@theholocron/cli 3.42.0 → 3.44.0

package/dist/capabilities/index.d.mts

@@ -12,7 +12,7 @@ import { ProviderApiError } from "@theholocron/http-client";
  * See `.notes/tech-architecture.spec.md` for the design narrative
  * (status: proposed, issue: #74).
  */
-type CapabilityKey = "source" | "ci" | "secrets" | "environments" | "issues" | "deployment" | "storage" | "auth" | "vault" | "dns" | "tooling" | "notifications" | "analytics" | "observability";
+type CapabilityKey = "source" | "ci" | "secrets" | "environments" | "issues" | "deployment" | "storage" | "auth" | "vault" | "dns" | "tooling" | "notifications" | "analytics" | "observability" | "wiki";
 type Cardinality = "single" | "many";
 declare const CARDINALITY: {
   readonly source: "single";
@@ -29,6 +29,7 @@ declare const CARDINALITY: {
   readonly notifications: "many";
   readonly analytics: "many";
   readonly observability: "many";
+  readonly wiki: "single";
 };
 /**
  * No capabilities are strictly required — repos without secrets (e.g. org
@@ -625,6 +626,23 @@ interface Observability extends ProviderIdentity {
     alreadyExists: boolean;
   }>;
 }
+interface WikiProvisionOpts {
+  /** Project display name used in the wiki title (e.g. "Holocron"). */
+  name?: string;
+}
+/**
+ * Engineering wiki provider.
+ *
+ * A swappable provider for publishing the `docs/decisions/` and
+ * `docs/engineering/` surfaces as a browsable, access-controlled site.
+ * Local-only providers (fern, mintlify) write config files; remote
+ * providers (github) make API calls.
+ */
+interface Wiki extends ProviderIdentity {
+  readonly key: "wiki";
+  /** Provision the wiki — write config files or call the provider API. */
+  provision(opts?: WikiProvisionOpts): Promise<string>;
+}
 interface CapabilityImpls {
   source: Source;
   ci: Ci;
@@ -640,10 +658,11 @@ interface CapabilityImpls {
   notifications: Notifications;
   analytics: Analytics;
   observability: Observability;
+  wiki: Wiki;
 }
 type CardinalityFor<K extends CapabilityKey> = (typeof CARDINALITY)[K];
 /** Resolved runtime shape: single → one impl; many → array. */
 type ResolvedCapability<K extends CapabilityKey> = CardinalityFor<K> extends "many" ? CapabilityImpls[K][] : CapabilityImpls[K];
 declare function isMulti<K extends CapabilityKey>(key: K): CardinalityFor<K> extends "many" ? true : false;
 //#endregion
-export { Analytics, Auth, AuthDescription, AuthEvent, AuthEventType, AuthIdentity, AuthUser, CARDINALITY, CapabilityImpls, CapabilityKey, Cardinality, CardinalityFor, Ci, CiRun, CiRunFilter, CiRunStatus, ConnectionStringOptions, CreateAuthUserInput, Deployment, DeploymentProject, DeploymentProjectSettings, DeploymentRecord, DeploymentTarget, DeploymentTrigger, Dns, DnsRecord, DnsRecordType, EnsureResult, Environment, EnvironmentReviewer, Environments, Issue, IssueSearchFilter, Issues, LabelDef, LifecycleResult, LifecycleSlot, NormalizedAuthUser, Notifications, Observability, PagesConfig, ParseWebhookInput, ProviderApiError, ProviderIdentity, PullRequest, REQUIRED_CAPABILITIES, RepoRef, RepoSettings, ResolvedCapability, Ruleset, SecretScope, Secrets, Source, StatusCategory, Storage, StorageBranch, TeamEntry, TeamPermission, Tooling, ToolingDoctorReport, TrackerDoctorReport, TrackerUser, Vault, WebhookDashboardInfo, WebhookVerificationError, isMulti };
+export { Analytics, Auth, AuthDescription, AuthEvent, AuthEventType, AuthIdentity, AuthUser, CARDINALITY, CapabilityImpls, CapabilityKey, Cardinality, CardinalityFor, Ci, CiRun, CiRunFilter, CiRunStatus, ConnectionStringOptions, CreateAuthUserInput, Deployment, DeploymentProject, DeploymentProjectSettings, DeploymentRecord, DeploymentTarget, DeploymentTrigger, Dns, DnsRecord, DnsRecordType, EnsureResult, Environment, EnvironmentReviewer, Environments, Issue, IssueSearchFilter, Issues, LabelDef, LifecycleResult, LifecycleSlot, NormalizedAuthUser, Notifications, Observability, PagesConfig, ParseWebhookInput, ProviderApiError, ProviderIdentity, PullRequest, REQUIRED_CAPABILITIES, RepoRef, RepoSettings, ResolvedCapability, Ruleset, SecretScope, Secrets, Source, StatusCategory, Storage, StorageBranch, TeamEntry, TeamPermission, Tooling, ToolingDoctorReport, TrackerDoctorReport, TrackerUser, Vault, WebhookDashboardInfo, WebhookVerificationError, Wiki, WikiProvisionOpts, isMulti };

