@theholocron/cli 2.0.0-alpha.8 → 2.0.0

package/dist/cli.mjs

@@ -1,12 +1,261 @@
-#!/usr/bin/env -S tsx
-import { n as ProviderApiError, t as CARDINALITY } from "./capabilities-DapaKOlX.mjs";
-import { a as ConfigError, c as resolvePluginPackage, i as setToken, n as getToken, o as resolveConfig, r as listStoredProviders, t as deleteToken } from "./keyring-DwNEmrBc.mjs";
+#!/usr/bin/env node
+import { createRequire } from "node:module";
 import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
+import path, { basename, dirname, join, relative } from "node:path";
 import yargs from "yargs";
 import { hideBin } from "yargs/helpers";
-import path, { join } from "node:path";
-import { spawnSync } from "node:child_process";
-import { readFile, stat } from "node:fs/promises";
+import { createInterface } from "node:readline";
+import { stdin, stdout } from "node:process";
+import { AuthError, ProviderApiError, ProviderApiError as ProviderApiError$1 } from "@theholocron/http-client";
+import { Entry, findCredentials } from "@napi-rs/keyring";
+import ora from "ora";
+import chalk from "chalk";
+import { execFile, execFileSync, spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { createGitHubClient } from "@theholocron/github-client";
+import { access, copyFile, mkdir, readFile, readdir, rm, stat, symlink, unlink, writeFile } from "node:fs/promises";
+import { pathToFileURL } from "node:url";
+import { promisify } from "node:util";
+import { homedir } from "node:os";
+//#region src/capabilities/index.ts
+const CARDINALITY = {
+	source: "single",
+	ci: "single",
+	secrets: "single",
+	environments: "single",
+	issues: "single",
+	deployment: "single",
+	storage: "single",
+	auth: "single",
+	vault: "single",
+	dns: "single",
+	tooling: "many",
+	notifications: "many",
+	analytics: "many",
+	observability: "many"
+};
+/**
+* No capabilities are strictly required — repos without secrets (e.g. org
+* community health repos) legitimately omit vault. Plugins validate their
+* own requirements at call time.
+*/
+const REQUIRED_CAPABILITIES = [];
+//#endregion
+//#region src/config.ts
+/**
+* `holocron.config.json` schema, parser, and provider resolution.
+*
+* ESLint-style entry forms:
+*
+*   "source": "github"                              ← single, short
+*   "deployment": ["vercel", { team: "rando" }]    ← single, with options
+*   "notifications": ["slack", "discord"]          ← multi, short
+*   "notifications": [
+*     ["slack",   { channel: "#ops" }],
+*     ["discord", { webhook: "env:HOOK" }]
+*   ]                                              ← multi, with options
+*
+* Discriminator: an array entry is a `[provider, options]` tuple when
+* the length is 2 AND element[1] is a non-array, non-null object.
+* Otherwise it's a multi-provider list (string[] or tuple[]).
+*
+* Validation rules:
+*   - `vault` is REQUIRED (every project has secrets somewhere)
+*   - Entries for `'many'` capabilities are normalized to an array of
+*     normalized tuples; entries for `'single'` capabilities are
+*     normalized to one tuple
+*   - Tokens / secret values never appear in config — providers read
+*     them from env (or pull from `vault` at runtime)
+*/
+var ConfigError = class extends Error {
+	name = "ConfigError";
+};
+const PLUGIN_PREFIX = "@theholocron/holocron-plugin-";
+const COMMUNITY_PREFIX = "holocron-plugin-";
+/**
+* Resolve `"github"` → `"@theholocron/holocron-plugin-github"`.
+* Fully-qualified names (scoped or not) are honored verbatim, which
+* is how third-party plugins published outside the org work.
+*/
+function resolvePluginPackage(provider) {
+	if (!provider) throw new ConfigError("provider name is empty");
+	if (provider.startsWith("@")) return provider;
+	if (provider.startsWith(COMMUNITY_PREFIX)) return provider;
+	if (provider.includes("/")) return provider;
+	return PLUGIN_PREFIX + provider;
+}
+/** A bare `[provider, options]` tuple, with both elements present? */
+function isOptionsTuple(value) {
+	if (!Array.isArray(value)) return false;
+	if (value.length !== 2) return false;
+	if (typeof value[0] !== "string") return false;
+	const opt = value[1];
+	return typeof opt === "object" && opt !== null && !Array.isArray(opt);
+}
+function normalizeEntry(entry) {
+	if (typeof entry === "string") return {
+		provider: entry,
+		packageName: resolvePluginPackage(entry),
+		options: {}
+	};
+	const [provider, options] = entry;
+	return {
+		provider,
+		packageName: resolvePluginPackage(provider),
+		options
+	};
+}
+function resolveEntry(key, raw) {
+	const cardinality = CARDINALITY[key];
+	if (typeof raw === "string") {
+		if (cardinality === "many") throw new ConfigError(`\`${key}\` accepts multiple providers; wrap a single one in an array: ["${raw}"]`);
+		return {
+			cardinality: "single",
+			tuple: normalizeEntry(raw)
+		};
+	}
+	if (!Array.isArray(raw)) throw new ConfigError(`\`${key}\` entry must be a string or array, got ${typeof raw}`);
+	if (isOptionsTuple(raw)) {
+		if (cardinality === "many") return {
+			cardinality: "many",
+			tuples: [normalizeEntry(raw)]
+		};
+		return {
+			cardinality: "single",
+			tuple: normalizeEntry(raw)
+		};
+	}
+	if (cardinality === "single") throw new ConfigError(`\`${key}\` accepts exactly one provider; got a multi-provider list with ${raw.length} entries`);
+	return {
+		cardinality: "many",
+		tuples: raw.map((entry, idx) => {
+			if (typeof entry === "string") return normalizeEntry(entry);
+			if (isOptionsTuple(entry)) return normalizeEntry(entry);
+			throw new ConfigError(`\`${key}[${idx}]\` must be a provider string or [provider, options] tuple`);
+		})
+	};
+}
+function resolveConfig(raw) {
+	if (!raw.name) throw new ConfigError("`name` is required");
+	if (!raw.providers || typeof raw.providers !== "object") throw new ConfigError("`providers` block is required");
+	const providers = {};
+	for (const [key, entry] of Object.entries(raw.providers)) {
+		if (entry === void 0) continue;
+		providers[key] = resolveEntry(key, entry);
+	}
+	for (const required of REQUIRED_CAPABILITIES) if (!providers[required]) throw new ConfigError(`required capability \`${required}\` is missing from providers`);
+	return {
+		name: raw.name,
+		description: raw.description,
+		repo: raw.repo,
+		workflows: raw.workflows,
+		providers,
+		apps: raw.apps ?? [],
+		doctor: raw.doctor ?? {},
+		agent: raw.agent,
+		skills: raw.skills
+	};
+}
+//#endregion
+//#region src/keyring.ts
+/**
+* Keyring-backed bootstrap credential store.
+*
+* Every holocron plugin's bootstrap token (the one it needs before it
+* can talk to its vendor's API) can be stored in the OS keyring under
+* a single reverse-DNS service scope. Managed via `holocron auth`
+* subcommands; consulted at position 4 in every plugin's auth
+* precedence chain (after --token / HOLOCRON_<X>_TOKEN / <native>_TOKEN).
+*
+* See `.notes/tech-auth-bootstrap.spec.md` for the design rationale.
+*
+* Failure model: keyring access is best-effort. Platforms without a
+* supported credential store (some Linux CI images, sandboxed
+* environments) will throw from the underlying library. Every export
+* here catches and returns a null/empty result rather than propagating
+* — the plugin's precedence chain then falls through to
+* env-var-only paths, which is exactly how CI is meant to work.
+*/
+const SERVICE = "com.theholocron.cli";
+/**
+* Store or overwrite a bootstrap token for a provider. Returns true on
+* success, false when the underlying keyring is unsupported or errored.
+*/
+function setToken(provider, token) {
+	try {
+		new Entry(SERVICE, provider).setPassword(token);
+		return true;
+	} catch {
+		return false;
+	}
+}
+/**
+* Read the bootstrap token for a provider. Returns `null` for both
+* "not stored" and "keyring unavailable" — callers can treat them the
+* same way (fall through to env-var precedence).
+*/
+function getToken(provider) {
+	try {
+		return new Entry(SERVICE, provider).getPassword();
+	} catch {
+		return null;
+	}
+}
+/**
+* Delete a stored token. Returns true when a token was removed, false
+* when there was nothing to delete or the keyring is unavailable.
+* Distinguishing the two cases isn't worth the surface area — the
+* command output makes the situation clear either way.
+*/
+function deleteToken(provider) {
+	try {
+		return new Entry(SERVICE, provider).deletePassword();
+	} catch {
+		return false;
+	}
+}
+/**
+* List provider slugs with a stored token in this service scope.
+* Uses the library's `findCredentials(service)` — supported on all
+* platforms the underlying credential store supports.
+*/
+function listStoredProviders() {
+	try {
+		return findCredentials(SERVICE).map((c) => c.account);
+	} catch {
+		return [];
+	}
+}
+//#endregion
+//#region src/ui/progress.ts
+/**
+* Runs `fn`, showing an ora spinner for its duration in TTY environments.
+* In non-TTY environments (CI, pipes, tests) the spinner is skipped entirely.
+*/
+async function withSpinner(label, fn) {
+	if (!process.stdout.isTTY) return fn();
+	const spinner = ora(label).start();
+	try {
+		const result = await fn();
+		spinner.succeed();
+		return result;
+	} catch (err) {
+		spinner.fail();
+		throw err;
+	}
+}
+//#endregion
+//#region src/ui/style.ts
+const style = {
+	success: (msg) => `${chalk.green("✓")} ${msg}`,
+	warn: (msg) => `${chalk.yellow("⚠")} ${msg}`,
+	fail: (msg) => `${chalk.red("✗")} ${msg}`,
+	step: (msg) => `${chalk.cyan("→")} ${msg}`,
+	hint: (msg) => chalk.dim(msg),
+	dim: (msg) => chalk.dim(msg),
+	header: (msg) => chalk.bold(msg)
+};
+//#endregion
 //#region src/commands/auth.ts
 /**
 * `holocron auth <subcommand>` — manage bootstrap credentials in the
@@ -49,11 +298,11 @@ async function runAuthSet(input) {
 	});
 	const packageName = resolvePluginPackage(provider);
 	if (!token) {
-		print(`no token supplied for \`${provider}\`.`);
-		print(`  pass as positional arg: holocron auth set ${provider} <token>`);
-		print(`  or via env: HOLOCRON_${provider.toUpperCase()}_TOKEN / ${provider.toUpperCase()}_TOKEN`);
+		print(style.fail(`no token supplied for \`${provider}\`.`));
+		print(style.hint(`  pass as positional arg: holocron auth set ${provider} <token>`));
+		print(style.hint(`  or via env: HOLOCRON_${provider.toUpperCase()}_TOKEN / ${provider.toUpperCase()}_TOKEN`));
 		const hint = await tryLoadHint(importer, packageName);
-		if (hint) print(`  hint: ${hint}`);
+		if (hint) print(style.hint(`  hint: ${hint}`));
 		return {
 			status: "fail",
 			message: "no token supplied"
@@ -65,27 +314,28 @@ async function runAuthSet(input) {
 		if (typeof module.verifyToken === "function") {
 			const verified = await module.verifyToken(token);
 			if (!verified.ok) {
-				print(`token rejected by ${provider}: ${verified.message}`);
-				if (module.AUTH_HINT) print(`  hint: ${module.AUTH_HINT}`);
+				print(style.fail(`token rejected by ${provider}: ${verified.message}`));
+				if (module.AUTH_HINT) print(style.hint(`  hint: ${module.AUTH_HINT}`));
 				return {
 					status: "fail",
 					message: verified.message
 				};
 			}
 			subject = verified.subject;
-		} else print(`(${provider} plugin has no verifyToken; storing without verification)`);
+		} else print(style.warn(`${provider} plugin has no verifyToken; storing without verification`));
 	} catch (err) {
-		print(`cannot verify token — failed to load ${packageName}: ${err instanceof Error ? err.message : String(err)}`);
-		print(`  storing token anyway; run 'holocron auth check ${provider}' once the plugin is installed`);
+		const msg = err instanceof Error ? err.message : String(err);
+		print(style.warn(`cannot verify token — failed to load ${packageName}: ${msg}`));
+		print(style.hint(`  storing token anyway; run 'holocron auth check ${provider}' once the plugin is installed`));
 	}
 	if (!setToken(provider, token)) {
-		print(`keyring unavailable — token not stored. Use env vars instead.`);
+		print(style.fail(`keyring unavailable — token not stored. Use env vars instead.`));
 		return {
 			status: "fail",
 			message: "keyring unavailable"
 		};
 	}
-	print(`stored ${provider} token${subject ? ` (${subject})` : ""}`);
+	print(style.success(`stored ${provider} token${subject ? ` (${subject})` : ""}`));
 	return {
 		status: "ok",
 		...subject ? { message: subject } : {}
@@ -94,10 +344,10 @@ async function runAuthSet(input) {
 function runAuthUnset(input) {
 	const print = input.print ?? ((l) => console.log(l));
 	if (deleteToken(input.provider)) {
-		print(`removed ${input.provider} token`);
+		print(style.success(`removed ${input.provider} token`));
 		return { status: "ok" };
 	}
-	print(`no stored token for ${input.provider}`);
+	print(style.dim(`no stored token for ${input.provider}`));
 	return {
 		status: "skip",
 		message: "nothing to remove"
@@ -109,7 +359,7 @@ async function runAuthCheck(input) {
 	const { provider } = input;
 	const token = getToken(provider);
 	if (!token) {
-		print(`no stored token for ${provider}`);
+		print(style.dim(`no stored token for ${provider}`));
 		return {
 			status: "skip",
 			message: "no stored token"
@@ -119,29 +369,30 @@ async function runAuthCheck(input) {
 	try {
 		const module = await importer(packageName);
 		if (typeof module.verifyToken !== "function") {
-			print(`${provider}: token stored (plugin has no verifyToken; can't confirm validity)`);
+			print(style.warn(`${provider}: token stored (plugin has no verifyToken; can't confirm validity)`));
 			return {
 				status: "ok",
 				message: "stored, unverified"
 			};
 		}
-		const verified = await module.verifyToken(token);
+		const verify = () => module.verifyToken(token);
+		const verified = input.showSpinner !== false ? await withSpinner(`Verifying ${provider} token…`, verify) : await verify();
 		if (verified.ok) {
-			print(`${provider}: ok — ${verified.subject}`);
+			print(style.success(`${provider}: ok — ${verified.subject}`));
 			return {
 				status: "ok",
 				message: verified.subject
 			};
 		}
-		print(`${provider}: rejected — ${verified.message}`);
-		if (module.AUTH_HINT) print(`  hint: ${module.AUTH_HINT}`);
+		print(style.fail(`${provider}: rejected — ${verified.message}`));
+		if (module.AUTH_HINT) print(style.hint(`  hint: ${module.AUTH_HINT}`));
 		return {
 			status: "fail",
 			message: verified.message
 		};
 	} catch (err) {
 		const msg = err instanceof Error ? err.message : String(err);
-		print(`${provider}: cannot verify — ${msg}`);
+		print(style.fail(`${provider}: cannot verify — ${msg}`));
 		return {
 			status: "fail",
 			message: msg
@@ -153,8 +404,8 @@ async function runAuthList(input = {}) {
 	const importer = input.importer ?? defaultImporter$1;
 	const providers = listStoredProviders();
 	if (providers.length === 0) {
-		print("no stored tokens.");
-		print("run: holocron auth set <provider> <token>");
+		print(style.dim("no stored tokens."));
+		print(style.hint("run: holocron auth set <provider> <token>"));
 		return {
 			status: "ok",
 			message: "none"
@@ -164,9 +415,13 @@ async function runAuthList(input = {}) {
 		const check = await runAuthCheck({
 			provider,
 			importer,
-			print: () => {}
+			print: () => {},
+			showSpinner: false
 		});
-		print(`  ${check.status === "ok" ? "✓" : check.status === "fail" ? "✗" : "·"} ${provider}${check.message ? ` — ${check.message}` : ""}`);
+		const label = `${provider}${check.message ? ` — ${check.message}` : ""}`;
+		if (check.status === "ok") print(`  ${style.success(label)}`);
+		else if (check.status === "fail") print(`  ${style.fail(label)}`);
+		else print(`  ${style.dim(`· ${label}`)}`);
 	}
 	return { status: "ok" };
 }
@@ -178,6 +433,210 @@ async function tryLoadHint(importer, packageName) {
 	}
 }
 //#endregion
+//#region src/commands/new.ts
+/**
+* `holocron new <type> <name>` — create a GitHub repo from a template and
+* bootstrap it by replacing all template-slug casing variants with the new
+* project name.
+*
+* Flow:
+*   1. Preflight — verify `gh` CLI is available.
+*   2. Resolve type, name, description (prompt via readline if missing).
+*   3. `gh repo create <org>/<name> --template <org>/<type>-template --private --clone`
+*      → clones to `<cwd>/<name>/`
+*   4. Detect template slug from cloned package.json.
+*   5. Replace all casing variants of the slug across every text file.
+*   6. Replace `<description>` placeholder if a description was given.
+*   7. Commit the patched files (-s for DCO).
+*   8. Unless --no-verify: `pnpm install` in the new repo.
+*   9. Print next steps.
+*/
+var NewError = class extends Error {
+	name = "NewError";
+};
+function cap(word) {
+	return word.charAt(0).toUpperCase() + word.slice(1).toLowerCase();
+}
+/**
+* Derive all common casing variants of a kebab-case slug (e.g.
+* "cli-template") and map each to the corresponding form of a
+* kebab-case name (e.g. "my-tool").
+*
+* Returns search→replacement pairs, deduplicating single-word slugs
+* that would otherwise produce identical entries.
+*/
+function deriveVariants(slug, name) {
+	const sw = slug.split("-");
+	const nw = name.split("-");
+	const pairs = [
+		[slug, name],
+		[sw.join("_"), nw.join("_")],
+		[sw.join("_").toUpperCase(), nw.join("_").toUpperCase()],
+		[sw.map(cap).join(""), nw.map(cap).join("")],
+		[sw[0].toLowerCase() + sw.slice(1).map(cap).join(""), nw[0].toLowerCase() + nw.slice(1).map(cap).join("")],
+		[sw.map(cap).join(" "), nw.map(cap).join(" ")]
+	];
+	const seen = /* @__PURE__ */ new Set();
+	return pairs.filter(([s]) => {
+		if (seen.has(s)) return false;
+		seen.add(s);
+		return true;
+	});
+}
+const SKIP_DIRS$1 = /* @__PURE__ */ new Set([
+	".git",
+	"node_modules",
+	"dist",
+	".turbo"
+]);
+function defaultWalkFiles$1(dir) {
+	const results = [];
+	for (const entry of readdirSync(dir)) {
+		if (SKIP_DIRS$1.has(entry)) continue;
+		const full = path.join(dir, entry);
+		const stat = statSync(full);
+		if (stat.isDirectory()) results.push(...defaultWalkFiles$1(full));
+		else if (stat.isFile()) results.push(full);
+	}
+	return results;
+}
+function isBinary(content) {
+	for (let i = 0; i < Math.min(content.length, 8e3); i++) if (content.charCodeAt(i) === 0) return true;
+	return false;
+}
+function patchFiles(dir, variants, description, print, readFn, writeFn, walkFn) {
+	const patched = [];
+	for (const filepath of walkFn(dir)) {
+		let content;
+		try {
+			content = readFn(filepath);
+		} catch {
+			continue;
+		}
+		if (isBinary(content)) continue;
+		const original = content;
+		for (const [search, replacement] of variants) content = content.split(search).join(replacement);
+		if (description !== void 0) content = content.split("<description>").join(description);
+		if (content !== original) {
+			writeFn(filepath, content);
+			print(`  ✓ ${path.relative(dir, filepath)}`);
+			patched.push(filepath);
+		}
+	}
+	return patched;
+}
+function preflight$1() {
+	const result = spawnSync("gh", ["--version"], { encoding: "utf8" });
+	if (result.error != null || result.status !== 0) throw new NewError("`gh` CLI is not installed or not on PATH. Install it from https://cli.github.com");
+}
+function defaultExec$3(cmd, args, opts) {
+	execFileSync(cmd, args, {
+		cwd: opts.cwd,
+		stdio: opts.stdio
+	});
+}
+function defaultReadFile(filepath) {
+	return readFileSync(filepath, "utf-8");
+}
+function defaultWriteFile(filepath, content) {
+	mkdirSync(path.dirname(filepath), { recursive: true });
+	writeFileSync(filepath, content, "utf-8");
+}
+async function runNew(input) {
+	const cwd = input.cwd ?? process.cwd();
+	const org = input.org ?? "theholocron";
+	const print = input.print ?? ((line) => console.log(line));
+	const execFn = input.exec ?? defaultExec$3;
+	const readFn = input.readFile ?? defaultReadFile;
+	const writeFn = input.writeFile ?? defaultWriteFile;
+	const walkFn = input.walkFiles ?? defaultWalkFiles$1;
+	preflight$1();
+	const templateRepo = `${org}/${input.type}-template`;
+	const newRepo = `${org}/${input.name}`;
+	const repoDir = path.join(cwd, input.name);
+	if (input.dryRun) {
+		print(`  Would create ${newRepo} from template ${templateRepo}`);
+		print(`  Would clone to ${repoDir}`);
+		print(`  Would patch all casing variants of "${input.type}-template" → "${input.name}"`);
+		if (input.description) print(`  Would replace <description> → "${input.description}"`);
+		return { status: "dry-run" };
+	}
+	if (existsSync(repoDir)) throw new NewError(`\`${repoDir}\` already exists — delete it or pick a different name.`);
+	print(`  Creating ${newRepo} from template ${templateRepo}…`);
+	try {
+		execFn("gh", [
+			"repo",
+			"create",
+			newRepo,
+			`--template=${templateRepo}`,
+			"--private",
+			"--clone"
+		], {
+			cwd,
+			stdio: "inherit"
+		});
+	} catch (err) {
+		throw new NewError(`gh repo create failed: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	let templateSlug = `${input.type}-template`;
+	const pkgJsonPath = path.join(repoDir, "package.json");
+	if (existsSync(pkgJsonPath)) try {
+		const pkg = JSON.parse(readFn(pkgJsonPath));
+		if (typeof pkg.name === "string") templateSlug = pkg.name.split("/").pop() ?? templateSlug;
+	} catch {}
+	print(`  Detected template slug: ${templateSlug}`);
+	print(`  Patching files…`);
+	const filesPatched = patchFiles(repoDir, deriveVariants(templateSlug, input.name), input.description, print, readFn, writeFn, walkFn);
+	print(`  ${filesPatched.length} file${filesPatched.length === 1 ? "" : "s"} patched`);
+	if (filesPatched.length > 0) {
+		execFn("git", ["add", "-A"], {
+			cwd: repoDir,
+			stdio: "inherit"
+		});
+		execFn("git", [
+			"commit",
+			"-s",
+			"-m",
+			`chore: bootstrap from ${templateSlug}`
+		], {
+			cwd: repoDir,
+			stdio: "inherit"
+		});
+	}
+	if (!input.noVerify) {
+		print("");
+		print("  Installing dependencies…");
+		try {
+			execFn("pnpm", ["install"], {
+				cwd: repoDir,
+				stdio: "inherit"
+			});
+		} catch (err) {
+			print(`  ✗ pnpm install failed — ${err instanceof Error ? err.message : String(err)}`);
+			return {
+				status: "fail",
+				repoDir,
+				filesPatched,
+				message: "pnpm install failed; inspect output above"
+			};
+		}
+	}
+	print("");
+	print(`  Scaffolded ${newRepo} (${filesPatched.length} file${filesPatched.length === 1 ? "" : "s"} patched).`);
+	print("");
+	print("  Next:");
+	print(`    1. cd ${repoDir}`);
+	if (input.noVerify) print(`    2. pnpm install`);
+	const step = input.noVerify ? 3 : 2;
+	print(`    ${step}. holocron setup  # wire up secrets, teams, labels, etc.`);
+	print(`    ${step + 1}. git push -u origin HEAD`);
+	return {
+		status: "ok",
+		repoDir,
+		filesPatched
+	};
+}
+//#endregion
 //#region src/loader.ts
 var LoaderError = class extends Error {
 	name = "LoaderError";
@@ -225,17 +684,33 @@ var PluginLoader = class {
 	}
 	/** Internal — invoke a plugin's capability factory and return the impl. */
 	async loadOne(key, tuple) {
-		const module = await this.importer(tuple.packageName).catch((err) => {
+		const mod = await this.importer(tuple.packageName).catch((err) => {
 			throw new LoaderError(`failed to import \`${tuple.packageName}\` for capability \`${key}\`: ${err instanceof Error ? err.message : String(err)}`);
 		});
-		if (typeof module.createPlugin !== "function") throw new LoaderError(`\`${tuple.packageName}\` does not export \`createPlugin(options)\``);
-		const factory = module.createPlugin({
-			...this.projectDefaults(),
-			...this.context,
-			...tuple.options
-		}).capabilities[key];
-		if (typeof factory !== "function") throw new LoaderError(`\`${tuple.packageName}\` does not implement the \`${key}\` capability`);
-		return factory();
+		if (isPluginModule(mod)) {
+			const effectiveToken = this.context.cliTokens?.[tuple.provider] ?? this.context.cliToken;
+			const factory = mod.createPlugin({
+				...this.projectDefaults(),
+				...this.context,
+				...effectiveToken !== void 0 ? { cliToken: effectiveToken } : {},
+				cliTokens: void 0,
+				...tuple.options
+			}).capabilities[key];
+			if (typeof factory !== "function") throw new LoaderError(`\`${tuple.packageName}\` does not implement the \`${key}\` capability`);
+			return factory();
+		}
+		if (isCapabilityConfigModule(mod)) {
+			const cap = mod.default;
+			return this.loadOne(key, {
+				provider: cap.provider,
+				packageName: resolvePluginPackage(cap.provider),
+				options: {
+					...cap.options,
+					...tuple.options
+				}
+			});
+		}
+		throw new LoaderError(`\`${tuple.packageName}\` does not export \`createPlugin(options)\` or a capability config ({ provider, options? })`);
 	}
 	/**
 	* Project-level defaults that get merged into every plugin's options
@@ -244,14 +719,20 @@ var PluginLoader = class {
 	*/
 	projectDefaults() {
 		const defaults = {};
-		if (this.config.project.repo) defaults.repo = this.config.project.repo;
+		if (this.config.repo?.name) defaults.repo = this.config.repo.name;
 		return defaults;
 	}
 };
 /** Default importer — native dynamic import. */
 const defaultImporter = async (pkg) => {
-	return await import(pkg);
+	return import(pkg);
 };
+function isPluginModule(mod) {
+	return typeof mod.createPlugin === "function";
+}
+function isCapabilityConfigModule(mod) {
+	return typeof mod.default?.provider === "string";
+}
 //#endregion
 //#region src/commands/deploy.ts
 async function runDeploy(input) {
@@ -259,12 +740,12 @@ async function runDeploy(input) {
 	const loader = input.loader ?? new PluginLoader(input.loaded.resolved, input.context);
 	await loader.load();
 	const dryRun = input.context.dryRun ?? false;
-	print(`Holocron deploy — branch=${input.branch}${input.target ? `, target=${input.target}` : " (preview)"}${dryRun ? " (dry-run)" : ""}`);
+	print(style.header(`Holocron deploy — branch=${input.branch}${input.target ? `, target=${input.target}` : " (preview)"}${dryRun ? " (dry-run)" : ""}`));
 	if (!loader.has("deployment")) throw new Error("deployment capability is not configured — add a `deployment` provider to holocron.config.json");
