paths see a clear message
- * instead of a generic \`TypeError: fetch failed\`.
- */
-
-import { ProviderApiError } from "@theholocron/cli";
-
-export interface RestClientOptions {
-	token: string;
-	fetch?: typeof fetch;
-	baseUrl?: string;
-}
-
-export interface RequestOptions {
-	method?: "GET" | "POST" | "PATCH" | "PUT" | "DELETE";
-	body?: unknown;
-	query?: Record<string, string>;
-	/** Treat this response as void even if 200 is returned. */
-	expectNoContent?: boolean;
-}
-
-export class ${clientClass} {
-	private readonly token: string;
-	private readonly fetchImpl: typeof fetch;
-	readonly baseUrl: string;
-
-	constructor(opts: RestClientOptions) {
-		this.token = opts.token;
-		this.fetchImpl = opts.fetch ?? globalThis.fetch;
-		// Manual trailing-slash trim — CodeQL flags regex on library
-		// input as polynomial ReDoS. O(n) loop, no backtracking risk.
-		let url = opts.baseUrl ?? "${inputs.baseUrl}";
-		while (url.endsWith("/")) url = url.slice(0, -1);
-		this.baseUrl = url;
-	}
-
-	async request<T>(path: string, opts: RequestOptions = {}): Promise<T> {
-		const url = new URL(\`\${this.baseUrl}\${path.startsWith("/") ? path : "/" + path}\`);
-		for (const [k, v] of Object.entries(opts.query ?? {})) url.searchParams.set(k, v);
-		const fullUrl = url.toString();
-
-		const headers: Record<string, string> = {
-			authorization: \`Bearer \${this.token}\`,
-			accept: "application/json",
-		};
-		const init: RequestInit = {
-			method: opts.method ?? "GET",
-			headers,
-		};
-		if (opts.body !== undefined) {
-			headers["content-type"] = "application/json";
-			init.body = JSON.stringify(opts.body);
-		}
-
-		let res: Response;
-		try {
-			res = await this.fetchImpl(fullUrl, init);
-		} catch (err) {
-			const detail = err instanceof Error ? \`\${err.name}: \${err.message}\` : String(err);
-			throw new ProviderApiError(\`${inputs.vendorName} \${init.method} \${path} failed: \${detail}\`, 0, undefined);
-		}
-		if (!res.ok) {
-			const body = await res.text().catch(() => "");
-			throw new ProviderApiError(\`${inputs.vendorName} \${init.method} \${path} → \${res.status}\`, res.status, body);
-		}
-		if (opts.expectNoContent || res.status === 204) return undefined as T;
-		const text = await res.text();
-		if (!text) return undefined as T;
-		return JSON.parse(text) as T;
-	}
+	return `import { createRestClient, type RequestOptions, type RestClient } from "@theholocron/cli";
+
+export type { RequestOptions, RestClient };
+
+export function ${`create${inputs.vendorName}RestClient`}(opts: {
+\ttoken: string;
+\tbaseUrl?: string;
+\tfetch?: typeof fetch;
+}): RestClient {
+\treturn createRestClient({
+\t\tbaseUrl: opts.baseUrl ?? "${inputs.baseUrl}",
+\t\ttoken: opts.token,
+\t\tvendor: "${inputs.vendorName}",
+\t\tfetch: opts.fetch,
+\t});
 }
 `;
 }
 //#endregion
 //#region src/commands/plugin-create/templates/rest-test.ts
 function render$6(inputs) {
-	const clientClass = `${inputs.vendorName}RestClient`;
+	const factoryName = `create${inputs.vendorName}RestClient`;
 	return `import { ProviderApiError } from "@theholocron/cli";
 import { describe, expect, it } from "vitest";
 
-import { ${clientClass} } from "../rest.js";
+import { ${factoryName} } from "../rest.js";
 import { stubFetch } from "./helpers.js";
 
-describe("${clientClass}", () => {
-	it("sends bearer + accept headers and returns the parsed body", async () => {
-		const stub = stubFetch([{ status: 200, body: { ok: true } }]);
-		const client = new ${clientClass}({ token: "t", fetch: stub.fetch });
-		const res = await client.request<{ ok: boolean }>("/me");
-		expect(res.ok).toBe(true);
-		expect(stub.calls[0]?.headers["authorization"]).toBe("Bearer t");
-		expect(stub.calls[0]?.headers["accept"]).toBe("application/json");
-	});
-
-	it("serializes body as JSON and sets content-type when present", async () => {
-		const stub = stubFetch([{ status: 200, body: {} }]);
-		const client = new ${clientClass}({ token: "t", fetch: stub.fetch });
-		await client.request<unknown>("/resource", { method: "POST", body: { name: "demo" } });
-		expect(stub.calls[0]?.method).toBe("POST");
-		expect(stub.calls[0]?.headers["content-type"]).toBe("application/json");
-		expect(stub.calls[0]?.body).toEqual({ name: "demo" });
-	});
-
-	it("returns undefined on 204", async () => {
-		const stub = stubFetch([{ status: 204 }]);
-		const client = new ${clientClass}({ token: "t", fetch: stub.fetch });
-		expect(await client.request<unknown>("/whatever")).toBeUndefined();
-	});
-
-	it("throws ProviderApiError with the HTTP status on non-2xx", async () => {
-		const stub = stubFetch([{ status: 401, body: { messages: ["invalid"] } }]);
-		const client = new ${clientClass}({ token: "bad", fetch: stub.fetch });
-		try {
-			await client.request<unknown>("/me");
-			throw new Error("should have thrown");
-		} catch (err) {
-			expect(err).toBeInstanceOf(ProviderApiError);
-			expect((err as ProviderApiError).status).toBe(401);
-		}
-	});
-
-	it("wraps transport-level failures with status 0", async () => {
-		const throwing: typeof fetch = async () => {
-			throw new TypeError("fetch failed");
-		};
-		const client = new ${clientClass}({ token: "t", fetch: throwing });
-		try {
-			await client.request<unknown>("/me");
-			throw new Error("should have thrown");
-		} catch (err) {
-			expect(err).toBeInstanceOf(ProviderApiError);
-			expect((err as ProviderApiError).status).toBe(0);
-		}
-	});
-
-	it("trims trailing slashes from the base URL", () => {
-		const client = new ${clientClass}({ token: "t", baseUrl: "${inputs.baseUrl}//" });
-		expect(client.baseUrl).toBe("${inputs.baseUrl}");
-	});
+describe("${factoryName}", () => {
+\tit("sends bearer + accept headers and returns the parsed body", async () => {
+\t\tconst stub = stubFetch([{ status: 200, body: { ok: true } }]);
+\t\tconst client = ${factoryName}({ token: "t", fetch: stub.fetch });
+\t\tconst res = await client.request<{ ok: boolean }>("/me");
+\t\texpect(res.ok).toBe(true);
+\t\texpect(stub.calls[0]?.headers["authorization"]).toBe("Bearer t");
+\t\texpect(stub.calls[0]?.headers["accept"]).toBe("application/json");
+\t});
+
+\tit("serializes body as JSON and sets content-type when present", async () => {
+\t\tconst stub = stubFetch([{ status: 200, body: {} }]);
+\t\tconst client = ${factoryName}({ token: "t", fetch: stub.fetch });
+\t\tawait client.request<unknown>("/resource", { method: "POST", body: { name: "demo" } });
+\t\texpect(stub.calls[0]?.method).toBe("POST");
+\t\texpect(stub.calls[0]?.headers["content-type"]).toBe("application/json");
+\t\texpect(stub.calls[0]?.body).toEqual({ name: "demo" });
+\t});
+
+\tit("returns undefined on 204", async () => {
+\t\tconst stub = stubFetch([{ status: 204 }]);
+\t\tconst client = ${factoryName}({ token: "t", fetch: stub.fetch });
+\t\texpect(await client.request<unknown>("/whatever")).toBeUndefined();
+\t});
+
+\tit("throws ProviderApiError with the HTTP status on non-2xx", async () => {
+\t\tconst stub = stubFetch([{ status: 401, body: { messages: ["invalid"] } }]);
+\t\tconst client = ${factoryName}({ token: "bad", fetch: stub.fetch });
+\t\tconst err = await client.request<unknown>("/me").catch((e: unknown) => e);
+\t\texpect(err).toBeInstanceOf(ProviderApiError);
+\t\texpect((err as ProviderApiError).status).toBe(401);
+\t});
+
+\tit("wraps transport-level failures with status 0", async () => {
+\t\tconst throwing: typeof fetch = async () => { throw new TypeError("fetch failed"); };
+\t\tconst client = ${factoryName}({ token: "t", fetch: throwing });
+\t\tconst err = await client.request<unknown>("/me").catch((e: unknown) => e);
+\t\texpect(err).toBeInstanceOf(ProviderApiError);
+\t\texpect((err as ProviderApiError).status).toBe(0);
+\t});
+
+\tit("trims trailing slashes from the base URL", () => {
+\t\tconst client = ${factoryName}({ token: "t", baseUrl: "${inputs.baseUrl}//" });
+\t\texpect(client.baseUrl).toBe("${inputs.baseUrl}");
+\t});
 });
 `;
 }
@@ -1513,13 +2357,11 @@ export default defineConfig({
 *   2. Slug collision — packages/holocron-plugin-<slug>/ must not exist.
 *   3. Capability sanity — must be one of the 14 known keys; warn for
 *      many-cardinality caps.
-*   4. Prompt — fill in any missing flags via cli-utils / inquirer
-*      (Phase B; Phase A takes fully-populated input).
-*   5. Generate — for each template, write to
+*   4. Generate — for each template, write to
 *      packages/holocron-plugin-<slug>/<path>.