package/dist/capabilities/index.mjs

@@ -14,7 +14,8 @@ const CARDINALITY = {
 	tooling: "many",
 	notifications: "many",
 	analytics: "many",
-	observability: "many"
+	observability: "many",
+	wiki: "single"
 };
 /**
 * No capabilities are strictly required — repos without secrets (e.g. org

package/dist/cli.mjs

@@ -137,7 +137,8 @@ const CARDINALITY = {
 	tooling: "many",
 	notifications: "many",
 	analytics: "many",
-	observability: "many"
+	observability: "many",
+	wiki: "single"
 };
 /**
 * No capabilities are strictly required — repos without secrets (e.g. org
@@ -3280,6 +3281,9 @@ var test_default$1 = "name: Test\n\non: # yamllint disable-line rule:truthy\n  p
 //#region src/commands/workflows/typecheck.yml
 var typecheck_default$1 = "name: Typecheck\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\nconcurrency:\n  group: typecheck-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n\njobs:\n  typecheck:\n    name: Typecheck\n    uses: theholocron/.github/.github/workflows/typecheck.yml@main\n    secrets: inherit\n";
 //#endregion
+//#region src/commands/workflows/wiki.yml
+var wiki_default$1 = "name: Wiki\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main]\n  pull_request:\n    branches: [main]\n\nconcurrency:\n  group: ${{ github.event_name == 'pull_request' && format('wiki-preview-{0}', github.event.pull_request.number) || 'wiki' }}\n  cancel-in-progress: ${{ github.event_name == 'pull_request' }}\n\npermissions:\n  contents: read\n\njobs:\n  publish:\n    name: Publish\n    if: ${{ github.event_name != 'pull_request' }}\n    uses: theholocron/.github/.github/workflows/wiki.yml@main\n    secrets: inherit\n\n  preview:\n    name: Preview\n    if: ${{ github.event_name == 'pull_request' }}\n    uses: theholocron/.github/.github/workflows/wiki.yml@main\n    with:\n      preview: true\n      preview-id: pr-${{ github.event.pull_request.number }}\n    secrets: inherit\n";
+//#endregion
 //#region src/commands/setup-workflows.ts
 /**
 * Header prepended to every auto-generated workflow thin caller.
@@ -3321,7 +3325,8 @@ const WORKFLOW_TEMPLATES = {
 	dependencies: dependencies_default$1,
 	bookkeeping: bookkeeping_default$1,
 	audit: audit_default$1,
-	deploy: deploy_default$1
+	deploy: deploy_default$1,
+	wiki: wiki_default$1
 };
 const KNOWN_WORKFLOWS = new Set(Object.keys(WORKFLOW_TEMPLATES));
 /**
@@ -4254,6 +4259,14 @@ async function runSetup(input) {
 			print(formatStep(steps[steps.length - 1]));
 		}
 	}
+	if (loader.has("wiki")) {
+		const wiki = loader.get("wiki");
+		print(style.step("wiki"));
+		steps.push(await runStep("wiki", "provision wiki config", dryRun, async () => {
+			return await wiki.provision({ name: config.name });
+		}));
+		print(formatStep(steps[steps.length - 1]));
+	}
 	if (loader.has("deployment")) {
 		const deploy = loader.get("deployment");
 		print(style.step("deployment"));
@@ -5326,7 +5339,7 @@ var deploy_preview_default = "name: Deploy Preview\n\non: # yamllint disable-lin
 var greetings_default = "name: Greetings\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n\njobs:\n  greeting:\n    name: Greet first-time contributors\n    permissions:\n      issues: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    # Group by the issue/PR number so duplicate events don't race each other.\n    steps:\n      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n        name: Greet on first contribution\n        with:\n          script: |\n            // Only greet on the initial open — ignore synchronize, reopened, etc.\n            if (context.payload.action !== 'opened') return;\n\n            const actor = context.actor;\n            const { owner, repo } = context.repo;\n\n            // Payload inspection is more reliable than context.eventName for detecting\n            // whether this is an issue vs. PR event — works regardless of how GitHub\n            // propagates event names through workflow_call chains.\n            const isIssue = !!context.payload.issue && !context.payload.pull_request;\n            // listForRepo returns both issues and PRs (GitHub treats PRs as issues),\n            // sorted newest-first. Filter by type to track first-issue and first-PR\n            // independently, and avoid search-index eventual-consistency lag.