@theholocron/cli 3.46.1 → 3.48.0

package/dist/cli.mjs

@@ -5,36 +5,33 @@ import path, { basename, dirname, join, relative, resolve } from "node:path";
 import { checkbox, input, select } from "@inquirer/prompts";
 import yargs from "yargs";
 import { hideBin } from "yargs/helpers";
-import { AuthError, ProviderApiError, ProviderApiError as ProviderApiError$1 } from "@theholocron/http-client";
+import { AuthError, ProviderApiError, ProviderApiError as ProviderApiError$1, createRestClient } from "@theholocron/http-client";
+import { createEnvLookup } from "@theholocron/env-utils";
 import { Entry, findCredentials } from "@napi-rs/keyring";
 import { pathToFileURL } from "node:url";
 import ora from "ora";
 import chalk from "chalk";
 import { execFile, execFileSync, spawnSync } from "node:child_process";
 import { homedir } from "node:os";
-import { createHash } from "node:crypto";
 import { access, copyFile, mkdir, readFile, readdir, rm, stat, symlink, unlink, writeFile } from "node:fs/promises";
+import { createHash } from "node:crypto";
 import { generateReadme } from "@theholocron/components-doc/markdown";
 import { getClients, getConfigs, getDocs, getPlugins, getSkills, getThemes, getUtils } from "@theholocron/registry-doc";
 import { createGitHubClient } from "@theholocron/github-client";
 import { promisify } from "node:util";
 import * as Sentry from "@sentry/node";
 //#region src/env.ts
-function createEnvLookup(source = process.env) {
-	return {
-		get(key) {
-			return source[key] || void 0;
-		},
-		first(...keys) {
-			for (const key of keys) {
-				const val = source[key];
-				if (val) return val;
-			}
-		}
-	};
+/** Singleton env for simple global lookups throughout the CLI. */
+const env = createEnvLookup();
+/**
+* Create an injectable env for commands that accept a fake env in tests.
+* Pass `input.env` when available, falls back to `process.env`.
+*/
+function makeEnv(source) {
+	return createEnvLookup(source);
 }
 //#endregion
-//#region src/keyring.ts
+//#region src/auth/keyring.ts
 /**
 * Keyring-backed bootstrap credential store.
 *
@@ -104,7 +101,7 @@ function listStoredProviders() {
 	}
 }
 //#endregion
-//#region src/auth-resolver.ts
+//#region src/auth/auth-resolver.ts
 /**
 * Build a strict, single-feature token resolver.
 *
@@ -114,7 +111,7 @@ function listStoredProviders() {
 */
 function createFeatureResolver(config) {
 	return function resolveFeatureToken(input = {}) {
-		const env = createEnvLookup(input.env);
+		const env = makeEnv(input.env);
 		const keyring = input.keyring ?? getToken;
 		const token = input.cliToken || env.get(config.envName) || keyring(config.keyringKey);
 		if (!token) throw new AuthError(`no GitHub token found for this operation. Pass --token <PAT>, set ${config.envName}, or run: holocron auth set ${config.keyringKey} <PAT>`);
@@ -122,7 +119,45 @@ function createFeatureResolver(config) {
 	};
 }
 //#endregion
-//#region src/capabilities/index.ts
+//#region src/auth/token-args.ts
+var TokenParseError = class extends Error {
+	name = "TokenParseError";
+};
+/**
+* Converts raw --token CLI values into a typed result.
+*
+* Bare form:   --token ghp_xxx            → { cliToken: "ghp_xxx" }
+* Keyed form:  --token github=ghp_xxx     → { cliTokens: { github: "ghp_xxx" } }
+* Mixed:       --token github=ghp_xxx --token v_yyy
+*                                         → { cliToken: "v_yyy", cliTokens: { github: "ghp_xxx" } }
+*
+* Values may contain "=" (e.g. base64 strings) — only the first "=" is treated as a separator.
+*/
+function parseTokenArgs(tokens) {
+	if (tokens.length === 0) return {};
+	const cliTokens = {};
+	const bare = [];
+	for (const raw of tokens) {
+		const eqIdx = raw.indexOf("=");
+		if (eqIdx === -1) {
+			bare.push(raw);
+			continue;
+		}
+		const vendor = raw.slice(0, eqIdx);
+		const value = raw.slice(eqIdx + 1);
+		if (vendor.trim() === "") throw new TokenParseError(`invalid --token value "${raw}": vendor name must not be empty`);
+		if (/\s/.test(vendor)) throw new TokenParseError(`invalid --token value "${raw}": vendor name must not contain whitespace`);
+		if (value === "") throw new TokenParseError(`invalid --token value "${raw}": token value must not be empty`);
+		cliTokens[vendor] = value;
+	}
+	if (bare.length > 1) throw new TokenParseError(`only one bare --token value is allowed; got ${bare.length.toString()} — use vendor=value form for multiple tokens`);
+	const result = {};
+	if (bare.length === 1) result.cliToken = bare[0];
+	if (Object.keys(cliTokens).length > 0) result.cliTokens = cliTokens;
+	return result;
+}
+//#endregion
+//#region src/plugin/capabilities.ts
 const CARDINALITY = {
 	source: "single",
 	ci: "single",
@@ -148,7 +183,7 @@ const CARDINALITY = {
 */
 const REQUIRED_CAPABILITIES = [];
 //#endregion
-//#region src/config.ts
+//#region src/config/config.ts
 /**
 * `holocron.config.json` schema, parser, and provider resolution.
 *
@@ -336,10 +371,10 @@ const defaultImporter$1 = async (pkg) => {
 * pulling FROM it would just re-store the same value.
 */
 function resolveAuthSetToken(input) {
-	const env = input.env ?? process.env;
+	const e = makeEnv(input.env);
 	const upper = input.provider.toUpperCase();
 	const holocronKey = `HOLOCRON_${upper}_TOKEN`;
-	return input.positional || env[holocronKey] || env[upper + "_TOKEN"] || null;
+	return input.positional || e.get(holocronKey) || e.get(`${upper}_TOKEN`) || null;
 }
 async function runAuthSet(input) {
 	const print = input.print ?? ((l) => console.log(l));
@@ -499,7 +534,7 @@ async function tryLoadHint(importer, packageName) {
 	}
 }
 //#endregion
-//#region src/loader.ts
+//#region src/plugin/loader.ts
 /**
 * `PluginLoader` — loads provider plugins per the resolved config and
 * builds a typed capability registry the runtime can query.
@@ -1324,11 +1359,11 @@ async function runNew(input) {
 			const setupEnv = {};
 			const adminToken = input.token ?? keychainLookup("github.admin");
 			if (adminToken) setupArgs.push("--token", adminToken);
-			if (!process.env["HOLOCRON_ORG_TOKEN"]) {
+			if (!env.get("HOLOCRON_ORG_TOKEN")) {
 				const orgToken = keychainLookup("github.org");
 				if (orgToken) setupEnv["HOLOCRON_ORG_TOKEN"] = orgToken;
 			}
-			if (!process.env["HOLOCRON_DEPLOY_TOKEN"]) {
+			if (!env.get("HOLOCRON_DEPLOY_TOKEN")) {
 				const deployToken = keychainLookup("github.deploy");
 				if (deployToken) setupEnv["HOLOCRON_DEPLOY_TOKEN"] = deployToken;
 			}
@@ -1459,7 +1494,7 @@ async function runNpmPublishInitial(input = {}) {
 	const tag = input.tag ?? "alpha";
 	const dryRun = input.dryRun ?? false;
 	const otp = input.otp;
-	const env = input.env ?? process.env;
+	const env = makeEnv(input.env);
 	const exec = input.exec ?? defaultExec$2;
 	const publishArgs = [
 		"-r",
@@ -1554,7 +1589,7 @@ function printNextSteps$1(print, env, packageNames, repoName) {
 	print("  → next: configure Trusted Publisher for each package on npm:");
 	for (const name of packageNames) print(`    https://www.npmjs.com/package/${name}/access`);
 	print(`    Publisher: GitHub Actions   Org: theholocron   Repo: ${repoName}   Workflow: release.yml`);
-	if (env.NPM_TOKEN) {
+	if (env.get("NPM_TOKEN")) {
 		print("");
 		print("  → cleanup: $NPM_TOKEN was used. Revoke it now (no API for self-revoke; UI-only):");
 		print("    https://www.npmjs.com/settings/~/tokens");
@@ -2689,9 +2724,8 @@ async function runSecretSet(input) {
 async function resolveValue(input) {
 	if (input.value) return input.value;
 	if (input.fromStdin) return (await (input.readStdin ?? defaultReadStdin)()).replace(/\r?\n$/, "");
-	const env = process.env;
-	if (input.fromEnv) return env[input.fromEnv];
-	return env[input.name];
+	if (input.fromEnv) return env.get(input.fromEnv);
+	return env.get(input.name);
 }
 async function defaultReadStdin() {
 	const chunks = [];
@@ -2815,19 +2849,547 @@ function vaultProviderName(loader) {
 	return loader.get("vault").providerName;
 }
 //#endregion
-//#region src/agent-prompts.ts
+//#region src/commands/setup/labels.ts
+const CANONICAL_LABELS = [
+	{
+		name: "bug",
+		color: "d73a4a",
+		description: "Something isn't working"
+	},
+	{
+		name: "chore",
+		color: "ededed",
+		description: "Maintenance, no user-facing change"
+	},
+	{
+		name: "ci",
+		color: "0075ca",
+		description: "CI/CD pipeline changes"
+	},
+	{
+		name: "dependencies",
+		color: "0366d6",
+		description: "Dependency update"
+	},
+	{
+		name: "documentation",
+		color: "0075ca",
+		description: "Documentation only"
+	},
+	{
+		name: "duplicate",
+		color: "cfd3d7",
+		description: "Already reported"
+	},
+	{
+		name: "enhancement",
+		color: "a2eeef",
+		description: "New feature or request"
+	},
+	{
+		name: "good first issue",
+		color: "7057ff",
+		description: "Good for newcomers"
+	},
+	{
+		name: "help wanted",
+		color: "008672",
+		description: "Extra attention needed"
+	},
+	{
+		name: "invalid",
+		color: "e4e669",
+		description: "Doesn't seem right"
+	},
+	{
+		name: "performance",
+		color: "fbca04",
+		description: "Performance improvement"
+	},
+	{
+		name: "question",
+		color: "d876e3",
+		description: "Further information requested"
+	},
+	{
+		name: "refactor",
+		color: "cfd3d7",
+		description: "Code restructuring"
+	},
+	{
+		name: "released",
+		color: "ededed",
+		description: "Included in a release"
+	},
+	{
+		name: "test",
+		color: "bfd4f2",
+		description: "Test-related changes"
+	},
+	{
+		name: "triage",
+		color: "e4e669",
+		description: "Needs investigation"
+	},
+	{
+		name: "wontfix",
+		color: "ffffff",
+		description: "Won't be addressed"
+	}
+];
+const STALE_LABELS = [
+	"github_actions",
+	"javascript",
+	"autorelease: pending",
+	"autorelease: tagged",
+	"released on @alpha"
+];
+//#endregion
+//#region src/templates/config.yml
+var config_default = "# Configuration for sentiment-bot - https://github.com/behaviorbot/sentiment-bot\n\n# *Required* toxicity threshold between 0 and .99 with the higher numbers being the most toxic\n# Anything higher than this threshold will be marked as toxic and commented on\nsentimentBotToxicityThreshold: .7\n\n# *Required* Comment to reply with\nsentimentBotReplyComment: >\n  Please be sure to review the [Code of Conduct](https://docs.theholocron.dev/reference/code-of-conduct/) and be respectful of other users.\n";
+//#endregion
+//#region src/utils/create-header.ts
+function createHeader(options) {
+	const { source, tool = "holocron setup", forPrimary = false } = options;
+	const doNotEdit = forPrimary ? `AUTO-GENERATED — do not edit in theholocron/.github directly.` : `AUTO-GENERATED — do not edit directly.`;
+	return {
+		workflowHeader(format = "yaml") {
+			if (format === "cjs") return [
+				`/* ${doNotEdit}`,
+				` * Source:  theholocron/holocron · ${source}`,
+				` * Tool:    ${tool}`,
+				` * Changes: edit source in theholocron/holocron`,
+				` */`,
+				``
+			].join("\n");
+			const yamlLines = [
+				`# ${doNotEdit}`,
+				`# Source:  theholocron/holocron · ${source}`,
+				`# Tool:    ${tool}`,
+				`# Changes: edit source in theholocron/holocron`,
+				``
+			].join("\n");
+			if (format === "shebang") return `#!/bin/sh\n\n${yamlLines}`;
+			return yamlLines;
+		},
+		scaffoldHeader() {
+			return [
+				`# Scaffolded by holocron setup — edit this file freely.`,
+				`# Source:  theholocron/holocron · ${source}`,
+				``
+			].join("\n");
+		}
+	};
+}
+//#endregion
+//#region src/templates/configs/alexjs/alexignore
+var alexignore_default = ".github/*\nCHANGELOG.md\nLICENSE\n";
+//#endregion
+//#region src/templates/configs/alexjs/alexrc.json
+var alexrc_default = { allow: [
+	"dead",
+	"failure",
+	"failures",
+	"hook",
+	"hooks",
+	"husky",
+	"period"
+] };
+//#endregion
+//#region src/templates/configs/alexjs/create-config.ts
+const { workflowHeader: workflowHeader$6 } = createHeader({ source: "packages/cli/src/templates/configs/alexjs/create-config.ts" });
+function createRcConfig() {
+	return JSON.stringify(alexrc_default, null, 2) + "\n";
+}
+function createIgnoreConfig() {
+	return `${workflowHeader$6()}${alexignore_default}`;
+}
+//#endregion
+//#region src/templates/configs/codecov/codecov.yml
+var codecov_default = "codecov:\n  require_ci_to_pass: true\n\ncoverage:\n  precision: 2\n  round: down\n  status:\n    project:\n      default:\n        target: auto\n        threshold: 2%\n    patch:\n      default:\n        target: 80%\n\ncomment:\n  layout: \"reach,diff,flags,components\"\n  behavior: default\n  require_changes: true\n\ncomponent_management:\n  default_rules:\n    statuses:\n      - type: patch\n        target: 80%\n  individual_components:\n";
+//#endregion
+//#region src/templates/configs/codecov/utils.ts
+const INDIVIDUAL_COMPONENTS_MARKER = "  individual_components:";
+function codecovComponentBlock(packages) {
+	if (packages.length === 0) return "\n    []\n";
+	return "\n" + packages.flatMap(({ slug }) => [
+		`    - component_id: ${slug}`,
+		`      name: "${slug}"`,
+		`      paths:`,
+		`        - packages/${slug}/**`,
+		``
+	]).join("\n");
+}
+function mergeCodecovComponents(existing, packages) {
+	const idx = existing.indexOf(INDIVIDUAL_COMPONENTS_MARKER);
+	if (idx === -1) return existing;
+	return existing.slice(0, idx + 24) + codecovComponentBlock(packages);
+}
+async function readWorkspacePackages(repoRoot) {
+	const packagesDir = join(repoRoot, "packages");
+	const entries = await readdir(packagesDir, { withFileTypes: true }).catch(() => null);
+	if (!entries) return [];
+	const packages = [];
+	for (const entry of entries) {
+		if (!entry.isDirectory()) continue;
+		try {
+			const raw = await readFile(join(packagesDir, entry.name, "package.json"), "utf8");
+			const pkg = JSON.parse(raw);
+			if (typeof pkg.name === "string") packages.push({
+				slug: entry.name,
+				name: pkg.name
+			});
+		} catch {}
+	}
+	return packages.sort((a, b) => a.slug.localeCompare(b.slug));
+}
+//#endregion
+//#region src/templates/configs/codecov/create-config.ts
+const { scaffoldHeader } = createHeader({ source: "packages/cli/src/templates/configs/codecov/create-config.ts" });
+function createConfig$4(packages) {
+	return `${scaffoldHeader()}${codecov_default.trimEnd()}${codecovComponentBlock(packages)}`;
+}
+//#endregion
+//#region src/templates/configs/devmoji/create-config.ts
+const { workflowHeader: workflowHeader$5 } = createHeader({ source: "packages/cli/src/templates/configs/devmoji/create-config.ts" });
+function createConfig$3() {
+	return [
+		workflowHeader$5("cjs"),
+		`/* eslint-disable */`,
+		`const { defineConfig } = require("@theholocron/devmoji-config");`,
+		`module.exports = defineConfig();`,
+		``
+	].join("\n");
+}
+//#endregion
+//#region src/templates/configs/editorconfig/editorconfig
+var editorconfig_default = "root = true\n\n[*]\nend_of_line = lf\ncharset = utf-8\ntrim_trailing_whitespace = true\ninsert_final_newline = true\nindent_style = tab\nindent_size = 4\n\n[.gitattributes]\nindent_style = space\nindent_size = 2\n\n[*.{json,yml,yaml}]\nindent_style = space\nindent_size = 2\n\n[*.{md,mdx}]\ntrim_trailing_whitespace = false\n\n[.*{rc,ignore}]\nindent_style = space\nindent_size = 2\n";
+//#endregion
+//#region src/templates/configs/editorconfig/create-config.ts
+const { workflowHeader: workflowHeader$4 } = createHeader({ source: "packages/cli/src/templates/configs/editorconfig/create-config.ts" });
+function createConfig$2() {
+	return `${workflowHeader$4()}${editorconfig_default}`;
+}
+//#endregion
+//#region src/templates/configs/editorconfig-checker/editorconfig-checker.json
+var editorconfig_checker_default = {
+	Version: "v3.7.0",
+	Verbose: false,
+	Format: "",
+	Debug: false,
+	IgnoreDefaults: false,
+	SpacesAfterTabs: false,
+	NoColor: false,
+	Exclude: [
+		"(^|.+/)LICENSE$",
+		"^public/.*",
+		"\\.md$",
+		"\\.mdx$"
+	],
+	AllowedContentTypes: [],
+	PassedFiles: [],
+	Disable: {
+		"EndOfLine": false,
+		"Indentation": false,
+		"InsertFinalNewline": false,
+		"TrimTrailingWhitespace": false,
+		"IndentSize": false,
+		"MaxLineLength": false
+	}
+};
+//#endregion
+//#region src/templates/configs/editorconfig-checker/create-config.ts
+function createConfig$1() {
+	return JSON.stringify(editorconfig_checker_default, null, 2) + "\n";
+}
+//#endregion
+//#region src/templates/configs/prepare-commit-msg/prepare-commit-msg
+var prepare_commit_msg_default = "NAME=$(git config user.name)\nEMAIL=$(git config user.email)\n\nif [ -z \"$NAME\" ]; then\n	echo \"empty git config user.name\"\n	exit 1\nfi\n\nif [ -z \"$EMAIL\" ]; then\n	echo \"empty git config user.email\"\n	exit 1\nfi\n\ngit interpret-trailers --if-exists doNothing --trailer \\\n	\"Signed-off-by: $NAME <$EMAIL>\" \\\n	--in-place \"$1\"\n\nnpx devmoji -e\n";
+//#endregion
+//#region src/templates/configs/prepare-commit-msg/create-config.ts
+const { workflowHeader: workflowHeader$3 } = createHeader({ source: "packages/cli/src/templates/configs/prepare-commit-msg/create-config.ts" });
+function createConfig() {
+	return `${workflowHeader$3("shebang")}${prepare_commit_msg_default}`;
+}
+//#endregion
+//#region src/templates/dco.yml
+var dco_default = "allowRemediationCommits:\n  individual: true\n";
+//#endregion
+//#region src/templates/dependabot.yml
+var dependabot_default = "version: 2\nupdates:\n  - package-ecosystem: npm\n    directory: /\n    schedule:\n      interval: weekly\n    commit-message:\n      prefix: \"chore(deps)\"\n      prefix-development: \"chore(deps-dev)\"\n    groups:\n      security-patches:\n        applies-to: security-updates\n        patterns:\n          - \"*\"\n      all-dependencies:\n        update-types:\n          - minor\n          - patch\n\n  - package-ecosystem: github-actions\n    directory: /\n    schedule:\n      interval: weekly\n    commit-message:\n      prefix: \"chore(deps)\"\n    groups:\n      all-actions:\n        patterns:\n          - \"*\"\n";
+//#endregion
+//#region src/templates/labeler.yml
+var labeler_default = "bug:\n  - '^fix'\n\nchore:\n  - '^chore(?!\\(deps)'\n\nci:\n  - '^ci'\n\ndependencies:\n  - '^chore\\(deps'\n\ndocumentation:\n  - '^docs'\n\nenhancement:\n  - '^feat'\n\nperformance:\n  - '^perf'\n\nrefactor:\n  - '^refactor'\n\ntest:\n  - '^test'\n";
+//#endregion
+//#region src/commands/setup-workflows/index.ts
 /**
-* Canonical AI engineering workflow role prompts.