-*   6. Verify (unless --no-verify) — Phase B; runs pnpm install +
+*   5. Verify (unless --no-verify) — runs pnpm install +
 *      pnpm --filter <pkg> typecheck lint test.
-*   7. Print next steps.
+*   6. Print next steps.
 */
 var PluginCreateError = class extends Error {
 	name = "PluginCreateError";
@@ -1612,7 +2454,7 @@ function runPluginCreate(input) {
 	const packageDir = path.join(cwd, "packages", `holocron-plugin-${input.slug}`);
 	if (existsSync(packageDir)) throw new PluginCreateError(`\`${packageDir}\` already exists — edit in place or pick a different slug.`);
 	validateCapability(input.capability, print);
-	const derived = deriveDefaults({
+	const derived = deriveDefaults$1({
 		slug: input.slug,
 		vendorName: input.vendorName,
 		capability: input.capability
@@ -1642,6 +2484,51 @@ function runPluginCreate(input) {
 		}
 		filesWritten.push(resolvedPath);
 	}
+	if (!input.dryRun && !input.noVerify) {
+		const execFn = input.exec ?? defaultExec;
+		const pkg = `@theholocron/holocron-plugin-${inputs.slug}`;
+		print("");
+		print("  Verifying scaffold…");
+		try {
+			execFn("pnpm", ["install", "--frozen-lockfile=false"], {
+				cwd,
+				stdio: "inherit"
+			});
+			execFn("pnpm", [
+				"--filter",
+				pkg,
+				"typecheck"
+			], {
+				cwd,
+				stdio: "inherit"
+			});
+			execFn("pnpm", [
+				"--filter",
+				pkg,
+				"lint"
+			], {
+				cwd,
+				stdio: "inherit"
+			});
+			execFn("pnpm", [
+				"--filter",
+				pkg,
+				"test"
+			], {
+				cwd,
+				stdio: "inherit"
+			});
+			print("  ✓ scaffold verified");
+		} catch (err) {
+			print(`  ✗ verify failed — ${err instanceof Error ? err.message : String(err)}`);
+			return {
+				status: "fail",
+				packagePath: packageDir,
+				filesWritten,
+				message: "post-scaffold verify failed; inspect output above"
+			};
+		}
+	}
 	if (!input.dryRun) printNextSteps(print, inputs);
 	return {
 		status: "ok",
@@ -1685,6 +2572,12 @@ function defaultWrite(filepath, content) {
 	mkdirSync(path.dirname(filepath), { recursive: true });
 	writeFileSync(filepath, content, "utf8");
 }
+function defaultExec(cmd, args, opts) {
+	execFileSync(cmd, args, {
+		cwd: opts.cwd,
+		stdio: opts.stdio
+	});
+}
 function printNextSteps(print, inputs) {
 	print("");
 	print(`  Scaffolded @theholocron/holocron-plugin-${inputs.slug} (18 files).`);
@@ -1765,22 +2658,22 @@ function describeScope(scope) {
 async function runSecretsSync(input) {
 	const print = input.print ?? ((line) => console.log(line));
 	const loader = input.loader ?? new PluginLoader(input.loaded.resolved, input.context);
-	await loader.load();
+	await withSpinner("Loading plugins…", () => loader.load());
 	const dryRun = input.context.dryRun ?? false;
 	const targets = input.targets ?? ["production", "preview"];
-	print(`Holocron secrets sync — environment ${input.environmentId}${dryRun ? " (dry-run)" : ""}`);
-	print(`  vault: ${vaultProviderName(loader)}`);
+	print(style.header(`Holocron secrets sync — environment ${input.environmentId}${dryRun ? " (dry-run)" : ""}`));
+	print(style.dim(`  vault: ${vaultProviderName(loader)}`));
 	print("");
 	const vault = loader.get("vault");
 	if (!vault.readEnvironment) throw new Error(`vault provider (${vault.providerName}) does not implement readEnvironment — sync needs bulk env reads`);
-	const envVars = await vault.readEnvironment(input.environmentId);
+	const envVars = await withSpinner(`Reading vault environment ${input.environmentId}…`, () => vault.readEnvironment(input.environmentId));
 	const keys = Object.keys(envVars).sort();
-	print(`  → read ${keys.length} keys from vault`);
+	print(style.step(`read ${keys.length} keys from vault`));
 	print("");
 	const rows = [];
 	if (loader.has("secrets")) {
 		const secrets = loader.get("secrets");
-		print("  → secrets (repo scope)");
+		print(style.step("secrets (repo scope)"));
 		for (const key of keys) {
 			rows.push(await runRow(`secrets:${secrets.providerName}`, "scope=repo", key, dryRun, async () => {
 				await secrets.setSecret({ kind: "repo" }, key, envVars[key]);
@@ -1791,7 +2684,7 @@ async function runSecretsSync(input) {
 	if (loader.has("deployment")) {
 		const deploy = loader.get("deployment");
 		if (!input.projectId) {
-			print("  → deployment");
+			print(style.step("deployment"));
 			const row = {
 				destination: `deployment:${deploy.providerName}`,
 				scope: "no projectId",
@@ -1802,7 +2695,7 @@ async function runSecretsSync(input) {
 			rows.push(row);
 			print(formatRow(row));
 		} else for (const target of targets) {
-			print(`  → deployment (target=${target})`);
+			print(style.step(`deployment (target=${target})`));
 			for (const key of keys) {
 				rows.push(await runRow(`deployment:${deploy.providerName}`, `target=${target}`, key, dryRun, async () => {
 					await deploy.setEnvVar(input.projectId, target, key, envVars[key]);
@@ -1824,7 +2717,8 @@ async function runSecretsSync(input) {
 		dryRun: 0
 	});
 	print("");
-	print(`  ${summary.ok} ok, ${summary.fail} fail, ${summary.skip} skipped${dryRun ? `, ${summary.dryRun} would-do` : ""}`);
+	const summaryLine = `${summary.ok} ok, ${summary.fail} fail, ${summary.skip} skipped${dryRun ? `, ${summary.dryRun} would-do` : ""}`;
+	print(summary.fail > 0 ? style.fail(summaryLine) : style.success(summaryLine));
 	return {
 		rows,
 		summary
@@ -1856,278 +2750,300 @@ async function runRow(destination, scope, key, dryRun, body) {
 	}
 }
 function formatRow(row) {
-	const icon = row.status === "ok" ? "✓" : row.status === "fail" ? "✗" : row.status === "dry-run" ? "…" : "·";
-	const detail = row.message ? `  (${row.message})` : "";
-	return `    ${icon} ${row.key}${detail}`;
+	const detail = row.message ? style.dim(`  (${row.message})`) : "";
+	const label = `${row.key}${detail}`;
+	if (row.status === "ok") return `    ${style.success(label)}`;
+	if (row.status === "fail") return `    ${style.fail(label)}`;
+	if (row.status === "dry-run") return `    ${style.dim(`… ${label}`)}`;
+	return `    ${style.dim(`· ${label}`)}`;
 }
 function vaultProviderName(loader) {
 	if (!loader.has("vault")) return "<missing>";
 	return loader.get("vault").providerName;
 }
 //#endregion
-//#region src/commands/setup-workflows.ts
+//#region src/commands/setup.ts
 /**
-* Thin workflow wrapper templates for `holocron setup`.
+* `holocron setup` — orchestrates per-capability setup actions across
+* every plugin loaded from `holocron.config.json`.
+*
+* Per CLAUDE.md soft-skip: each step is wrapped in a try/catch and
+* failures don't abort subsequent capabilities. The summary at the end
+* reports counts so the operator can see what worked + what didn't.
+*
+* Per the Standards: when `ctx.dryRun` is true, mutating calls are
+* replaced with "would" log lines. Read-only probes (e.g.,
+* `vault.list`) still run so the operator sees real state.
 *
-* Each entry is a complete `.github/workflows/<name>.yml` that delegates
-* to the corresponding reusable `ci-<name>.yml` in `theholocron/.github`.
-* Files are overwritten on each setup run — they are generated artifacts.
+* The orchestrator knows about specific capability methods by name
+* (e.g., `source.enableVulnerabilityAlerts`). This deliberate coupling
+* makes the "what does setup do" contract explicit and concrete —
+* decoupling via a per-capability `setupSteps()` method would be more
+* extensible but pushes the same knowledge into N plugins instead of
+* one central place.