\n            const { data: recent } = await github.rest.issues.listForRepo({\n              owner, repo,\n              creator: actor,\n              state: 'all',\n              per_page: 100\n            });\n\n            const sameType = recent.filter(item =>\n              isIssue ? !item.pull_request : !!item.pull_request\n            );\n\n            if (sameType.length !== 1) return;\n            const body = isIssue\n              ? `Hey @${actor}!\\n\\nWe really appreciate you taking the time to report an issue. The collaborators on this project attempt to help as many people as possible, but we are a limited number of volunteers, so it is possible that this will not be addressed as swiftly.\\n\\nYour patience is much appreciated and we will get back to you as quickly as possible.`\n              : `Hey @${actor}!\\n\\nWe really appreciate you taking the time to help out with this PR. The collaborators on this project attempt to help as many people as possible, but we are a limited number of volunteers, so it is possible that this will not be addressed as swiftly.\\n\\nYour patience is much appreciated and we will get back to you as quickly as possible.`;\n\n            await github.rest.issues.createComment({\n              owner,\n              repo,\n              issue_number: context.issue.number,\n              body\n            });\n";
 //#endregion
 //#region src/templates/workflows/lint.yml
-var lint_default = "name: Lint\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      eslint-config:\n        description: >\n          Filename for the ESLint flat config used by super-linter for\n          JavaScript, JSX, TSX, and TypeScript (ES) files. Defaults to\n          eslint.config.ts (the org standard). Note: ESLint 9 requires\n          --flag unstable_ts_config to load .ts configs; if super-linter\n          cannot load it, override with eslint.config.mjs or eslint.config.js.\n        type: string\n        required: false\n        default: eslint.config.ts\n      prettier-config:\n        description: >\n          Filename for the Prettier config. Defaults to prettier.config.ts\n          (the org standard). Prettier 3.x loads .ts configs natively.\n        type: string\n        required: false\n        default: prettier.config.ts\n      yaml-config:\n        description: >\n          Filename for the yamllint config. Defaults to yamllint.config.yml.\n        type: string\n        required: false\n        default: yamllint.config.yml\n      enable-auto-commit:\n        description: >\n          Auto-commit super-linter fixes as a verified commit via a GitHub App.\n          Requires SUPER_LINTER_APP_ID and SUPER_LINTER_PRIVATE_KEY secrets.\n        type: boolean\n        required: false\n        default: false\n    secrets:\n      SUPER_LINTER_APP_ID:\n        required: false\n      SUPER_LINTER_PRIVATE_KEY:\n        required: false\n\njobs:\n  super-lint:\n    name: Lint entire codebase\n    permissions:\n      contents: write\n      issues: write\n      statuses: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    env:\n      APP_ID_SET: ${{ secrets.SUPER_LINTER_APP_ID != '' }}\n    steps:\n      - name: Generate GitHub App token\n        id: app-token\n        # Runs before checkout so the token is used as the checkout credential,\n        # which makes the subsequent push go through the App and produce a\n        # Verified commit. Skipped when auto-commit is disabled or secrets unset.\n        if: >\n          inputs.enable-auto-commit == true &&\n          github.event.pull_request != null &&\n          github.event.pull_request.head.repo.full_name == github.repository &&\n          github.ref_name != github.event.repository.default_branch &&\n          env.APP_ID_SET == 'true'\n        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0\n        with:\n          app-id: ${{ secrets.SUPER_LINTER_APP_ID }}\n          private-key: ${{ secrets.SUPER_LINTER_PRIVATE_KEY }}\n\n      - name: Resolve App bot identity\n        id: app-bot\n        # GitHub marks commits as Verified when the author email matches the\n        # App bot's noreply address (<numeric-id>+<slug>[bot]@users.noreply.github.com).