+* Thin workflow wrapper templates for `holocron setup`.
 *
-* Written to `.agents/prompts/<role>.md` by `holocron setup` when `agent` is
-* configured. Paths are gitignored and regenerated on every setup run so the
-* content always reflects the current CLI version.
+* Each entry is a complete `.github/workflows/<name>.yml` that delegates
+* to the corresponding reusable `ci-<name>.yml` in `theholocron/.github`.
+* Files are overwritten on each setup run — they are generated artifacts.
+*/
+const WORKFLOW_TEMPLATES = {
+	lint: "name: Lint\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\nconcurrency:\n  group: lint-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: write\n  issues: write\n  statuses: write\n\njobs:\n  lint:\n    name: Lint\n    uses: theholocron/.github/.github/workflows/lint.yml@main\n    secrets: inherit\n    with:\n      enable-auto-commit: true\n",
+	test: "name: Test\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\nconcurrency:\n  group: test-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n  id-token: write\n  statuses: write\n\njobs:\n  test:\n    name: Test\n    uses: theholocron/.github/.github/workflows/test.yml@main\n    with:\n      run-unit: true\n    secrets: inherit\n",
+	typecheck: "name: Typecheck\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\nconcurrency:\n  group: typecheck-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n\njobs:\n  typecheck:\n    name: Typecheck\n    uses: theholocron/.github/.github/workflows/typecheck.yml@main\n    secrets: inherit\n",
+	security: "name: Security\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches:\n      - main\n  pull_request:\n    branches:\n      - main\n  schedule:\n    - cron: \"0 0 * * 1\"\n\npermissions:\n  actions: read\n  contents: read\n  security-events: write\n\njobs:\n  security:\n    uses: theholocron/.github/.github/workflows/security.yml@main\n    secrets: inherit\n",
+	preview: "name: Preview\n\non: # yamllint disable-line rule:truthy\n  pull_request:\n    branches: [main]\n\nconcurrency:\n  group: preview-${{ github.event.pull_request.number }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n  deployments: write\n  pull-requests: write\n\njobs:\n  preview:\n    name: Preview\n    uses: theholocron/.github/.github/workflows/preview.yml@main\n    secrets: inherit\n",
+	review: "name: Review\n\non: # yamllint disable-line rule:truthy\n  pull_request:\n\nconcurrency:\n  group: review-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n  checks: write\n  pull-requests: write\n\njobs:\n  review:\n    name: Review\n    uses: theholocron/.github/.github/workflows/review.yml@main\n    secrets: inherit\n",
+	release: "name: Release\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches:\n      - main\n      - alpha\n  workflow_dispatch:\n    inputs:\n      dry_run:\n        description: >\n          Dry run — analyze commits and preview the release without git writes\n          or publish. Push-triggered runs always run fully; this only applies\n          to manual workflow_dispatch triggers.\n        required: false\n        default: true\n        type: boolean\n\npermissions:\n  contents: write\n  id-token: write\n  issues: write\n  pull-requests: write\n\nconcurrency:\n  group: ${{ github.workflow }}-${{ github.ref }}\n  cancel-in-progress: false\n\njobs:\n  release:\n    uses: theholocron/.github/.github/workflows/release.yml@main\n    with:\n      dry-run: ${{ inputs.dry_run == true }}\n    secrets: inherit\n",
+	stale: "name: Stale\n\non: # yamllint disable-line rule:truthy\n  schedule:\n    - cron: \"30 1 * * *\"\n\npermissions:\n  contents: write\n  issues: write\n  pull-requests: write\n\njobs:\n  stale:\n    uses: theholocron/.github/.github/workflows/stale.yml@main\n    secrets: inherit\n",
+	sync: "name: Sync\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main]\n    paths:\n      - holocron.config.ts\n      - package.json\n      - pnpm-workspace.yaml\n  workflow_dispatch:\n    inputs:\n      steps:\n        description: \"Sync steps to run (default: all)\"\n        type: string\n        required: false\n\nconcurrency:\n  group: sync-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: write\n  pull-requests: write\n\njobs:\n  sync:\n    name: Sync\n    uses: theholocron/.github/.github/workflows/sync.yml@main\n    with:\n      steps: ${{ inputs.steps }}\n    secrets: inherit\n",
+	greetings: "name: Greetings\n\non: # yamllint disable-line rule:truthy\n  pull_request:\n  issues:\n\npermissions:\n  issues: write\n  pull-requests: write\n\njobs:\n  greetings:\n    uses: theholocron/.github/.github/workflows/greetings.yml@main\n    secrets: inherit\n",
+	dependencies: "name: Dependencies\n\non: # yamllint disable-line rule:truthy\n  pull_request:\n\npermissions:\n  contents: write\n  pull-requests: write\n\njobs:\n  dependencies:\n    uses: theholocron/.github/.github/workflows/dependencies.yml@main\n    secrets: inherit\n",
+	bookkeeping: "name: Bookkeeping\n\non: # yamllint disable-line rule:truthy\n  pull_request:\n    types:\n      - opened\n      - edited\n\npermissions:\n  contents: read\n  issues: write\n  pull-requests: write\n\njobs:\n  bookkeeping:\n    uses: theholocron/.github/.github/workflows/bookkeeping.yml@main\n    secrets: inherit\n",
+	audit: "name: Audit\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\npermissions:\n  contents: read\n\njobs:\n  audit:\n    uses: theholocron/.github/.github/workflows/audit.yml@main\n    secrets: inherit\n",
+	deploy: "name: Deploy\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main]\n  workflow_dispatch:\n\nconcurrency:\n  group: pages\n  cancel-in-progress: false\n\npermissions:\n  contents: read\n  pages: write\n  id-token: write\n\njobs:\n  deploy:\n    name: Deploy\n    uses: theholocron/.github/.github/workflows/deploy.yml@main\n    secrets: inherit\n",
+	wiki: "name: Wiki\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main]\n  pull_request:\n    branches: [main]\n\nconcurrency:\n  group: ${{ github.event_name == 'pull_request' && format('wiki-preview-{0}', github.event.pull_request.number) || 'wiki' }}\n  cancel-in-progress: ${{ github.event_name == 'pull_request' }}\n\npermissions:\n  contents: read\n  deployments: write\n\njobs:\n  publish:\n    name: Publish\n    if: ${{ github.event_name != 'pull_request' }}\n    uses: theholocron/.github/.github/workflows/wiki.yml@main\n    secrets: inherit\n\n  preview:\n    name: Preview\n    if: ${{ github.event_name == 'pull_request' }}\n    uses: theholocron/.github/.github/workflows/wiki.yml@main\n    with:\n      preview: true\n      preview-id: pr-${{ github.event.pull_request.number }}\n    secrets: inherit\n"
+};
+const KNOWN_WORKFLOWS = new Set(Object.keys(WORKFLOW_TEMPLATES));
+/**
+* GitHub check context name each CI workflow produces on a PR.
 *
-* Source: .notes/ai-engineering-workflow.spec.md
+* The format is "{caller-workflow-name} / {reusable-job-name}". The caller
+* job's own `name:` field does NOT appear in the external check name — only
+* the calling workflow's top-level `name:` and the inner reusable-workflow
+* job name matter. Only workflows that gate merges are listed here.
 */
-const DECISIONS_TEMPLATE = "---\nid: ADR-XXXX\ntitle: \"\"\nstatus: proposed\ndate: YYYY-MM-DD\nowners: []\nspecs: []\ndiscussion:\n  github:\nsupersedes: []\nsuperseded-by: []\ntags: []\n---\n\n# [Short title of the decision]\n\n- Status: [proposed | accepted | rejected | deprecated | superseded by ADR-XXXX]\n- Date: YYYY-MM-DD\n\n## Context and Problem Statement\n\n2–3 sentences describing the situation that forced this decision.\n\n## Decision Drivers\n\n- [driver 1 — a constraint, goal, or value]\n- [driver 2]\n\n## Considered Options\n\n- [Option A]\n- [Option B]\n- [Option C — do nothing]\n\n## Decision Outcome\n\nChosen option: **[Option A]**, because [one-sentence justification].\n\n### Positive Consequences\n\n- …\n\n### Negative Consequences\n\n- …\n\n## Pros and Cons of the Options\n\n### [Option A]\n\n- Good, because [argument]\n- Bad, because [argument]\n\n### [Option B]\n\n- Good, because [argument]\n- Bad, because [argument]\n";
-const AGENT_PROMPTS = {
-	"discovery.md": `# Discovery Agent
+const WORKFLOW_CHECK_CONTEXTS = {
+	lint: "Lint / Lint entire codebase",
+	test: "Test / Run tests and collect coverage",
+	typecheck: "Typecheck / tsc --noEmit"
+};
+/**
+* Generate the thin caller content for a workflow, optionally injecting or
+* merging `with:` overrides into the jobs block.
+*
+* Two strategies are used depending on the template:
+* - Templates that already have a `with:` block (e.g. lint):
+*   the override entries are merged in, replacing existing keys and appending
+*   new ones.
+* - Templates that end with `    secrets: inherit`: a new `with:` block is
+*   injected immediately before `secrets: inherit`.
+* If neither pattern matches the template, a warning is emitted and the
+* base template is returned unchanged.
+*/
+function generateThinCallerContent(name, withOverrides, additionalPaths) {
+	const base = WORKFLOW_TEMPLATES[name];
+	if (!base) return "";
+	const yamlScalar = (v) => {
+		if (v === true) return "true";
+		if (v === false) return "false";
+		const s = String(v);
+		return s.startsWith("[") || s.startsWith("{") ? `'${s}'` : s;
+	};
+	const fmt = (k, v) => `      ${k}: ${yamlScalar(v)}`;
+	let result = base;
+	if (additionalPaths && additionalPaths.length > 0) {
+		const pathsBlockRe = /( {4}paths:\n)((?:[ ]{6}- [^\n]+\n)+)/;
+		if (pathsBlockRe.test(result)) result = result.replace(pathsBlockRe, (_, header, existing) => {
+			const existingPaths = new Set([...existing.matchAll(/- (.+)/g)].map((m) => m[1]));
+			const newEntries = additionalPaths.filter((p) => !existingPaths.has(p)).map((p) => `      - ${p}\n`).join("");
+			return header + existing + newEntries;
+		});
+		else {
+			const pathsBlock = `    paths:\n${additionalPaths.map((p) => `      - ${p}\n`).join("")}`;
+			result = result.replace(/( {4}branches: \[main\]\n)/, `$1${pathsBlock}`);
+		}
+	}
+	if (!withOverrides || Object.keys(withOverrides).length === 0) return result;
+	const withBlockRe = /( {4}with:\n)((?:[ ]{6}[^\n]+\n)*)/;
+	const existingMatch = result.match(withBlockRe);
+	if (existingMatch) {
+		const existingEntries = new Map(existingMatch[2].split("\n").filter(Boolean).map((line) => {
+			const m = line.match(/^ {6}([^:]+):\s*(.*)/);
+			return m ? [m[1].trim(), m[2].trim()] : null;
+		}).filter((e) => e !== null));
+		for (const [k, v] of Object.entries(withOverrides)) existingEntries.set(k, yamlScalar(v));
+		const merged = [...existingEntries.entries()].map(([k, v]) => `      ${k}: ${v}`).join("\n");
+		return result.replace(withBlockRe, `    with:\n${merged}\n`);
+	}
+	const withBlock = Object.entries(withOverrides).map(([k, v]) => fmt(k, v)).join("\n");
+	const injected = result.replace(/ {4}secrets: inherit\n$/, `    with:\n${withBlock}\n    secrets: inherit\n`);
+	if (injected === result) console.warn(`[generateThinCallerContent] could not inject with: overrides into "${name}" template`);
+	return injected;
+}
+/**
+* Extract the Cloudflare Pages preview config from a deploy workflow's `with:` object.
+*
+* Accepts three forms:
+* - `preview: true` — derive both project and domain from org context
+* - `preview: { project: "..." }` — explicit project; domain derived from context if omitted
+* - `preview: { project: "...", domain: "..." }` — fully explicit
+*
+* Returns null when `preview:` is absent, false, or can't be resolved.
+*/
+function extractPreviewConfig(raw, ctx = {}) {
+	const preview = raw["preview"];
+	if (!preview) return null;
+	if (preview === true) {
+		const project = ctx.org ? `${ctx.org}-preview` : null;
+		const domain = ctx.domain ? `preview.${ctx.domain}` : void 0;
+		if (!project) return null;
+		return {
+			project,
+			...domain ? { domain } : {}
+		};
+	}
+	if (typeof preview !== "object") return null;
+	const p = preview;
+	const project = typeof p["project"] === "string" && p["project"] ? p["project"] : ctx.org ? `${ctx.org}-preview` : null;
+	if (!project) return null;
+	const domain = typeof p["domain"] === "string" && p["domain"] ? p["domain"] : ctx.domain ? `preview.${ctx.domain}` : void 0;
+	return {
+		project,
+		...domain ? { domain } : {}
+	};
+}
+/**
+* Generate the full thin-caller YAML for a `deploy.yml` that handles both
+* production (push to main → GitHub Pages) and preview (pull_request →
+* Cloudflare Pages) in a single file.
+*
+* Both jobs receive the same docs/storybook `with:` inputs. If the per-repo
+* config supplies `cloudflare-project` it is forwarded; otherwise the reusable
+* falls back to the `CLOUDFLARE_PAGES_PROJECT` org variable — set that once and
+* all repos with a `deploy` workflow get previews without per-repo config.
+*/
+function generateCombinedDeployContent(deployWith, paths, preview) {
+	const yamlScalar = (v) => {
+		if (v === true) return "true";
+		if (v === false) return "false";
+		const s = String(v);
+		return s.startsWith("[") || s.startsWith("{") ? `'${s}'` : s;
+	};
+	const withLines = (entries) => Object.entries(entries).map(([k, v]) => `      ${k}: ${yamlScalar(v)}`).join("\n");
+	const pathsBlock = paths.length > 0 ? `    paths:\n${paths.map((p) => `      - ${p}\n`).join("")}` : "";
+	const previewWith = {
+		...deployWith,
+		"cloudflare-project": preview.project
+	};
+	const deployWithBlock = Object.keys(deployWith).length > 0 ? `    with:\n${withLines(deployWith)}\n` : "";
+	const previewWithBlock = `    with:\n${withLines(previewWith)}\n`;
+	return [
+		`name: Deploy`,
+		``,
+		`on: # yamllint disable-line rule:truthy`,
+		`  push:`,
+		`    branches: [main]`,
+		...pathsBlock ? [`${pathsBlock}`] : [],
+		`  pull_request:`,
+		`    branches: [main]`,
+		`    types: [opened, synchronize, reopened, closed]`,
+		...pathsBlock ? [`${pathsBlock}`] : [],
+		`  workflow_dispatch:`,
+		``,
+		`concurrency:`,
+		`  group: $\{{ github.event_name == 'pull_request' && format('preview-{0}', github.event.pull_request.number) || 'pages' }}`,
+		`  cancel-in-progress: $\{{ github.event_name == 'pull_request' && github.event.action != 'closed' }}`,
+		``,
+		`permissions:`,
+		`  contents: read`,
+		`  deployments: write`,
+		`  pages: write`,
+		`  id-token: write`,
+		`  pull-requests: write`,
+		``,
+		`jobs:`,
+		`  deploy:`,
+		`    name: Deploy`,
+		`    if: \${{ github.event_name != 'pull_request' }}`,
+		`    uses: theholocron/.github/.github/workflows/deploy.yml@main`,
+		...deployWithBlock ? [deployWithBlock.trimEnd()] : [],
+		`    secrets: inherit`,
+		``,
+		`  preview:`,
+		`    name: Preview`,
+		`    if: \${{ github.event_name == 'pull_request' }}`,
+		`    uses: theholocron/.github/.github/workflows/preview.yml@main`,
+		previewWithBlock.trimEnd(),
+		`    secrets: inherit`,
+		``
+	].join("\n");
+}
+/**
+* Expand structured with-values to flat GitHub Actions inputs before
+* generating the thin caller. Handles:
+*   - deploy shorthand: docs/storybook → type + storybook-projects
+*   - preview: stripped (handled separately via extractPreviewConfig)
+*   - run-chromatic object → run-chromatic: true + chromatic-projects
+*   - plain arrays → JSON-stringified for YAML scalar quoting
+*
+* Used by both `holocron setup` and `sync-workflow-templates`.