 	const deploy = loader.get("deployment");
 	if (dryRun) {
 		const message = `would: ${deploy.providerName}.triggerDeployment(projectId=${input.projectId}, branch=${input.branch}${input.target ? `, target=${input.target}` : ""})`;
-		print(`  … ${message}`);
+		print(`  ${style.dim(`… ${message}`)}`);
 		return {
 			deployment: null,
 			status: "dry-run",
@@ -272,19 +753,19 @@ async function runDeploy(input) {
 		};
 	}
 	try {
-		const record = await deploy.triggerDeployment({
+		const record = await withSpinner(`Deploying ${input.branch}${input.target ? ` → ${input.target}` : ""}…`, () => deploy.triggerDeployment({
 			projectId: input.projectId,
 			branch: input.branch,
 			...input.target ? { target: input.target } : {}
-		});
-		print(`  ✓ ${record.status} — ${record.url}`);
+		}));
+		print(`  ${style.success(`${record.status} — ${record.url}`)}`);
 		return {
 			deployment: record,
 			status: "ok"
 		};
 	} catch (err) {
 		const message = err instanceof Error ? err.message : String(err);
-		print(`  ✗ ${message}`);
+		print(`  ${style.fail(message)}`);
 		return {
 			deployment: null,
 			status: "fail",
@@ -297,11 +778,11 @@ async function runDeploy(input) {
 async function runDoctor(input) {
 	const print = input.print ?? ((line) => console.log(line));
 	const loader = input.loader ?? new PluginLoader(input.loaded.resolved, input.context);
-	await loader.load();
+	await withSpinner("Loading plugins…", () => loader.load());
 	const rows = [];
 	const config = input.loaded.resolved;
-	print(`Holocron doctor — ${config.project.name}`);
-	print(`  config: ${input.loaded.filepath}`);
+	print(style.header(`Holocron doctor — ${config.name}`));
+	print(style.dim(`  config: ${input.loaded.filepath}`));
 	print("");
 	for (const key of loader.loadedKeys()) {
 		const cardinality = CARDINALITY[key];
@@ -321,7 +802,12 @@ async function runDoctor(input) {
 			rows.push(row);
 		}
 	}
-	for (const row of rows) print(`  ${row.status === "ok" ? "✓" : row.status === "fail" ? "✗" : "·"} ${pad(row.capability, 14)} via ${pad(row.provider, 14)}  ${row.message}`);
+	for (const row of rows) {
+		const label = `${pad(row.capability, 14)} via ${pad(row.provider, 14)}  ${row.message}`;
+		if (row.status === "ok") print(`  ${style.success(label)}`);
+		else if (row.status === "fail") print(`  ${style.fail(label)}`);
+		else print(`  ${style.dim(`· ${label}`)}`);
+	}
 	const summary = rows.reduce((acc, r) => {
 		acc[r.status] += 1;
 		return acc;
@@ -330,8 +816,9 @@ async function runDoctor(input) {
 		fail: 0,
 		skip: 0
 	});
+	const summaryLine = `${summary.ok} ok, ${summary.fail} fail, ${summary.skip} skipped`;
 	print("");
-	print(`  ${summary.ok} ok, ${summary.fail} fail, ${summary.skip} skipped`);
+	print(summary.fail > 0 ? style.fail(summaryLine) : style.success(summaryLine));
 	return {
 		rows,
 		summary
@@ -446,1075 +933,667 @@ async function runNpmBumpVersions(input) {
 	};
 }
 //#endregion
+//#region src/commands/upgrade-node.ts
+const SKIP_DIRS = /* @__PURE__ */ new Set([
+	"node_modules",
+	".git",
+	"dist",
+	"coverage",
+	"build",
+	".turbo",
+	".next",
+	"out"
+]);
+function patchPackageJson(content, from, to) {
+	let pkg;
+	try {
+		pkg = JSON.parse(content);
+	} catch {
+		return null;
+	}
+	let changed = false;
+	const engines = pkg.engines;
+	if (engines?.node && /^>=\d+(?:\.0\.0)?$/.test(engines.node)) {
+		if (parseInt(engines.node.match(/\d+/)[0], 10) === from) {
+			engines.node = `>=${to}.0.0`;
+			changed = true;
+		}
+	}
+	for (const field of ["devDependencies", "dependencies"]) {
+		const deps = pkg[field];
+		if (!deps?.["@types/node"]) continue;
+		if (deps["@types/node"] === `^${from}.0.0`) {
+			deps["@types/node"] = `^${to}.0.0`;
+			changed = true;
+		}
+	}
+	return changed ? JSON.stringify(pkg, null, 2) + "\n" : null;
+}
+function patchYaml(content, from, to) {
+	const updated = content.replace(/node-version:\s+['"]?(\d+)['"]?/g, (match, ver) => ver === String(from) ? match.replace(String(from), String(to)) : match);
+	return updated !== content ? updated : null;
+}
+function patchPinFile(content, from, to) {
+	const trimmed = content.trim();
+	if (trimmed === String(from) || trimmed.startsWith(`${from}.`)) return `${to}\n`;
+	return null;
+}
+function patchDockerfile(content, from, to) {
+	const updated = content.replace(/^(FROM\s+node:)(\d+)/gm, (match, prefix, ver) => ver === String(from) ? `${prefix}${to}` : match);
+	return updated !== content ? updated : null;
+}
+function patchToolVersions(content, from, to) {
+	const updated = content.replace(/^(nodejs\s+)(\d+)/gm, (match, prefix, ver) => ver === String(from) ? `${prefix}${to}` : match);
+	return updated !== content ? updated : null;
+}
+const PATTERNS = [
+	{
+		matches: (n) => n === "package.json",
+		patch: patchPackageJson
+	},
+	{
+		matches: (n) => n.endsWith(".yml") || n.endsWith(".yaml"),
+		patch: patchYaml
+	},
+	{
+		matches: (n) => n === ".nvmrc" || n === ".node-version",
+		patch: patchPinFile
+	},
+	{
+		matches: (n) => n === "Dockerfile" || n.startsWith("Dockerfile."),
+		patch: patchDockerfile
+	},
+	{
+		matches: (n) => n === ".tool-versions",
+		patch: patchToolVersions
+	}
+];
+function detectFrom(cwd, _readFile) {
+	for (const name of [".nvmrc", ".node-version"]) try {
+		const major = parseInt(_readFile(join(cwd, name)).trim(), 10);
+		if (!isNaN(major)) return major;
+	} catch {}
+	try {
+		const node = JSON.parse(_readFile(join(cwd, "package.json"))).engines?.node;
+		if (node) {
+			const m = node.match(/(\d+)/);
+			if (m) return parseInt(m[1], 10);
+		}
+	} catch {}
+	return null;
+}
+function defaultWalkFiles(dir) {
+	const results = [];
+	function walk(current) {
+		let entries;
+		try {
+			entries = readdirSync(current);
+		} catch {
+			return;
+		}
+		for (const entry of entries) {
+			if (SKIP_DIRS.has(entry)) continue;
+			const abs = join(current, entry);
+			try {
+				if (statSync(abs).isDirectory()) walk(abs);
+				else results.push(abs);
+			} catch {}
+		}
+	}
+	walk(dir);
+	return results;
+}
+async function runUpgradeNode(input) {
+	const print = input.print ?? ((line) => console.log(line));
+	const cwd = input.cwd ?? process.cwd();
+	const { to, dryRun = false, extra = [] } = input;
+	const _readFile = input.readFile ?? ((p) => readFileSync(p, "utf8"));
+	const _writeFile = input.writeFile ?? ((p, c) => writeFileSync(p, c));
+	const _walkFiles = input.walkFiles ?? defaultWalkFiles;
+	const from = input.from ?? detectFrom(cwd, _readFile);
+	if (from === null) return {
+		status: "fail",
+		updated: [],
+		message: "could not detect current Node version — pass --from <major>"
+	};
+	if (from === to) {
+		print(`Already at Node.js ${to} — nothing to do.`);
+		return {
+			status: "ok",
+			updated: []
+		};
+	}
+	print(`Upgrading Node.js ${from} → ${to}${dryRun ? " (dry-run)" : ""}…`);
+	const updated = [];
+	const scanned = [..._walkFiles(cwd), ...extra.map((p) => join(cwd, p))];
+	for (const abs of scanned) {
+		const name = basename(abs);
+		const pattern = PATTERNS.find((p) => p.matches(name));
+		if (!pattern) continue;
+		let content;
+		try {
+			content = _readFile(abs);
+		} catch {
+			continue;
+		}
+		const patched = pattern.patch(content, from, to);
+		if (patched === null) continue;
+		const rel = abs.startsWith(cwd + "/") ? abs.slice(cwd.length + 1) : abs;
+		if (!dryRun) _writeFile(abs, patched);
+		print(`  ${dryRun ? "~" : "✓"} ${rel}`);
+		updated.push(rel);
+	}
+	if (updated.length === 0) print(`  · no files contained Node.js ${from} pins`);
+	return {
+		status: dryRun ? "dry-run" : "ok",
+		updated
+	};
+}
+//#endregion
+//#region src/templates/actions/setup.yml
+var setup_default = "name: Setup\ndescription: Prepare the environment and install project dependencies.\n\ninputs:\n  node-version:\n    description: Node.js version\n    required: false\n    default: \"22.x\"\n\nruns:\n  using: composite\n\n  steps:\n    - uses: theholocron/.github/.github/actions/setup-node@main\n      with:\n        node-version: ${{ inputs.node-version }}\n\n    - uses: theholocron/.github/.github/actions/install@main\n";
+//#endregion
+//#region src/templates/actions/install.yml
+var install_default = "name: Install dependencies\ndescription: Install project dependencies with pnpm frozen lockfile.\n\nruns:\n  using: composite\n\n  steps:\n    - name: Install dependencies\n      if: ${{ hashFiles('pnpm-lock.yaml') != '' }}\n      shell: bash\n      run: pnpm install --frozen-lockfile\n";
+//#endregion
+//#region src/templates/actions/setup-node.yml
+var setup_node_default = "name: Setup Node\ndescription: Install pnpm and Node.js with pnpm dependency caching.\n\ninputs:\n  node-version:\n    description: Node.js version\n    required: false\n    default: \"22.x\"\n\nruns:\n  using: composite\n\n  steps:\n    - name: Setup pnpm\n      if: ${{ hashFiles('pnpm-lock.yaml') != '' }}\n      uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4\n\n    - name: Setup Node.js\n      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4\n      with:\n        node-version: ${{ hashFiles('.node-version') != '' && '' || inputs.node-version }}\n        node-version-file: ${{ hashFiles('.node-version') != '' && '.node-version' || '' }}\n        cache: ${{ hashFiles('pnpm-lock.yaml') != '' && 'pnpm' || '' }}\n\n    - name: Add node_modules/.bin to PATH\n      shell: bash\n      run: echo \"$GITHUB_WORKSPACE/node_modules/.bin\" >> $GITHUB_PATH\n";
+//#endregion
+//#region src/templates/workflows/audit.yml
+var audit_default$1 = "name: Audit\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      build-script:\n        description: Script to build and upload bundle stats to Codecov\n        type: string\n        required: false\n        default: pnpm build\n    secrets:\n      CODECOV_TOKEN:\n        required: false\n\njobs:\n  bundle-size:\n    name: Audit the bundle size\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    concurrency:\n      group: audit-${{ github.ref }}\n      cancel-in-progress: true\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: eval \"$BUILD_SCRIPT\"\n        name: Build and upload bundle stats\n        env:\n          BUILD_SCRIPT: ${{ inputs.build-script }}\n          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}\n";
+//#endregion
+//#region src/templates/workflows/bookkeeping.yml
+var bookkeeping_default$1 = "name: Bookkeeping\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      configuration-path:\n        description: Path to the labeler configuration file in the calling repo\n        type: string\n        required: false\n        default: .github/labeler.yml\n\njobs:\n  label:\n    name: Apply Labels\n    permissions:\n      contents: read\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    concurrency:\n      group: bookkeeping-${{ github.event.pull_request.number || github.event.issue.number }}\n      cancel-in-progress: true\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          sparse-checkout: ${{ inputs.configuration-path || '.github/labeler.yml' }}\n          sparse-checkout-cone-mode: false\n\n      - uses: github/issue-labeler@c1b0f9f52a63158c4adc09425e858e87b32e9685 # v3.4\n        if: ${{ github.event_name == 'pull_request' && hashFiles(inputs.configuration-path || '.github/labeler.yml') != '' }}\n        # v3.4 bundles Node 20; allow it to run under Actions' current default.\n        env:\n          ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true\n        with:\n          # Fall back to default path when triggered directly (not via workflow_call)\n          # because inputs.* defaults only apply on workflow_call events.\n          configuration-path: ${{ inputs.configuration-path || '.github/labeler.yml' }}\n          include-title: 1\n          include-body: 0\n          sync-labels: 1\n          enable-versioned-regex: 0\n          repo-token: ${{ github.token }}\n";
+//#endregion
+//#region src/templates/workflows/codeql.yml
+var codeql_default$1 = "name: CodeQL\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      language:\n        description: CodeQL language to analyze\n        type: string\n        required: false\n        default: javascript-typescript\n\njobs:\n  analyze:\n    name: Analyze (${{ inputs.language }})\n    permissions:\n      actions: read\n      contents: read\n      security-events: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 45\n    # Do not cancel in-progress security scans.\n    concurrency:\n      group: codeql-${{ github.ref }}\n      cancel-in-progress: false\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0\n        name: Initialize CodeQL\n        with:\n          languages: ${{ inputs.language }}\n\n      - uses: github/codeql-action/autobuild@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0\n        name: Autobuild\n\n      - uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0\n        name: Analyze\n        with:\n          category: /language:${{ inputs.language }}\n";
+//#endregion
+//#region src/templates/workflows/dependencies.yml
+var dependencies_default$1 = "name: Dependencies\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      merge-token:\n        description: >\n          Optional privileged token for auto-merge. Falls back to GITHUB_TOKEN.\n          Required when branch protection enforces required reviews — GITHUB_TOKEN\n          cannot approve its own PRs.\n        required: false\n\njobs:\n  dependabot:\n    name: Update the dependencies\n    permissions:\n      contents: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    concurrency:\n      group: dependencies-${{ github.event.pull_request.number }}\n      cancel-in-progress: true\n    if: github.event.pull_request.user.login == 'dependabot[bot]'\n    steps:\n      - uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0\n        name: Fetch Dependabot metadata\n        id: metadata\n\n      - run: gh pr merge --auto --squash \"$PR_URL\"\n        # --squash is intentional: repo protection sets allow_merge_commit: false,\n        # so --merge would fail on any repo using the standard preset.\n        name: Enable auto-merge for Dependabot PRs\n        if: steps.metadata.outputs.update-type == 'version-update:semver-patch'\n        env:\n          PR_URL: ${{ github.event.pull_request.html_url }}\n          GH_TOKEN: ${{ secrets.merge-token || github.token }}\n";
+//#endregion
+//#region src/templates/workflows/greetings.yml
+var greetings_default$1 = "name: Greetings\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n\njobs:\n  greeting:\n    name: Greet first-time contributors\n    permissions:\n      issues: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    # Group by the issue/PR number so duplicate events don't race each other.\n    concurrency:\n      group: greetings-${{ github.event.issue.number || github.event.pull_request.number }}\n      cancel-in-progress: false\n    steps:\n      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n        name: Greet on first contribution\n        with:\n          script: |\n            // Only greet on the initial open — ignore synchronize, reopened, etc.\n            if (context.payload.action !== 'opened') return;\n\n            const actor = context.actor;\n            const { owner, repo } = context.repo;\n\n            // Payload inspection is more reliable than context.eventName for detecting\n            // whether this is an issue vs. PR event — works regardless of how GitHub\n            // propagates event names through workflow_call chains.\n            const isIssue = !!context.payload.issue && !context.payload.pull_request;\n            // listForRepo returns both issues and PRs (GitHub treats PRs as issues),\n            // sorted newest-first. Filter by type to track first-issue and first-PR\n            // independently, and avoid search-index eventual-consistency lag.\n            const { data: recent } = await github.rest.issues.listForRepo({\n              owner, repo,\n              creator: actor,\n              state: 'all',\n              per_page: 100\n            });\n\n            const sameType = recent.filter(item =>\n              isIssue ? !item.pull_request : !!item.pull_request\n            );\n\n            if (sameType.length !== 1) return;\n            const body = isIssue\n              ? `Hey @${actor}!\\n\\nWe really appreciate you taking the time to report an issue. The collaborators on this project attempt to help as many people as possible, but we are a limited number of volunteers, so it is possible that this will not be addressed as swiftly.\\n\\nYour patience is much appreciated and we will get back to you as quickly as possible.`\n              : `Hey @${actor}!\\n\\nWe really appreciate you taking the time to help out with this PR. The collaborators on this project attempt to help as many people as possible, but we are a limited number of volunteers, so it is possible that this will not be addressed as swiftly.\\n\\nYour patience is much appreciated and we will get back to you as quickly as possible.`;\n\n            await github.rest.issues.createComment({\n              owner,\n              repo,\n              issue_number: context.issue.number,\n              body\n            });\n";
+//#endregion
+//#region src/templates/workflows/lint.yml
+var lint_default$1 = "name: Lint\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      prettier-config:\n        type: string\n        required: false\n        default: prettier.config.js\n      yaml-config:\n        type: string\n        required: false\n        default: yamllint.config.yml\n      enable-auto-commit:\n        description: Auto-commit super-linter fixes via GPG-signed commit\n        type: boolean\n        required: false\n        default: false\n    secrets:\n      SUPER_LINTER_GPG_PRIVATE_KEY:\n        required: false\n      SUPER_LINTER_GPG_PASSPHRASE:\n        required: false\n\njobs:\n  super-lint:\n    name: Lint entire codebase\n    permissions:\n      contents: write\n      statuses: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    env:\n      GPG_KEY_SET: ${{ secrets.SUPER_LINTER_GPG_PRIVATE_KEY != '' }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n          token: ${{ github.token }}\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n        if: ${{ hashFiles('pnpm-lock.yaml') != '' }}\n\n      - uses: super-linter/super-linter/slim@4ce20838b8ab83717e78138c5b3a1407148e0918 # v8.7.0\n        name: Run Super Linter\n        env:\n          GITHUB_TOKEN: ${{ github.token }}\n          DEFAULT_BRANCH: ${{ github.event.pull_request.base.ref || github.event.repository.default_branch }}\n          ANNOTATE_ONLY: true\n          DISABLE_COMMENTS: false\n          IGNORE_GITIGNORED_FILES: true\n          LINTER_RULES_PATH: /\n          EDITORCONFIG_FILE_NAME: \".editorconfig-checker.json\"\n          FIX_ENV: true\n          FIX_GRAPHQL_PRETTIER: true\n          FIX_HTML_PRETTIER: true\n          FIX_JAVASCRIPT_PRETTIER: true\n          FIX_JSX_PRETTIER: true\n          FIX_MARKDOWN_PRETTIER: true\n          FIX_TSX: true\n          FIX_TYPESCRIPT_PRETTIER: true\n          PRETTIER_CONFIG: ${{ inputs.prettier-config }}\n          VALIDATE_DOCKERFILE: true\n          VALIDATE_EDITORCONFIG: true\n          VALIDATE_ENV: true\n          VALIDATE_GIT_COMMITLINT: true\n          VALIDATE_GIT_MERGE_CONFLICT_MARKERS: true\n          VALIDATE_GITHUB_ACTIONS: true\n          VALIDATE_GITLEAKS: true\n          VALIDATE_GRAPHQL_PRETTIER: true\n          VALIDATE_HTML_PRETTIER: true\n          VALIDATE_JAVASCRIPT_PRETTIER: true\n          VALIDATE_JSX_PRETTIER: true\n          VALIDATE_MARKDOWN_PRETTIER: true\n          VALIDATE_TSX: true\n          VALIDATE_TYPESCRIPT_PRETTIER: true\n          VALIDATE_YAML: true\n          YAML_CONFIG_FILE: ${{ inputs.yaml-config }}\n\n      - uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0\n        name: Import GPG Key\n        # Conditions mirror auto-commit exactly — no point importing GPG if the\n        # commit step will be skipped (fork PR, default branch, or secret unset).\n        if: >\n          inputs.enable-auto-commit == true &&\n          github.event.pull_request != null &&\n          github.event.pull_request.head.repo.full_name == github.repository &&\n          github.ref_name != github.event.repository.default_branch &&\n          env.GPG_KEY_SET == 'true'\n        with:\n          git_user_signingkey: true\n          git_commit_gpgsign: true\n          GPG_PRIVATE_KEY: ${{ secrets.SUPER_LINTER_GPG_PRIVATE_KEY }}\n          PASSPHRASE: ${{ secrets.SUPER_LINTER_GPG_PASSPHRASE }}\n\n      - uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d # v7.2.0\n        name: Commit and push linting fixes\n        if: >\n          inputs.enable-auto-commit == true &&\n          github.event.pull_request != null &&\n          github.event.pull_request.head.repo.full_name == github.repository &&\n          github.ref_name != github.event.repository.default_branch &&\n          env.GPG_KEY_SET == 'true'\n        with:\n          branch: ${{ github.event.pull_request.head.ref || github.head_ref || github.ref }}\n          commit_message: \"chore: fix linting issues\\n\\nSigned-off-by: super-linter <super-linter@super-linter.dev>\"\n          commit_options: \"--no-verify\"\n          commit_user_name: super-linter\n          commit_user_email: super-linter@super-linter.dev\n";
+//#endregion
+//#region src/templates/workflows/release.yml
+var release_default$1 = "name: Release\n\n# Semantic-release with OIDC Trusted Publishing — no NPM_TOKEN required.\n# The calling repo must have a .releaserc.json that configures branches,\n# plugins, and any publish options. npm@11+ is installed to support OIDC.\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      run-build:\n        description: Run `pnpm build` before releasing\n        type: boolean\n        required: false\n        default: true\n    secrets:\n      RELEASE_TOKEN:\n        description: >\n          Fine-grained PAT (Contents + Issues + Pull requests: write) owned by\n          an admin. Required when the default branch is protected by a ruleset —\n          github.token cannot push through rulesets, but an admin PAT can.\n          Takes priority over SYNC_TOKEN. Falls back to github.token.\n        required: false\n      SYNC_TOKEN:\n        description: >\n          Legacy alias for RELEASE_TOKEN — kept for backward compatibility.\n          Prefer RELEASE_TOKEN for new repos.\n        required: false\n\njobs:\n  release:\n    name: Semantic release\n    permissions:\n      contents: write\n      id-token: write\n      issues: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    # Do not cancel in-progress releases — a partial release is worse than a slow one.\n    concurrency:\n      group: release-${{ github.ref }}\n      cancel-in-progress: false\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n          # Use SYNC_TOKEN when available — git push (tags, release commits)\n          # uses the checkout credential, not GITHUB_TOKEN env var. The\n          # built-in github.token cannot push through branch protection rulesets.\n          token: ${{ secrets.RELEASE_TOKEN || secrets.SYNC_TOKEN || github.token }}\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - name: Configure git identity\n        run: |\n          GIT_NAME=$(gh api user --jq .name 2>/dev/null || echo \"github-actions[bot]\")\n          GIT_EMAIL=$(gh api user --jq '\"\\(.id)+\\(.login)@users.noreply.github.com\"' 2>/dev/null || echo \"41898282+github-actions[bot]@users.noreply.github.com\")\n          git config --global user.name \"$GIT_NAME\"\n          git config --global user.email \"$GIT_EMAIL\"\n          git config --global format.signoff true\n        env:\n          GH_TOKEN: ${{ secrets.RELEASE_TOKEN || secrets.SYNC_TOKEN || github.token }}\n\n      - run: npm install -g npm@11 sigstore\n        name: Upgrade npm for OIDC support\n        # sigstore is required by libnpmpublish/provenance.js at module parse\n        # time — before any config takes effect. Some npm 11.x builds stopped\n        # bundling it; installing it globally into the same prefix ensures it\n        # resolves regardless of npm version. (Discovered 2026-07-09.)\n\n      - run: pnpm build\n        name: Build\n        if: ${{ inputs.run-build == true }}\n\n      - run: npx semantic-release\n        name: Release\n        env:\n          # Prefer RELEASE_TOKEN (fine-grained PAT, Contents+Issues+PRs write,\n          # owned by an admin with ruleset bypass) so @semantic-release/git can\n          # push the version-bump commit through branch protection. Falls back to\n          # SYNC_TOKEN (legacy) then github.token for unprotected repos.\n          GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN || secrets.SYNC_TOKEN || github.token }}\n          NPM_CONFIG_PROVENANCE: true\n";
+//#endregion
+//#region src/templates/workflows/review.yml