 */
-const WORKFLOW_REPO = "theholocron/.github";
-const WORKFLOW_REF = "main";
-function ref(name) {
-	return `${WORKFLOW_REPO}/.github/workflows/${name}.yml@${WORKFLOW_REF}`;
+function editorconfigContent() {
+	return [
+		`# AUTO-GENERATED — do not edit directly.`,
+		`# Source:  theholocron/holocron · packages/cli/src/commands/setup.ts`,
+		`# Synced:  ${(/* @__PURE__ */ new Date()).toISOString()}`,
+		`# Tool:    holocron setup`,
+		`# Changes: run \`holocron setup\` to regenerate.`,
+		``,
+		`root = true`,
+		``,
+		`[*]`,
+		`end_of_line = lf`,
+		`charset = utf-8`,
+		`trim_trailing_whitespace = true`,
+		`insert_final_newline = true`,
+		`indent_style = tab`,
+		`indent_size = 4`,
+		``,
+		`[.gitattributes]`,
+		`indent_style = space`,
+		`indent_size = 2`,
+		``,
+		`[*.{json,yml,yaml}]`,
+		`indent_style = space`,
+		`indent_size = 2`,
+		``,
+		`[*.md]`,
+		`trim_trailing_whitespace = false`,
+		`indent_style = space`,
+		`indent_size = 2`,
+		``,
+		`[.*{rc,ignore}]`,
+		`indent_style = space`,
+		`indent_size = 2`,
+		``
+	].join("\n");
+}
+function codecovContent(packages) {
+	const header = [
+		`# AUTO-GENERATED by holocron setup — do not edit directly.`,
+		`# Source:  theholocron/holocron · packages/cli/src/commands/setup.ts`,
+		`# Synced:  ${(/* @__PURE__ */ new Date()).toISOString()}`,
+		`# Tool:    holocron setup`,
+		`# Changes: run \`holocron setup\` to regenerate.`
+	].join("\n");
+	const componentLines = packages.flatMap(({ slug, name }) => [
+		`    - component_id: ${slug}`,
+		`      name: "${name}"`,
+		`      paths:`,
+		`        - packages/${slug}/**`
+	]);
+	return [
+		header,
+		``,
+		`codecov:`,
+		`  require_ci_to_pass: true`,
+		``,
+		`coverage:`,
+		`  precision: 2`,
+		`  round: down`,
+		`  status:`,
+		`    project:`,
+		`      default:`,
+		`        target: auto`,
+		`        threshold: 2%`,
+		`    patch:`,
+		`      default:`,
+		`        target: 80%`,
+		``,
+		`comment:`,
+		`  layout: "reach,diff,flags,components"`,
+		`  behavior: default`,
+		`  require_changes: true`,
+		``,
+		`component_management:`,
+		`  default_rules:`,
+		`    statuses:`,
+		`      - type: patch`,
+		`        target: 80%`,
+		`  individual_components:`,
+		...componentLines.length > 0 ? componentLines : [`    []`],
+		``
+	].join("\n");
+}
+async function readWorkspacePackages(repoRoot) {
+	const packagesDir = join(repoRoot, "packages");
+	const entries = await readdir(packagesDir, { withFileTypes: true }).catch(() => null);
+	if (!entries) return [];
+	const packages = [];
+	for (const entry of entries) {
+		if (!entry.isDirectory()) continue;
+		try {
+			const raw = await readFile(join(packagesDir, entry.name, "package.json"), "utf8");
+			const pkg = JSON.parse(raw);
+			if (typeof pkg.name === "string") packages.push({
+				slug: entry.name,
+				name: pkg.name
+			});
+		} catch {}
+	}
+	return packages.sort((a, b) => a.slug.localeCompare(b.slug));
+}
+const EDITORCONFIG_CHECKER_CONFIG = JSON.stringify({
+	Version: "v3.7.0",
+	Verbose: false,
+	Format: "",
+	Debug: false,
+	IgnoreDefaults: false,
+	SpacesAfterTabs: false,
+	NoColor: false,
+	Exclude: ["(^|.+/)LICENSE$", "^public/.*"],
+	AllowedContentTypes: [],
+	PassedFiles: [],
+	Disable: {
+		EndOfLine: false,
+		Indentation: false,
+		InsertFinalNewline: false,
+		TrimTrailingWhitespace: false,
+		IndentSize: false,
+		MaxLineLength: false
+	}
+}, null, 2) + "\n";
+const ALEX_CONFIG = JSON.stringify({ allow: [
+	"dead",
+	"failure",
+	"failures",
+	"hook",
+	"hooks",
+	"husky",
+	"period"
+] }, null, 2) + "\n";
+const CANONICAL_LABELS = [
+	{
+		name: "bug",
+		color: "d73a4a",
+		description: "Something isn't working"
+	},
+	{
+		name: "chore",
+		color: "ededed",
+		description: "Maintenance, no user-facing change"
+	},
+	{
+		name: "ci",
+		color: "0075ca",
+		description: "CI/CD pipeline changes"
+	},
+	{
+		name: "dependencies",
+		color: "0366d6",
+		description: "Dependency update"
+	},
+	{
+		name: "documentation",
+		color: "0075ca",
+		description: "Documentation only"
+	},
+	{
+		name: "duplicate",
+		color: "cfd3d7",
+		description: "Already reported"
+	},
+	{
+		name: "enhancement",
+		color: "a2eeef",
+		description: "New feature or request"
+	},
+	{
+		name: "good first issue",
+		color: "7057ff",
+		description: "Good for newcomers"
+	},
+	{
+		name: "help wanted",
+		color: "008672",
+		description: "Extra attention needed"
+	},
+	{
+		name: "invalid",
+		color: "e4e669",
+		description: "Doesn't seem right"
+	},
+	{
+		name: "performance",
+		color: "fbca04",
+		description: "Performance improvement"
+	},
+	{
+		name: "question",
+		color: "d876e3",
+		description: "Further information requested"
+	},
+	{
+		name: "refactor",
+		color: "cfd3d7",
+		description: "Code restructuring"
+	},
+	{
+		name: "released",
+		color: "ededed",
+		description: "Included in a release"
+	},
+	{
+		name: "test",
+		color: "bfd4f2",
+		description: "Test-related changes"
+	},
+	{
+		name: "triage",
+		color: "e4e669",
+		description: "Needs investigation"
+	},
+	{
+		name: "wontfix",
+		color: "ffffff",
+		description: "Won't be addressed"
+	}
+];
+const STALE_LABELS = [
+	"github_actions",
+	"javascript",
+	"autorelease: pending",
+	"autorelease: tagged",
+	"released on @alpha"
+];
+function labelerConfig() {
+	return [
+		`# AUTO-GENERATED — do not edit directly.`,
+		`# Source:  theholocron/holocron · packages/cli/src/commands/setup.ts`,
+		`# Synced:  ${(/* @__PURE__ */ new Date()).toISOString()}`,
+		`# Tool:    holocron setup`,
+		`# Changes: run \`holocron setup\` to regenerate.`,
+		``,
+		`bug:`,
+		`  - '^fix'`,
+		``,
+		`chore:`,
+		`  - '^chore(?!\\(deps)'`,
+		``,
+		`ci:`,
+		`  - '^ci'`,
+		``,
+		`dependencies:`,
+		`  - '^chore\\(deps'`,
+		``,
+		`documentation:`,
+		`  - '^docs'`,
+		``,
+		`enhancement:`,
+		`  - '^feat'`,
+		``,
+		`performance:`,
+		`  - '^perf'`,
+		``,
+		`refactor:`,
+		`  - '^refactor'`,
+		``,
+		`test:`,
+		`  - '^test'`,
+		``
+	].join("\n");
 }
-/** Header prepended when holocron setup writes a thin caller to a repo. */
-const WORKFLOW_HEADER = `\
-# AUTO-GENERATED by holocron — do not edit directly.
-# Source: theholocron/holocron · packages/cli/src/commands/setup-workflows.ts
-# Run \`holocron setup\` to regenerate.
-
-`;
-const WORKFLOW_TEMPLATES = {
-	lint: `\
-name: Lint
-
-on: # yamllint disable-line rule:truthy
-  push:
-    branches: [main, alpha]
-  pull_request:
-
-concurrency:
-  group: lint-\${{ github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: write
-  statuses: write
-
-jobs:
-  lint:
-    name: Lint
-    uses: ${ref("lint")}
-    secrets: inherit
-    with:
-      enable-auto-commit: true
-`,
-	test: `\
-name: Test
-
-on: # yamllint disable-line rule:truthy
-  push:
-    branches: [main, alpha]
-  pull_request:
-
-concurrency:
-  group: test-\${{ github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  test:
-    name: Test
-    uses: ${ref("test")}
-    secrets: inherit
-`,
-	typecheck: `\
-name: Typecheck
-
-on: # yamllint disable-line rule:truthy
-  push:
-    branches: [main, alpha]
-  pull_request:
-
-concurrency:
-  group: typecheck-\${{ github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  typecheck:
-    name: Typecheck
-    uses: ${ref("typecheck")}
-    secrets: inherit
-`,
-	codeql: `\
-name: CodeQL
-
-on: # yamllint disable-line rule:truthy
-  push:
-    branches:
-      - main
-  pull_request:
-    branches:
-      - main
-  schedule:
-    - cron: "0 0 * * 1"
-
-permissions:
-  actions: read
-  contents: read
-  security-events: write
-
-jobs:
-  codeql:
-    uses: ${ref("codeql")}
-    secrets: inherit
-`,
-	review: `\
-name: Review
-
-on: # yamllint disable-line rule:truthy
-  pull_request:
-
-concurrency:
-  group: review-\${{ github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-  checks: write
-  pull-requests: write
-
-jobs:
-  review:
-    name: Review
-    uses: ${ref("review")}
-    secrets: inherit
-`,
-	release: `\
-name: Release
-
-on: # yamllint disable-line rule:truthy
-  push:
-    branches:
-      - main
-
-permissions:
-  contents: write
-  id-token: write
-  issues: write
-  pull-requests: write
-
-jobs:
-  release:
-    uses: ${ref("release")}
-    secrets: inherit
-`,
-	stale: `\
-name: Stale
-
-on: # yamllint disable-line rule:truthy
-  schedule:
-    - cron: "30 1 * * *"
-
-permissions:
-  contents: write
-  issues: write
-  pull-requests: write
-
-jobs:
-  stale:
-    uses: ${ref("stale")}
-    secrets: inherit
-`,
-	greetings: `\
-name: Greetings
-
-on: # yamllint disable-line rule:truthy
-  pull_request:
-  issues:
-
-permissions:
-  issues: write
-  pull-requests: write
-
-jobs:
-  greetings:
-    uses: ${ref("greetings")}
-    secrets: inherit
-`,
-	dependencies: `\
-name: Dependencies
-
-on: # yamllint disable-line rule:truthy
-  pull_request:
-
-permissions:
-  contents: write
-  pull-requests: write
-
-jobs:
-  dependencies:
-    uses: ${ref("dependencies")}
-    secrets: inherit
-`,
-	"bookkeeping-pr": `\
-name: PR Bookkeeping
-
-on: # yamllint disable-line rule:truthy
-  pull_request:
-    types:
-      - opened
-      - edited
-
-permissions:
-  contents: read
-  pull-requests: write
-
-jobs:
-  bookkeeping:
-    uses: ${ref("bookkeeping-pr")}
-    secrets: inherit
-`,
-	audit: `\
-name: Audit
-
-on: # yamllint disable-line rule:truthy
-  push:
-    branches: [main, alpha]
-  pull_request:
-
-permissions:
-  contents: read
-
-jobs:
-  audit:
-    uses: ${ref("audit")}
-    secrets: inherit
-`
-};
-const KNOWN_WORKFLOWS = new Set(Object.keys(WORKFLOW_TEMPLATES));
-//#endregion
-//#region src/commands/setup.ts
-const DEPENDABOT_CONFIG = `\
-# AUTO-GENERATED by holocron — run \`holocron setup\` to regenerate.