+*/
+function normalizeWorkflowWith(raw) {
+	const result = { ...raw };
+	delete result["preview"];
+	const hasDocs = raw["docs"] === true || raw["docs"] !== null && typeof raw["docs"] === "object";
+	const storybookProjects = raw["storybook"];
+	if (hasDocs) {
+		result["type"] = "docs";
+		delete result["docs"];
+	}
+	if (Array.isArray(storybookProjects)) {
+		if (!hasDocs) result["type"] = "storybook";
+		result["storybook-projects"] = JSON.stringify(storybookProjects.map(({ name, path = "." }) => ({
+			name,
+			workingDir: path
+		})));
+		delete result["storybook"];
+	}
+	const runChromatic = raw["run-chromatic"];
+	if (runChromatic !== null && typeof runChromatic === "object" && "projects" in runChromatic) {
+		result["run-chromatic"] = true;
+		const projects = runChromatic.projects.map((p) => ({
+			...p,
+			...Array.isArray(p.untraced) ? { untraced: p.untraced.join("\n") } : {}
+		}));
+		result["chromatic-projects"] = JSON.stringify(projects);
+	}
+	for (const [k, v] of Object.entries(result)) if (Array.isArray(v)) result[k] = JSON.stringify(v);
+	return result;
+}
+/**
+* Derive on.push.paths entries from the deploy with: shorthand.
+* Used by both `holocron setup` and `sync-workflow-templates`.
+*/
+function deriveDeployPaths(raw) {
+	const paths = [];
+	const docs = raw["docs"];
+	if (docs === true) {
+		paths.push("docs/**");
+		paths.push("astro.config.ts");
+		paths.push("pnpm-workspace.yaml");
+		paths.push("pnpm-lock.yaml");
+	} else if (docs !== null && typeof docs === "object" && "path" in docs) {
+		const p = docs.path;
+		if (p && p !== ".") paths.push(`${p}/**`);
+	}
+	const storybookProjects = raw["storybook"];
+	if (Array.isArray(storybookProjects)) for (const s of storybookProjects) {
+		const p = s.path || ".";
+		if (p === ".") {
+			paths.push("src/**");
+			paths.push(".storybook/**");
+		} else paths.push(`${p}/**`);
+	}
+	return paths;
+}
+//#endregion
+//#region src/commands/setup/agent-prompts-data.ts
+/**
+* Canonical AI engineering workflow role prompts.
+*
+* Written to `.agents/prompts/<role>.md` by `holocron setup` when `agent` is
+* configured. Paths are gitignored and regenerated on every setup run so the
+* content always reflects the current CLI version.
+*
+* Source: .notes/ai-engineering-workflow.spec.md
+*/
+const DECISIONS_TEMPLATE = "---\nid: ADR-XXXX\ntitle: \"\"\nstatus: proposed\ndate: YYYY-MM-DD\nowners: []\nspecs: []\ndiscussion:\n  github:\nsupersedes: []\nsuperseded-by: []\ntags: []\n---\n\n# [Short title of the decision]\n\n- Status: [proposed | accepted | rejected | deprecated | superseded by ADR-XXXX]\n- Date: YYYY-MM-DD\n\n## Context and Problem Statement\n\n2–3 sentences describing the situation that forced this decision.\n\n## Decision Drivers\n\n- [driver 1 — a constraint, goal, or value]\n- [driver 2]\n\n## Considered Options\n\n- [Option A]\n- [Option B]\n- [Option C — do nothing]\n\n## Decision Outcome\n\nChosen option: **[Option A]**, because [one-sentence justification].\n\n### Positive Consequences\n\n- …\n\n### Negative Consequences\n\n- …\n\n## Pros and Cons of the Options\n\n### [Option A]\n\n- Good, because [argument]\n- Bad, because [argument]\n\n### [Option B]\n\n- Good, because [argument]\n- Bad, because [argument]\n";
+const AGENT_PROMPTS = {
+	"discovery.md": `# Discovery Agent
 
 You are performing engineering discovery.
 
@@ -3203,660 +3765,34 @@ the system must do — not how to implement it.
 > **Drafts** live in \`.notes/*.spec.md\` until accepted, then graduate here.
 `;
 //#endregion
-//#region src/commands/dependabot.yml
-var dependabot_default = "version: 2\nupdates:\n  - package-ecosystem: npm\n    directory: /\n    schedule:\n      interval: weekly\n    commit-message:\n      prefix: \"chore(deps)\"\n      prefix-development: \"chore(deps-dev)\"\n    groups:\n      security-patches:\n        applies-to: security-updates\n        patterns:\n          - \"*\"\n      all-dependencies:\n        update-types:\n          - minor\n          - patch\n\n  - package-ecosystem: github-actions\n    directory: /\n    schedule:\n      interval: weekly\n    commit-message:\n      prefix: \"chore(deps)\"\n    groups:\n      all-actions:\n        patterns:\n          - \"*\"\n";
-//#endregion
-//#region src/commands/workflows/audit.yml
-var audit_default$1 = "name: Audit\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\npermissions:\n  contents: read\n\njobs:\n  audit:\n    uses: theholocron/.github/.github/workflows/audit.yml@main\n    secrets: inherit\n";
+//#region src/commands/setup/agent-prompts.ts
+const AGENTS_PROMPTS_ROOT = ".agents/prompts";
+const PROMPTS_GITIGNORE_START = "# managed by holocron setup — prompts";
+const PROMPTS_GITIGNORE_END = "# end managed by holocron setup — prompts";
+async function installAgentPrompts({ repoRoot }) {
+	const promptsDir = join(repoRoot, AGENTS_PROMPTS_ROOT);
+	await mkdir(promptsDir, { recursive: true });
+	for (const [filename, content] of Object.entries(AGENT_PROMPTS)) await writeFile(join(promptsDir, filename), content, "utf8");
+	const gitignorePath = join(repoRoot, ".gitignore");
+	const existing = await readFile(gitignorePath, "utf8").catch(() => "");
+	const block = [
+		PROMPTS_GITIGNORE_START,
+		`/${AGENTS_PROMPTS_ROOT}/`,
+		PROMPTS_GITIGNORE_END
+	].join("\n");
+	let updated;
+	if (existing.includes(PROMPTS_GITIGNORE_START)) {
+		const start = existing.indexOf(PROMPTS_GITIGNORE_START);
+		const end = existing.indexOf(PROMPTS_GITIGNORE_END, start);
+		const afterBlock = end !== -1 ? existing.slice(end + 41) : "\n";
+		updated = existing.slice(0, start) + block + afterBlock;
+	} else updated = (existing.trimEnd() ? existing.trimEnd() + "\n\n" : "") + block + "\n";
+	await writeFile(gitignorePath, updated, "utf8");
+	return `wrote ${Object.keys(AGENT_PROMPTS).length} prompt files to ${AGENTS_PROMPTS_ROOT}/`;
+}
 //#endregion
-//#region src/commands/workflows/bookkeeping.yml
-var bookkeeping_default$1 = "name: Bookkeeping\n\non: # yamllint disable-line rule:truthy\n  pull_request:\n    types:\n      - opened\n      - edited\n\npermissions:\n  contents: read\n  issues: write\n  pull-requests: write\n\njobs:\n  bookkeeping:\n    uses: theholocron/.github/.github/workflows/bookkeeping.yml@main\n    secrets: inherit\n";
-//#endregion
-//#region src/commands/workflows/codeql.yml
-var codeql_default$1 = "name: CodeQL\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches:\n      - main\n  pull_request:\n    branches:\n      - main\n  schedule:\n    - cron: \"0 0 * * 1\"\n\npermissions:\n  actions: read\n  contents: read\n  security-events: write\n\njobs:\n  codeql:\n    uses: theholocron/.github/.github/workflows/codeql.yml@main\n    secrets: inherit\n";
-//#endregion
-//#region src/commands/workflows/dependencies.yml
-var dependencies_default$1 = "name: Dependencies\n\non: # yamllint disable-line rule:truthy\n  pull_request:\n\npermissions:\n  contents: write\n  pull-requests: write\n\njobs:\n  dependencies:\n    uses: theholocron/.github/.github/workflows/dependencies.yml@main\n    secrets: inherit\n";
-//#endregion
-//#region src/commands/workflows/deploy.yml
-var deploy_default$1 = "name: Deploy\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main]\n  workflow_dispatch:\n\nconcurrency:\n  group: pages\n  cancel-in-progress: false\n\npermissions:\n  contents: read\n  pages: write\n  id-token: write\n\njobs:\n  deploy:\n    name: Deploy\n    uses: theholocron/.github/.github/workflows/deploy.yml@main\n    secrets: inherit\n";
-//#endregion
-//#region src/commands/workflows/greetings.yml
-var greetings_default$1 = "name: Greetings\n\non: # yamllint disable-line rule:truthy\n  pull_request:\n  issues:\n\npermissions:\n  issues: write\n  pull-requests: write\n\njobs:\n  greetings:\n    uses: theholocron/.github/.github/workflows/greetings.yml@main\n    secrets: inherit\n";
-//#endregion
-//#region src/commands/workflows/lint.yml
-var lint_default$1 = "name: Lint\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\nconcurrency:\n  group: lint-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: write\n  issues: write\n  statuses: write\n\njobs:\n  lint:\n    name: Lint\n    uses: theholocron/.github/.github/workflows/lint.yml@main\n    secrets: inherit\n    with:\n      enable-auto-commit: true\n";
-//#endregion
-//#region src/commands/workflows/post-release.yml
-var post_release_default$1 = "name: Post-release Sync\n\non: # yamllint disable-line rule:truthy\n  release:\n    types: [published]\n\npermissions:\n  contents: read\n\njobs:\n  broadcast:\n    name: Post-release Sync\n    uses: theholocron/.github/.github/workflows/post-release.yml@main\n    secrets: inherit\n";
-//#endregion
-//#region src/commands/workflows/release.yml
-var release_default$1 = "name: Release\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches:\n      - main\n      - alpha\n  workflow_dispatch:\n    inputs:\n      dry_run:\n        description: >\n          Dry run — analyze commits and preview the release without git writes\n          or publish. Push-triggered runs always run fully; this only applies\n          to manual workflow_dispatch triggers.\n        required: false\n        default: true\n        type: boolean\n\npermissions:\n  contents: write\n  id-token: write\n  issues: write\n  pull-requests: write\n\nconcurrency:\n  group: ${{ github.workflow }}-${{ github.ref }}\n  cancel-in-progress: false\n\njobs:\n  release:\n    uses: theholocron/.github/.github/workflows/release.yml@main\n    with:\n      dry-run: ${{ inputs.dry_run == true }}\n    secrets: inherit\n";
-//#endregion
-//#region src/commands/workflows/review.yml
-var review_default$1 = "name: Review\n\non: # yamllint disable-line rule:truthy\n  pull_request:\n\nconcurrency:\n  group: review-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n  checks: write\n  pull-requests: write\n\njobs:\n  review:\n    name: Review\n    uses: theholocron/.github/.github/workflows/review.yml@main\n    secrets: inherit\n";
-//#endregion
-//#region src/commands/workflows/stale.yml
-var stale_default$1 = "name: Stale\n\non: # yamllint disable-line rule:truthy\n  schedule:\n    - cron: \"30 1 * * *\"\n\npermissions:\n  contents: write\n  issues: write\n  pull-requests: write\n\njobs:\n  stale:\n    uses: theholocron/.github/.github/workflows/stale.yml@main\n    secrets: inherit\n";
-//#endregion
-//#region src/commands/workflows/sync.yml
-var sync_default$1 = "name: Sync\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main]\n    paths:\n      - holocron.config.ts\n      - package.json\n      - pnpm-workspace.yaml\n  workflow_dispatch:\n    inputs:\n      steps:\n        description: \"Sync steps to run (default: all)\"\n        type: string\n        required: false\n\nconcurrency:\n  group: sync-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: write\n  pull-requests: write\n\njobs:\n  sync:\n    name: Sync\n    uses: theholocron/.github/.github/workflows/sync.yml@main\n    with:\n      steps: ${{ inputs.steps }}\n    secrets: inherit\n";
-//#endregion
-//#region src/commands/workflows/test.yml
-var test_default$1 = "name: Test\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\nconcurrency:\n  group: test-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n  id-token: write\n  statuses: write\n\njobs:\n  test:\n    name: Test\n    uses: theholocron/.github/.github/workflows/test.yml@main\n    with:\n      run-unit: true\n    secrets: inherit\n";
-//#endregion
-//#region src/commands/workflows/typecheck.yml
-var typecheck_default$1 = "name: Typecheck\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\nconcurrency:\n  group: typecheck-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n\njobs:\n  typecheck:\n    name: Typecheck\n    uses: theholocron/.github/.github/workflows/typecheck.yml@main\n    secrets: inherit\n";
-//#endregion
-//#region src/commands/workflows/wiki.yml
-var wiki_default$1 = "name: Wiki\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main]\n  pull_request:\n    branches: [main]\n\nconcurrency:\n  group: ${{ github.event_name == 'pull_request' && format('wiki-preview-{0}', github.event.pull_request.number) || 'wiki' }}\n  cancel-in-progress: ${{ github.event_name == 'pull_request' }}\n\npermissions:\n  contents: read\n  deployments: write\n\njobs:\n  publish:\n    name: Publish\n    if: ${{ github.event_name != 'pull_request' }}\n    uses: theholocron/.github/.github/workflows/wiki.yml@main\n    secrets: inherit\n\n  preview:\n    name: Preview\n    if: ${{ github.event_name == 'pull_request' }}\n    uses: theholocron/.github/.github/workflows/wiki.yml@main\n    with:\n      preview: true\n      preview-id: pr-${{ github.event.pull_request.number }}\n    secrets: inherit\n";
-//#endregion
-//#region src/commands/setup-workflows.ts
-/**
-* Header prepended to every auto-generated workflow thin caller.
-*
-* Used by both `holocron setup` (initial creation) and `holocron sync-github`
-* (subsequent updates) so the header is always identical regardless of which
-* command last wrote the file.
-*
-* @param source - path within theholocron/holocron that owns the template
-* @param forPrimary - true only when writing to theholocron/.github itself
-*/
-function workflowHeader(source = "packages/cli/src/commands/setup-workflows.ts", forPrimary = false, tool = "holocron sync-github") {
-	return [
-		forPrimary ? `# AUTO-GENERATED — do not edit in theholocron/.github directly.` : `# AUTO-GENERATED — do not edit directly.`,
-		`# Source:  theholocron/holocron · ${source}`,
-		`# Tool:    ${tool}`,
-		`# Changes: edit source in theholocron/holocron and push to alpha or main.`,
-		``
-	].join("\n");
-}
-function scaffoldHeader(source = "packages/cli/src/commands/setup.ts") {
-	return [
-		`# Scaffolded by holocron setup — edit this file freely.`,
-		`# Source:  theholocron/holocron · ${source}`,
-		``
-	].join("\n");
-}
-const WORKFLOW_TEMPLATES = {
-	lint: lint_default$1,
-	test: test_default$1,
-	typecheck: typecheck_default$1,
-	codeql: codeql_default$1,
-	review: review_default$1,
-	"post-release": post_release_default$1,
-	release: release_default$1,
-	stale: stale_default$1,
-	sync: sync_default$1,
-	greetings: greetings_default$1,
-	dependencies: dependencies_default$1,
-	bookkeeping: bookkeeping_default$1,
-	audit: audit_default$1,
-	deploy: deploy_default$1,
-	wiki: wiki_default$1
-};
-const KNOWN_WORKFLOWS = new Set(Object.keys(WORKFLOW_TEMPLATES));
-/**
-* GitHub check context name each CI workflow produces on a PR.
-*
-* The format is "{caller-workflow-name} / {reusable-job-name}". The caller
-* job's own `name:` field does NOT appear in the external check name — only
-* the calling workflow's top-level `name:` and the inner reusable-workflow
-* job name matter. Only workflows that gate merges are listed here.
-*/
-const WORKFLOW_CHECK_CONTEXTS = {
-	lint: "Lint / Lint entire codebase",
-	test: "Test / Run tests and collect coverage",
-	typecheck: "Typecheck / tsc --noEmit"
-};
-/**
-* Generate the thin caller content for a workflow, optionally injecting or
-* merging `with:` overrides into the jobs block.
-*
-* Two strategies are used depending on the template:
-* - Templates that already have a `with:` block (e.g. lint):
-*   the override entries are merged in, replacing existing keys and appending
-*   new ones.
-* - Templates that end with `    secrets: inherit`: a new `with:` block is
-*   injected immediately before `secrets: inherit`.
-* If neither pattern matches the template, a warning is emitted and the
-* base template is returned unchanged.