+var review_default$1 = "name: Review\n\n# ReviewDog is the annotation layer — posts inline PR diff annotations.\n# Runs on pull_request only: inline annotations require PR context,\n# and branch protection ensures all changes go through PRs anyway.\n# super-linter (lint.yml) is the CI gate covering push + PR events.\n# Gitleaks and YAML are intentionally duplicated: super-linter gates\n# merges; ReviewDog surfaces exact line annotations in the PR diff.\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n\nconcurrency:\n  group: review-${{ github.workflow }}-${{ github.ref }}\n  cancel-in-progress: true\n\njobs:\n  reviewdog:\n    name: Review PRs\n    runs-on: ubuntu-latest\n    timeout-minutes: 20\n    permissions:\n      contents: read\n      checks: write\n      pull-requests: write\n\n    steps:\n      - name: Checkout repository\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          fetch-depth: 0\n\n      - name: Setup\n        if: ${{ hashFiles('pnpm-lock.yaml') != '' }}\n        uses: theholocron/.github/.github/actions/setup@main\n\n      - name: Install ReviewDog\n        uses: reviewdog/action-setup@d8a7baabd7f3e8544ee4dbde3ee41d0011c3a93f # v1\n        with:\n          reviewdog_version: latest\n\n      # Detect which tools are relevant for this repo, excluding node_modules.\n      # hashFiles('**/*') recurses into node_modules/.pnpm and produces false\n      # positives for repos that don't own those file types.\n      # -print -quit stops find after the first match without a pipe, avoiding\n      # the SIGPIPE/pipefail exit-141 that find|head-1 triggers under\n      # GitHub Actions' default bash --noprofile --norc -e -o pipefail mode.\n      - name: Detect project features\n        id: detect\n        shell: bash\n        run: |\n          has() { find . -not -path '*/node_modules/*' -name \"$1\" -print -quit 2>/dev/null | grep -q .; }\n          has_ext() { find . -not -path '*/node_modules/*' -name \"$1\" -print -quit 2>/dev/null | grep -q .; }\n          { { has 'eslint.config.js' || has 'eslint.config.mjs' || has 'eslint.config.cjs' || \\\n              has 'eslint.config.ts' || has '.eslintrc' || has '.eslintrc.js' || \\\n              has '.eslintrc.cjs' || has '.eslintrc.json' || has '.eslintrc.yaml' || \\\n              has '.eslintrc.yml'; } && grep -qF '\"eslint\":' package.json 2>/dev/null; } && echo \"eslint=true\" >> \"$GITHUB_OUTPUT\" || echo \"eslint=false\" >> \"$GITHUB_OUTPUT\"\n          { has 'tsconfig.json' && grep -qF '\"typescript\":' package.json 2>/dev/null; } && echo \"tsconfig=true\" >> \"$GITHUB_OUTPUT\" || echo \"tsconfig=false\" >> \"$GITHUB_OUTPUT\"\n          has_ext '*.sh' && echo \"shell=true\" >> \"$GITHUB_OUTPUT\" || echo \"shell=false\" >> \"$GITHUB_OUTPUT\"\n          has 'Dockerfile' || has_ext '*.Dockerfile' || has 'Containerfile' && \\\n            echo \"docker=true\" >> \"$GITHUB_OUTPUT\" || echo \"docker=false\" >> \"$GITHUB_OUTPUT\"\n          has_ext '.env*' && echo \"dotenv=true\" >> \"$GITHUB_OUTPUT\" || echo \"dotenv=false\" >> \"$GITHUB_OUTPUT\"\n          has_ext '*.md' && echo \"markdown=true\" >> \"$GITHUB_OUTPUT\" || echo \"markdown=false\" >> \"$GITHUB_OUTPUT\"\n\n      #\n      # Always applicable\n      #\n\n      - name: Gitleaks (secrets)\n        uses: reviewdog/action-gitleaks@2b7b5685e3e3eecddab5d30cfa04f18123031421 # v1\n        with:\n          reporter: github-pr-check\n          tool_name: \"Review / gitleaks\"\n          gitleaks_flags: --log-opts=${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }}\n\n      - name: YamlLint\n        if: ${{ hashFiles('yamllint.config.yml') != '' }}\n        uses: reviewdog/action-yamllint@b5f7217d8c815ae374d1d55840d5e569d82f01f0 # v1\n        with:\n          reporter: github-pr-check\n          tool_name: \"Review / yamllint\"\n          yamllint_flags: -c ${{ github.workspace }}/yamllint.config.yml ${{ github.workspace }}\n\n      - name: ActionLint (GitHub Actions)\n        if: ${{ hashFiles('.github/workflows/*.yml', '.github/workflows/*.yaml') != '' }}\n        uses: reviewdog/action-actionlint@6fb7acc99f4a1008869fa8a0f09cfca740837d9d # v1\n        with:\n          reporter: github-pr-check\n          tool_name: \"Review / actionlint\"\n\n      #\n      # TypeScript / JavaScript\n      #\n\n      - name: ESLint\n        if: steps.detect.outputs.eslint == 'true'\n        uses: reviewdog/action-eslint@556a3fdaf8b4201d4d74d406013386aa4f7dab96 # v1.34.0\n        with:\n          reporter: github-pr-check\n          tool_name: \"Review / eslint\"\n          eslint_flags: .\n\n      - name: TypeScript\n        if: steps.detect.outputs.tsconfig == 'true'\n        uses: EPMatt/reviewdog-action-tsc@63d923a3c5b4497671940b8874f58a404e2351b5 # v1\n        with:\n          reporter: github-pr-check\n          tool_name: \"Review / tsc\"\n\n      #\n      # Shell\n      #\n\n      - name: ShellCheck\n        if: steps.detect.outputs.shell == 'true'\n        uses: reviewdog/action-shellcheck@4c07458293ac342d477251099501a718ae5ef86e # v1\n        with:\n          reporter: github-pr-check\n          tool_name: \"Review / shellcheck\"\n          fail_level: none\n\n      #\n      # Docker\n      #\n\n      - name: Hadolint\n        if: steps.detect.outputs.docker == 'true'\n        uses: reviewdog/action-hadolint@1b2cfa6ba72072ad35158d7ff3aa49bbdc03506d # v1\n        with:\n          reporter: github-pr-check\n          tool_name: \"Review / hadolint\"\n          fail_level: none\n\n      #\n      # Environment files\n      #\n\n      - name: dotenv-linter\n        if: steps.detect.outputs.dotenv == 'true'\n        uses: dotenv-linter/action-dotenv-linter@afde61cfda2ecffe7bea35837b6f20b956c88689 # v3.0.0\n        with:\n          reporter: github-code-suggestions\n\n      #\n      # Documentation\n      #\n\n      - name: Alex (inclusive language)\n        if: steps.detect.outputs.markdown == 'true'\n        uses: reviewdog/action-alex@347481655add010a2ae302df34b57c9bcfa0d6e4 # v1\n        with:\n          reporter: github-pr-check\n          tool_name: \"Review / alex\"\n";
+//#endregion
+//#region src/templates/workflows/stale.yml
+var stale_default$1 = "name: Stale\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      days-before-stale:\n        description: Days of inactivity before an issue is marked stale\n        type: number\n        required: false\n        default: 30\n      days-before-close:\n        description: Days of inactivity after stale label before closing\n        type: number\n        required: false\n        default: 5\n\njobs:\n  stale:\n    name: Mark stale issues and pull requests\n    permissions:\n      contents: write\n      issues: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    steps:\n      - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0\n        name: Run Stale\n        with:\n          close-issue-message: >\n            This issue was closed because it has been stalled for\n            ${{ inputs.days-before-close }} days with no activity.\n          days-before-close: ${{ inputs.days-before-close }}\n          days-before-stale: ${{ inputs.days-before-stale }}\n          exempt-all-pr-milestones: true\n          stale-issue-label: wontfix\n          stale-issue-message: >\n            This issue is stale because it has been open ${{ inputs.days-before-stale }}\n            days with no activity. Remove the stale label or comment, or this will be\n            closed in ${{ inputs.days-before-close }} days.\n          stale-pr-label: wontfix\n          stale-pr-message: >\n            This PR is stale because it has been open ${{ inputs.days-before-stale }}\n            days with no activity. Remove the stale label or comment, or this will be\n            closed in ${{ inputs.days-before-close }} days.\n";
+//#endregion
+//#region src/templates/workflows/sync-github.yml
+var sync_github_default$1 = "name: Sync GitHub Templates\n\n# Builds the holocron CLI from source and pushes updated workflow templates\n# and composite actions to downstream .github repos. Runs whenever the\n# template source files change on main or alpha.\n#\n# Secrets required:\n#   SYNC_TOKEN — fine-grained PAT (resource owner: org) with:\n#                  Contents:      Read and write  (git trees, blobs, refs)\n#                  Pull requests: Read and write  (open sync PR)\n#                  Workflows:     Read and write  (write .github/workflows/*.yml)\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      primary-repo:\n        description: >\n          Primary .github repo — receives composite actions, reusable workflows,\n          and thin-caller templates. Requires a PR (branch protection assumed).\n        type: string\n        required: false\n        default: theholocron/.github\n      secondary-repos:\n        description: >\n          Space-separated list of secondary repos (reusable workflows + thin\n          callers only, no composite actions). Changes are delivered via pull\n          request, same as the primary repo.\n        type: string\n        required: false\n        default: \"\"\n      sync-branch:\n        description: Branch name used for the primary and secondary repo PRs\n        type: string\n        required: false\n        default: chore/sync-templates\n    secrets:\n      SYNC_TOKEN:\n        required: true\n\njobs:\n  sync:\n    name: Sync templates\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    permissions:\n      contents: read\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: pnpm build\n        name: Build CLI\n\n      - name: Validate generated workflows\n        run: |\n          node packages/cli/dist/cli.mjs sync-github \\\n            --repo \"$PRIMARY_REPO\" \\\n            --output-dir /tmp/sync-validate\n          curl -fsSL https://github.com/rhysd/actionlint/releases/download/v1.7.7/actionlint_1.7.7_linux_amd64.tar.gz \\\n            | tar -xz -C /tmp actionlint\n          /tmp/actionlint /tmp/sync-validate/.github/workflows/*.yml\n        env:\n          PRIMARY_REPO: ${{ inputs.primary-repo }}\n\n      - name: Sync primary repo (PR)\n        run: |\n          GIT_NAME=$(gh api user --jq .name 2>/dev/null || echo \"github-actions[bot]\")\n          GIT_EMAIL=$(gh api user --jq '\"\\(.id)+\\(.login)@users.noreply.github.com\"' 2>/dev/null || echo \"41898282+github-actions[bot]@users.noreply.github.com\")\n          COMMIT_MSG=\"chore: sync from theholocron/holocron\"$'\\n\\n'\"Signed-off-by: $GIT_NAME <$GIT_EMAIL>\"\n          node packages/cli/dist/cli.mjs sync-github \\\n            --repo \"$PRIMARY_REPO\" \\\n            --branch \"$SYNC_BRANCH\" \\\n            --pr \\\n            --message \"$COMMIT_MSG\"\n        env:\n          GITHUB_TOKEN: ${{ secrets.SYNC_TOKEN }}\n          GH_TOKEN: ${{ secrets.SYNC_TOKEN }}\n          PRIMARY_REPO: ${{ inputs.primary-repo }}\n          SYNC_BRANCH: ${{ inputs.sync-branch }}\n\n      - name: Sync secondary repos (PR)\n        if: ${{ inputs.secondary-repos != '' }}\n        run: |\n          GIT_NAME=$(gh api user --jq .name 2>/dev/null || echo \"github-actions[bot]\")\n          GIT_EMAIL=$(gh api user --jq '\"\\(.id)+\\(.login)@users.noreply.github.com\"' 2>/dev/null || echo \"41898282+github-actions[bot]@users.noreply.github.com\")\n          COMMIT_MSG=\"chore: sync from theholocron/holocron\"$'\\n\\n'\"Signed-off-by: $GIT_NAME <$GIT_EMAIL>\"\n          for repo in $SECONDARY_REPOS; do\n            node packages/cli/dist/cli.mjs sync-github \\\n              --repo \"$repo\" \\\n              --branch \"$SYNC_BRANCH\" \\\n              --pr \\\n              --message \"$COMMIT_MSG\"\n          done\n        env:\n          GITHUB_TOKEN: ${{ secrets.SYNC_TOKEN }}\n          GH_TOKEN: ${{ secrets.SYNC_TOKEN }}\n          SECONDARY_REPOS: ${{ inputs.secondary-repos }}\n          SYNC_BRANCH: ${{ inputs.sync-branch }}\n";
+//#endregion
+//#region src/templates/workflows/test.yml
+var test_default$1 = "name: Test\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      CODECOV_TOKEN:\n        required: false\n\njobs:\n  unit:\n    name: Run tests and collect coverage\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: pnpm test -- --coverage\n        name: Run tests with coverage\n\n      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0\n        name: Upload coverage to Codecov\n        with:\n          token: ${{ secrets.CODECOV_TOKEN }}\n\n      - uses: codecov/test-results-action@0fa95f0e1eeaafde2c782583b36b28ad0d8c77d3 # v1\n        name: Upload test results to Codecov\n        if: ${{ !cancelled() }}\n        with:\n          token: ${{ secrets.CODECOV_TOKEN }}\n          files: '**/test-report.junit.xml'\n";
+//#endregion
+//#region src/templates/workflows/typecheck.yml
+var typecheck_default$1 = "name: Typecheck\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n\njobs:\n  typecheck:\n    name: tsc --noEmit\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: pnpm typecheck\n        name: Type check\n";
+//#endregion
 //#region src/templates/index.ts
 /**
 * All reusable workflow and composite action content bundled as string
 * constants so the CLI can push them to theholocron/.github without
 * needing filesystem access at runtime.
 *
-* These are the sources of truth — the YAML files in this directory
-* have been removed in favour of these constants.
+* Content lives in standalone .yml files; the rawYml rollup plugin
+* inlines them as string exports at build time.
 */
 const ACTIONS = {
-	"setup/action": `\
-name: Setup
-description: Prepare the environment and install project dependencies.
-
-inputs:
-  node-version:
-    description: Node.js version
-    required: false
-    default: "22.x"
-
-  pnpm-version:
-    description: pnpm version
-    required: false
-    default: "10"
-
-runs:
-  using: composite
-
-  steps:
-    - uses: ./.github/actions/setup-node
-      with:
-        node-version: \${{ inputs.node-version }}
-        pnpm-version: \${{ inputs.pnpm-version }}
-
-    - uses: ./.github/actions/install
-`,
-	"install/action": `\
-name: Install dependencies
-description: Install project dependencies with pnpm frozen lockfile.
-
-runs:
-  using: composite
-
-  steps:
-    - name: Install dependencies
-      shell: bash
-      run: pnpm install --frozen-lockfile
-`,
-	"setup-node/action": `\
-name: Setup Node
-description: Install pnpm and Node.js with pnpm dependency caching.
-
-inputs:
-  node-version:
-    description: Node.js version
-    required: false
-    default: "22.x"
-
-  pnpm-version:
-    description: pnpm version
-    required: false
-    default: "10"
-
-runs:
-  using: composite
-
-  steps:
-    - name: Setup pnpm
-      uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
-      with:
-        version: \${{ inputs.pnpm-version }}
-
-    - name: Setup Node.js
-      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-      with:
-        node-version: \${{ inputs.node-version }}
-        cache: pnpm
-`
+	"setup/action": setup_default,
+	"install/action": install_default,
+	"setup-node/action": setup_node_default
 };
 const REUSABLE_WORKFLOWS = {
-	audit: `\
-name: Audit
-
-on: # yamllint disable-line rule:truthy
-  workflow_call:
-    inputs:
-      build-script:
-        description: Script to build before analyzing bundle size
-        type: string
-        required: false
-        default: pnpm build
-    secrets:
-      BUNDLEWATCH_GITHUB_TOKEN:
-        required: true
-
-jobs:
-  bundle-size:
-    name: Audit the bundle size
-    permissions:
-      contents: read
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    concurrency:
-      group: audit-\${{ github.ref }}
-      cancel-in-progress: true
-    steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-        name: Checkout repository
-        with:
-          fetch-depth: 0
-
-      - uses: theholocron/.github/.github/actions/setup@main
-        name: Setup
-
-      - uses: jackyef/bundlewatch-gh-action@01f51133d3580a6daa046ca83eb233d79735e1c1 # 0.3.0
-        name: Analyze using BundleWatch
-        with:
-          build-script: \${{ inputs.build-script }}
-          bundlewatch-github-token: \${{ secrets.BUNDLEWATCH_GITHUB_TOKEN }}
-`,
-	"bookkeeping-pr": `\
-name: PR Bookkeeping
-
-on: # yamllint disable-line rule:truthy
-  workflow_call:
-    inputs:
-      configuration-path:
-        description: Path to the labeler configuration file in the calling repo
-        type: string
-        required: false
-        default: .github/labeler.yml
-
-jobs:
-  label:
-    name: Add Labels to PRs
-    permissions:
-      contents: read
-      pull-requests: write
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    concurrency:
-      group: bookkeeping-pr-\${{ github.event.pull_request.number }}
-      cancel-in-progress: true
-    steps:
-      - uses: github/issue-labeler@c1b0f9f52a63158c4adc09425e858e87b32e9685 # v3.4
-        with:
-          # Fall back to default path when triggered directly (not via workflow_call)
-          # because inputs.* defaults only apply on workflow_call events.
-          configuration-path: \${{ inputs.configuration-path || '.github/labeler.yml' }}
-          include-title: 1
-          include-body: 0
-          sync-labels: 1
-          enable-versioned-regex: 0
-          repo-token: \${{ github.token }}
-`,
-	codeql: `\
-name: CodeQL
-
-on: # yamllint disable-line rule:truthy
-  workflow_call:
-    inputs:
-      language:
-        description: CodeQL language to analyze
-        type: string
-        required: false
-        default: javascript-typescript
-
-jobs:
-  analyze:
-    name: Analyze (\${{ inputs.language }})
-    permissions:
-      actions: read
-      contents: read
-      security-events: write
-    runs-on: ubuntu-latest
-    timeout-minutes: 45
-    # Do not cancel in-progress security scans.
-    concurrency:
-      group: codeql-\${{ github.ref }}
-      cancel-in-progress: false
-    steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-        name: Checkout repository
-
-      - uses: github/codeql-action/init@411c4c9a36b3fca4d674f06b6396b2c6d23522c6 # v3
-        name: Initialize CodeQL
-        with:
-          languages: \${{ inputs.language }}
-
-      - uses: github/codeql-action/autobuild@411c4c9a36b3fca4d674f06b6396b2c6d23522c6 # v3
-        name: Autobuild
-
-      - uses: github/codeql-action/analyze@411c4c9a36b3fca4d674f06b6396b2c6d23522c6 # v3
-        name: Analyze
-        with:
-          category: /language:\${{ inputs.language }}
-`,
-	dependencies: `\
-name: Dependencies
-
-on: # yamllint disable-line rule:truthy
-  workflow_call:
-    secrets:
-      merge-token:
-        description: >
-          Optional privileged token for auto-merge. Falls back to GITHUB_TOKEN.
-          Required when branch protection enforces required reviews — GITHUB_TOKEN
-          cannot approve its own PRs.
-        required: false
-
-jobs:
-  dependabot:
-    name: Update the dependencies
-    permissions:
-      contents: write
-      pull-requests: write
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    concurrency:
-      group: dependencies-\${{ github.event.pull_request.number }}
-      cancel-in-progress: true
-    if: github.event.pull_request.user.login == 'dependabot[bot]'
-    steps:
-      - uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a # v2
-        name: Fetch Dependabot metadata
-        id: metadata
-
-      - run: gh pr merge --auto --squash "$PR_URL"
-        # --squash is intentional: repoPolicy sets allow_merge_commit: false,
-        # so --merge would fail on any repo using the standard preset.
-        name: Enable auto-merge for Dependabot PRs
-        if: steps.metadata.outputs.update-type == 'version-update:semver-patch'
-        env:
-          PR_URL: \${{ github.event.pull_request.html_url }}
-          GH_TOKEN: \${{ secrets.merge-token || github.token }}
-`,
-	greetings: `\
-name: Greetings
-
-on: # yamllint disable-line rule:truthy
-  workflow_call:
-
-jobs:
-  greeting:
-    name: Greet first-time contributors
-    permissions:
-      issues: write
-      pull-requests: write
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    # Group by the issue/PR number so duplicate events don't race each other.
-    concurrency:
-      group: greetings-\${{ github.event.issue.number || github.event.pull_request.number }}
-      cancel-in-progress: false
-    steps:
-      - uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
-        name: Greet on first contribution
-        with:
-          script: |
-            // Only greet on the initial open — ignore synchronize, reopened, etc.
-            if (context.payload.action !== 'opened') return;
-
-            const actor = context.actor;
-            const { owner, repo } = context.repo;
-
-            // Payload inspection is more reliable than context.eventName for detecting
-            // whether this is an issue vs. PR event — works regardless of how GitHub
-            // propagates event names through workflow_call chains.
-            const isIssue = !!context.payload.issue && !context.payload.pull_request;
-            // listForRepo returns both issues and PRs (GitHub treats PRs as issues),
-            // sorted newest-first. Filter by type to track first-issue and first-PR
-            // independently, and avoid search-index eventual-consistency lag.
-            const { data: recent } = await github.rest.issues.listForRepo({
-              owner, repo,
-              creator: actor,
-              state: 'all',
-              per_page: 100
-            });
-
-            const sameType = recent.filter(item =>
-              isIssue ? !item.pull_request : !!item.pull_request
-            );
-
-            if (sameType.length !== 1) return;
-            const body = isIssue
-              ? \`Hey @\${actor}!\\n\\nWe really appreciate you taking the time to report an issue. The collaborators on this project attempt to help as many people as possible, but we are a limited number of volunteers, so it is possible that this will not be addressed as swiftly.\\n\\nYour patience is much appreciated and we will get back to you as quickly as possible.\`
-              : \`Hey @\${actor}!\\n\\nWe really appreciate you taking the time to help out with this PR. The collaborators on this project attempt to help as many people as possible, but we are a limited number of volunteers, so it is possible that this will not be addressed as swiftly.\\n\\nYour patience is much appreciated and we will get back to you as quickly as possible.\`;
-
-            await github.rest.issues.createComment({
-              owner,
-              repo,
-              issue_number: context.issue.number,
-              body
-            });
-`,
-	lint: `\
-name: Lint
-
-on: # yamllint disable-line rule:truthy
-  workflow_call:
-    inputs:
-      prettier-config:
-        type: string
-        required: false
-        default: prettier.config.js
-      yaml-config:
-        type: string
-        required: false
-        default: yamllint.config.yml
-      enable-auto-commit:
-        description: Auto-commit super-linter fixes via GPG-signed commit
-        type: boolean
-        required: false
-        default: false
-    secrets:
-      SUPER_LINTER_GPG_PRIVATE_KEY:
-        required: false
-      SUPER_LINTER_GPG_PASSPHRASE:
-        required: false
-
-jobs:
-  super-lint:
-    name: Lint entire codebase
-    permissions:
-      contents: write
-      statuses: write
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-        name: Checkout repository
-        with:
-          fetch-depth: 0
-          token: \${{ github.token }}
-
-      - uses: theholocron/.github/.github/actions/setup@main
-        name: Setup
-
-      - uses: super-linter/super-linter/slim@b92721f792f381cedc002ecdbb9847a15ece5bb8 # v7.1.0
-        name: Run Super Linter
-        env:
-          GITHUB_TOKEN: \${{ github.token }}
-          ANNOTATE_ONLY: true
-          DISABLE_COMMENTS: false
-          IGNORE_GITIGNORED_FILES: true
-          LINTER_RULES_PATH: /
-          EDITORCONFIG_FILE_NAME: ".editorconfig-checker.json"
-          FIX_ENV: true
-          FIX_GRAPHQL_PRETTIER: true
-          FIX_HTML_PRETTIER: true
-          FIX_JAVASCRIPT_PRETTIER: true
-          FIX_JSX_PRETTIER: true
-          FIX_MARKDOWN_PRETTIER: true
-          FIX_TSX: true
-          FIX_TYPESCRIPT_PRETTIER: true
-          PRETTIER_CONFIG: \${{ inputs.prettier-config }}
-          VALIDATE_DOCKERFILE: true
-          VALIDATE_EDITORCONFIG: true
-          VALIDATE_ENV: true
-          VALIDATE_GIT_COMMITLINT: true
-          VALIDATE_GIT_MERGE_CONFLICT_MARKERS: true
-          VALIDATE_GITHUB_ACTIONS: true
-          VALIDATE_GITLEAKS: true
-          VALIDATE_GRAPHQL_PRETTIER: true
-          VALIDATE_HTML_PRETTIER: true
-          VALIDATE_JAVASCRIPT_PRETTIER: true
-          VALIDATE_JSX_PRETTIER: true
-          VALIDATE_MARKDOWN_PRETTIER: true
-          VALIDATE_TSX: true
-          VALIDATE_TYPESCRIPT_PRETTIER: true
-          VALIDATE_YAML: true
-          YAML_CONFIG_FILE: \${{ inputs.yaml-config }}
-
-      - uses: crazy-max/ghaction-import-gpg@e89d40939c28e39f97cf32126055eeae86ba74ec # v6
-        name: Import GPG Key
-        # Conditions mirror auto-commit exactly — no point importing GPG if the
-        # commit step will be skipped (fork PR, default branch, or secret unset).
-        if: >
-          inputs.enable-auto-commit == true &&
-          github.event.pull_request != null &&
-          github.event.pull_request.head.repo.full_name == github.repository &&
-          github.ref_name != github.event.repository.default_branch &&
-          secrets.SUPER_LINTER_GPG_PRIVATE_KEY != ''
-        with:
-          git_user_signingkey: true
-          git_commit_gpgsign: true
-          GPG_PRIVATE_KEY: \${{ secrets.SUPER_LINTER_GPG_PRIVATE_KEY }}
-          PASSPHRASE: \${{ secrets.SUPER_LINTER_GPG_PASSPHRASE }}
-
-      - uses: stefanzweifel/git-auto-commit-action@b863ae1933cb653a53c021fe36dbb774e1fb9403 # v5
-        name: Commit and push linting fixes
-        if: >
-          inputs.enable-auto-commit == true &&
-          github.event.pull_request != null &&
-          github.event.pull_request.head.repo.full_name == github.repository &&
-          github.ref_name != github.event.repository.default_branch &&
-          secrets.SUPER_LINTER_GPG_PRIVATE_KEY != ''
-        with:
-          branch: \${{ github.event.pull_request.head.ref || github.head_ref || github.ref }}
-          commit_message: "chore: fix linting issues"
-          commit_options: "--no-verify --signoff"
-          commit_user_name: super-linter
-          commit_user_email: super-linter@super-linter.dev
-`,
-	release: `\
-name: Release
-
-# Semantic-release with OIDC Trusted Publishing — no NPM_TOKEN required.
