@theholocron/cli 3.0.1 → 3.1.0

package/dist/cli.mjs

@@ -2,21 +2,124 @@
 import { createRequire } from "node:module";
 import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
 import path, { basename, dirname, join, relative, resolve } from "node:path";
+import { stdin, stdout } from "node:process";
+import { createInterface } from "node:readline";
 import yargs from "yargs";
 import { hideBin } from "yargs/helpers";
-import { createInterface } from "node:readline";
-import { stdin, stdout } from "node:process";
 import { AuthError, ProviderApiError, ProviderApiError as ProviderApiError$1 } from "@theholocron/http-client";
 import { Entry, findCredentials } from "@napi-rs/keyring";
 import ora from "ora";
 import chalk from "chalk";
-import { homedir } from "node:os";
 import { execFile, execFileSync, spawnSync } from "node:child_process";
+import { homedir } from "node:os";
 import { createHash } from "node:crypto";
-import { createGitHubClient } from "@theholocron/github-client";
 import { access, copyFile, mkdir, readFile, readdir, rm, stat, symlink, unlink, writeFile } from "node:fs/promises";
 import { pathToFileURL } from "node:url";
+import { createGitHubClient } from "@theholocron/github-client";
 import { promisify } from "node:util";
+//#region src/env.ts
+function createEnvLookup(source = process.env) {
+	return {
+		get(key) {
+			return source[key] || void 0;
+		},
+		first(...keys) {
+			for (const key of keys) {
+				const val = source[key];
+				if (val) return val;
+			}
+		}
+	};
+}
+//#endregion
+//#region src/keyring.ts
+/**
+* Keyring-backed bootstrap credential store.
+*
+* Every holocron plugin's bootstrap token (the one it needs before it
+* can talk to its vendor's API) can be stored in the OS keyring under
+* a single reverse-DNS service scope. Managed via `holocron auth`
+* subcommands; consulted at position 4 in every plugin's auth
+* precedence chain (after --token / HOLOCRON_<X>_TOKEN / <native>_TOKEN).
+*
+* See `.notes/tech-auth-bootstrap.spec.md` for the design rationale.
+*
+* Failure model: keyring access is best-effort. Platforms without a
+* supported credential store (some Linux CI images, sandboxed
+* environments) will throw from the underlying library. Every export
+* here catches and returns a null/empty result rather than propagating
+* — the plugin's precedence chain then falls through to
+* env-var-only paths, which is exactly how CI is meant to work.
+*/
+const SERVICE = "com.theholocron.cli";
+/**
+* Store or overwrite a bootstrap token for a provider. Returns true on
+* success, false when the underlying keyring is unsupported or errored.
+*/
+function setToken(provider, token) {
+	try {
+		new Entry(SERVICE, provider).setPassword(token);
+		return true;
+	} catch {
+		return false;
+	}
+}
+/**
+* Read the bootstrap token for a provider. Returns `null` for both
+* "not stored" and "keyring unavailable" — callers can treat them the
+* same way (fall through to env-var precedence).
+*/
+function getToken(provider) {
+	try {
+		return new Entry(SERVICE, provider).getPassword();
+	} catch {
+		return null;
+	}
+}
+/**
+* Delete a stored token. Returns true when a token was removed, false
+* when there was nothing to delete or the keyring is unavailable.
+* Distinguishing the two cases isn't worth the surface area — the
+* command output makes the situation clear either way.
+*/
+function deleteToken(provider) {
+	try {
+		return new Entry(SERVICE, provider).deletePassword();
+	} catch {
+		return false;
+	}
+}
+/**
+* List provider slugs with a stored token in this service scope.
+* Uses the library's `findCredentials(service)` — supported on all
+* platforms the underlying credential store supports.
+*/
+function listStoredProviders() {
+	try {
+		return findCredentials(SERVICE).map((c) => c.account);
+	} catch {
+		return [];
+	}
+}
+//#endregion
+//#region src/auth-resolver.ts
+/**
+* Build a strict, single-feature token resolver.
+*
+* Resolution chain: `--token flag → envName env var → keyring(keyringKey)`.
+* No broad-token fallback — if the feature-specific token is absent the
+* operation fails with a message naming the exact env var to set.
+*/
+function createFeatureResolver(config) {
+	return function resolveFeatureToken(input = {}) {
+		const env = createEnvLookup(input.env);
+		const keyring = input.keyring ?? getToken;
+		const token = input.cliToken || env.get(config.envName) || keyring(config.keyringKey);
+		if (!token) throw new AuthError(`no GitHub token found for this operation. Pass --token <PAT>, set ${config.envName}, or run: holocron auth set ${config.keyringKey} <PAT>`);
+		return token;
+	};
+}
+//#endregion
 //#region src/capabilities/index.ts
 const CARDINALITY = {
 	source: "single",
@@ -157,76 +260,6 @@ function resolveConfig(raw) {
 	};
 }
 //#endregion
-//#region src/keyring.ts
-/**
-* Keyring-backed bootstrap credential store.
-*
-* Every holocron plugin's bootstrap token (the one it needs before it
-* can talk to its vendor's API) can be stored in the OS keyring under
-* a single reverse-DNS service scope. Managed via `holocron auth`
-* subcommands; consulted at position 4 in every plugin's auth
-* precedence chain (after --token / HOLOCRON_<X>_TOKEN / <native>_TOKEN).
-*
-* See `.notes/tech-auth-bootstrap.spec.md` for the design rationale.
-*
-* Failure model: keyring access is best-effort. Platforms without a
-* supported credential store (some Linux CI images, sandboxed
-* environments) will throw from the underlying library. Every export
-* here catches and returns a null/empty result rather than propagating
-* — the plugin's precedence chain then falls through to
-* env-var-only paths, which is exactly how CI is meant to work.
-*/
-const SERVICE = "com.theholocron.cli";
-/**
-* Store or overwrite a bootstrap token for a provider. Returns true on
-* success, false when the underlying keyring is unsupported or errored.
-*/
-function setToken(provider, token) {
-	try {
-		new Entry(SERVICE, provider).setPassword(token);
-		return true;
-	} catch {
-		return false;
-	}
-}
-/**
-* Read the bootstrap token for a provider. Returns `null` for both
-* "not stored" and "keyring unavailable" — callers can treat them the
-* same way (fall through to env-var precedence).
-*/
-function getToken(provider) {
-	try {
-		return new Entry(SERVICE, provider).getPassword();
-	} catch {
-		return null;
-	}
-}
-/**
-* Delete a stored token. Returns true when a token was removed, false
-* when there was nothing to delete or the keyring is unavailable.
-* Distinguishing the two cases isn't worth the surface area — the
-* command output makes the situation clear either way.
-*/
-function deleteToken(provider) {
-	try {
-		return new Entry(SERVICE, provider).deletePassword();
-	} catch {
-		return false;
-	}
-}
-/**
-* List provider slugs with a stored token in this service scope.
-* Uses the library's `findCredentials(service)` — supported on all
-* platforms the underlying credential store supports.
-*/
-function listStoredProviders() {
-	try {
-		return findCredentials(SERVICE).map((c) => c.account);
-	} catch {
-		return [];
-	}
-}
-//#endregion
 //#region src/ui/progress.ts
 /**
 * Runs `fn`, showing an ora spinner for its duration in TTY environments.
@@ -545,223 +578,19 @@ async function runClone(input) {
 	};
 }
 //#endregion
-//#region src/commands/new.ts
-/**
-* `holocron new <type> <name>` — create a GitHub repo from a template and
-* bootstrap it by replacing all template-slug casing variants with the new
-* project name.
-*
-* Flow:
-*   1. Preflight — verify `gh` CLI is available.
-*   2. Resolve type, name, description (prompt via readline if missing).
-*   3. `gh repo create <org>/<name> --template <org>/<type>-template --private --clone`
-*      → clones to `<cwd>/<name>/`
-*   4. Detect template slug from cloned package.json.
-*   5. Replace all casing variants of the slug across every text file.
-*   6. Replace `<description>` placeholder if a description was given.
-*   7. Commit the patched files (-s for DCO).
-*   8. Unless --no-verify: `pnpm install` in the new repo.
-*   9. Print next steps.
-*/
-var NewError = class extends Error {
-	name = "NewError";
+//#region src/loader.ts
+var LoaderError = class extends Error {
+	name = "LoaderError";
 };
-function cap(word) {
-	return word.charAt(0).toUpperCase() + word.slice(1).toLowerCase();
-}
-/**
-* Derive all common casing variants of a kebab-case slug (e.g.
-* "cli-template") and map each to the corresponding form of a
-* kebab-case name (e.g. "my-tool").
-*
-* Returns search→replacement pairs, deduplicating single-word slugs
-* that would otherwise produce identical entries.
-*/
-function deriveVariants(slug, name) {
-	const sw = slug.split("-");
-	const nw = name.split("-");
-	const pairs = [
-		[slug, name],
-		[sw.join("_"), nw.join("_")],
-		[sw.join("_").toUpperCase(), nw.join("_").toUpperCase()],
-		[sw.map(cap).join(""), nw.map(cap).join("")],
-		[sw[0].toLowerCase() + sw.slice(1).map(cap).join(""), nw[0].toLowerCase() + nw.slice(1).map(cap).join("")],
-		[sw.map(cap).join(" "), nw.map(cap).join(" ")]
-	];
-	const seen = /* @__PURE__ */ new Set();
-	return pairs.filter(([s]) => {
-		if (seen.has(s)) return false;
-		seen.add(s);
-		return true;
-	});
-}
-const SKIP_DIRS$1 = /* @__PURE__ */ new Set([
-	".git",
-	"node_modules",
-	"dist",
-	".turbo"
-]);
-function defaultWalkFiles$1(dir) {
-	const results = [];
-	for (const entry of readdirSync(dir)) {
-		if (SKIP_DIRS$1.has(entry)) continue;
-		const full = path.join(dir, entry);
-		const stat = statSync(full);
-		if (stat.isDirectory()) results.push(...defaultWalkFiles$1(full));
-		else if (stat.isFile()) results.push(full);
-	}
-	return results;
-}
-function isBinary(content) {
-	for (let i = 0; i < Math.min(content.length, 8e3); i++) if (content.charCodeAt(i) === 0) return true;
-	return false;
-}
-function patchFiles(dir, variants, description, print, readFn, writeFn, walkFn) {
-	const patched = [];
-	for (const filepath of walkFn(dir)) {
-		let content;
-		try {
-			content = readFn(filepath);
-		} catch {
-			continue;
-		}
-		if (isBinary(content)) continue;
-		const original = content;
-		for (const [search, replacement] of variants) content = content.split(search).join(replacement);
-		if (description !== void 0) content = content.split("<description>").join(description);
-		if (content !== original) {
-			writeFn(filepath, content);
-			print(`  ✓ ${path.relative(dir, filepath)}`);
-			patched.push(filepath);
-		}
-	}
-	return patched;
-}
-function preflight$1() {
-	const result = spawnSync("gh", ["--version"], { encoding: "utf8" });
-	if (result.error != null || result.status !== 0) throw new NewError("`gh` CLI is not installed or not on PATH. Install it from https://cli.github.com");
-}
-function defaultExec$3(cmd, args, opts) {
-	execFileSync(cmd, args, {
-		cwd: opts.cwd,
-		stdio: opts.stdio
-	});
-}
-function defaultReadFile(filepath) {
-	return readFileSync(filepath, "utf-8");
-}
-function defaultWriteFile(filepath, content) {
-	mkdirSync(path.dirname(filepath), { recursive: true });
-	writeFileSync(filepath, content, "utf-8");
-}
-async function runNew(input) {
-	const cwd = input.cwd ?? process.cwd();
-	const org = input.org ?? "theholocron";
-	const print = input.print ?? ((line) => console.log(line));
-	const execFn = input.exec ?? defaultExec$3;
-	const readFn = input.readFile ?? defaultReadFile;
-	const writeFn = input.writeFile ?? defaultWriteFile;
-	const walkFn = input.walkFiles ?? defaultWalkFiles$1;
-	preflight$1();
-	const templateRepo = `${org}/${input.type}-template`;
-	const newRepo = `${org}/${input.name}`;
-	const repoDir = path.join(cwd, input.name);
-	if (input.dryRun) {
-		print(`  Would create ${newRepo} from template ${templateRepo}`);
-		print(`  Would clone to ${repoDir}`);
-		print(`  Would patch all casing variants of "${input.type}-template" → "${input.name}"`);
-		if (input.description) print(`  Would replace <description> → "${input.description}"`);
-		return { status: "dry-run" };
-	}
-	if (existsSync(repoDir)) throw new NewError(`\`${repoDir}\` already exists — delete it or pick a different name.`);
-	print(`  Creating ${newRepo} from template ${templateRepo}…`);
-	try {
-		execFn("gh", [
-			"repo",
-			"create",
-			newRepo,
-			`--template=${templateRepo}`,
-			"--private",
-			"--clone"
-		], {
-			cwd,
-			stdio: "inherit"
-		});
-	} catch (err) {
-		throw new NewError(`gh repo create failed: ${err instanceof Error ? err.message : String(err)}`);
-	}
-	let templateSlug = `${input.type}-template`;
-	const pkgJsonPath = path.join(repoDir, "package.json");
-	if (existsSync(pkgJsonPath)) try {
-		const pkg = JSON.parse(readFn(pkgJsonPath));
-		if (typeof pkg.name === "string") templateSlug = pkg.name.split("/").pop() ?? templateSlug;
-	} catch {}
-	print(`  Detected template slug: ${templateSlug}`);
-	print(`  Patching files…`);
-	const filesPatched = patchFiles(repoDir, deriveVariants(templateSlug, input.name), input.description, print, readFn, writeFn, walkFn);
-	print(`  ${filesPatched.length} file${filesPatched.length === 1 ? "" : "s"} patched`);
-	if (filesPatched.length > 0) {
-		execFn("git", ["add", "-A"], {
-			cwd: repoDir,
-			stdio: "inherit"
-		});
-		execFn("git", [
-			"commit",
-			"-s",
-			"-m",
-			`chore: bootstrap from ${templateSlug}`
-		], {
-			cwd: repoDir,
-			stdio: "inherit"
-		});
-	}
-	if (!input.noVerify) {
-		print("");
-		print("  Installing dependencies…");
-		try {
-			execFn("pnpm", ["install"], {
-				cwd: repoDir,
-				stdio: "inherit"
-			});
-		} catch (err) {
-			print(`  ✗ pnpm install failed — ${err instanceof Error ? err.message : String(err)}`);
-			return {
-				status: "fail",
-				repoDir,
-				filesPatched,
-				message: "pnpm install failed; inspect output above"
-			};
-		}
-	}
-	print("");
-	print(`  Scaffolded ${newRepo} (${filesPatched.length} file${filesPatched.length === 1 ? "" : "s"} patched).`);
-	print("");
-	print("  Next:");
-	print(`    1. cd ${repoDir}`);
-	if (input.noVerify) print(`    2. pnpm install`);
-	const step = input.noVerify ? 3 : 2;
-	print(`    ${step}. holocron setup  # wire up secrets, teams, labels, etc.`);
-	print(`    ${step + 1}. git push -u origin HEAD`);
-	return {
-		status: "ok",
-		repoDir,
-		filesPatched
-	};
-}
-//#endregion
-//#region src/loader.ts
-var LoaderError = class extends Error {
-	name = "LoaderError";
-};
-var PluginLoader = class {
-	config;
-	context;
-	importer;
-	registry = /* @__PURE__ */ new Map();
-	constructor(config, context, importer = defaultImporter) {
-		this.config = config;
-		this.context = context;
-		this.importer = importer;
+var PluginLoader = class {
+	config;
+	context;
+	importer;
+	registry = /* @__PURE__ */ new Map();
+	constructor(config, context, importer = defaultImporter) {
+		this.config = config;
+		this.context = context;
+		this.importer = importer;
 	}
 	/** Imports every configured plugin and builds the capability registry. */
 	async load() {
@@ -975,35 +804,239 @@ function pad(s, width) {
 	return s.length >= width ? s : s + " ".repeat(width - s.length);
 }
 //#endregion
-//#region src/commands/npm-bump-versions.ts
-async function runNpmBumpVersions(input) {
-	const print = input.print ?? ((line) => console.log(line));
-	const cwd = input.cwd ?? process.cwd();
-	const { version, dryRun = false } = input;
-	const readFile = input.readFile ?? ((p) => readFileSync(p, "utf8"));
-	const writeFile = input.writeFile ?? ((p, c) => writeFileSync(p, c));
-	const listDir = input.listDir ?? ((p) => readdirSync(p));
-	const isDir = input.isDir ?? ((p) => statSync(p).isDirectory());
-	const bumped = [];
-	const skipped = [];
-	print(`Bumping monorepo to ${version}${dryRun ? " (dry-run)" : ""}…`);
-	function bumpFile(absPath, label) {
-		let pkg;
+//#region src/commands/new.ts
+/**
+* `holocron new <type> <name>` — create a GitHub repo from a template and
+* bootstrap it by replacing all template-slug casing variants with the new
+* project name.
+*
+* Flow:
+*   1. Preflight — verify `gh` CLI is available.
+*   2. Resolve type, name, description (prompt via readline if missing).
+*   3. `gh repo create <org>/<name> --template <org>/<type>-template --private --clone`
+*      → clones to `<cwd>/<name>/`
+*   4. Detect template slug from cloned package.json.
+*   5. Replace all casing variants of the slug across every text file.
+*   6. Replace `<description>` placeholder if a description was given.
+*   7. Commit the patched files (-s for DCO).
+*   8. Unless --no-verify: `pnpm install` in the new repo.
+*   9. Print next steps.
+*/
+var NewError = class extends Error {
+	name = "NewError";
+};
+function cap(word) {
+	return word.charAt(0).toUpperCase() + word.slice(1).toLowerCase();
+}
+/**
+* Derive all common casing variants of a kebab-case slug (e.g.
+* "cli-template") and map each to the corresponding form of a
+* kebab-case name (e.g. "my-tool").
+*
+* Returns search→replacement pairs, deduplicating single-word slugs
+* that would otherwise produce identical entries.
+*/
+function deriveVariants(slug, name) {
+	const sw = slug.split("-");
+	const nw = name.split("-");
+	const pairs = [
+		[slug, name],
+		[sw.join("_"), nw.join("_")],
+		[sw.join("_").toUpperCase(), nw.join("_").toUpperCase()],
+		[sw.map(cap).join(""), nw.map(cap).join("")],
+		[sw[0].toLowerCase() + sw.slice(1).map(cap).join(""), nw[0].toLowerCase() + nw.slice(1).map(cap).join("")],
+		[sw.map(cap).join(" "), nw.map(cap).join(" ")]
+	];
+	const seen = /* @__PURE__ */ new Set();
+	return pairs.filter(([s]) => {
+		if (seen.has(s)) return false;
+		seen.add(s);
+		return true;
+	});
+}
+const SKIP_DIRS$1 = /* @__PURE__ */ new Set([
+	".git",
+	"node_modules",
+	"dist",
+	".turbo"
+]);
+function defaultWalkFiles$1(dir) {
+	const results = [];
+	for (const entry of readdirSync(dir)) {
+		if (SKIP_DIRS$1.has(entry)) continue;
+		const full = path.join(dir, entry);
+		const stat = statSync(full);
+		if (stat.isDirectory()) results.push(...defaultWalkFiles$1(full));
+		else if (stat.isFile()) results.push(full);
+	}
+	return results;
+}
+function isBinary(content) {
+	for (let i = 0; i < Math.min(content.length, 8e3); i++) if (content.charCodeAt(i) === 0) return true;
+	return false;
+}
+function patchFiles(dir, variants, description, print, readFn, writeFn, walkFn) {
+	const patched = [];
+	for (const filepath of walkFn(dir)) {
+		let content;
 		try {
-			pkg = JSON.parse(readFile(absPath));
+			content = readFn(filepath);
 		} catch {
-			print(`  ✗ could not parse ${label}`);
-			return;
-		}
-		const old = pkg.version;
-		if (!dryRun) {
-			pkg.version = version;
-			writeFile(absPath, JSON.stringify(pkg, null, 2) + "\n");
+			continue;
 		}
-		print(`  ${dryRun ? "~" : "✓"} ${label}: ${old} → ${version}`);
-		bumped.push(label);
-	}
-	bumpFile(join(cwd, "package.json"), "root");
+		if (isBinary(content)) continue;
+		const original = content;
+		for (const [search, replacement] of variants) content = content.split(search).join(replacement);
+		if (description !== void 0) content = content.split("<description>").join(description);
+		if (content !== original) {
+			writeFn(filepath, content);
+			print(`  ✓ ${path.relative(dir, filepath)}`);
+			patched.push(filepath);
+		}
+	}
+	return patched;
+}
+function preflight$1() {
+	const result = spawnSync("gh", ["--version"], { encoding: "utf8" });
+	if (result.error != null || result.status !== 0) throw new NewError("`gh` CLI is not installed or not on PATH. Install it from https://cli.github.com");
+}
+function defaultExec$3(cmd, args, opts) {
+	execFileSync(cmd, args, {
+		cwd: opts.cwd,
+		stdio: opts.stdio
+	});
+}
+function defaultReadFile(filepath) {
+	return readFileSync(filepath, "utf-8");
+}
+function defaultWriteFile(filepath, content) {
+	mkdirSync(path.dirname(filepath), { recursive: true });
+	writeFileSync(filepath, content, "utf-8");
+}
+async function runNew(input) {
+	const cwd = input.cwd ?? process.cwd();
+	const org = input.org ?? "theholocron";
+	const print = input.print ?? ((line) => console.log(line));
+	const execFn = input.exec ?? defaultExec$3;
+	const readFn = input.readFile ?? defaultReadFile;
+	const writeFn = input.writeFile ?? defaultWriteFile;
+	const walkFn = input.walkFiles ?? defaultWalkFiles$1;
+	preflight$1();
+	const templateRepo = `${org}/${input.type}-template`;
+	const newRepo = `${org}/${input.name}`;
+	const repoDir = path.join(cwd, input.name);
+	if (input.dryRun) {
+		print(`  Would create ${newRepo} from template ${templateRepo}`);
+		print(`  Would clone to ${repoDir}`);
+		print(`  Would patch all casing variants of "${input.type}-template" → "${input.name}"`);
+		if (input.description) print(`  Would replace <description> → "${input.description}"`);
+		return { status: "dry-run" };
+	}
+	if (existsSync(repoDir)) throw new NewError(`\`${repoDir}\` already exists — delete it or pick a different name.`);
+	print(`  Creating ${newRepo} from template ${templateRepo}…`);
+	try {
+		execFn("gh", [
+			"repo",
+			"create",
+			newRepo,
+			`--template=${templateRepo}`,
+			"--private",
+			"--clone"
+		], {
+			cwd,
+			stdio: "inherit"
+		});
+	} catch (err) {
+		throw new NewError(`gh repo create failed: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	let templateSlug = `${input.type}-template`;
+	const pkgJsonPath = path.join(repoDir, "package.json");
+	if (existsSync(pkgJsonPath)) try {
+		const pkg = JSON.parse(readFn(pkgJsonPath));
+		if (typeof pkg.name === "string") templateSlug = pkg.name.split("/").pop() ?? templateSlug;
+	} catch {}
+	print(`  Detected template slug: ${templateSlug}`);
+	print(`  Patching files…`);
+	const filesPatched = patchFiles(repoDir, deriveVariants(templateSlug, input.name), input.description, print, readFn, writeFn, walkFn);
+	print(`  ${filesPatched.length} file${filesPatched.length === 1 ? "" : "s"} patched`);
+	if (filesPatched.length > 0) {
+		execFn("git", ["add", "-A"], {
+			cwd: repoDir,
+			stdio: "inherit"
+		});
+		execFn("git", [
+			"commit",
+			"-s",
+			"-m",
+			`chore: bootstrap from ${templateSlug}`
+		], {
+			cwd: repoDir,
+			stdio: "inherit"
+		});
+	}
+	if (!input.noVerify) {
+		print("");
+		print("  Installing dependencies…");
+		try {
+			execFn("pnpm", ["install"], {
+				cwd: repoDir,
+				stdio: "inherit"
+			});
+		} catch (err) {
+			print(`  ✗ pnpm install failed — ${err instanceof Error ? err.message : String(err)}`);
+			return {
+				status: "fail",
+				repoDir,
+				filesPatched,
+				message: "pnpm install failed; inspect output above"
+			};
+		}
+	}
+	print("");
+	print(`  Scaffolded ${newRepo} (${filesPatched.length} file${filesPatched.length === 1 ? "" : "s"} patched).`);
+	print("");
+	print("  Next:");
+	print(`    1. cd ${repoDir}`);
+	if (input.noVerify) print(`    2. pnpm install`);
+	const step = input.noVerify ? 3 : 2;
+	print(`    ${step}. holocron setup  # wire up secrets, teams, labels, etc.`);
+	print(`    ${step + 1}. git push -u origin HEAD`);
+	return {
+		status: "ok",
+		repoDir,
+		filesPatched
+	};
+}
+//#endregion
+//#region src/commands/npm-bump-versions.ts
+async function runNpmBumpVersions(input) {
+	const print = input.print ?? ((line) => console.log(line));
+	const cwd = input.cwd ?? process.cwd();
+	const { version, dryRun = false } = input;
+	const readFile = input.readFile ?? ((p) => readFileSync(p, "utf8"));
+	const writeFile = input.writeFile ?? ((p, c) => writeFileSync(p, c));
+	const listDir = input.listDir ?? ((p) => readdirSync(p));
+	const isDir = input.isDir ?? ((p) => statSync(p).isDirectory());
+	const bumped = [];
+	const skipped = [];
+	print(`Bumping monorepo to ${version}${dryRun ? " (dry-run)" : ""}…`);
+	function bumpFile(absPath, label) {
+		let pkg;
+		try {
+			pkg = JSON.parse(readFile(absPath));
+		} catch {
+			print(`  ✗ could not parse ${label}`);
+			return;
+		}
+		const old = pkg.version;
+		if (!dryRun) {
+			pkg.version = version;
+			writeFile(absPath, JSON.stringify(pkg, null, 2) + "\n");
+		}
+		print(`  ${dryRun ? "~" : "✓"} ${label}: ${old} → ${version}`);
+		bumped.push(label);
+	}
+	bumpFile(join(cwd, "package.json"), "root");
 	const packagesDir = join(cwd, "packages");
 	let entries;
 	try {
@@ -1045,883 +1078,220 @@ async function runNpmBumpVersions(input) {
 	};
 }
 //#endregion
-//#region src/commands/upgrade-node.ts
-const SKIP_DIRS = /* @__PURE__ */ new Set([
-	"node_modules",
-	".git",
-	"dist",
-	"coverage",
-	"build",
-	".turbo",
-	".next",
-	"out"
-]);
-function patchPackageJson(content, from, to) {
-	let pkg;
-	try {
-		pkg = JSON.parse(content);
-	} catch {
-		return null;
-	}
-	let changed = false;
-	const engines = pkg.engines;
-	if (engines?.node && /^>=\d+(?:\.0\.0)?$/.test(engines.node)) {
-		if (parseInt(engines.node.match(/\d+/)[0], 10) === from) {
-			engines.node = `>=${to}.0.0`;
-			changed = true;
-		}
-	}
-	for (const field of ["devDependencies", "dependencies"]) {
-		const deps = pkg[field];
-		if (!deps?.["@types/node"]) continue;
-		if (deps["@types/node"] === `^${from}.0.0`) {
-			deps["@types/node"] = `^${to}.0.0`;
-			changed = true;
-		}
+//#region src/commands/npm-publish-initial.ts
+/**
+* `holocron npm publish-initial` — bottles up the chicken-and-egg
+* bootstrap that every new npm-published holocron monorepo hits.