-*/
-function generateThinCallerContent(name, withOverrides, additionalPaths) {
-	const base = WORKFLOW_TEMPLATES[name];
-	if (!base) return "";
-	const yamlScalar = (v) => {
-		if (v === true) return "true";
-		if (v === false) return "false";
-		const s = String(v);
-		return s.startsWith("[") || s.startsWith("{") ? `'${s}'` : s;
-	};
-	const fmt = (k, v) => `      ${k}: ${yamlScalar(v)}`;
-	let result = base;
-	if (additionalPaths && additionalPaths.length > 0) {
-		const pathsBlockRe = /( {4}paths:\n)((?:[ ]{6}- [^\n]+\n)+)/;
-		if (pathsBlockRe.test(result)) result = result.replace(pathsBlockRe, (_, header, existing) => {
-			const existingPaths = new Set([...existing.matchAll(/- (.+)/g)].map((m) => m[1]));
-			const newEntries = additionalPaths.filter((p) => !existingPaths.has(p)).map((p) => `      - ${p}\n`).join("");
-			return header + existing + newEntries;
-		});
-		else {
-			const pathsBlock = `    paths:\n${additionalPaths.map((p) => `      - ${p}\n`).join("")}`;
-			result = result.replace(/( {4}branches: \[main\]\n)/, `$1${pathsBlock}`);
-		}
-	}
-	if (!withOverrides || Object.keys(withOverrides).length === 0) return result;
-	const withBlockRe = /( {4}with:\n)((?:[ ]{6}[^\n]+\n)*)/;
-	const existingMatch = result.match(withBlockRe);
-	if (existingMatch) {
-		const existingEntries = new Map(existingMatch[2].split("\n").filter(Boolean).map((line) => {
-			const m = line.match(/^ {6}([^:]+):\s*(.*)/);
-			return m ? [m[1].trim(), m[2].trim()] : null;
-		}).filter((e) => e !== null));
-		for (const [k, v] of Object.entries(withOverrides)) existingEntries.set(k, yamlScalar(v));
-		const merged = [...existingEntries.entries()].map(([k, v]) => `      ${k}: ${v}`).join("\n");
-		return result.replace(withBlockRe, `    with:\n${merged}\n`);
-	}
-	const withBlock = Object.entries(withOverrides).map(([k, v]) => fmt(k, v)).join("\n");
-	const injected = result.replace(/ {4}secrets: inherit\n$/, `    with:\n${withBlock}\n    secrets: inherit\n`);
-	if (injected === result) console.warn(`[generateThinCallerContent] could not inject with: overrides into "${name}" template`);
-	return injected;
-}
-/**
-* Extract the Cloudflare Pages preview config from a deploy workflow's `with:` object.
-*
-* Accepts three forms:
-* - `preview: true` — derive both project and domain from org context
-* - `preview: { project: "..." }` — explicit project; domain derived from context if omitted
-* - `preview: { project: "...", domain: "..." }` — fully explicit
-*
-* Returns null when `preview:` is absent, false, or can't be resolved.
-*/
-function extractPreviewConfig(raw, ctx = {}) {
-	const preview = raw["preview"];
-	if (!preview) return null;
-	if (preview === true) {
-		const project = ctx.org ? `${ctx.org}-preview` : null;
-		const domain = ctx.domain ? `preview.${ctx.domain}` : void 0;
-		if (!project) return null;
-		return {
-			project,
-			...domain ? { domain } : {}
-		};
-	}
-	if (typeof preview !== "object") return null;
-	const p = preview;
-	const project = typeof p["project"] === "string" && p["project"] ? p["project"] : ctx.org ? `${ctx.org}-preview` : null;
-	if (!project) return null;
-	const domain = typeof p["domain"] === "string" && p["domain"] ? p["domain"] : ctx.domain ? `preview.${ctx.domain}` : void 0;
-	return {
-		project,
-		...domain ? { domain } : {}
-	};
-}
-/**
-* Generate the full thin-caller YAML for a `deploy.yml` that handles both
-* production (push to main → GitHub Pages) and preview (pull_request →
-* Cloudflare Pages) in a single file.
-*
-* Both jobs receive the same docs/storybook `with:` inputs. If the per-repo
-* config supplies `cloudflare-project` it is forwarded; otherwise the reusable
-* falls back to the `CLOUDFLARE_PAGES_PROJECT` org variable — set that once and
-* all repos with a `deploy` workflow get previews without per-repo config.
-*/
-function generateCombinedDeployContent(deployWith, paths, preview) {
-	const yamlScalar = (v) => {
-		if (v === true) return "true";
-		if (v === false) return "false";
-		const s = String(v);
-		return s.startsWith("[") || s.startsWith("{") ? `'${s}'` : s;
-	};
-	const withLines = (entries) => Object.entries(entries).map(([k, v]) => `      ${k}: ${yamlScalar(v)}`).join("\n");
-	const pathsBlock = paths.length > 0 ? `    paths:\n${paths.map((p) => `      - ${p}\n`).join("")}` : "";
-	const previewWith = {
-		...deployWith,
-		"cloudflare-project": preview.project
-	};
-	const deployWithBlock = Object.keys(deployWith).length > 0 ? `    with:\n${withLines(deployWith)}\n` : "";
-	const previewWithBlock = `    with:\n${withLines(previewWith)}\n`;
-	const cleanupWithBlock = `    with:\n      cloudflare-project: ${preview.project}`;
-	return [
-		`name: Deploy`,
-		``,
-		`on: # yamllint disable-line rule:truthy`,
-		`  push:`,
-		`    branches: [main]`,
-		...pathsBlock ? [`${pathsBlock}`] : [],
-		`  pull_request:`,
-		`    branches: [main]`,
-		`    types: [opened, synchronize, reopened, closed]`,
-		...pathsBlock ? [`${pathsBlock}`] : [],
-		`  workflow_dispatch:`,
-		``,
-		`concurrency:`,
-		`  group: $\{{ github.event_name == 'pull_request' && format('deploy-preview-{0}', github.event.pull_request.number) || 'pages' }}`,
-		`  cancel-in-progress: $\{{ github.event_name == 'pull_request' && github.event.action != 'closed' }}`,
-		``,
-		`permissions:`,
-		`  contents: read`,
-		`  deployments: write`,
-		`  pages: write`,
-		`  id-token: write`,
-		`  pull-requests: write`,
-		``,
-		`jobs:`,
-		`  deploy:`,
-		`    name: Deploy`,
-		`    if: \${{ github.event_name != 'pull_request' }}`,
-		`    uses: theholocron/.github/.github/workflows/deploy.yml@main`,
-		...deployWithBlock ? [deployWithBlock.trimEnd()] : [],
-		`    secrets: inherit`,
-		``,
-		`  preview:`,
-		`    name: Deploy Preview`,
-		`    if: \${{ github.event_name == 'pull_request' && github.event.action != 'closed' }}`,
-		`    uses: theholocron/.github/.github/workflows/deploy-preview.yml@main`,
-		previewWithBlock.trimEnd(),
-		`    secrets: inherit`,
-		``,
-		`  cleanup:`,
-		`    name: Clean up Preview`,
-		`    if: \${{ github.event_name == 'pull_request' && github.event.action == 'closed' }}`,
-		`    uses: theholocron/.github/.github/workflows/cleanup-preview.yml@main`,
-		cleanupWithBlock,
-		`    secrets: inherit`,
-		``
-	].join("\n");
-}
-/**
-* Expand structured with-values to flat GitHub Actions inputs before
-* generating the thin caller. Handles:
-*   - deploy shorthand: docs/storybook → type + storybook-projects
-*   - preview: stripped (handled separately via extractPreviewConfig)
-*   - run-chromatic object → run-chromatic: true + chromatic-projects
-*   - plain arrays → JSON-stringified for YAML scalar quoting
-*
-* Used by both `holocron setup` and `sync-workflow-templates`.
-*/
-function normalizeWorkflowWith(raw) {
-	const result = { ...raw };
-	delete result["preview"];
-	const hasDocs = raw["docs"] === true || raw["docs"] !== null && typeof raw["docs"] === "object";
-	const storybookProjects = raw["storybook"];
-	if (hasDocs) {
-		result["type"] = "docs";
-		delete result["docs"];
-	}
-	if (Array.isArray(storybookProjects)) {
-		if (!hasDocs) result["type"] = "storybook";
-		result["storybook-projects"] = JSON.stringify(storybookProjects.map(({ name, path = "." }) => ({
-			name,
-			workingDir: path
-		})));
-		delete result["storybook"];
-	}
-	const runChromatic = raw["run-chromatic"];
-	if (runChromatic !== null && typeof runChromatic === "object" && "projects" in runChromatic) {
-		result["run-chromatic"] = true;
-		const projects = runChromatic.projects.map((p) => ({
-			...p,
-			...Array.isArray(p.untraced) ? { untraced: p.untraced.join("\n") } : {}
-		}));
-		result["chromatic-projects"] = JSON.stringify(projects);
-	}
-	for (const [k, v] of Object.entries(result)) if (Array.isArray(v)) result[k] = JSON.stringify(v);
-	return result;
-}
-/**
-* Derive on.push.paths entries from the deploy with: shorthand.
-* Used by both `holocron setup` and `sync-workflow-templates`.
-*/
-function deriveDeployPaths(raw) {
-	const paths = [];
-	const docs = raw["docs"];
-	if (docs === true) {
-		paths.push("docs/**");
-		paths.push("astro.config.ts");
-		paths.push("pnpm-workspace.yaml");
-		paths.push("pnpm-lock.yaml");
-	} else if (docs !== null && typeof docs === "object" && "path" in docs) {
-		const p = docs.path;
-		if (p && p !== ".") paths.push(`${p}/**`);
-	}
-	const storybookProjects = raw["storybook"];
-	if (Array.isArray(storybookProjects)) for (const s of storybookProjects) {
-		const p = s.path || ".";
-		if (p === ".") {
-			paths.push("src/**");
-			paths.push(".storybook/**");
-		} else paths.push(`${p}/**`);
-	}
-	return paths;
-}
-//#endregion
-//#region src/commands/setup.ts
-/**
-* `holocron setup` — orchestrates per-capability setup actions across
-* every plugin loaded from `holocron.config.json`.
-*
-* Per CLAUDE.md soft-skip: each step is wrapped in a try/catch and
-* failures don't abort subsequent capabilities. The summary at the end
-* reports counts so the operator can see what worked + what didn't.
-*
-* Per the Standards: when `ctx.dryRun` is true, mutating calls are
-* replaced with "would" log lines. Read-only probes (e.g.,
-* `vault.list`) still run so the operator sees real state.
-*
-* The orchestrator knows about specific capability methods by name
-* (e.g., `source.enableVulnerabilityAlerts`). This deliberate coupling
-* makes the "what does setup do" contract explicit and concrete —
-* decoupling via a per-capability `setupSteps()` method would be more
-* extensible but pushes the same knowledge into N plugins instead of
-* one central place.
-*/
-function editorconfigContent() {
-	return [
-		workflowHeader("packages/cli/src/commands/setup.ts"),
-		`root = true`,
-		``,
-		`[*]`,
-		`end_of_line = lf`,
-		`charset = utf-8`,
-		`trim_trailing_whitespace = true`,
-		`insert_final_newline = true`,
-		`indent_style = tab`,
-		`indent_size = 4`,
-		``,
-		`[.gitattributes]`,
-		`indent_style = space`,
-		`indent_size = 2`,
-		``,
-		`[*.{json,yml,yaml}]`,
-		`indent_style = space`,
-		`indent_size = 2`,
-		``,
-		`[*.{md,mdx}]`,
-		`trim_trailing_whitespace = false`,
-		``,
-		`[.*{rc,ignore}]`,
-		`indent_style = space`,
-		`indent_size = 2`,
-		``
-	].join("\n");
-}
-const INDIVIDUAL_COMPONENTS_MARKER = "  individual_components:";
-function codecovComponentBlock(packages) {
-	if (packages.length === 0) return "\n    []\n";
-	return "\n" + packages.flatMap(({ slug }) => [
-		`    - component_id: ${slug}`,
-		`      name: "${slug}"`,
-		`      paths:`,
-		`        - packages/${slug}/**`,
-		``
-	]).join("\n");
-}
-function mergeCodecovComponents(existing, packages) {
-	const idx = existing.indexOf(INDIVIDUAL_COMPONENTS_MARKER);
-	if (idx === -1) return existing;
-	return existing.slice(0, idx + 24) + codecovComponentBlock(packages);
-}
-function codecovContent(packages) {
-	return [
-		scaffoldHeader(),
-		`codecov:`,
-		`  require_ci_to_pass: true`,
-		``,
-		`coverage:`,
-		`  precision: 2`,
-		`  round: down`,
-		`  status:`,
-		`    project:`,
-		`      default:`,
-		`        target: auto`,
-		`        threshold: 2%`,
-		`    patch:`,
-		`      default:`,
-		`        target: 80%`,
-		``,
-		`comment:`,
-		`  layout: "reach,diff,flags,components"`,
-		`  behavior: default`,
-		`  require_changes: true`,
-		``,
-		`component_management:`,
-		`  default_rules:`,
-		`    statuses:`,
-		`      - type: patch`,
-		`        target: 80%`,
-		`  individual_components:`
-	].join("\n") + codecovComponentBlock(packages);
-}
-async function readWorkspacePackages(repoRoot) {
-	const packagesDir = join(repoRoot, "packages");
-	const entries = await readdir(packagesDir, { withFileTypes: true }).catch(() => null);
-	if (!entries) return [];
-	const packages = [];
-	for (const entry of entries) {
-		if (!entry.isDirectory()) continue;
-		try {
-			const raw = await readFile(join(packagesDir, entry.name, "package.json"), "utf8");
-			const pkg = JSON.parse(raw);
-			if (typeof pkg.name === "string") packages.push({
-				slug: entry.name,
-				name: pkg.name
-			});
-		} catch {}
-	}
-	return packages.sort((a, b) => a.slug.localeCompare(b.slug));
-}
-const EDITORCONFIG_CHECKER_CONFIG = JSON.stringify({
-	Version: "v3.7.0",
-	Verbose: false,
-	Format: "",
-	Debug: false,
-	IgnoreDefaults: false,
-	SpacesAfterTabs: false,
-	NoColor: false,
-	Exclude: [
-		"(^|.+/)LICENSE$",
-		"^public/.*",
-		"\\.md$",
-		"\\.mdx$"
-	],
-	AllowedContentTypes: [],
-	PassedFiles: [],
-	Disable: {
-		EndOfLine: false,
-		Indentation: false,
-		InsertFinalNewline: false,
-		TrimTrailingWhitespace: false,
-		IndentSize: false,
-		MaxLineLength: false
-	}
-}, null, 2) + "\n";
-const ALEX_CONFIG = JSON.stringify({ allow: [
-	"dead",
-	"failure",
-	"failures",
-	"hook",
-	"hooks",
-	"husky",
-	"period"
-] }, null, 2) + "\n";
-function devmojiConfigContent() {
-	return [
-		`/* eslint-disable */`,
-		`// devmoji.config.cjs — generated by holocron setup, do not edit`,
-		`// https://github.com/folke/devmoji`,
-		`const { defineConfig } = require("@theholocron/devmoji-config");`,
-		`module.exports = defineConfig();`,
-		``
-	].join("\n");
-}
-function prepareCommitMsgHookContent() {
-	return [
-		`#!/bin/sh`,
-		``,
-		`NAME=$(git config user.name)`,
-		`EMAIL=$(git config user.email)`,
-		``,
-		`if [ -z "$NAME" ]; then`,
-		`\techo "empty git config user.name"`,
-		`\texit 1`,
-		`fi`,
-		``,
-		`if [ -z "$EMAIL" ]; then`,
-		`\techo "empty git config user.email"`,
-		`\texit 1`,
-		`fi`,
-		``,
-		`git interpret-trailers --if-exists doNothing --trailer \\`,
-		`\t"Signed-off-by: $NAME <$EMAIL>" \\`,
-		`\t--in-place "$1"`,
-		``,
-		`npx devmoji -e`,
-		``
-	].join("\n");
-}
-const CANONICAL_LABELS = [
-	{
-		name: "bug",
-		color: "d73a4a",
-		description: "Something isn't working"
-	},
-	{
-		name: "chore",
-		color: "ededed",
-		description: "Maintenance, no user-facing change"
-	},
-	{
-		name: "ci",
-		color: "0075ca",
-		description: "CI/CD pipeline changes"
-	},
-	{
-		name: "dependencies",
-		color: "0366d6",
-		description: "Dependency update"
-	},
-	{
-		name: "documentation",
-		color: "0075ca",
-		description: "Documentation only"
-	},
-	{
-		name: "duplicate",
-		color: "cfd3d7",
-		description: "Already reported"
-	},
-	{
-		name: "enhancement",
-		color: "a2eeef",
-		description: "New feature or request"
-	},
-	{
-		name: "good first issue",
-		color: "7057ff",
-		description: "Good for newcomers"
-	},
-	{
-		name: "help wanted",
-		color: "008672",
-		description: "Extra attention needed"
-	},
-	{
-		name: "invalid",
-		color: "e4e669",
-		description: "Doesn't seem right"
-	},
-	{
-		name: "performance",
-		color: "fbca04",
-		description: "Performance improvement"
-	},
-	{
-		name: "question",
-		color: "d876e3",
-		description: "Further information requested"
-	},
-	{
-		name: "refactor",
-		color: "cfd3d7",
-		description: "Code restructuring"
-	},
-	{
-		name: "released",
-		color: "ededed",
-		description: "Included in a release"
-	},
-	{
-		name: "test",
-		color: "bfd4f2",
-		description: "Test-related changes"
-	},
-	{
-		name: "triage",
-		color: "e4e669",
-		description: "Needs investigation"
-	},
-	{
-		name: "wontfix",
-		color: "ffffff",
-		description: "Won't be addressed"
-	}
-];
-const STALE_LABELS = [
-	"github_actions",
-	"javascript",
-	"autorelease: pending",
-	"autorelease: tagged",
-	"released on @alpha"
-];
-function labelerConfig() {
-	return [
-		workflowHeader("packages/cli/src/commands/setup.ts"),
-		`bug:`,
-		`  - '^fix'`,
-		``,
-		`chore:`,
-		`  - '^chore(?!\\(deps)'`,
-		``,
-		`ci:`,
-		`  - '^ci'`,
-		``,
-		`dependencies:`,
-		`  - '^chore\\(deps'`,
-		``,
-		`documentation:`,
-		`  - '^docs'`,
-		``,
-		`enhancement:`,
-		`  - '^feat'`,
-		``,
-		`performance:`,
-		`  - '^perf'`,
-		``,
-		`refactor:`,
-		`  - '^refactor'`,
-		``,
-		`test:`,
-		`  - '^test'`,
-		``
-	].join("\n");
-}
+//#region src/commands/setup/branch-protection.ts
 const RULESET_NAME = "holocron-default-branch";
-const BALANCED_REPO_SETTINGS = {
-	allow_squash_merge: true,
-	allow_merge_commit: false,
-	allow_rebase_merge: false,
-	allow_auto_merge: true,
-	allow_update_branch: true,
-	delete_branch_on_merge: true,
-	has_issues: true,
-	has_discussions: true,
-	has_projects: true,
-	has_wiki: false
-};
 function buildClassicProtectionPayload(requiredChecks = []) {
 	return {
 		required_status_checks: requiredChecks.length > 0 ? {
@@ -3969,6 +3905,278 @@ async function upsertBranchProtection(source, dryRun, requiredChecks) {
 		};
 	}
 }
+//#endregion
+//#region src/commands/setup/engineering.ts
+async function writeIfAbsent(filePath, content) {
+	try {
+		await access(filePath);
+		return false;
+	} catch {
+		await mkdir(dirname(filePath), { recursive: true });
+		await writeFile(filePath, content, "utf8");
+		return true;
+	}
+}
+async function installEngineeringStructure({ repoRoot }) {
+	const results = [];
+	const writes = [
+		[join(repoRoot, "docs/wiki/decisions/template.md"), DECISIONS_TEMPLATE],
+		[join(repoRoot, "docs/wiki/decisions/README.md"), DECISIONS_README],
+		[join(repoRoot, "docs/wiki/standards/README.md"), STANDARDS_README],
+		[join(repoRoot, "docs/wiki/specifications/README.md"), SPECIFICATIONS_README]
+	];
+	for (const [path, content] of writes) if (await writeIfAbsent(path, content)) results.push(path.replace(repoRoot + "/", ""));
+	return results.length > 0 ? `created: ${results.join(", ")}` : "all files already exist — nothing to write";