-# The calling repo must have a .releaserc.json that configures branches,
-# plugins, and any publish options. npm@11+ is installed to support OIDC.
-
-on: # yamllint disable-line rule:truthy
-  workflow_call:
-    inputs:
-      run-build:
-        description: Run \`pnpm build\` before releasing
-        type: boolean
-        required: false
-        default: true
-
-jobs:
-  release:
-    name: Semantic release
-    permissions:
-      contents: write
-      id-token: write
-      issues: write
-      pull-requests: write
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    # Do not cancel in-progress releases — a partial release is worse than a slow one.
-    concurrency:
-      group: release-\${{ github.ref }}
-      cancel-in-progress: false
-    steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-        name: Checkout repository
-        with:
-          fetch-depth: 0
-          token: \${{ github.token }}
-
-      - uses: theholocron/.github/.github/actions/setup@main
-        name: Setup
-
-      - run: npm install -g npm@11 sigstore
-        name: Upgrade npm for OIDC support
-        # sigstore is required by libnpmpublish/provenance.js at module parse
-        # time — before any config takes effect. Some npm 11.x builds stopped
-        # bundling it; installing it globally into the same prefix ensures it
-        # resolves regardless of npm version. (Discovered 2026-07-09.)
-
-      - run: pnpm build
-        name: Build
-        if: \${{ inputs.run-build == true }}
-
-      - run: npx semantic-release
-        name: Release
-        env:
-          GITHUB_TOKEN: \${{ github.token }}
-          NPM_CONFIG_PROVENANCE: true
-`,
-	review: `\
-name: Review
-
-# ReviewDog is the annotation layer — posts inline PR diff annotations.
-# Runs on pull_request only: inline annotations require PR context,
-# and branch protection ensures all changes go through PRs anyway.
-# super-linter (lint.yml) is the CI gate covering push + PR events.
-# Gitleaks and YAML are intentionally duplicated: super-linter gates
-# merges; ReviewDog surfaces exact line annotations in the PR diff.
-
-on: # yamllint disable-line rule:truthy
-  workflow_call:
-
-concurrency:
-  group: review-\${{ github.workflow }}-\${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  reviewdog:
-    name: Review PRs
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    permissions:
-      contents: read
-      checks: write
-      pull-requests: write
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-
-      - name: Setup
-        if: \${{ hashFiles('pnpm-lock.yaml') != '' }}
-        uses: theholocron/.github/.github/actions/setup@main
-
-      - name: Install ReviewDog
-        uses: reviewdog/action-setup@d8a7baabd7f3e8544ee4dbde3ee41d0011c3a93f # v1
-        with:
-          reviewdog_version: latest
-
-      #
-      # Always applicable
-      #
-
-      - name: Gitleaks (secrets)
-        uses: reviewdog/action-gitleaks@2b7b5685e3e3eecddab5d30cfa04f18123031421 # v1
-        with:
-          reporter: github-pr-check
-
-      - name: YamlLint
-        uses: reviewdog/action-yamllint@b5f7217d8c815ae374d1d55840d5e569d82f01f0 # v1
-        with:
-          reporter: github-pr-check
-          yamllint_flags: >-
-            \${{ hashFiles('yamllint.config.yml') != ''
-                && format('-c {0}/yamllint.config.yml {0}', github.workspace)
-                || github.workspace }}
-
-      - name: ActionLint (GitHub Actions)
-        if: \${{ hashFiles('.github/workflows/*.yml', '.github/workflows/*.yaml') != '' }}
-        uses: reviewdog/action-actionlint@6fb7acc99f4a1008869fa8a0f09cfca740837d9d # v1
-        with:
-          reporter: github-pr-check
-
-      #
-      # TypeScript / JavaScript
-      #
-
-      - name: ESLint
-        if: >-
-          \${{
-            hashFiles(
-              '**/eslint.config.js',
-              '**/eslint.config.mjs',
-              '**/eslint.config.cjs',
-              '**/eslint.config.ts',
-              '**/.eslintrc',
-              '**/.eslintrc.js',
-              '**/.eslintrc.cjs',
-              '**/.eslintrc.json',
-              '**/.eslintrc.yaml',
-              '**/.eslintrc.yml'
-            ) != ''
-          }}
-        uses: reviewdog/action-eslint@556a3fdaf8b4201d4d74d406013386aa4f7dab96 # v1
-        with:
-          reporter: github-pr-check
-          eslint_flags: .
-
-      - name: TypeScript
-        if: \${{ hashFiles('**/tsconfig.json') != '' }}
-        uses: EPMatt/reviewdog-action-tsc@63d923a3c5b4497671940b8874f58a404e2351b5 # v1
-        with:
-          reporter: github-pr-check
-
-      #
-      # Shell
-      #
-
-      - name: ShellCheck
-        if: \${{ hashFiles('**/*.sh') != '' }}
-        uses: reviewdog/action-shellcheck@4c07458293ac342d477251099501a718ae5ef86e # v1
-        with:
-          reporter: github-pr-check
-          fail_level: none
-
-      #
-      # Docker
-      #
-
-      - name: Hadolint
-        if: >-
-          \${{
-            hashFiles(
-              '**/Dockerfile',
-              '**/*.Dockerfile',
-              '**/Containerfile'
-            ) != ''
-          }}
-        uses: reviewdog/action-hadolint@1b2cfa6ba72072ad35158d7ff3aa49bbdc03506d # v1
-        with:
-          reporter: github-pr-check
-          fail_level: none
-
-      #
-      # Environment files
-      #
-
-      - name: dotenv-linter
-        if: \${{ hashFiles('**/.env*') != '' }}
-        uses: dotenv-linter/action-dotenv-linter@21287e2624aaf2dc8da5dd8ccfe8e49c63501116 # v2
-        with:
-          reporter: github-code-suggestions
-
-      #
-      # Documentation
-      #
-
-      - name: Alex (inclusive language)
-        if: \${{ hashFiles('**/*.md') != '' }}
-        uses: reviewdog/action-alex@347481655add010a2ae302df34b57c9bcfa0d6e4 # v1
-        with:
-          reporter: github-pr-check
-`,
-	stale: `\
-name: Stale
-
-on: # yamllint disable-line rule:truthy
-  workflow_call:
-    inputs:
-      days-before-stale:
-        description: Days of inactivity before an issue is marked stale
-        type: number
-        required: false
-        default: 30
-      days-before-close:
-        description: Days of inactivity after stale label before closing
-        type: number
-        required: false
-        default: 5
-
-jobs:
-  stale:
-    name: Mark stale issues and pull requests
-    permissions:
-      contents: write
-      issues: write
-      pull-requests: write
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9
-        name: Run Stale
-        with:
-          close-issue-message: >
-            This issue was closed because it has been stalled for
-            \${{ inputs.days-before-close }} days with no activity.
-          days-before-close: \${{ inputs.days-before-close }}
-          days-before-stale: \${{ inputs.days-before-stale }}
-          exempt-all-pr-milestones: true
-          stale-issue-label: wontfix
-          stale-issue-message: >
-            This issue is stale because it has been open \${{ inputs.days-before-stale }}
-            days with no activity. Remove the stale label or comment, or this will be
-            closed in \${{ inputs.days-before-close }} days.
-          stale-pr-label: wontfix
-          stale-pr-message: >
-            This PR is stale because it has been open \${{ inputs.days-before-stale }}
-            days with no activity. Remove the stale label or comment, or this will be
-            closed in \${{ inputs.days-before-close }} days.
-`,
-	test: `\
-name: Test
-
-on: # yamllint disable-line rule:truthy
-  workflow_call:
-    secrets:
-      CODECOV_TOKEN:
-        required: false
-
-jobs:
-  unit:
-    name: Run tests and collect coverage
-    permissions:
-      contents: read
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-        name: Checkout repository
-        with:
-          fetch-depth: 0
-
-      - uses: theholocron/.github/.github/actions/setup@main
-        name: Setup
-
-      - run: pnpm test -- --coverage
-        name: Run tests with coverage
-
-      - uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4
-        name: Upload results to Codecov
-        with:
-          token: \${{ secrets.CODECOV_TOKEN }}
-`,
-	typecheck: `\
-name: Typecheck
-
-on: # yamllint disable-line rule:truthy
-  workflow_call:
-
-jobs:
-  typecheck:
-    name: tsc --noEmit
-    permissions:
-      contents: read
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-        name: Checkout repository
-
-      - uses: theholocron/.github/.github/actions/setup@main
-        name: Setup
-
-      - run: pnpm typecheck
-        name: Type check
-`
+	audit: audit_default$1,
+	bookkeeping: bookkeeping_default$1,
+	codeql: codeql_default$1,
+	dependencies: dependencies_default$1,
+	greetings: greetings_default$1,
+	lint: lint_default$1,
+	release: release_default$1,
+	review: review_default$1,
+	stale: stale_default$1,
+	"sync-github": sync_github_default$1,
+	test: test_default$1,
+	typecheck: typecheck_default$1
 };
+const WORKFLOW_TEMPLATE_PROPERTIES = {
+	bookkeeping: JSON.stringify({
+		name: "Bookkeeping",
+		description: "Label and track issues and pull requests.",
+		iconName: "octicon tag"
+	}, null, 2),
+	"sync-github": JSON.stringify({
+		name: "Sync GitHub Templates",
+		description: "Sync workflow templates and composite actions from the holocron CLI.",
+		iconName: "octicon sync"
+	}, null, 2)
+};
+//#endregion
+//#region src/commands/dependabot.yml
+var dependabot_default = "# AUTO-GENERATED by holocron — run `holocron setup` to regenerate.\nversion: 2\nupdates:\n  - package-ecosystem: npm\n    directory: /\n    schedule:\n      interval: weekly\n    groups:\n      security-patches:\n        applies-to: security-updates\n        patterns:\n          - \"*\"\n      all-dependencies:\n        update-types:\n          - minor\n          - patch\n\n  - package-ecosystem: github-actions\n    directory: /\n    schedule:\n      interval: weekly\n    groups:\n      all-actions:\n        patterns:\n          - \"*\"\n";
+//#endregion
+//#region src/commands/workflows/audit.yml
+var audit_default = "name: Audit\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\npermissions:\n  contents: read\n\njobs:\n  audit:\n    uses: theholocron/.github/.github/workflows/audit.yml@main\n    secrets: inherit\n";
+//#endregion
+//#region src/commands/workflows/bookkeeping.yml
+var bookkeeping_default = "name: Bookkeeping\n\non: # yamllint disable-line rule:truthy\n  pull_request:\n    types:\n      - opened\n      - edited\n\npermissions:\n  contents: read\n  pull-requests: write\n\njobs:\n  bookkeeping:\n    uses: theholocron/.github/.github/workflows/bookkeeping.yml@main\n    secrets: inherit\n";
+//#endregion
+//#region src/commands/workflows/codeql.yml
+var codeql_default = "name: CodeQL\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches:\n      - main\n  pull_request:\n    branches:\n      - main\n  schedule:\n    - cron: \"0 0 * * 1\"\n\npermissions:\n  actions: read\n  contents: read\n  security-events: write\n\njobs:\n  codeql:\n    uses: theholocron/.github/.github/workflows/codeql.yml@main\n    secrets: inherit\n";
+//#endregion
+//#region src/commands/workflows/dependencies.yml
+var dependencies_default = "name: Dependencies\n\non: # yamllint disable-line rule:truthy\n  pull_request:\n\npermissions:\n  contents: write\n  pull-requests: write\n\njobs:\n  dependencies:\n    uses: theholocron/.github/.github/workflows/dependencies.yml@main\n    secrets: inherit\n";
+//#endregion
+//#region src/commands/workflows/greetings.yml
+var greetings_default = "name: Greetings\n\non: # yamllint disable-line rule:truthy\n  pull_request:\n  issues:\n\npermissions:\n  issues: write\n  pull-requests: write\n\njobs:\n  greetings:\n    uses: theholocron/.github/.github/workflows/greetings.yml@main\n    secrets: inherit\n";
+//#endregion
+//#region src/commands/workflows/lint.yml
+var lint_default = "name: Lint\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\nconcurrency:\n  group: lint-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: write\n  statuses: write\n\njobs:\n  lint:\n    name: Lint\n    uses: theholocron/.github/.github/workflows/lint.yml@main\n    secrets: inherit\n    with:\n      enable-auto-commit: true\n";
+//#endregion
+//#region src/commands/workflows/release.yml
+var release_default = "name: Release\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches:\n      - main\n      - alpha\n  workflow_dispatch:\n\npermissions:\n  contents: write\n  id-token: write\n  issues: write\n  pull-requests: write\n\nconcurrency:\n  group: ${{ github.workflow }}-${{ github.ref }}\n  cancel-in-progress: false\n\njobs:\n  release:\n    uses: theholocron/.github/.github/workflows/release.yml@main\n    secrets: inherit\n";
+//#endregion
+//#region src/commands/workflows/review.yml
+var review_default = "name: Review\n\non: # yamllint disable-line rule:truthy\n  pull_request:\n\nconcurrency:\n  group: review-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n  checks: write\n  pull-requests: write\n\njobs:\n  review:\n    name: Review\n    uses: theholocron/.github/.github/workflows/review.yml@main\n    secrets: inherit\n";
+//#endregion
+//#region src/commands/workflows/stale.yml
+var stale_default = "name: Stale\n\non: # yamllint disable-line rule:truthy\n  schedule:\n    - cron: \"30 1 * * *\"\n\npermissions:\n  contents: write\n  issues: write\n  pull-requests: write\n\njobs:\n  stale:\n    uses: theholocron/.github/.github/workflows/stale.yml@main\n    secrets: inherit\n";
+//#endregion
+//#region src/commands/workflows/sync-github.yml
+var sync_github_default = "name: Sync GitHub Templates\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n    paths:\n      - packages/cli/src/templates/index.ts\n      - packages/cli/src/commands/setup-workflows.ts\n\nconcurrency:\n  group: sync-github-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n\njobs:\n  sync:\n    name: Sync\n    uses: theholocron/.github/.github/workflows/sync-github.yml@main\n    with:\n      secondary-repos: theholocron/.github-private\n    secrets:\n      SYNC_TOKEN: ${{ secrets.SYNC_TOKEN }}\n";
+//#endregion
+//#region src/commands/workflows/test.yml
+var test_default = "name: Test\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\nconcurrency:\n  group: test-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n\njobs:\n  test:\n    name: Test\n    uses: theholocron/.github/.github/workflows/test.yml@main\n    secrets: inherit\n";
+//#endregion
+//#region src/commands/workflows/typecheck.yml
+var typecheck_default = "name: Typecheck\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\nconcurrency:\n  group: typecheck-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n\njobs:\n  typecheck:\n    name: Typecheck\n    uses: theholocron/.github/.github/workflows/typecheck.yml@main\n    secrets: inherit\n";
 //#endregion
 //#region src/commands/setup-workflows.ts
-/**
-* Thin workflow wrapper templates for `holocron setup`.
-*
-* Each entry is a complete `.github/workflows/<name>.yml` that delegates
-* to the corresponding reusable `ci-<name>.yml` in `theholocron/.github`.
-* Files are overwritten on each setup run — they are generated artifacts.
-*/
-const WORKFLOW_REPO = "theholocron/.github";
-const WORKFLOW_REF = "main";
-function ref(name) {
-	return `${WORKFLOW_REPO}/.github/workflows/${name}.yml@${WORKFLOW_REF}`;
+/** Header prepended when holocron setup writes a generated file to a repo. */
+function workflowHeader(source = "packages/cli/src/commands/setup-workflows.ts") {
+	return [
+		`# AUTO-GENERATED — do not edit directly.`,
+		`# Source:  theholocron/holocron · ${source}`,
+		`# Synced:  ${(/* @__PURE__ */ new Date()).toISOString()}`,
+		`# Tool:    holocron setup`,
+		`# Changes: run \`holocron setup\` to regenerate.`,
+		``
+	].join("\n");
 }
-/** Header prepended when holocron setup writes a thin caller to a repo. */
-const WORKFLOW_HEADER = `\
-# AUTO-GENERATED by holocron — do not edit directly.
-# Source: theholocron/holocron · packages/cli/src/commands/setup-workflows.ts
-# Run \`holocron setup\` to regenerate.
-
-`;
 const WORKFLOW_TEMPLATES = {
-	lint: `\
-name: Lint
-
-on: # yamllint disable-line rule:truthy
-  push:
-    branches: [main, alpha]
-  pull_request:
-
-concurrency:
-  group: lint-\${{ github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: write
-  statuses: write
-
-jobs:
-  lint:
-    name: Lint
-    uses: ${ref("lint")}
-    secrets: inherit
-    with:
-      enable-auto-commit: true
-`,
-	test: `\
-name: Test
-
-on: # yamllint disable-line rule:truthy
-  push:
-    branches: [main, alpha]
-  pull_request:
-
-concurrency:
-  group: test-\${{ github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  test:
-    name: Test
-    uses: ${ref("test")}
-    secrets: inherit
-`,
-	typecheck: `\
-name: Typecheck
-
-on: # yamllint disable-line rule:truthy
-  push:
-    branches: [main, alpha]
-  pull_request:
-
-concurrency:
-  group: typecheck-\${{ github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  typecheck:
-    name: Typecheck
-    uses: ${ref("typecheck")}
-    secrets: inherit
-`,
-	codeql: `\
-name: CodeQL
-
-on: # yamllint disable-line rule:truthy
-  push:
-    branches:
-      - main
-  pull_request:
-    branches:
-      - main
-  schedule:
-    - cron: "0 0 * * 1"
-
-permissions:
-  actions: read
-  contents: read
-  security-events: write
-
-jobs:
-  codeql:
-    uses: ${ref("codeql")}
-    secrets: inherit
-`,
-	review: `\
-name: Review
-
-on: # yamllint disable-line rule:truthy
-  pull_request:
-
-concurrency:
-  group: review-\${{ github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-  checks: write
-  pull-requests: write
-
-jobs:
-  review:
-    name: Review
-    uses: ${ref("review")}
-    secrets: inherit
-`,
-	release: `\
-name: Release
-
-on: # yamllint disable-line rule:truthy
-  push:
-    branches:
-      - main
-      - alpha
-  workflow_dispatch:
-
-permissions:
-  contents: write
-  id-token: write
-  issues: write
-  pull-requests: write
-
-concurrency:
-  group: \${{ github.workflow }}-\${{ github.ref }}
-  cancel-in-progress: false
-
-jobs:
-  release:
-    uses: ${ref("release")}
-    secrets: inherit
-`,
-	stale: `\
-name: Stale
-
-on: # yamllint disable-line rule:truthy
-  schedule:
-    - cron: "30 1 * * *"
-
-permissions:
-  contents: write
-  issues: write
-  pull-requests: write
-
-jobs:
-  stale:
-    uses: ${ref("stale")}
-    secrets: inherit
-`,
-	greetings: `\
-name: Greetings
-
-on: # yamllint disable-line rule:truthy
-  pull_request:
-  issues:
-
-permissions:
-  issues: write
-  pull-requests: write
-
-jobs:
-  greetings:
-    uses: ${ref("greetings")}
-    secrets: inherit
-`,
-	dependencies: `\
-name: Dependencies
-
-on: # yamllint disable-line rule:truthy
-  pull_request:
-
-permissions:
-  contents: write
-  pull-requests: write
-
-jobs:
-  dependencies:
-    uses: ${ref("dependencies")}
-    secrets: inherit
-`,
-	"bookkeeping-pr": `\
-name: PR Bookkeeping
-
-on: # yamllint disable-line rule:truthy
-  pull_request:
-    types:
-      - opened
-      - edited
-
-permissions:
-  contents: read
-  pull-requests: write
-
-jobs:
-  bookkeeping:
-    uses: ${ref("bookkeeping-pr")}
-    secrets: inherit
-`,
-	audit: `\
-name: Audit
-
-on: # yamllint disable-line rule:truthy
-  push:
-    branches: [main, alpha]
-  pull_request:
-
-permissions:
-  contents: read
-
-jobs:
-  audit:
-    uses: ${ref("audit")}
-    secrets: inherit
-`
+	lint: lint_default,
+	test: test_default,
+	typecheck: typecheck_default,
+	codeql: codeql_default,
+	review: review_default,
+	release: release_default,
+	stale: stale_default,
+	greetings: greetings_default,
+	dependencies: dependencies_default,
+	bookkeeping: bookkeeping_default,
+	audit: audit_default,
+	"sync-github": sync_github_default
 };
 const KNOWN_WORKFLOWS = new Set(Object.keys(WORKFLOW_TEMPLATES));
+/**
+* GitHub check context name each CI workflow produces on a PR.
+*
+* The format is "{caller-workflow-name} / {reusable-job-name}". The caller
+* job's own `name:` field does NOT appear in the external check name — only
+* the calling workflow's top-level `name:` and the inner reusable-workflow
+* job name matter. Only workflows that gate merges are listed here.
+*/
+const WORKFLOW_CHECK_CONTEXTS = {
+	lint: "Lint / Lint entire codebase",
+	test: "Test / Run tests and collect coverage",
+	typecheck: "Typecheck / tsc --noEmit"
+};
+/**
+* Generate the thin caller content for a workflow, optionally injecting or
+* merging `with:` overrides into the jobs block.
+*
+* Two strategies are used depending on the template:
+* - Templates that already have a `with:` block (e.g. lint, sync-github):
+*   the override entries are merged in, replacing existing keys and appending
+*   new ones.
+* - Templates that end with `    secrets: inherit`: a new `with:` block is
+*   injected immediately before `secrets: inherit`.
+* If neither pattern matches the template, a warning is emitted and the
+* base template is returned unchanged.
+*/
+function generateThinCallerContent(name, withOverrides) {
+	const base = WORKFLOW_TEMPLATES[name];
+	if (!base) return "";
+	if (!withOverrides || Object.keys(withOverrides).length === 0) return base;
+	const fmt = (k, v) => `      ${k}: ${v === true ? "true" : v === false ? "false" : String(v)}`;
+	const withBlockRe = /( {4}with:\n)((?:[ ]{6}[^\n]+\n)*)/;
+	const existingMatch = base.match(withBlockRe);
+	if (existingMatch) {
+		const existingEntries = new Map(existingMatch[2].split("\n").filter(Boolean).map((line) => {
+			const m = line.match(/^ {6}([^:]+):\s*(.*)/);
+			return m ? [m[1].trim(), m[2].trim()] : null;
+		}).filter((e) => e !== null));
+		for (const [k, v] of Object.entries(withOverrides)) existingEntries.set(k, v === true ? "true" : v === false ? "false" : String(v));
+		const merged = [...existingEntries.entries()].map(([k, v]) => `      ${k}: ${v}`).join("\n");
+		return base.replace(withBlockRe, `    with:\n${merged}\n`);
+	}
+	const withBlock = Object.entries(withOverrides).map(([k, v]) => fmt(k, v)).join("\n");
+	const result = base.replace(/ {4}secrets: inherit\n$/, `    with:\n${withBlock}\n    secrets: inherit\n`);
+	if (result === base) console.warn(`[generateThinCallerContent] could not inject with: overrides into "${name}" template`);
+	return result;
+}
 //#endregion
 //#region src/commands/sync-github.ts
 const DEFAULT_REPO = "theholocron/.github";
-const API_BASE = "https://api.github.com";
-function reusableHeader(source) {
-	return [
-		`# AUTO-GENERATED — do not edit in theholocron/.github directly.`,
-		`# Source:  theholocron/holocron · ${source}`,
-		`# Synced:  ${(/* @__PURE__ */ new Date()).toISOString()}`,
-		`# Tool:    holocron sync-github`,
-		`# Changes: edit source in theholocron/holocron and push to alpha or main.`,
+/**
+* Extracts the `workflows` array from a `holocron.config.ts` source string.
+* Handles both plain string entries and `{ name, with }` object entries.
+* Falls back to an empty array if the array cannot be found or parsed.