+*
+* npm requires a package to exist before Trusted Publishing can be
+* configured on it. So the first publish has to happen outside the
+* OIDC flow — using either a browser-auth session (`npm login
+* --auth-type=web`) or an ephemeral automation token. This command
+* runs the publish step + tells you exactly what to do next.
+*
+* Workflow:
+*
+*   $ npm login --auth-type=web          # one-time, browser-based
+*   $ pnpm install --frozen-lockfile
+*   $ pnpm build
+*   $ pnpm exec tsx packages/cli/src/cli.ts npm publish-initial
+*
+* The command itself only handles the publish step + the post-publish
+* Trusted Publisher setup reminder. `pnpm install` + `pnpm build`
+* stay outside the command (no pnpm-inside-pnpm).
+*
+* If `NPM_TOKEN` is detected in env, the command prints a final
+* "revoke this token at <url>" reminder — same pattern as `rando vc
+* setup` for the ephemeral GH admin PAT.
+*/
+const PUBLISHABLE_PACKAGES = [
+	"@theholocron/cli",
+	"@theholocron/holocron-plugin-github",
+	"@theholocron/holocron-plugin-vercel",
+	"@theholocron/holocron-plugin-neon",
+	"@theholocron/holocron-plugin-clerk",
+	"@theholocron/holocron-plugin-1password",
+	"@theholocron/holocron-plugin-postman"
+];
+async function runNpmPublishInitial(input = {}) {
+	const print = input.print ?? ((line) => console.log(line));
+	const cwd = input.cwd ?? process.cwd();
+	const tag = input.tag ?? "alpha";
+	const dryRun = input.dryRun ?? false;
+	const otp = input.otp;
+	const env = input.env ?? process.env;
+	const exec = input.exec ?? defaultExec$2;
+	const publishArgs = [
+		"-r",
+		"--filter=./packages/*",
+		"publish",
+		"--access",
+		"public",
+		"--no-git-checks",
+		"--tag",
+		tag,
+		...otp ? ["--otp", otp] : []
+	];
+	print(`Holocron npm publish-initial${dryRun ? " (dry-run)" : ""}`);
+	print(`  cwd: ${cwd}`);
+	print(`  tag: ${tag}`);
+	if (otp) print(`  otp: <${otp.length} chars>`);
+	print("");
+	print("  → verifying npm auth (`npm whoami`)…");
+	const whoami = await exec("npm", ["whoami"], { cwd });
+	if (whoami.exitCode !== 0) {
+		const message = "npm is not authenticated. Run `npm login --auth-type=web` (browser flow, no token stored) or `npm login`, then re-run this command.";
+		print(`  ✗ ${message}`);
+		return {
+			status: "fail",
+			message,
+			packageNames: PUBLISHABLE_PACKAGES
+		};
 	}
-	return changed ? JSON.stringify(pkg, null, 2) + "\n" : null;
-}
-function patchYaml(content, from, to) {
-	const updated = content.replace(/node-version:\s+['"]?(\d+)['"]?/g, (match, ver) => ver === String(from) ? match.replace(String(from), String(to)) : match);
-	return updated !== content ? updated : null;
-}
-function patchPinFile(content, from, to) {
-	const trimmed = content.trim();
-	if (trimmed === String(from) || trimmed.startsWith(`${from}.`)) return `${to}\n`;
-	return null;
-}
-function patchDockerfile(content, from, to) {
-	const updated = content.replace(/^(FROM\s+node:)(\d+)/gm, (match, prefix, ver) => ver === String(from) ? `${prefix}${to}` : match);
-	return updated !== content ? updated : null;
-}
-function patchToolVersions(content, from, to) {
-	const updated = content.replace(/^(nodejs\s+)(\d+)/gm, (match, prefix, ver) => ver === String(from) ? `${prefix}${to}` : match);
-	return updated !== content ? updated : null;
-}
-const PATTERNS = [
-	{
-		matches: (n) => n === "package.json",
-		patch: patchPackageJson
-	},
-	{
-		matches: (n) => n.endsWith(".yml") || n.endsWith(".yaml"),
-		patch: patchYaml
-	},
-	{
-		matches: (n) => n === ".nvmrc" || n === ".node-version",
-		patch: patchPinFile
-	},
-	{
-		matches: (n) => n === "Dockerfile" || n.startsWith("Dockerfile."),
-		patch: patchDockerfile
-	},
-	{
-		matches: (n) => n === ".tool-versions",
-		patch: patchToolVersions
-	}
-];
-function detectFrom(cwd, _readFile) {
-	for (const name of [".nvmrc", ".node-version"]) try {
-		const major = parseInt(_readFile(join(cwd, name)).trim(), 10);
-		if (!isNaN(major)) return major;
-	} catch {}
-	try {
-		const node = JSON.parse(_readFile(join(cwd, "package.json"))).engines?.node;
-		if (node) {
-			const m = node.match(/(\d+)/);
-			if (m) return parseInt(m[1], 10);
-		}
-	} catch {}
-	return null;
-}
-function defaultWalkFiles(dir) {
-	const results = [];
-	function walk(current) {
-		let entries;
-		try {
-			entries = readdirSync(current);
-		} catch {
-			return;
-		}
-		for (const entry of entries) {
-			if (SKIP_DIRS.has(entry)) continue;
-			const abs = join(current, entry);
-			try {
-				if (statSync(abs).isDirectory()) walk(abs);
-				else results.push(abs);
-			} catch {}
-		}
-	}
-	walk(dir);
-	return results;
-}
-async function runUpgradeNode(input) {
-	const print = input.print ?? ((line) => console.log(line));
-	const cwd = input.cwd ?? process.cwd();
-	const { to, dryRun = false, extra = [] } = input;
-	const _readFile = input.readFile ?? ((p) => readFileSync(p, "utf8"));
-	const _writeFile = input.writeFile ?? ((p, c) => writeFileSync(p, c));
-	const _walkFiles = input.walkFiles ?? defaultWalkFiles;
-	const from = input.from ?? detectFrom(cwd, _readFile);
-	if (from === null) return {
-		status: "fail",
-		updated: [],
-		message: "could not detect current Node version — pass --from <major>"
-	};
-	if (from === to) {
-		print(`Already at Node.js ${to} — nothing to do.`);
+	print(`    ✓ authed as ${whoami.stdout.trim() || "<unknown>"}`);
+	if (dryRun) {
+		print("");
+		print("  … (dry-run) skipping actual publish");
+		print(`    would run: pnpm ${publishArgs.join(" ")}`);
+		printNextSteps$1(print, env);
 		return {
-			status: "ok",
-			updated: []
+			status: "dry-run",
+			message: "dry-run — no publish executed",
+			packageNames: PUBLISHABLE_PACKAGES
 		};
 	}
-	print(`Upgrading Node.js ${from} → ${to}${dryRun ? " (dry-run)" : ""}…`);
-	const updated = [];
-	const scanned = [..._walkFiles(cwd), ...extra.map((p) => join(cwd, p))];
-	for (const abs of scanned) {
-		const name = basename(abs);
-		const pattern = PATTERNS.find((p) => p.matches(name));
-		if (!pattern) continue;
-		let content;
-		try {
-			content = _readFile(abs);
-		} catch {
-			continue;
+	print("");
+	print("  → publishing all public @theholocron/* packages…");
+	const publish = await exec("pnpm", publishArgs, { cwd });
+	if (publish.exitCode !== 0) {
+		const message = `publish failed (exit ${publish.exitCode}): ${publish.stderr.trim() || publish.stdout.trim() || "no output"}`;
+		print(`  ✗ ${message}`);
+		if (publish.stdout.includes("EOTP") || publish.stderr.includes("EOTP")) {
+			print("");
+			print("  → hint: your npm account requires 2FA for writes. Re-run with `--otp <code>`:");
+			print(`    pnpm exec tsx packages/cli/src/cli.ts npm publish-initial --otp <6-digit-code>`);
 		}
-		const patched = pattern.patch(content, from, to);
-		if (patched === null) continue;
-		const rel = abs.startsWith(cwd + "/") ? abs.slice(cwd.length + 1) : abs;
-		if (!dryRun) _writeFile(abs, patched);
-		print(`  ${dryRun ? "~" : "✓"} ${rel}`);
-		updated.push(rel);
+		return {
+			status: "fail",
+			message,
+			packageNames: PUBLISHABLE_PACKAGES
+		};
 	}
-	if (updated.length === 0) print(`  · no files contained Node.js ${from} pins`);
+	print("    ✓ publish complete");
+	printNextSteps$1(print, env);
 	return {
-		status: dryRun ? "dry-run" : "ok",
-		updated
+		status: "ok",
+		packageNames: PUBLISHABLE_PACKAGES
 	};
 }
+function printNextSteps$1(print, env) {
+	print("");
+	print("  → next: configure Trusted Publisher for each package on npm:");
+	for (const name of PUBLISHABLE_PACKAGES) print(`    https://www.npmjs.com/package/${name}/access`);
+	print("    Publisher: GitHub Actions   Org: theholocron   Repo: holocron   Workflow: release.yml");
+	if (env.NPM_TOKEN) {
+		print("");
+		print("  → cleanup: $NPM_TOKEN was used. Revoke it now (no API for self-revoke; UI-only):");
+		print("    https://www.npmjs.com/settings/~/tokens");
+	}
+}
+const defaultExec$2 = async (cmd, args, opts) => {
+	const result = spawnSync(cmd, args, {
+		cwd: opts.cwd,
+		encoding: "utf8",
+		stdio: [
+			"inherit",
+			"pipe",
+			"pipe"
+		]
+	});
+	return {
+		exitCode: result.status ?? -1,
+		stdout: result.stdout ?? "",
+		stderr: result.stderr ?? ""
+	};
+};
 //#endregion
-//#region src/templates/actions/setup.yml
-var setup_default = "name: Setup\ndescription: Prepare the environment and install project dependencies.\n\ninputs:\n  node-version:\n    description: Node.js version\n    required: false\n    default: \"22.x\"\n\nruns:\n  using: composite\n\n  steps:\n    - uses: theholocron/.github/.github/actions/setup-node@main\n      with:\n        node-version: ${{ inputs.node-version }}\n\n    - uses: theholocron/.github/.github/actions/install@main\n";
-//#endregion
-//#region src/templates/actions/install.yml
-var install_default = "name: Install dependencies\ndescription: Install project dependencies with pnpm frozen lockfile.\n\nruns:\n  using: composite\n\n  steps:\n    - name: Install dependencies\n      if: ${{ hashFiles('pnpm-lock.yaml') != '' }}\n      shell: bash\n      run: pnpm install --frozen-lockfile\n";
-//#endregion
-//#region src/templates/actions/setup-node.yml
-var setup_node_default = "name: Setup Node\ndescription: Install pnpm and Node.js with pnpm dependency caching.\n\ninputs:\n  node-version:\n    description: Node.js version\n    required: false\n    default: \"22.x\"\n\nruns:\n  using: composite\n\n  steps:\n    - name: Setup pnpm\n      if: ${{ hashFiles('pnpm-lock.yaml') != '' }}\n      uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4\n\n    - name: Setup Node.js\n      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4\n      with:\n        node-version: ${{ hashFiles('.node-version') != '' && '' || inputs.node-version }}\n        node-version-file: ${{ hashFiles('.node-version') != '' && '.node-version' || '' }}\n        cache: ${{ hashFiles('pnpm-lock.yaml') != '' && 'pnpm' || '' }}\n\n    - name: Add node_modules/.bin to PATH\n      shell: bash\n      run: echo \"$GITHUB_WORKSPACE/node_modules/.bin\" >> $GITHUB_PATH\n";
+//#region src/commands/plugin-create/template-inputs.ts
+/** Derive the standard defaults from a slug + vendor name. */
+function deriveDefaults$1(input) {
+	const vendorUpper = input.slug.toUpperCase().replace(/-/g, "_");
+	const capability = input.capability;
+	return {
+		vendorUpper,
+		capabilityClass: `${input.vendorName}${capability.charAt(0).toUpperCase() + capability.slice(1)}`,
+		tokenEnv: `HOLOCRON_${vendorUpper}_TOKEN`,
+		transport: "rest"
+	};
+}
 //#endregion
-//#region src/templates/workflows/audit.yml
-var audit_default$1 = "name: Audit\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      build-script:\n        description: Script to build and upload bundle stats to Codecov\n        type: string\n        required: false\n        default: pnpm build\n      run-knip:\n        description: Run Knip to detect unused files, exports, and dependencies\n        type: boolean\n        required: false\n        default: false\n      knip-script:\n        description: Script that invokes Knip (must exit non-zero on findings)\n        type: string\n        required: false\n        default: pnpm run audit\n    secrets:\n      CODECOV_TOKEN:\n        required: false\n\njobs:\n  bundle-size:\n    name: Audit the bundle size\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    concurrency:\n      group: audit-${{ github.ref }}\n      cancel-in-progress: true\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: eval \"$BUILD_SCRIPT\"\n        name: Build and upload bundle stats\n        env:\n          BUILD_SCRIPT: ${{ inputs.build-script }}\n          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}\n\n  knip:\n    name: Knip\n    if: ${{ inputs.run-knip }}\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          persist-credentials: false\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: eval \"$KNIP_SCRIPT\"\n        name: Run Knip\n        env:\n          KNIP_SCRIPT: ${{ inputs.knip-script }}\n";
+//#region src/commands/plugin-create/templates/auth.ts
+function render$17(inputs) {
+	return `import { AuthError, createResolveToken, type ResolveTokenInput } from "@theholocron/cli";
+
+export { AuthError };
+export type { ResolveTokenInput };
+
+export const resolveToken = createResolveToken({
+\tenvName: "${inputs.tokenEnv}",
+\tvendorEnvName: "${inputs.vendorEnv}",
+\tkeyringService: "${inputs.slug}",
+\terrorMessage:
+\t\t"no ${inputs.vendorName} token found. Pass --token <TOKEN>, set ${inputs.tokenEnv} / ${inputs.vendorEnv}, " +
+\t\t"or run: holocron auth set ${inputs.slug} <TOKEN>",
+});
+`;
+}
 //#endregion
-//#region src/templates/workflows/bookkeeping.yml
-var bookkeeping_default$1 = "name: Bookkeeping\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      configuration-path:\n        description: Path to the labeler configuration file in the calling repo\n        type: string\n        required: false\n        default: .github/labeler.yml\n\njobs:\n  label:\n    name: Apply Labels\n    permissions:\n      contents: read\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    concurrency:\n      group: bookkeeping-${{ github.event.pull_request.number || github.event.issue.number }}\n      cancel-in-progress: true\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          sparse-checkout: ${{ inputs.configuration-path || '.github/labeler.yml' }}\n          sparse-checkout-cone-mode: false\n\n      - uses: github/issue-labeler@c1b0f9f52a63158c4adc09425e858e87b32e9685 # v3.4\n        if: ${{ github.event_name == 'pull_request' && hashFiles(inputs.configuration-path || '.github/labeler.yml') != '' }}\n        # v3.4 bundles Node 20; allow it to run under Actions' current default.\n        env:\n          ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true\n        with:\n          # Fall back to default path when triggered directly (not via workflow_call)\n          # because inputs.* defaults only apply on workflow_call events.\n          configuration-path: ${{ inputs.configuration-path || '.github/labeler.yml' }}\n          include-title: 1\n          include-body: 0\n          sync-labels: 1\n          enable-versioned-regex: 0\n          repo-token: ${{ github.token }}\n";
-//#endregion
-//#region src/templates/workflows/codeql.yml
-var codeql_default$1 = "name: CodeQL\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      language:\n        description: CodeQL language to analyze\n        type: string\n        required: false\n        default: javascript-typescript\n\njobs:\n  analyze:\n    name: Analyze (${{ inputs.language }})\n    permissions:\n      actions: read\n      contents: read\n      security-events: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 45\n    # Do not cancel in-progress security scans.\n    concurrency:\n      group: codeql-${{ github.ref }}\n      cancel-in-progress: false\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0\n        name: Initialize CodeQL\n        with:\n          languages: ${{ inputs.language }}\n\n      - uses: github/codeql-action/autobuild@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0\n        name: Autobuild\n\n      - uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0\n        name: Analyze\n        with:\n          category: /language:${{ inputs.language }}\n";
-//#endregion
-//#region src/templates/workflows/dependencies.yml
-var dependencies_default$1 = "name: Dependencies\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      merge-token:\n        description: >\n          Optional privileged token for auto-merge. Falls back to GITHUB_TOKEN.\n          Required when branch protection enforces required reviews — GITHUB_TOKEN\n          cannot approve its own PRs.\n        required: false\n\njobs:\n  dependabot:\n    name: Update the dependencies\n    permissions:\n      contents: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    concurrency:\n      group: dependencies-${{ github.event.pull_request.number }}\n      cancel-in-progress: true\n    if: github.event.pull_request.user.login == 'dependabot[bot]'\n    steps:\n      - uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0\n        name: Fetch Dependabot metadata\n        id: metadata\n\n      - run: gh pr merge --auto --squash \"$PR_URL\"\n        # --squash is intentional: repo protection sets allow_merge_commit: false,\n        # so --merge would fail on any repo using the standard preset.\n        name: Enable auto-merge for Dependabot PRs\n        if: steps.metadata.outputs.update-type == 'version-update:semver-patch'\n        env:\n          PR_URL: ${{ github.event.pull_request.html_url }}\n          GH_TOKEN: ${{ secrets.merge-token || github.token }}\n";
-//#endregion
-//#region src/templates/workflows/greetings.yml
-var greetings_default$1 = "name: Greetings\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n\njobs:\n  greeting:\n    name: Greet first-time contributors\n    permissions:\n      issues: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    # Group by the issue/PR number so duplicate events don't race each other.\n    concurrency:\n      group: greetings-${{ github.event.issue.number || github.event.pull_request.number }}\n      cancel-in-progress: false\n    steps:\n      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n        name: Greet on first contribution\n        with:\n          script: |\n            // Only greet on the initial open — ignore synchronize, reopened, etc.\n            if (context.payload.action !== 'opened') return;\n\n            const actor = context.actor;\n            const { owner, repo } = context.repo;\n\n            // Payload inspection is more reliable than context.eventName for detecting\n            // whether this is an issue vs. PR event — works regardless of how GitHub\n            // propagates event names through workflow_call chains.\n            const isIssue = !!context.payload.issue && !context.payload.pull_request;\n            // listForRepo returns both issues and PRs (GitHub treats PRs as issues),\n            // sorted newest-first. Filter by type to track first-issue and first-PR\n            // independently, and avoid search-index eventual-consistency lag.\n            const { data: recent } = await github.rest.issues.listForRepo({\n              owner, repo,\n              creator: actor,\n              state: 'all',\n              per_page: 100\n            });\n\n            const sameType = recent.filter(item =>\n              isIssue ? !item.pull_request : !!item.pull_request\n            );\n\n            if (sameType.length !== 1) return;\n            const body = isIssue\n              ? `Hey @${actor}!\\n\\nWe really appreciate you taking the time to report an issue. The collaborators on this project attempt to help as many people as possible, but we are a limited number of volunteers, so it is possible that this will not be addressed as swiftly.\\n\\nYour patience is much appreciated and we will get back to you as quickly as possible.`\n              : `Hey @${actor}!\\n\\nWe really appreciate you taking the time to help out with this PR. The collaborators on this project attempt to help as many people as possible, but we are a limited number of volunteers, so it is possible that this will not be addressed as swiftly.\\n\\nYour patience is much appreciated and we will get back to you as quickly as possible.`;\n\n            await github.rest.issues.createComment({\n              owner,\n              repo,\n              issue_number: context.issue.number,\n              body\n            });\n";
-//#endregion
-//#region src/templates/workflows/lint.yml
-var lint_default$1 = "name: Lint\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      prettier-config:\n        type: string\n        required: false\n        default: prettier.config.js\n      yaml-config:\n        type: string\n        required: false\n        default: yamllint.config.yml\n      enable-auto-commit:\n        description: Auto-commit super-linter fixes via GPG-signed commit\n        type: boolean\n        required: false\n        default: false\n    secrets:\n      SUPER_LINTER_GPG_PRIVATE_KEY:\n        required: false\n      SUPER_LINTER_GPG_PASSPHRASE:\n        required: false\n\njobs:\n  super-lint:\n    name: Lint entire codebase\n    permissions:\n      contents: write\n      statuses: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    env:\n      GPG_KEY_SET: ${{ secrets.SUPER_LINTER_GPG_PRIVATE_KEY != '' }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n          token: ${{ github.token }}\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n        if: ${{ hashFiles('pnpm-lock.yaml') != '' }}\n\n      - uses: super-linter/super-linter/slim@4ce20838b8ab83717e78138c5b3a1407148e0918 # v8.7.0\n        name: Run Super Linter\n        env:\n          GITHUB_TOKEN: ${{ github.token }}\n          DEFAULT_BRANCH: ${{ github.event.pull_request.base.ref || github.event.repository.default_branch }}\n          ANNOTATE_ONLY: true\n          DISABLE_COMMENTS: false\n          IGNORE_GITIGNORED_FILES: true\n          LINTER_RULES_PATH: /\n          EDITORCONFIG_FILE_NAME: \".editorconfig-checker.json\"\n          FIX_ENV: true\n          FIX_GRAPHQL_PRETTIER: true\n          FIX_HTML_PRETTIER: true\n          FIX_JAVASCRIPT_PRETTIER: true\n          FIX_JSX_PRETTIER: true\n          FIX_MARKDOWN_PRETTIER: true\n          FIX_TSX: true\n          FIX_TYPESCRIPT_PRETTIER: true\n          PRETTIER_CONFIG: ${{ inputs.prettier-config }}\n          VALIDATE_DOCKERFILE: true\n          VALIDATE_EDITORCONFIG: true\n          VALIDATE_ENV: true\n          VALIDATE_GIT_COMMITLINT: true\n          VALIDATE_GIT_MERGE_CONFLICT_MARKERS: true\n          VALIDATE_GITHUB_ACTIONS: true\n          VALIDATE_GITLEAKS: true\n          VALIDATE_GRAPHQL_PRETTIER: true\n          VALIDATE_HTML_PRETTIER: true\n          VALIDATE_JAVASCRIPT_PRETTIER: true\n          VALIDATE_JSX_PRETTIER: true\n          VALIDATE_MARKDOWN_PRETTIER: true\n          VALIDATE_TSX: true\n          VALIDATE_TYPESCRIPT_PRETTIER: true\n          VALIDATE_YAML: true\n          YAML_CONFIG_FILE: ${{ inputs.yaml-config }}\n\n      - uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0\n        name: Import GPG Key\n        # Conditions mirror auto-commit exactly — no point importing GPG if the\n        # commit step will be skipped (fork PR, default branch, or secret unset).\n        if: >\n          inputs.enable-auto-commit == true &&\n          github.event.pull_request != null &&\n          github.event.pull_request.head.repo.full_name == github.repository &&\n          github.ref_name != github.event.repository.default_branch &&\n          env.GPG_KEY_SET == 'true'\n        with:\n          git_user_signingkey: true\n          git_commit_gpgsign: true\n          GPG_PRIVATE_KEY: ${{ secrets.SUPER_LINTER_GPG_PRIVATE_KEY }}\n          PASSPHRASE: ${{ secrets.SUPER_LINTER_GPG_PASSPHRASE }}\n\n      - uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d # v7.2.0\n        name: Commit and push linting fixes\n        if: >\n          inputs.enable-auto-commit == true &&\n          github.event.pull_request != null &&\n          github.event.pull_request.head.repo.full_name == github.repository &&\n          github.ref_name != github.event.repository.default_branch &&\n          env.GPG_KEY_SET == 'true'\n        with:\n          branch: ${{ github.event.pull_request.head.ref || github.head_ref || github.ref }}\n          commit_message: \"chore: fix linting issues\\n\\nSigned-off-by: super-linter <super-linter@super-linter.dev>\"\n          commit_options: \"--no-verify\"\n          commit_user_name: super-linter\n          commit_user_email: super-linter@super-linter.dev\n";
-//#endregion
-//#region src/templates/workflows/release.yml