+}
+//#endregion
+//#region src/commands/setup/repo-settings.ts
+const BALANCED_REPO_SETTINGS = {
+	allow_squash_merge: true,
+	allow_merge_commit: false,
+	allow_rebase_merge: false,
+	allow_auto_merge: true,
+	allow_update_branch: true,
+	delete_branch_on_merge: true,
+	has_issues: true,
+	has_discussions: true,
+	has_projects: true,
+	has_wiki: false
+};
+//#endregion
+//#region src/commands/setup/run-step.ts
+async function runStep(capability, step, dryRun, body, opts = {}) {
+	if (dryRun) return {
+		capability,
+		step,
+		status: "dry-run"
+	};
+	try {
+		const note = await body();
+		const result = {
+			capability,
+			step,
+			status: "ok"
+		};
+		if (typeof note === "string") result.message = note;
+		return result;
+	} catch (err) {
+		if (err instanceof ProviderApiError$1) {
+			if (err.status !== void 0 && opts.skipCodes?.includes(err.status)) return {
+				capability,
+				step,
+				status: "skip",
+				message: err.message
+			};
+			if (err.status === 403) {
+				const reason = classify403(err);
+				return {
+					capability,
+					step,
+					status: reason === "plan" ? "skip" : "fail",
+					message: err.message,
+					reason
+				};
+			}
+		}
+		return {
+			capability,
+			step,
+			status: "fail",
+			message: err instanceof Error ? err.message : String(err)
+		};
+	}
+}
+function classify403(err) {
+	const detailText = typeof err.details === "string" ? err.details : typeof err.details === "object" && err.details !== null && "message" in err.details ? String(err.details.message) : "";
+	const text = `${err.message} ${detailText}`.toLowerCase();
+	if (text.includes("advanced security") || text.includes("not enabled for this repository") || text.includes("upgrade") || text.includes("not available on")) return "plan";
+	return "permissions";
+}
+function formatStep(step) {
+	const tag = step.reason === "permissions" ? " [permissions]" : step.reason === "plan" ? " [plan restriction]" : "";
+	const detail = step.message ? style.dim(`  (${step.message})`) : "";
+	const label = `${step.step}${tag}${detail}`;
+	if (step.status === "ok") return `    ${style.success(label)}`;
+	if (step.status === "fail") return `    ${style.fail(label)}`;
+	if (step.status === "dry-run") return `    ${style.dim(`… ${label}`)}`;
+	return `    ${style.dim(`· ${label}`)}`;
+}
+//#endregion
+//#region src/commands/setup/skills.ts
+async function fetchExternalSkill(entry) {
+	if (entry.sourceType !== "github")
+ /* c8 ignore next */
+	throw new Error(`unsupported sourceType: ${entry.sourceType}`);
+	const url = `https://raw.githubusercontent.com/${entry.source}/HEAD/${entry.skillPath}`;
+	const res = await fetch(url);
+	if (!res.ok) throw new Error(`HTTP ${res.status} fetching ${url}`);
+	const content = await res.text();
+	return {
+		content,
+		stale: !!entry.computedHash && createHash("sha256").update(content).digest("hex") !== entry.computedHash
+	};
+}
+const AGENTS_SKILLS_ROOT = ".agents/skills";
+/** Relative path of the agent-specific symlink. undefined = unsupported agent. */
+const AGENT_SYMLINK_PATHS = { claude: (name) => `.claude/skills/${name}` };
+const GITIGNORE_BLOCK_START = "# managed by holocron setup — skills";
+const GITIGNORE_BLOCK_END = "# end managed by holocron setup — skills";
+async function installSkills({ agent, skills, repoRoot }) {
+	const symlinkFn = AGENT_SYMLINK_PATHS[agent];
+	if (!symlinkFn) return `agent "${agent}" has no known skill install path — skipping`;
+	const require = createRequire(pathToFileURL(join(repoRoot, "package.json")));
+	let skillsRoot;
+	try {
+		skillsRoot = dirname(require.resolve("@theholocron/skills/package.json"));
+	} catch {
+		if (spawnSync("pnpm", [
+			"add",
+			"-D",
+			"@theholocron/skills"
+		], {
+			cwd: repoRoot,
+			stdio: "inherit"
+		}).status !== 0) throw new Error("failed to auto-install @theholocron/skills");
+		try {
+			skillsRoot = dirname(require.resolve("@theholocron/skills/package.json"));
+		} catch {
+			throw new Error("failed to auto-install @theholocron/skills");
+		}
+	}
+	const gitignorePath = join(repoRoot, ".gitignore");
+	const existingContent = await readFile(gitignorePath, "utf8").catch(() => "");
+	const previouslyInstalled = parsePreviousSkills(existingContent, symlinkFn);
+	const currentSet = new Set(skills);
+	const stale = previouslyInstalled.filter((n) => !currentSet.has(n));
+	for (const name of stale) {
+		await rm(join(repoRoot, symlinkFn(name)), { force: true }).catch(() => void 0);
+		await rm(join(repoRoot, AGENTS_SKILLS_ROOT, name), {
+			recursive: true,
+			force: true
+		}).catch(() => void 0);
+	}
+	const installed = [];
+	const missing = [];
+	for (const name of skills) {
+		const srcDir = join(skillsRoot, "src", name);
+		try {
+			await stat(srcDir);
+		} catch {
+			missing.push(name);
+			continue;
+		}
+		const agentsDir = join(repoRoot, AGENTS_SKILLS_ROOT, name);
+		await copyDirRecursive(srcDir, agentsDir);
+		const symlinkPath = join(repoRoot, symlinkFn(name));
+		await mkdir(dirname(symlinkPath), { recursive: true });
+		try {
+			await unlink(symlinkPath);
+		} catch {}
+		await symlink(relative(dirname(symlinkPath), agentsDir).replace(/\\/g, "/"), symlinkPath);
+		installed.push(name);
+	}
+	const externalFailed = [];
+	const externalStale = [];
+	if (missing.length > 0) {
+		let lock = null;
+		try {
+			lock = JSON.parse(await readFile(join(skillsRoot, "skills-lock.json"), "utf8"));
+		} catch {}
+		if (lock?.skills) for (const name of [...missing]) {
+			const entry = lock.skills[name];
+			if (!entry) continue;
+			try {
+				const { content, stale: isStale } = await fetchExternalSkill(entry);
+				const agentsDir = join(repoRoot, AGENTS_SKILLS_ROOT, name);
+				await mkdir(agentsDir, { recursive: true });
+				await writeFile(join(agentsDir, "SKILL.md"), content);
+				const symlinkPath = join(repoRoot, symlinkFn(name));
+				await mkdir(dirname(symlinkPath), { recursive: true });
+				try {
+					await unlink(symlinkPath);
+				} catch {}
+				await symlink(relative(dirname(symlinkPath), agentsDir).replace(/\\/g, "/"), symlinkPath);
+				missing.splice(missing.indexOf(name), 1);
+				installed.push(name);
+				if (isStale) externalStale.push(name);
+			} catch {
+				missing.splice(missing.indexOf(name), 1);
+				externalFailed.push(name);
+			}
+		}
+	}
+	if (installed.length > 0 || stale.length > 0 || missing.length > 0 || externalFailed.length > 0) await updateSkillsGitignore(gitignorePath, existingContent, [
+		...installed,
+		...missing,
+		...externalFailed
+	], symlinkFn);
+	const parts = [`installed ${installed.length}`];
+	if (stale.length > 0) parts.push(`pruned: ${stale.join(", ")}`);
+	if (externalStale.length > 0) parts.push(`stale: ${externalStale.join(", ")} (run \`holocron skills update\` to refresh)`);
+	if (externalFailed.length > 0) parts.push(`fetch failed: ${externalFailed.join(", ")}`);
+	if (missing.length > 0) parts.push(`unknown: ${missing.join(", ")}`);
+	return parts.join("; ");
+}
+function parsePreviousSkills(gitignoreContent, symlinkFn) {
+	if (!gitignoreContent.includes(GITIGNORE_BLOCK_START)) return [];
+	const startIdx = gitignoreContent.indexOf(GITIGNORE_BLOCK_START);
+	const endIdx = gitignoreContent.indexOf(GITIGNORE_BLOCK_END, startIdx);
+	const block = endIdx !== -1 ? gitignoreContent.slice(startIdx, endIdx) : gitignoreContent.slice(startIdx);
+	const placeholder = "__placeholder__";
+	const symlinkPrefix = `/${symlinkFn(placeholder)}`.replace(placeholder, "");
+	return block.split("\n").filter((line) => line.startsWith(symlinkPrefix)).map((line) => line.slice(symlinkPrefix.length));
+}
+async function copyDirRecursive(src, dest) {
+	await mkdir(dest, { recursive: true });
+	const entries = await readdir(src, { withFileTypes: true });
+	for (const entry of entries) {
+		const srcPath = join(src, entry.name);
+		const destPath = join(dest, entry.name);
+		if (entry.isDirectory()) await copyDirRecursive(srcPath, destPath);
+		else await copyFile(srcPath, destPath);
+	}
+}
+async function updateSkillsGitignore(gitignorePath, existingContent, skills, symlinkFn) {
+	const entries = [`/${AGENTS_SKILLS_ROOT}/`, ...skills.map((n) => `/${symlinkFn(n)}`)];
+	const block = [
+		GITIGNORE_BLOCK_START,
+		...entries,
+		GITIGNORE_BLOCK_END
+	].join("\n");
+	let content;
+	if (existingContent.includes(GITIGNORE_BLOCK_START)) {
+		const start = existingContent.indexOf(GITIGNORE_BLOCK_START);
+		const end = existingContent.indexOf(GITIGNORE_BLOCK_END, start);
+		const afterBlock = end !== -1 ? existingContent.slice(end + 40) : "\n";
+		content = existingContent.slice(0, start) + block + afterBlock;
+	} else content = (existingContent.trimEnd() ? existingContent.trimEnd() + "\n\n" : "") + block + "\n";
+	await writeFile(gitignorePath, content, "utf8");
+}
+//#endregion
+//#region src/commands/setup/run-setup.ts
+/**
+* `holocron setup` — orchestrates per-capability setup actions across
+* every plugin loaded from `holocron.config.json`.
+*
+* Per CLAUDE.md soft-skip: each step is wrapped in a try/catch and
+* failures don't abort subsequent capabilities. The summary at the end
+* reports counts so the operator can see what worked + what didn't.
+*
+* Per the Standards: when `ctx.dryRun` is true, mutating calls are
+* replaced with "would" log lines. Read-only probes (e.g.,
+* `vault.list`) still run so the operator sees real state.
+*
+* The orchestrator knows about specific capability methods by name
+* (e.g., `source.enableVulnerabilityAlerts`). This deliberate coupling
+* makes the "what does setup do" contract explicit and concrete —
+* decoupling via a per-capability `setupSteps()` method would be more
+* extensible but pushes the same knowledge into N plugins instead of
+* one central place.
+*/
+const { workflowHeader: workflowHeader$2 } = createHeader({
+	source: "packages/cli/src/commands/setup/run-setup.ts",
+	tool: "holocron setup"
+});
 async function runSetup(input) {
 	const print = input.print ?? ((line) => console.log(line));
 	const loader = input.loader ?? new PluginLoader(input.loaded.resolved, input.context);
@@ -4056,14 +4264,14 @@ async function runSetup(input) {
 				if (previewCfg) {
 					const paths = additionalPaths;
 					steps.push(await runStep("source", "write workflow deploy (with preview)", dryRun, async () => {
-						await source.writeWorkflowFile("deploy.yml", workflowHeader() + generateCombinedDeployContent(withOverrides, paths, previewCfg));
+						await source.writeWorkflowFile("deploy.yml", `${workflowHeader$2()}${generateCombinedDeployContent(withOverrides, paths, previewCfg)}`);
 					}));
 					print(formatStep(steps[steps.length - 1]));
 					continue;
 				}
 			}
 			steps.push(await runStep("source", `write workflow ${name}`, dryRun, async () => {
-				await source.writeWorkflowFile(`${name}.yml`, workflowHeader() + generateThinCallerContent(name, withOverrides, additionalPaths));
+				await source.writeWorkflowFile(`${name}.yml`, `${workflowHeader$2()}${generateThinCallerContent(name, withOverrides, additionalPaths)}`);
 			}));
 			print(formatStep(steps[steps.length - 1]));
 		}
@@ -4071,37 +4279,49 @@ async function runSetup(input) {
 	if (loader.has("source") && (config.workflows ?? []).map((e) => typeof e === "string" ? e : e.name).includes("bookkeeping")) {
 		const source = loader.get("source");
 		steps.push(await runStep("source", "write .github/labeler.yml", dryRun, async () => {
-			await source.writeRepoFile(".github/labeler.yml", labelerConfig());
+			await source.writeRepoFile(".github/labeler.yml", `${workflowHeader$2()}${labeler_default}`);
 		}));
 		print(formatStep(steps[steps.length - 1]));
 	}
 	if (loader.has("source") && effectivePreset !== "none") {
 		const source = loader.get("source");
 		steps.push(await runStep("source", "write .github/dependabot.yml", dryRun, async () => {
-			await source.writeRepoFile(".github/dependabot.yml", workflowHeader("packages/cli/src/commands/setup.ts") + dependabot_default);
+			await source.writeRepoFile(".github/dependabot.yml", `${workflowHeader$2()}${dependabot_default}`);
+		}));
+		print(formatStep(steps[steps.length - 1]));
+		steps.push(await runStep("source", "write .github/dco.yml", dryRun, async () => {
+			await source.writeRepoFile(".github/dco.yml", `${workflowHeader$2()}${dco_default}`);
 		}));
 		print(formatStep(steps[steps.length - 1]));
 	}
 	if (loader.has("source")) {
 		const source = loader.get("source");
+		steps.push(await runStep("source", "write .github/config.yml", dryRun, async () => {
+			await source.writeRepoFile(".github/config.yml", `${workflowHeader$2()}${config_default}`);
+		}));
+		print(formatStep(steps[steps.length - 1]));
 		steps.push(await runStep("source", "write .alexrc.json", dryRun, async () => {
-			await source.writeRepoFile(".alexrc.json", ALEX_CONFIG);
+			await source.writeRepoFile(".alexrc.json", createRcConfig());
+		}));
+		print(formatStep(steps[steps.length - 1]));
+		steps.push(await runStep("source", "write .alexignore", dryRun, async () => {
+			await source.writeRepoFile(".alexignore", createIgnoreConfig());
 		}));
 		print(formatStep(steps[steps.length - 1]));
 		steps.push(await runStep("source", "write .editorconfig", dryRun, async () => {
-			await source.writeRepoFile(".editorconfig", editorconfigContent());
+			await source.writeRepoFile(".editorconfig", createConfig$2());
 		}));
 		print(formatStep(steps[steps.length - 1]));
 		steps.push(await runStep("source", "write .editorconfig-checker.json", dryRun, async () => {
-			await source.writeRepoFile(".editorconfig-checker.json", EDITORCONFIG_CHECKER_CONFIG);
+			await source.writeRepoFile(".editorconfig-checker.json", createConfig$1());
 		}));
 		print(formatStep(steps[steps.length - 1]));
 		steps.push(await runStep("source", "write devmoji.config.cjs", dryRun, async () => {
-			await source.writeRepoFile("devmoji.config.cjs", devmojiConfigContent());
+			await source.writeRepoFile("devmoji.config.cjs", createConfig$3());
 		}));
 		print(formatStep(steps[steps.length - 1]));
 		steps.push(await runStep("source", "write .husky/prepare-commit-msg", dryRun, async () => {
-			await source.writeRepoFile(".husky/prepare-commit-msg", prepareCommitMsgHookContent());
+			await source.writeRepoFile(".husky/prepare-commit-msg", createConfig());
 		}));
 		print(formatStep(steps[steps.length - 1]));
 		{
@@ -4115,7 +4335,7 @@ async function runSetup(input) {
 				message: "no test workflow configured"
 			});
 			else steps.push(await runStep("source", "write codecov.yml", dryRun, async () => {
-				const content = existing != null ? mergeCodecovComponents(existing, packages) : codecovContent(packages);
+				const content = existing != null ? mergeCodecovComponents(existing, packages) : createConfig$4(packages);
 				await source.writeRepoFile("codecov.yml", content);
 				return packages.length > 0 ? `${packages.length} components` : "no components";
 			}));
@@ -4418,296 +4638,42 @@ async function runSetup(input) {
 	const summaryLine = `  ${summary.ok} ok, ${summary.fail} fail, ${summary.skip} skipped${dryRun ? `, ${summary.dryRun} would-do` : ""}`;
 	print(summary.fail > 0 ? style.fail(summaryLine.trim()) : style.success(summaryLine.trim()));
 	const skippedSteps = steps.filter((s) => s.status === "skip");
-	if (skippedSteps.length > 0) {
-		print("");
-		print(style.hint("  Skipped:"));
-		for (const s of skippedSteps)
- /* v8 ignore next -- all skip steps set message; empty fallback is defensive */
-		print(style.hint(`    · ${s.step}${s.message ? `  (${s.message})` : ""}`));
-	}
-	if (steps.some((s) => s.reason === "permissions")) {
-		print("");
-		print(style.warn("Some steps failed with 403 (insufficient token permissions)."));
-		print(style.hint("     Repo-scoped operations (rulesets, settings, workflows) require a"));
-		print(style.hint("     fine-grained PAT passed via --token or HOLOCRON_ADMIN_TOKEN:"));
-		print("");
-		print(style.hint("       · Administration          — read and write"));
-		print(style.hint("       · Code scanning alerts    — read and write"));
-		print(style.hint("       · Contents                — read and write"));
-		print(style.hint("       · Secret scanning alerts  — read and write"));
-		print(style.hint("       · Workflows               — read and write"));
-		print(style.hint("       · Metadata                — read (added automatically)"));
-		print("");
-		print(style.hint("     Org-scoped operations (teams, custom properties) require"));
-		print(style.hint("     HOLOCRON_ORG_TOKEN — a fine-grained PAT with resource owner set to the org:"));
-		print("");
-		print(style.hint("       · Administration          — read and write (repository permission)"));
-		print(style.hint("       · Members                 — read (organization permission)"));
-		print(style.hint("       · Organization custom properties — read and write (organization permission)"));
-		print(style.hint("       · Metadata                — read (repository permission, auto-included)"));
-		print("");
-		print(style.hint("     Create tokens at: https://github.com/settings/personal-access-tokens/new"));
-		print(style.hint("     Then re-run:      holocron setup --token <your-admin-pat>"));
-		print(style.hint("     Store org token:  HOLOCRON_ORG_TOKEN env var or keyring key github.org"));
-	}
-	return {
-		steps,
-		summary
-	};
-}
-/**
-* Fetch a single SKILL.md from its upstream GitHub source.