+*/
+function parseWorkflowsFromTs(source) {
+	const keyMatch = source.match(/\bworkflows\s*:\s*\[/);
+	if (!keyMatch) return [];
+	const start = keyMatch.index + keyMatch[0].length;
+	let depth = 1;
+	let i = start;
+	while (i < source.length && depth > 0) {
+		if (source[i] === "[") depth++;
+		else if (source[i] === "]") depth--;
+		i++;
+	}
+	const body = source.slice(start, i - 1);
+	const entries = [];
+	const objSpans = [];
+	const objRe = /\{\s*name\s*:\s*"([^"]+)"(?:\s*,\s*with\s*:\s*(\{[^}]*\}))?\s*\}/g;
+	let m;
+	while ((m = objRe.exec(body)) !== null) {
+		objSpans.push([m.index, m.index + m[0].length]);
+		let withObj;
+		if (m[2]) try {
+			withObj = JSON.parse(m[2]);
+		} catch {}
+		entries.push({
+			pos: m.index,
+			entry: {
+				name: m[1],
+				...withObj && { with: withObj }
+			}
+		});
+	}
+	const strRe = /"([^"]+)"/g;
+	while ((m = strRe.exec(body)) !== null) if (!objSpans.some(([s, e]) => m.index >= s && m.index < e)) entries.push({
+		pos: m.index,
+		entry: { name: m[1] }
+	});
+	entries.sort((a, b) => a.pos - b.pos);
+	return entries.map(({ entry }) => entry);
+}
+function reusableHeader(source) {
+	return [
+		`# AUTO-GENERATED — do not edit in theholocron/.github directly.`,
+		`# Source:  theholocron/holocron · ${source}`,
+		`# Synced:  ${(/* @__PURE__ */ new Date()).toISOString()}`,
+		`# Tool:    holocron sync-github`,
+		`# Changes: edit source in theholocron/holocron and push to alpha or main.`,
 		``
 	].join("\n");
 }
-function thinCallerHeader() {
+function thinCallerHeader(forPrimary = false) {
 	return [
-		`# AUTO-GENERATED — do not edit in theholocron/.github directly.`,
+		forPrimary ? `# AUTO-GENERATED — do not edit in theholocron/.github directly.` : `# AUTO-GENERATED — do not edit directly.`,
 		`# Source:  theholocron/holocron · packages/cli/src/commands/setup-workflows.ts`,
 		`# Synced:  ${(/* @__PURE__ */ new Date()).toISOString()}`,
 		`# Tool:    holocron sync-github`,
-		`# Changes: edit setup-workflows.ts in theholocron/holocron and push.`,
+		`# Changes: edit source in theholocron/holocron and push to alpha or main.`,
 		``
 	].join("\n");
 }
-function buildBatch() {
+function buildBatch(repo, allowedWorkflows, withOverrides) {
 	const files = [];
-	for (const [name, content] of Object.entries(ACTIONS)) files.push({
+	const isPrimaryGithubRepo = repo === DEFAULT_REPO;
+	if (isPrimaryGithubRepo) for (const [name, content] of Object.entries(ACTIONS)) files.push({
 		path: `.github/actions/${name}.yml`,
 		content: reusableHeader(`packages/cli/src/templates/index.ts`) + content
 	});
-	for (const [name, content] of Object.entries(REUSABLE_WORKFLOWS)) files.push({
-		path: `.github/workflows/${name}.yml`,
-		content: reusableHeader(`packages/cli/src/templates/index.ts`) + content
-	});
-	for (const [name, content] of Object.entries(WORKFLOW_TEMPLATES)) files.push({
-		path: `workflow-templates/${name}.yml`,
-		content: thinCallerHeader() + content
-	});
+	if (isPrimaryGithubRepo) {
+		for (const [name, content] of Object.entries(REUSABLE_WORKFLOWS)) files.push({
+			path: `.github/workflows/${name}.yml`,
+			content: reusableHeader(`packages/cli/src/templates/index.ts`) + content
+		});
+		for (const [name, content] of Object.entries(WORKFLOW_TEMPLATES)) {
+			files.push({
+				path: `workflow-templates/${name}.yml`,
+				content: thinCallerHeader(true) + content
+			});
+			const props = WORKFLOW_TEMPLATE_PROPERTIES[name];
+			if (props) files.push({
+				path: `workflow-templates/${name}.properties.json`,
+				content: props
+			});
+		}
+	} else for (const name of Object.keys(REUSABLE_WORKFLOWS)) {
+		if (allowedWorkflows && !allowedWorkflows.has(name)) continue;
+		const content = generateThinCallerContent(name, withOverrides?.get(name));
+		if (!content) continue;
+		files.push({
+			path: `.github/workflows/${name}.yml`,
+			content: thinCallerHeader() + content
+		});
+	}
 	return files;
 }
+/** Git blob SHA: sha1("blob {len}\0{content}") — used to detect unchanged files. */
+function gitBlobSha(content) {
+	const buf = Buffer.from(content, "utf8");
+	return createHash("sha1").update(`blob ${buf.length}\0`).update(buf).digest("hex");
+}
 async function runSyncGithub(input) {
 	const print = input.print ?? ((line) => console.log(line));
 	const repo = input.repo ?? DEFAULT_REPO;
-	const [owner, repoName] = repo.split("/");
-	const { token, dryRun = false } = input;
+	const { token, dryRun = false, branch, createPr = false } = input;
 	const message = input.message ?? `chore: sync from theholocron/holocron`;
-	const fetchFn = input.fetch ?? globalThis.fetch;
-	const headers = {
-		Authorization: `Bearer ${token}`,
-		Accept: "application/vnd.github+json",
-		"Content-Type": "application/json",
-		"X-GitHub-Api-Version": "2022-11-28"
-	};
+	const client = createGitHubClient({
+		token,
+		fetch: input.fetch
+	});
 	print(`holocron sync-github${dryRun ? " (dry-run)" : ""}`);
-	print(`  repo: ${repo}`);
+	print(`  repo:   ${repo}`);
+	if (branch) print(`  branch: ${branch}`);
 	print("");
-	const batch = buildBatch();
+	if (input.outputDir) {
+		const batch = buildBatch(repo);
+		for (const file of batch) {
+			const dest = join(input.outputDir, file.path);
+			mkdirSync(dirname(dest), { recursive: true });
+			writeFileSync(dest, file.content, "utf8");
+		}
+		print(`  ${batch.length} files written to ${input.outputDir}`);
+		return {
+			status: "ok",
+			created: batch.length,
+			updated: 0,
+			unchanged: 0
+		};
+	}
+	let targetBranch = branch;
+	let defaultBranch;
+	if (!targetBranch || createPr) try {
+		defaultBranch = (await client.repos.getRepo(repo)).default_branch;
+		if (!targetBranch) targetBranch = defaultBranch;
+	} catch {
+		const msg = "failed to fetch repo metadata";
+		print(`  ✗ ${msg}`);
+		return {
+			status: "fail",
+			created: 0,
+			updated: 0,
+			unchanged: 0,
+			message: msg
+		};
+	}
+	const baseBranch = createPr && defaultBranch ? defaultBranch : targetBranch;
+	let headSha;
+	let baseTreeSha;
+	let existingBlobs;
+	try {
+		headSha = (await client.git.getRef(repo, baseBranch)).object.sha;
+		baseTreeSha = (await client.git.getCommit(repo, headSha)).tree.sha;
+		const treeData = await client.git.getTree(repo, baseTreeSha, true);
+		existingBlobs = new Map(treeData.tree.filter((i) => i.type === "blob").map((i) => [i.path, i.sha]));
+	} catch (err) {
+		const msg = err instanceof Error ? err.message : `Branch ${baseBranch} not found`;
+		print(`  ✗ ${msg}`);
+		return {
+			status: "fail",
+			created: 0,
+			updated: 0,
+			unchanged: 0,
+			message: msg
+		};
+	}
+	let allowedWorkflows;
+	let withOverrides;
+	if (repo !== DEFAULT_REPO) try {
+		let entries = [];
+		try {
+			const data = await client.git.getContents(repo, "holocron.config.json");
+			entries = (JSON.parse(Buffer.from(data.content.replace(/\n/g, ""), "base64").toString("utf8"))?.workflows ?? []).map((w) => typeof w === "string" ? { name: w } : w);
+		} catch (err) {
+			if (!(err instanceof ProviderApiError) || err.status !== 404) throw err;
+			try {
+				const data = await client.git.getContents(repo, "holocron.config.ts");
+				entries = parseWorkflowsFromTs(Buffer.from(data.content.replace(/\n/g, ""), "base64").toString("utf8"));
+			} catch {}
+		}
+		if (entries.length > 0) {
+			allowedWorkflows = new Set(entries.map((e) => e.name));
+			const overrideEntries = entries.filter((e) => e.with != null).map((e) => [e.name, e.with]);
+			if (overrideEntries.length > 0) withOverrides = new Map(overrideEntries);
+		}
+	} catch {}
+	const batch = buildBatch(repo, allowedWorkflows, withOverrides);
 	let created = 0;
 	let updated = 0;
 	let unchanged = 0;
+	const changedFiles = [];
 	for (const file of batch) {
-		const url = `${API_BASE}/repos/${owner}/${repoName}/contents/${file.path}`;
-		const newContent = Buffer.from(file.content, "utf8").toString("base64");
-		let existingSha;
-		let existingContent;
-		try {
-			const getRes = await fetchFn(url, { headers });
-			if (getRes.ok) {
-				const data = await getRes.json();
-				existingSha = data.sha;
-				existingContent = data.content.replace(/\n/g, "");
-			}
-		} catch {}
-		if (existingContent === newContent) {
+		const localSha = gitBlobSha(file.content);
+		const existingSha = existingBlobs.get(file.path);
+		if (existingSha === localSha) {
 			print(`  · unchanged  ${file.path}`);
 			unchanged++;
-			continue;
-		}
-		const verb = existingSha ? "updated " : "created ";
-		if (dryRun) {
-			print(`  ~ ${verb} ${file.path}`);
-			if (existingSha) updated++;
-			else created++;
-			continue;
-		}
-		const body = {
-			message,
-			content: newContent
-		};
-		if (existingSha) body.sha = existingSha;
-		const putRes = await fetchFn(url, {
-			method: "PUT",
-			headers,
-			body: JSON.stringify(body)
-		});
-		if (!putRes.ok) {
-			const err = await putRes.json();
-			const msg = `failed to push ${file.path}: ${err.message ?? putRes.status}`;
-			print(`  ✗ ${msg}`);
-			return {
-				status: "fail",
-				created,
-				updated,
-				unchanged,
-				message: msg
-			};
+		} else if (existingSha) {
+			print(`  ${dryRun ? "~" : "✓"} updated  ${file.path}`);
+			updated++;
+			if (!dryRun) changedFiles.push(file);
+		} else {
+			print(`  ${dryRun ? "~" : "✓"} created  ${file.path}`);
+			created++;
+			if (!dryRun) changedFiles.push(file);
 		}
-		print(`  ✓ ${verb} ${file.path}`);
-		if (existingSha) updated++;
-		else created++;
 	}
 	print("");
 	print(`  ${created} created, ${updated} updated, ${unchanged} unchanged`);
-	return {
+	if (dryRun || changedFiles.length === 0) return {
 		status: dryRun ? "dry-run" : "ok",
 		created,
 		updated,
 		unchanged
 	};
+	const treeEntries = [];
+	for (const file of changedFiles) try {
+		const blob = await client.git.createBlob(repo, file.content);
+		treeEntries.push({
+			path: file.path,
+			mode: "100644",
+			type: "blob",
+			sha: blob.sha
+		});
+	} catch (err) {
+		const msg = `failed to create blob for ${file.path}: ${err instanceof Error ? err.message : String(err)}`;
+		print(`  ✗ ${msg}`);
+		return {
+			status: "fail",
+			created,
+			updated,
+			unchanged,
+			message: msg
+		};
+	}
+	let newTreeSha;
+	try {
+		newTreeSha = (await client.git.createTree(repo, treeEntries, baseTreeSha)).sha;
+	} catch (err) {
+		const msg = `failed to create tree: ${err instanceof Error ? err.message : String(err)}`;
+		print(`  ✗ ${msg}`);
+		return {
+			status: "fail",
+			created,
+			updated,
+			unchanged,
+			message: msg
+		};
+	}
+	let newCommitSha;
+	try {
+		newCommitSha = (await client.git.createCommit(repo, message, newTreeSha, [headSha])).sha;
+	} catch (err) {
+		const msg = `failed to create commit: ${err instanceof Error ? err.message : String(err)}`;
+		print(`  ✗ ${msg}`);
+		return {
+			status: "fail",
+			created,
+			updated,
+			unchanged,
+			message: msg
+		};
+	}
+	try {
+		if (createPr && branch) try {
+			await client.git.createRef(repo, `refs/heads/${branch}`, newCommitSha);
+		} catch (err) {
+			if (!(err instanceof ProviderApiError) || err.status !== 422) throw err;
+			await client.git.updateRef(repo, `heads/${branch}`, newCommitSha, true);
+		}
+		else await client.git.updateRef(repo, `heads/${targetBranch}`, newCommitSha);
+	} catch (err) {
+		const msg = `failed to update ref: ${err instanceof Error ? err.message : String(err)}`;
+		print(`  ✗ ${msg}`);
+		return {
+			status: "fail",
+			created,
+			updated,
+			unchanged,
+			message: msg
+		};
+	}
+	let prUrl;
+	if (branch && createPr && !dryRun) try {
+		prUrl = (await client.git.createPull(repo, {
+			title: message.split("\n")[0],
+			head: branch,
+			base: "main",
+			body: "Auto-generated by `holocron sync-github`. Review and merge to apply template updates."
+		})).html_url;
+		print(`  → PR opened: ${prUrl}`);
+	} catch (err) {
+		if (err instanceof ProviderApiError && err.status === 422 && String(err.details).includes("already exists")) print(`  → PR already open for ${branch} — branch updated, ready to merge`);
+		else print(`  ⚠ PR creation failed: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	return {
+		status: "ok",
+		created,
+		updated,
+		unchanged,
+		prUrl
+	};
 }
 //#endregion
 //#region src/commands/npm-publish-initial.ts
@@ -1559,11 +1638,10 @@ async function runNpmPublishInitial(input = {}) {
 	const dryRun = input.dryRun ?? false;
 	const otp = input.otp;
 	const env = input.env ?? process.env;
-	const exec = input.exec ?? defaultExec;
+	const exec = input.exec ?? defaultExec$2;
 	const publishArgs = [
 		"-r",
 		"--filter=./packages/*",
-		"--filter=!@theholocron/cli-utils",
 		"publish",
 		"--access",
 		"public",
@@ -1635,7 +1713,7 @@ function printNextSteps$1(print, env) {
 		print("    https://www.npmjs.com/settings/~/tokens");
 	}
 }
-const defaultExec = async (cmd, args, opts) => {
+const defaultExec$2 = async (cmd, args, opts) => {
 	const result = spawnSync(cmd, args, {
 		cwd: opts.cwd,
 		encoding: "utf8",
@@ -1654,7 +1732,7 @@ const defaultExec = async (cmd, args, opts) => {
 //#endregion
 //#region src/commands/plugin-create/template-inputs.ts
 /** Derive the standard defaults from a slug + vendor name. */
-function deriveDefaults(input) {
+function deriveDefaults$1(input) {
 	const vendorUpper = input.slug.toUpperCase().replace(/-/g, "_");
 	const capability = input.capability;
 	return {
@@ -1667,48 +1745,19 @@ function deriveDefaults(input) {
 //#endregion
 //#region src/commands/plugin-create/templates/auth.ts
 function render$17(inputs) {
-	return `/**
- * Token resolution for the ${inputs.vendorName} plugin.
- *
- * Resolution order (matches the standard 4-step precedence set by
- * \`.notes/tech-auth-bootstrap.spec.md\`):
- *   1. explicit \`cliToken\` argument (from \`--token\` flag)
- *   2. ${inputs.tokenEnv} env var (preferred — explicit intent)
- *   3. ${inputs.vendorEnv} env var (vendor-native)
- *   4. keyring (com.theholocron.cli / "${inputs.slug}")
- *   5. AuthError naming all four options + the bootstrap hint
- */
-
-import { getToken as getKeyringToken } from "@theholocron/cli";
-
-export class AuthError extends Error {
-	override name = "AuthError";
-}
-
-export interface ResolveTokenInput {
-	/** From \`--token\` CLI flag. */
-	cliToken?: string;
-	/** Env vars; passed in for testability. Defaults to \`process.env\`. */
-	env?: NodeJS.ProcessEnv;
-	/** Keyring lookup fn; passed in for testability. Defaults to \`getToken(provider)\`. */
-	keyring?: (provider: string) => string | null;
-}
-
-export function resolveToken(input: ResolveTokenInput = {}): string {
-	const env = input.env ?? process.env;
-	const keyring = input.keyring ?? getKeyringToken;
-	// Bracket access so numeric-prefixed slugs (e.g., env.HOLOCRON_1PASSWORD_TOKEN
-	// which is invalid JS) still produce syntactically valid code.
-	const token =
-		input.cliToken || env["${inputs.tokenEnv}"] || env["${inputs.vendorEnv}"] || keyring("${inputs.slug}");
-	if (!token) {
-		throw new AuthError(
-			"no ${inputs.vendorName} token found. Pass --token <TOKEN>, set ${inputs.tokenEnv} / ${inputs.vendorEnv}, " +
-				"or run: holocron auth set ${inputs.slug} <TOKEN>"
-		);
-	}
-	return token;
-}
+	return `import { AuthError, createResolveToken, type ResolveTokenInput } from "@theholocron/cli";
+
+export { AuthError };
+export type { ResolveTokenInput };
+
+export const resolveToken = createResolveToken({
+\tenvName: "${inputs.tokenEnv}",
+\tvendorEnvName: "${inputs.vendorEnv}",
+\tkeyringService: "${inputs.slug}",
+\terrorMessage:
+\t\t"no ${inputs.vendorName} token found. Pass --token <TOKEN>, set ${inputs.tokenEnv} / ${inputs.vendorEnv}, " +
+\t\t"or run: holocron auth set ${inputs.slug} <TOKEN>",
+});
 `;
 }
 //#endregion
@@ -2134,148 +2183,79 @@ Not yet published; capability methods are stubs.
 //#endregion
 //#region src/commands/plugin-create/templates/rest.ts
 function render$7(inputs) {
-	const clientClass = `${inputs.vendorName}RestClient`;
-	return `/**
- * Thin REST wrapper around ${inputs.baseUrl}.
- *
- * Bearer auth, JSON-only bodies, transport-failure wrapping with
- * \`status: 0\` so orchestrator soft-skip paths see a clear message
- * instead of a generic \`TypeError: fetch failed\`.
- */
-
-import { ProviderApiError } from "@theholocron/cli";
-
-export interface RestClientOptions {
-	token: string;
-	fetch?: typeof fetch;
-	baseUrl?: string;
-}
-
-export interface RequestOptions {
-	method?: "GET" | "POST" | "PATCH" | "PUT" | "DELETE";
-	body?: unknown;
-	query?: Record<string, string>;
-	/** Treat this response as void even if 200 is returned. */
-	expectNoContent?: boolean;
-}
-
-export class ${clientClass} {
-	private readonly token: string;
-	private readonly fetchImpl: typeof fetch;
-	readonly baseUrl: string;
-
-	constructor(opts: RestClientOptions) {
-		this.token = opts.token;
-		this.fetchImpl = opts.fetch ?? globalThis.fetch;
-		// Manual trailing-slash trim — CodeQL flags regex on library
-		// input as polynomial ReDoS. O(n) loop, no backtracking risk.
-		let url = opts.baseUrl ?? "${inputs.baseUrl}";
-		while (url.endsWith("/")) url = url.slice(0, -1);
-		this.baseUrl = url;
-	}
-
-	async request<T>(path: string, opts: RequestOptions = {}): Promise<T> {
-		const url = new URL(\`\${this.baseUrl}\${path.startsWith("/") ? path : "/" + path}\`);
-		for (const [k, v] of Object.entries(opts.query ?? {})) url.searchParams.set(k, v);
-		const fullUrl = url.toString();
-
-		const headers: Record<string, string> = {
-			authorization: \`Bearer \${this.token}\`,
-			accept: "application/json",
-		};
-		const init: RequestInit = {
-			method: opts.method ?? "GET",
-			headers,
-		};
-		if (opts.body !== undefined) {
-			headers["content-type"] = "application/json";
-			init.body = JSON.stringify(opts.body);
-		}
-
-		let res: Response;
-		try {
-			res = await this.fetchImpl(fullUrl, init);
-		} catch (err) {
-			const detail = err instanceof Error ? \`\${err.name}: \${err.message}\` : String(err);
-			throw new ProviderApiError(\`${inputs.vendorName} \${init.method} \${path} failed: \${detail}\`, 0, undefined);
-		}
-		if (!res.ok) {
-			const body = await res.text().catch(() => "");
-			throw new ProviderApiError(\`${inputs.vendorName} \${init.method} \${path} → \${res.status}\`, res.status, body);
-		}
-		if (opts.expectNoContent || res.status === 204) return undefined as T;
-		const text = await res.text();
-		if (!text) return undefined as T;
-		return JSON.parse(text) as T;
-	}
+	return `import { createRestClient, type RequestOptions, type RestClient } from "@theholocron/cli";
+
+export type { RequestOptions, RestClient };
+
+export function ${`create${inputs.vendorName}RestClient`}(opts: {
+\ttoken: string;
+\tbaseUrl?: string;
+\tfetch?: typeof fetch;
+}): RestClient {
+\treturn createRestClient({
+\t\tbaseUrl: opts.baseUrl ?? "${inputs.baseUrl}",
+\t\ttoken: opts.token,
+\t\tvendor: "${inputs.vendorName}",
+\t\tfetch: opts.fetch,
+\t});
 }
 `;
 }
 //#endregion
 //#region src/commands/plugin-create/templates/rest-test.ts
 function render$6(inputs) {
-	const clientClass = `${inputs.vendorName}RestClient`;
+	const factoryName = `create${inputs.vendorName}RestClient`;
 	return `import { ProviderApiError } from "@theholocron/cli";
 import { describe, expect, it } from "vitest";
 
-import { ${clientClass} } from "../rest.js";
+import { ${factoryName} } from "../rest.js";
 import { stubFetch } from "./helpers.js";
 
-describe("${clientClass}", () => {
-	it("sends bearer + accept headers and returns the parsed body", async () => {
-		const stub = stubFetch([{ status: 200, body: { ok: true } }]);
-		const client = new ${clientClass}({ token: "t", fetch: stub.fetch });
-		const res = await client.request<{ ok: boolean }>("/me");
-		expect(res.ok).toBe(true);
-		expect(stub.calls[0]?.headers["authorization"]).toBe("Bearer t");
-		expect(stub.calls[0]?.headers["accept"]).toBe("application/json");
-	});
-
-	it("serializes body as JSON and sets content-type when present", async () => {
-		const stub = stubFetch([{ status: 200, body: {} }]);
-		const client = new ${clientClass}({ token: "t", fetch: stub.fetch });
-		await client.request<unknown>("/resource", { method: "POST", body: { name: "demo" } });
-		expect(stub.calls[0]?.method).toBe("POST");
-		expect(stub.calls[0]?.headers["content-type"]).toBe("application/json");
-		expect(stub.calls[0]?.body).toEqual({ name: "demo" });
-	});
-
-	it("returns undefined on 204", async () => {
-		const stub = stubFetch([{ status: 204 }]);
-		const client = new ${clientClass}({ token: "t", fetch: stub.fetch });
-		expect(await client.request<unknown>("/whatever")).toBeUndefined();
-	});
-
-	it("throws ProviderApiError with the HTTP status on non-2xx", async () => {
-		const stub = stubFetch([{ status: 401, body: { messages: ["invalid"] } }]);
-		const client = new ${clientClass}({ token: "bad", fetch: stub.fetch });
-		try {
-			await client.request<unknown>("/me");
-			throw new Error("should have thrown");
-		} catch (err) {
-			expect(err).toBeInstanceOf(ProviderApiError);
-			expect((err as ProviderApiError).status).toBe(401);
-		}
-	});
-
-	it("wraps transport-level failures with status 0", async () => {
-		const throwing: typeof fetch = async () => {
-			throw new TypeError("fetch failed");
-		};
-		const client = new ${clientClass}({ token: "t", fetch: throwing });
-		try {
-			await client.request<unknown>("/me");
-			throw new Error("should have thrown");
-		} catch (err) {
-			expect(err).toBeInstanceOf(ProviderApiError);
-			expect((err as ProviderApiError).status).toBe(0);
-		}
-	});
-
-	it("trims trailing slashes from the base URL", () => {
-		const client = new ${clientClass}({ token: "t", baseUrl: "${inputs.baseUrl}//" });
-		expect(client.baseUrl).toBe("${inputs.baseUrl}");
-	});
+describe("${factoryName}", () => {
+\tit("sends bearer + accept headers and returns the parsed body", async () => {
+\t\tconst stub = stubFetch([{ status: 200, body: { ok: true } }]);
+\t\tconst client = ${factoryName}({ token: "t", fetch: stub.fetch });
+\t\tconst res = await client.request<{ ok: boolean }>("/me");
+\t\texpect(res.ok).toBe(true);
+\t\texpect(stub.calls[0]?.headers["authorization"]).toBe("Bearer t");
+\t\texpect(stub.calls[0]?.headers["accept"]).toBe("application/json");
+\t});
+
+\tit("serializes body as JSON and sets content-type when present", async () => {
+\t\tconst stub = stubFetch([{ status: 200, body: {} }]);
+\t\tconst client = ${factoryName}({ token: "t", fetch: stub.fetch });
+\t\tawait client.request<unknown>("/resource", { method: "POST", body: { name: "demo" } });
+\t\texpect(stub.calls[0]?.method).toBe("POST");
+\t\texpect(stub.calls[0]?.headers["content-type"]).toBe("application/json");
+\t\texpect(stub.calls[0]?.body).toEqual({ name: "demo" });
+\t});
+
+\tit("returns undefined on 204", async () => {
+\t\tconst stub = stubFetch([{ status: 204 }]);
+\t\tconst client = ${factoryName}({ token: "t", fetch: stub.fetch });
+\t\texpect(await client.request<unknown>("/whatever")).toBeUndefined();
+\t});
+
+\tit("throws ProviderApiError with the HTTP status on non-2xx", async () => {
+\t\tconst stub = stubFetch([{ status: 401, body: { messages: ["invalid"] } }]);
+\t\tconst client = ${factoryName}({ token: "bad", fetch: stub.fetch });
+\t\tconst err = await client.request<unknown>("/me").catch((e: unknown) => e);
+\t\texpect(err).toBeInstanceOf(ProviderApiError);
+\t\texpect((err as ProviderApiError).status).toBe(401);
+\t});
+
+\tit("wraps transport-level failures with status 0", async () => {
+\t\tconst throwing: typeof fetch = async () => { throw new TypeError("fetch failed"); };
+\t\tconst client = ${factoryName}({ token: "t", fetch: throwing });
+\t\tconst err = await client.request<unknown>("/me").catch((e: unknown) => e);
+\t\texpect(err).toBeInstanceOf(ProviderApiError);
+\t\texpect((err as ProviderApiError).status).toBe(0);
+\t});
+
+\tit("trims trailing slashes from the base URL", () => {
+\t\tconst client = ${factoryName}({ token: "t", baseUrl: "${inputs.baseUrl}//" });
+\t\texpect(client.baseUrl).toBe("${inputs.baseUrl}");
+\t});
 });
 `;
 }
@@ -2584,13 +2564,11 @@ export default defineConfig({
 *   2. Slug collision — packages/holocron-plugin-<slug>/ must not exist.
 *   3. Capability sanity — must be one of the 14 known keys; warn for
 *      many-cardinality caps.
-*   4. Prompt — fill in any missing flags via cli-utils / inquirer
-*      (Phase B; Phase A takes fully-populated input).
-*   5. Generate — for each template, write to
+*   4. Generate — for each template, write to
 *      packages/holocron-plugin-<slug>/<path>.
-*   6. Verify (unless --no-verify) — Phase B; runs pnpm install +
+*   5. Verify (unless --no-verify) — runs pnpm install +
 *      pnpm --filter <pkg> typecheck lint test.
-*   7. Print next steps.
+*   6. Print next steps.