-var release_default$1 = "name: Release\n\n# Semantic-release with OIDC Trusted Publishing — no NPM_TOKEN required.\n# The calling repo must have a .releaserc.json that configures branches,\n# plugins, and any publish options. npm@11+ is installed to support OIDC.\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      run-build:\n        description: Run `pnpm build` before releasing\n        type: boolean\n        required: false\n        default: true\n    secrets:\n      HOLOCRON_RELEASE_TOKEN:\n        description: >\n          Fine-grained PAT (Contents + Issues + Pull requests: write) owned by\n          an admin. Required when the default branch is protected by a ruleset —\n          github.token cannot push through rulesets, but an admin PAT can.\n          Takes priority over HOLOCRON_SYNC_TOKEN. Falls back to github.token.\n        required: false\n      HOLOCRON_SYNC_TOKEN:\n        description: >\n          Legacy alias for HOLOCRON_RELEASE_TOKEN — kept for backward compatibility.\n          Prefer HOLOCRON_RELEASE_TOKEN for new repos.\n        required: false\n      HOLOCRON_READ_TOKEN:\n        description: >\n          Fine-grained PAT for read-only GitHub API calls (e.g. resolving git\n          committer identity via `gh api user`). Falls back to github.token.\n        required: false\n      GH_TOKEN:\n        description: >\n          Generic GitHub token fallback for `gh` CLI calls. Used when\n          HOLOCRON_READ_TOKEN is not set.\n        required: false\n\njobs:\n  release:\n    name: Semantic release\n    permissions:\n      contents: write\n      id-token: write\n      issues: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    # Do not cancel in-progress releases — a partial release is worse than a slow one.\n    concurrency:\n      group: release-${{ github.ref }}\n      cancel-in-progress: false\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n          # Use HOLOCRON_RELEASE_TOKEN when available — git push (tags, release commits)\n          # uses the checkout credential, not GITHUB_TOKEN env var. The\n          # built-in github.token cannot push through branch protection rulesets.\n          token: ${{ secrets.HOLOCRON_RELEASE_TOKEN || secrets.HOLOCRON_SYNC_TOKEN || github.token }}\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - name: Configure git identity\n        run: |\n          GIT_NAME=$(gh api user --jq .name 2>/dev/null || echo \"github-actions[bot]\")\n          GIT_EMAIL=$(gh api user --jq '\"\\(.id)+\\(.login)@users.noreply.github.com\"' 2>/dev/null || echo \"41898282+github-actions[bot]@users.noreply.github.com\")\n          git config --global user.name \"$GIT_NAME\"\n          git config --global user.email \"$GIT_EMAIL\"\n          git config --global format.signoff true\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_READ_TOKEN || secrets.GH_TOKEN || github.token }}\n\n      - run: npm install -g npm@11 sigstore\n        name: Upgrade npm for OIDC support\n        # sigstore is required by libnpmpublish/provenance.js at module parse\n        # time — before any config takes effect. Some npm 11.x builds stopped\n        # bundling it; installing it globally into the same prefix ensures it\n        # resolves regardless of npm version. (Discovered 2026-07-09.)\n\n      - run: pnpm build\n        name: Build\n        if: ${{ inputs.run-build == true }}\n\n      - run: npx semantic-release\n        name: Release\n        env:\n          # Prefer HOLOCRON_RELEASE_TOKEN (fine-grained PAT, Contents+Issues+PRs write,\n          # owned by an admin with ruleset bypass) so @semantic-release/git can\n          # push the version-bump commit through branch protection. Falls back to\n          # HOLOCRON_SYNC_TOKEN (legacy) then github.token for unprotected repos.\n          GITHUB_TOKEN: ${{ secrets.HOLOCRON_RELEASE_TOKEN || secrets.HOLOCRON_SYNC_TOKEN || github.token }}\n          NPM_CONFIG_PROVENANCE: true\n";
-//#endregion
-//#region src/templates/workflows/review.yml
-var review_default$1 = "name: Review\n\n# ReviewDog is the annotation layer — posts inline PR diff annotations.\n# Runs on pull_request only: inline annotations require PR context,\n# and branch protection ensures all changes go through PRs anyway.\n# super-linter (lint.yml) is the CI gate covering push + PR events.\n# Gitleaks and YAML are intentionally duplicated: super-linter gates\n# merges; ReviewDog surfaces exact line annotations in the PR diff.\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n\nconcurrency:\n  group: review-${{ github.workflow }}-${{ github.ref }}\n  cancel-in-progress: true\n\njobs:\n  reviewdog:\n    name: Review PRs\n    runs-on: ubuntu-latest\n    timeout-minutes: 20\n    permissions:\n      contents: read\n      pull-requests: write\n\n    steps:\n      - name: Checkout repository\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          fetch-depth: 0\n\n      - name: Setup\n        if: ${{ hashFiles('pnpm-lock.yaml') != '' }}\n        uses: theholocron/.github/.github/actions/setup@main\n\n      - name: Install ReviewDog\n        uses: reviewdog/action-setup@d8a7baabd7f3e8544ee4dbde3ee41d0011c3a93f # v1\n        with:\n          reviewdog_version: latest\n\n      # Detect which tools are relevant for this repo, excluding node_modules.\n      # hashFiles('**/*') recurses into node_modules/.pnpm and produces false\n      # positives for repos that don't own those file types.\n      # -print -quit stops find after the first match without a pipe, avoiding\n      # the SIGPIPE/pipefail exit-141 that find|head-1 triggers under\n      # GitHub Actions' default bash --noprofile --norc -e -o pipefail mode.\n      - name: Detect project features\n        id: detect\n        shell: bash\n        run: |\n          has() { find . -not -path '*/node_modules/*' -name \"$1\" -print -quit 2>/dev/null | grep -q .; }\n          has_ext() { find . -not -path '*/node_modules/*' -name \"$1\" -print -quit 2>/dev/null | grep -q .; }\n          { { has 'eslint.config.js' || has 'eslint.config.mjs' || has 'eslint.config.cjs' || \\\n              has 'eslint.config.ts' || has '.eslintrc' || has '.eslintrc.js' || \\\n              has '.eslintrc.cjs' || has '.eslintrc.json' || has '.eslintrc.yaml' || \\\n              has '.eslintrc.yml'; } && grep -qF '\"eslint\":' package.json 2>/dev/null; } && echo \"eslint=true\" >> \"$GITHUB_OUTPUT\" || echo \"eslint=false\" >> \"$GITHUB_OUTPUT\"\n          { has 'tsconfig.json' && grep -qF '\"typescript\":' package.json 2>/dev/null; } && echo \"tsconfig=true\" >> \"$GITHUB_OUTPUT\" || echo \"tsconfig=false\" >> \"$GITHUB_OUTPUT\"\n          has_ext '*.sh' && echo \"shell=true\" >> \"$GITHUB_OUTPUT\" || echo \"shell=false\" >> \"$GITHUB_OUTPUT\"\n          has 'Dockerfile' || has_ext '*.Dockerfile' || has 'Containerfile' && \\\n            echo \"docker=true\" >> \"$GITHUB_OUTPUT\" || echo \"docker=false\" >> \"$GITHUB_OUTPUT\"\n          has_ext '.env*' && echo \"dotenv=true\" >> \"$GITHUB_OUTPUT\" || echo \"dotenv=false\" >> \"$GITHUB_OUTPUT\"\n          has_ext '*.md' && echo \"markdown=true\" >> \"$GITHUB_OUTPUT\" || echo \"markdown=false\" >> \"$GITHUB_OUTPUT\"\n\n      #\n      # Always applicable\n      #\n\n      - name: Gitleaks (secrets)\n        uses: reviewdog/action-gitleaks@2b7b5685e3e3eecddab5d30cfa04f18123031421 # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / gitleaks\"\n          gitleaks_flags: --log-opts=${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }}\n\n      - name: YamlLint\n        if: ${{ hashFiles('yamllint.config.yml') != '' }}\n        uses: reviewdog/action-yamllint@b5f7217d8c815ae374d1d55840d5e569d82f01f0 # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / yamllint\"\n          yamllint_flags: -c ${{ github.workspace }}/yamllint.config.yml ${{ github.workspace }}\n\n      - name: ActionLint (GitHub Actions)\n        if: ${{ hashFiles('.github/workflows/*.yml', '.github/workflows/*.yaml') != '' }}\n        uses: reviewdog/action-actionlint@6fb7acc99f4a1008869fa8a0f09cfca740837d9d # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / actionlint\"\n\n      #\n      # TypeScript / JavaScript\n      #\n\n      - name: ESLint\n        if: steps.detect.outputs.eslint == 'true'\n        uses: reviewdog/action-eslint@556a3fdaf8b4201d4d74d406013386aa4f7dab96 # v1.34.0\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / eslint\"\n          eslint_flags: .\n\n      - name: TypeScript\n        if: steps.detect.outputs.tsconfig == 'true'\n        uses: EPMatt/reviewdog-action-tsc@63d923a3c5b4497671940b8874f58a404e2351b5 # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / tsc\"\n\n      #\n      # Shell\n      #\n\n      - name: ShellCheck\n        if: steps.detect.outputs.shell == 'true'\n        uses: reviewdog/action-shellcheck@4c07458293ac342d477251099501a718ae5ef86e # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / shellcheck\"\n          fail_level: none\n\n      #\n      # Docker\n      #\n\n      - name: Hadolint\n        if: steps.detect.outputs.docker == 'true'\n        uses: reviewdog/action-hadolint@1b2cfa6ba72072ad35158d7ff3aa49bbdc03506d # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / hadolint\"\n          fail_level: none\n\n      #\n      # Environment files\n      #\n\n      - name: dotenv-linter\n        if: steps.detect.outputs.dotenv == 'true'\n        uses: dotenv-linter/action-dotenv-linter@afde61cfda2ecffe7bea35837b6f20b956c88689 # v3.0.0\n        with:\n          reporter: github-code-suggestions\n\n      #\n      # Documentation\n      #\n\n      - name: Alex (inclusive language)\n        if: steps.detect.outputs.markdown == 'true'\n        uses: reviewdog/action-alex@347481655add010a2ae302df34b57c9bcfa0d6e4 # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / alex\"\n";
-//#endregion
-//#region src/templates/workflows/stale.yml
-var stale_default$1 = "name: Stale\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      days-before-stale:\n        description: Days of inactivity before an issue is marked stale\n        type: number\n        required: false\n        default: 30\n      days-before-close:\n        description: Days of inactivity after stale label before closing\n        type: number\n        required: false\n        default: 5\n\njobs:\n  stale:\n    name: Mark stale issues and pull requests\n    permissions:\n      contents: write\n      issues: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    steps:\n      - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0\n        name: Run Stale\n        with:\n          close-issue-message: >\n            This issue was closed because it has been stalled for\n            ${{ inputs.days-before-close }} days with no activity.\n          days-before-close: ${{ inputs.days-before-close }}\n          days-before-stale: ${{ inputs.days-before-stale }}\n          exempt-all-pr-milestones: true\n          stale-issue-label: wontfix\n          stale-issue-message: >\n            This issue is stale because it has been open ${{ inputs.days-before-stale }}\n            days with no activity. Remove the stale label or comment, or this will be\n            closed in ${{ inputs.days-before-close }} days.\n          stale-pr-label: wontfix\n          stale-pr-message: >\n            This PR is stale because it has been open ${{ inputs.days-before-stale }}\n            days with no activity. Remove the stale label or comment, or this will be\n            closed in ${{ inputs.days-before-close }} days.\n";
-//#endregion
-//#region src/templates/workflows/sync-github.yml
-var sync_github_default$1 = "name: Sync GitHub Templates\n\n# Builds the holocron CLI from source and pushes updated workflow templates\n# and composite actions to downstream .github repos. Runs whenever the\n# template source files change on main or alpha.\n#\n# Secrets required:\n#   HOLOCRON_SYNC_TOKEN — fine-grained PAT (resource owner: org) with:\n#                  Contents:      Read and write  (git trees, blobs, refs)\n#                  Pull requests: Read and write  (open sync PR)\n#                  Workflows:     Read and write  (write .github/workflows/*.yml)\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      primary-repo:\n        description: >\n          Primary .github repo — receives composite actions, reusable workflows,\n          and thin-caller templates. Requires a PR (branch protection assumed).\n        type: string\n        required: false\n        default: theholocron/.github\n      secondary-repos:\n        description: >\n          Space-separated list of secondary repos (reusable workflows + thin\n          callers only, no composite actions). Changes are delivered via pull\n          request, same as the primary repo.\n        type: string\n        required: false\n        default: \"\"\n      sync-branch:\n        description: Branch name used for the primary and secondary repo PRs\n        type: string\n        required: false\n        default: chore/sync-templates\n    secrets:\n      HOLOCRON_SYNC_TOKEN:\n        required: true\n      HOLOCRON_READ_TOKEN:\n        description: >\n          Fine-grained PAT for read-only GitHub API calls (e.g. resolving git\n          committer identity via `gh api user`). Falls back to HOLOCRON_SYNC_TOKEN.\n        required: false\n      GH_TOKEN:\n        description: >\n          Generic GitHub token fallback for `gh` CLI calls. Used when neither\n          HOLOCRON_READ_TOKEN nor HOLOCRON_SYNC_TOKEN is set.\n        required: false\n\njobs:\n  sync:\n    name: Sync templates\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    permissions:\n      contents: read\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: pnpm build\n        name: Build CLI\n\n      - name: Validate generated workflows\n        run: |\n          node packages/cli/dist/cli.mjs sync-github \\\n            --repo \"$PRIMARY_REPO\" \\\n            --output-dir /tmp/sync-validate\n          curl -fsSL https://github.com/rhysd/actionlint/releases/download/v1.7.7/actionlint_1.7.7_linux_amd64.tar.gz \\\n            | tar -xz -C /tmp actionlint\n          /tmp/actionlint /tmp/sync-validate/.github/workflows/*.yml\n        env:\n          PRIMARY_REPO: ${{ inputs.primary-repo }}\n\n      - name: Sync primary repo (PR)\n        run: |\n          GIT_NAME=$(gh api user --jq .name 2>/dev/null || echo \"github-actions[bot]\")\n          GIT_EMAIL=$(gh api user --jq '\"\\(.id)+\\(.login)@users.noreply.github.com\"' 2>/dev/null || echo \"41898282+github-actions[bot]@users.noreply.github.com\")\n          COMMIT_MSG=\"chore: sync from theholocron/holocron\"$'\\n\\n'\"Signed-off-by: $GIT_NAME <$GIT_EMAIL>\"\n          node packages/cli/dist/cli.mjs sync-github \\\n            --repo \"$PRIMARY_REPO\" \\\n            --branch \"$SYNC_BRANCH\" \\\n            --pr \\\n            --message \"$COMMIT_MSG\"\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_READ_TOKEN || secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN }}\n          HOLOCRON_SYNC_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN }}\n          PRIMARY_REPO: ${{ inputs.primary-repo }}\n          SYNC_BRANCH: ${{ inputs.sync-branch }}\n\n      - name: Sync secondary repos (PR)\n        if: ${{ inputs.secondary-repos != '' }}\n        run: |\n          GIT_NAME=$(gh api user --jq .name 2>/dev/null || echo \"github-actions[bot]\")\n          GIT_EMAIL=$(gh api user --jq '\"\\(.id)+\\(.login)@users.noreply.github.com\"' 2>/dev/null || echo \"41898282+github-actions[bot]@users.noreply.github.com\")\n          COMMIT_MSG=\"chore: sync from theholocron/holocron\"$'\\n\\n'\"Signed-off-by: $GIT_NAME <$GIT_EMAIL>\"\n          for repo in $SECONDARY_REPOS; do\n            node packages/cli/dist/cli.mjs sync-github \\\n              --repo \"$repo\" \\\n              --branch \"$SYNC_BRANCH\" \\\n              --pr \\\n              --message \"$COMMIT_MSG\"\n          done\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_READ_TOKEN || secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN }}\n          HOLOCRON_SYNC_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN }}\n          SECONDARY_REPOS: ${{ inputs.secondary-repos }}\n          SYNC_BRANCH: ${{ inputs.sync-branch }}\n";
-//#endregion
-//#region src/templates/workflows/test.yml
-var test_default$1 = "name: Test\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      CODECOV_TOKEN:\n        required: false\n\njobs:\n  unit:\n    name: Run tests and collect coverage\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: pnpm test -- --coverage\n        name: Run tests with coverage\n\n      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0\n        name: Upload coverage to Codecov\n        with:\n          token: ${{ secrets.CODECOV_TOKEN }}\n\n      - uses: codecov/test-results-action@0fa95f0e1eeaafde2c782583b36b28ad0d8c77d3 # v1\n        name: Upload test results to Codecov\n        if: ${{ !cancelled() }}\n        with:\n          token: ${{ secrets.CODECOV_TOKEN }}\n          files: '**/test-report.junit.xml'\n";
-//#endregion
-//#region src/templates/workflows/typecheck.yml
-var typecheck_default$1 = "name: Typecheck\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n\njobs:\n  typecheck:\n    name: tsc --noEmit\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: pnpm typecheck\n        name: Type check\n";
-//#endregion
-//#region src/templates/index.ts
-/**
-* All reusable workflow and composite action content bundled as string
-* constants so the CLI can push them to theholocron/.github without
-* needing filesystem access at runtime.
-*
-* Content lives in standalone .yml files; the rawYml rollup plugin
-* inlines them as string exports at build time.
-*/
-const ACTIONS = {
-	"setup/action": setup_default,
-	"install/action": install_default,
-	"setup-node/action": setup_node_default
-};
-const REUSABLE_WORKFLOWS = {
-	audit: audit_default$1,
-	bookkeeping: bookkeeping_default$1,
-	codeql: codeql_default$1,
-	dependencies: dependencies_default$1,
-	greetings: greetings_default$1,
-	lint: lint_default$1,
-	release: release_default$1,
-	review: review_default$1,
-	stale: stale_default$1,
-	"sync-github": sync_github_default$1,
-	test: test_default$1,
-	typecheck: typecheck_default$1
-};
-const WORKFLOW_TEMPLATE_PROPERTIES = {
-	bookkeeping: JSON.stringify({
-		name: "Bookkeeping",
-		description: "Label and track issues and pull requests.",
-		iconName: "octicon tag"
-	}, null, 2),
-	"sync-github": JSON.stringify({
-		name: "Sync GitHub Templates",
-		description: "Sync workflow templates and composite actions from the holocron CLI.",
-		iconName: "octicon sync"
-	}, null, 2)
-};
-//#endregion
-//#region src/commands/dependabot.yml
-var dependabot_default = "# AUTO-GENERATED by holocron — run `holocron setup` to regenerate.\nversion: 2\nupdates:\n  - package-ecosystem: npm\n    directory: /\n    schedule:\n      interval: weekly\n    groups:\n      security-patches:\n        applies-to: security-updates\n        patterns:\n          - \"*\"\n      all-dependencies:\n        update-types:\n          - minor\n          - patch\n\n  - package-ecosystem: github-actions\n    directory: /\n    schedule:\n      interval: weekly\n    groups:\n      all-actions:\n        patterns:\n          - \"*\"\n";
-//#endregion
-//#region src/commands/workflows/audit.yml
-var audit_default = "name: Audit\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\npermissions:\n  contents: read\n\njobs:\n  audit:\n    uses: theholocron/.github/.github/workflows/audit.yml@main\n    secrets: inherit\n";
-//#endregion
-//#region src/commands/workflows/bookkeeping.yml
-var bookkeeping_default = "name: Bookkeeping\n\non: # yamllint disable-line rule:truthy\n  pull_request:\n    types:\n      - opened\n      - edited\n\npermissions:\n  contents: read\n  pull-requests: write\n\njobs:\n  bookkeeping:\n    uses: theholocron/.github/.github/workflows/bookkeeping.yml@main\n    secrets: inherit\n";
-//#endregion
-//#region src/commands/workflows/codeql.yml
-var codeql_default = "name: CodeQL\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches:\n      - main\n  pull_request:\n    branches:\n      - main\n  schedule:\n    - cron: \"0 0 * * 1\"\n\npermissions:\n  actions: read\n  contents: read\n  security-events: write\n\njobs:\n  codeql:\n    uses: theholocron/.github/.github/workflows/codeql.yml@main\n    secrets: inherit\n";
-//#endregion
-//#region src/commands/workflows/dependencies.yml
-var dependencies_default = "name: Dependencies\n\non: # yamllint disable-line rule:truthy\n  pull_request:\n\npermissions:\n  contents: write\n  pull-requests: write\n\njobs:\n  dependencies:\n    uses: theholocron/.github/.github/workflows/dependencies.yml@main\n    secrets: inherit\n";
-//#endregion
-//#region src/commands/workflows/greetings.yml
-var greetings_default = "name: Greetings\n\non: # yamllint disable-line rule:truthy\n  pull_request:\n  issues:\n\npermissions:\n  issues: write\n  pull-requests: write\n\njobs:\n  greetings:\n    uses: theholocron/.github/.github/workflows/greetings.yml@main\n    secrets: inherit\n";
-//#endregion
-//#region src/commands/workflows/lint.yml
-var lint_default = "name: Lint\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\nconcurrency:\n  group: lint-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: write\n  statuses: write\n\njobs:\n  lint:\n    name: Lint\n    uses: theholocron/.github/.github/workflows/lint.yml@main\n    secrets: inherit\n    with:\n      enable-auto-commit: true\n";
-//#endregion
-//#region src/commands/workflows/release.yml
-var release_default = "name: Release\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches:\n      - main\n      - alpha\n  workflow_dispatch:\n\npermissions:\n  contents: write\n  id-token: write\n  issues: write\n  pull-requests: write\n\nconcurrency:\n  group: ${{ github.workflow }}-${{ github.ref }}\n  cancel-in-progress: false\n\njobs:\n  release:\n    uses: theholocron/.github/.github/workflows/release.yml@main\n    secrets: inherit\n";
-//#endregion
-//#region src/commands/workflows/review.yml
-var review_default = "name: Review\n\non: # yamllint disable-line rule:truthy\n  pull_request:\n\nconcurrency:\n  group: review-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n  checks: write\n  pull-requests: write\n\njobs:\n  review:\n    name: Review\n    uses: theholocron/.github/.github/workflows/review.yml@main\n    secrets: inherit\n";
-//#endregion
-//#region src/commands/workflows/stale.yml
-var stale_default = "name: Stale\n\non: # yamllint disable-line rule:truthy\n  schedule:\n    - cron: \"30 1 * * *\"\n\npermissions:\n  contents: write\n  issues: write\n  pull-requests: write\n\njobs:\n  stale:\n    uses: theholocron/.github/.github/workflows/stale.yml@main\n    secrets: inherit\n";
-//#endregion
-//#region src/commands/workflows/sync-github.yml
-var sync_github_default = "name: Sync GitHub Templates\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n    paths:\n      - packages/cli/src/templates/index.ts\n      - packages/cli/src/commands/setup-workflows.ts\n\nconcurrency:\n  group: sync-github-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n\njobs:\n  sync:\n    name: Sync\n    uses: theholocron/.github/.github/workflows/sync-github.yml@main\n    with:\n      secondary-repos: theholocron/.github-private\n    secrets:\n      HOLOCRON_SYNC_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN }}\n";
-//#endregion
-//#region src/commands/workflows/test.yml
-var test_default = "name: Test\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\nconcurrency:\n  group: test-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n\njobs:\n  test:\n    name: Test\n    uses: theholocron/.github/.github/workflows/test.yml@main\n    secrets: inherit\n";
-//#endregion
-//#region src/commands/workflows/typecheck.yml
-var typecheck_default = "name: Typecheck\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\nconcurrency:\n  group: typecheck-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n\njobs:\n  typecheck:\n    name: Typecheck\n    uses: theholocron/.github/.github/workflows/typecheck.yml@main\n    secrets: inherit\n";
-//#endregion
-//#region src/commands/setup-workflows.ts
-/** Header prepended when holocron setup writes a generated file to a repo. */
-function workflowHeader(source = "packages/cli/src/commands/setup-workflows.ts") {
-	return [
-		`# AUTO-GENERATED — do not edit directly.`,
-		`# Source:  theholocron/holocron · ${source}`,
-		`# Synced:  ${(/* @__PURE__ */ new Date()).toISOString()}`,
-		`# Tool:    holocron setup`,
-		`# Changes: run \`holocron setup\` to regenerate.`,
-		``
-	].join("\n");
-}
-const WORKFLOW_TEMPLATES = {
-	lint: lint_default,
-	test: test_default,
-	typecheck: typecheck_default,
-	codeql: codeql_default,
-	review: review_default,
-	release: release_default,
-	stale: stale_default,
-	greetings: greetings_default,
-	dependencies: dependencies_default,
-	bookkeeping: bookkeeping_default,
-	audit: audit_default,
-	"sync-github": sync_github_default
-};
-const KNOWN_WORKFLOWS = new Set(Object.keys(WORKFLOW_TEMPLATES));
-/**
-* GitHub check context name each CI workflow produces on a PR.
-*
-* The format is "{caller-workflow-name} / {reusable-job-name}". The caller
-* job's own `name:` field does NOT appear in the external check name — only
-* the calling workflow's top-level `name:` and the inner reusable-workflow
-* job name matter. Only workflows that gate merges are listed here.