-* Verifies the SHA-256 hash when `computedHash` is present in the lock entry.
-*/
-async function fetchExternalSkill(entry) {
-	if (entry.sourceType !== "github") throw new Error(`unsupported sourceType: ${entry.sourceType}`);
-	const url = `https://raw.githubusercontent.com/${entry.source}/HEAD/${entry.skillPath}`;
-	const res = await fetch(url);
-	if (!res.ok) throw new Error(`HTTP ${res.status} fetching ${url}`);
-	const content = await res.text();
-	return {
-		content,
-		stale: !!entry.computedHash && createHash("sha256").update(content).digest("hex") !== entry.computedHash
-	};
-}
-const AGENTS_SKILLS_ROOT = ".agents/skills";
-/** Relative path of the agent-specific symlink. undefined = unsupported agent. */
-const AGENT_SYMLINK_PATHS = { claude: (name) => `.claude/skills/${name}` };
-const GITIGNORE_BLOCK_START = "# managed by holocron setup — skills";
-const GITIGNORE_BLOCK_END = "# end managed by holocron setup — skills";
-async function installSkills({ agent, skills, repoRoot }) {
-	const symlinkFn = AGENT_SYMLINK_PATHS[agent];
-	if (!symlinkFn) return `agent "${agent}" has no known skill install path — skipping`;
-	const require = createRequire(pathToFileURL(join(repoRoot, "package.json")));
-	let skillsRoot;
-	try {
-		skillsRoot = dirname(require.resolve("@theholocron/skills/package.json"));
-	} catch {
-		if (spawnSync("pnpm", [
-			"add",
-			"-D",
-			"@theholocron/skills"
-		], {
-			cwd: repoRoot,
-			stdio: "inherit"
-		}).status !== 0) throw new Error("failed to auto-install @theholocron/skills");
-		try {
-			skillsRoot = dirname(require.resolve("@theholocron/skills/package.json"));
-		} catch {
-			throw new Error("failed to auto-install @theholocron/skills");
-		}
-	}
-	const gitignorePath = join(repoRoot, ".gitignore");
-	const existingContent = await readFile(gitignorePath, "utf8").catch(() => "");
-	const previouslyInstalled = parsePreviousSkills(existingContent, symlinkFn);
-	const currentSet = new Set(skills);
-	const stale = previouslyInstalled.filter((n) => !currentSet.has(n));
-	for (const name of stale) {
-		await rm(join(repoRoot, symlinkFn(name)), { force: true }).catch(() => void 0);
-		await rm(join(repoRoot, AGENTS_SKILLS_ROOT, name), {
-			recursive: true,
-			force: true
-		}).catch(() => void 0);
-	}
-	const installed = [];
-	const missing = [];
-	for (const name of skills) {
-		const srcDir = join(skillsRoot, "src", name);
-		try {
-			await stat(srcDir);
-		} catch {
-			missing.push(name);
-			continue;
-		}
-		const agentsDir = join(repoRoot, AGENTS_SKILLS_ROOT, name);
-		await copyDirRecursive(srcDir, agentsDir);
-		const symlinkPath = join(repoRoot, symlinkFn(name));
-		await mkdir(dirname(symlinkPath), { recursive: true });
-		try {
-			await unlink(symlinkPath);
-		} catch {}
-		await symlink(relative(dirname(symlinkPath), agentsDir).replace(/\\/g, "/"), symlinkPath);
-		installed.push(name);
-	}
-	const externalFailed = [];
-	const externalStale = [];
-	if (missing.length > 0) {
-		let lock = null;
-		try {
-			lock = JSON.parse(await readFile(join(skillsRoot, "skills-lock.json"), "utf8"));
-		} catch {}
-		if (lock?.skills) for (const name of [...missing]) {
-			const entry = lock.skills[name];
-			if (!entry) continue;
-			try {
-				const { content, stale: isStale } = await fetchExternalSkill(entry);
-				const agentsDir = join(repoRoot, AGENTS_SKILLS_ROOT, name);
-				await mkdir(agentsDir, { recursive: true });
-				await writeFile(join(agentsDir, "SKILL.md"), content);
-				const symlinkPath = join(repoRoot, symlinkFn(name));
-				await mkdir(dirname(symlinkPath), { recursive: true });
-				try {
-					await unlink(symlinkPath);
-				} catch {}
-				await symlink(relative(dirname(symlinkPath), agentsDir).replace(/\\/g, "/"), symlinkPath);
-				missing.splice(missing.indexOf(name), 1);
-				installed.push(name);
-				if (isStale) externalStale.push(name);
-			} catch {
-				missing.splice(missing.indexOf(name), 1);
-				externalFailed.push(name);
-			}
-		}
-	}
-	if (installed.length > 0 || stale.length > 0 || missing.length > 0 || externalFailed.length > 0) await updateSkillsGitignore(gitignorePath, existingContent, [
-		...installed,
-		...missing,
-		...externalFailed
-	], symlinkFn);
-	const parts = [`installed ${installed.length}`];
-	if (stale.length > 0) parts.push(`pruned: ${stale.join(", ")}`);
-	if (externalStale.length > 0) parts.push(`stale: ${externalStale.join(", ")} (run \`holocron skills update\` to refresh)`);
-	if (externalFailed.length > 0) parts.push(`fetch failed: ${externalFailed.join(", ")}`);
-	if (missing.length > 0) parts.push(`unknown: ${missing.join(", ")}`);
-	return parts.join("; ");
-}
-/** Extract skill names from the previous gitignore block so stale dirs can be pruned. */
-function parsePreviousSkills(gitignoreContent, symlinkFn) {
-	if (!gitignoreContent.includes(GITIGNORE_BLOCK_START)) return [];
-	const startIdx = gitignoreContent.indexOf(GITIGNORE_BLOCK_START);
-	const endIdx = gitignoreContent.indexOf(GITIGNORE_BLOCK_END, startIdx);
-	const block = endIdx !== -1 ? gitignoreContent.slice(startIdx, endIdx) : gitignoreContent.slice(startIdx);
-	const placeholder = "__placeholder__";
-	const symlinkPrefix = `/${symlinkFn(placeholder)}`.replace(placeholder, "");
-	return block.split("\n").filter((line) => line.startsWith(symlinkPrefix)).map((line) => line.slice(symlinkPrefix.length));
-}
-async function copyDirRecursive(src, dest) {
-	await mkdir(dest, { recursive: true });
-	const entries = await readdir(src, { withFileTypes: true });
-	for (const entry of entries) {
-		const srcPath = join(src, entry.name);
-		const destPath = join(dest, entry.name);
-		if (entry.isDirectory()) await copyDirRecursive(srcPath, destPath);
-		else await copyFile(srcPath, destPath);
+	if (skippedSteps.length > 0) {
+		print("");
+		print(style.hint("  Skipped:"));
+		for (const s of skippedSteps)
+ /* v8 ignore next -- all skip steps set message; empty fallback is defensive */
+		print(style.hint(`    · ${s.step}${s.message ? `  (${s.message})` : ""}`));
 	}
-}
-async function updateSkillsGitignore(gitignorePath, existingContent, skills, symlinkFn) {
-	const entries = [`/${AGENTS_SKILLS_ROOT}/`, ...skills.map((n) => `/${symlinkFn(n)}`)];
-	const block = [
-		GITIGNORE_BLOCK_START,
-		...entries,
-		GITIGNORE_BLOCK_END
-	].join("\n");
-	let content;
-	if (existingContent.includes(GITIGNORE_BLOCK_START)) {
-		const start = existingContent.indexOf(GITIGNORE_BLOCK_START);
-		const end = existingContent.indexOf(GITIGNORE_BLOCK_END, start);
-		const afterBlock = end !== -1 ? existingContent.slice(end + 40) : "\n";
-		content = existingContent.slice(0, start) + block + afterBlock;
-	} else content = (existingContent.trimEnd() ? existingContent.trimEnd() + "\n\n" : "") + block + "\n";
-	await writeFile(gitignorePath, content, "utf8");
-}
-const AGENTS_PROMPTS_ROOT = ".agents/prompts";
-const PROMPTS_GITIGNORE_START = "# managed by holocron setup — prompts";
-const PROMPTS_GITIGNORE_END = "# end managed by holocron setup — prompts";
-async function installAgentPrompts({ repoRoot }) {
-	const promptsDir = join(repoRoot, AGENTS_PROMPTS_ROOT);
-	await mkdir(promptsDir, { recursive: true });
-	for (const [filename, content] of Object.entries(AGENT_PROMPTS)) await writeFile(join(promptsDir, filename), content, "utf8");
-	const gitignorePath = join(repoRoot, ".gitignore");
-	const existing = await readFile(gitignorePath, "utf8").catch(() => "");
-	const block = [
-		PROMPTS_GITIGNORE_START,
-		`/${AGENTS_PROMPTS_ROOT}/`,
-		PROMPTS_GITIGNORE_END
-	].join("\n");
-	let updated;
-	if (existing.includes(PROMPTS_GITIGNORE_START)) {
-		const start = existing.indexOf(PROMPTS_GITIGNORE_START);
-		const end = existing.indexOf(PROMPTS_GITIGNORE_END, start);
-		const afterBlock = end !== -1 ? existing.slice(end + 41) : "\n";
-		updated = existing.slice(0, start) + block + afterBlock;
-	} else updated = (existing.trimEnd() ? existing.trimEnd() + "\n\n" : "") + block + "\n";
-	await writeFile(gitignorePath, updated, "utf8");
-	return `wrote ${Object.keys(AGENT_PROMPTS).length} prompt files to ${AGENTS_PROMPTS_ROOT}/`;
-}
-async function writeIfAbsent(filePath, content) {
-	try {
-		await access(filePath);
-		return false;
-	} catch {
-		await mkdir(dirname(filePath), { recursive: true });
-		await writeFile(filePath, content, "utf8");
-		return true;
+	if (steps.some((s) => s.reason === "permissions")) {
+		print("");
+		print(style.warn("Some steps failed with 403 (insufficient token permissions)."));
+		print(style.hint("     Repo-scoped operations (rulesets, settings, workflows) require a"));
+		print(style.hint("     fine-grained PAT passed via --token or HOLOCRON_ADMIN_TOKEN:"));
+		print("");
+		print(style.hint("       · Administration          — read and write"));
+		print(style.hint("       · Code scanning alerts    — read and write"));
+		print(style.hint("       · Contents                — read and write"));
+		print(style.hint("       · Secret scanning alerts  — read and write"));
+		print(style.hint("       · Workflows               — read and write"));
+		print(style.hint("       · Metadata                — read (added automatically)"));
+		print("");
+		print(style.hint("     Org-scoped operations (teams, custom properties) require"));
+		print(style.hint("     HOLOCRON_ORG_TOKEN — a fine-grained PAT with resource owner set to the org:"));
+		print("");
+		print(style.hint("       · Administration          — read and write (repository permission)"));
+		print(style.hint("       · Members                 — read (organization permission)"));
+		print(style.hint("       · Organization custom properties — read and write (organization permission)"));
+		print(style.hint("       · Metadata                — read (repository permission, auto-included)"));
+		print("");
+		print(style.hint("     Create tokens at: https://github.com/settings/personal-access-tokens/new"));
+		print(style.hint("     Then re-run:      holocron setup --token <your-admin-pat>"));
+		print(style.hint("     Store org token:  HOLOCRON_ORG_TOKEN env var or keyring key github.org"));
 	}
-}
-async function installEngineeringStructure({ repoRoot }) {
-	const results = [];
-	const writes = [
-		[join(repoRoot, "docs/wiki/decisions/template.md"), DECISIONS_TEMPLATE],
-		[join(repoRoot, "docs/wiki/decisions/README.md"), DECISIONS_README],
-		[join(repoRoot, "docs/wiki/standards/README.md"), STANDARDS_README],
-		[join(repoRoot, "docs/wiki/specifications/README.md"), SPECIFICATIONS_README]
-	];
-	for (const [path, content] of writes) if (await writeIfAbsent(path, content)) results.push(path.replace(repoRoot + "/", ""));
-	return results.length > 0 ? `created: ${results.join(", ")}` : "all files already exist — nothing to write";
-}
-async function runStep(capability, step, dryRun, body, opts = {}) {
-	if (dryRun) return {
-		capability,
-		step,
-		status: "dry-run"
+	return {
+		steps,
+		summary
 	};
-	try {
-		const note = await body();
-		const result = {
-			capability,
-			step,
-			status: "ok"
-		};
-		if (typeof note === "string") result.message = note;
-		return result;
-	} catch (err) {
-		if (err instanceof ProviderApiError$1) {
-			if (err.status !== void 0 && opts.skipCodes?.includes(err.status)) return {
-				capability,
-				step,
-				status: "skip",
-				message: err.message
-			};
-			if (err.status === 403) {
-				const reason = classify403(err);
-				return {
-					capability,
-					step,
-					status: reason === "plan" ? "skip" : "fail",
-					message: err.message,
-					reason
-				};
-			}
-		}
-		return {
-			capability,
-			step,
-			status: "fail",
-			message: err instanceof Error ? err.message : String(err)
-		};
-	}
-}
-function classify403(err) {
-	const detailText = typeof err.details === "string" ? err.details : typeof err.details === "object" && err.details !== null && "message" in err.details ? String(err.details.message) : "";
-	const text = `${err.message} ${detailText}`.toLowerCase();
-	if (text.includes("advanced security") || text.includes("not enabled for this repository") || text.includes("upgrade") || text.includes("not available on")) return "plan";
-	return "permissions";
-}
-function formatStep(step) {
-	const tag = step.reason === "permissions" ? " [permissions]" : step.reason === "plan" ? " [plan restriction]" : "";
-	const detail = step.message ? style.dim(`  (${step.message})`) : "";
-	const label = `${step.step}${tag}${detail}`;
-	if (step.status === "ok") return `    ${style.success(label)}`;
-	if (step.status === "fail") return `    ${style.fail(label)}`;
-	if (step.status === "dry-run") return `    ${style.dim(`… ${label}`)}`;
-	return `    ${style.dim(`· ${label}`)}`;
 }
 //#endregion
 //#region src/commands/skills.ts
@@ -4914,7 +4880,193 @@ async function runSyncReadme(input) {
 	};
 }
 //#endregion
+//#region src/commands/sync-wiki.ts
+function resolveToken(input) {
+	return input.token ?? input.context.cliToken ?? process.env.HOLOCRON_READ_TOKEN ?? process.env.GH_TOKEN ?? process.env.GITHUB_TOKEN;
+}
+function deriveBasepath(domain, repoName) {
+	if (domain) {
+		const slashIdx = domain.indexOf("/");
+		if (slashIdx !== -1) return domain.slice(slashIdx + 1);
+	}
+	return repoName;
+}
+function titleCase(s) {
+	return s.charAt(0).toUpperCase() + s.slice(1);
+}
+function extractFromJson(raw, repoName) {
+	let config;
+	try {
+		config = JSON.parse(raw);
+	} catch {
+		return null;
+	}
+	const providers = config.providers;
+	if (!providers?.wiki) return null;
+	const wikiEntry = providers.wiki;
+	let domain;
+	let subtitle;
+	let icon;
+	if (Array.isArray(wikiEntry) && wikiEntry.length === 2) {
+		const opts = wikiEntry[1];
+		domain = typeof opts.domain === "string" ? opts.domain : void 0;
+		subtitle = typeof opts.subtitle === "string" ? opts.subtitle : void 0;
+		icon = typeof opts.icon === "string" ? opts.icon : void 0;
+	}
+	if (!subtitle && typeof config.description === "string") subtitle = config.description;
+	const basepath = deriveBasepath(domain, repoName);
+	return {
+		displayName: titleCase(basepath),
+		basepath,
+		...subtitle ? { subtitle } : {},
+		...icon ? { icon } : {}
+	};
+}
+function extractFromTs(raw, repoName) {
+	const hasWikiProvider = /providers\s*:\s*\{[^}]*\bwiki\b/s.test(raw);
+	const hasWikiPreset = /\bwikiCapability\b|\bwiki\s*\(\s*\)/.test(raw);
+	if (!hasWikiProvider && !hasWikiPreset) return null;
+	const domain = raw.match(/\bdomain\s*:\s*["']([^"']+)["']/)?.[1];
+	let subtitle = raw.match(/\bsubtitle\s*:\s*["']([^"']+)["']/)?.[1];
+	const icon = raw.match(/\bicon\s*:\s*["']([^"']+)["']/)?.[1];
+	if (!subtitle) subtitle = raw.match(/\bdescription\s*:\s*["']([^"']+)["']/)?.[1];
+	const basepath = deriveBasepath(domain, repoName);
+	return {
+		displayName: titleCase(basepath),
+		basepath,
+		...subtitle ? { subtitle } : {},
+		...icon ? { icon } : {}
+	};
+}
+async function discoverWikiProducts(org, token, fetchFn) {
+	const rest = createRestClient({
+		baseUrl: "https://api.github.com",
+		token,
+		extraHeaders: {
+			accept: "application/vnd.github+json",
+			"x-github-api-version": "2022-11-28"
+		},
+		vendor: "GitHub",
+		fetch: fetchFn
+	});
+	const allRepos = [];
+	let page = 1;
+	while (true) {
+		const batch = await rest.request(`/orgs/${org}/repos`, { query: {
+			per_page: "100",
+			page: String(page),
+			type: "all"
+		} });
+		allRepos.push(...batch);
+		if (batch.length < 100) break;
+		page++;
+	}
+	const products = [];
+	for (const repo of allRepos.filter((r) => !r.archived)) {
+		let product = null;
+		try {
+			const contents = await rest.request(`/repos/${repo.full_name}/contents/holocron.config.json`);
+			if (contents.encoding === "base64") product = extractFromJson(Buffer.from(contents.content.replace(/\s/g, ""), "base64").toString("utf8"), repo.name);
+		} catch {}
+		if (!product) try {
+			const contents = await rest.request(`/repos/${repo.full_name}/contents/holocron.config.ts`);
+			if (contents.encoding === "base64") product = extractFromTs(Buffer.from(contents.content.replace(/\s/g, ""), "base64").toString("utf8"), repo.name);
+		} catch {}
+		if (product) products.push(product);
+	}
+	products.sort((a, b) => a.basepath.localeCompare(b.basepath));
+	return products;
+}
+function buildProductsBlock(products) {
+	const lines = ["products:"];
+	for (const p of products) {
+		lines.push(`  - display-name: ${p.displayName}`);
+		if (p.subtitle) lines.push(`    subtitle: ${p.subtitle}`);
+		if (p.icon) lines.push(`    icon: ${p.icon}`);
+		lines.push(`    href: /${p.basepath}`);
+	}
+	return lines.join("\n");
+}
+async function mergeProducts(docsYmlPath, products) {
+	let content;
+	try {
+		content = await readFile(docsYmlPath, "utf8");
+	} catch {
+		throw new Error(`fern/docs.yml not found at ${docsYmlPath}`);
+	}
+	const newBlock = buildProductsBlock(products);
+	const productBlockRe = /^products:(?:\n[ \t][^\n]*)*/m;