-version: 2
-updates:
-  - package-ecosystem: npm
-    directory: /
-    schedule:
-      interval: weekly
-    groups:
-      security-patches:
-        applies-to: security-updates
-        patterns:
-          - "*"
-      all-dependencies:
-        update-types:
-          - minor
-          - patch
-
-  - package-ecosystem: github-actions
-    directory: /
-    schedule:
-      interval: weekly
-    groups:
-      all-actions:
-        patterns:
-          - "*"
-`;
 const RULESET_NAME = "holocron-default-branch";
 const BALANCED_REPO_SETTINGS = {
 	allow_squash_merge: true,
@@ -2169,7 +3085,7 @@ function buildRulesetPayload(requiredChecks = []) {
 				dismiss_stale_reviews_on_push: false,
 				require_code_owner_review: false,
 				require_last_push_approval: false,
-				required_review_thread_resolution: false
+				required_review_thread_resolution: true
 			}
 		}
 	];
@@ -2184,6 +3100,11 @@ function buildRulesetPayload(requiredChecks = []) {
 		name: RULESET_NAME,
 		target: "branch",
 		enforcement: "active",
+		bypass_actors: [{
+			actor_id: 4,
+			actor_type: "RepositoryRole",
+			bypass_mode: "always"
+		}],
 		conditions: { ref_name: {
 			include: ["~DEFAULT_BRANCH"],
 			exclude: []
@@ -2217,7 +3138,7 @@ async function upsertBranchProtection(source, dryRun, requiredChecks) {
 			message: "created"
 		};
 	} catch (err) {
-		if (!(err instanceof ProviderApiError) || err.status !== 403) return {
+		if (!(err instanceof ProviderApiError$1) || err.status !== 403) return {
 			capability: "source",
 			step,
 			status: "fail",
@@ -2234,7 +3155,7 @@ async function upsertBranchProtection(source, dryRun, requiredChecks) {
 			message: `classic protection on ${repo.defaultBranch}`
 		};
 	} catch (err) {
-		if (err instanceof ProviderApiError && err.status === 403) return {
+		if (err instanceof ProviderApiError$1 && err.status === 403) return {
 			capability: "source",
 			step,
 			status: "skip",
@@ -2251,16 +3172,18 @@ async function upsertBranchProtection(source, dryRun, requiredChecks) {
 async function runSetup(input) {
 	const print = input.print ?? ((line) => console.log(line));
 	const loader = input.loader ?? new PluginLoader(input.loaded.resolved, input.context);
-	await loader.load();
+	await withSpinner("Loading plugins…", () => loader.load());
 	const config = input.loaded.resolved;
 	const dryRun = input.context.dryRun ?? false;
 	const steps = [];
-	print(`Holocron setup — ${config.project.name}${dryRun ? " (dry-run)" : ""}`);
-	print(`  config: ${input.loaded.filepath}`);
+	const repo = config.repo;
+	const effectivePreset = repo?.protection;
+	print(style.header(`Holocron setup — ${config.name}${dryRun ? " (dry-run)" : ""}`));
+	print(style.dim(`  config: ${input.loaded.filepath}`));
 	print("");
 	if (loader.has("source")) {
 		const source = loader.get("source");
-		print("  → source");
+		print(style.step("source"));
 		for (const method of [
 			"enableVulnerabilityAlerts",
 			"enableAutomatedSecurityFixes",
@@ -2273,27 +3196,37 @@ async function runSetup(input) {
 			}));
 			print(formatStep(steps[steps.length - 1]));
 		}
-		steps.push(await runStep("source", "enableCodeScanning", dryRun, async () => {
-			return await source.enableCodeScanning();
+		const usesAdvancedCodeQL = (config.workflows ?? []).map((e) => typeof e === "string" ? e : e.name).includes("codeql");
+		steps.push(await runStep("source", usesAdvancedCodeQL ? "disableDefaultCodeScanning" : "enableCodeScanning", dryRun, async () => {
+			if (usesAdvancedCodeQL) await source.disableDefaultCodeScanning();
+			else return await source.enableCodeScanning();
 		}));
 		print(formatStep(steps[steps.length - 1]));
-		const policy = config.project.repoPolicy;
-		if (policy && policy.preset !== "none") {
-			const preset = policy.preset ?? "balanced";
+		if (effectivePreset && effectivePreset !== "none") {
 			steps.push(await runStep("source", "updateRepoSettings", dryRun, async () => {
 				await source.updateRepoSettings(BALANCED_REPO_SETTINGS);
 			}));
 			print(formatStep(steps[steps.length - 1]));
-			const requiredChecks = preset === "strict" ? policy.requiredChecks ?? [] : [];
+			const configuredWorkflowNames = (config.workflows ?? []).map((entry) => typeof entry === "string" ? entry : entry.name);
+			const requiredChecks = effectivePreset === "strict" ? [
+				"DCO",
+				...configuredWorkflowNames.flatMap((name) => {
+					const ctx = WORKFLOW_CHECK_CONTEXTS[name];
+					return ctx ? [ctx] : [];
+				}),
+				...repo?.requiredChecks ?? []
+			] : [];
 			steps.push(await upsertBranchProtection(source, dryRun, requiredChecks));
 			print(formatStep(steps[steps.length - 1]));
 		}
 	}
-	const workflows = config.project.workflows;
+	const workflows = config.workflows;
 	if (loader.has("source") && workflows && workflows.length > 0) {
 		const source = loader.get("source");
-		print("  → workflows");
-		for (const name of workflows) {
+		print(style.step("workflows"));
+		for (const entry of workflows) {
+			const name = typeof entry === "string" ? entry : entry.name;
+			const withOverrides = typeof entry === "object" ? entry.with : void 0;
 			if (!KNOWN_WORKFLOWS.has(name)) {
 				steps.push({
 					capability: "source",
@@ -2305,21 +3238,103 @@ async function runSetup(input) {
 				continue;
 			}
 			steps.push(await runStep("source", `write workflow ${name}`, dryRun, async () => {
-				await source.writeWorkflowFile(`${name}.yml`, WORKFLOW_HEADER + WORKFLOW_TEMPLATES[name]);
+				await source.writeWorkflowFile(`${name}.yml`, workflowHeader() + generateThinCallerContent(name, withOverrides));
 			}));
 			print(formatStep(steps[steps.length - 1]));
 		}
 	}
-	if (loader.has("source") && config.project.repoPolicy?.preset !== "none") {
+	if (loader.has("source") && (config.workflows ?? []).map((e) => typeof e === "string" ? e : e.name).includes("bookkeeping")) {
+		const source = loader.get("source");
+		steps.push(await runStep("source", "write .github/labeler.yml", dryRun, async () => {
+			await source.writeRepoFile(".github/labeler.yml", labelerConfig());
+		}));
+		print(formatStep(steps[steps.length - 1]));
+	}
+	if (loader.has("source") && effectivePreset !== "none") {
 		const source = loader.get("source");
 		steps.push(await runStep("source", "write .github/dependabot.yml", dryRun, async () => {
-			await source.writeRepoFile(".github/dependabot.yml", DEPENDABOT_CONFIG);
+			await source.writeRepoFile(".github/dependabot.yml", dependabot_default);
+		}));
+		print(formatStep(steps[steps.length - 1]));
+	}
+	if (loader.has("source")) {
+		const source = loader.get("source");
+		steps.push(await runStep("source", "write .alexrc.json", dryRun, async () => {
+			await source.writeRepoFile(".alexrc.json", ALEX_CONFIG);
+		}));
+		print(formatStep(steps[steps.length - 1]));
+		steps.push(await runStep("source", "write .editorconfig", dryRun, async () => {
+			await source.writeRepoFile(".editorconfig", editorconfigContent());
+		}));
+		print(formatStep(steps[steps.length - 1]));
+		steps.push(await runStep("source", "write .editorconfig-checker.json", dryRun, async () => {
+			await source.writeRepoFile(".editorconfig-checker.json", EDITORCONFIG_CHECKER_CONFIG);
+		}));
+		print(formatStep(steps[steps.length - 1]));
+		steps.push(await runStep("source", "write codecov.yml", dryRun, async () => {
+			const packages = await readWorkspacePackages(input.context.repoRoot);
+			await source.writeRepoFile("codecov.yml", codecovContent(packages));
+			return packages.length > 0 ? `${packages.length} components` : "no components";
 		}));
 		print(formatStep(steps[steps.length - 1]));
+		if (source.syncLabels) {
+			steps.push(await runStep("source", "sync labels", dryRun, async () => {
+				return source.syncLabels(CANONICAL_LABELS, STALE_LABELS);
+			}));
+			print(formatStep(steps[steps.length - 1]));
+		}
+		const properties = {};
+		if (effectivePreset && effectivePreset !== "none") properties["branch_protection_level"] = effectivePreset;
+		const isMonorepo = await access(join(input.context.repoRoot, "pnpm-workspace.yaml")).then(() => true).catch(() => false);
+		properties["monorepo"] = String(isMonorepo);
+		const manual = repo?.properties ?? {};
+		if (manual.lifecycle) properties["lifecycle"] = manual.lifecycle;
+		if (manual.open_source !== void 0) properties["open_source"] = String(manual.open_source);