 */
 var PluginCreateError = class extends Error {
 	name = "PluginCreateError";
@@ -2683,7 +2661,7 @@ function runPluginCreate(input) {
 	const packageDir = path.join(cwd, "packages", `holocron-plugin-${input.slug}`);
 	if (existsSync(packageDir)) throw new PluginCreateError(`\`${packageDir}\` already exists — edit in place or pick a different slug.`);
 	validateCapability(input.capability, print);
-	const derived = deriveDefaults({
+	const derived = deriveDefaults$1({
 		slug: input.slug,
 		vendorName: input.vendorName,
 		capability: input.capability
@@ -2713,6 +2691,51 @@ function runPluginCreate(input) {
 		}
 		filesWritten.push(resolvedPath);
 	}
+	if (!input.dryRun && !input.noVerify) {
+		const execFn = input.exec ?? defaultExec$1;
+		const pkg = `@theholocron/holocron-plugin-${inputs.slug}`;
+		print("");
+		print("  Verifying scaffold…");
+		try {
+			execFn("pnpm", ["install", "--frozen-lockfile=false"], {
+				cwd,
+				stdio: "inherit"
+			});
+			execFn("pnpm", [
+				"--filter",
+				pkg,
+				"typecheck"
+			], {
+				cwd,
+				stdio: "inherit"
+			});
+			execFn("pnpm", [
+				"--filter",
+				pkg,
+				"lint"
+			], {
+				cwd,
+				stdio: "inherit"
+			});
+			execFn("pnpm", [
+				"--filter",
+				pkg,
+				"test"
+			], {
+				cwd,
+				stdio: "inherit"
+			});
+			print("  ✓ scaffold verified");
+		} catch (err) {
+			print(`  ✗ verify failed — ${err instanceof Error ? err.message : String(err)}`);
+			return {
+				status: "fail",
+				packagePath: packageDir,
+				filesWritten,
+				message: "post-scaffold verify failed; inspect output above"
+			};
+		}
+	}
 	if (!input.dryRun) printNextSteps(print, inputs);
 	return {
 		status: "ok",
@@ -2756,6 +2779,12 @@ function defaultWrite(filepath, content) {
 	mkdirSync(path.dirname(filepath), { recursive: true });
 	writeFileSync(filepath, content, "utf8");
 }
+function defaultExec$1(cmd, args, opts) {
+	execFileSync(cmd, args, {
+		cwd: opts.cwd,
+		stdio: opts.stdio
+	});
+}
 function printNextSteps(print, inputs) {
 	print("");
 	print(`  Scaffolded @theholocron/holocron-plugin-${inputs.slug} (18 files).`);
@@ -2836,22 +2865,22 @@ function describeScope(scope) {
 async function runSecretsSync(input) {
 	const print = input.print ?? ((line) => console.log(line));
 	const loader = input.loader ?? new PluginLoader(input.loaded.resolved, input.context);
-	await loader.load();
+	await withSpinner("Loading plugins…", () => loader.load());
 	const dryRun = input.context.dryRun ?? false;
 	const targets = input.targets ?? ["production", "preview"];
-	print(`Holocron secrets sync — environment ${input.environmentId}${dryRun ? " (dry-run)" : ""}`);
-	print(`  vault: ${vaultProviderName(loader)}`);
+	print(style.header(`Holocron secrets sync — environment ${input.environmentId}${dryRun ? " (dry-run)" : ""}`));
+	print(style.dim(`  vault: ${vaultProviderName(loader)}`));
 	print("");
 	const vault = loader.get("vault");
 	if (!vault.readEnvironment) throw new Error(`vault provider (${vault.providerName}) does not implement readEnvironment — sync needs bulk env reads`);
-	const envVars = await vault.readEnvironment(input.environmentId);
+	const envVars = await withSpinner(`Reading vault environment ${input.environmentId}…`, () => vault.readEnvironment(input.environmentId));
 	const keys = Object.keys(envVars).sort();
-	print(`  → read ${keys.length} keys from vault`);
+	print(style.step(`read ${keys.length} keys from vault`));
 	print("");
 	const rows = [];
 	if (loader.has("secrets")) {
 		const secrets = loader.get("secrets");
-		print("  → secrets (repo scope)");
+		print(style.step("secrets (repo scope)"));
 		for (const key of keys) {
 			rows.push(await runRow(`secrets:${secrets.providerName}`, "scope=repo", key, dryRun, async () => {
 				await secrets.setSecret({ kind: "repo" }, key, envVars[key]);
@@ -2862,7 +2891,7 @@ async function runSecretsSync(input) {
 	if (loader.has("deployment")) {
 		const deploy = loader.get("deployment");
 		if (!input.projectId) {
-			print("  → deployment");
+			print(style.step("deployment"));
 			const row = {
 				destination: `deployment:${deploy.providerName}`,
 				scope: "no projectId",
@@ -2873,7 +2902,7 @@ async function runSecretsSync(input) {
 			rows.push(row);
 			print(formatRow(row));
 		} else for (const target of targets) {
-			print(`  → deployment (target=${target})`);
+			print(style.step(`deployment (target=${target})`));
 			for (const key of keys) {
 				rows.push(await runRow(`deployment:${deploy.providerName}`, `target=${target}`, key, dryRun, async () => {
 					await deploy.setEnvVar(input.projectId, target, key, envVars[key]);
@@ -2895,7 +2924,8 @@ async function runSecretsSync(input) {
 		dryRun: 0
 	});
 	print("");
-	print(`  ${summary.ok} ok, ${summary.fail} fail, ${summary.skip} skipped${dryRun ? `, ${summary.dryRun} would-do` : ""}`);
+	const summaryLine = `${summary.ok} ok, ${summary.fail} fail, ${summary.skip} skipped${dryRun ? `, ${summary.dryRun} would-do` : ""}`;
+	print(summary.fail > 0 ? style.fail(summaryLine) : style.success(summaryLine));
 	return {
 		rows,
 		summary
@@ -2927,9 +2957,12 @@ async function runRow(destination, scope, key, dryRun, body) {
 	}
 }
 function formatRow(row) {
-	const icon = row.status === "ok" ? "✓" : row.status === "fail" ? "✗" : row.status === "dry-run" ? "…" : "·";
-	const detail = row.message ? `  (${row.message})` : "";
-	return `    ${icon} ${row.key}${detail}`;
+	const detail = row.message ? style.dim(`  (${row.message})`) : "";
+	const label = `${row.key}${detail}`;
+	if (row.status === "ok") return `    ${style.success(label)}`;
+	if (row.status === "fail") return `    ${style.fail(label)}`;
+	if (row.status === "dry-run") return `    ${style.dim(`… ${label}`)}`;
+	return `    ${style.dim(`· ${label}`)}`;
 }
 function vaultProviderName(loader) {
 	if (!loader.has("vault")) return "<missing>";
@@ -2937,33 +2970,277 @@ function vaultProviderName(loader) {
 }
 //#endregion
 //#region src/commands/setup.ts
-const DEPENDABOT_CONFIG = `\
-# AUTO-GENERATED by holocron — run \`holocron setup\` to regenerate.
-version: 2
-updates:
-  - package-ecosystem: npm
-    directory: /
-    schedule:
-      interval: weekly
-    groups:
-      security-patches:
-        applies-to: security-updates
-        patterns:
-          - "*"
-      all-dependencies:
-        update-types:
-          - minor
-          - patch
-
-  - package-ecosystem: github-actions
-    directory: /
-    schedule:
-      interval: weekly
-    groups:
-      all-actions:
-        patterns:
-          - "*"
-`;
+/**
+* `holocron setup` — orchestrates per-capability setup actions across
+* every plugin loaded from `holocron.config.json`.
+*
+* Per CLAUDE.md soft-skip: each step is wrapped in a try/catch and
+* failures don't abort subsequent capabilities. The summary at the end
+* reports counts so the operator can see what worked + what didn't.
+*
+* Per the Standards: when `ctx.dryRun` is true, mutating calls are
+* replaced with "would" log lines. Read-only probes (e.g.,
+* `vault.list`) still run so the operator sees real state.
+*
+* The orchestrator knows about specific capability methods by name
+* (e.g., `source.enableVulnerabilityAlerts`). This deliberate coupling
+* makes the "what does setup do" contract explicit and concrete —
+* decoupling via a per-capability `setupSteps()` method would be more
+* extensible but pushes the same knowledge into N plugins instead of
+* one central place.
+*/
+function editorconfigContent() {
+	return [
+		workflowHeader("packages/cli/src/commands/setup.ts"),
+		`root = true`,
+		``,
+		`[*]`,
+		`end_of_line = lf`,
+		`charset = utf-8`,
+		`trim_trailing_whitespace = true`,
+		`insert_final_newline = true`,
+		`indent_style = tab`,
+		`indent_size = 4`,
+		``,
+		`[.gitattributes]`,
+		`indent_style = space`,
+		`indent_size = 2`,
+		``,
+		`[*.{json,yml,yaml}]`,
+		`indent_style = space`,
+		`indent_size = 2`,
+		``,
+		`[*.md]`,
+		`trim_trailing_whitespace = false`,
+		`indent_style = space`,
+		`indent_size = 2`,
+		``,
+		`[.*{rc,ignore}]`,
+		`indent_style = space`,
+		`indent_size = 2`,
+		``
+	].join("\n");
+}
+const INDIVIDUAL_COMPONENTS_MARKER = "  individual_components:";
+function codecovComponentBlock(packages) {
+	if (packages.length === 0) return "\n    []\n";
+	return "\n" + packages.flatMap(({ slug }) => [
+		`    - component_id: ${slug}`,
+		`      name: "${slug}"`,
+		`      paths:`,
+		`        - packages/${slug}/**`,
+		``
+	]).join("\n");
+}
+function mergeCodecovComponents(existing, packages) {
+	const idx = existing.indexOf(INDIVIDUAL_COMPONENTS_MARKER);
+	if (idx === -1) return existing;
+	return existing.slice(0, idx + 24) + codecovComponentBlock(packages);
+}
+function codecovContent(packages) {
+	return [
+		workflowHeader("packages/cli/src/commands/setup.ts"),
+		`codecov:`,
+		`  require_ci_to_pass: true`,
+		``,
+		`coverage:`,
+		`  precision: 2`,
+		`  round: down`,
+		`  status:`,
+		`    project:`,
+		`      default:`,
+		`        target: auto`,
+		`        threshold: 2%`,
+		`    patch:`,
+		`      default:`,
+		`        target: 80%`,
+		``,
+		`comment:`,
+		`  layout: "reach,diff,flags,components"`,
+		`  behavior: default`,
+		`  require_changes: true`,
+		``,
+		`component_management:`,
+		`  default_rules:`,
+		`    statuses:`,
+		`      - type: patch`,
+		`        target: 80%`,
+		`  individual_components:`
+	].join("\n") + codecovComponentBlock(packages);
+}
+async function readWorkspacePackages(repoRoot) {
+	const packagesDir = join(repoRoot, "packages");
+	const entries = await readdir(packagesDir, { withFileTypes: true }).catch(() => null);
+	if (!entries) return [];
+	const packages = [];
+	for (const entry of entries) {
+		if (!entry.isDirectory()) continue;
+		try {
+			const raw = await readFile(join(packagesDir, entry.name, "package.json"), "utf8");
+			const pkg = JSON.parse(raw);
+			if (typeof pkg.name === "string") packages.push({
+				slug: entry.name,
+				name: pkg.name
+			});
+		} catch {}
+	}
+	return packages.sort((a, b) => a.slug.localeCompare(b.slug));
+}
+const EDITORCONFIG_CHECKER_CONFIG = JSON.stringify({
+	Version: "v3.7.0",
+	Verbose: false,
+	Format: "",
+	Debug: false,
+	IgnoreDefaults: false,
+	SpacesAfterTabs: false,
+	NoColor: false,
+	Exclude: ["(^|.+/)LICENSE$", "^public/.*"],
+	AllowedContentTypes: [],
+	PassedFiles: [],
+	Disable: {
+		EndOfLine: false,
+		Indentation: false,
+		InsertFinalNewline: false,
+		TrimTrailingWhitespace: false,
+		IndentSize: false,
+		MaxLineLength: false
+	}
+}, null, 2) + "\n";
+const ALEX_CONFIG = JSON.stringify({ allow: [
+	"dead",
+	"failure",
+	"failures",
+	"hook",
+	"hooks",
+	"husky",
+	"period"
+] }, null, 2) + "\n";
+const CANONICAL_LABELS = [
+	{
+		name: "bug",
+		color: "d73a4a",
+		description: "Something isn't working"
+	},
+	{
+		name: "chore",
+		color: "ededed",
+		description: "Maintenance, no user-facing change"
+	},
+	{
+		name: "ci",
+		color: "0075ca",
+		description: "CI/CD pipeline changes"
+	},
+	{
+		name: "dependencies",
+		color: "0366d6",
+		description: "Dependency update"
+	},
+	{
+		name: "documentation",
+		color: "0075ca",
+		description: "Documentation only"
+	},
+	{
+		name: "duplicate",
+		color: "cfd3d7",
+		description: "Already reported"
+	},
+	{
+		name: "enhancement",
+		color: "a2eeef",
+		description: "New feature or request"
+	},
+	{
+		name: "good first issue",
+		color: "7057ff",
+		description: "Good for newcomers"
+	},
+	{
+		name: "help wanted",
+		color: "008672",
+		description: "Extra attention needed"
+	},
+	{
+		name: "invalid",
+		color: "e4e669",
+		description: "Doesn't seem right"
+	},
+	{
+		name: "performance",
+		color: "fbca04",
+		description: "Performance improvement"
+	},
+	{
+		name: "question",
+		color: "d876e3",
+		description: "Further information requested"
+	},
+	{
+		name: "refactor",
+		color: "cfd3d7",
+		description: "Code restructuring"
+	},
+	{
+		name: "released",
+		color: "ededed",
+		description: "Included in a release"
+	},
+	{
+		name: "test",
+		color: "bfd4f2",
+		description: "Test-related changes"
+	},
+	{
+		name: "triage",
+		color: "e4e669",
+		description: "Needs investigation"
+	},
+	{
+		name: "wontfix",
+		color: "ffffff",
+		description: "Won't be addressed"
+	}
+];
+const STALE_LABELS = [
+	"github_actions",
+	"javascript",
+	"autorelease: pending",
+	"autorelease: tagged",
+	"released on @alpha"
+];
+function labelerConfig() {
+	return [
+		workflowHeader("packages/cli/src/commands/setup.ts"),
+		`bug:`,
+		`  - '^fix'`,
+		``,
+		`chore:`,
+		`  - '^chore(?!\\(deps)'`,
+		``,
+		`ci:`,
+		`  - '^ci'`,
+		``,
+		`dependencies:`,
+		`  - '^chore\\(deps'`,
+		``,
+		`documentation:`,
+		`  - '^docs'`,
+		``,
+		`enhancement:`,
+		`  - '^feat'`,
+		``,
+		`performance:`,
+		`  - '^perf'`,
+		``,
+		`refactor:`,
+		`  - '^refactor'`,
+		``,
+		`test:`,
+		`  - '^test'`,
+		``
+	].join("\n");
+}
 const RULESET_NAME = "holocron-default-branch";
 const BALANCED_REPO_SETTINGS = {
 	allow_squash_merge: true,
@@ -3005,7 +3282,7 @@ function buildRulesetPayload(requiredChecks = []) {
 				dismiss_stale_reviews_on_push: false,
 				require_code_owner_review: false,
 				require_last_push_approval: false,
-				required_review_thread_resolution: false
+				required_review_thread_resolution: true
 			}
 		}
 	];
@@ -3020,6 +3297,11 @@ function buildRulesetPayload(requiredChecks = []) {
 		name: RULESET_NAME,
 		target: "branch",
 		enforcement: "active",
+		bypass_actors: [{
+			actor_id: 4,
+			actor_type: "RepositoryRole",
+			bypass_mode: "always"
+		}],
 		conditions: { ref_name: {
 			include: ["~DEFAULT_BRANCH"],
 			exclude: []
@@ -3053,7 +3335,7 @@ async function upsertBranchProtection(source, dryRun, requiredChecks) {
 			message: "created"
 		};
 	} catch (err) {
-		if (!(err instanceof ProviderApiError) || err.status !== 403) return {
+		if (!(err instanceof ProviderApiError$1) || err.status !== 403) return {
 			capability: "source",
 			step,
 			status: "fail",
@@ -3070,7 +3352,7 @@ async function upsertBranchProtection(source, dryRun, requiredChecks) {
 			message: `classic protection on ${repo.defaultBranch}`
 		};
 	} catch (err) {
-		if (err instanceof ProviderApiError && err.status === 403) return {
+		if (err instanceof ProviderApiError$1 && err.status === 403) return {
 			capability: "source",
 			step,
 			status: "skip",
@@ -3087,16 +3369,18 @@ async function upsertBranchProtection(source, dryRun, requiredChecks) {
 async function runSetup(input) {
 	const print = input.print ?? ((line) => console.log(line));
 	const loader = input.loader ?? new PluginLoader(input.loaded.resolved, input.context);
-	await loader.load();
+	await withSpinner("Loading plugins…", () => loader.load());
 	const config = input.loaded.resolved;
 	const dryRun = input.context.dryRun ?? false;
 	const steps = [];
-	print(`Holocron setup — ${config.project.name}${dryRun ? " (dry-run)" : ""}`);
-	print(`  config: ${input.loaded.filepath}`);
+	const repo = config.repo;
+	const effectivePreset = repo?.protection;
+	print(style.header(`Holocron setup — ${config.name}${dryRun ? " (dry-run)" : ""}`));
+	print(style.dim(`  config: ${input.loaded.filepath}`));
 	print("");
 	if (loader.has("source")) {
 		const source = loader.get("source");
-		print("  → source");
+		print(style.step("source"));
 		for (const method of [
 			"enableVulnerabilityAlerts",
 			"enableAutomatedSecurityFixes",
@@ -3109,27 +3393,37 @@ async function runSetup(input) {
 			}));
 			print(formatStep(steps[steps.length - 1]));
 		}
-		steps.push(await runStep("source", "enableCodeScanning", dryRun, async () => {
-			return await source.enableCodeScanning();
+		const usesAdvancedCodeQL = (config.workflows ?? []).map((e) => typeof e === "string" ? e : e.name).includes("codeql");
+		steps.push(await runStep("source", usesAdvancedCodeQL ? "disableDefaultCodeScanning" : "enableCodeScanning", dryRun, async () => {
+			if (usesAdvancedCodeQL) await source.disableDefaultCodeScanning();
+			else return await source.enableCodeScanning();
 		}));
 		print(formatStep(steps[steps.length - 1]));
-		const policy = config.project.repoPolicy;
-		if (policy && policy.preset !== "none") {
-			const preset = policy.preset ?? "balanced";
+		if (effectivePreset && effectivePreset !== "none") {
 			steps.push(await runStep("source", "updateRepoSettings", dryRun, async () => {
 				await source.updateRepoSettings(BALANCED_REPO_SETTINGS);
 			}));
 			print(formatStep(steps[steps.length - 1]));
-			const requiredChecks = preset === "strict" ? policy.requiredChecks ?? [] : [];
+			const configuredWorkflowNames = (config.workflows ?? []).map((entry) => typeof entry === "string" ? entry : entry.name);
+			const requiredChecks = effectivePreset === "strict" ? [
+				"DCO",
+				...configuredWorkflowNames.flatMap((name) => {
+					const ctx = WORKFLOW_CHECK_CONTEXTS[name];
+					return ctx ? [ctx] : [];
+				}),
+				...repo?.requiredChecks ?? []
+			] : [];
 			steps.push(await upsertBranchProtection(source, dryRun, requiredChecks));
 			print(formatStep(steps[steps.length - 1]));
 		}
 	}
-	const workflows = config.project.workflows;
+	const workflows = config.workflows;
 	if (loader.has("source") && workflows && workflows.length > 0) {
 		const source = loader.get("source");
-		print("  → workflows");
-		for (const name of workflows) {
+		print(style.step("workflows"));
+		for (const entry of workflows) {
+			const name = typeof entry === "string" ? entry : entry.name;
+			const withOverrides = typeof entry === "object" ? entry.with : void 0;
 			if (!KNOWN_WORKFLOWS.has(name)) {
 				steps.push({
 					capability: "source",
@@ -3141,21 +3435,113 @@ async function runSetup(input) {
 				continue;
 			}
 			steps.push(await runStep("source", `write workflow ${name}`, dryRun, async () => {
-				await source.writeWorkflowFile(`${name}.yml`, WORKFLOW_HEADER + WORKFLOW_TEMPLATES[name]);
+				await source.writeWorkflowFile(`${name}.yml`, workflowHeader() + generateThinCallerContent(name, withOverrides));
 			}));
 			print(formatStep(steps[steps.length - 1]));
 		}
 	}
-	if (loader.has("source") && config.project.repoPolicy?.preset !== "none") {
+	if (loader.has("source") && (config.workflows ?? []).map((e) => typeof e === "string" ? e : e.name).includes("bookkeeping")) {
+		const source = loader.get("source");
+		steps.push(await runStep("source", "write .github/labeler.yml", dryRun, async () => {
+			await source.writeRepoFile(".github/labeler.yml", labelerConfig());
+		}));
+		print(formatStep(steps[steps.length - 1]));
+	}
+	if (loader.has("source") && effectivePreset !== "none") {
 		const source = loader.get("source");
 		steps.push(await runStep("source", "write .github/dependabot.yml", dryRun, async () => {
-			await source.writeRepoFile(".github/dependabot.yml", DEPENDABOT_CONFIG);
+			await source.writeRepoFile(".github/dependabot.yml", dependabot_default);
 		}));
 		print(formatStep(steps[steps.length - 1]));
 	}
-	if (loader.has("environments")) {
-		const envs = loader.get("environments");
-		print("  → environments");
+	if (loader.has("source")) {
+		const source = loader.get("source");
+		steps.push(await runStep("source", "write .alexrc.json", dryRun, async () => {
+			await source.writeRepoFile(".alexrc.json", ALEX_CONFIG);
+		}));
+		print(formatStep(steps[steps.length - 1]));
+		steps.push(await runStep("source", "write .editorconfig", dryRun, async () => {
+			await source.writeRepoFile(".editorconfig", editorconfigContent());
+		}));
+		print(formatStep(steps[steps.length - 1]));
+		steps.push(await runStep("source", "write .editorconfig-checker.json", dryRun, async () => {
+			await source.writeRepoFile(".editorconfig-checker.json", EDITORCONFIG_CHECKER_CONFIG);
+		}));
+		print(formatStep(steps[steps.length - 1]));
+		{
+			const packages = await readWorkspacePackages(input.context.repoRoot);
+			const existing = await readFile(join(input.context.repoRoot, "codecov.yml"), "utf8").catch(() => null);
+			if (packages.length === 0 && existing == null) steps.push({
+				capability: "source",
+				step: "write codecov.yml",
+				status: "skip",
+				message: "no packages and no existing codecov.yml"
+			});
+			else steps.push(await runStep("source", "write codecov.yml", dryRun, async () => {
+				const content = existing != null ? mergeCodecovComponents(existing, packages) : codecovContent(packages);
+				await source.writeRepoFile("codecov.yml", content);
+				return packages.length > 0 ? `${packages.length} components` : "no components";
+			}));
+			print(formatStep(steps[steps.length - 1]));
+		}
+		if (source.syncLabels) {
+			steps.push(await runStep("source", "sync labels", dryRun, async () => {
+				return source.syncLabels(CANONICAL_LABELS, STALE_LABELS);
+			}));
+			print(formatStep(steps[steps.length - 1]));
+		}
+		const properties = {};
+		if (effectivePreset && effectivePreset !== "none") properties["branch_protection_level"] = effectivePreset;
+		const isMonorepo = await access(join(input.context.repoRoot, "pnpm-workspace.yaml")).then(() => true).catch(() => false);
+		properties["monorepo"] = String(isMonorepo);
+		const manual = repo?.properties ?? {};
+		if (manual.lifecycle) properties["lifecycle"] = manual.lifecycle;
+		if (manual.open_source !== void 0) properties["open_source"] = String(manual.open_source);
+		if (manual.runtime_environment) properties["runtime_environment"] = manual.runtime_environment;
+		if (manual.uses_external_packages !== void 0) properties["uses_external_packages"] = String(manual.uses_external_packages);
+		if (source.syncProperties) {
+			steps.push(await runStep("source", "sync properties", dryRun, () => source.syncProperties(properties)));
+			print(formatStep(steps[steps.length - 1]));
+		}
+		const topics = repo?.topics ?? [];
+		if (topics.length > 0 && source.syncTopics) {
+			steps.push(await runStep("source", "sync topics", dryRun, () => source.syncTopics(topics)));
+			print(formatStep(steps[steps.length - 1]));
+		}
+		const teams = repo?.teams ?? [];
+		if (teams.length > 0) if (source.syncTeams) {
+			steps.push(await runStep("source", "sync teams", dryRun, () => source.syncTeams(teams)));
+			print(formatStep(steps[steps.length - 1]));
+			const repoCoord = input.context.repo ?? repo?.name ?? "";
+			const org = repoCoord.includes("/") ? repoCoord.split("/")[0] : "";
+			const writeableTeams = teams.map((t) => typeof t === "string" ? {
+				slug: t,
+				permission: "push"
+			} : t).filter((t) => [
+				"push",
+				"maintain",
+				"admin"
+			].includes(t.permission));
+			if (org && writeableTeams.length > 0) {
+				steps.push(await runStep("source", "write .github/CODEOWNERS", dryRun, async () => {
+					const content = writeableTeams.map((t) => `* @${org}/${t.slug}`).join("\n") + "\n";
+					await source.writeRepoFile(".github/CODEOWNERS", content);
+				}));
+				print(formatStep(steps[steps.length - 1]));
+			}
+		} else {
+			steps.push({
+				capability: "source",
+				step: "sync teams",
+				status: "skip",
+				message: "provider does not implement syncTeams"
+			});
+			print(formatStep(steps[steps.length - 1]));
+		}
+	}
+	if (loader.has("environments")) {
+		const envs = loader.get("environments");
+		print(style.step("environments"));
 		for (const envName of ["staging", "production"]) {
 			steps.push(await runStep("environments", `upsert ${envName}`, dryRun, async () => {
 				await envs.upsertEnvironment({ name: envName });
@@ -3165,15 +3551,15 @@ async function runSetup(input) {
 	}
 	if (loader.has("deployment")) {
 		const deploy = loader.get("deployment");
-		print("  → deployment");
-		steps.push(await runStep("deployment", `ensureProject ${config.project.name}`, dryRun, async () => {
-			await deploy.ensureProject({ name: config.project.name });
+		print(style.step("deployment"));
+		steps.push(await runStep("deployment", `ensureProject ${config.name}`, dryRun, async () => {
+			await deploy.ensureProject({ name: config.name });