-*/
-const WORKFLOW_CHECK_CONTEXTS = {
-	lint: "Lint / Lint entire codebase",
-	test: "Test / Run tests and collect coverage",
-	typecheck: "Typecheck / tsc --noEmit"
-};
-/**
-* Generate the thin caller content for a workflow, optionally injecting or
-* merging `with:` overrides into the jobs block.
-*
-* Two strategies are used depending on the template:
-* - Templates that already have a `with:` block (e.g. lint, sync-github):
-*   the override entries are merged in, replacing existing keys and appending
-*   new ones.
-* - Templates that end with `    secrets: inherit`: a new `with:` block is
-*   injected immediately before `secrets: inherit`.
-* If neither pattern matches the template, a warning is emitted and the
-* base template is returned unchanged.
-*/
-function generateThinCallerContent(name, withOverrides) {
-	const base = WORKFLOW_TEMPLATES[name];
-	if (!base) return "";
-	if (!withOverrides || Object.keys(withOverrides).length === 0) return base;
-	const fmt = (k, v) => `      ${k}: ${v === true ? "true" : v === false ? "false" : String(v)}`;
-	const withBlockRe = /( {4}with:\n)((?:[ ]{6}[^\n]+\n)*)/;
-	const existingMatch = base.match(withBlockRe);
-	if (existingMatch) {
-		const existingEntries = new Map(existingMatch[2].split("\n").filter(Boolean).map((line) => {
-			const m = line.match(/^ {6}([^:]+):\s*(.*)/);
-			return m ? [m[1].trim(), m[2].trim()] : null;
-		}).filter((e) => e !== null));
-		for (const [k, v] of Object.entries(withOverrides)) existingEntries.set(k, v === true ? "true" : v === false ? "false" : String(v));
-		const merged = [...existingEntries.entries()].map(([k, v]) => `      ${k}: ${v}`).join("\n");
-		return base.replace(withBlockRe, `    with:\n${merged}\n`);
-	}
-	const withBlock = Object.entries(withOverrides).map(([k, v]) => fmt(k, v)).join("\n");
-	const result = base.replace(/ {4}secrets: inherit\n$/, `    with:\n${withBlock}\n    secrets: inherit\n`);
-	if (result === base) console.warn(`[generateThinCallerContent] could not inject with: overrides into "${name}" template`);
-	return result;
-}
-//#endregion
-//#region src/commands/sync-github.ts
-const DEFAULT_REPO = "theholocron/.github";
-/**
-* Extracts the `workflows` array from a `holocron.config.ts` source string.
-* Handles both plain string entries and `{ name, with }` object entries.
-* Falls back to an empty array if the array cannot be found or parsed.
-*/
-function parseWorkflowsFromTs(source) {
-	const keyMatch = source.match(/\bworkflows\s*:\s*\[/);
-	if (!keyMatch) return [];
-	const start = keyMatch.index + keyMatch[0].length;
-	let depth = 1;
-	let i = start;
-	while (i < source.length && depth > 0) {
-		if (source[i] === "[") depth++;
-		else if (source[i] === "]") depth--;
-		i++;
-	}
-	const body = source.slice(start, i - 1);
-	const entries = [];
-	const objSpans = [];
-	const objRe = /\{\s*name\s*:\s*"([^"]+)"(?:\s*,\s*with\s*:\s*(\{[^}]*\}))?\s*\}/g;
-	let m;
-	while ((m = objRe.exec(body)) !== null) {
-		objSpans.push([m.index, m.index + m[0].length]);
-		let withObj;
-		if (m[2]) try {
-			withObj = JSON.parse(m[2]);
-		} catch {}
-		entries.push({
-			pos: m.index,
-			entry: {
-				name: m[1],
-				...withObj && { with: withObj }
-			}
-		});
-	}
-	const strRe = /"([^"]+)"/g;
-	while ((m = strRe.exec(body)) !== null) if (!objSpans.some(([s, e]) => m.index >= s && m.index < e)) entries.push({
-		pos: m.index,
-		entry: { name: m[1] }
-	});
-	entries.sort((a, b) => a.pos - b.pos);
-	return entries.map(({ entry }) => entry);
-}
-function reusableHeader(source) {
-	return [
-		`# AUTO-GENERATED — do not edit in theholocron/.github directly.`,
-		`# Source:  theholocron/holocron · ${source}`,
-		`# Synced:  ${(/* @__PURE__ */ new Date()).toISOString()}`,
-		`# Tool:    holocron sync-github`,
-		`# Changes: edit source in theholocron/holocron and push to alpha or main.`,
-		``
-	].join("\n");
-}
-function thinCallerHeader(forPrimary = false) {
-	return [
-		forPrimary ? `# AUTO-GENERATED — do not edit in theholocron/.github directly.` : `# AUTO-GENERATED — do not edit directly.`,
-		`# Source:  theholocron/holocron · packages/cli/src/commands/setup-workflows.ts`,
-		`# Synced:  ${(/* @__PURE__ */ new Date()).toISOString()}`,
-		`# Tool:    holocron sync-github`,
-		`# Changes: edit source in theholocron/holocron and push to alpha or main.`,
-		``
-	].join("\n");
-}
-function buildBatch(repo, allowedWorkflows, withOverrides) {
-	const files = [];
-	const isPrimaryGithubRepo = repo === DEFAULT_REPO;
-	if (isPrimaryGithubRepo) for (const [name, content] of Object.entries(ACTIONS)) files.push({
-		path: `.github/actions/${name}.yml`,
-		content: reusableHeader(`packages/cli/src/templates/index.ts`) + content
-	});
-	if (isPrimaryGithubRepo) {
-		for (const [name, content] of Object.entries(REUSABLE_WORKFLOWS)) files.push({
-			path: `.github/workflows/${name}.yml`,
-			content: reusableHeader(`packages/cli/src/templates/index.ts`) + content
-		});
-		for (const [name, content] of Object.entries(WORKFLOW_TEMPLATES)) {
-			files.push({
-				path: `workflow-templates/${name}.yml`,
-				content: thinCallerHeader(true) + content
-			});
-			const props = WORKFLOW_TEMPLATE_PROPERTIES[name];
-			if (props) files.push({
-				path: `workflow-templates/${name}.properties.json`,
-				content: props
-			});
-		}
-	} else for (const name of Object.keys(REUSABLE_WORKFLOWS)) {
-		if (allowedWorkflows && !allowedWorkflows.has(name)) continue;
-		const content = generateThinCallerContent(name, withOverrides?.get(name));
-		if (!content) continue;
-		files.push({
-			path: `.github/workflows/${name}.yml`,
-			content: thinCallerHeader() + content
-		});
-	}
-	return files;
-}
-/** Git blob SHA: sha1("blob {len}\0{content}") — used to detect unchanged files. */
-function gitBlobSha(content) {
-	const buf = Buffer.from(content, "utf8");
-	return createHash("sha1").update(`blob ${buf.length}\0`).update(buf).digest("hex");
-}
-async function runSyncGithub(input) {
-	const print = input.print ?? ((line) => console.log(line));
-	const repo = input.repo ?? DEFAULT_REPO;
-	const { token, dryRun = false, branch, createPr = false } = input;
-	const message = input.message ?? `chore: sync from theholocron/holocron`;
-	const client = createGitHubClient({
-		token,
-		fetch: input.fetch
-	});
-	print(`holocron sync-github${dryRun ? " (dry-run)" : ""}`);
-	print(`  repo:   ${repo}`);
-	if (branch) print(`  branch: ${branch}`);
-	print("");
-	if (input.outputDir) {
-		const batch = buildBatch(repo);
-		for (const file of batch) {
-			const dest = join(input.outputDir, file.path);
-			mkdirSync(dirname(dest), { recursive: true });
-			writeFileSync(dest, file.content, "utf8");
-		}
-		print(`  ${batch.length} files written to ${input.outputDir}`);
-		return {
-			status: "ok",
-			created: batch.length,
-			updated: 0,
-			unchanged: 0
-		};
-	}
-	let targetBranch = branch;
-	let defaultBranch;
-	if (!targetBranch || createPr) try {
-		defaultBranch = (await client.repos.getRepo(repo)).default_branch;
-		if (!targetBranch) targetBranch = defaultBranch;
-	} catch {
-		const msg = "failed to fetch repo metadata";
-		print(`  ✗ ${msg}`);
-		return {
-			status: "fail",
-			created: 0,
-			updated: 0,
-			unchanged: 0,
-			message: msg
-		};
-	}
-	const baseBranch = createPr && defaultBranch ? defaultBranch : targetBranch;
-	let headSha;
-	let baseTreeSha;
-	let existingBlobs;
-	try {
-		headSha = (await client.git.getRef(repo, baseBranch)).object.sha;
-		baseTreeSha = (await client.git.getCommit(repo, headSha)).tree.sha;
-		const treeData = await client.git.getTree(repo, baseTreeSha, true);
-		existingBlobs = new Map(treeData.tree.filter((i) => i.type === "blob").map((i) => [i.path, i.sha]));
-	} catch (err) {
-		const msg = err instanceof Error ? err.message : `Branch ${baseBranch} not found`;
-		print(`  ✗ ${msg}`);
-		return {
-			status: "fail",
-			created: 0,
-			updated: 0,
-			unchanged: 0,
-			message: msg
-		};
-	}
-	let allowedWorkflows;
-	let withOverrides;
-	if (repo !== DEFAULT_REPO) try {
-		let entries = [];
-		try {
-			const data = await client.git.getContents(repo, "holocron.config.json");
-			entries = (JSON.parse(Buffer.from(data.content.replace(/\n/g, ""), "base64").toString("utf8"))?.workflows ?? []).map((w) => typeof w === "string" ? { name: w } : w);
-		} catch (err) {
-			if (!(err instanceof ProviderApiError) || err.status !== 404) throw err;
-			try {
-				const data = await client.git.getContents(repo, "holocron.config.ts");
-				entries = parseWorkflowsFromTs(Buffer.from(data.content.replace(/\n/g, ""), "base64").toString("utf8"));
-			} catch {}
-		}
-		if (entries.length > 0) {
-			allowedWorkflows = new Set(entries.map((e) => e.name));
-			const overrideEntries = entries.filter((e) => e.with != null).map((e) => [e.name, e.with]);
-			if (overrideEntries.length > 0) withOverrides = new Map(overrideEntries);
-		}
-	} catch {}
-	const batch = buildBatch(repo, allowedWorkflows, withOverrides);
-	let created = 0;
-	let updated = 0;
-	let unchanged = 0;
-	const changedFiles = [];
-	for (const file of batch) {
-		const localSha = gitBlobSha(file.content);
-		const existingSha = existingBlobs.get(file.path);
-		if (existingSha === localSha) {
-			print(`  · unchanged  ${file.path}`);
-			unchanged++;
-		} else if (existingSha) {
-			print(`  ${dryRun ? "~" : "✓"} updated  ${file.path}`);
-			updated++;
-			if (!dryRun) changedFiles.push(file);
-		} else {
-			print(`  ${dryRun ? "~" : "✓"} created  ${file.path}`);
-			created++;
-			if (!dryRun) changedFiles.push(file);
-		}
-	}
-	print("");
-	print(`  ${created} created, ${updated} updated, ${unchanged} unchanged`);
-	if (dryRun || changedFiles.length === 0) return {
-		status: dryRun ? "dry-run" : "ok",
-		created,
-		updated,
-		unchanged
-	};
-	const treeEntries = [];
-	for (const file of changedFiles) try {
-		const blob = await client.git.createBlob(repo, file.content);
-		treeEntries.push({
-			path: file.path,
-			mode: "100644",
-			type: "blob",
-			sha: blob.sha
-		});
-	} catch (err) {
-		const msg = `failed to create blob for ${file.path}: ${err instanceof Error ? err.message : String(err)}`;
-		print(`  ✗ ${msg}`);
-		return {
-			status: "fail",
-			created,
-			updated,
-			unchanged,
-			message: msg
-		};
-	}
-	let newTreeSha;
-	try {
-		newTreeSha = (await client.git.createTree(repo, treeEntries, baseTreeSha)).sha;
-	} catch (err) {
-		const msg = `failed to create tree: ${err instanceof Error ? err.message : String(err)}`;
-		print(`  ✗ ${msg}`);
-		return {
-			status: "fail",
-			created,
-			updated,
-			unchanged,
-			message: msg
-		};
-	}
-	let newCommitSha;
-	try {
-		newCommitSha = (await client.git.createCommit(repo, message, newTreeSha, [headSha])).sha;
-	} catch (err) {
-		const msg = `failed to create commit: ${err instanceof Error ? err.message : String(err)}`;
-		print(`  ✗ ${msg}`);
-		return {
-			status: "fail",
-			created,
-			updated,
-			unchanged,
-			message: msg
-		};
-	}
-	try {
-		if (createPr && branch) try {
-			await client.git.createRef(repo, `refs/heads/${branch}`, newCommitSha);
-		} catch (err) {
-			if (!(err instanceof ProviderApiError) || err.status !== 422) throw err;
-			await client.git.updateRef(repo, `heads/${branch}`, newCommitSha, true);
-		}
-		else await client.git.updateRef(repo, `heads/${targetBranch}`, newCommitSha);
-	} catch (err) {
-		const msg = `failed to update ref: ${err instanceof Error ? err.message : String(err)}`;
-		print(`  ✗ ${msg}`);
-		return {
-			status: "fail",
-			created,
-			updated,
-			unchanged,
-			message: msg
-		};
-	}
-	let prUrl;
-	if (branch && createPr && !dryRun) try {
-		prUrl = (await client.git.createPull(repo, {
-			title: message.split("\n")[0],
-			head: branch,
-			base: "main",
-			body: "Auto-generated by `holocron sync-github`. Review and merge to apply template updates."
-		})).html_url;
-		print(`  → PR opened: ${prUrl}`);
-	} catch (err) {
-		if (err instanceof ProviderApiError && err.status === 422 && String(err.details).includes("already exists")) print(`  → PR already open for ${branch} — branch updated, ready to merge`);
-		else print(`  ⚠ PR creation failed: ${err instanceof Error ? err.message : String(err)}`);
-	}
-	return {
-		status: "ok",
-		created,
-		updated,
-		unchanged,
-		prUrl
-	};
-}
-//#endregion
-//#region src/commands/npm-publish-initial.ts
-/**
-* `holocron npm publish-initial` — bottles up the chicken-and-egg
-* bootstrap that every new npm-published holocron monorepo hits.
-*
-* npm requires a package to exist before Trusted Publishing can be
-* configured on it. So the first publish has to happen outside the
-* OIDC flow — using either a browser-auth session (`npm login
-* --auth-type=web`) or an ephemeral automation token. This command
-* runs the publish step + tells you exactly what to do next.
-*
-* Workflow:
-*
-*   $ npm login --auth-type=web          # one-time, browser-based
-*   $ pnpm install --frozen-lockfile
-*   $ pnpm build
-*   $ pnpm exec tsx packages/cli/src/cli.ts npm publish-initial
-*
-* The command itself only handles the publish step + the post-publish
-* Trusted Publisher setup reminder. `pnpm install` + `pnpm build`
-* stay outside the command (no pnpm-inside-pnpm).
-*
-* If `NPM_TOKEN` is detected in env, the command prints a final
-* "revoke this token at <url>" reminder — same pattern as `rando vc
-* setup` for the ephemeral GH admin PAT.
-*/
-const PUBLISHABLE_PACKAGES = [
-	"@theholocron/cli",
-	"@theholocron/holocron-plugin-github",
-	"@theholocron/holocron-plugin-vercel",
-	"@theholocron/holocron-plugin-neon",
-	"@theholocron/holocron-plugin-clerk",
-	"@theholocron/holocron-plugin-1password",
-	"@theholocron/holocron-plugin-postman"
-];
-async function runNpmPublishInitial(input = {}) {
-	const print = input.print ?? ((line) => console.log(line));
-	const cwd = input.cwd ?? process.cwd();
-	const tag = input.tag ?? "alpha";
-	const dryRun = input.dryRun ?? false;
-	const otp = input.otp;
-	const env = input.env ?? process.env;
-	const exec = input.exec ?? defaultExec$2;
-	const publishArgs = [
-		"-r",
-		"--filter=./packages/*",
-		"publish",
-		"--access",
-		"public",
-		"--no-git-checks",
-		"--tag",
-		tag,
-		...otp ? ["--otp", otp] : []
-	];
-	print(`Holocron npm publish-initial${dryRun ? " (dry-run)" : ""}`);
-	print(`  cwd: ${cwd}`);
-	print(`  tag: ${tag}`);
-	if (otp) print(`  otp: <${otp.length} chars>`);
-	print("");
-	print("  → verifying npm auth (`npm whoami`)…");
-	const whoami = await exec("npm", ["whoami"], { cwd });
-	if (whoami.exitCode !== 0) {
-		const message = "npm is not authenticated. Run `npm login --auth-type=web` (browser flow, no token stored) or `npm login`, then re-run this command.";
-		print(`  ✗ ${message}`);
-		return {
-			status: "fail",
-			message,
-			packageNames: PUBLISHABLE_PACKAGES
-		};
-	}
-	print(`    ✓ authed as ${whoami.stdout.trim() || "<unknown>"}`);
-	if (dryRun) {
-		print("");
-		print("  … (dry-run) skipping actual publish");
-		print(`    would run: pnpm ${publishArgs.join(" ")}`);
-		printNextSteps$1(print, env);
-		return {
-			status: "dry-run",
-			message: "dry-run — no publish executed",
-			packageNames: PUBLISHABLE_PACKAGES
-		};
-	}
-	print("");
-	print("  → publishing all public @theholocron/* packages…");
-	const publish = await exec("pnpm", publishArgs, { cwd });
-	if (publish.exitCode !== 0) {
-		const message = `publish failed (exit ${publish.exitCode}): ${publish.stderr.trim() || publish.stdout.trim() || "no output"}`;
-		print(`  ✗ ${message}`);
-		if (publish.stdout.includes("EOTP") || publish.stderr.includes("EOTP")) {
-			print("");
-			print("  → hint: your npm account requires 2FA for writes. Re-run with `--otp <code>`:");
-			print(`    pnpm exec tsx packages/cli/src/cli.ts npm publish-initial --otp <6-digit-code>`);
-		}
-		return {
-			status: "fail",
-			message,
-			packageNames: PUBLISHABLE_PACKAGES
-		};
-	}
-	print("    ✓ publish complete");
-	printNextSteps$1(print, env);
-	return {
-		status: "ok",
-		packageNames: PUBLISHABLE_PACKAGES
-	};
-}
-function printNextSteps$1(print, env) {
-	print("");
-	print("  → next: configure Trusted Publisher for each package on npm:");
-	for (const name of PUBLISHABLE_PACKAGES) print(`    https://www.npmjs.com/package/${name}/access`);
-	print("    Publisher: GitHub Actions   Org: theholocron   Repo: holocron   Workflow: release.yml");
-	if (env.NPM_TOKEN) {
-		print("");
-		print("  → cleanup: $NPM_TOKEN was used. Revoke it now (no API for self-revoke; UI-only):");
-		print("    https://www.npmjs.com/settings/~/tokens");
-	}
-}
-const defaultExec$2 = async (cmd, args, opts) => {
-	const result = spawnSync(cmd, args, {
-		cwd: opts.cwd,
-		encoding: "utf8",
-		stdio: [
-			"inherit",
-			"pipe",
-			"pipe"
-		]
-	});
-	return {
-		exitCode: result.status ?? -1,
-		stdout: result.stdout ?? "",
-		stderr: result.stderr ?? ""
-	};
-};
-//#endregion
-//#region src/commands/plugin-create/template-inputs.ts
-/** Derive the standard defaults from a slug + vendor name. */
-function deriveDefaults$1(input) {
-	const vendorUpper = input.slug.toUpperCase().replace(/-/g, "_");
-	const capability = input.capability;
-	return {
-		vendorUpper,
-		capabilityClass: `${input.vendorName}${capability.charAt(0).toUpperCase() + capability.slice(1)}`,
-		tokenEnv: `HOLOCRON_${vendorUpper}_TOKEN`,
-		transport: "rest"
-	};
-}
-//#endregion
-//#region src/commands/plugin-create/templates/auth.ts
-function render$17(inputs) {
-	return `import { AuthError, createResolveToken, type ResolveTokenInput } from "@theholocron/cli";
-
-export { AuthError };
-export type { ResolveTokenInput };
-
-export const resolveToken = createResolveToken({
-\tenvName: "${inputs.tokenEnv}",
-\tvendorEnvName: "${inputs.vendorEnv}",
-\tkeyringService: "${inputs.slug}",
-\terrorMessage:
-\t\t"no ${inputs.vendorName} token found. Pass --token <TOKEN>, set ${inputs.tokenEnv} / ${inputs.vendorEnv}, " +
-\t\t"or run: holocron auth set ${inputs.slug} <TOKEN>",
-});
-`;
-}
-//#endregion
-//#region src/commands/plugin-create/templates/auth-test.ts
-function render$16(inputs) {
-	return `import { describe, expect, it } from "vitest";
-
-import { AuthError, resolveToken } from "../auth.js";
-
-const noKeyring = () => null;
-
-describe("resolveToken", () => {
-	it("prefers --token over env vars + keyring", () => {
-		expect(
-			resolveToken({
-				cliToken: "flag",
-				env: { ${inputs.tokenEnv}: "hlc", ${inputs.vendorEnv}: "vendor" },
-				keyring: () => "kr",
-			})
-		).toBe("flag");
-	});
-
-	it("prefers ${inputs.tokenEnv} over ${inputs.vendorEnv}", () => {
-		expect(
-			resolveToken({
-				env: { ${inputs.tokenEnv}: "hlc", ${inputs.vendorEnv}: "vendor" },
-				keyring: noKeyring,
-			})
-		).toBe("hlc");
-	});
-
-	it("falls back to ${inputs.vendorEnv} when ${inputs.tokenEnv} is unset", () => {
-		expect(resolveToken({ env: { ${inputs.vendorEnv}: "vendor" }, keyring: noKeyring })).toBe("vendor");
-	});
-
-	it("falls back to keyring when env vars are unset", () => {
-		expect(resolveToken({ env: {}, keyring: (p) => (p === "${inputs.slug}" ? "kr" : null) })).toBe("kr");
-	});
-
-	it("throws AuthError with a helpful message when nothing is set", () => {
-		try {
-			resolveToken({ env: {}, keyring: noKeyring });
-			throw new Error("should have thrown");
-		} catch (err) {
-			expect(err).toBeInstanceOf(AuthError);
-			expect((err as Error).message).toMatch(/${inputs.tokenEnv}/);
-			expect((err as Error).message).toMatch(/holocron auth set ${inputs.slug}/);
-		}
-	});
-});
-`;
-}
+//#region src/commands/plugin-create/templates/auth-test.ts
+function render$16(inputs) {
+	return `import { describe, expect, it } from "vitest";
+
+import { AuthError, resolveToken } from "../auth.js";
+
+const noKeyring = () => null;
+
+describe("resolveToken", () => {
+	it("prefers --token over env vars + keyring", () => {
+		expect(
+			resolveToken({
+				cliToken: "flag",
+				env: { ${inputs.tokenEnv}: "hlc", ${inputs.vendorEnv}: "vendor" },
+				keyring: () => "kr",
+			})
+		).toBe("flag");
+	});
+
+	it("prefers ${inputs.tokenEnv} over ${inputs.vendorEnv}", () => {
+		expect(
+			resolveToken({
+				env: { ${inputs.tokenEnv}: "hlc", ${inputs.vendorEnv}: "vendor" },
+				keyring: noKeyring,
+			})
+		).toBe("hlc");
+	});
+
+	it("falls back to ${inputs.vendorEnv} when ${inputs.tokenEnv} is unset", () => {
+		expect(resolveToken({ env: { ${inputs.vendorEnv}: "vendor" }, keyring: noKeyring })).toBe("vendor");
+	});
+
+	it("falls back to keyring when env vars are unset", () => {
+		expect(resolveToken({ env: {}, keyring: (p) => (p === "${inputs.slug}" ? "kr" : null) })).toBe("kr");
+	});
+
+	it("throws AuthError with a helpful message when nothing is set", () => {
+		try {
+			resolveToken({ env: {}, keyring: noKeyring });
+			throw new Error("should have thrown");
+		} catch (err) {
+			expect(err).toBeInstanceOf(AuthError);
+			expect((err as Error).message).toMatch(/${inputs.tokenEnv}/);
+			expect((err as Error).message).toMatch(/holocron auth set ${inputs.slug}/);
+		}
+	});
+});
+`;
+}
 //#endregion
 //#region src/commands/plugin-create/templates/capability.ts
 function render$15(inputs) {
@@ -3067,18 +2437,132 @@ async function runRow(destination, scope, key, dryRun, body) {
 			message: err instanceof Error ? err.message : String(err)
 		};
 	}
-}
-function formatRow(row) {
-	const detail = row.message ? style.dim(`  (${row.message})`) : "";
-	const label = `${row.key}${detail}`;
-	if (row.status === "ok") return `    ${style.success(label)}`;
-	if (row.status === "fail") return `    ${style.fail(label)}`;
-	if (row.status === "dry-run") return `    ${style.dim(`… ${label}`)}`;
-	return `    ${style.dim(`· ${label}`)}`;
-}
-function vaultProviderName(loader) {
-	if (!loader.has("vault")) return "<missing>";
-	return loader.get("vault").providerName;
+}
+function formatRow(row) {
+	const detail = row.message ? style.dim(`  (${row.message})`) : "";
+	const label = `${row.key}${detail}`;
+	if (row.status === "ok") return `    ${style.success(label)}`;
+	if (row.status === "fail") return `    ${style.fail(label)}`;
+	if (row.status === "dry-run") return `    ${style.dim(`… ${label}`)}`;
+	return `    ${style.dim(`· ${label}`)}`;
+}
+function vaultProviderName(loader) {
+	if (!loader.has("vault")) return "<missing>";
+	return loader.get("vault").providerName;
+}
+//#endregion
+//#region src/commands/dependabot.yml
+var dependabot_default = "# AUTO-GENERATED by holocron — run `holocron setup` to regenerate.\nversion: 2\nupdates:\n  - package-ecosystem: npm\n    directory: /\n    schedule:\n      interval: weekly\n    groups:\n      security-patches:\n        applies-to: security-updates\n        patterns:\n          - \"*\"\n      all-dependencies:\n        update-types:\n          - minor\n          - patch\n\n  - package-ecosystem: github-actions\n    directory: /\n    schedule:\n      interval: weekly\n    groups:\n      all-actions:\n        patterns:\n          - \"*\"\n";
+//#endregion
+//#region src/commands/workflows/audit.yml
+var audit_default$1 = "name: Audit\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\npermissions:\n  contents: read\n\njobs:\n  audit:\n    uses: theholocron/.github/.github/workflows/audit.yml@main\n    secrets: inherit\n";
+//#endregion
+//#region src/commands/workflows/bookkeeping.yml
+var bookkeeping_default$1 = "name: Bookkeeping\n\non: # yamllint disable-line rule:truthy\n  pull_request:\n    types:\n      - opened\n      - edited\n\npermissions:\n  contents: read\n  pull-requests: write\n\njobs:\n  bookkeeping:\n    uses: theholocron/.github/.github/workflows/bookkeeping.yml@main\n    secrets: inherit\n";
+//#endregion
+//#region src/commands/workflows/codeql.yml
+var codeql_default$1 = "name: CodeQL\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches:\n      - main\n  pull_request:\n    branches:\n      - main\n  schedule:\n    - cron: \"0 0 * * 1\"\n\npermissions:\n  actions: read\n  contents: read\n  security-events: write\n\njobs:\n  codeql:\n    uses: theholocron/.github/.github/workflows/codeql.yml@main\n    secrets: inherit\n";
+//#endregion
+//#region src/commands/workflows/dependencies.yml
+var dependencies_default$1 = "name: Dependencies\n\non: # yamllint disable-line rule:truthy\n  pull_request:\n\npermissions:\n  contents: write\n  pull-requests: write\n\njobs:\n  dependencies:\n    uses: theholocron/.github/.github/workflows/dependencies.yml@main\n    secrets: inherit\n";
+//#endregion
+//#region src/commands/workflows/greetings.yml
+var greetings_default$1 = "name: Greetings\n\non: # yamllint disable-line rule:truthy\n  pull_request:\n  issues:\n\npermissions:\n  issues: write\n  pull-requests: write\n\njobs:\n  greetings:\n    uses: theholocron/.github/.github/workflows/greetings.yml@main\n    secrets: inherit\n";
+//#endregion
+//#region src/commands/workflows/lint.yml
+var lint_default$1 = "name: Lint\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\nconcurrency:\n  group: lint-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: write\n  statuses: write\n\njobs:\n  lint:\n    name: Lint\n    uses: theholocron/.github/.github/workflows/lint.yml@main\n    secrets: inherit\n    with:\n      enable-auto-commit: true\n";
+//#endregion
+//#region src/commands/workflows/release.yml
+var release_default$1 = "name: Release\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches:\n      - main\n      - alpha\n  workflow_dispatch:\n\npermissions:\n  contents: write\n  id-token: write\n  issues: write\n  pull-requests: write\n\nconcurrency:\n  group: ${{ github.workflow }}-${{ github.ref }}\n  cancel-in-progress: false\n\njobs:\n  release:\n    uses: theholocron/.github/.github/workflows/release.yml@main\n    secrets: inherit\n";
+//#endregion
+//#region src/commands/workflows/review.yml
+var review_default$1 = "name: Review\n\non: # yamllint disable-line rule:truthy\n  pull_request:\n\nconcurrency:\n  group: review-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n  checks: write\n  pull-requests: write\n\njobs:\n  review:\n    name: Review\n    uses: theholocron/.github/.github/workflows/review.yml@main\n    secrets: inherit\n";
+//#endregion
+//#region src/commands/workflows/stale.yml
+var stale_default$1 = "name: Stale\n\non: # yamllint disable-line rule:truthy\n  schedule:\n    - cron: \"30 1 * * *\"\n\npermissions:\n  contents: write\n  issues: write\n  pull-requests: write\n\njobs:\n  stale:\n    uses: theholocron/.github/.github/workflows/stale.yml@main\n    secrets: inherit\n";
+//#endregion
+//#region src/commands/workflows/sync-github.yml
+var sync_github_default$1 = "name: Sync GitHub Templates\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n    paths:\n      - packages/cli/src/templates/index.ts\n      - packages/cli/src/commands/setup-workflows.ts\n\nconcurrency:\n  group: sync-github-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n\njobs:\n  sync:\n    name: Sync\n    uses: theholocron/.github/.github/workflows/sync-github.yml@main\n    with:\n      secondary-repos: theholocron/.github-private\n    secrets:\n      HOLOCRON_SYNC_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN }}\n";
+//#endregion
+//#region src/commands/workflows/test.yml
+var test_default$1 = "name: Test\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\nconcurrency:\n  group: test-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n\njobs:\n  test:\n    name: Test\n    uses: theholocron/.github/.github/workflows/test.yml@main\n    secrets: inherit\n";
+//#endregion
+//#region src/commands/workflows/typecheck.yml
+var typecheck_default$1 = "name: Typecheck\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\nconcurrency:\n  group: typecheck-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n\njobs:\n  typecheck:\n    name: Typecheck\n    uses: theholocron/.github/.github/workflows/typecheck.yml@main\n    secrets: inherit\n";
+//#endregion
+//#region src/commands/setup-workflows.ts
+/** Header prepended when holocron setup writes a generated file to a repo. */
+function workflowHeader(source = "packages/cli/src/commands/setup-workflows.ts") {
+	return [
+		`# AUTO-GENERATED — do not edit directly.`,
+		`# Source:  theholocron/holocron · ${source}`,
+		`# Synced:  ${(/* @__PURE__ */ new Date()).toISOString()}`,
+		`# Tool:    holocron setup`,
+		`# Changes: run \`holocron setup\` to regenerate.`,
+		``
+	].join("\n");
+}
+const WORKFLOW_TEMPLATES = {
+	lint: lint_default$1,
+	test: test_default$1,
+	typecheck: typecheck_default$1,
+	codeql: codeql_default$1,
+	review: review_default$1,
+	release: release_default$1,
+	stale: stale_default$1,
+	greetings: greetings_default$1,
+	dependencies: dependencies_default$1,
+	bookkeeping: bookkeeping_default$1,
+	audit: audit_default$1,
+	"sync-github": sync_github_default$1
+};
+const KNOWN_WORKFLOWS = new Set(Object.keys(WORKFLOW_TEMPLATES));
+/**
+* GitHub check context name each CI workflow produces on a PR.