+		if (manual.runtime_environment) properties["runtime_environment"] = manual.runtime_environment;
+		if (manual.uses_external_packages !== void 0) properties["uses_external_packages"] = String(manual.uses_external_packages);
+		if (source.syncProperties) {
+			steps.push(await runStep("source", "sync properties", dryRun, () => source.syncProperties(properties)));
+			print(formatStep(steps[steps.length - 1]));
+		}
+		const topics = repo?.topics ?? [];
+		if (topics.length > 0 && source.syncTopics) {
+			steps.push(await runStep("source", "sync topics", dryRun, () => source.syncTopics(topics)));
+			print(formatStep(steps[steps.length - 1]));
+		}
+		const teams = repo?.teams ?? [];
+		if (teams.length > 0) if (source.syncTeams) {
+			steps.push(await runStep("source", "sync teams", dryRun, () => source.syncTeams(teams)));
+			print(formatStep(steps[steps.length - 1]));
+			const repoCoord = input.context.repo ?? repo?.name ?? "";
+			const org = repoCoord.includes("/") ? repoCoord.split("/")[0] : "";
+			const writeableTeams = teams.map((t) => typeof t === "string" ? {
+				slug: t,
+				permission: "push"
+			} : t).filter((t) => [
+				"push",
+				"maintain",
+				"admin"
+			].includes(t.permission));
+			if (org && writeableTeams.length > 0) {
+				steps.push(await runStep("source", "write .github/CODEOWNERS", dryRun, async () => {
+					const content = writeableTeams.map((t) => `* @${org}/${t.slug}`).join("\n") + "\n";
+					await source.writeRepoFile(".github/CODEOWNERS", content);
+				}));
+				print(formatStep(steps[steps.length - 1]));
+			}
+		} else {
+			steps.push({
+				capability: "source",
+				step: "sync teams",
+				status: "skip",
+				message: "provider does not implement syncTeams"
+			});
+			print(formatStep(steps[steps.length - 1]));
+		}
 	}
 	if (loader.has("environments")) {
 		const envs = loader.get("environments");
-		print("  → environments");
+		print(style.step("environments"));
 		for (const envName of ["staging", "production"]) {
 			steps.push(await runStep("environments", `upsert ${envName}`, dryRun, async () => {
 				await envs.upsertEnvironment({ name: envName });
@@ -2329,15 +3344,15 @@ async function runSetup(input) {
 	}
 	if (loader.has("deployment")) {
 		const deploy = loader.get("deployment");
-		print("  → deployment");
-		steps.push(await runStep("deployment", `ensureProject ${config.project.name}`, dryRun, async () => {
-			await deploy.ensureProject({ name: config.project.name });
+		print(style.step("deployment"));
+		steps.push(await runStep("deployment", `ensureProject ${config.name}`, dryRun, async () => {
+			await deploy.ensureProject({ name: config.name });
 		}));
 		print(formatStep(steps[steps.length - 1]));
 	}
 	if (loader.has("auth")) {
 		const auth = loader.get("auth");
-		print("  → auth");
+		print(style.step("auth"));
 		if (auth.ensureWebhookApp) {
 			steps.push(await runStep("auth", "ensureWebhookApp", dryRun, async () => {
 				return `webhook ${(await auth.ensureWebhookApp()).alreadyExists ? "exists" : "created"}`;
@@ -2355,10 +3370,10 @@ async function runSetup(input) {
 	}
 	if (loader.has("vault")) {
 		const vault = loader.get("vault");
-		print("  → vault");
+		print(style.step("vault"));
 		if (vault.ensureProject) {
-			steps.push(await runStep("vault", `ensureProject ${config.project.name}`, dryRun, async () => {
-				return `project ${(await vault.ensureProject(config.project.name)).alreadyExists ? "exists" : "created"}`;
+			steps.push(await runStep("vault", `ensureProject ${config.name}`, dryRun, async () => {
+				return `project ${(await vault.ensureProject(config.name)).alreadyExists ? "exists" : "created"}`;
 			}));
 			print(formatStep(steps[steps.length - 1]));
 		}
@@ -2368,7 +3383,7 @@ async function runSetup(input) {
 			"prd"
 		]) {
 			steps.push(await runStep("vault", `ensureEnvironment ${envName}`, dryRun, async () => {
-				return `${envName} ${(await vault.ensureEnvironment(config.project.name, envName)).alreadyExists ? "exists" : "created"}`;
+				return `${envName} ${(await vault.ensureEnvironment(config.name, envName)).alreadyExists ? "exists" : "created"}`;
 			}));
 			print(formatStep(steps[steps.length - 1]));
 		}
@@ -2392,7 +3407,7 @@ async function runSetup(input) {
 	}
 	if (loader.has("tooling")) {
 		const tools = loader.get("tooling");
-		print("  → tooling");
+		print(style.step("tooling"));
 		for (const tool of tools) {
 			steps.push(await runStep("tooling", `${tool.providerName}.sync`, dryRun, async () => {
 				await tool.sync();
@@ -2400,6 +3415,23 @@ async function runSetup(input) {
 			print(formatStep(steps[steps.length - 1]));
 		}
 	}
+	if (config.skills && config.skills.length > 0 && config.agent) {
+		print(style.step("skills"));
+		if (!(config.agent in AGENT_SYMLINK_PATHS)) steps.push({
+			capability: "skills",
+			step: "install skills",
+			status: "skip",
+			message: `agent "${config.agent}" has no known skill install path`
+		});
+		else steps.push(await runStep("skills", "install skills", dryRun, async () => {
+			return await installSkills({
+				agent: config.agent,
+				skills: config.skills,
+				repoRoot: input.context.repoRoot
+			});
+		}));
+		print(formatStep(steps[steps.length - 1]));
+	}
 	const summary = steps.reduce((acc, s) => {
 		if (s.status === "ok") acc.ok += 1;
 		else if (s.status === "fail") acc.fail += 1;
@@ -2413,12 +3445,118 @@ async function runSetup(input) {
 		dryRun: 0
 	});
 	print("");
-	print(`  ${summary.ok} ok, ${summary.fail} fail, ${summary.skip} skipped${dryRun ? `, ${summary.dryRun} would-do` : ""}`);
+	const summaryLine = `  ${summary.ok} ok, ${summary.fail} fail, ${summary.skip} skipped${dryRun ? `, ${summary.dryRun} would-do` : ""}`;
+	print(summary.fail > 0 ? style.fail(summaryLine.trim()) : style.success(summaryLine.trim()));
+	if (steps.some((s) => s.reason === "permissions")) {
+		print("");
+		print(style.warn("Some steps failed with 403 (insufficient token permissions)."));
+		print(style.hint("     These operations require a temporary fine-grained PAT with the"));
+		print(style.hint("     following repository permissions:"));
+		print("");
+		print(style.hint("       · Administration          — read and write"));
+		print(style.hint("       · Code scanning alerts    — read and write"));
+		print(style.hint("       · Contents                — read and write"));
+		print(style.hint("       · Secret scanning alerts  — read and write"));
+		print(style.hint("       · Workflows               — read and write"));
+		print(style.hint("       · Metadata                — read (added automatically)"));
+		print("");
+		print(style.hint("     Create one at: https://github.com/settings/personal-access-tokens/new"));
+		print(style.hint("     Then re-run:   holocron setup --token <your-temp-pat>"));
+		print(style.hint("     You can revoke it immediately after setup completes."));
+	}
 	return {
 		steps,
 		summary
 	};
 }
+const AGENTS_SKILLS_ROOT = ".agents/skills";
+/** Relative path of the agent-specific symlink. undefined = unsupported agent. */
+const AGENT_SYMLINK_PATHS = { claude: (name) => `.claude/skills/${name}` };
+const GITIGNORE_BLOCK_START = "# managed by holocron setup — skills";
+const GITIGNORE_BLOCK_END = "# end managed by holocron setup — skills";
+async function installSkills({ agent, skills, repoRoot }) {
+	const symlinkFn = AGENT_SYMLINK_PATHS[agent];
+	if (!symlinkFn) return `agent "${agent}" has no known skill install path — skipping`;
+	const require = createRequire(pathToFileURL(join(repoRoot, "package.json")));
+	let skillsRoot;
+	try {
+		skillsRoot = dirname(require.resolve("@theholocron/skills/package.json"));
+	} catch {
+		throw new Error("@theholocron/skills not found — run: pnpm add -D @theholocron/skills");
+	}
+	const gitignorePath = join(repoRoot, ".gitignore");
+	const existingContent = await readFile(gitignorePath, "utf8").catch(() => "");
+	const previouslyInstalled = parsePreviousSkills(existingContent, symlinkFn);
+	const currentSet = new Set(skills);
+	const stale = previouslyInstalled.filter((n) => !currentSet.has(n));
+	for (const name of stale) {
+		await rm(join(repoRoot, symlinkFn(name)), { force: true }).catch(() => void 0);
+		await rm(join(repoRoot, AGENTS_SKILLS_ROOT, name), {
+			recursive: true,
+			force: true
+		}).catch(() => void 0);
+	}
+	const installed = [];