\n        # The numeric ID must be fetched via the API — it differs from the App ID.\n        # app-slug is passed via env rather than interpolated into the script to\n        # prevent code injection (CWE-78).\n        if: steps.app-token.conclusion == 'success'\n        run: |\n          BOT_SLUG=\"${APP_SLUG}[bot]\"\n          BOT_ID=$(gh api \"/users/${BOT_SLUG}\" --jq .id)\n          echo \"name=${BOT_SLUG}\" >> \"$GITHUB_OUTPUT\"\n          echo \"email=${BOT_ID}+${BOT_SLUG}@users.noreply.github.com\" >> \"$GITHUB_OUTPUT\"\n        env:\n          GH_TOKEN: ${{ steps.app-token.outputs.token }}\n          APP_SLUG: ${{ steps.app-token.outputs.app-slug }}\n\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n          # Use the App token when available so the push credential is the App\n          # bot — GitHub marks those commits as Verified automatically.\n          token: ${{ steps.app-token.outputs.token || github.token }}\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n        if: ${{ hashFiles('pnpm-lock.yaml') != '' }}\n\n      - name: Detect project features\n        # Writes VALIDATE_*/FIX_* to GITHUB_ENV only when the feature exists.\n        # Also writes step outputs for values referenced in expression context\n        # (GITHUB_ENV is not readable via steps.*.outputs — they need GITHUB_OUTPUT).\n        # All values written are hardcoded 'true' — no user input in the script.\n        # Config file paths (inputs.*) stay in GH Actions expression context in\n        # the super-linter env: block below, never shell-evaluated (CWE-78).\n        id: detect\n        run: |\n          has() { find . -not -path '*/node_modules/*' -name \"$1\" -print -quit 2>/dev/null | grep -q .; }\n\n          if { has 'eslint.config.ts' || has 'eslint.config.mjs' || has 'eslint.config.js' || has '.eslintrc.json' || has '.eslintrc.yml'; }; then\n            {\n              echo \"VALIDATE_JAVASCRIPT_ES=true\"\n              echo \"VALIDATE_TYPESCRIPT_ES=true\"\n            } >> \"$GITHUB_ENV\"\n            echo \"eslint=true\" >> \"$GITHUB_OUTPUT\"\n          fi\n\n          if { has '*.js' || has '*.jsx' || has '*.mjs' || has '*.cjs' || has '*.ts' || has '*.tsx'; }; then\n            {\n              echo \"VALIDATE_JAVASCRIPT_PRETTIER=true\"\n              echo \"VALIDATE_JSX_PRETTIER=true\"\n              echo \"VALIDATE_TYPESCRIPT_PRETTIER=true\"\n              echo \"VALIDATE_TSX=true\"\n              echo \"FIX_JAVASCRIPT_PRETTIER=true\"\n              echo \"FIX_JSX_PRETTIER=true\"\n              echo \"FIX_TYPESCRIPT_PRETTIER=true\"\n              echo \"FIX_TSX=true\"\n            } >> \"$GITHUB_ENV\"\n          fi\n\n          if { has '*.css' || has '*.scss' || has 'stylelint.config.ts' || has 'stylelint.config.mjs' || has 'stylelint.config.js'; }; then\n            {\n              echo \"VALIDATE_CSS=true\"\n              echo \"STYLELINT_CONFIG_FILE=stylelint.config.ts\"\n            } >> \"$GITHUB_ENV\"\n          fi\n\n          if { has '*.graphql' || has '*.gql'; }; then\n            {\n              echo \"VALIDATE_GRAPHQL_PRETTIER=true\"\n              echo \"FIX_GRAPHQL_PRETTIER=true\"\n            } >> \"$GITHUB_ENV\"\n          fi\n\n          if { has '*.html' || has '*.htm'; }; then\n            {\n              echo \"VALIDATE_HTML_PRETTIER=true\"\n              echo \"FIX_HTML_PRETTIER=true\"\n            } >> \"$GITHUB_ENV\"\n          fi\n\n          if { has '.env' || has '.env.example' || has '.env.local'; }; then\n            {\n              echo \"VALIDATE_ENV=true\"\n              echo \"FIX_ENV=true\"\n            } >> \"$GITHUB_ENV\"\n          fi\n\n          if { has 'Dockerfile' || has '*.Dockerfile'; }; then\n            echo \"VALIDATE_DOCKERFILE=true\" >> \"$GITHUB_ENV\"\n          fi\n\n      - uses: super-linter/super-linter/slim@4ce20838b8ab83717e78138c5b3a1407148e0918 # v8.7.0\n        name: Run Super Linter\n        env:\n          GITHUB_TOKEN: ${{ github.token }}\n          DEFAULT_BRANCH: ${{ github.event.pull_request.base.ref || github.event.repository.default_branch }}\n          ANNOTATE_ONLY: true\n          DISABLE_COMMENTS: false\n          IGNORE_GITIGNORED_FILES: true\n          LINTER_RULES_PATH: /\n          EDITORCONFIG_FILE_NAME: \".editorconfig-checker.json\"\n          # Config file paths — inputs stay in expression context, never shell-evaluated.