+	if (productBlockRe.test(content)) {
+		const updated = content.replace(productBlockRe, newBlock);
+		if (updated !== content) await writeFile(docsYmlPath, updated, "utf8");
+		return;
+	}
+	const instancesIdx = content.indexOf("\ninstances:");
+	if (instancesIdx !== -1) {
+		await writeFile(docsYmlPath, content.slice(0, instancesIdx + 1) + newBlock + "\n\n" + content.slice(instancesIdx + 1), "utf8");
+		return;
+	}
+	await writeFile(docsYmlPath, content.trimEnd() + "\n\n" + newBlock + "\n", "utf8");
+}
+async function runSyncWiki(input) {
+	const config = input.loaded.resolved;
+	const dryRun = input.context.dryRun ?? false;
+	if (!config.providers.wiki) return {
+		capability: "local",
+		step: "sync wiki",
+		status: "skip",
+		message: "no wiki provider configured"
+	};
+	const org = config.org ?? input.context.repo?.split("/")[0];
+	if (!org) return {
+		capability: "local",
+		step: "sync wiki",
+		status: "skip",
+		message: "no org configured"
+	};
+	const token = resolveToken(input);
+	if (!token) return {
+		capability: "local",
+		step: "sync wiki",
+		status: "skip",
+		message: "no GitHub token available (set HOLOCRON_READ_TOKEN or GH_TOKEN)"
+	};
+	if (dryRun) return {
+		capability: "local",
+		step: "sync wiki",
+		status: "dry-run"
+	};
+	const docsYmlPath = join(input.context.repoRoot, "fern", "docs.yml");
+	try {
+		const products = await discoverWikiProducts(org, token, input.fetch);
+		if (products.length === 0) return {
+			capability: "local",
+			step: "sync wiki",
+			status: "skip",
+			message: "no wiki-enabled repos found"
+		};
+		await mergeProducts(docsYmlPath, products);
+		return {
+			capability: "local",
+			step: "sync wiki",
+			status: "ok",
+			message: `${products.length} products`
+		};
+	} catch (err) {
+		return {
+			capability: "local",
+			step: "sync wiki",
+			status: "fail",
+			message: err instanceof Error ? err.message : String(err)
+		};
+	}
+}
+//#endregion
 //#region src/commands/sync.ts
+const { workflowHeader: workflowHeader$1 } = createHeader({
+	source: "packages/cli/src/commands/sync.ts",
+	tool: "holocron sync"
+});
 const SYNC_STEPS = [
 	"labels",
 	"properties",
@@ -4924,14 +5076,16 @@ const SYNC_STEPS = [
 	"description",
 	"homepage",
 	"readme",
-	"workflows"
+	"workflows",
+	"wiki"
 ];
 const LOCAL_STEPS = /* @__PURE__ */ new Set([
 	"keywords",
 	"description",
 	"homepage",
 	"readme",
-	"workflows"
+	"workflows",
+	"wiki"
 ]);
 async function runSync(input) {
 	const print = input.print ?? ((line) => console.log(line));
@@ -5071,7 +5225,8 @@ async function runSync(input) {
 		"description",
 		"homepage",
 		"readme",
-		"workflows"
+		"workflows",
+		"wiki"
 	]) {
 		if (requestedSteps !== void 0 && !requestedSteps.includes(stepName)) continue;
 		if (stepName === "keywords") {
@@ -5185,7 +5340,7 @@ async function runSync(input) {
 					});
 					if (previewCfg) {
 						steps.push(await runSyncStep("local", "sync workflow deploy (with preview)", dryRun, async () => {
-							const content = workflowHeader() + generateCombinedDeployContent(withOverrides, additionalPaths, previewCfg);
+							const content = `${workflowHeader$1()}${generateCombinedDeployContent(withOverrides, additionalPaths, previewCfg)}`;
 							await writeWorkflowFile(input.context.repoRoot, "deploy.yml", content);
 						}));
 						print(formatSyncStep(steps[steps.length - 1]));
@@ -5193,12 +5348,20 @@ async function runSync(input) {
 					}
 				}
 				steps.push(await runSyncStep("local", `sync workflow ${name}`, dryRun, async () => {
-					const content = workflowHeader() + generateThinCallerContent(name, withOverrides, additionalPaths);
+					const content = `${workflowHeader$1()}${generateThinCallerContent(name, withOverrides, additionalPaths)}`;
 					await writeWorkflowFile(input.context.repoRoot, `${name}.yml`, content);
 				}));
 				print(formatSyncStep(steps[steps.length - 1]));
 			}
 		}
+		if (stepName === "wiki") {
+			const result = await runSyncWiki({
+				loaded: input.loaded,
+				context: input.context
+			});
+			steps.push(result);
+			print(formatSyncStep(result));
+		}
 	}
 	const summary = steps.reduce((acc, s) => {
 		if (s.status === "ok") acc.ok += 1;
@@ -5310,47 +5473,41 @@ var audit_default = "name: Audit\n\non: # yamllint disable-line rule:truthy\n  w
 //#region src/templates/workflows/bookkeeping.yml
 var bookkeeping_default = "name: Bookkeeping\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      configuration-path:\n        description: Path to the labeler configuration file in the calling repo\n        type: string\n        required: false\n        default: .github/labeler.yml\n\njobs:\n  label:\n    name: Apply Labels\n    permissions:\n      contents: read\n      issues: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          sparse-checkout: ${{ inputs.configuration-path || '.github/labeler.yml' }}\n          sparse-checkout-cone-mode: false\n\n      - uses: github/issue-labeler@c1b0f9f52a63158c4adc09425e858e87b32e9685 # v3.4\n        if: ${{ github.event_name == 'pull_request' && hashFiles(inputs.configuration-path || '.github/labeler.yml') != '' }}\n        # v3.4 bundles Node 20; allow it to run under Actions' current default.\n        env:\n          ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true\n        with:\n          # Fall back to default path when triggered directly (not via workflow_call)\n          # because inputs.* defaults only apply on workflow_call events.\n          configuration-path: ${{ inputs.configuration-path || '.github/labeler.yml' }}\n          include-title: 1\n          include-body: 0\n          sync-labels: 1\n          enable-versioned-regex: 0\n          repo-token: ${{ github.token }}\n";
 //#endregion
-//#region src/templates/workflows/cleanup-preview.yml
-var cleanup_preview_default = "name: Clean up Preview\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      cloudflare-project:\n        description: >\n          Cloudflare Pages project name. Falls back to the CLOUDFLARE_PAGES_PROJECT\n          org variable when omitted.\n        required: false\n        type: string\n        default: \"\"\n\njobs:\n  cleanup:\n    name: Clean up Preview\n    runs-on: ubuntu-latest\n    permissions:\n      contents: read\n      deployments: write\n      pull-requests: write\n    steps:\n      - name: Delete Cloudflare Pages deployments for branch\n        if: ${{ inputs.cloudflare-project != '' || vars.CLOUDFLARE_PAGES_PROJECT != '' }}\n        env:\n          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}\n          CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}\n          PROJECT: ${{ inputs.cloudflare-project || vars.CLOUDFLARE_PAGES_PROJECT }}\n          BRANCH: ${{ github.event.repository.name }}-pr-${{ github.event.pull_request.number }}\n          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n        run: |\n          DEPLOYMENTS=$(curl -s \\\n            \"https://api.cloudflare.com/client/v4/accounts/${CLOUDFLARE_ACCOUNT_ID}/pages/projects/${PROJECT}/deployments\" \\\n            -H \"Authorization: Bearer ${CLOUDFLARE_API_TOKEN}\" \\\n            | jq -r --arg b \"$BRANCH\" \\\n              '.result[] | select(.deployment_trigger.metadata.branch == $b) | .id')\n\n          if [ -z \"$DEPLOYMENTS\" ]; then\n            echo \"No deployments found for branch ${BRANCH} — nothing to clean up.\"\n            exit 0\n          fi\n\n          for id in $DEPLOYMENTS; do\n            echo \"Deleting CF Pages deployment: $id\"\n            curl -s -X DELETE \\\n              \"https://api.cloudflare.com/client/v4/accounts/${CLOUDFLARE_ACCOUNT_ID}/pages/projects/${PROJECT}/deployments/${id}?force=true\" \\\n              -H \"Authorization: Bearer ${CLOUDFLARE_API_TOKEN}\" | jq -r 'if .success then \"  ✓ deleted\" else \"  ✗ \\(.errors[0].message)\" end'\n          done\n\n          # Mark the GitHub Deployment environment as inactive.\n          ENV_NAME=\"${PROJECT} (Preview)\"\n          gh api \"repos/${GITHUB_REPOSITORY}/deployments\" \\\n            | jq -r \".[] | select(.environment == \\\"${ENV_NAME}\\\") | .id\" \\\n            | while read -r deploy_id; do\n                gh api \"repos/${GITHUB_REPOSITORY}/deployments/${deploy_id}/statuses\" \\\n                  --method POST --field state=inactive 2>/dev/null || true\n              done\n";
-//#endregion
-//#region src/templates/workflows/codeql.yml
-var codeql_default = "name: CodeQL\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      language:\n        description: CodeQL language to analyze\n        type: string\n        required: false\n        default: javascript-typescript\n\njobs:\n  analyze:\n    name: Analyze (${{ inputs.language }})\n    permissions:\n      actions: read\n      contents: read\n      security-events: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 45\n    # Do not cancel in-progress security scans.\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0\n        name: Initialize CodeQL\n        with:\n          languages: ${{ inputs.language }}\n\n      - uses: github/codeql-action/autobuild@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0\n        name: Autobuild\n\n      - uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0\n        name: Analyze\n        with:\n          category: /language:${{ inputs.language }}\n";
-//#endregion
 //#region src/templates/workflows/dependencies.yml
 var dependencies_default = "name: Dependencies\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      merge-token:\n        description: >\n          Optional privileged token for auto-merge. Falls back to GITHUB_TOKEN.\n          Required when branch protection enforces required reviews — GITHUB_TOKEN\n          cannot approve its own PRs.\n        required: false\n\njobs:\n  dependabot:\n    name: Update the dependencies\n    permissions:\n      contents: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    if: github.event.pull_request.user.login == 'dependabot[bot]'\n    steps:\n      - uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0\n        name: Fetch Dependabot metadata\n        id: metadata\n\n      - run: gh pr merge --auto --squash \"$PR_URL\"\n        # --squash is intentional: repo protection sets allow_merge_commit: false,\n        # so --merge would fail on any repo using the standard preset.\n        name: Enable auto-merge for Dependabot PRs\n        if: steps.metadata.outputs.update-type == 'version-update:semver-patch'\n        env:\n          PR_URL: ${{ github.event.pull_request.html_url }}\n          GH_TOKEN: ${{ secrets.merge-token || github.token }}\n";
 //#endregion
 //#region src/templates/workflows/deploy.yml
 var deploy_default = "name: Deploy\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      type:\n        description: \"Type of deployment: docs or storybook\"\n        required: true\n        type: string\n      storybook-projects:\n        description: >\n          JSON array of { \"name\"?, \"workingDir\", \"outputDir\"? } objects for storybook deploys.\n          Each is built via `pnpm -C <workingDir> build:storybook`. If \"name\" is provided the\n          output is placed under `sandbox/<name>/`; omit \"name\" for single-repo deploys and the\n          output lands directly in `sandbox/`.\n        type: string\n        required: false\n        default: \"[]\"\n      build-script:\n        description: pnpm script that builds the Storybook static output (single storybook, type:storybook only)\n        type: string\n        required: false\n        default: build:storybook\n      output-dir:\n        description: Directory where Storybook writes its static output (single storybook, type:storybook only)\n        type: string\n        required: false\n        default: storybook-static\n\njobs:\n  deploy:\n    name: Deploy\n    runs-on: ubuntu-latest\n    permissions:\n      contents: read\n      pages: write\n      id-token: write\n    environment:\n      name: github-pages\n      url: ${{ steps.deployment.outputs.page_url }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - name: Build docs site\n        if: ${{ inputs.type == 'docs' }}\n        run: pnpm -C docs build\n\n      - name: Build Storybook projects\n        if: ${{ inputs.storybook-projects != '[]' }}\n        env:\n          PROJECTS: ${{ inputs.storybook-projects }}\n        run: |\n          echo \"$PROJECTS\" | jq -c '.[]' | while IFS= read -r project; do\n            workingDir=$(echo \"$project\" | jq -r '.workingDir')\n            pnpm -C \"$workingDir\" build:storybook\n          done\n\n      - name: Build Storybook\n        if: ${{ inputs.type == 'storybook' && inputs.storybook-projects == '[]' }}\n        env:\n          BUILD_SCRIPT: ${{ inputs.build-script }}\n        run: pnpm run \"$BUILD_SCRIPT\"\n\n      - name: Assemble site\n        env:\n          DEPLOY_TYPE: ${{ inputs.type }}\n          PROJECTS: ${{ inputs.storybook-projects }}\n          STORYBOOK_OUTPUT_DIR: ${{ inputs.output-dir }}\n        run: |\n          mkdir -p _site\n          if [ \"$DEPLOY_TYPE\" = \"docs\" ]; then\n            cp -r docs/dist/. _site/\n          fi\n          if [ \"$PROJECTS\" != \"[]\" ]; then\n            echo \"$PROJECTS\" | jq -c '.[]' | while IFS= read -r project; do\n              name=$(echo \"$project\" | jq -r '.name // \"\"')\n              workingDir=$(echo \"$project\" | jq -r '.workingDir')\n              outputDir=$(echo \"$project\" | jq -r '.outputDir // \"storybook-static\"')\n              if [ -n \"$name\" ]; then\n                target=\"_site/sandbox/${name}\"\n              else\n                target=\"_site/sandbox\"\n              fi\n              mkdir -p \"$target\"\n              cp -r \"${workingDir}/${outputDir}/.\" \"$target/\"\n            done\n          elif [ \"$DEPLOY_TYPE\" = \"storybook\" ]; then\n            mkdir -p _site/sandbox\n            cp -r \"${STORYBOOK_OUTPUT_DIR}/.\" _site/sandbox/\n          fi\n\n      - uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1\n        name: Upload pages artifact\n        with:\n          path: _site\n\n      - uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5\n        id: deployment\n        name: Deploy to GitHub Pages\n";
 //#endregion
-//#region src/templates/workflows/deploy-preview.yml