 		}));
 		print(formatStep(steps[steps.length - 1]));
 	}
 	if (loader.has("auth")) {
 		const auth = loader.get("auth");
-		print("  → auth");
+		print(style.step("auth"));
 		if (auth.ensureWebhookApp) {
 			steps.push(await runStep("auth", "ensureWebhookApp", dryRun, async () => {
 				return `webhook ${(await auth.ensureWebhookApp()).alreadyExists ? "exists" : "created"}`;
@@ -3191,10 +3577,10 @@ async function runSetup(input) {
 	}
 	if (loader.has("vault")) {
 		const vault = loader.get("vault");
-		print("  → vault");
+		print(style.step("vault"));
 		if (vault.ensureProject) {
-			steps.push(await runStep("vault", `ensureProject ${config.project.name}`, dryRun, async () => {
-				return `project ${(await vault.ensureProject(config.project.name)).alreadyExists ? "exists" : "created"}`;
+			steps.push(await runStep("vault", `ensureProject ${config.name}`, dryRun, async () => {
+				return `project ${(await vault.ensureProject(config.name)).alreadyExists ? "exists" : "created"}`;
 			}));
 			print(formatStep(steps[steps.length - 1]));
 		}
@@ -3204,7 +3590,7 @@ async function runSetup(input) {
 			"prd"
 		]) {
 			steps.push(await runStep("vault", `ensureEnvironment ${envName}`, dryRun, async () => {
-				return `${envName} ${(await vault.ensureEnvironment(config.project.name, envName)).alreadyExists ? "exists" : "created"}`;
+				return `${envName} ${(await vault.ensureEnvironment(config.name, envName)).alreadyExists ? "exists" : "created"}`;
 			}));
 			print(formatStep(steps[steps.length - 1]));
 		}
@@ -3228,7 +3614,7 @@ async function runSetup(input) {
 	}
 	if (loader.has("tooling")) {
 		const tools = loader.get("tooling");
-		print("  → tooling");
+		print(style.step("tooling"));
 		for (const tool of tools) {
 			steps.push(await runStep("tooling", `${tool.providerName}.sync`, dryRun, async () => {
 				await tool.sync();
@@ -3236,6 +3622,23 @@ async function runSetup(input) {
 			print(formatStep(steps[steps.length - 1]));
 		}
 	}
+	if (config.skills && config.skills.length > 0 && config.agent) {
+		print(style.step("skills"));
+		if (!(config.agent in AGENT_SYMLINK_PATHS)) steps.push({
+			capability: "skills",
+			step: "install skills",
+			status: "skip",
+			message: `agent "${config.agent}" has no known skill install path`
+		});
+		else steps.push(await runStep("skills", "install skills", dryRun, async () => {
+			return await installSkills({
+				agent: config.agent,
+				skills: config.skills,
+				repoRoot: input.context.repoRoot
+			});
+		}));
+		print(formatStep(steps[steps.length - 1]));
+	}
 	const summary = steps.reduce((acc, s) => {
 		if (s.status === "ok") acc.ok += 1;
 		else if (s.status === "fail") acc.fail += 1;
@@ -3249,12 +3652,118 @@ async function runSetup(input) {
 		dryRun: 0
 	});
 	print("");
-	print(`  ${summary.ok} ok, ${summary.fail} fail, ${summary.skip} skipped${dryRun ? `, ${summary.dryRun} would-do` : ""}`);
+	const summaryLine = `  ${summary.ok} ok, ${summary.fail} fail, ${summary.skip} skipped${dryRun ? `, ${summary.dryRun} would-do` : ""}`;
+	print(summary.fail > 0 ? style.fail(summaryLine.trim()) : style.success(summaryLine.trim()));
+	if (steps.some((s) => s.reason === "permissions")) {
+		print("");
+		print(style.warn("Some steps failed with 403 (insufficient token permissions)."));
+		print(style.hint("     These operations require a temporary fine-grained PAT with the"));
+		print(style.hint("     following repository permissions:"));
+		print("");
+		print(style.hint("       · Administration          — read and write"));
+		print(style.hint("       · Code scanning alerts    — read and write"));
+		print(style.hint("       · Contents                — read and write"));
+		print(style.hint("       · Secret scanning alerts  — read and write"));
+		print(style.hint("       · Workflows               — read and write"));
+		print(style.hint("       · Metadata                — read (added automatically)"));
+		print("");
+		print(style.hint("     Create one at: https://github.com/settings/personal-access-tokens/new"));
+		print(style.hint("     Then re-run:   holocron setup --token <your-temp-pat>"));
+		print(style.hint("     You can revoke it immediately after setup completes."));
+	}
 	return {
 		steps,
 		summary
 	};
 }
+const AGENTS_SKILLS_ROOT = ".agents/skills";
+/** Relative path of the agent-specific symlink. undefined = unsupported agent. */
+const AGENT_SYMLINK_PATHS = { claude: (name) => `.claude/skills/${name}` };
+const GITIGNORE_BLOCK_START = "# managed by holocron setup — skills";
+const GITIGNORE_BLOCK_END = "# end managed by holocron setup — skills";
+async function installSkills({ agent, skills, repoRoot }) {
+	const symlinkFn = AGENT_SYMLINK_PATHS[agent];
+	if (!symlinkFn) return `agent "${agent}" has no known skill install path — skipping`;
+	const require = createRequire(pathToFileURL(join(repoRoot, "package.json")));
+	let skillsRoot;
+	try {
+		skillsRoot = dirname(require.resolve("@theholocron/skills/package.json"));
+	} catch {
+		throw new Error("@theholocron/skills not found — run: pnpm add -D @theholocron/skills");
+	}
+	const gitignorePath = join(repoRoot, ".gitignore");
+	const existingContent = await readFile(gitignorePath, "utf8").catch(() => "");
+	const previouslyInstalled = parsePreviousSkills(existingContent, symlinkFn);
+	const currentSet = new Set(skills);
+	const stale = previouslyInstalled.filter((n) => !currentSet.has(n));
+	for (const name of stale) {
+		await rm(join(repoRoot, symlinkFn(name)), { force: true }).catch(() => void 0);
+		await rm(join(repoRoot, AGENTS_SKILLS_ROOT, name), {
+			recursive: true,
+			force: true
+		}).catch(() => void 0);
+	}
+	const installed = [];
+	const missing = [];
+	for (const name of skills) {
+		const srcDir = join(skillsRoot, "skills", name);
+		try {
+			await stat(srcDir);
+		} catch {
+			missing.push(name);
+			continue;
+		}
+		const agentsDir = join(repoRoot, AGENTS_SKILLS_ROOT, name);
+		await copyDirRecursive(srcDir, agentsDir);
+		const symlinkPath = join(repoRoot, symlinkFn(name));
+		await mkdir(dirname(symlinkPath), { recursive: true });
+		try {
+			await unlink(symlinkPath);
+		} catch {}
+		await symlink(relative(dirname(symlinkPath), agentsDir).replace(/\\/g, "/"), symlinkPath);
+		installed.push(name);
+	}
+	if (installed.length > 0 || stale.length > 0 || missing.length > 0) await updateSkillsGitignore(gitignorePath, existingContent, [...installed, ...missing], symlinkFn);
+	const parts = [`installed ${installed.length}`];
+	if (stale.length > 0) parts.push(`pruned: ${stale.join(", ")}`);
+	if (missing.length > 0) parts.push(`unknown: ${missing.join(", ")}`);
+	return parts.join("; ");
+}
+/** Extract skill names from the previous gitignore block so stale dirs can be pruned. */
+function parsePreviousSkills(gitignoreContent, symlinkFn) {
+	if (!gitignoreContent.includes(GITIGNORE_BLOCK_START)) return [];
+	const startIdx = gitignoreContent.indexOf(GITIGNORE_BLOCK_START);
+	const endIdx = gitignoreContent.indexOf(GITIGNORE_BLOCK_END, startIdx);
+	const block = endIdx !== -1 ? gitignoreContent.slice(startIdx, endIdx) : gitignoreContent.slice(startIdx);
+	const placeholder = "__placeholder__";
+	const symlinkPrefix = `/${symlinkFn(placeholder)}`.replace(placeholder, "");
+	return block.split("\n").filter((line) => line.startsWith(symlinkPrefix)).map((line) => line.slice(symlinkPrefix.length));
+}
+async function copyDirRecursive(src, dest) {
+	await mkdir(dest, { recursive: true });
+	const entries = await readdir(src, { withFileTypes: true });
+	for (const entry of entries) {
+		const srcPath = join(src, entry.name);
+		const destPath = join(dest, entry.name);
+		if (entry.isDirectory()) await copyDirRecursive(srcPath, destPath);
+		else await copyFile(srcPath, destPath);
+	}
+}
+async function updateSkillsGitignore(gitignorePath, existingContent, skills, symlinkFn) {
+	const block = [
+		GITIGNORE_BLOCK_START,
+		...[`/${AGENTS_SKILLS_ROOT}/`, ...skills.map((n) => `/${symlinkFn(n)}`)],
+		GITIGNORE_BLOCK_END
+	].join("\n");
+	let content;
+	if (existingContent.includes(GITIGNORE_BLOCK_START)) {
+		const start = existingContent.indexOf(GITIGNORE_BLOCK_START);
+		const end = existingContent.indexOf(GITIGNORE_BLOCK_END, start);
+		const afterBlock = end !== -1 ? existingContent.slice(end + 40) : "\n";
+		content = existingContent.slice(0, start) + block + afterBlock;
+	} else content = (existingContent.trimEnd() ? existingContent.trimEnd() + "\n\n" : "") + block + "\n";
+	await writeFile(gitignorePath, content, "utf8");
+}
 async function runStep(capability, step, dryRun, body) {
 	if (dryRun) return {
 		capability,
@@ -3271,6 +3780,16 @@ async function runStep(capability, step, dryRun, body) {
 		if (typeof note === "string") result.message = note;
 		return result;
 	} catch (err) {
+		if (err instanceof ProviderApiError$1 && err.status === 403) {
+			const reason = classify403(err);
+			return {
+				capability,
+				step,
+				status: "fail",
+				message: err.message,
+				reason
+			};
+		}
 		return {
 			capability,
 			step,
@@ -3279,26 +3798,382 @@ async function runStep(capability, step, dryRun, body) {
 		};
 	}
 }
+function classify403(err) {
+	const detailText = typeof err.details === "string" ? err.details : typeof err.details === "object" && err.details !== null && "message" in err.details ? String(err.details.message) : "";
+	const text = `${err.message} ${detailText}`.toLowerCase();
+	if (text.includes("advanced security") || text.includes("not enabled for this repository") || text.includes("upgrade") || text.includes("not available on")) return "plan";
+	return "permissions";
+}
 function formatStep(step) {
+	const tag = step.reason === "permissions" ? " [permissions]" : step.reason === "plan" ? " [plan restriction]" : "";
+	const detail = step.message ? style.dim(`  (${step.message})`) : "";
+	const label = `${step.step}${tag}${detail}`;
+	if (step.status === "ok") return `    ${style.success(label)}`;
+	if (step.status === "fail") return `    ${style.fail(label)}`;
+	if (step.status === "dry-run") return `    ${style.dim(`… ${label}`)}`;
+	return `    ${style.dim(`· ${label}`)}`;
+}
+//#endregion
+//#region src/commands/skills.ts
+/**
+* `holocron skills` — install, remove, and update agent skills from @theholocron/skills.
+*
+* Unlike `holocron setup`, this command is purely local (no GitHub token
+* required). It reads `agent` and `skills` from the config and installs
+* the listed skills into `.agents/skills/<name>/` with a symlink at the
+* agent-specific path (e.g. `.claude/skills/<name>` for Claude Code).
+*
+* `holocron skills remove [name]` and `holocron skills update [name]` delegate
+* to the corresponding `npx skills` subcommands from the upstream skills CLI.
+*/
+const defaultExec = (cmd, args, opts) => {
+	return { exitCode: spawnSync(cmd, args, {
+		cwd: opts.cwd,
+		stdio: "inherit"
+	}).status ?? -1 };
+};
+async function runSkillsInstall(input) {
+	const print = input.print ?? ((line) => console.log(line));
+	const config = input.loaded.resolved;
+	if (!config.agent || !config.skills?.length) {
+		print("Nothing to install — set `agent` and `skills` in holocron.config.ts");
+		return;
+	}
+	if (input.context.dryRun) {
+		print(`Would install ${config.skills.length} skill(s) for agent: ${config.agent}`);
+		for (const name of config.skills) print(`  → would install: ${name}`);
+		return;
+	}
+	print(`Installing ${config.skills.length} skill(s) for agent: ${config.agent}`);
+	try {
+		print(`  → ${await installSkills({
+			agent: config.agent,
+			skills: config.skills,
+			repoRoot: input.context.repoRoot
+		})}`);
+	} catch (err) {
+		print(`  ✗ ${err instanceof Error ? err.message : String(err)}`);
+	}
+}
+function runSkillsRemove(input) {
+	const { dryRun, repoRoot } = input.context;
+	const exec = input.exec ?? defaultExec;
+	const args = [
+		"skills",
+		"remove",
+		...input.names ?? []
+	];
+	if (dryRun) {
+		console.log(`Would run: npx ${args.join(" ")}`);
+		return { status: "dry-run" };
+	}
+	const { exitCode } = exec("npx", args, { cwd: repoRoot });
+	return { status: exitCode === 0 ? "ok" : "fail" };
+}
+function runSkillsUpdate(input) {
+	const { dryRun, repoRoot } = input.context;
+	const exec = input.exec ?? defaultExec;
+	const args = [
+		"skills",
+		"update",
+		...input.name ? [input.name] : []
+	];
+	if (dryRun) {
+		console.log(`Would run: npx ${args.join(" ")}`);
+		return { status: "dry-run" };
+	}
+	const { exitCode } = exec("npx", args, { cwd: repoRoot });
+	return { status: exitCode === 0 ? "ok" : "fail" };
+}
+//#endregion
+//#region src/commands/sync.ts
+const SYNC_STEPS = [
+	"labels",
+	"properties",
+	"teams",
+	"topics",
+	"keywords",
+	"description"
+];
+const LOCAL_STEPS = /* @__PURE__ */ new Set(["keywords", "description"]);
+async function runSync(input) {
+	const print = input.print ?? ((line) => console.log(line));
+	const loader = input.loader ?? new PluginLoader(input.loaded.resolved, input.context);
+	const config = input.loaded.resolved;
+	const dryRun = input.context.dryRun ?? false;
+	const requestedSteps = input.steps;
+	const steps = [];
+	if (!requestedSteps || requestedSteps.some((s) => !LOCAL_STEPS.has(s))) await loader.load();
+	else try {
+		await loader.load();
+	} catch (err) {
+		if (!(err instanceof AuthError)) throw err;
+	}
+	print(`Holocron sync — ${config.name}${dryRun ? " (dry-run)" : ""}`);
+	print(`  config: ${input.loaded.filepath}`);
+	print("");
+	if (loader.has("source")) {
+		const source = loader.get("source");
+		print("  → source");
+		for (const stepName of SYNC_STEPS) {
+			if (requestedSteps !== void 0 && !requestedSteps.includes(stepName)) continue;
+			if (LOCAL_STEPS.has(stepName)) continue;
+			if (stepName === "labels") if (source.syncLabels) {
+				steps.push(await runSyncStep("source", "sync labels", dryRun, () => source.syncLabels(CANONICAL_LABELS, STALE_LABELS)));
+				print(formatSyncStep(steps[steps.length - 1]));
+			} else {
+				steps.push({
+					capability: "source",
+					step: "sync labels",
+					status: "skip",
+					message: "provider does not implement syncLabels"
+				});
+				print(formatSyncStep(steps[steps.length - 1]));
+			}
+			if (stepName === "properties") if (source.syncProperties) {
+				const repo = config.repo;
+				const properties = {};
+				const effectivePreset = repo?.protection;
+				if (effectivePreset && effectivePreset !== "none") properties["branch_protection_level"] = effectivePreset;
+				const isMonorepo = await access(join(input.context.repoRoot, "pnpm-workspace.yaml")).then(() => true).catch(() => false);
+				properties["monorepo"] = String(isMonorepo);
+				const manual = repo?.properties ?? {};
+				if (manual.lifecycle) properties["lifecycle"] = manual.lifecycle;
+				if (manual.open_source !== void 0) properties["open_source"] = String(manual.open_source);
+				if (manual.runtime_environment) properties["runtime_environment"] = manual.runtime_environment;
+				if (manual.uses_external_packages !== void 0) properties["uses_external_packages"] = String(manual.uses_external_packages);
+				steps.push(await runSyncStep("source", "sync properties", dryRun, () => source.syncProperties(properties)));
+				print(formatSyncStep(steps[steps.length - 1]));
+			} else {
+				steps.push({
+					capability: "source",
+					step: "sync properties",
+					status: "skip",
+					message: "provider does not implement syncProperties"
+				});
+				print(formatSyncStep(steps[steps.length - 1]));
+			}
+			if (stepName === "teams") {
+				const teams = config.repo?.teams ?? [];
+				if (teams.length === 0) {
+					steps.push({
+						capability: "source",
+						step: "sync teams",
+						status: "skip",
+						message: "no teams configured"
+					});
+					print(formatSyncStep(steps[steps.length - 1]));
+				} else if (source.syncTeams) {
+					steps.push(await runSyncStep("source", "sync teams", dryRun, () => source.syncTeams(teams)));
+					print(formatSyncStep(steps[steps.length - 1]));
+					const repoCoord = input.context.repo ?? config.repo?.name ?? "";
+					const org = repoCoord.includes("/") ? repoCoord.split("/")[0] : "";
+					const writeableTeams = teams.map((t) => typeof t === "string" ? {
+						slug: t,
+						permission: "push"
+					} : t).filter((t) => [
+						"push",
+						"maintain",
+						"admin"
+					].includes(t.permission));
+					if (org && writeableTeams.length > 0) {
+						steps.push(await runSyncStep("source", "write .github/CODEOWNERS", dryRun, async () => {
+							const content = writeableTeams.map((t) => `* @${org}/${t.slug}`).join("\n") + "\n";
+							await source.writeRepoFile(".github/CODEOWNERS", content);
+						}));
+						print(formatSyncStep(steps[steps.length - 1]));
+					}
+				} else {
+					steps.push({
+						capability: "source",
+						step: "sync teams",
+						status: "skip",
+						message: "provider does not implement syncTeams"
+					});
+					print(formatSyncStep(steps[steps.length - 1]));
+				}
+			}
+			if (stepName === "topics") {
+				const topics = config.repo?.topics ?? [];
+				if (topics.length === 0) {
+					steps.push({
+						capability: "source",
+						step: "sync topics",
+						status: "skip",
+						message: "no topics configured"
+					});
+					print(formatSyncStep(steps[steps.length - 1]));
+				} else if (source.syncTopics) {
+					steps.push(await runSyncStep("source", "sync topics", dryRun, () => source.syncTopics(topics)));
+					print(formatSyncStep(steps[steps.length - 1]));
+				} else {
+					steps.push({
+						capability: "source",
+						step: "sync topics",
+						status: "skip",
+						message: "provider does not implement syncTopics"
+					});
+					print(formatSyncStep(steps[steps.length - 1]));
+				}
+			}
+		}
+		if (requestedSteps) {
+			for (const name of requestedSteps) if (!SYNC_STEPS.includes(name)) {
+				steps.push({
+					capability: "source",
+					step: `sync ${name}`,
+					status: "skip",
+					message: `unknown step "${name}"`
+				});
+				print(formatSyncStep(steps[steps.length - 1]));
+			}
+		}
+	}
+	for (const stepName of ["keywords", "description"]) {
+		if (requestedSteps !== void 0 && !requestedSteps.includes(stepName)) continue;
+		if (stepName === "keywords") {
+			const topics = config.repo?.topics ?? [];
+			if (topics.length === 0) {
+				steps.push({
+					capability: "local",
+					step: "sync keywords",
+					status: "skip",
+					message: "no topics configured"
+				});
+				print(formatSyncStep(steps[steps.length - 1]));
+			} else {
+				steps.push(await runSyncStep("local", "sync keywords", dryRun, async () => {
+					return await writePackageJsonField(input.context.repoRoot, "keywords", topics) ? `${topics.length} keywords written` : `${topics.length} topics (no package.json)`;
+				}));
+				print(formatSyncStep(steps[steps.length - 1]));
+			}
+		}
+		if (stepName === "description") {
+			const description = config.description;
+			if (!description) {
+				steps.push({
+					capability: "local",
+					step: "sync description",
+					status: "skip",
+					message: "no description configured"
+				});
+				print(formatSyncStep(steps[steps.length - 1]));
+			} else {
+				const source = loader.has("source") ? loader.get("source") : null;
+				steps.push(await runSyncStep("local", "sync description", dryRun, async () => {
+					const pkgWrote = await writePackageJsonField(input.context.repoRoot, "description", description);
+					const readmeWrote = await updateReadmeDescription(input.context.repoRoot, description);
+					if (source?.syncDescription) await source.syncDescription(description);
+					const parts = [];
+					if (pkgWrote) parts.push("package.json");
+					if (readmeWrote) parts.push("README.md");
+					if (source?.syncDescription) parts.push("GitHub");
+					return parts.length > 0 ? parts.join(", ") + " updated" : "description synced";
+				}));
+				print(formatSyncStep(steps[steps.length - 1]));
+			}
+		}
+	}
+	const summary = steps.reduce((acc, s) => {
+		if (s.status === "ok") acc.ok += 1;
+		else if (s.status === "fail") acc.fail += 1;
+		else if (s.status === "skip") acc.skip += 1;
+		else if (s.status === "dry-run") acc.dryRun += 1;
+		return acc;
+	}, {
+		ok: 0,
+		fail: 0,
+		skip: 0,
+		dryRun: 0
+	});
+	print("");
+	print(`  ${summary.ok} ok, ${summary.fail} fail, ${summary.skip} skipped${dryRun ? `, ${summary.dryRun} would-do` : ""}`);
+	return {
+		steps,
+		summary
+	};
+}
+async function runSyncStep(capability, step, dryRun, body) {
+	if (dryRun) return {
+		capability,
+		step,
+		status: "dry-run"
+	};
+	try {
+		const note = await body();
+		const result = {
+			capability,
+			step,
+			status: "ok"
+		};
+		if (typeof note === "string") result.message = note;
+		return result;
+	} catch (err) {
+		return {
+			capability,
+			step,
+			status: "fail",
+			message: err instanceof Error ? err.message : String(err)
+		};
+	}
+}
+function formatSyncStep(step) {
 	const icon = step.status === "ok" ? "✓" : step.status === "fail" ? "✗" : step.status === "dry-run" ? "…" : "·";
 	const detail = step.message ? `  (${step.message})` : "";
 	return `    ${icon} ${step.step}${detail}`;
 }
+async function writePackageJsonField(repoRoot, field, value) {
+	const pkgPath = join(repoRoot, "package.json");
+	let content;
+	try {
+		content = await readFile(pkgPath, "utf8");
+	} catch {
+		return false;
+	}
+	const pkg = JSON.parse(content);
+	pkg[field] = value;
+	await writeFile(pkgPath, JSON.stringify(pkg, null, 2) + "\n", "utf8");
+	return true;
+}
+const README_DESC_START = "<!-- holocron:description -->";
+const README_DESC_END = "<!-- /holocron:description -->";
+async function updateReadmeDescription(repoRoot, description) {
+	const readmePath = join(repoRoot, "README.md");
+	let content;
+	try {
+		content = await readFile(readmePath, "utf8");
+	} catch {
+		return false;
+	}
+	const lines = content.split("\n");
+	const startIdx = lines.findIndex((l) => l.trim() === README_DESC_START);
+	const endIdx = lines.findIndex((l) => l.trim() === README_DESC_END);
+	if (startIdx !== -1) {
+		if (endIdx === -1 || endIdx <= startIdx) return false;
+		lines.splice(startIdx + 1, endIdx - startIdx - 1, description);
+		await writeFile(readmePath, lines.join("\n"), "utf8");
+		return true;
+	}
+	const h1Index = lines.findIndex((l) => /^# /.test(l));
+	if (h1Index === -1) return false;
+	lines.splice(h1Index + 1, 0, "", README_DESC_START, description, README_DESC_END);
+	await writeFile(readmePath, lines.join("\n"), "utf8");
+	return true;
+}
 //#endregion
 //#region src/load-config.ts
 /**
 * `holocron.config.{json,js,ts}` file loader.
 *
-* v2.0 only documents the JSON form, but the loader looks up all three
-* extensions in priority order (json → js → ts) — that's the schema
-* commitment captured in [`.notes/tech-architecture.spec.md` → Roadmap
-* → Shareable configs] so the JS/TS preset story (issue #75) can land
-* later without a breaking change.
+* Search order: json → js → ts. JSON is parsed directly; JS is loaded
+* via native dynamic import; TS is loaded via `tsImport` from tsx (a
+* runtime dep) so operators can write typed configs with `defineConfig`
+* without needing a separate build step.
 *
-* The JS/TS forms aren't actually parsed today; they trigger a clear
-* error telling the operator to use JSON for v2.0. The contract is the
-* lookup order, not the interpretation.
+* All three forms are validated through the same `resolveConfig` path.
+* Implements the lookup-order contract from issue #75 / #81.
 */
+const execFileAsync = promisify(execFile);
 const CANDIDATE_FILENAMES = [
 	"holocron.config.json",
 	"holocron.config.js",
@@ -3310,7 +4185,7 @@ var ConfigFileError = class extends Error {
 /**
 * Read + parse + resolve `holocron.config.*` from the given directory.
 * Search order: json → js → ts. Throws `ConfigFileError` if nothing
-* found, or `ConfigError` if the JSON is malformed / invalid.
+* found, or `ConfigError` if the config is malformed / invalid.