\n          # When VALIDATE_JAVASCRIPT_ES is not set by detect, ESLint doesn't run so\n          # the empty-string fallback (→ eslint.config.mjs in container) is safe.\n          JAVASCRIPT_ES_CONFIG_FILE: ${{ steps.detect.outputs.eslint == 'true' && inputs.eslint-config || '' }}\n          TYPESCRIPT_ES_CONFIG_FILE: ${{ steps.detect.outputs.eslint == 'true' && inputs.eslint-config || '' }}\n          PRETTIER_CONFIG: ${{ inputs.prettier-config }}\n          YAML_CONFIG_FILE: ${{ inputs.yaml-config }}\n          # Always-on linters\n          FIX_MARKDOWN_PRETTIER: true\n          VALIDATE_EDITORCONFIG: true\n          VALIDATE_GIT_COMMITLINT: true\n          VALIDATE_GIT_MERGE_CONFLICT_MARKERS: true\n          VALIDATE_GITHUB_ACTIONS: true\n          VALIDATE_GITLEAKS: true\n          VALIDATE_MARKDOWN_PRETTIER: true\n          VALIDATE_YAML: true\n\n      - name: Validate ADR and spec frontmatter\n        if: hashFiles('scripts/validate-adrs.mjs') != ''\n        run: |\n          mapfile -t changed < <(git diff --name-only \"$BASE_SHA\" HEAD -- \\\n            'docs/decisions/*.md' '.notes/*.spec.md' 2>/dev/null || true)\n          if [ \"${#changed[@]}\" -eq 0 ]; then\n            node scripts/validate-adrs.mjs\n          else\n            node scripts/validate-adrs.mjs \"${changed[@]}\"\n          fi\n        env:\n          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}\n\n      - uses: theholocron/.github/.github/actions/auto-commit@main\n        name: Commit and push linting fixes\n        if: >\n          inputs.enable-auto-commit == true &&\n          github.event.pull_request != null &&\n          github.event.pull_request.head.repo.full_name == github.repository &&\n          github.ref_name != github.event.repository.default_branch &&\n          env.APP_ID_SET == 'true'\n        with:\n          token: ${{ steps.app-token.outputs.token }}\n          branch: ${{ github.event.pull_request.head.ref || github.head_ref || github.ref }}\n          commit-message: \"chore: fix linting issues\\n\\nSigned-off-by: ${{ steps.app-bot.outputs.name }} <${{ steps.app-bot.outputs.email }}>\"\n          commit-options: \"--no-verify\"\n          commit-user-name: ${{ steps.app-bot.outputs.name }}\n          commit-user-email: ${{ steps.app-bot.outputs.email }}\n          commit-author: \"${{ steps.app-bot.outputs.name }} <${{ steps.app-bot.outputs.email }}>\"\n\n\n  conclusion:\n    name: Conclusion\n    runs-on: ubuntu-latest\n    if: always()\n    needs: [super-lint]\n    steps:\n      - name: Check job statuses\n        run: |\n          if [[ \"$RESULTS\" == *\"failure\"* ]] || [[ \"$RESULTS\" == *\"cancelled\"* ]]; then\n            exit 1\n          fi\n        env:\n          RESULTS: ${{ join(needs.*.result, ',') }}\n";
+var lint_default = "name: Lint\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      eslint-config:\n        description: >\n          Filename for the ESLint flat config used by super-linter for\n          JavaScript, JSX, TSX, and TypeScript (ES) files. Defaults to\n          eslint.config.ts (the org standard). Note: ESLint 9 requires\n          --flag unstable_ts_config to load .ts configs; if super-linter\n          cannot load it, override with eslint.config.mjs or eslint.config.js.\n        type: string\n        required: false\n        default: eslint.config.ts\n      prettier-config:\n        description: >\n          Filename for the Prettier config. Defaults to prettier.config.ts\n          (the org standard). Prettier 3.x loads .ts configs natively.\n        type: string\n        required: false\n        default: prettier.config.ts\n      yaml-config:\n        description: >\n          Filename for the yamllint config. Defaults to yamllint.config.yml.\n        type: string\n        required: false\n        default: yamllint.config.yml\n      enable-auto-commit:\n        description: >\n          Auto-commit super-linter fixes as a verified commit via a GitHub App.\n          Requires SUPER_LINTER_APP_ID and SUPER_LINTER_PRIVATE_KEY secrets.