+*
+* The format is "{caller-workflow-name} / {reusable-job-name}". The caller
+* job's own `name:` field does NOT appear in the external check name — only
+* the calling workflow's top-level `name:` and the inner reusable-workflow
+* job name matter. Only workflows that gate merges are listed here.
+*/
+const WORKFLOW_CHECK_CONTEXTS = {
+	lint: "Lint / Lint entire codebase",
+	test: "Test / Run tests and collect coverage",
+	typecheck: "Typecheck / tsc --noEmit"
+};
+/**
+* Generate the thin caller content for a workflow, optionally injecting or
+* merging `with:` overrides into the jobs block.
+*
+* Two strategies are used depending on the template:
+* - Templates that already have a `with:` block (e.g. lint, sync-github):
+*   the override entries are merged in, replacing existing keys and appending
+*   new ones.
+* - Templates that end with `    secrets: inherit`: a new `with:` block is
+*   injected immediately before `secrets: inherit`.
+* If neither pattern matches the template, a warning is emitted and the
+* base template is returned unchanged.
+*/
+function generateThinCallerContent(name, withOverrides) {
+	const base = WORKFLOW_TEMPLATES[name];
+	if (!base) return "";
+	if (!withOverrides || Object.keys(withOverrides).length === 0) return base;
+	const fmt = (k, v) => `      ${k}: ${v === true ? "true" : v === false ? "false" : String(v)}`;
+	const withBlockRe = /( {4}with:\n)((?:[ ]{6}[^\n]+\n)*)/;
+	const existingMatch = base.match(withBlockRe);
+	if (existingMatch) {
+		const existingEntries = new Map(existingMatch[2].split("\n").filter(Boolean).map((line) => {
+			const m = line.match(/^ {6}([^:]+):\s*(.*)/);
+			return m ? [m[1].trim(), m[2].trim()] : null;
+		}).filter((e) => e !== null));
+		for (const [k, v] of Object.entries(withOverrides)) existingEntries.set(k, v === true ? "true" : v === false ? "false" : String(v));
+		const merged = [...existingEntries.entries()].map(([k, v]) => `      ${k}: ${v}`).join("\n");
+		return base.replace(withBlockRe, `    with:\n${merged}\n`);
+	}
+	const withBlock = Object.entries(withOverrides).map(([k, v]) => fmt(k, v)).join("\n");
+	const result = base.replace(/ {4}secrets: inherit\n$/, `    with:\n${withBlock}\n    secrets: inherit\n`);
+	if (result === base) console.warn(`[generateThinCallerContent] could not inject with: overrides into "${name}" template`);
+	return result;
 }
 //#endregion
 //#region src/commands/setup.ts
@@ -3784,152 +3268,481 @@ async function runSetup(input) {
 		print(style.hint("     Then re-run:   holocron setup --token <your-temp-pat>"));
 		print(style.hint("     You can revoke it immediately after setup completes."));
 	}
-	return {
-		steps,
-		summary
-	};
+	return {
+		steps,
+		summary
+	};
+}
+/**
+* Fetch a single SKILL.md from its upstream GitHub source.
+* Verifies the SHA-256 hash when `computedHash` is present in the lock entry.
+*/
+async function fetchExternalSkill(entry) {
+	if (entry.sourceType !== "github") throw new Error(`unsupported sourceType: ${entry.sourceType}`);
+	const url = `https://raw.githubusercontent.com/${entry.source}/HEAD/${entry.skillPath}`;
+	const res = await fetch(url);
+	if (!res.ok) throw new Error(`HTTP ${res.status} fetching ${url}`);
+	const content = await res.text();
+	return {
+		content,
+		stale: !!entry.computedHash && createHash("sha256").update(content).digest("hex") !== entry.computedHash
+	};
+}
+const AGENTS_SKILLS_ROOT = ".agents/skills";
+/** Relative path of the agent-specific symlink. undefined = unsupported agent. */
+const AGENT_SYMLINK_PATHS = { claude: (name) => `.claude/skills/${name}` };
+const GITIGNORE_BLOCK_START = "# managed by holocron setup — skills";
+const GITIGNORE_BLOCK_END = "# end managed by holocron setup — skills";
+async function installSkills({ agent, skills, repoRoot }) {
+	const symlinkFn = AGENT_SYMLINK_PATHS[agent];
+	if (!symlinkFn) return `agent "${agent}" has no known skill install path — skipping`;
+	const require = createRequire(pathToFileURL(join(repoRoot, "package.json")));
+	let skillsRoot;
+	try {
+		skillsRoot = dirname(require.resolve("@theholocron/skills/package.json"));
+	} catch {
+		throw new Error("@theholocron/skills not found — run: pnpm add -D @theholocron/skills");
+	}
+	const gitignorePath = join(repoRoot, ".gitignore");
+	const existingContent = await readFile(gitignorePath, "utf8").catch(() => "");
+	const previouslyInstalled = parsePreviousSkills(existingContent, symlinkFn);
+	const currentSet = new Set(skills);
+	const stale = previouslyInstalled.filter((n) => !currentSet.has(n));
+	for (const name of stale) {
+		await rm(join(repoRoot, symlinkFn(name)), { force: true }).catch(() => void 0);
+		await rm(join(repoRoot, AGENTS_SKILLS_ROOT, name), {
+			recursive: true,
+			force: true
+		}).catch(() => void 0);
+	}
+	const installed = [];
+	const missing = [];
+	for (const name of skills) {
+		const srcDir = join(skillsRoot, "skills", name);
+		try {
+			await stat(srcDir);
+		} catch {
+			missing.push(name);
+			continue;
+		}
+		const agentsDir = join(repoRoot, AGENTS_SKILLS_ROOT, name);
+		await copyDirRecursive(srcDir, agentsDir);
+		const symlinkPath = join(repoRoot, symlinkFn(name));
+		await mkdir(dirname(symlinkPath), { recursive: true });
+		try {
+			await unlink(symlinkPath);
+		} catch {}
+		await symlink(relative(dirname(symlinkPath), agentsDir).replace(/\\/g, "/"), symlinkPath);
+		installed.push(name);
+	}
+	const externalFailed = [];
+	const externalStale = [];
+	if (missing.length > 0) {
+		let lock = null;
+		try {
+			lock = JSON.parse(await readFile(join(skillsRoot, "skills-lock.json"), "utf8"));
+		} catch {}
+		if (lock?.skills) for (const name of [...missing]) {
+			const entry = lock.skills[name];
+			if (!entry) continue;
+			try {
+				const { content, stale: isStale } = await fetchExternalSkill(entry);
+				const agentsDir = join(repoRoot, AGENTS_SKILLS_ROOT, name);
+				await mkdir(agentsDir, { recursive: true });
+				await writeFile(join(agentsDir, "SKILL.md"), content);
+				const symlinkPath = join(repoRoot, symlinkFn(name));
+				await mkdir(dirname(symlinkPath), { recursive: true });
+				try {
+					await unlink(symlinkPath);
+				} catch {}
+				await symlink(relative(dirname(symlinkPath), agentsDir).replace(/\\/g, "/"), symlinkPath);
+				missing.splice(missing.indexOf(name), 1);
+				installed.push(name);
+				if (isStale) externalStale.push(name);
+			} catch {
+				missing.splice(missing.indexOf(name), 1);
+				externalFailed.push(name);
+			}
+		}
+	}
+	if (installed.length > 0 || stale.length > 0 || missing.length > 0 || externalFailed.length > 0) await updateSkillsGitignore(gitignorePath, existingContent, [
+		...installed,
+		...missing,
+		...externalFailed
+	], symlinkFn);
+	const parts = [`installed ${installed.length}`];
+	if (stale.length > 0) parts.push(`pruned: ${stale.join(", ")}`);
+	if (externalStale.length > 0) parts.push(`stale: ${externalStale.join(", ")} (run \`holocron skills update\` to refresh)`);
+	if (externalFailed.length > 0) parts.push(`fetch failed: ${externalFailed.join(", ")}`);
+	if (missing.length > 0) parts.push(`unknown: ${missing.join(", ")}`);
+	return parts.join("; ");
+}
+/** Extract skill names from the previous gitignore block so stale dirs can be pruned. */
+function parsePreviousSkills(gitignoreContent, symlinkFn) {
+	if (!gitignoreContent.includes(GITIGNORE_BLOCK_START)) return [];
+	const startIdx = gitignoreContent.indexOf(GITIGNORE_BLOCK_START);
+	const endIdx = gitignoreContent.indexOf(GITIGNORE_BLOCK_END, startIdx);
+	const block = endIdx !== -1 ? gitignoreContent.slice(startIdx, endIdx) : gitignoreContent.slice(startIdx);
+	const placeholder = "__placeholder__";
+	const symlinkPrefix = `/${symlinkFn(placeholder)}`.replace(placeholder, "");
+	return block.split("\n").filter((line) => line.startsWith(symlinkPrefix)).map((line) => line.slice(symlinkPrefix.length));
+}
+async function copyDirRecursive(src, dest) {
+	await mkdir(dest, { recursive: true });
+	const entries = await readdir(src, { withFileTypes: true });
+	for (const entry of entries) {
+		const srcPath = join(src, entry.name);
+		const destPath = join(dest, entry.name);
+		if (entry.isDirectory()) await copyDirRecursive(srcPath, destPath);
+		else await copyFile(srcPath, destPath);
+	}
+}
+async function updateSkillsGitignore(gitignorePath, existingContent, skills, symlinkFn) {
+	const entries = [`/${AGENTS_SKILLS_ROOT}/`, ...skills.map((n) => `/${symlinkFn(n)}`)];
+	const block = [
+		GITIGNORE_BLOCK_START,
+		...entries,
+		GITIGNORE_BLOCK_END
+	].join("\n");
+	let content;
+	if (existingContent.includes(GITIGNORE_BLOCK_START)) {
+		const start = existingContent.indexOf(GITIGNORE_BLOCK_START);
+		const end = existingContent.indexOf(GITIGNORE_BLOCK_END, start);
+		const afterBlock = end !== -1 ? existingContent.slice(end + 40) : "\n";
+		content = existingContent.slice(0, start) + block + afterBlock;
+	} else content = (existingContent.trimEnd() ? existingContent.trimEnd() + "\n\n" : "") + block + "\n";
+	await writeFile(gitignorePath, content, "utf8");
+}
+async function runStep(capability, step, dryRun, body) {
+	if (dryRun) return {
+		capability,
+		step,
+		status: "dry-run"
+	};
+	try {
+		const note = await body();
+		const result = {
+			capability,
+			step,
+			status: "ok"
+		};
+		if (typeof note === "string") result.message = note;
+		return result;
+	} catch (err) {
+		if (err instanceof ProviderApiError$1 && err.status === 403) {
+			const reason = classify403(err);
+			return {
+				capability,
+				step,
+				status: "fail",
+				message: err.message,
+				reason
+			};
+		}
+		return {
+			capability,
+			step,
+			status: "fail",
+			message: err instanceof Error ? err.message : String(err)
+		};
+	}
+}
+function classify403(err) {
+	const detailText = typeof err.details === "string" ? err.details : typeof err.details === "object" && err.details !== null && "message" in err.details ? String(err.details.message) : "";
+	const text = `${err.message} ${detailText}`.toLowerCase();
+	if (text.includes("advanced security") || text.includes("not enabled for this repository") || text.includes("upgrade") || text.includes("not available on")) return "plan";
+	return "permissions";
+}
+function formatStep(step) {
+	const tag = step.reason === "permissions" ? " [permissions]" : step.reason === "plan" ? " [plan restriction]" : "";
+	const detail = step.message ? style.dim(`  (${step.message})`) : "";
+	const label = `${step.step}${tag}${detail}`;
+	if (step.status === "ok") return `    ${style.success(label)}`;
+	if (step.status === "fail") return `    ${style.fail(label)}`;
+	if (step.status === "dry-run") return `    ${style.dim(`… ${label}`)}`;
+	return `    ${style.dim(`· ${label}`)}`;
+}
+//#endregion
+//#region src/commands/skills.ts
+/**
+* `holocron skills` — install, remove, and update agent skills from @theholocron/skills.
+*
+* Unlike `holocron setup`, this command is purely local (no GitHub token
+* required). It reads `agent` and `skills` from the config and installs
+* the listed skills into `.agents/skills/<name>/` with a symlink at the
+* agent-specific path (e.g. `.claude/skills/<name>` for Claude Code).
+*
+* `holocron skills remove [name]` and `holocron skills update [name]` delegate
+* to the corresponding `npx skills` subcommands from the upstream skills CLI.
+*/
+const defaultExec = (cmd, args, opts) => {
+	return { exitCode: spawnSync(cmd, args, {
+		cwd: opts.cwd,
+		stdio: "inherit"
+	}).status ?? -1 };
+};
+async function runSkillsInstall(input) {
+	const print = input.print ?? ((line) => console.log(line));
+	const config = input.loaded.resolved;
+	if (!config.agent || !config.skills?.length) {
+		print("Nothing to install — set `agent` and `skills` in holocron.config.ts");
+		return;
+	}
+	if (input.context.dryRun) {
+		print(`Would install ${config.skills.length} skill(s) for agent: ${config.agent}`);
+		for (const name of config.skills) print(`  → would install: ${name}`);
+		return;
+	}
+	print(`Installing ${config.skills.length} skill(s) for agent: ${config.agent}`);
+	try {
+		print(`  → ${await installSkills({
+			agent: config.agent,
+			skills: config.skills,
+			repoRoot: input.context.repoRoot
+		})}`);
+	} catch (err) {
+		print(`  ✗ ${err instanceof Error ? err.message : String(err)}`);
+	}
 }
-/**
-* Fetch a single SKILL.md from its upstream GitHub source.
-* Verifies the SHA-256 hash when `computedHash` is present in the lock entry.