+	const missing = [];
+	for (const name of skills) {
+		const srcDir = join(skillsRoot, "skills", name);
+		try {
+			await stat(srcDir);
+		} catch {
+			missing.push(name);
+			continue;
+		}
+		const agentsDir = join(repoRoot, AGENTS_SKILLS_ROOT, name);
+		await copyDirRecursive(srcDir, agentsDir);
+		const symlinkPath = join(repoRoot, symlinkFn(name));
+		await mkdir(dirname(symlinkPath), { recursive: true });
+		try {
+			await unlink(symlinkPath);
+		} catch {}
+		await symlink(relative(dirname(symlinkPath), agentsDir).replace(/\\/g, "/"), symlinkPath);
+		installed.push(name);
+	}
+	if (installed.length > 0 || stale.length > 0 || missing.length > 0) await updateSkillsGitignore(gitignorePath, existingContent, [...installed, ...missing], symlinkFn);
+	const parts = [`installed ${installed.length}`];
+	if (stale.length > 0) parts.push(`pruned: ${stale.join(", ")}`);
+	if (missing.length > 0) parts.push(`unknown: ${missing.join(", ")}`);
+	return parts.join("; ");
+}
+/** Extract skill names from the previous gitignore block so stale dirs can be pruned. */
+function parsePreviousSkills(gitignoreContent, symlinkFn) {
+	if (!gitignoreContent.includes(GITIGNORE_BLOCK_START)) return [];
+	const startIdx = gitignoreContent.indexOf(GITIGNORE_BLOCK_START);
+	const endIdx = gitignoreContent.indexOf(GITIGNORE_BLOCK_END, startIdx);
+	const block = endIdx !== -1 ? gitignoreContent.slice(startIdx, endIdx) : gitignoreContent.slice(startIdx);
+	const placeholder = "__placeholder__";
+	const symlinkPrefix = `/${symlinkFn(placeholder)}`.replace(placeholder, "");
+	return block.split("\n").filter((line) => line.startsWith(symlinkPrefix)).map((line) => line.slice(symlinkPrefix.length));
+}
+async function copyDirRecursive(src, dest) {
+	await mkdir(dest, { recursive: true });
+	const entries = await readdir(src, { withFileTypes: true });
+	for (const entry of entries) {
+		const srcPath = join(src, entry.name);
+		const destPath = join(dest, entry.name);
+		if (entry.isDirectory()) await copyDirRecursive(srcPath, destPath);
+		else await copyFile(srcPath, destPath);
+	}
+}
+async function updateSkillsGitignore(gitignorePath, existingContent, skills, symlinkFn) {
+	const block = [
+		GITIGNORE_BLOCK_START,
+		...[`/${AGENTS_SKILLS_ROOT}/`, ...skills.map((n) => `/${symlinkFn(n)}`)],
+		GITIGNORE_BLOCK_END
+	].join("\n");
+	let content;
+	if (existingContent.includes(GITIGNORE_BLOCK_START)) {
+		const start = existingContent.indexOf(GITIGNORE_BLOCK_START);
+		const end = existingContent.indexOf(GITIGNORE_BLOCK_END, start);
+		const afterBlock = end !== -1 ? existingContent.slice(end + 40) : "\n";
+		content = existingContent.slice(0, start) + block + afterBlock;
+	} else content = (existingContent.trimEnd() ? existingContent.trimEnd() + "\n\n" : "") + block + "\n";
+	await writeFile(gitignorePath, content, "utf8");
+}
 async function runStep(capability, step, dryRun, body) {
 	if (dryRun) return {
 		capability,
@@ -2435,6 +3573,16 @@ async function runStep(capability, step, dryRun, body) {
 		if (typeof note === "string") result.message = note;
 		return result;
 	} catch (err) {
+		if (err instanceof ProviderApiError$1 && err.status === 403) {
+			const reason = classify403(err);
+			return {
+				capability,
+				step,
+				status: "fail",
+				message: err.message,
+				reason
+			};
+		}
 		return {
 			capability,
 			step,
@@ -2443,26 +3591,335 @@ async function runStep(capability, step, dryRun, body) {
 		};
 	}
 }
+function classify403(err) {
+	const detailText = typeof err.details === "string" ? err.details : typeof err.details === "object" && err.details !== null && "message" in err.details ? String(err.details.message) : "";
+	const text = `${err.message} ${detailText}`.toLowerCase();
+	if (text.includes("advanced security") || text.includes("not enabled for this repository") || text.includes("upgrade") || text.includes("not available on")) return "plan";
+	return "permissions";
+}
 function formatStep(step) {
+	const tag = step.reason === "permissions" ? " [permissions]" : step.reason === "plan" ? " [plan restriction]" : "";
+	const detail = step.message ? style.dim(`  (${step.message})`) : "";
+	const label = `${step.step}${tag}${detail}`;
+	if (step.status === "ok") return `    ${style.success(label)}`;
+	if (step.status === "fail") return `    ${style.fail(label)}`;
+	if (step.status === "dry-run") return `    ${style.dim(`… ${label}`)}`;
+	return `    ${style.dim(`· ${label}`)}`;
+}
+//#endregion
+//#region src/commands/skills.ts
+async function runSkillsInstall(input) {
+	const print = input.print ?? ((line) => console.log(line));
+	const config = input.loaded.resolved;
+	if (!config.agent || !config.skills?.length) {
+		print("Nothing to install — set `agent` and `skills` in holocron.config.ts");
+		return;
+	}
+	if (input.context.dryRun) {
+		print(`Would install ${config.skills.length} skill(s) for agent: ${config.agent}`);
+		for (const name of config.skills) print(`  → would install: ${name}`);
+		return;
+	}
+	print(`Installing ${config.skills.length} skill(s) for agent: ${config.agent}`);
+	try {
+		print(`  → ${await installSkills({
+			agent: config.agent,
+			skills: config.skills,
+			repoRoot: input.context.repoRoot
+		})}`);
+	} catch (err) {
+		print(`  ✗ ${err instanceof Error ? err.message : String(err)}`);
+	}
+}
+//#endregion
+//#region src/commands/sync.ts
+const SYNC_STEPS = [
+	"labels",
+	"properties",
+	"teams",
+	"topics",
+	"keywords",
+	"description"
+];
+const LOCAL_STEPS = /* @__PURE__ */ new Set(["keywords", "description"]);
+async function runSync(input) {
+	const print = input.print ?? ((line) => console.log(line));
+	const loader = input.loader ?? new PluginLoader(input.loaded.resolved, input.context);
+	const config = input.loaded.resolved;
+	const dryRun = input.context.dryRun ?? false;
+	const requestedSteps = input.steps;
+	const steps = [];
+	if (!requestedSteps || requestedSteps.some((s) => !LOCAL_STEPS.has(s))) await loader.load();
+	else try {
+		await loader.load();
+	} catch (err) {
+		if (!(err instanceof AuthError)) throw err;
+	}
+	print(`Holocron sync — ${config.name}${dryRun ? " (dry-run)" : ""}`);
+	print(`  config: ${input.loaded.filepath}`);
+	print("");
+	if (loader.has("source")) {
+		const source = loader.get("source");
+		print("  → source");
+		for (const stepName of SYNC_STEPS) {
+			if (requestedSteps !== void 0 && !requestedSteps.includes(stepName)) continue;
+			if (LOCAL_STEPS.has(stepName)) continue;
+			if (stepName === "labels") if (source.syncLabels) {
+				steps.push(await runSyncStep("source", "sync labels", dryRun, () => source.syncLabels(CANONICAL_LABELS, STALE_LABELS)));
+				print(formatSyncStep(steps[steps.length - 1]));
+			} else {
+				steps.push({
+					capability: "source",
+					step: "sync labels",
+					status: "skip",
+					message: "provider does not implement syncLabels"
+				});
+				print(formatSyncStep(steps[steps.length - 1]));
+			}
+			if (stepName === "properties") if (source.syncProperties) {
+				const repo = config.repo;
+				const properties = {};
+				const effectivePreset = repo?.protection;
+				if (effectivePreset && effectivePreset !== "none") properties["branch_protection_level"] = effectivePreset;
+				const isMonorepo = await access(join(input.context.repoRoot, "pnpm-workspace.yaml")).then(() => true).catch(() => false);
+				properties["monorepo"] = String(isMonorepo);
+				const manual = repo?.properties ?? {};
+				if (manual.lifecycle) properties["lifecycle"] = manual.lifecycle;
+				if (manual.open_source !== void 0) properties["open_source"] = String(manual.open_source);
+				if (manual.runtime_environment) properties["runtime_environment"] = manual.runtime_environment;
+				if (manual.uses_external_packages !== void 0) properties["uses_external_packages"] = String(manual.uses_external_packages);
+				steps.push(await runSyncStep("source", "sync properties", dryRun, () => source.syncProperties(properties)));
+				print(formatSyncStep(steps[steps.length - 1]));
+			} else {
+				steps.push({
+					capability: "source",
+					step: "sync properties",
+					status: "skip",
+					message: "provider does not implement syncProperties"
+				});
+				print(formatSyncStep(steps[steps.length - 1]));
+			}
+			if (stepName === "teams") {
+				const teams = config.repo?.teams ?? [];
+				if (teams.length === 0) {