 */
 async function loadConfig(cwd) {
 	for (const filename of CANDIDATE_FILENAMES) {
@@ -3320,7 +4195,14 @@ async function loadConfig(cwd) {
 				resolved: await loadJson(fullPath),
 				filepath: fullPath
 			};
-			throw new ConfigFileError(`${filename} found, but v2.0 only supports the JSON form. Rename to holocron.config.json. The JS/TS form lands with the preset feature (see issue #75).`);
+			if (filename.endsWith(".ts")) return {
+				resolved: await loadTs(fullPath),
+				filepath: fullPath
+			};
+			return {
+				resolved: await loadJs(fullPath),
+				filepath: fullPath
+			};
 		}
 	}
 	throw new ConfigFileError(`no holocron.config.{json,js,ts} found in ${cwd}. Create one — see the README for the schema.`);
@@ -3333,7 +4215,61 @@ async function loadJson(filepath) {
 	} catch (err) {
 		throw new ConfigError(`${filepath} is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
 	}
-	return resolveConfig(parsed);
+	return resolveConfig(await deriveDefaults(dirname(filepath), parsed));
+}
+async function loadJs(filepath) {
+	const mod = await import(pathToFileURL(filepath).href);
+	return resolveConfig(await deriveDefaults(dirname(filepath), extractRaw(filepath, mod)));
+}
+async function loadTs(filepath) {
+	const { tsImport } = await import("tsx/esm/api");
+	const mod = await tsImport(pathToFileURL(filepath).href, import.meta.url);
+	return resolveConfig(await deriveDefaults(dirname(filepath), extractRaw(filepath, mod)));
+}
+function extractRaw(filepath, mod) {
+	const outer = mod.default;
+	const raw = outer?.__esModule === true ? outer.default : outer;
+	if (raw === void 0 || raw === null) throw new ConfigFileError(`${filepath} must have a default export (use \`export default defineConfig({…})\`)`);
+	return raw;
+}
+async function deriveDefaults(configDir, raw) {
+	const result = { ...raw };
+	if (!result.name) result.name = await readPackageJsonName(configDir) ?? basename(configDir);
+	if (result.repo && !result.repo.name) {
+		const repoName = await readGitRemote(configDir);
+		if (repoName) result.repo = {
+			...result.repo,
+			name: repoName
+		};
+	}
+	return result;
+}
+async function readPackageJsonName(dir) {
+	try {
+		const content = await readFile(join(dir, "package.json"), "utf8");
+		const pkg = JSON.parse(content);
+		return typeof pkg.name === "string" ? pkg.name.replace(/^@[^/]+\//, "") : void 0;
+	} catch {
+		return;
+	}
+}
+async function readGitRemote(dir) {
+	try {
+		const { stdout } = await execFileAsync("git", [
+			"remote",
+			"get-url",
+			"origin"
+		], { cwd: dir });
+		return parseGitRemoteUrl(stdout.trim());
+	} catch {
+		return;
+	}
+}
+function parseGitRemoteUrl(url) {
+	const httpsMatch = url.match(/github\.com\/([^/]+\/[^/]+?)(?:\.git)?$/);
+	if (httpsMatch) return httpsMatch[1];
+	const sshMatch = url.match(/github\.com:([^/]+\/[^/]+?)(?:\.git)?$/);
+	if (sshMatch) return sshMatch[1];
 }
 async function fileExists(path) {
 	try {
@@ -3343,15 +4279,181 @@ async function fileExists(path) {
 	}
 }
 //#endregion
+//#region src/token-args.ts
+var TokenParseError = class extends Error {
+	name = "TokenParseError";
+};
+/**
+* Converts raw --token CLI values into a typed result.
+*
+* Bare form:   --token ghp_xxx            → { cliToken: "ghp_xxx" }
+* Keyed form:  --token github=ghp_xxx     → { cliTokens: { github: "ghp_xxx" } }
+* Mixed:       --token github=ghp_xxx --token v_yyy
+*                                         → { cliToken: "v_yyy", cliTokens: { github: "ghp_xxx" } }
+*
+* Values may contain "=" (e.g. base64 strings) — only the first "=" is treated as a separator.
+*/
+function parseTokenArgs(tokens) {
+	if (tokens.length === 0) return {};
+	const cliTokens = {};
+	const bare = [];
+	for (const raw of tokens) {
+		const eqIdx = raw.indexOf("=");
+		if (eqIdx === -1) {
+			bare.push(raw);
+			continue;
+		}
+		const vendor = raw.slice(0, eqIdx);
+		const value = raw.slice(eqIdx + 1);
+		if (vendor.trim() === "") throw new TokenParseError(`invalid --token value "${raw}": vendor name must not be empty`);
+		if (/\s/.test(vendor)) throw new TokenParseError(`invalid --token value "${raw}": vendor name must not contain whitespace`);
+		if (value === "") throw new TokenParseError(`invalid --token value "${raw}": token value must not be empty`);
+		cliTokens[vendor] = value;
+	}
+	if (bare.length > 1) throw new TokenParseError(`only one bare --token value is allowed; got ${bare.length.toString()} — use vendor=value form for multiple tokens`);
+	const result = {};
+	if (bare.length === 1) result.cliToken = bare[0];
+	if (Object.keys(cliTokens).length > 0) result.cliTokens = cliTokens;
+	return result;
+}
+//#endregion
+//#region src/update-notifier.ts
+const PACKAGE_NAME = "@theholocron/cli";
+const CACHE_TTL_MS = 1440 * 60 * 1e3;
+const FETCH_TIMEOUT_MS = 3e3;
+function getCacheDir() {
+	return process.env["HOLOCRON_CACHE_DIR"] ?? join(homedir(), ".cache", "holocron");
+}
+function getCachePath() {
+	return join(getCacheDir(), "update-check.json");
+}
+function readCache() {
+	try {
+		return JSON.parse(readFileSync(getCachePath(), "utf8"));
+	} catch {
+		return null;
+	}
+}
+function writeCache(entry) {
+	try {
+		mkdirSync(getCacheDir(), { recursive: true });
+		writeFileSync(getCachePath(), JSON.stringify(entry));
+	} catch {}
+}
+async function fetchLatestVersion(channel) {
+	try {
+		const res = await fetch(`https://registry.npmjs.org/${encodeURIComponent(PACKAGE_NAME)}`, { signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });
+		if (!res.ok) return null;
+		const data = await res.json();
+		return data["dist-tags"][channel] ?? data["dist-tags"]["latest"] ?? null;
+	} catch {
+		return null;
+	}
+}
+function getChannel(version) {
+	return /^[^-]+-([a-zA-Z]+)/.exec(version)?.[1] ?? "latest";
+}
+function isUpdateAvailable(current, latest) {
+	const normalize = (v) => v.replace(/^v/, "");
+	const c = normalize(current);
+	const l = normalize(latest);
+	if (c === l) return false;
+	const splitPre = (v) => {
+		const idx = v.indexOf("-");
+		return idx === -1 ? [v, ""] : [v.slice(0, idx), v.slice(idx + 1)];
+	};
+	const [cRelease, cPre] = splitPre(c);
+	const [lRelease, lPre] = splitPre(l);
+	const parseRelease = (r) => r.split(".").map(Number);
+	const cParts = parseRelease(cRelease);
+	const lParts = parseRelease(lRelease);
+	for (let i = 0; i < Math.max(cParts.length, lParts.length); i++) {
+		const cv = cParts[i] ?? 0;
+		const lv = lParts[i] ?? 0;
+		if (lv > cv) return true;
+		if (lv < cv) return false;
+	}
+	if (!lPre && cPre) return true;
+	if (lPre && !cPre) return false;
+	const cPreParts = cPre.split(".");
+	const lPreParts = lPre.split(".");
+	for (let i = 0; i < Math.max(cPreParts.length, lPreParts.length); i++) {
+		const cv = cPreParts[i] ?? "";
+		const lv = lPreParts[i] ?? "";
+		const cvNum = Number(cv);
+		const lvNum = Number(lv);
+		if (!isNaN(cvNum) && !isNaN(lvNum)) {
+			if (lvNum > cvNum) return true;
+			if (lvNum < cvNum) return false;
+		} else {
+			if (lv > cv) return true;
+			if (lv < cv) return false;
+		}
+	}
+	return false;
+}
+function formatNotice(current, latest) {
+	const installCmd = `npm install -g ${PACKAGE_NAME}`;
+	const raw1 = `Update available: ${current} → ${latest}`;
+	const raw2 = `Run ${installCmd} to update`;
+	const width = Math.max(raw1.length, raw2.length) + 4;
+	const bar = chalk.yellow("─".repeat(width));
+	const border = chalk.yellow("│");
+	const pad = (raw, styled) => `${border} ${styled}${" ".repeat(width - 2 - raw.length)} ${border}`;
+	return [
+		"",
+		chalk.yellow(`╭${bar}╮`),
+		pad(raw1, `Update available: ${chalk.dim(current)} → ${chalk.green(latest)}`),
+		pad(raw2, `Run ${chalk.cyan(installCmd)} to update`),
+		chalk.yellow(`╰${bar}╯`),
+		""
+	].join("\n");
+}
+async function checkForUpdates(currentVersion) {
+	if (process.env["CI"] || process.env["NO_UPDATE_NOTIFIER"]) return null;
+	const channel = getChannel(currentVersion);
+	const cache = readCache();
+	const now = Date.now();
+	let latestVersion = null;
+	if (cache && now - cache.checkedAt < CACHE_TTL_MS) latestVersion = cache.latestVersion;
+	else {
+		latestVersion = await fetchLatestVersion(channel);
+		if (latestVersion) writeCache({
+			latestVersion,
+			checkedAt: now
+		});
+	}
+	if (!latestVersion || !isUpdateAvailable(currentVersion, latestVersion)) return null;
+	return () => {
+		process.stderr.write(formatNotice(currentVersion, latestVersion) + "\n");
+	};
+}
+//#endregion
 //#region src/cli.ts
 const { version: CLI_VERSION } = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf-8"));
+/** Parses --token values and returns the context spread, or null on parse error (exits with code 1). */
+function tokenContext(rawTokens) {
+	if (!rawTokens?.length) return {};
+	try {
+		return parseTokenArgs(rawTokens);
+	} catch (err) {
+		if (err instanceof TokenParseError) {
+			console.error(`--token: ${err.message}`);
+			process.exitCode = 1;
+			return null;
+		}
+		throw err;
+	}
+}
+const updateCheckPromise = checkForUpdates(CLI_VERSION);
 await yargs(hideBin(process.argv)).scriptName("holocron").usage("$0 <command> [options]").option("dry-run", {
 	type: "boolean",
 	default: false,
 	describe: "Print what would be mutated without calling capability mutators. Commands branch on this; read-only commands ignore it."
 }).option("token", {
 	type: "string",
-	describe: "Vendor token passed to plugins as `cliToken`, taking precedence over env vars. Unambiguous for single-plugin commands; for multi-plugin flows pass per-vendor env vars instead."
+	array: true,
+	describe: "Vendor token override for plugins. Bare form: --token <value> (fallback for all plugins, single-plugin commands). Keyed form: --token vendor=value (targets a specific provider; repeat for each). Example: --token github=ghp_xxx --token vercel=v_yyy"
 }).option("cwd", {
 	type: "string",
 	default: process.cwd(),
@@ -3362,29 +4464,64 @@ await yargs(hideBin(process.argv)).scriptName("holocron").usage("$0 <command> [o
 	type: "string",
 	describe: "Repo coords (\"owner/name\"). Defaults to plugin-specific resolution."
 }), async (argv) => {
+	const tokens = tokenContext(argv.token);
+	if (!tokens) return;
 	if ((await runDoctor({
 		loaded: await loadConfig(argv.cwd),
 		context: {
 			repoRoot: argv.cwd,
 			dryRun: argv.dryRun,
 			...argv.repo ? { repo: argv.repo } : {},
-			...argv.token ? { cliToken: argv.token } : {}
+			...tokens
 		}
 	})).summary.fail > 0) process.exitCode = 1;
 }).command("setup", "Apply infra setup actions across every configured capability", (y) => y.option("repo", {
 	type: "string",
 	describe: "Repo coords (\"owner/name\"). Defaults to plugin-specific resolution."
 }), async (argv) => {
+	const tokens = tokenContext(argv.token);
+	if (!tokens) return;
 	if ((await runSetup({
 		loaded: await loadConfig(argv.cwd),
 		context: {
 			repoRoot: argv.cwd,
 			dryRun: argv.dryRun,
 			...argv.repo ? { repo: argv.repo } : {},
-			...argv.token ? { cliToken: argv.token } : {}
+			...tokens
 		}
 	})).summary.fail > 0) process.exitCode = 1;
-}).command("secret set <name> [value]", "Set a single secret via the configured `secrets` capability", (y) => y.positional("name", {
+}).command("skills", "Manage agent skills from the @theholocron/skills registry", (y) => y.command("install", "Copy skills from @theholocron/skills into .agents/ with agent symlinks", () => {}, async (argv) => {
+	await runSkillsInstall({
+		loaded: await loadConfig(argv.cwd),
+		context: {
+			repoRoot: argv.cwd,
+			dryRun: argv.dryRun
+		}
+	});
+}).command("remove [names..]", "Remove installed skills via npx skills remove", (yy) => yy.positional("names", {
+	type: "string",
+	array: true,
+	describe: "Skill name(s) to remove (omit to remove all installed skills)"
+}), (argv) => {
+	if (runSkillsRemove({
+		context: {
+			repoRoot: argv.cwd,
+			dryRun: argv.dryRun
+		},
+		...argv.names?.length ? { names: argv.names } : {}
+	}).status === "fail") process.exitCode = 1;
+}).command("update [name]", "Update installed skills to their latest upstream versions via npx skills update", (yy) => yy.positional("name", {
+	type: "string",
+	describe: "Skill name to update (omit to update all installed skills)"
+}), (argv) => {
+	if (runSkillsUpdate({
+		context: {
+			repoRoot: argv.cwd,
+			dryRun: argv.dryRun
+		},
+		...argv.name ? { name: argv.name } : {}
+	}).status === "fail") process.exitCode = 1;
+}).demandCommand(1, "Run `holocron skills --help` to see available skills subcommands."), () => {}).command("secret set <name> [value]", "Set a single secret via the configured `secrets` capability", (y) => y.positional("name", {
 	type: "string",
 	demandOption: true,
 	describe: "Secret name (e.g., NPM_TOKEN)"
@@ -3403,6 +4540,8 @@ await yargs(hideBin(process.argv)).scriptName("holocron").usage("$0 <command> [o
 	default: "repo",
 	describe: "Scope: \"repo\" (default), \"env=<name>\", or \"org=<name>\""
 }), async (argv) => {
+	const tokens = tokenContext(argv.token);
+	if (!tokens) return;
 	const scopeArg = argv.scope;
 	const scope = parseScope(scopeArg);
 	if ((await runSecretSet({
@@ -3410,7 +4549,7 @@ await yargs(hideBin(process.argv)).scriptName("holocron").usage("$0 <command> [o
 		context: {
 			repoRoot: argv.cwd,
 			dryRun: argv.dryRun,
-			...argv.token ? { cliToken: argv.token } : {}
+			...tokens
 		},
 		name: argv.name,
 		...argv.value ? { value: argv.value } : {},
@@ -3430,12 +4569,14 @@ await yargs(hideBin(process.argv)).scriptName("holocron").usage("$0 <command> [o
 	default: ["production", "preview"],
 	describe: "Deployment targets to sync to. Defaults to production + preview."
 }), async (argv) => {
+	const tokens = tokenContext(argv.token);
+	if (!tokens) return;
 	if ((await runSecretsSync({
 		loaded: await loadConfig(argv.cwd),
 		context: {
 			repoRoot: argv.cwd,
 			dryRun: argv.dryRun,
-			...argv.token ? { cliToken: argv.token } : {}
+			...tokens
 		},
 		environmentId: argv.environmentId,
 		...argv.projectId ? { projectId: argv.projectId } : {},
@@ -3454,12 +4595,14 @@ await yargs(hideBin(process.argv)).scriptName("holocron").usage("$0 <command> [o
 	choices: ["production", "staging"],
 	describe: "Named environment to deploy into. Omit for a branch preview."
 }), async (argv) => {
+	const tokens = tokenContext(argv.token);
+	if (!tokens) return;
 	if ((await runDeploy({
 		loaded: await loadConfig(argv.cwd),
 		context: {
 			repoRoot: argv.cwd,
 			dryRun: argv.dryRun,
-			...argv.token ? { cliToken: argv.token } : {}
+			...tokens
 		},
 		projectId: argv.projectId,
 		branch: argv.branch,
@@ -3489,15 +4632,48 @@ await yargs(hideBin(process.argv)).scriptName("holocron").usage("$0 <command> [o
 		dryRun: argv.dryRun,
 		...argv.otp ? { otp: argv.otp } : {}
 	})).status === "fail") process.exitCode = 1;
-}).demandCommand(1, "Run `holocron npm --help` to see available npm subcommands."), () => {}).command("sync-github", "Sync workflow templates and composite actions to theholocron/.github via the GitHub API", (y) => y.option("repo", {
+}).demandCommand(1, "Run `holocron npm --help` to see available npm subcommands."), () => {}).command("sync [steps..]", "Sync state from config to the provider and local files (labels, properties, topics, keywords, description)", (y) => y.positional("steps", {
+	type: "string",
+	array: true,
+	describe: "Steps to run: labels, properties, topics, keywords, description (default: all)"
+}).option("repo", {
+	type: "string",
+	describe: "Repo coords (\"owner/name\"). Defaults to plugin-specific resolution."
+}), async (argv) => {
+	const tokens = tokenContext(argv.token);
+	if (!tokens) return;
+	if ((await runSync({
+		loaded: await loadConfig(argv.cwd),
+		context: {
+			repoRoot: argv.cwd,
+			dryRun: argv.dryRun,
+			...argv.repo ? { repo: argv.repo } : {},
+			...tokens
+		},
+		...argv.steps && argv.steps.length > 0 ? { steps: argv.steps } : {}
+	})).summary.fail > 0) process.exitCode = 1;
+}).command("sync-github", "Sync workflow templates and composite actions to theholocron/.github via the GitHub API", (y) => y.option("repo", {
 	type: "string",
 	default: "theholocron/.github",
 	describe: "Target org/repo (default: theholocron/.github)"
+}).option("branch", {
+	type: "string",
+	describe: "Push to this branch instead of the default branch (enables PR-based workflow for protected repos)"
+}).option("pr", {
+	type: "boolean",
+	default: false,
+	describe: "Open a PR after pushing to --branch (no-op without --branch)"
 }).option("message", {
 	type: "string",
 	describe: "Commit message (default: chore: sync from theholocron/holocron)"
+}).option("output-dir", {
+	type: "string",
+	describe: "Write generated files to this local directory instead of pushing (for validation)"
 }), async (argv) => {
-	const token = argv.token ?? process.env.GITHUB_TOKEN ?? process.env.HOLOCRON_GITHUB_TOKEN;
+	const outputDir = argv["output-dir"];
+	const parsed = tokenContext(argv.token);
+	if (!parsed) return;
+	const token = outputDir ? "no-token-needed" : parsed.cliTokens?.["github"] ?? parsed.cliToken ?? process.env.GITHUB_TOKEN ?? process.env.HOLOCRON_GITHUB_TOKEN;
 	if (!token) {
 		console.error("sync-github: GitHub token required — pass --token or set GITHUB_TOKEN");
 		process.exitCode = 1;
@@ -3507,11 +4683,80 @@ await yargs(hideBin(process.argv)).scriptName("holocron").usage("$0 <command> [o
 		token,
 		repo: argv.repo,
 		dryRun: argv.dryRun,
-		...argv.message ? { message: argv.message } : {}
+		...argv.branch ? { branch: argv.branch } : {},
+		...argv.pr ? { createPr: true } : {},
+		...argv.message ? { message: argv.message } : {},
+		...outputDir ? { outputDir } : {}
 	})).status === "fail") process.exitCode = 1;
 }).command("config show", "Print the resolved holocron config", () => {}, async (argv) => {
 	const loaded = await loadConfig(argv.cwd);
 	console.log(JSON.stringify(loaded.resolved, null, 2));
+}).command("new [type] [name]", "Scaffold a new repo from a GitHub template (e.g. cli, react, nextjs, node, monorepo, base)", (y) => y.positional("type", {
+	type: "string",
+	describe: "Template type — maps to theholocron/<type>-template (e.g. cli, react, nextjs, node, monorepo, base)"
+}).positional("name", {
+	type: "string",
+	describe: "New repo name (kebab-case, e.g. my-tool)"
+}).option("description", {
+	type: "string",
+	describe: "Short description — replaces <description> placeholders in the template"
+}).option("org", {
+	type: "string",
+	default: "theholocron",
+	describe: "GitHub org that owns the template and will own the new repo"
+}).option("verify", {
+	type: "boolean",
+	default: true,
+	describe: "Run pnpm install after bootstrapping (default true; --no-verify skips)"
+}), async (argv) => {
+	try {
+		let type = argv.type;
+		let name = argv.name;
+		let description = argv.description;
+		if (!type || !name || description === void 0) {
+			const rl = createInterface({
+				input: stdin,
+				output: stdout
+			});
+			const ask = (question) => new Promise((resolve) => rl.question(`  ${question} `, (answer) => resolve(answer.trim())));
+			try {
+				if (!type) {
+					console.log("  Known types: base, cli, monorepo, nextjs, node, react");
+					type = await ask("Template type:");
+				}
+				if (!name) name = await ask("Repo name (kebab-case):");
+				if (description === void 0) description = await ask("Short description (Enter to skip):");
+			} finally {
+				rl.close();
+			}
+		}
+		if (!type) {
+			console.error("new: template type is required");
+			process.exitCode = 1;
+			return;
+		}
+		if (!name) {
+			console.error("new: repo name is required");
+			process.exitCode = 1;
+			return;
+		}
+		if ((await runNew({
+			type,
+			name,
+			...description ? { description } : {},
+			org: argv.org,
+			dryRun: argv.dryRun,
+			noVerify: !argv.verify,
+			cwd: argv.cwd
+		})).status === "fail") process.exitCode = 1;
+	} catch (err) {
+		if (err instanceof NewError) {
+			console.error(`new: ${err.message}`);
+			process.exitCode = 1;
+			return;
+		}
+		throw err;
+	}
 }).command("plugin create <slug> <vendor>", "Scaffold a new @theholocron/holocron-plugin-<slug> package", (y) => y.positional("slug", {
 	type: "string",
 	demandOption: true,
@@ -3536,15 +4781,40 @@ await yargs(hideBin(process.argv)).scriptName("holocron").usage("$0 <command> [o
 	type: "boolean",
 	default: true,
 	describe: "Run post-scaffold pnpm install + typecheck + lint + test (default true; --no-verify skips)"
-}), (argv) => {
+}), async (argv) => {
 	try {
-		if (!argv.capability || !argv.vendorEnv || !argv.baseUrl) throw new PluginCreateError("Phase A: --capability, --vendor-env, and --base-url are required. Interactive prompts land in Phase B.");
+		const capabilityKeys = Object.keys(CARDINALITY).join(", ");
+		const needsPrompt = !argv.capability || !argv.vendorEnv || !argv.baseUrl;
+		let capability;
+		let vendorEnv;
+		let baseUrl;
+		if (needsPrompt) {
+			const rl = createInterface({
+				input: stdin,
+				output: stdout
+			});
+			const ask = (question) => new Promise((resolve) => rl.question(`  ${question} `, (answer) => resolve(answer.trim())));
+			try {
+				if (!argv.capability) {
+					console.log(`  Available capabilities: ${capabilityKeys}`);
+					capability = await ask("Capability:");
+				} else capability = argv.capability;
+				vendorEnv = argv.vendorEnv ? argv.vendorEnv : await ask(`Vendor-native env var for the ${argv.vendor} token (e.g. MYVENDOR_API_KEY):`);
+				baseUrl = argv.baseUrl ? argv.baseUrl : await ask(`REST base URL for the ${argv.vendor} API (e.g. https://api.myvendor.com):`);
+			} finally {
+				rl.close();
+			}
+		} else {
+			capability = argv.capability;
+			vendorEnv = argv.vendorEnv;
+			baseUrl = argv.baseUrl;
+		}
 		if (runPluginCreate({
 			slug: argv.slug,
 			vendorName: argv.vendor,
-			capability: argv.capability,
-			vendorEnv: argv.vendorEnv,
-			baseUrl: argv.baseUrl,
+			capability,
+			vendorEnv,
+			baseUrl,
 			...argv.tokenEnv ? { tokenEnv: argv.tokenEnv } : {},
 			dryRun: argv.dryRun,
 			noVerify: !argv.verify,
@@ -3558,7 +4828,32 @@ await yargs(hideBin(process.argv)).scriptName("holocron").usage("$0 <command> [o
 		}
 		throw err;
 	}
-}).command("auth <subcommand>", "Manage bootstrap credentials in the OS keyring", (y) => y.command("set <provider> [token]", "Verify + store a bootstrap token for a provider", (yy) => yy.positional("provider", {
+}).command("upgrade", "Upgrade toolchain version pins across the repo", (y) => y.command("node <to>", "Scan the repo and update every Node.js version pin to a new major", (yy) => yy.positional("to", {
+	type: "number",
+	demandOption: true,
+	describe: "Target Node.js major version (e.g., 22)"
+}).option("from", {
+	type: "number",
+	describe: "Current major version to replace. Auto-detected from .nvmrc / engines.node when omitted."
+}), async (argv) => {
+	let extra = [];
+	try {
+		const raw = readFileSync(join(argv.cwd, "holocron.config.json"), "utf8");
+		const upgradeNode = JSON.parse(raw).upgrade?.node;
+		if (Array.isArray(upgradeNode?.extra)) extra = upgradeNode.extra;
+	} catch {}
+	const report = await runUpgradeNode({
+		to: argv.to,
+		...argv.from != null ? { from: argv.from } : {},
+		cwd: argv.cwd,
+		dryRun: argv.dryRun,
+		extra
+	});
+	if (report.status === "fail") {
+		if (report.message) console.error(`upgrade node: ${report.message}`);
+		process.exitCode = 1;
+	}
+}).demandCommand(1, "Run `holocron upgrade --help` to see available upgrade subcommands."), () => {}).command("auth <subcommand>", "Manage bootstrap credentials in the OS keyring", (y) => y.command("set <provider> [token]", "Verify + store a bootstrap token for a provider", (yy) => yy.positional("provider", {
 	type: "string",
 	demandOption: true
 }).positional("token", { type: "string" }), async (argv) => {
@@ -3579,6 +4874,7 @@ await yargs(hideBin(process.argv)).scriptName("holocron").usage("$0 <command> [o
 }).command("list", "List every provider with a stored bootstrap token", () => {}, async () => {
 	await runAuthList();
 }).demandCommand(1, "Run `holocron auth --help` to see available auth subcommands."), () => {}).demandCommand(1, "Run `holocron --help` to see available commands.").strict().help().parse();
+(await updateCheckPromise)?.();
 /**
 * Parse `--scope` strings: `repo` | `env=NAME` | `org=NAME`.
 */