-*/
-async function fetchExternalSkill(entry) {
-	if (entry.sourceType !== "github") throw new Error(`unsupported sourceType: ${entry.sourceType}`);
-	const url = `https://raw.githubusercontent.com/${entry.source}/HEAD/${entry.skillPath}`;
-	const res = await fetch(url);
-	if (!res.ok) throw new Error(`HTTP ${res.status} fetching ${url}`);
-	const content = await res.text();
-	return {
-		content,
-		stale: !!entry.computedHash && createHash("sha256").update(content).digest("hex") !== entry.computedHash
-	};
+function runSkillsRemove(input) {
+	const { dryRun, repoRoot } = input.context;
+	const exec = input.exec ?? defaultExec;
+	const args = [
+		"skills",
+		"remove",
+		...input.names ?? []
+	];
+	if (dryRun) {
+		console.log(`Would run: npx ${args.join(" ")}`);
+		return { status: "dry-run" };
+	}
+	const { exitCode } = exec("npx", args, { cwd: repoRoot });
+	return { status: exitCode === 0 ? "ok" : "fail" };
 }
-const AGENTS_SKILLS_ROOT = ".agents/skills";
-/** Relative path of the agent-specific symlink. undefined = unsupported agent. */
-const AGENT_SYMLINK_PATHS = { claude: (name) => `.claude/skills/${name}` };
-const GITIGNORE_BLOCK_START = "# managed by holocron setup — skills";
-const GITIGNORE_BLOCK_END = "# end managed by holocron setup — skills";
-async function installSkills({ agent, skills, repoRoot }) {
-	const symlinkFn = AGENT_SYMLINK_PATHS[agent];
-	if (!symlinkFn) return `agent "${agent}" has no known skill install path — skipping`;
-	const require = createRequire(pathToFileURL(join(repoRoot, "package.json")));
-	let skillsRoot;
-	try {
-		skillsRoot = dirname(require.resolve("@theholocron/skills/package.json"));
-	} catch {
-		throw new Error("@theholocron/skills not found — run: pnpm add -D @theholocron/skills");
+function runSkillsUpdate(input) {
+	const { dryRun, repoRoot } = input.context;
+	const exec = input.exec ?? defaultExec;
+	const args = [
+		"skills",
+		"update",
+		...input.name ? [input.name] : []
+	];
+	if (dryRun) {
+		console.log(`Would run: npx ${args.join(" ")}`);
+		return { status: "dry-run" };
 	}
-	const gitignorePath = join(repoRoot, ".gitignore");
-	const existingContent = await readFile(gitignorePath, "utf8").catch(() => "");
-	const previouslyInstalled = parsePreviousSkills(existingContent, symlinkFn);
-	const currentSet = new Set(skills);
-	const stale = previouslyInstalled.filter((n) => !currentSet.has(n));
-	for (const name of stale) {
-		await rm(join(repoRoot, symlinkFn(name)), { force: true }).catch(() => void 0);
-		await rm(join(repoRoot, AGENTS_SKILLS_ROOT, name), {
-			recursive: true,
-			force: true
-		}).catch(() => void 0);
+	const { exitCode } = exec("npx", args, { cwd: repoRoot });
+	return { status: exitCode === 0 ? "ok" : "fail" };
+}
+//#endregion
+//#region src/commands/sync.ts
+const SYNC_STEPS = [
+	"labels",
+	"properties",
+	"teams",
+	"topics",
+	"keywords",
+	"description"
+];
+const LOCAL_STEPS = /* @__PURE__ */ new Set(["keywords", "description"]);
+async function runSync(input) {
+	const print = input.print ?? ((line) => console.log(line));
+	const loader = input.loader ?? new PluginLoader(input.loaded.resolved, input.context);
+	const config = input.loaded.resolved;
+	const dryRun = input.context.dryRun ?? false;
+	const requestedSteps = input.steps;
+	const steps = [];
+	if (!requestedSteps || requestedSteps.some((s) => !LOCAL_STEPS.has(s))) await loader.load();
+	else try {
+		await loader.load();
+	} catch (err) {
+		if (!(err instanceof AuthError)) throw err;
 	}
-	const installed = [];
-	const missing = [];
-	for (const name of skills) {
-		const srcDir = join(skillsRoot, "skills", name);
-		try {
-			await stat(srcDir);
-		} catch {
-			missing.push(name);
-			continue;
+	print(`Holocron sync — ${config.name}${dryRun ? " (dry-run)" : ""}`);
+	print(`  config: ${input.loaded.filepath}`);
+	print("");
+	if (loader.has("source")) {
+		const source = loader.get("source");
+		print("  → source");
+		for (const stepName of SYNC_STEPS) {
+			if (requestedSteps !== void 0 && !requestedSteps.includes(stepName)) continue;
+			if (LOCAL_STEPS.has(stepName)) continue;
+			if (stepName === "labels") if (source.syncLabels) {
+				steps.push(await runSyncStep("source", "sync labels", dryRun, () => source.syncLabels(CANONICAL_LABELS, STALE_LABELS)));
+				print(formatSyncStep(steps[steps.length - 1]));
+			} else {
+				steps.push({
+					capability: "source",
+					step: "sync labels",
+					status: "skip",
+					message: "provider does not implement syncLabels"
+				});
+				print(formatSyncStep(steps[steps.length - 1]));
+			}
+			if (stepName === "properties") if (source.syncProperties) {
+				const repo = config.repo;
+				const properties = {};
+				const effectivePreset = repo?.protection;
+				if (effectivePreset && effectivePreset !== "none") properties["branch_protection_level"] = effectivePreset;
+				const isMonorepo = await access(join(input.context.repoRoot, "pnpm-workspace.yaml")).then(() => true).catch(() => false);
+				properties["monorepo"] = String(isMonorepo);
+				const manual = repo?.properties ?? {};
+				if (manual.lifecycle) properties["lifecycle"] = manual.lifecycle;
+				if (manual.open_source !== void 0) properties["open_source"] = String(manual.open_source);
+				if (manual.runtime_environment) properties["runtime_environment"] = manual.runtime_environment;
+				if (manual.uses_external_packages !== void 0) properties["uses_external_packages"] = String(manual.uses_external_packages);
+				steps.push(await runSyncStep("source", "sync properties", dryRun, () => source.syncProperties(properties)));
+				print(formatSyncStep(steps[steps.length - 1]));
+			} else {
+				steps.push({
+					capability: "source",
+					step: "sync properties",
+					status: "skip",
+					message: "provider does not implement syncProperties"
+				});
+				print(formatSyncStep(steps[steps.length - 1]));
+			}
+			if (stepName === "teams") {
+				const teams = config.repo?.teams ?? [];
+				if (teams.length === 0) {
+					steps.push({
+						capability: "source",
+						step: "sync teams",
+						status: "skip",
+						message: "no teams configured"
+					});
+					print(formatSyncStep(steps[steps.length - 1]));
+				} else if (source.syncTeams) {
+					steps.push(await runSyncStep("source", "sync teams", dryRun, () => source.syncTeams(teams)));
+					print(formatSyncStep(steps[steps.length - 1]));
+					const repoCoord = input.context.repo ?? config.repo?.name ?? "";
+					const org = repoCoord.includes("/") ? repoCoord.split("/")[0] : "";
+					const writeableTeams = teams.map((t) => typeof t === "string" ? {
+						slug: t,
+						permission: "push"
+					} : t).filter((t) => [
+						"push",
+						"maintain",
+						"admin"
+					].includes(t.permission));
+					if (org && writeableTeams.length > 0) {
+						steps.push(await runSyncStep("source", "write .github/CODEOWNERS", dryRun, async () => {
+							const content = writeableTeams.map((t) => `* @${org}/${t.slug}`).join("\n") + "\n";
+							await source.writeRepoFile(".github/CODEOWNERS", content);
+						}));
+						print(formatSyncStep(steps[steps.length - 1]));
+					}
+				} else {
+					steps.push({
+						capability: "source",
+						step: "sync teams",
+						status: "skip",
+						message: "provider does not implement syncTeams"
+					});
+					print(formatSyncStep(steps[steps.length - 1]));
+				}
+			}
+			if (stepName === "topics") {
+				const topics = config.repo?.topics ?? [];
+				if (topics.length === 0) {
+					steps.push({
+						capability: "source",
+						step: "sync topics",
+						status: "skip",
+						message: "no topics configured"
+					});
+					print(formatSyncStep(steps[steps.length - 1]));
+				} else if (source.syncTopics) {
+					steps.push(await runSyncStep("source", "sync topics", dryRun, () => source.syncTopics(topics)));
+					print(formatSyncStep(steps[steps.length - 1]));
+				} else {
+					steps.push({
+						capability: "source",
+						step: "sync topics",
+						status: "skip",
+						message: "provider does not implement syncTopics"
+					});
+					print(formatSyncStep(steps[steps.length - 1]));
+				}
+			}
 		}
-		const agentsDir = join(repoRoot, AGENTS_SKILLS_ROOT, name);
-		await copyDirRecursive(srcDir, agentsDir);
-		const symlinkPath = join(repoRoot, symlinkFn(name));
-		await mkdir(dirname(symlinkPath), { recursive: true });
-		try {
-			await unlink(symlinkPath);
-		} catch {}
-		await symlink(relative(dirname(symlinkPath), agentsDir).replace(/\\/g, "/"), symlinkPath);
-		installed.push(name);
-	}
-	const externalFailed = [];
-	const externalStale = [];
-	if (missing.length > 0) {
-		let lock = null;
-		try {
-			lock = JSON.parse(await readFile(join(skillsRoot, "skills-lock.json"), "utf8"));
-		} catch {}
-		if (lock?.skills) for (const name of [...missing]) {
-			const entry = lock.skills[name];
-			if (!entry) continue;
-			try {
-				const { content, stale: isStale } = await fetchExternalSkill(entry);
-				const agentsDir = join(repoRoot, AGENTS_SKILLS_ROOT, name);
-				await mkdir(agentsDir, { recursive: true });
-				await writeFile(join(agentsDir, "SKILL.md"), content);
-				const symlinkPath = join(repoRoot, symlinkFn(name));
-				await mkdir(dirname(symlinkPath), { recursive: true });
-				try {
-					await unlink(symlinkPath);
-				} catch {}
-				await symlink(relative(dirname(symlinkPath), agentsDir).replace(/\\/g, "/"), symlinkPath);
-				missing.splice(missing.indexOf(name), 1);
-				installed.push(name);
-				if (isStale) externalStale.push(name);
-			} catch {
-				missing.splice(missing.indexOf(name), 1);
-				externalFailed.push(name);
+		if (requestedSteps) {
+			for (const name of requestedSteps) if (!SYNC_STEPS.includes(name)) {
+				steps.push({
+					capability: "source",
+					step: `sync ${name}`,
+					status: "skip",
+					message: `unknown step "${name}"`
+				});
+				print(formatSyncStep(steps[steps.length - 1]));
 			}
 		}
 	}
-	if (installed.length > 0 || stale.length > 0 || missing.length > 0 || externalFailed.length > 0) await updateSkillsGitignore(gitignorePath, existingContent, [
-		...installed,
-		...missing,
-		...externalFailed
-	], symlinkFn);
-	const parts = [`installed ${installed.length}`];
-	if (stale.length > 0) parts.push(`pruned: ${stale.join(", ")}`);
-	if (externalStale.length > 0) parts.push(`stale: ${externalStale.join(", ")} (run \`holocron skills update\` to refresh)`);
-	if (externalFailed.length > 0) parts.push(`fetch failed: ${externalFailed.join(", ")}`);
-	if (missing.length > 0) parts.push(`unknown: ${missing.join(", ")}`);
-	return parts.join("; ");
-}
-/** Extract skill names from the previous gitignore block so stale dirs can be pruned. */
-function parsePreviousSkills(gitignoreContent, symlinkFn) {
-	if (!gitignoreContent.includes(GITIGNORE_BLOCK_START)) return [];
-	const startIdx = gitignoreContent.indexOf(GITIGNORE_BLOCK_START);
-	const endIdx = gitignoreContent.indexOf(GITIGNORE_BLOCK_END, startIdx);
-	const block = endIdx !== -1 ? gitignoreContent.slice(startIdx, endIdx) : gitignoreContent.slice(startIdx);
-	const placeholder = "__placeholder__";
-	const symlinkPrefix = `/${symlinkFn(placeholder)}`.replace(placeholder, "");
-	return block.split("\n").filter((line) => line.startsWith(symlinkPrefix)).map((line) => line.slice(symlinkPrefix.length));
-}
-async function copyDirRecursive(src, dest) {
-	await mkdir(dest, { recursive: true });
-	const entries = await readdir(src, { withFileTypes: true });
-	for (const entry of entries) {
-		const srcPath = join(src, entry.name);
-		const destPath = join(dest, entry.name);
-		if (entry.isDirectory()) await copyDirRecursive(srcPath, destPath);
-		else await copyFile(srcPath, destPath);
+	for (const stepName of ["keywords", "description"]) {
+		if (requestedSteps !== void 0 && !requestedSteps.includes(stepName)) continue;
+		if (stepName === "keywords") {
+			const topics = config.repo?.topics ?? [];
+			if (topics.length === 0) {
+				steps.push({
+					capability: "local",
+					step: "sync keywords",
+					status: "skip",
+					message: "no topics configured"
+				});
+				print(formatSyncStep(steps[steps.length - 1]));
+			} else {
+				steps.push(await runSyncStep("local", "sync keywords", dryRun, async () => {
+					return await writePackageJsonField(input.context.repoRoot, "keywords", topics) ? `${topics.length} keywords written` : `${topics.length} topics (no package.json)`;
+				}));
+				print(formatSyncStep(steps[steps.length - 1]));
+			}
+		}
+		if (stepName === "description") {
+			const description = config.description;
+			if (!description) {
+				steps.push({
+					capability: "local",
+					step: "sync description",
+					status: "skip",
+					message: "no description configured"
+				});
+				print(formatSyncStep(steps[steps.length - 1]));
+			} else {
+				const source = loader.has("source") ? loader.get("source") : null;
+				steps.push(await runSyncStep("local", "sync description", dryRun, async () => {
+					const pkgWrote = await writePackageJsonField(input.context.repoRoot, "description", description);
+					const readmeWrote = await updateReadmeDescription(input.context.repoRoot, description);
+					if (source?.syncDescription) await source.syncDescription(description);
+					const parts = [];
+					if (pkgWrote) parts.push("package.json");
+					if (readmeWrote) parts.push("README.md");
+					if (source?.syncDescription) parts.push("GitHub");
+					return parts.length > 0 ? parts.join(", ") + " updated" : "description synced";
+				}));
+				print(formatSyncStep(steps[steps.length - 1]));
+			}
+		}
 	}
+	const summary = steps.reduce((acc, s) => {
+		if (s.status === "ok") acc.ok += 1;
+		else if (s.status === "fail") acc.fail += 1;
+		else if (s.status === "skip") acc.skip += 1;
+		else if (s.status === "dry-run") acc.dryRun += 1;
+		return acc;
+	}, {
+		ok: 0,
+		fail: 0,
+		skip: 0,
+		dryRun: 0
+	});
+	print("");
+	print(`  ${summary.ok} ok, ${summary.fail} fail, ${summary.skip} skipped${dryRun ? `, ${summary.dryRun} would-do` : ""}`);
+	return {
+		steps,
+		summary
+	};
 }
-async function updateSkillsGitignore(gitignorePath, existingContent, skills, symlinkFn) {
-	const entries = [`/${AGENTS_SKILLS_ROOT}/`, ...skills.map((n) => `/${symlinkFn(n)}`)];
-	const block = [
-		GITIGNORE_BLOCK_START,
-		...entries,
-		GITIGNORE_BLOCK_END
-	].join("\n");
-	let content;
-	if (existingContent.includes(GITIGNORE_BLOCK_START)) {
-		const start = existingContent.indexOf(GITIGNORE_BLOCK_START);
-		const end = existingContent.indexOf(GITIGNORE_BLOCK_END, start);
-		const afterBlock = end !== -1 ? existingContent.slice(end + 40) : "\n";
-		content = existingContent.slice(0, start) + block + afterBlock;
-	} else content = (existingContent.trimEnd() ? existingContent.trimEnd() + "\n\n" : "") + block + "\n";
-	await writeFile(gitignorePath, content, "utf8");
-}
-async function runStep(capability, step, dryRun, body) {
+async function runSyncStep(capability, step, dryRun, body) {
 	if (dryRun) return {
 		capability,
 		step,
@@ -3945,16 +3758,6 @@ async function runStep(capability, step, dryRun, body) {
 		if (typeof note === "string") result.message = note;
 		return result;
 	} catch (err) {
-		if (err instanceof ProviderApiError$1 && err.status === 403) {
-			const reason = classify403(err);
-			return {
-				capability,
-				step,
-				status: "fail",
-				message: err.message,
-				reason
-			};
-		}
 		return {
 			capability,
 			step,
@@ -3963,400 +3766,597 @@ async function runStep(capability, step, dryRun, body) {
 		};
 	}
 }
-function classify403(err) {
-	const detailText = typeof err.details === "string" ? err.details : typeof err.details === "object" && err.details !== null && "message" in err.details ? String(err.details.message) : "";
-	const text = `${err.message} ${detailText}`.toLowerCase();
-	if (text.includes("advanced security") || text.includes("not enabled for this repository") || text.includes("upgrade") || text.includes("not available on")) return "plan";
-	return "permissions";
-}
-function formatStep(step) {
-	const tag = step.reason === "permissions" ? " [permissions]" : step.reason === "plan" ? " [plan restriction]" : "";
-	const detail = step.message ? style.dim(`  (${step.message})`) : "";
-	const label = `${step.step}${tag}${detail}`;
-	if (step.status === "ok") return `    ${style.success(label)}`;
-	if (step.status === "fail") return `    ${style.fail(label)}`;
-	if (step.status === "dry-run") return `    ${style.dim(`… ${label}`)}`;
-	return `    ${style.dim(`· ${label}`)}`;
+function formatSyncStep(step) {
+	const icon = step.status === "ok" ? "✓" : step.status === "fail" ? "✗" : step.status === "dry-run" ? "…" : "·";
+	const detail = step.message ? `  (${step.message})` : "";
+	return `    ${icon} ${step.step}${detail}`;
 }
-//#endregion
-//#region src/commands/skills.ts
-/**
-* `holocron skills` — install, remove, and update agent skills from @theholocron/skills.
-*
-* Unlike `holocron setup`, this command is purely local (no GitHub token
-* required). It reads `agent` and `skills` from the config and installs
-* the listed skills into `.agents/skills/<name>/` with a symlink at the
-* agent-specific path (e.g. `.claude/skills/<name>` for Claude Code).
-*
-* `holocron skills remove [name]` and `holocron skills update [name]` delegate
-* to the corresponding `npx skills` subcommands from the upstream skills CLI.
-*/
-const defaultExec = (cmd, args, opts) => {
-	return { exitCode: spawnSync(cmd, args, {
-		cwd: opts.cwd,
-		stdio: "inherit"
-	}).status ?? -1 };
-};
-async function runSkillsInstall(input) {
-	const print = input.print ?? ((line) => console.log(line));
-	const config = input.loaded.resolved;
-	if (!config.agent || !config.skills?.length) {
-		print("Nothing to install — set `agent` and `skills` in holocron.config.ts");
-		return;
-	}
-	if (input.context.dryRun) {
-		print(`Would install ${config.skills.length} skill(s) for agent: ${config.agent}`);
-		for (const name of config.skills) print(`  → would install: ${name}`);
-		return;
-	}
-	print(`Installing ${config.skills.length} skill(s) for agent: ${config.agent}`);
+async function writePackageJsonField(repoRoot, field, value) {
+	const pkgPath = join(repoRoot, "package.json");
+	let content;
 	try {
-		print(`  → ${await installSkills({
-			agent: config.agent,
-			skills: config.skills,
-			repoRoot: input.context.repoRoot
-		})}`);
-	} catch (err) {
-		print(`  ✗ ${err instanceof Error ? err.message : String(err)}`);
+		content = await readFile(pkgPath, "utf8");
+	} catch {
+		return false;
 	}
+	const pkg = JSON.parse(content);
+	pkg[field] = value;
+	await writeFile(pkgPath, JSON.stringify(pkg, null, 2) + "\n", "utf8");
+	return true;
 }
-function runSkillsRemove(input) {
-	const { dryRun, repoRoot } = input.context;
-	const exec = input.exec ?? defaultExec;
-	const args = [
-		"skills",
-		"remove",
-		...input.names ?? []
-	];
-	if (dryRun) {
-		console.log(`Would run: npx ${args.join(" ")}`);
-		return { status: "dry-run" };
+const README_DESC_START = "<!-- holocron:description -->";
+const README_DESC_END = "<!-- /holocron:description -->";
+async function updateReadmeDescription(repoRoot, description) {
+	const readmePath = join(repoRoot, "README.md");
+	let content;
+	try {
+		content = await readFile(readmePath, "utf8");
+	} catch {
+		return false;
 	}
-	const { exitCode } = exec("npx", args, { cwd: repoRoot });
-	return { status: exitCode === 0 ? "ok" : "fail" };
-}
-function runSkillsUpdate(input) {
-	const { dryRun, repoRoot } = input.context;
-	const exec = input.exec ?? defaultExec;
-	const args = [
-		"skills",
-		"update",
-		...input.name ? [input.name] : []
-	];
-	if (dryRun) {
-		console.log(`Would run: npx ${args.join(" ")}`);
-		return { status: "dry-run" };
+	const lines = content.split("\n");
+	const startIdx = lines.findIndex((l) => l.trim() === README_DESC_START);
+	const endIdx = lines.findIndex((l) => l.trim() === README_DESC_END);
+	if (startIdx !== -1) {
+		if (endIdx === -1 || endIdx <= startIdx) return false;
+		lines.splice(startIdx + 1, endIdx - startIdx - 1, description);
+		await writeFile(readmePath, lines.join("\n"), "utf8");
+		return true;
 	}
-	const { exitCode } = exec("npx", args, { cwd: repoRoot });
-	return { status: exitCode === 0 ? "ok" : "fail" };
-}
-//#endregion
-//#region src/env.ts
-function createEnvLookup(source = process.env) {
-	return {
-		get(key) {
-			return source[key] || void 0;
-		},
-		first(...keys) {
-			for (const key of keys) {
-				const val = source[key];
-				if (val) return val;
-			}
-		}
-	};
+	const h1Index = lines.findIndex((l) => /^# /.test(l));
+	if (h1Index === -1) return false;
+	lines.splice(h1Index + 1, 0, "", README_DESC_START, description, README_DESC_END);
+	await writeFile(readmePath, lines.join("\n"), "utf8");
+	return true;
 }
 //#endregion
-//#region src/auth-resolver.ts
+//#region src/templates/actions/install.yml
+var install_default = "name: Install dependencies\ndescription: Install project dependencies with pnpm frozen lockfile.\n\nruns:\n  using: composite\n\n  steps:\n    - name: Install dependencies\n      if: ${{ hashFiles('pnpm-lock.yaml') != '' }}\n      shell: bash\n      run: pnpm install --frozen-lockfile\n";
+//#endregion
+//#region src/templates/actions/setup.yml
+var setup_default = "name: Setup\ndescription: Prepare the environment and install project dependencies.\n\ninputs:\n  node-version:\n    description: Node.js version\n    required: false\n    default: \"22.x\"\n\nruns:\n  using: composite\n\n  steps:\n    - uses: theholocron/.github/.github/actions/setup-node@main\n      with:\n        node-version: ${{ inputs.node-version }}\n\n    - uses: theholocron/.github/.github/actions/install@main\n";
+//#endregion
+//#region src/templates/actions/setup-node.yml
+var setup_node_default = "name: Setup Node\ndescription: Install pnpm and Node.js with pnpm dependency caching.\n\ninputs:\n  node-version:\n    description: Node.js version\n    required: false\n    default: \"22.x\"\n\nruns:\n  using: composite\n\n  steps:\n    - name: Setup pnpm\n      if: ${{ hashFiles('pnpm-lock.yaml') != '' }}\n      uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4\n\n    - name: Setup Node.js\n      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4\n      with:\n        node-version: ${{ hashFiles('.node-version') != '' && '' || inputs.node-version }}\n        node-version-file: ${{ hashFiles('.node-version') != '' && '.node-version' || '' }}\n        cache: ${{ hashFiles('pnpm-lock.yaml') != '' && 'pnpm' || '' }}\n\n    - name: Add node_modules/.bin to PATH\n      shell: bash\n      run: echo \"$GITHUB_WORKSPACE/node_modules/.bin\" >> $GITHUB_PATH\n";
+//#endregion
+//#region src/templates/workflows/audit.yml
+var audit_default = "name: Audit\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      build-script:\n        description: Script to build and upload bundle stats to Codecov\n        type: string\n        required: false\n        default: pnpm build\n      run-knip:\n        description: Run Knip to detect unused files, exports, and dependencies\n        type: boolean\n        required: false\n        default: false\n      knip-script:\n        description: Script that invokes Knip (must exit non-zero on findings)\n        type: string\n        required: false\n        default: pnpm run audit\n    secrets:\n      CODECOV_TOKEN:\n        required: false\n\njobs:\n  bundle-size:\n    name: Audit the bundle size\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    concurrency:\n      group: audit-${{ github.ref }}\n      cancel-in-progress: true\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: eval \"$BUILD_SCRIPT\"\n        name: Build and upload bundle stats\n        env:\n          BUILD_SCRIPT: ${{ inputs.build-script }}\n          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}\n\n  knip:\n    name: Knip\n    if: ${{ inputs.run-knip }}\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          persist-credentials: false\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: eval \"$KNIP_SCRIPT\"\n        name: Run Knip\n        env:\n          KNIP_SCRIPT: ${{ inputs.knip-script }}\n";
+//#endregion
+//#region src/templates/workflows/bookkeeping.yml
+var bookkeeping_default = "name: Bookkeeping\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      configuration-path:\n        description: Path to the labeler configuration file in the calling repo\n        type: string\n        required: false\n        default: .github/labeler.yml\n\njobs:\n  label:\n    name: Apply Labels\n    permissions:\n      contents: read\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    concurrency:\n      group: bookkeeping-${{ github.event.pull_request.number || github.event.issue.number }}\n      cancel-in-progress: true\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          sparse-checkout: ${{ inputs.configuration-path || '.github/labeler.yml' }}\n          sparse-checkout-cone-mode: false\n\n      - uses: github/issue-labeler@c1b0f9f52a63158c4adc09425e858e87b32e9685 # v3.4\n        if: ${{ github.event_name == 'pull_request' && hashFiles(inputs.configuration-path || '.github/labeler.yml') != '' }}\n        # v3.4 bundles Node 20; allow it to run under Actions' current default.\n        env:\n          ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true\n        with:\n          # Fall back to default path when triggered directly (not via workflow_call)\n          # because inputs.* defaults only apply on workflow_call events.\n          configuration-path: ${{ inputs.configuration-path || '.github/labeler.yml' }}\n          include-title: 1\n          include-body: 0\n          sync-labels: 1\n          enable-versioned-regex: 0\n          repo-token: ${{ github.token }}\n";
+//#endregion
+//#region src/templates/workflows/codeql.yml
+var codeql_default = "name: CodeQL\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      language:\n        description: CodeQL language to analyze\n        type: string\n        required: false\n        default: javascript-typescript\n\njobs:\n  analyze:\n    name: Analyze (${{ inputs.language }})\n    permissions:\n      actions: read\n      contents: read\n      security-events: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 45\n    # Do not cancel in-progress security scans.\n    concurrency:\n      group: codeql-${{ github.ref }}\n      cancel-in-progress: false\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0\n        name: Initialize CodeQL\n        with:\n          languages: ${{ inputs.language }}\n\n      - uses: github/codeql-action/autobuild@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0\n        name: Autobuild\n\n      - uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0\n        name: Analyze\n        with:\n          category: /language:${{ inputs.language }}\n";
+//#endregion
+//#region src/templates/workflows/dependencies.yml
+var dependencies_default = "name: Dependencies\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      merge-token:\n        description: >\n          Optional privileged token for auto-merge. Falls back to GITHUB_TOKEN.\n          Required when branch protection enforces required reviews — GITHUB_TOKEN\n          cannot approve its own PRs.\n        required: false\n\njobs:\n  dependabot:\n    name: Update the dependencies\n    permissions:\n      contents: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    concurrency:\n      group: dependencies-${{ github.event.pull_request.number }}\n      cancel-in-progress: true\n    if: github.event.pull_request.user.login == 'dependabot[bot]'\n    steps:\n      - uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0\n        name: Fetch Dependabot metadata\n        id: metadata\n\n      - run: gh pr merge --auto --squash \"$PR_URL\"\n        # --squash is intentional: repo protection sets allow_merge_commit: false,\n        # so --merge would fail on any repo using the standard preset.\n        name: Enable auto-merge for Dependabot PRs\n        if: steps.metadata.outputs.update-type == 'version-update:semver-patch'\n        env:\n          PR_URL: ${{ github.event.pull_request.html_url }}\n          GH_TOKEN: ${{ secrets.merge-token || github.token }}\n";