+					steps.push({
+						capability: "source",
+						step: "sync teams",
+						status: "skip",
+						message: "no teams configured"
+					});
+					print(formatSyncStep(steps[steps.length - 1]));
+				} else if (source.syncTeams) {
+					steps.push(await runSyncStep("source", "sync teams", dryRun, () => source.syncTeams(teams)));
+					print(formatSyncStep(steps[steps.length - 1]));
+					const repoCoord = input.context.repo ?? config.repo?.name ?? "";
+					const org = repoCoord.includes("/") ? repoCoord.split("/")[0] : "";
+					const writeableTeams = teams.map((t) => typeof t === "string" ? {
+						slug: t,
+						permission: "push"
+					} : t).filter((t) => [
+						"push",
+						"maintain",
+						"admin"
+					].includes(t.permission));
+					if (org && writeableTeams.length > 0) {
+						steps.push(await runSyncStep("source", "write .github/CODEOWNERS", dryRun, async () => {
+							const content = writeableTeams.map((t) => `* @${org}/${t.slug}`).join("\n") + "\n";
+							await source.writeRepoFile(".github/CODEOWNERS", content);
+						}));
+						print(formatSyncStep(steps[steps.length - 1]));
+					}
+				} else {
+					steps.push({
+						capability: "source",
+						step: "sync teams",
+						status: "skip",
+						message: "provider does not implement syncTeams"
+					});
+					print(formatSyncStep(steps[steps.length - 1]));
+				}
+			}
+			if (stepName === "topics") {
+				const topics = config.repo?.topics ?? [];
+				if (topics.length === 0) {
+					steps.push({
+						capability: "source",
+						step: "sync topics",
+						status: "skip",
+						message: "no topics configured"
+					});
+					print(formatSyncStep(steps[steps.length - 1]));
+				} else if (source.syncTopics) {
+					steps.push(await runSyncStep("source", "sync topics", dryRun, () => source.syncTopics(topics)));
+					print(formatSyncStep(steps[steps.length - 1]));
+				} else {
+					steps.push({
+						capability: "source",
+						step: "sync topics",
+						status: "skip",
+						message: "provider does not implement syncTopics"
+					});
+					print(formatSyncStep(steps[steps.length - 1]));
+				}
+			}
+		}
+		if (requestedSteps) {
+			for (const name of requestedSteps) if (!SYNC_STEPS.includes(name)) {
+				steps.push({
+					capability: "source",
+					step: `sync ${name}`,
+					status: "skip",
+					message: `unknown step "${name}"`
+				});
+				print(formatSyncStep(steps[steps.length - 1]));
+			}
+		}
+	}
+	for (const stepName of ["keywords", "description"]) {
+		if (requestedSteps !== void 0 && !requestedSteps.includes(stepName)) continue;
+		if (stepName === "keywords") {
+			const topics = config.repo?.topics ?? [];
+			if (topics.length === 0) {
+				steps.push({
+					capability: "local",
+					step: "sync keywords",
+					status: "skip",
+					message: "no topics configured"
+				});
+				print(formatSyncStep(steps[steps.length - 1]));
+			} else {
+				steps.push(await runSyncStep("local", "sync keywords", dryRun, async () => {
+					return await writePackageJsonField(input.context.repoRoot, "keywords", topics) ? `${topics.length} keywords written` : `${topics.length} topics (no package.json)`;
+				}));
+				print(formatSyncStep(steps[steps.length - 1]));
+			}
+		}
+		if (stepName === "description") {
+			const description = config.description;
+			if (!description) {
+				steps.push({
+					capability: "local",
+					step: "sync description",
+					status: "skip",
+					message: "no description configured"
+				});
+				print(formatSyncStep(steps[steps.length - 1]));
+			} else {
+				const source = loader.has("source") ? loader.get("source") : null;
+				steps.push(await runSyncStep("local", "sync description", dryRun, async () => {
+					const pkgWrote = await writePackageJsonField(input.context.repoRoot, "description", description);
+					const readmeWrote = await updateReadmeDescription(input.context.repoRoot, description);
+					if (source?.syncDescription) await source.syncDescription(description);
+					const parts = [];
+					if (pkgWrote) parts.push("package.json");
+					if (readmeWrote) parts.push("README.md");
+					if (source?.syncDescription) parts.push("GitHub");
+					return parts.length > 0 ? parts.join(", ") + " updated" : "description synced";
+				}));
+				print(formatSyncStep(steps[steps.length - 1]));
+			}
+		}
+	}
+	const summary = steps.reduce((acc, s) => {
+		if (s.status === "ok") acc.ok += 1;
+		else if (s.status === "fail") acc.fail += 1;
+		else if (s.status === "skip") acc.skip += 1;
+		else if (s.status === "dry-run") acc.dryRun += 1;
+		return acc;
+	}, {
+		ok: 0,
+		fail: 0,
+		skip: 0,
+		dryRun: 0
+	});
+	print("");
+	print(`  ${summary.ok} ok, ${summary.fail} fail, ${summary.skip} skipped${dryRun ? `, ${summary.dryRun} would-do` : ""}`);
+	return {
+		steps,
+		summary
+	};
+}
+async function runSyncStep(capability, step, dryRun, body) {
+	if (dryRun) return {
+		capability,
+		step,
+		status: "dry-run"
+	};
+	try {
+		const note = await body();
+		const result = {
+			capability,
+			step,
+			status: "ok"
+		};
+		if (typeof note === "string") result.message = note;
+		return result;
+	} catch (err) {
+		return {
+			capability,
+			step,
+			status: "fail",
+			message: err instanceof Error ? err.message : String(err)
+		};
+	}
+}
+function formatSyncStep(step) {
 	const icon = step.status === "ok" ? "✓" : step.status === "fail" ? "✗" : step.status === "dry-run" ? "…" : "·";
 	const detail = step.message ? `  (${step.message})` : "";
 	return `    ${icon} ${step.step}${detail}`;
 }
+async function writePackageJsonField(repoRoot, field, value) {
+	const pkgPath = join(repoRoot, "package.json");
+	let content;
+	try {
+		content = await readFile(pkgPath, "utf8");
+	} catch {
+		return false;
+	}
+	const pkg = JSON.parse(content);
+	pkg[field] = value;
+	await writeFile(pkgPath, JSON.stringify(pkg, null, 2) + "\n", "utf8");
+	return true;
+}
+const README_DESC_START = "<!-- holocron:description -->";
+const README_DESC_END = "<!-- /holocron:description -->";
+async function updateReadmeDescription(repoRoot, description) {
+	const readmePath = join(repoRoot, "README.md");
+	let content;
+	try {
+		content = await readFile(readmePath, "utf8");
+	} catch {
+		return false;
+	}
+	const lines = content.split("\n");
+	const startIdx = lines.findIndex((l) => l.trim() === README_DESC_START);
+	const endIdx = lines.findIndex((l) => l.trim() === README_DESC_END);
+	if (startIdx !== -1) {
+		if (endIdx === -1 || endIdx <= startIdx) return false;
+		lines.splice(startIdx + 1, endIdx - startIdx - 1, description);
+		await writeFile(readmePath, lines.join("\n"), "utf8");
+		return true;
+	}
+	const h1Index = lines.findIndex((l) => /^# /.test(l));
+	if (h1Index === -1) return false;
+	lines.splice(h1Index + 1, 0, "", README_DESC_START, description, README_DESC_END);
+	await writeFile(readmePath, lines.join("\n"), "utf8");
+	return true;
+}
 //#endregion
 //#region src/load-config.ts
 /**
 * `holocron.config.{json,js,ts}` file loader.
 *
-* v2.0 only documents the JSON form, but the loader looks up all three
-* extensions in priority order (json → js → ts) — that's the schema
-* commitment captured in [`.notes/tech-architecture.spec.md` → Roadmap
-* → Shareable configs] so the JS/TS preset story (issue #75) can land
-* later without a breaking change.
+* Search order: json → js → ts. JSON is parsed directly; JS is loaded
+* via native dynamic import; TS is loaded via `tsImport` from tsx (a
+* runtime dep) so operators can write typed configs with `defineConfig`
+* without needing a separate build step.
 *
-* The JS/TS forms aren't actually parsed today; they trigger a clear
-* error telling the operator to use JSON for v2.0. The contract is the
-* lookup order, not the interpretation.
+* All three forms are validated through the same `resolveConfig` path.
+* Implements the lookup-order contract from issue #75 / #81.
 */
+const execFileAsync = promisify(execFile);
 const CANDIDATE_FILENAMES = [
 	"holocron.config.json",
 	"holocron.config.js",
@@ -2474,7 +3931,7 @@ var ConfigFileError = class extends Error {
 /**
 * Read + parse + resolve `holocron.config.*` from the given directory.
 * Search order: json → js → ts. Throws `ConfigFileError` if nothing
-* found, or `ConfigError` if the JSON is malformed / invalid.
+* found, or `ConfigError` if the config is malformed / invalid.