\n        type: boolean\n        required: false\n        default: false\n    secrets:\n      SUPER_LINTER_APP_ID:\n        required: false\n      SUPER_LINTER_PRIVATE_KEY:\n        required: false\n\njobs:\n  super-lint:\n    name: Lint entire codebase\n    permissions:\n      contents: write\n      issues: write\n      statuses: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    env:\n      APP_ID_SET: ${{ secrets.SUPER_LINTER_APP_ID != '' }}\n    steps:\n      - name: Generate GitHub App token\n        id: app-token\n        # Runs before checkout so the token is used as the checkout credential,\n        # which makes the subsequent push go through the App and produce a\n        # Verified commit. Skipped when auto-commit is disabled or secrets unset.\n        if: >\n          inputs.enable-auto-commit == true &&\n          github.event.pull_request != null &&\n          github.event.pull_request.head.repo.full_name == github.repository &&\n          github.ref_name != github.event.repository.default_branch &&\n          env.APP_ID_SET == 'true'\n        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0\n        with:\n          app-id: ${{ secrets.SUPER_LINTER_APP_ID }}\n          private-key: ${{ secrets.SUPER_LINTER_PRIVATE_KEY }}\n\n      - name: Resolve App bot identity\n        id: app-bot\n        # GitHub marks commits as Verified when the author email matches the\n        # App bot's noreply address (<numeric-id>+<slug>[bot]@users.noreply.github.com).\n        # The numeric ID must be fetched via the API — it differs from the App ID.\n        # app-slug is passed via env rather than interpolated into the script to\n        # prevent code injection (CWE-78).\n        if: steps.app-token.conclusion == 'success'\n        run: |\n          BOT_SLUG=\"${APP_SLUG}[bot]\"\n          BOT_ID=$(gh api \"/users/${BOT_SLUG}\" --jq .id)\n          echo \"name=${BOT_SLUG}\" >> \"$GITHUB_OUTPUT\"\n          echo \"email=${BOT_ID}+${BOT_SLUG}@users.noreply.github.com\" >> \"$GITHUB_OUTPUT\"\n        env:\n          GH_TOKEN: ${{ steps.app-token.outputs.token }}\n          APP_SLUG: ${{ steps.app-token.outputs.app-slug }}\n\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n          # Use the App token when available so the push credential is the App\n          # bot — GitHub marks those commits as Verified automatically.\n          token: ${{ steps.app-token.outputs.token || github.token }}\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n        if: ${{ hashFiles('pnpm-lock.yaml') != '' }}\n\n      - name: Detect project features\n        # Writes VALIDATE_*/FIX_* to GITHUB_ENV only when the feature exists.\n        # Also writes step outputs for values referenced in expression context\n        # (GITHUB_ENV is not readable via steps.*.outputs — they need GITHUB_OUTPUT).\n        # All values written are hardcoded 'true' — no user input in the script.\n        # Config file paths (inputs.*) stay in GH Actions expression context in\n        # the super-linter env: block below, never shell-evaluated (CWE-78).\n        id: detect\n        run: |\n          has() { find . -not -path '*/node_modules/*' -name \"$1\" -print -quit 2>/dev/null | grep -q .; }\n\n          if { has 'eslint.config.ts' || has 'eslint.config.mjs' || has 'eslint.config.js' || has '.eslintrc.json' || has '.eslintrc.yml'; }; then\n            {\n              echo \"VALIDATE_JAVASCRIPT_ES=true\"\n              echo \"VALIDATE_TYPESCRIPT_ES=true\"\n            } >> \"$GITHUB_ENV\"\n            echo \"eslint=true\" >> \"$GITHUB_OUTPUT\"\n          fi\n\n          if { has '*.js' || has '*.jsx' || has '*.mjs' || has '*.cjs' || has '*.ts' || has '*.tsx'; }; then\n            {\n              echo \"VALIDATE_JAVASCRIPT_PRETTIER=true\"\n              echo \"VALIDATE_JSX_PRETTIER=true\"\n              echo \"VALIDATE_TYPESCRIPT_PRETTIER=true\"\n              echo \"VALIDATE_TSX=true\"\n              echo \"FIX_JAVASCRIPT_PRETTIER=true\"\n              echo \"FIX_JSX_PRETTIER=true\"\n              echo \"FIX_TYPESCRIPT_PRETTIER=true\"\n              echo \"FIX_TSX=true\"\n            } >> \"$GITHUB_ENV\"\n          fi\n\n          if { has '*.css' || has '*.scss' || has 'stylelint.config.ts' || has 'stylelint.config.mjs' || has 'stylelint.config.js'; }; then\n            {\n              echo \"VALIDATE_CSS=true\"\n              