+//#endregion
+//#region src/templates/workflows/greetings.yml
+var greetings_default = "name: Greetings\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n\njobs:\n  greeting:\n    name: Greet first-time contributors\n    permissions:\n      issues: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    # Group by the issue/PR number so duplicate events don't race each other.\n    concurrency:\n      group: greetings-${{ github.event.issue.number || github.event.pull_request.number }}\n      cancel-in-progress: false\n    steps:\n      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n        name: Greet on first contribution\n        with:\n          script: |\n            // Only greet on the initial open — ignore synchronize, reopened, etc.\n            if (context.payload.action !== 'opened') return;\n\n            const actor = context.actor;\n            const { owner, repo } = context.repo;\n\n            // Payload inspection is more reliable than context.eventName for detecting\n            // whether this is an issue vs. PR event — works regardless of how GitHub\n            // propagates event names through workflow_call chains.\n            const isIssue = !!context.payload.issue && !context.payload.pull_request;\n            // listForRepo returns both issues and PRs (GitHub treats PRs as issues),\n            // sorted newest-first. Filter by type to track first-issue and first-PR\n            // independently, and avoid search-index eventual-consistency lag.\n            const { data: recent } = await github.rest.issues.listForRepo({\n              owner, repo,\n              creator: actor,\n              state: 'all',\n              per_page: 100\n            });\n\n            const sameType = recent.filter(item =>\n              isIssue ? !item.pull_request : !!item.pull_request\n            );\n\n            if (sameType.length !== 1) return;\n            const body = isIssue\n              ? `Hey @${actor}!\\n\\nWe really appreciate you taking the time to report an issue. The collaborators on this project attempt to help as many people as possible, but we are a limited number of volunteers, so it is possible that this will not be addressed as swiftly.\\n\\nYour patience is much appreciated and we will get back to you as quickly as possible.`\n              : `Hey @${actor}!\\n\\nWe really appreciate you taking the time to help out with this PR. The collaborators on this project attempt to help as many people as possible, but we are a limited number of volunteers, so it is possible that this will not be addressed as swiftly.\\n\\nYour patience is much appreciated and we will get back to you as quickly as possible.`;\n\n            await github.rest.issues.createComment({\n              owner,\n              repo,\n              issue_number: context.issue.number,\n              body\n            });\n";
+//#endregion
+//#region src/templates/workflows/lint.yml
+var lint_default = "name: Lint\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      prettier-config:\n        type: string\n        required: false\n        default: prettier.config.js\n      yaml-config:\n        type: string\n        required: false\n        default: yamllint.config.yml\n      enable-auto-commit:\n        description: Auto-commit super-linter fixes via GPG-signed commit\n        type: boolean\n        required: false\n        default: false\n    secrets:\n      SUPER_LINTER_GPG_PRIVATE_KEY:\n        required: false\n      SUPER_LINTER_GPG_PASSPHRASE:\n        required: false\n\njobs:\n  super-lint:\n    name: Lint entire codebase\n    permissions:\n      contents: write\n      statuses: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    env:\n      GPG_KEY_SET: ${{ secrets.SUPER_LINTER_GPG_PRIVATE_KEY != '' }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n          token: ${{ github.token }}\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n        if: ${{ hashFiles('pnpm-lock.yaml') != '' }}\n\n      - uses: super-linter/super-linter/slim@4ce20838b8ab83717e78138c5b3a1407148e0918 # v8.7.0\n        name: Run Super Linter\n        env:\n          GITHUB_TOKEN: ${{ github.token }}\n          DEFAULT_BRANCH: ${{ github.event.pull_request.base.ref || github.event.repository.default_branch }}\n          ANNOTATE_ONLY: true\n          DISABLE_COMMENTS: false\n          IGNORE_GITIGNORED_FILES: true\n          LINTER_RULES_PATH: /\n          EDITORCONFIG_FILE_NAME: \".editorconfig-checker.json\"\n          FIX_ENV: true\n          FIX_GRAPHQL_PRETTIER: true\n          FIX_HTML_PRETTIER: true\n          FIX_JAVASCRIPT_PRETTIER: true\n          FIX_JSX_PRETTIER: true\n          FIX_MARKDOWN_PRETTIER: true\n          FIX_TSX: true\n          FIX_TYPESCRIPT_PRETTIER: true\n          PRETTIER_CONFIG: ${{ inputs.prettier-config }}\n          VALIDATE_DOCKERFILE: true\n          VALIDATE_EDITORCONFIG: true\n          VALIDATE_ENV: true\n          VALIDATE_GIT_COMMITLINT: true\n          VALIDATE_GIT_MERGE_CONFLICT_MARKERS: true\n          VALIDATE_GITHUB_ACTIONS: true\n          VALIDATE_GITLEAKS: true\n          VALIDATE_GRAPHQL_PRETTIER: true\n          VALIDATE_HTML_PRETTIER: true\n          VALIDATE_JAVASCRIPT_PRETTIER: true\n          VALIDATE_JSX_PRETTIER: true\n          VALIDATE_MARKDOWN_PRETTIER: true\n          VALIDATE_TSX: true\n          VALIDATE_TYPESCRIPT_PRETTIER: true\n          VALIDATE_YAML: true\n          YAML_CONFIG_FILE: ${{ inputs.yaml-config }}\n\n      - uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0\n        name: Import GPG Key\n        # Conditions mirror auto-commit exactly — no point importing GPG if the\n        # commit step will be skipped (fork PR, default branch, or secret unset).\n        if: >\n          inputs.enable-auto-commit == true &&\n          github.event.pull_request != null &&\n          github.event.pull_request.head.repo.full_name == github.repository &&\n          github.ref_name != github.event.repository.default_branch &&\n          env.GPG_KEY_SET == 'true'\n        with:\n          git_user_signingkey: true\n          git_commit_gpgsign: true\n          GPG_PRIVATE_KEY: ${{ secrets.SUPER_LINTER_GPG_PRIVATE_KEY }}\n          PASSPHRASE: ${{ secrets.SUPER_LINTER_GPG_PASSPHRASE }}\n\n      - uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d # v7.2.0\n        name: Commit and push linting fixes\n        if: >\n          inputs.enable-auto-commit == true &&\n          github.event.pull_request != null &&\n          github.event.pull_request.head.repo.full_name == github.repository &&\n          github.ref_name != github.event.repository.default_branch &&\n          env.GPG_KEY_SET == 'true'\n        with:\n          branch: ${{ github.event.pull_request.head.ref || github.head_ref || github.ref }}\n          commit_message: \"chore: fix linting issues\\n\\nSigned-off-by: super-linter <super-linter@super-linter.dev>\"\n          commit_options: \"--no-verify\"\n          commit_user_name: super-linter\n          commit_user_email: super-linter@super-linter.dev\n";
+//#endregion
+//#region src/templates/workflows/release.yml
+var release_default = "name: Release\n\n# Semantic-release with OIDC Trusted Publishing — no NPM_TOKEN required.\n# The calling repo must have a .releaserc.json that configures branches,\n# plugins, and any publish options. npm@11+ is installed to support OIDC.\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      run-build:\n        description: Run `pnpm build` before releasing\n        type: boolean\n        required: false\n        default: true\n    secrets:\n      HOLOCRON_RELEASE_TOKEN:\n        description: >\n          Fine-grained PAT (Contents + Issues + Pull requests: write) owned by\n          an admin. Required when the default branch is protected by a ruleset —\n          github.token cannot push through rulesets, but an admin PAT can.\n          Takes priority over HOLOCRON_SYNC_TOKEN. Falls back to github.token.\n        required: false\n      HOLOCRON_SYNC_TOKEN:\n        description: >\n          Legacy alias for HOLOCRON_RELEASE_TOKEN — kept for backward compatibility.\n          Prefer HOLOCRON_RELEASE_TOKEN for new repos.\n        required: false\n      HOLOCRON_READ_TOKEN:\n        description: >\n          Fine-grained PAT for read-only GitHub API calls (e.g. resolving git\n          committer identity via `gh api user`). Falls back to github.token.\n        required: false\n      GH_TOKEN:\n        description: >\n          Generic GitHub token fallback for `gh` CLI calls. Used when\n          HOLOCRON_READ_TOKEN is not set.\n        required: false\n\njobs:\n  release:\n    name: Semantic release\n    permissions:\n      contents: write\n      id-token: write\n      issues: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    # Do not cancel in-progress releases — a partial release is worse than a slow one.\n    concurrency:\n      group: release-${{ github.ref }}\n      cancel-in-progress: false\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n          # Use HOLOCRON_RELEASE_TOKEN when available — git push (tags, release commits)\n          # uses the checkout credential, not GITHUB_TOKEN env var. The\n          # built-in github.token cannot push through branch protection rulesets.\n          token: ${{ secrets.HOLOCRON_RELEASE_TOKEN || secrets.HOLOCRON_SYNC_TOKEN || github.token }}\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - name: Configure git identity\n        run: |\n          GIT_NAME=$(gh api user --jq .name 2>/dev/null || echo \"github-actions[bot]\")\n          GIT_EMAIL=$(gh api user --jq '\"\\(.id)+\\(.login)@users.noreply.github.com\"' 2>/dev/null || echo \"41898282+github-actions[bot]@users.noreply.github.com\")\n          git config --global user.name \"$GIT_NAME\"\n          git config --global user.email \"$GIT_EMAIL\"\n          git config --global format.signoff true\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_READ_TOKEN || secrets.GH_TOKEN || github.token }}\n\n      - run: npm install -g npm@11 sigstore\n        name: Upgrade npm for OIDC support\n        # sigstore is required by libnpmpublish/provenance.js at module parse\n        # time — before any config takes effect. Some npm 11.x builds stopped\n        # bundling it; installing it globally into the same prefix ensures it\n        # resolves regardless of npm version. (Discovered 2026-07-09.)\n\n      - run: pnpm build\n        name: Build\n        if: ${{ inputs.run-build == true }}\n\n      - run: npx semantic-release\n        name: Release\n        env:\n          # Prefer HOLOCRON_RELEASE_TOKEN (fine-grained PAT, Contents+Issues+PRs write,\n          # owned by an admin with ruleset bypass) so @semantic-release/git can\n          # push the version-bump commit through branch protection. Falls back to\n          # HOLOCRON_SYNC_TOKEN (legacy) then github.token for unprotected repos.\n          GITHUB_TOKEN: ${{ secrets.HOLOCRON_RELEASE_TOKEN || secrets.HOLOCRON_SYNC_TOKEN || github.token }}\n          NPM_CONFIG_PROVENANCE: true\n";
+//#endregion
+//#region src/templates/workflows/review.yml
+var review_default = "name: Review\n\n# ReviewDog is the annotation layer — posts inline PR diff annotations.\n# Runs on pull_request only: inline annotations require PR context,\n# and branch protection ensures all changes go through PRs anyway.\n# super-linter (lint.yml) is the CI gate covering push + PR events.\n# Gitleaks and YAML are intentionally duplicated: super-linter gates\n# merges; ReviewDog surfaces exact line annotations in the PR diff.\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n\nconcurrency:\n  group: review-${{ github.workflow }}-${{ github.ref }}\n  cancel-in-progress: true\n\njobs:\n  reviewdog:\n    name: Review PRs\n    runs-on: ubuntu-latest\n    timeout-minutes: 20\n    permissions:\n      contents: read\n      pull-requests: write\n\n    steps:\n      - name: Checkout repository\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          fetch-depth: 0\n\n      - name: Setup\n        if: ${{ hashFiles('pnpm-lock.yaml') != '' }}\n        uses: theholocron/.github/.github/actions/setup@main\n\n      - name: Install ReviewDog\n        uses: reviewdog/action-setup@d8a7baabd7f3e8544ee4dbde3ee41d0011c3a93f # v1\n        with:\n          reviewdog_version: latest\n\n      # Detect which tools are relevant for this repo, excluding node_modules.\n      # hashFiles('**/*') recurses into node_modules/.pnpm and produces false\n      # positives for repos that don't own those file types.\n      # -print -quit stops find after the first match without a pipe, avoiding\n      # the SIGPIPE/pipefail exit-141 that find|head-1 triggers under\n      # GitHub Actions' default bash --noprofile --norc -e -o pipefail mode.\n      - name: Detect project features\n        id: detect\n        shell: bash\n        run: |\n          has() { find . -not -path '*/node_modules/*' -name \"$1\" -print -quit 2>/dev/null | grep -q .; }\n          has_ext() { find . -not -path '*/node_modules/*' -name \"$1\" -print -quit 2>/dev/null | grep -q .; }\n          { { has 'eslint.config.js' || has 'eslint.config.mjs' || has 'eslint.config.cjs' || \\\n              has 'eslint.config.ts' || has '.eslintrc' || has '.eslintrc.js' || \\\n              has '.eslintrc.cjs' || has '.eslintrc.json' || has '.eslintrc.yaml' || \\\n              has '.eslintrc.yml'; } && grep -qF '\"eslint\":' package.json 2>/dev/null; } && echo \"eslint=true\" >> \"$GITHUB_OUTPUT\" || echo \"eslint=false\" >> \"$GITHUB_OUTPUT\"\n          { has 'tsconfig.json' && grep -qF '\"typescript\":' package.json 2>/dev/null; } && echo \"tsconfig=true\" >> \"$GITHUB_OUTPUT\" || echo \"tsconfig=false\" >> \"$GITHUB_OUTPUT\"\n          has_ext '*.sh' && echo \"shell=true\" >> \"$GITHUB_OUTPUT\" || echo \"shell=false\" >> \"$GITHUB_OUTPUT\"\n          has 'Dockerfile' || has_ext '*.Dockerfile' || has 'Containerfile' && \\\n            echo \"docker=true\" >> \"$GITHUB_OUTPUT\" || echo \"docker=false\" >> \"$GITHUB_OUTPUT\"\n          has_ext '.env*' && echo \"dotenv=true\" >> \"$GITHUB_OUTPUT\" || echo \"dotenv=false\" >> \"$GITHUB_OUTPUT\"\n          has_ext '*.md' && echo \"markdown=true\" >> \"$GITHUB_OUTPUT\" || echo \"markdown=false\" >> \"$GITHUB_OUTPUT\"\n\n      #\n      # Always applicable\n      #\n\n      - name: Gitleaks (secrets)\n        uses: reviewdog/action-gitleaks@2b7b5685e3e3eecddab5d30cfa04f18123031421 # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / gitleaks\"\n          gitleaks_flags: --log-opts=${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }}\n\n      - name: YamlLint\n        if: ${{ hashFiles('yamllint.config.yml') != '' }}\n        uses: reviewdog/action-yamllint@b5f7217d8c815ae374d1d55840d5e569d82f01f0 # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / yamllint\"\n          yamllint_flags: -c ${{ github.workspace }}/yamllint.config.yml ${{ github.workspace }}\n\n      - name: ActionLint (GitHub Actions)\n        if: ${{ hashFiles('.github/workflows/*.yml', '.github/workflows/*.yaml') != '' }}\n        uses: reviewdog/action-actionlint@6fb7acc99f4a1008869fa8a0f09cfca740837d9d # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / actionlint\"\n\n      #\n      # TypeScript / JavaScript\n      #\n\n      - name: ESLint\n        if: steps.detect.outputs.eslint == 'true'\n        uses: reviewdog/action-eslint@556a3fdaf8b4201d4d74d406013386aa4f7dab96 # v1.34.0\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / eslint\"\n          eslint_flags: .\n\n      - name: TypeScript\n        if: steps.detect.outputs.tsconfig == 'true'\n        uses: EPMatt/reviewdog-action-tsc@63d923a3c5b4497671940b8874f58a404e2351b5 # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / tsc\"\n\n      #\n      # Shell\n      #\n\n      - name: ShellCheck\n        if: steps.detect.outputs.shell == 'true'\n        uses: reviewdog/action-shellcheck@4c07458293ac342d477251099501a718ae5ef86e # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / shellcheck\"\n          fail_level: none\n\n      #\n      # Docker\n      #\n\n      - name: Hadolint\n        if: steps.detect.outputs.docker == 'true'\n        uses: reviewdog/action-hadolint@1b2cfa6ba72072ad35158d7ff3aa49bbdc03506d # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / hadolint\"\n          fail_level: none\n\n      #\n      # Environment files\n      #\n\n      - name: dotenv-linter\n        if: steps.detect.outputs.dotenv == 'true'\n        uses: dotenv-linter/action-dotenv-linter@afde61cfda2ecffe7bea35837b6f20b956c88689 # v3.0.0\n        with:\n          reporter: github-code-suggestions\n\n      #\n      # Documentation\n      #\n\n      - name: Alex (inclusive language)\n        if: steps.detect.outputs.markdown == 'true'\n        uses: reviewdog/action-alex@347481655add010a2ae302df34b57c9bcfa0d6e4 # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / alex\"\n";
+//#endregion
+//#region src/templates/workflows/stale.yml
+var stale_default = "name: Stale\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      days-before-stale:\n        description: Days of inactivity before an issue is marked stale\n        type: number\n        required: false\n        default: 30\n      days-before-close:\n        description: Days of inactivity after stale label before closing\n        type: number\n        required: false\n        default: 5\n\njobs:\n  stale:\n    name: Mark stale issues and pull requests\n    permissions:\n      contents: write\n      issues: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    steps:\n      - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0\n        name: Run Stale\n        with:\n          close-issue-message: >\n            This issue was closed because it has been stalled for\n            ${{ inputs.days-before-close }} days with no activity.\n          days-before-close: ${{ inputs.days-before-close }}\n          days-before-stale: ${{ inputs.days-before-stale }}\n          exempt-all-pr-milestones: true\n          stale-issue-label: wontfix\n          stale-issue-message: >\n            This issue is stale because it has been open ${{ inputs.days-before-stale }}\n            days with no activity. Remove the stale label or comment, or this will be\n            closed in ${{ inputs.days-before-close }} days.\n          stale-pr-label: wontfix\n          stale-pr-message: >\n            This PR is stale because it has been open ${{ inputs.days-before-stale }}\n            days with no activity. Remove the stale label or comment, or this will be\n            closed in ${{ inputs.days-before-close }} days.\n";
+//#endregion
+//#region src/templates/workflows/sync-github.yml
+var sync_github_default = "name: Sync GitHub Templates\n\n# Builds the holocron CLI from source and pushes updated workflow templates\n# and composite actions to downstream .github repos. Runs whenever the\n# template source files change on main or alpha.\n#\n# Secrets required:\n#   HOLOCRON_SYNC_TOKEN — fine-grained PAT (resource owner: org) with:\n#                  Contents:      Read and write  (git trees, blobs, refs)\n#                  Pull requests: Read and write  (open sync PR)\n#                  Workflows:     Read and write  (write .github/workflows/*.yml)\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      primary-repo:\n        description: >\n          Primary .github repo — receives composite actions, reusable workflows,\n          and thin-caller templates. Requires a PR (branch protection assumed).\n        type: string\n        required: false\n        default: theholocron/.github\n      secondary-repos:\n        description: >\n          Space-separated list of secondary repos (reusable workflows + thin\n          callers only, no composite actions). Changes are delivered via pull\n          request, same as the primary repo.\n        type: string\n        required: false\n        default: \"\"\n      sync-branch:\n        description: Branch name used for the primary and secondary repo PRs\n        type: string\n        required: false\n        default: chore/sync-templates\n    secrets:\n      HOLOCRON_SYNC_TOKEN:\n        required: true\n      HOLOCRON_READ_TOKEN:\n        description: >\n          Fine-grained PAT for read-only GitHub API calls (e.g. resolving git\n          committer identity via `gh api user`). Falls back to HOLOCRON_SYNC_TOKEN.\n        required: false\n      GH_TOKEN:\n        description: >\n          Generic GitHub token fallback for `gh` CLI calls. Used when neither\n          HOLOCRON_READ_TOKEN nor HOLOCRON_SYNC_TOKEN is set.\n        required: false\n\njobs:\n  sync:\n    name: Sync templates\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    permissions:\n      contents: read\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: pnpm build\n        name: Build CLI\n\n      - name: Validate generated workflows\n        run: |\n          node packages/cli/dist/cli.mjs sync-github \\\n            --repo \"$PRIMARY_REPO\" \\\n            --output-dir /tmp/sync-validate\n          curl -fsSL https://github.com/rhysd/actionlint/releases/download/v1.7.7/actionlint_1.7.7_linux_amd64.tar.gz \\\n            | tar -xz -C /tmp actionlint\n          /tmp/actionlint /tmp/sync-validate/.github/workflows/*.yml\n        env:\n          PRIMARY_REPO: ${{ inputs.primary-repo }}\n\n      - name: Sync primary repo (PR)\n        run: |\n          GIT_NAME=$(gh api user --jq .name 2>/dev/null || echo \"github-actions[bot]\")\n          GIT_EMAIL=$(gh api user --jq '\"\\(.id)+\\(.login)@users.noreply.github.com\"' 2>/dev/null || echo \"41898282+github-actions[bot]@users.noreply.github.com\")\n          COMMIT_MSG=\"chore: sync from theholocron/holocron\"$'\\n\\n'\"Signed-off-by: $GIT_NAME <$GIT_EMAIL>\"\n          node packages/cli/dist/cli.mjs sync-github \\\n            --repo \"$PRIMARY_REPO\" \\\n            --branch \"$SYNC_BRANCH\" \\\n            --pr \\\n            --message \"$COMMIT_MSG\"\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_READ_TOKEN || secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN }}\n          HOLOCRON_SYNC_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN }}\n          PRIMARY_REPO: ${{ inputs.primary-repo }}\n          SYNC_BRANCH: ${{ inputs.sync-branch }}\n\n      - name: Sync secondary repos (PR)\n        if: ${{ inputs.secondary-repos != '' }}\n        run: |\n          GIT_NAME=$(gh api user --jq .name 2>/dev/null || echo \"github-actions[bot]\")\n          GIT_EMAIL=$(gh api user --jq '\"\\(.id)+\\(.login)@users.noreply.github.com\"' 2>/dev/null || echo \"41898282+github-actions[bot]@users.noreply.github.com\")\n          COMMIT_MSG=\"chore: sync from theholocron/holocron\"$'\\n\\n'\"Signed-off-by: $GIT_NAME <$GIT_EMAIL>\"\n          for repo in $SECONDARY_REPOS; do\n            node packages/cli/dist/cli.mjs sync-github \\\n              --repo \"$repo\" \\\n              --branch \"$SYNC_BRANCH\" \\\n              --pr \\\n              --message \"$COMMIT_MSG\"\n          done\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_READ_TOKEN || secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN }}\n          HOLOCRON_SYNC_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN }}\n          SECONDARY_REPOS: ${{ inputs.secondary-repos }}\n          SYNC_BRANCH: ${{ inputs.sync-branch }}\n";
+//#endregion
+//#region src/templates/workflows/test.yml
+var test_default = "name: Test\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n\njobs:\n  unit:\n    name: Run tests and collect coverage\n    permissions:\n      contents: read\n      id-token: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: pnpm test -- --coverage\n        name: Run tests with coverage\n\n      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0\n        name: Upload coverage to Codecov\n        with:\n          use_oidc: true\n\n      - uses: codecov/test-results-action@0fa95f0e1eeaafde2c782583b36b28ad0d8c77d3 # v1\n        name: Upload test results to Codecov\n        if: ${{ !cancelled() }}\n        with:\n          use_oidc: true\n          files: '**/test-report.junit.xml'\n";
+//#endregion
+//#region src/templates/workflows/typecheck.yml
+var typecheck_default = "name: Typecheck\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n\njobs:\n  typecheck:\n    name: tsc --noEmit\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: pnpm typecheck\n        name: Type check\n";
+//#endregion
+//#region src/templates/index.ts
 /**
-* Build a strict, single-feature token resolver.
+* All reusable workflow and composite action content bundled as string
+* constants so the CLI can push them to theholocron/.github without
+* needing filesystem access at runtime.
 *
-* Resolution chain: `--token flag → envName env var → keyring(keyringKey)`.
-* No broad-token fallback — if the feature-specific token is absent the
-* operation fails with a message naming the exact env var to set.
+* Content lives in standalone .yml files; the rawYml rollup plugin
+* inlines them as string exports at build time.
 */
-function createFeatureResolver(config) {
-	return function resolveFeatureToken(input = {}) {
-		const env = createEnvLookup(input.env);
-		const keyring = input.keyring ?? getToken;
-		const token = input.cliToken || env.get(config.envName) || keyring(config.keyringKey);
-		if (!token) throw new AuthError(`no GitHub token found for this operation. Pass --token <PAT>, set ${config.envName}, or run: holocron auth set ${config.keyringKey} <PAT>`);
-		return token;
-	};
-}
+const ACTIONS = {
+	"setup/action": setup_default,
+	"install/action": install_default,
+	"setup-node/action": setup_node_default
+};
+const REUSABLE_WORKFLOWS = {
+	audit: audit_default,
+	bookkeeping: bookkeeping_default,
+	codeql: codeql_default,
+	dependencies: dependencies_default,
+	greetings: greetings_default,
+	lint: lint_default,
+	release: release_default,
+	review: review_default,
+	stale: stale_default,
+	"sync-github": sync_github_default,
+	test: test_default,
+	typecheck: typecheck_default
+};
+const WORKFLOW_TEMPLATE_PROPERTIES = {
+	bookkeeping: JSON.stringify({
+		name: "Bookkeeping",
+		description: "Label and track issues and pull requests.",
+		iconName: "octicon tag"
+	}, null, 2),
+	"sync-github": JSON.stringify({
+		name: "Sync GitHub Templates",
+		description: "Sync workflow templates and composite actions from the holocron CLI.",
+		iconName: "octicon sync"
+	}, null, 2)
+};
 //#endregion
-//#region src/commands/sync.ts
-const SYNC_STEPS = [
-	"labels",
-	"properties",
-	"teams",
-	"topics",
-	"keywords",
-	"description"
-];
-const LOCAL_STEPS = /* @__PURE__ */ new Set(["keywords", "description"]);
-async function runSync(input) {
-	const print = input.print ?? ((line) => console.log(line));
-	const loader = input.loader ?? new PluginLoader(input.loaded.resolved, input.context);
-	const config = input.loaded.resolved;
-	const dryRun = input.context.dryRun ?? false;
-	const requestedSteps = input.steps;
-	const steps = [];
-	if (!requestedSteps || requestedSteps.some((s) => !LOCAL_STEPS.has(s))) await loader.load();
-	else try {
-		await loader.load();
-	} catch (err) {
-		if (!(err instanceof AuthError)) throw err;
+//#region src/commands/sync-github.ts
+const DEFAULT_REPO = "theholocron/.github";
+/**
+* Extracts the `workflows` array from a `holocron.config.ts` source string.
+* Handles both plain string entries and `{ name, with }` object entries.
+* Falls back to an empty array if the array cannot be found or parsed.