 */
 async function loadConfig(cwd) {
 	for (const filename of CANDIDATE_FILENAMES) {
@@ -2484,7 +3941,14 @@ async function loadConfig(cwd) {
 				resolved: await loadJson(fullPath),
 				filepath: fullPath
 			};
-			throw new ConfigFileError(`${filename} found, but v2.0 only supports the JSON form. Rename to holocron.config.json. The JS/TS form lands with the preset feature (see issue #75).`);
+			if (filename.endsWith(".ts")) return {
+				resolved: await loadTs(fullPath),
+				filepath: fullPath
+			};
+			return {
+				resolved: await loadJs(fullPath),
+				filepath: fullPath
+			};
 		}
 	}
 	throw new ConfigFileError(`no holocron.config.{json,js,ts} found in ${cwd}. Create one — see the README for the schema.`);
@@ -2497,7 +3961,61 @@ async function loadJson(filepath) {
 	} catch (err) {
 		throw new ConfigError(`${filepath} is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
 	}
-	return resolveConfig(parsed);
+	return resolveConfig(await deriveDefaults(dirname(filepath), parsed));
+}
+async function loadJs(filepath) {
+	const mod = await import(pathToFileURL(filepath).href);
+	return resolveConfig(await deriveDefaults(dirname(filepath), extractRaw(filepath, mod)));
+}
+async function loadTs(filepath) {
+	const { tsImport } = await import("tsx/esm/api");
+	const mod = await tsImport(pathToFileURL(filepath).href, import.meta.url);
+	return resolveConfig(await deriveDefaults(dirname(filepath), extractRaw(filepath, mod)));
+}
+function extractRaw(filepath, mod) {
+	const outer = mod.default;
+	const raw = outer?.__esModule === true ? outer.default : outer;
+	if (raw === void 0 || raw === null) throw new ConfigFileError(`${filepath} must have a default export (use \`export default defineConfig({…})\`)`);
+	return raw;
+}
+async function deriveDefaults(configDir, raw) {
+	const result = { ...raw };
+	if (!result.name) result.name = await readPackageJsonName(configDir) ?? basename(configDir);
+	if (result.repo && !result.repo.name) {
+		const repoName = await readGitRemote(configDir);
+		if (repoName) result.repo = {
+			...result.repo,
+			name: repoName
+		};
+	}
+	return result;
+}
+async function readPackageJsonName(dir) {
+	try {
+		const content = await readFile(join(dir, "package.json"), "utf8");
+		const pkg = JSON.parse(content);
+		return typeof pkg.name === "string" ? pkg.name.replace(/^@[^/]+\//, "") : void 0;
+	} catch {
+		return;
+	}
+}
+async function readGitRemote(dir) {
+	try {
+		const { stdout } = await execFileAsync("git", [
+			"remote",
+			"get-url",
+			"origin"
+		], { cwd: dir });
+		return parseGitRemoteUrl(stdout.trim());
+	} catch {
+		return;
+	}
+}
+function parseGitRemoteUrl(url) {
+	const httpsMatch = url.match(/github\.com\/([^/]+\/[^/]+?)(?:\.git)?$/);
+	if (httpsMatch) return httpsMatch[1];
+	const sshMatch = url.match(/github\.com:([^/]+\/[^/]+?)(?:\.git)?$/);
+	if (sshMatch) return sshMatch[1];
 }
 async function fileExists(path) {
 	try {
@@ -2548,6 +4066,18 @@ await yargs(hideBin(process.argv)).scriptName("holocron").usage("$0 <command> [o
 			...argv.token ? { cliToken: argv.token } : {}
 		}
 	})).summary.fail > 0) process.exitCode = 1;
+}).command("skills <action>", "Manage agent skills from the @theholocron/skills registry", (y) => y.positional("action", {
+	type: "string",
+	choices: ["install"],
+	describe: "install — copy skills from @theholocron/skills into .agents/ with agent symlinks"
+}), async (argv) => {
+	if (argv.action === "install") await runSkillsInstall({
+		loaded: await loadConfig(argv.cwd),
+		context: {
+			repoRoot: argv.cwd,
+			dryRun: argv.dryRun
+		}
+	});
 }).command("secret set <name> [value]", "Set a single secret via the configured `secrets` capability", (y) => y.positional("name", {
 	type: "string",
 	demandOption: true,
@@ -2653,7 +4183,59 @@ await yargs(hideBin(process.argv)).scriptName("holocron").usage("$0 <command> [o
 		dryRun: argv.dryRun,
 		...argv.otp ? { otp: argv.otp } : {}
 	})).status === "fail") process.exitCode = 1;
-}).demandCommand(1, "Run `holocron npm --help` to see available npm subcommands."), () => {}).command("config show", "Print the resolved holocron config", () => {}, async (argv) => {
+}).demandCommand(1, "Run `holocron npm --help` to see available npm subcommands."), () => {}).command("sync [steps..]", "Sync state from config to the provider and local files (labels, properties, topics, keywords, description)", (y) => y.positional("steps", {
+	type: "string",
+	array: true,
+	describe: "Steps to run: labels, properties, topics, keywords, description (default: all)"
+}).option("repo", {
+	type: "string",
+	describe: "Repo coords (\"owner/name\"). Defaults to plugin-specific resolution."
+}), async (argv) => {
+	if ((await runSync({
+		loaded: await loadConfig(argv.cwd),
+		context: {
+			repoRoot: argv.cwd,
+			dryRun: argv.dryRun,
+			...argv.repo ? { repo: argv.repo } : {},
+			...argv.token ? { cliToken: argv.token } : {}
+		},
+		...argv.steps && argv.steps.length > 0 ? { steps: argv.steps } : {}
+	})).summary.fail > 0) process.exitCode = 1;
+}).command("sync-github", "Sync workflow templates and composite actions to theholocron/.github via the GitHub API", (y) => y.option("repo", {
+	type: "string",
+	default: "theholocron/.github",
+	describe: "Target org/repo (default: theholocron/.github)"
+}).option("branch", {
+	type: "string",
+	describe: "Push to this branch instead of the default branch (enables PR-based workflow for protected repos)"
+}).option("pr", {
+	type: "boolean",
+	default: false,
+	describe: "Open a PR after pushing to --branch (no-op without --branch)"
+}).option("message", {
+	type: "string",
+	describe: "Commit message (default: chore: sync from theholocron/holocron)"
+}).option("output-dir", {
+	type: "string",
+	describe: "Write generated files to this local directory instead of pushing (for validation)"
+}), async (argv) => {
+	const outputDir = argv["output-dir"];
+	const token = outputDir ? "no-token-needed" : argv.token ?? process.env.GITHUB_TOKEN ?? process.env.HOLOCRON_GITHUB_TOKEN;
+	if (!token) {
+		console.error("sync-github: GitHub token required — pass --token or set GITHUB_TOKEN");
+		process.exitCode = 1;
+		return;
+	}
+	if ((await runSyncGithub({
+		token,
+		repo: argv.repo,
+		dryRun: argv.dryRun,
+		...argv.branch ? { branch: argv.branch } : {},
+		...argv.pr ? { createPr: true } : {},
+		...argv.message ? { message: argv.message } : {},
+		...outputDir ? { outputDir } : {}
+	})).status === "fail") process.exitCode = 1;
+}).command("config show", "Print the resolved holocron config", () => {}, async (argv) => {
 	const loaded = await loadConfig(argv.cwd);
 	console.log(JSON.stringify(loaded.resolved, null, 2));
 }).command("plugin create <slug> <vendor>", "Scaffold a new @theholocron/holocron-plugin-<slug> package", (y) => y.positional("slug", {
@@ -2680,15 +4262,40 @@ await yargs(hideBin(process.argv)).scriptName("holocron").usage("$0 <command> [o
 	type: "boolean",
 	default: true,
 	describe: "Run post-scaffold pnpm install + typecheck + lint + test (default true; --no-verify skips)"
-}), (argv) => {
+}), async (argv) => {
 	try {
-		if (!argv.capability || !argv.vendorEnv || !argv.baseUrl) throw new PluginCreateError("Phase A: --capability, --vendor-env, and --base-url are required. Interactive prompts land in Phase B.");
+		const capabilityKeys = Object.keys(CARDINALITY).join(", ");
+		const needsPrompt = !argv.capability || !argv.vendorEnv || !argv.baseUrl;
+		let capability;
+		let vendorEnv;
+		let baseUrl;
+		if (needsPrompt) {
+			const rl = createInterface({
+				input: stdin,
+				output: stdout
+			});
+			const ask = (question) => new Promise((resolve) => rl.question(`  ${question} `, (answer) => resolve(answer.trim())));
+			try {
+				if (!argv.capability) {
+					console.log(`  Available capabilities: ${capabilityKeys}`);
+					capability = await ask("Capability:");
+				} else capability = argv.capability;
+				vendorEnv = argv.vendorEnv ? argv.vendorEnv : await ask(`Vendor-native env var for the ${argv.vendor} token (e.g. MYVENDOR_API_KEY):`);
+				baseUrl = argv.baseUrl ? argv.baseUrl : await ask(`REST base URL for the ${argv.vendor} API (e.g. https://api.myvendor.com):`);
+			} finally {
+				rl.close();
+			}
+		} else {
+			capability = argv.capability;
+			vendorEnv = argv.vendorEnv;
+			baseUrl = argv.baseUrl;
+		}
 		if (runPluginCreate({
 			slug: argv.slug,
 			vendorName: argv.vendor,
-			capability: argv.capability,
-			vendorEnv: argv.vendorEnv,
-			baseUrl: argv.baseUrl,
+			capability,
+			vendorEnv,
+			baseUrl,
 			...argv.tokenEnv ? { tokenEnv: argv.tokenEnv } : {},
 			dryRun: argv.dryRun,
 			noVerify: !argv.verify,
@@ -2702,7 +4309,32 @@ await yargs(hideBin(process.argv)).scriptName("holocron").usage("$0 <command> [o
 		}
 		throw err;
 	}
-}).command("auth <subcommand>", "Manage bootstrap credentials in the OS keyring", (y) => y.command("set <provider> [token]", "Verify + store a bootstrap token for a provider", (yy) => yy.positional("provider", {
+}).command("upgrade", "Upgrade toolchain version pins across the repo", (y) => y.command("node <to>", "Scan the repo and update every Node.js version pin to a new major", (yy) => yy.positional("to", {
+	type: "number",
+	demandOption: true,
+	describe: "Target Node.js major version (e.g., 22)"
+}).option("from", {
+	type: "number",
+	describe: "Current major version to replace. Auto-detected from .nvmrc / engines.node when omitted."
+}), async (argv) => {
+	let extra = [];
+	try {
+		const raw = readFileSync(join(argv.cwd, "holocron.config.json"), "utf8");
+		const upgradeNode = JSON.parse(raw).upgrade?.node;
+		if (Array.isArray(upgradeNode?.extra)) extra = upgradeNode.extra;
+	} catch {}
+	const report = await runUpgradeNode({
+		to: argv.to,
+		...argv.from != null ? { from: argv.from } : {},
+		cwd: argv.cwd,
+		dryRun: argv.dryRun,
+		extra
+	});
+	if (report.status === "fail") {
+		if (report.message) console.error(`upgrade node: ${report.message}`);
+		process.exitCode = 1;
+	}
+}).demandCommand(1, "Run `holocron upgrade --help` to see available upgrade subcommands."), () => {}).command("auth <subcommand>", "Manage bootstrap credentials in the OS keyring", (y) => y.command("set <provider> [token]", "Verify + store a bootstrap token for a provider", (yy) => yy.positional("provider", {
 	type: "string",
 	demandOption: true
 }).positional("token", { type: "string" }), async (argv) => {