echo \"STYLELINT_CONFIG_FILE=stylelint.config.ts\"\n            } >> \"$GITHUB_ENV\"\n          fi\n\n          if { has '*.graphql' || has '*.gql'; }; then\n            {\n              echo \"VALIDATE_GRAPHQL_PRETTIER=true\"\n              echo \"FIX_GRAPHQL_PRETTIER=true\"\n            } >> \"$GITHUB_ENV\"\n          fi\n\n          if { has '*.html' || has '*.htm'; }; then\n            {\n              echo \"VALIDATE_HTML_PRETTIER=true\"\n              echo \"FIX_HTML_PRETTIER=true\"\n            } >> \"$GITHUB_ENV\"\n          fi\n\n          if { has '.env' || has '.env.example' || has '.env.local'; }; then\n            {\n              echo \"VALIDATE_ENV=true\"\n              echo \"FIX_ENV=true\"\n            } >> \"$GITHUB_ENV\"\n          fi\n\n          if { has 'Dockerfile' || has '*.Dockerfile'; }; then\n            echo \"VALIDATE_DOCKERFILE=true\" >> \"$GITHUB_ENV\"\n          fi\n\n      - uses: super-linter/super-linter/slim@4ce20838b8ab83717e78138c5b3a1407148e0918 # v8.7.0\n        name: Run Super Linter\n        env:\n          GITHUB_TOKEN: ${{ github.token }}\n          DEFAULT_BRANCH: ${{ github.event.pull_request.base.ref || github.event.repository.default_branch }}\n          ANNOTATE_ONLY: true\n          DISABLE_COMMENTS: false\n          IGNORE_GITIGNORED_FILES: true\n          LINTER_RULES_PATH: /\n          EDITORCONFIG_FILE_NAME: \".editorconfig-checker.json\"\n          # Config file paths — inputs stay in expression context, never shell-evaluated.\n          # When VALIDATE_JAVASCRIPT_ES is not set by detect, ESLint doesn't run so\n          # the empty-string fallback (→ eslint.config.mjs in container) is safe.\n          JAVASCRIPT_ES_CONFIG_FILE: ${{ steps.detect.outputs.eslint == 'true' && inputs.eslint-config || '' }}\n          TYPESCRIPT_ES_CONFIG_FILE: ${{ steps.detect.outputs.eslint == 'true' && inputs.eslint-config || '' }}\n          PRETTIER_CONFIG: ${{ inputs.prettier-config }}\n          YAML_CONFIG_FILE: ${{ inputs.yaml-config }}\n          # Always-on linters\n          FIX_MARKDOWN_PRETTIER: true\n          VALIDATE_EDITORCONFIG: true\n          VALIDATE_GIT_COMMITLINT: true\n          VALIDATE_GIT_MERGE_CONFLICT_MARKERS: true\n          VALIDATE_GITHUB_ACTIONS: true\n          VALIDATE_GITLEAKS: true\n          VALIDATE_MARKDOWN_PRETTIER: true\n          VALIDATE_YAML: true\n\n      - name: Validate ADR and spec frontmatter\n        if: hashFiles('scripts/validate-adrs.mjs') != ''\n        run: |\n          mapfile -t changed < <(git diff --name-only \"$BASE_SHA\" HEAD -- \\\n            'docs/decisions/*.md' '.notes/*.spec.md' 2>/dev/null || true)\n          if [ \"${#changed[@]}\" -eq 0 ]; then\n            node scripts/validate-adrs.mjs\n          else\n            node scripts/validate-adrs.mjs \"${changed[@]}\"\n          fi\n        env:\n          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}\n\n      - name: Validate registry consistency\n        if: hashFiles('scripts/validate-registry.mjs') != ''\n        run: node scripts/validate-registry.mjs\n\n      - name: Validate docs presence for new packages\n        if: hashFiles('scripts/validate-docs-presence.mjs') != ''\n        run: node scripts/validate-docs-presence.mjs\n        env:\n          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}\n\n      - uses: theholocron/.github/.github/actions/auto-commit@main\n        name: Commit and push linting fixes\n        if: >\n          inputs.enable-auto-commit == true &&\n          github.event.pull_request != null &&\n          github.event.pull_request.head.repo.full_name == github.repository &&\n          github.ref_name != github.event.repository.default_branch &&\n          env.APP_ID_SET == 'true'\n        with:\n          token: ${{ steps.app-token.outputs.token }}\n          branch: ${{ github.event.pull_request.head.ref || github.head_ref || github.ref }}\n          commit-message: \"chore: fix linting issues\\n\\nSigned-off-by: ${{ steps.app-bot.outputs.name }} <${{ steps.app-bot.outputs.email }}>\"\n          commit-options: \"--no-verify\"\n          commit-user-name: ${{ steps.app-bot.outputs.name }}\n          commit-user-email: ${{ steps.app-bot.outputs.email }}\n          commit-author: \"${{ steps.app-bot.outputs.name }} <${{ steps.app-bot.outputs.email }}>\"\n\n\n  conclusion:\n    name: Conclusion\n    runs-on: ubuntu-latest\n    if: always()\n    needs: [super-lint]\n    steps:\n      - name: Check job statuses\n        run: |\n          if [[ \"$RESULTS\" == *\"failure\"* ]] || [[ \"$RESULTS\" == *\"cancelled\"* ]]; then\n            exit 1\n          fi\n        env:\n          RESULTS: ${{ join(needs.*.result, ',') }}\n";