+*/
+function parseWorkflowsFromTs(source) {
+	const keyMatch = source.match(/\bworkflows\s*:\s*\[/);
+	if (!keyMatch) return [];
+	const start = keyMatch.index + keyMatch[0].length;
+	let depth = 1;
+	let i = start;
+	while (i < source.length && depth > 0) {
+		if (source[i] === "[") depth++;
+		else if (source[i] === "]") depth--;
+		i++;
 	}
-	print(`Holocron sync — ${config.name}${dryRun ? " (dry-run)" : ""}`);
-	print(`  config: ${input.loaded.filepath}`);
-	print("");
-	if (loader.has("source")) {
-		const source = loader.get("source");
-		print("  → source");
-		for (const stepName of SYNC_STEPS) {
-			if (requestedSteps !== void 0 && !requestedSteps.includes(stepName)) continue;
-			if (LOCAL_STEPS.has(stepName)) continue;
-			if (stepName === "labels") if (source.syncLabels) {
-				steps.push(await runSyncStep("source", "sync labels", dryRun, () => source.syncLabels(CANONICAL_LABELS, STALE_LABELS)));
-				print(formatSyncStep(steps[steps.length - 1]));
-			} else {
-				steps.push({
-					capability: "source",
-					step: "sync labels",
-					status: "skip",
-					message: "provider does not implement syncLabels"
-				});
-				print(formatSyncStep(steps[steps.length - 1]));
-			}
-			if (stepName === "properties") if (source.syncProperties) {
-				const repo = config.repo;
-				const properties = {};
-				const effectivePreset = repo?.protection;
-				if (effectivePreset && effectivePreset !== "none") properties["branch_protection_level"] = effectivePreset;
-				const isMonorepo = await access(join(input.context.repoRoot, "pnpm-workspace.yaml")).then(() => true).catch(() => false);
-				properties["monorepo"] = String(isMonorepo);
-				const manual = repo?.properties ?? {};
-				if (manual.lifecycle) properties["lifecycle"] = manual.lifecycle;
-				if (manual.open_source !== void 0) properties["open_source"] = String(manual.open_source);
-				if (manual.runtime_environment) properties["runtime_environment"] = manual.runtime_environment;
-				if (manual.uses_external_packages !== void 0) properties["uses_external_packages"] = String(manual.uses_external_packages);
-				steps.push(await runSyncStep("source", "sync properties", dryRun, () => source.syncProperties(properties)));
-				print(formatSyncStep(steps[steps.length - 1]));
-			} else {
-				steps.push({
-					capability: "source",
-					step: "sync properties",
-					status: "skip",
-					message: "provider does not implement syncProperties"
-				});
-				print(formatSyncStep(steps[steps.length - 1]));
-			}
-			if (stepName === "teams") {
-				const teams = config.repo?.teams ?? [];
-				if (teams.length === 0) {
-					steps.push({
-						capability: "source",
-						step: "sync teams",
-						status: "skip",
-						message: "no teams configured"
-					});
-					print(formatSyncStep(steps[steps.length - 1]));
-				} else if (source.syncTeams) {
-					steps.push(await runSyncStep("source", "sync teams", dryRun, () => source.syncTeams(teams)));
-					print(formatSyncStep(steps[steps.length - 1]));
-					const repoCoord = input.context.repo ?? config.repo?.name ?? "";
-					const org = repoCoord.includes("/") ? repoCoord.split("/")[0] : "";
-					const writeableTeams = teams.map((t) => typeof t === "string" ? {
-						slug: t,
-						permission: "push"
-					} : t).filter((t) => [
-						"push",
-						"maintain",
-						"admin"
-					].includes(t.permission));
-					if (org && writeableTeams.length > 0) {
-						steps.push(await runSyncStep("source", "write .github/CODEOWNERS", dryRun, async () => {
-							const content = writeableTeams.map((t) => `* @${org}/${t.slug}`).join("\n") + "\n";
-							await source.writeRepoFile(".github/CODEOWNERS", content);
-						}));
-						print(formatSyncStep(steps[steps.length - 1]));
-					}
-				} else {
-					steps.push({
-						capability: "source",
-						step: "sync teams",
-						status: "skip",
-						message: "provider does not implement syncTeams"
-					});
-					print(formatSyncStep(steps[steps.length - 1]));
-				}
-			}
-			if (stepName === "topics") {
-				const topics = config.repo?.topics ?? [];
-				if (topics.length === 0) {
-					steps.push({
-						capability: "source",
-						step: "sync topics",
-						status: "skip",
-						message: "no topics configured"
-					});
-					print(formatSyncStep(steps[steps.length - 1]));
-				} else if (source.syncTopics) {
-					steps.push(await runSyncStep("source", "sync topics", dryRun, () => source.syncTopics(topics)));
-					print(formatSyncStep(steps[steps.length - 1]));
-				} else {
-					steps.push({
-						capability: "source",
-						step: "sync topics",
-						status: "skip",
-						message: "provider does not implement syncTopics"
-					});
-					print(formatSyncStep(steps[steps.length - 1]));
-				}
+	const body = source.slice(start, i - 1);
+	const entries = [];
+	const objSpans = [];
+	const objRe = /\{\s*name\s*:\s*"([^"]+)"(?:\s*,\s*with\s*:\s*(\{[^}]*\}))?\s*\}/g;
+	let m;
+	while ((m = objRe.exec(body)) !== null) {
+		objSpans.push([m.index, m.index + m[0].length]);
+		let withObj;
+		if (m[2]) try {
+			withObj = JSON.parse(m[2]);
+		} catch {}
+		entries.push({
+			pos: m.index,
+			entry: {
+				name: m[1],
+				...withObj && { with: withObj }
 			}
+		});
+	}
+	const strRe = /"([^"]+)"/g;
+	while ((m = strRe.exec(body)) !== null) if (!objSpans.some(([s, e]) => m.index >= s && m.index < e)) entries.push({
+		pos: m.index,
+		entry: { name: m[1] }
+	});
+	entries.sort((a, b) => a.pos - b.pos);
+	return entries.map(({ entry }) => entry);
+}
+function reusableHeader(source) {
+	return [
+		`# AUTO-GENERATED — do not edit in theholocron/.github directly.`,
+		`# Source:  theholocron/holocron · ${source}`,
+		`# Synced:  ${(/* @__PURE__ */ new Date()).toISOString()}`,
+		`# Tool:    holocron sync-github`,
+		`# Changes: edit source in theholocron/holocron and push to alpha or main.`,
+		``
+	].join("\n");
+}
+function thinCallerHeader(forPrimary = false) {
+	return [
+		forPrimary ? `# AUTO-GENERATED — do not edit in theholocron/.github directly.` : `# AUTO-GENERATED — do not edit directly.`,
+		`# Source:  theholocron/holocron · packages/cli/src/commands/setup-workflows.ts`,
+		`# Synced:  ${(/* @__PURE__ */ new Date()).toISOString()}`,
+		`# Tool:    holocron sync-github`,
+		`# Changes: edit source in theholocron/holocron and push to alpha or main.`,
+		``
+	].join("\n");
+}
+function buildBatch(repo, allowedWorkflows, withOverrides) {
+	const files = [];
+	const isPrimaryGithubRepo = repo === DEFAULT_REPO;
+	if (isPrimaryGithubRepo) for (const [name, content] of Object.entries(ACTIONS)) files.push({
+		path: `.github/actions/${name}.yml`,
+		content: reusableHeader(`packages/cli/src/templates/index.ts`) + content
+	});
+	if (isPrimaryGithubRepo) {
+		for (const [name, content] of Object.entries(REUSABLE_WORKFLOWS)) files.push({
+			path: `.github/workflows/${name}.yml`,
+			content: reusableHeader(`packages/cli/src/templates/index.ts`) + content
+		});
+		for (const [name, content] of Object.entries(WORKFLOW_TEMPLATES)) {
+			files.push({
+				path: `workflow-templates/${name}.yml`,
+				content: thinCallerHeader(true) + content
+			});
+			const props = WORKFLOW_TEMPLATE_PROPERTIES[name];
+			if (props) files.push({
+				path: `workflow-templates/${name}.properties.json`,
+				content: props
+			});
 		}
-		if (requestedSteps) {
-			for (const name of requestedSteps) if (!SYNC_STEPS.includes(name)) {
-				steps.push({
-					capability: "source",
-					step: `sync ${name}`,
-					status: "skip",
-					message: `unknown step "${name}"`
-				});
-				print(formatSyncStep(steps[steps.length - 1]));
-			}
+	} else for (const name of Object.keys(REUSABLE_WORKFLOWS)) {
+		if (allowedWorkflows && !allowedWorkflows.has(name)) continue;
+		const content = generateThinCallerContent(name, withOverrides?.get(name));
+		if (!content) continue;
+		files.push({
+			path: `.github/workflows/${name}.yml`,
+			content: thinCallerHeader() + content
+		});
+	}
+	return files;
+}
+/** Git blob SHA: sha1("blob {len}\0{content}") — used to detect unchanged files. */
+function gitBlobSha(content) {
+	const buf = Buffer.from(content, "utf8");
+	return createHash("sha1").update(`blob ${buf.length}\0`).update(buf).digest("hex");
+}
+async function runSyncGithub(input) {
+	const print = input.print ?? ((line) => console.log(line));
+	const repo = input.repo ?? DEFAULT_REPO;
+	const { token, dryRun = false, branch, createPr = false } = input;
+	const message = input.message ?? `chore: sync from theholocron/holocron`;
+	const client = createGitHubClient({
+		token,
+		fetch: input.fetch
+	});
+	print(`holocron sync-github${dryRun ? " (dry-run)" : ""}`);
+	print(`  repo:   ${repo}`);
+	if (branch) print(`  branch: ${branch}`);
+	print("");
+	if (input.outputDir) {
+		const batch = buildBatch(repo);
+		for (const file of batch) {
+			const dest = join(input.outputDir, file.path);
+			mkdirSync(dirname(dest), { recursive: true });
+			writeFileSync(dest, file.content, "utf8");
 		}
+		print(`  ${batch.length} files written to ${input.outputDir}`);
+		return {
+			status: "ok",
+			created: batch.length,
+			updated: 0,
+			unchanged: 0
+		};
 	}
-	for (const stepName of ["keywords", "description"]) {
-		if (requestedSteps !== void 0 && !requestedSteps.includes(stepName)) continue;
-		if (stepName === "keywords") {
-			const topics = config.repo?.topics ?? [];
-			if (topics.length === 0) {
-				steps.push({
-					capability: "local",
-					step: "sync keywords",
-					status: "skip",
-					message: "no topics configured"
-				});
-				print(formatSyncStep(steps[steps.length - 1]));
-			} else {
-				steps.push(await runSyncStep("local", "sync keywords", dryRun, async () => {
-					return await writePackageJsonField(input.context.repoRoot, "keywords", topics) ? `${topics.length} keywords written` : `${topics.length} topics (no package.json)`;
-				}));
-				print(formatSyncStep(steps[steps.length - 1]));
-			}
+	let targetBranch = branch;
+	let defaultBranch;
+	if (!targetBranch || createPr) try {
+		defaultBranch = (await client.repos.getRepo(repo)).default_branch;
+		if (!targetBranch) targetBranch = defaultBranch;
+	} catch {
+		const msg = "failed to fetch repo metadata";
+		print(`  ✗ ${msg}`);
+		return {
+			status: "fail",
+			created: 0,
+			updated: 0,
+			unchanged: 0,
+			message: msg
+		};
+	}
+	const baseBranch = createPr && defaultBranch ? defaultBranch : targetBranch;
+	let headSha;
+	let baseTreeSha;
+	let existingBlobs;
+	try {
+		headSha = (await client.git.getRef(repo, baseBranch)).object.sha;
+		baseTreeSha = (await client.git.getCommit(repo, headSha)).tree.sha;
+		const treeData = await client.git.getTree(repo, baseTreeSha, true);
+		existingBlobs = new Map(treeData.tree.filter((i) => i.type === "blob").map((i) => [i.path, i.sha]));
+	} catch (err) {
+		const msg = err instanceof Error ? err.message : `Branch ${baseBranch} not found`;
+		print(`  ✗ ${msg}`);
+		return {
+			status: "fail",
+			created: 0,
+			updated: 0,
+			unchanged: 0,
+			message: msg
+		};
+	}
+	let allowedWorkflows;
+	let withOverrides;
+	if (repo !== DEFAULT_REPO) try {
+		let entries = [];
+		try {
+			const data = await client.git.getContents(repo, "holocron.config.json");
+			entries = (JSON.parse(Buffer.from(data.content.replace(/\n/g, ""), "base64").toString("utf8"))?.workflows ?? []).map((w) => typeof w === "string" ? { name: w } : w);
+		} catch (err) {
+			if (!(err instanceof ProviderApiError) || err.status !== 404) throw err;
+			try {
+				const data = await client.git.getContents(repo, "holocron.config.ts");
+				entries = parseWorkflowsFromTs(Buffer.from(data.content.replace(/\n/g, ""), "base64").toString("utf8"));
+			} catch {}
 		}
-		if (stepName === "description") {
-			const description = config.description;
-			if (!description) {
-				steps.push({
-					capability: "local",
-					step: "sync description",
-					status: "skip",
-					message: "no description configured"
-				});
-				print(formatSyncStep(steps[steps.length - 1]));
-			} else {
-				const source = loader.has("source") ? loader.get("source") : null;
-				steps.push(await runSyncStep("local", "sync description", dryRun, async () => {
-					const pkgWrote = await writePackageJsonField(input.context.repoRoot, "description", description);
-					const readmeWrote = await updateReadmeDescription(input.context.repoRoot, description);
-					if (source?.syncDescription) await source.syncDescription(description);
-					const parts = [];
-					if (pkgWrote) parts.push("package.json");
-					if (readmeWrote) parts.push("README.md");
-					if (source?.syncDescription) parts.push("GitHub");
-					return parts.length > 0 ? parts.join(", ") + " updated" : "description synced";
-				}));
-				print(formatSyncStep(steps[steps.length - 1]));
-			}
+		if (entries.length > 0) {
+			allowedWorkflows = new Set(entries.map((e) => e.name));
+			const overrideEntries = entries.filter((e) => e.with != null).map((e) => [e.name, e.with]);
+			if (overrideEntries.length > 0) withOverrides = new Map(overrideEntries);
+		}
+	} catch {}
+	const batch = buildBatch(repo, allowedWorkflows, withOverrides);
+	let created = 0;
+	let updated = 0;
+	let unchanged = 0;
+	const changedFiles = [];
+	for (const file of batch) {
+		const localSha = gitBlobSha(file.content);
+		const existingSha = existingBlobs.get(file.path);
+		if (existingSha === localSha) {
+			print(`  · unchanged  ${file.path}`);
+			unchanged++;
+		} else if (existingSha) {
+			print(`  ${dryRun ? "~" : "✓"} updated  ${file.path}`);
+			updated++;
+			if (!dryRun) changedFiles.push(file);
+		} else {
+			print(`  ${dryRun ? "~" : "✓"} created  ${file.path}`);
+			created++;
+			if (!dryRun) changedFiles.push(file);
 		}
 	}
-	const summary = steps.reduce((acc, s) => {
-		if (s.status === "ok") acc.ok += 1;
-		else if (s.status === "fail") acc.fail += 1;
-		else if (s.status === "skip") acc.skip += 1;
-		else if (s.status === "dry-run") acc.dryRun += 1;
-		return acc;
-	}, {
-		ok: 0,
-		fail: 0,
-		skip: 0,
-		dryRun: 0
-	});
 	print("");
-	print(`  ${summary.ok} ok, ${summary.fail} fail, ${summary.skip} skipped${dryRun ? `, ${summary.dryRun} would-do` : ""}`);
-	return {
-		steps,
-		summary
-	};
-}
-async function runSyncStep(capability, step, dryRun, body) {
-	if (dryRun) return {
-		capability,
-		step,
-		status: "dry-run"
+	print(`  ${created} created, ${updated} updated, ${unchanged} unchanged`);
+	if (dryRun || changedFiles.length === 0) return {
+		status: dryRun ? "dry-run" : "ok",
+		created,
+		updated,
+		unchanged
 	};
+	const treeEntries = [];
+	for (const file of changedFiles) try {
+		const blob = await client.git.createBlob(repo, file.content);
+		treeEntries.push({
+			path: file.path,
+			mode: "100644",
+			type: "blob",
+			sha: blob.sha
+		});
+	} catch (err) {
+		const msg = `failed to create blob for ${file.path}: ${err instanceof Error ? err.message : String(err)}`;
+		print(`  ✗ ${msg}`);
+		return {
+			status: "fail",
+			created,
+			updated,
+			unchanged,
+			message: msg
+		};
+	}
+	let newTreeSha;
 	try {
-		const note = await body();
-		const result = {
-			capability,
-			step,
-			status: "ok"
+		newTreeSha = (await client.git.createTree(repo, treeEntries, baseTreeSha)).sha;
+	} catch (err) {
+		const msg = `failed to create tree: ${err instanceof Error ? err.message : String(err)}`;
+		print(`  ✗ ${msg}`);
+		return {
+			status: "fail",
+			created,
+			updated,
+			unchanged,
+			message: msg
 		};
-		if (typeof note === "string") result.message = note;
-		return result;
+	}
+	let newCommitSha;
+	try {
+		newCommitSha = (await client.git.createCommit(repo, message, newTreeSha, [headSha])).sha;
 	} catch (err) {
+		const msg = `failed to create commit: ${err instanceof Error ? err.message : String(err)}`;
+		print(`  ✗ ${msg}`);
 		return {
-			capability,
-			step,
 			status: "fail",
-			message: err instanceof Error ? err.message : String(err)
+			created,
+			updated,
+			unchanged,
+			message: msg
 		};
 	}
+	try {
+		if (createPr && branch) try {
+			await client.git.createRef(repo, `refs/heads/${branch}`, newCommitSha);
+		} catch (err) {
+			if (!(err instanceof ProviderApiError) || err.status !== 422) throw err;
+			await client.git.updateRef(repo, `heads/${branch}`, newCommitSha, true);
+		}
+		else await client.git.updateRef(repo, `heads/${targetBranch}`, newCommitSha);
+	} catch (err) {
+		const msg = `failed to update ref: ${err instanceof Error ? err.message : String(err)}`;
+		print(`  ✗ ${msg}`);
+		return {
+			status: "fail",
+			created,
+			updated,
+			unchanged,
+			message: msg
+		};
+	}
+	let prUrl;
+	if (branch && createPr && !dryRun) try {
+		prUrl = (await client.git.createPull(repo, {
+			title: message.split("\n")[0],
+			head: branch,
+			base: "main",
+			body: "Auto-generated by `holocron sync-github`. Review and merge to apply template updates."
+		})).html_url;
+		print(`  → PR opened: ${prUrl}`);
+	} catch (err) {
+		if (err instanceof ProviderApiError && err.status === 422 && String(err.details).includes("already exists")) print(`  → PR already open for ${branch} — branch updated, ready to merge`);
+		else print(`  ⚠ PR creation failed: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	return {
+		status: "ok",
+		created,
+		updated,
+		unchanged,
+		prUrl
+	};
 }
-function formatSyncStep(step) {
-	const icon = step.status === "ok" ? "✓" : step.status === "fail" ? "✗" : step.status === "dry-run" ? "…" : "·";
-	const detail = step.message ? `  (${step.message})` : "";
-	return `    ${icon} ${step.step}${detail}`;
-}
-async function writePackageJsonField(repoRoot, field, value) {
-	const pkgPath = join(repoRoot, "package.json");
-	let content;
+//#endregion
+//#region src/commands/upgrade-node.ts
+const SKIP_DIRS = /* @__PURE__ */ new Set([
+	"node_modules",
+	".git",
+	"dist",
+	"coverage",
+	"build",
+	".turbo",
+	".next",
+	"out"
+]);
+function patchPackageJson(content, from, to) {
+	let pkg;
 	try {
-		content = await readFile(pkgPath, "utf8");
+		pkg = JSON.parse(content);
 	} catch {
-		return false;
+		return null;
 	}
-	const pkg = JSON.parse(content);
-	pkg[field] = value;
-	await writeFile(pkgPath, JSON.stringify(pkg, null, 2) + "\n", "utf8");
-	return true;
+	let changed = false;
+	const engines = pkg.engines;
+	if (engines?.node && /^>=\d+(?:\.0\.0)?$/.test(engines.node)) {
+		if (parseInt(engines.node.match(/\d+/)[0], 10) === from) {
+			engines.node = `>=${to}.0.0`;
+			changed = true;
+		}
+	}
+	for (const field of ["devDependencies", "dependencies"]) {
+		const deps = pkg[field];
+		if (!deps?.["@types/node"]) continue;
+		if (deps["@types/node"] === `^${from}.0.0`) {
+			deps["@types/node"] = `^${to}.0.0`;
+			changed = true;
+		}
+	}
+	return changed ? JSON.stringify(pkg, null, 2) + "\n" : null;
 }
-const README_DESC_START = "<!-- holocron:description -->";
-const README_DESC_END = "<!-- /holocron:description -->";
-async function updateReadmeDescription(repoRoot, description) {
-	const readmePath = join(repoRoot, "README.md");
-	let content;
+function patchYaml(content, from, to) {
+	const updated = content.replace(/node-version:\s+['"]?(\d+)['"]?/g, (match, ver) => ver === String(from) ? match.replace(String(from), String(to)) : match);
+	return updated !== content ? updated : null;
+}
+function patchPinFile(content, from, to) {
+	const trimmed = content.trim();
+	if (trimmed === String(from) || trimmed.startsWith(`${from}.`)) return `${to}\n`;
+	return null;
+}
+function patchDockerfile(content, from, to) {
+	const updated = content.replace(/^(FROM\s+node:)(\d+)/gm, (match, prefix, ver) => ver === String(from) ? `${prefix}${to}` : match);
+	return updated !== content ? updated : null;
+}
+function patchToolVersions(content, from, to) {
+	const updated = content.replace(/^(nodejs\s+)(\d+)/gm, (match, prefix, ver) => ver === String(from) ? `${prefix}${to}` : match);
+	return updated !== content ? updated : null;
+}
+const PATTERNS = [
+	{
+		matches: (n) => n === "package.json",
+		patch: patchPackageJson
+	},
+	{
+		matches: (n) => n.endsWith(".yml") || n.endsWith(".yaml"),
+		patch: patchYaml
+	},
+	{
+		matches: (n) => n === ".nvmrc" || n === ".node-version",
+		patch: patchPinFile
+	},
+	{
+		matches: (n) => n === "Dockerfile" || n.startsWith("Dockerfile."),
+		patch: patchDockerfile
+	},
+	{
+		matches: (n) => n === ".tool-versions",
+		patch: patchToolVersions
+	}
+];
+function detectFrom(cwd, _readFile) {
+	for (const name of [".nvmrc", ".node-version"]) try {
+		const major = parseInt(_readFile(join(cwd, name)).trim(), 10);
+		if (!isNaN(major)) return major;
+	} catch {}
 	try {
-		content = await readFile(readmePath, "utf8");
-	} catch {
-		return false;
+		const node = JSON.parse(_readFile(join(cwd, "package.json"))).engines?.node;
+		if (node) {
+			const m = node.match(/(\d+)/);
+			if (m) return parseInt(m[1], 10);
+		}
+	} catch {}
+	return null;
+}
+function defaultWalkFiles(dir) {
+	const results = [];
+	function walk(current) {
+		let entries;
+		try {
+			entries = readdirSync(current);
+		} catch {
+			return;
+		}
+		for (const entry of entries) {
+			if (SKIP_DIRS.has(entry)) continue;
+			const abs = join(current, entry);
+			try {
+				if (statSync(abs).isDirectory()) walk(abs);
+				else results.push(abs);
+			} catch {}
+		}
 	}
-	const lines = content.split("\n");
-	const startIdx = lines.findIndex((l) => l.trim() === README_DESC_START);
-	const endIdx = lines.findIndex((l) => l.trim() === README_DESC_END);
-	if (startIdx !== -1) {
-		if (endIdx === -1 || endIdx <= startIdx) return false;
-		lines.splice(startIdx + 1, endIdx - startIdx - 1, description);
-		await writeFile(readmePath, lines.join("\n"), "utf8");
-		return true;
+	walk(dir);
+	return results;
+}
+async function runUpgradeNode(input) {
+	const print = input.print ?? ((line) => console.log(line));
+	const cwd = input.cwd ?? process.cwd();
+	const { to, dryRun = false, extra = [] } = input;
+	const _readFile = input.readFile ?? ((p) => readFileSync(p, "utf8"));
+	const _writeFile = input.writeFile ?? ((p, c) => writeFileSync(p, c));
+	const _walkFiles = input.walkFiles ?? defaultWalkFiles;
+	const from = input.from ?? detectFrom(cwd, _readFile);
+	if (from === null) return {
+		status: "fail",
+		updated: [],
+		message: "could not detect current Node version — pass --from <major>"
+	};
+	if (from === to) {
+		print(`Already at Node.js ${to} — nothing to do.`);
+		return {
+			status: "ok",
+			updated: []
+		};
 	}
-	const h1Index = lines.findIndex((l) => /^# /.test(l));
-	if (h1Index === -1) return false;
-	lines.splice(h1Index + 1, 0, "", README_DESC_START, description, README_DESC_END);
-	await writeFile(readmePath, lines.join("\n"), "utf8");
-	return true;
+	print(`Upgrading Node.js ${from} → ${to}${dryRun ? " (dry-run)" : ""}…`);
+	const updated = [];
+	const scanned = [..._walkFiles(cwd), ...extra.map((p) => join(cwd, p))];
+	for (const abs of scanned) {
+		const name = basename(abs);
+		const pattern = PATTERNS.find((p) => p.matches(name));
+		if (!pattern) continue;
+		let content;
+		try {
+			content = _readFile(abs);
+		} catch {
+			continue;
+		}
+		const patched = pattern.patch(content, from, to);
+		if (patched === null) continue;
+		const rel = abs.startsWith(cwd + "/") ? abs.slice(cwd.length + 1) : abs;
+		if (!dryRun) _writeFile(abs, patched);
+		print(`  ${dryRun ? "~" : "✓"} ${rel}`);
+		updated.push(rel);
+	}
+	if (updated.length === 0) print(`  · no files contained Node.js ${from} pins`);
+	return {
+		status: dryRun ? "dry-run" : "ok",
+		updated
+	};
 }
 //#endregion
 //#region src/load-config.ts