 //#endregion
 //#region src/templates/workflows/post-release.yml
 var post_release_default = "name: Post-release Sync\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      HOLOCRON_SYNC_TOKEN:\n        required: false\n      GH_TOKEN:\n        description: >\n          Generic GitHub token fallback for gh CLI calls. Used when\n          HOLOCRON_SYNC_TOKEN is not set.\n        required: false\n\njobs:\n  broadcast:\n    name: Broadcast readme sync\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    steps:\n      - name: Trigger broadcast readme sync\n        run: |\n          gh workflow run sync-broadcast.yml \\\n            --repo theholocron/.github \\\n            --field \"steps=readme\"\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN }}\n";
@@ -5358,6 +5371,9 @@ var test_default = "name: Test\n\non: # yamllint disable-line rule:truthy\n  wor
 //#region src/templates/workflows/typecheck.yml
 var typecheck_default = "name: Typecheck\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  typecheck:\n    name: tsc --noEmit\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: pnpm typecheck\n        name: Type check\n\n\n  conclusion:\n    name: Conclusion\n    runs-on: ubuntu-latest\n    if: always()\n    needs: [typecheck]\n    steps:\n      - name: Check job statuses\n        run: |\n          if [[ \"$RESULTS\" == *\"failure\"* ]] || [[ \"$RESULTS\" == *\"cancelled\"* ]]; then\n            exit 1\n          fi\n        env:\n          RESULTS: ${{ join(needs.*.result, ',') }}\n";
 //#endregion
+//#region src/templates/workflows/wiki.yml
+var wiki_default = "name: Wiki\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      fern-version:\n        description: >\n          Fern CLI version to install. Pin this to avoid breaking changes when\n          Fern updates their config schema.\n        type: string\n        required: false\n        default: \"5.35.4\"\n      preview:\n        description: >\n          When true, publishes a preview instead of production.\n          Requires preview-id to be set.\n        type: boolean\n        required: false\n        default: false\n      preview-id:\n        description: >\n          Stable ID for the preview URL. The preview is accessible at\n          {org}-preview-{id}.docs.buildwithfern.com. Use the PR number\n          (e.g. \"pr-123\") so the same URL is reused on every push to\n          the branch.\n        type: string\n        required: false\n        default: \"\"\n    secrets:\n      HOLOCRON_FERN_TOKEN:\n        required: true\n\njobs:\n  publish:\n    name: ${{ inputs.preview && 'Preview' || 'Publish' }} to Fern\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    permissions:\n      contents: read\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - name: Install Fern CLI\n        run: npm install -g \"fern-api@$FERN_VERSION\"\n        env:\n          FERN_VERSION: ${{ inputs.fern-version }}\n\n      - name: Publish docs\n        if: ${{ !inputs.preview }}\n        run: fern generate --docs\n        env:\n          FERN_TOKEN: ${{ secrets.HOLOCRON_FERN_TOKEN }}\n\n      - name: Preview docs\n        if: ${{ inputs.preview && inputs.preview-id != '' }}\n        run: fern generate --docs --preview --id \"$PREVIEW_ID\"\n        env:\n          FERN_TOKEN: ${{ secrets.HOLOCRON_FERN_TOKEN }}\n          PREVIEW_ID: ${{ inputs.preview-id }}\n";
+//#endregion
 //#region src/templates/index.ts
 /**
 * All reusable workflow and composite action content bundled as string
@@ -5392,7 +5408,8 @@ const REUSABLE_WORKFLOWS = {
 	"sync-github": sync_github_default,
 	sync: sync_default,
 	test: test_default,
-	typecheck: typecheck_default
+	typecheck: typecheck_default,
+	wiki: wiki_default
 };
 const WORKFLOW_TEMPLATE_PROPERTIES = { bookkeeping: JSON.stringify({
 	name: "Bookkeeping",