-var deploy_preview_default = "name: Deploy Preview\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      type:\n        description: \"Type of deployment: docs or storybook\"\n        required: true\n        type: string\n      name:\n        description: Repo name prefix used to filter the docs site package (<name>-site); omit to run pnpm -C docs build\n        required: false\n        type: string\n        default: \"\"\n      storybook-projects:\n        description: >\n          JSON array of { \"name\"?, \"workingDir\", \"outputDir\"? } objects for storybook deploys.\n          Each is built via `pnpm -C <workingDir> build:storybook`. If \"name\" is provided the\n          output is placed under `sandbox/<name>/`; omit \"name\" for single-repo deploys and the\n          output lands directly in `sandbox/`.\n        type: string\n        required: false\n        default: \"[]\"\n      build-script:\n        description: pnpm script that builds the Storybook static output (single storybook, type:storybook only)\n        type: string\n        required: false\n        default: build:storybook\n      output-dir:\n        description: Directory where Storybook writes its static output (single storybook, type:storybook only)\n        type: string\n        required: false\n        default: storybook-static\n      cloudflare-project:\n        description: >\n          Cloudflare Pages project name. Falls back to the CLOUDFLARE_PAGES_PROJECT\n          org variable when omitted — set that variable once and all repos get previews\n          without per-repo config.\n        required: false\n        type: string\n        default: \"\"\n\njobs:\n  deploy-preview:\n    name: Deploy Preview\n    runs-on: ubuntu-latest\n    permissions:\n      contents: read\n      deployments: write\n      pull-requests: write\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - name: Build docs site\n        if: ${{ inputs.type == 'docs' && inputs.name != '' }}\n        env:\n          SITE_NAME: ${{ inputs.name }}\n        run: pnpm --filter @theholocron/\"$SITE_NAME\"-site build\n\n      - name: Build docs site\n        if: ${{ inputs.type == 'docs' && inputs.name == '' }}\n        run: pnpm -C docs build\n\n      - name: Build Storybook projects\n        if: ${{ inputs.storybook-projects != '[]' }}\n        env:\n          PROJECTS: ${{ inputs.storybook-projects }}\n        run: |\n          echo \"$PROJECTS\" | jq -c '.[]' | while IFS= read -r project; do\n            workingDir=$(echo \"$project\" | jq -r '.workingDir')\n            pnpm -C \"$workingDir\" build:storybook\n          done\n\n      - name: Build Storybook\n        if: ${{ inputs.type == 'storybook' && inputs.storybook-projects == '[]' }}\n        env:\n          BUILD_SCRIPT: ${{ inputs.build-script }}\n        run: pnpm run \"$BUILD_SCRIPT\"\n\n      - name: Assemble site\n        env:\n          DEPLOY_TYPE: ${{ inputs.type }}\n          SITE_NAME: ${{ inputs.name }}\n          PROJECTS: ${{ inputs.storybook-projects }}\n          STORYBOOK_OUTPUT_DIR: ${{ inputs.output-dir }}\n        run: |\n          mkdir -p _site\n          if [ \"$DEPLOY_TYPE\" = \"docs\" ]; then\n            if [ -n \"$SITE_NAME\" ]; then\n              # Site built with base: /<name>/ — nest under _site/<name>/ so asset\n              # paths match (/name/_astro/... → served at /name/_astro/...).\n              mkdir -p \"_site/${SITE_NAME}\"\n              cp -r docs/dist/. \"_site/${SITE_NAME}/\"\n              # Redirect root to the base path so the preview URL lands correctly.\n              printf \"/ /%s/ 301\\n\" \"$SITE_NAME\" > _site/_redirects\n            else\n              cp -r docs/dist/. _site/\n            fi\n          fi\n          if [ \"$PROJECTS\" != \"[]\" ]; then\n            echo \"$PROJECTS\" | jq -c '.[]' | while IFS= read -r project; do\n              name=$(echo \"$project\" | jq -r '.name // \"\"')\n              workingDir=$(echo \"$project\" | jq -r '.workingDir')\n              outputDir=$(echo \"$project\" | jq -r '.outputDir // \"storybook-static\"')\n              if [ -n \"$name\" ]; then\n                target=\"_site/sandbox/${name}\"\n              else\n                target=\"_site/sandbox\"\n              fi\n              mkdir -p \"$target\"\n              cp -r \"${workingDir}/${outputDir}/.\" \"$target/\"\n            done\n          elif [ \"$DEPLOY_TYPE\" = \"storybook\" ]; then\n            mkdir -p _site/sandbox\n            cp -r \"${STORYBOOK_OUTPUT_DIR}/.\" _site/sandbox/\n          fi\n\n      - name: Install Wrangler\n        # The action's install step runs npm/pnpm in the repo root; pnpm fails\n        # because it rejects adding to a workspace root without -w, and npm fails\n        # because package.json contains pnpm catalog: references it cannot parse.\n        # Pre-installing from /tmp (no package.json) lets the action find wrangler\n        # already on PATH and skip its own install entirely.\n        working-directory: /tmp\n        run: npm install -g wrangler@4\n\n      - uses: cloudflare/wrangler-action@ebbaa1584979971c8614a24965b4405ff95890e0 # v4.0.0\n        id: deploy\n        name: Deploy to Cloudflare Pages\n        # Skip when neither the per-repo input nor the org variable is set.\n        if: ${{ inputs.cloudflare-project != '' || vars.CLOUDFLARE_PAGES_PROJECT != '' }}\n        with:\n          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}\n          accountId: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}\n          packageManager: npm\n          command: >-\n            pages deploy _site\n            --project-name ${{ inputs.cloudflare-project || vars.CLOUDFLARE_PAGES_PROJECT }}\n            --branch ${{ github.event.repository.name }}-pr-${{ github.event.pull_request.number }}\n            --commit-dirty=true\n\n      - name: Report preview URL\n        if: ${{ steps.deploy.outputs.pages-deployment-alias-url != '' }}\n        env:\n          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n          ALIAS: ${{ steps.deploy.outputs.pages-deployment-alias-url }}\n          SITE_NAME: ${{ inputs.name }}\n          PROJECT: ${{ inputs.cloudflare-project || vars.CLOUDFLARE_PAGES_PROJECT }}\n        run: |\n          PREVIEW_URL=\"${ALIAS%/}${SITE_NAME:+/${SITE_NAME}}/\"\n          # GITHUB_HEAD_REF is the PR branch name — links the deployment to this PR's sidebar widget.\n          PAYLOAD=$(printf '{\"ref\":\"%s\",\"environment\":\"%s\",\"description\":\"Cloudflare Pages\",\"production_environment\":false,\"auto_merge\":false,\"required_contexts\":[]}' \\\n            \"$GITHUB_HEAD_REF\" \"${PROJECT} (Preview)\")\n          DEPLOY_ID=$(echo \"$PAYLOAD\" | gh api \"repos/${GITHUB_REPOSITORY}/deployments\" \\\n            --method POST --input - | jq -r '.id')\n          gh api \"repos/${GITHUB_REPOSITORY}/deployments/${DEPLOY_ID}/statuses\" \\\n            --method POST --field state=success --field environment_url=\"${PREVIEW_URL}\"\n";
-//#endregion
 //#region src/templates/workflows/greetings.yml
 var greetings_default = "name: Greetings\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n\njobs:\n  greeting:\n    name: Greet first-time contributors\n    permissions:\n      issues: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    # Group by the issue/PR number so duplicate events don't race each other.\n    steps:\n      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n        name: Greet on first contribution\n        with:\n          script: |\n            // Only greet on the initial open — ignore synchronize, reopened, etc.\n            if (context.payload.action !== 'opened') return;\n\n            const actor = context.actor;\n            const { owner, repo } = context.repo;\n\n            // Payload inspection is more reliable than context.eventName for detecting\n            // whether this is an issue vs. PR event — works regardless of how GitHub\n            // propagates event names through workflow_call chains.\n            const isIssue = !!context.payload.issue && !context.payload.pull_request;\n            // listForRepo returns both issues and PRs (GitHub treats PRs as issues),\n            // sorted newest-first. Filter by type to track first-issue and first-PR\n            // independently, and avoid search-index eventual-consistency lag.\n            const { data: recent } = await github.rest.issues.listForRepo({\n              owner, repo,\n              creator: actor,\n              state: 'all',\n              per_page: 100\n            });\n\n            const sameType = recent.filter(item =>\n              isIssue ? !item.pull_request : !!item.pull_request\n            );\n\n            if (sameType.length !== 1) return;\n            const body = isIssue\n              ? `Hey @${actor}!\\n\\nWe really appreciate you taking the time to report an issue. The collaborators on this project attempt to help as many people as possible, but we are a limited number of volunteers, so it is possible that this will not be addressed as swiftly.\\n\\nYour patience is much appreciated and we will get back to you as quickly as possible.`\n              : `Hey @${actor}!\\n\\nWe really appreciate you taking the time to help out with this PR. The collaborators on this project attempt to help as many people as possible, but we are a limited number of volunteers, so it is possible that this will not be addressed as swiftly.\\n\\nYour patience is much appreciated and we will get back to you as quickly as possible.`;\n\n            await github.rest.issues.createComment({\n              owner,\n              repo,\n              issue_number: context.issue.number,\n              body\n            });\n";
 //#endregion
 //#region src/templates/workflows/lint.yml
 var lint_default = "name: Lint\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      eslint-config:\n        description: >\n          Filename for the ESLint flat config used by super-linter for\n          JavaScript, JSX, TSX, and TypeScript (ES) files. Defaults to\n          eslint.config.ts (the org standard). Note: ESLint 9 requires\n          --flag unstable_ts_config to load .ts configs; if super-linter\n          cannot load it, override with eslint.config.mjs or eslint.config.js.\n        type: string\n        required: false\n        default: eslint.config.ts\n      prettier-config:\n        description: >\n          Filename for the Prettier config. Defaults to prettier.config.ts\n          (the org standard). Prettier 3.x loads .ts configs natively.\n        type: string\n        required: false\n        default: prettier.config.ts\n      yaml-config:\n        description: >\n          Filename for the yamllint config. Defaults to yamllint.config.yml.\n        type: string\n        required: false\n        default: yamllint.config.yml\n      enable-auto-commit:\n        description: >\n          Auto-commit super-linter fixes as a verified commit via a GitHub App.\n          Requires SUPER_LINTER_APP_ID and SUPER_LINTER_PRIVATE_KEY secrets.\n        type: boolean\n        required: false\n        default: false\n    secrets:\n      SUPER_LINTER_APP_ID:\n        required: false\n      SUPER_LINTER_PRIVATE_KEY:\n        required: false\n\njobs:\n  super-lint:\n    name: Lint entire codebase\n    permissions:\n      contents: write\n      issues: write\n      statuses: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    env:\n      APP_ID_SET: ${{ secrets.SUPER_LINTER_APP_ID != '' }}\n    steps:\n      - name: Generate GitHub App token\n        id: app-token\n        # Runs before checkout so the token is used as the checkout credential,\n        # which makes the subsequent push go through the App and produce a\n        # Verified commit. Skipped when auto-commit is disabled or secrets unset.\n        if: >\n          inputs.enable-auto-commit == true &&\n          github.event.pull_request != null &&\n          github.event.pull_request.head.repo.full_name == github.repository &&\n          github.ref_name != github.event.repository.default_branch &&\n          env.APP_ID_SET == 'true'\n        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0\n        with:\n          app-id: ${{ secrets.SUPER_LINTER_APP_ID }}\n          private-key: ${{ secrets.SUPER_LINTER_PRIVATE_KEY }}\n\n      - name: Resolve App bot identity\n        id: app-bot\n        # GitHub marks commits as Verified when the author email matches the\n        # App bot's noreply address (<numeric-id>+<slug>[bot]@users.noreply.github.com).\n        # The numeric ID must be fetched via the API — it differs from the App ID.\n        # app-slug is passed via env rather than interpolated into the script to\n        # prevent code injection (CWE-78).\n        if: steps.app-token.conclusion == 'success'\n        run: |\n          BOT_SLUG=\"${APP_SLUG}[bot]\"\n          BOT_ID=$(gh api \"/users/${BOT_SLUG}\" --jq .id)\n          echo \"name=${BOT_SLUG}\" >> \"$GITHUB_OUTPUT\"\n          echo \"email=${BOT_ID}+${BOT_SLUG}@users.noreply.github.com\" >> \"$GITHUB_OUTPUT\"\n        env:\n          GH_TOKEN: ${{ steps.app-token.outputs.token }}\n          APP_SLUG: ${{ steps.app-token.outputs.app-slug }}\n\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n          # Use the App token when available so the push credential is the App\n          # bot — GitHub marks those commits as Verified automatically.\n          token: ${{ steps.app-token.outputs.token || github.token }}\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n        if: ${{ hashFiles('pnpm-lock.yaml') != '' }}\n\n      - name: Detect project features\n        # Writes VALIDATE_*/FIX_* to GITHUB_ENV only when the feature exists.\n        # Also writes step outputs for values referenced in expression context\n        # (GITHUB_ENV is not readable via steps.*.outputs — they need GITHUB_OUTPUT).\n        # All values written are hardcoded 'true' — no user input in the script.\n        # Config file paths (inputs.*) stay in GH Actions expression context in\n        # the super-linter env: block below, never shell-evaluated (CWE-78).\n        id: detect\n        run: |\n          has() { find . -not -path '*/node_modules/*' -name \"$1\" -print -quit 2>/dev/null | grep -q .; }\n\n          if { has 'eslint.config.ts' || has 'eslint.config.mjs' || has 'eslint.config.js' || has '.eslintrc.json' || has '.eslintrc.yml'; }; then\n            {\n              echo \"VALIDATE_JAVASCRIPT_ES=true\"\n              echo \"VALIDATE_TYPESCRIPT_ES=true\"\n            } >> \"$GITHUB_ENV\"\n            echo \"eslint=true\" >> \"$GITHUB_OUTPUT\"\n          fi\n\n          if { has '*.js' || has '*.jsx' || has '*.mjs' || has '*.cjs' || has '*.ts' || has '*.tsx'; }; then\n            {\n              echo \"VALIDATE_JAVASCRIPT_PRETTIER=true\"\n              echo \"VALIDATE_JSX_PRETTIER=true\"\n              echo \"VALIDATE_TYPESCRIPT_PRETTIER=true\"\n              echo \"VALIDATE_TSX=true\"\n              echo \"FIX_JAVASCRIPT_PRETTIER=true\"\n              echo \"FIX_JSX_PRETTIER=true\"\n              echo \"FIX_TYPESCRIPT_PRETTIER=true\"\n              echo \"FIX_TSX=true\"\n            } >> \"$GITHUB_ENV\"\n          fi\n\n          if { has '*.css' || has '*.scss' || has 'stylelint.config.ts' || has 'stylelint.config.mjs' || has 'stylelint.config.js'; }; then\n            {\n              echo \"VALIDATE_CSS=true\"\n              echo \"STYLELINT_CONFIG_FILE=stylelint.config.ts\"\n            } >> \"$GITHUB_ENV\"\n          fi\n\n          if { has '*.graphql' || has '*.gql'; }; then\n            {\n              echo \"VALIDATE_GRAPHQL_PRETTIER=true\"\n              echo \"FIX_GRAPHQL_PRETTIER=true\"\n            } >> \"$GITHUB_ENV\"\n          fi\n\n          if { has '*.html' || has '*.htm'; }; then\n            {\n              echo \"VALIDATE_HTML_PRETTIER=true\"\n              echo \"FIX_HTML_PRETTIER=true\"\n            } >> \"$GITHUB_ENV\"\n          fi\n\n          if { has '.env' || has '.env.example' || has '.env.local'; }; then\n            {\n              echo \"VALIDATE_ENV=true\"\n              echo \"FIX_ENV=true\"\n            } >> \"$GITHUB_ENV\"\n          fi\n\n          if { has 'Dockerfile' || has '*.Dockerfile'; }; then\n            echo \"VALIDATE_DOCKERFILE=true\" >> \"$GITHUB_ENV\"\n          fi\n\n      - uses: super-linter/super-linter/slim@4ce20838b8ab83717e78138c5b3a1407148e0918 # v8.7.0\n        name: Run Super Linter\n        env:\n          GITHUB_TOKEN: ${{ github.token }}\n          DEFAULT_BRANCH: ${{ github.event.pull_request.base.ref || github.event.repository.default_branch }}\n          ANNOTATE_ONLY: true\n          DISABLE_COMMENTS: false\n          IGNORE_GITIGNORED_FILES: true\n          LINTER_RULES_PATH: /\n          EDITORCONFIG_FILE_NAME: \".editorconfig-checker.json\"\n          # Config file paths — inputs stay in expression context, never shell-evaluated.\n          # When VALIDATE_JAVASCRIPT_ES is not set by detect, ESLint doesn't run so\n          # the empty-string fallback (→ eslint.config.mjs in container) is safe.\n          JAVASCRIPT_ES_CONFIG_FILE: ${{ steps.detect.outputs.eslint == 'true' && inputs.eslint-config || '' }}\n          TYPESCRIPT_ES_CONFIG_FILE: ${{ steps.detect.outputs.eslint == 'true' && inputs.eslint-config || '' }}\n          PRETTIER_CONFIG: ${{ inputs.prettier-config }}\n          YAML_CONFIG_FILE: ${{ inputs.yaml-config }}\n          # Always-on linters\n          FIX_MARKDOWN_PRETTIER: true\n          VALIDATE_EDITORCONFIG: true\n          VALIDATE_GIT_COMMITLINT: true\n          VALIDATE_GIT_MERGE_CONFLICT_MARKERS: true\n          VALIDATE_GITHUB_ACTIONS: true\n          VALIDATE_GITLEAKS: true\n          VALIDATE_MARKDOWN_PRETTIER: true\n          VALIDATE_YAML: true\n\n      - name: Validate ADR and spec frontmatter\n        if: hashFiles('scripts/validate-adrs.mjs') != ''\n        run: |\n          mapfile -t changed < <(git diff --name-only \"$BASE_SHA\" HEAD -- \\\n            'docs/decisions/*.md' '.notes/*.spec.md' 2>/dev/null || true)\n          if [ \"${#changed[@]}\" -eq 0 ]; then\n            node scripts/validate-adrs.mjs\n          else\n            node scripts/validate-adrs.mjs \"${changed[@]}\"\n          fi\n        env:\n          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}\n\n      - name: Validate registry consistency\n        if: hashFiles('scripts/validate-registry.mjs') != ''\n        run: node scripts/validate-registry.mjs\n\n      - name: Validate docs presence for new packages\n        if: hashFiles('scripts/validate-docs-presence.mjs') != ''\n        run: node scripts/validate-docs-presence.mjs\n        env:\n          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}\n\n      - uses: theholocron/.github/.github/actions/auto-commit@main\n        name: Commit and push linting fixes\n        if: >\n          inputs.enable-auto-commit == true &&\n          github.event.pull_request != null &&\n          github.event.pull_request.head.repo.full_name == github.repository &&\n          github.ref_name != github.event.repository.default_branch &&\n          env.APP_ID_SET == 'true'\n        with:\n          token: ${{ steps.app-token.outputs.token }}\n          branch: ${{ github.event.pull_request.head.ref || github.head_ref || github.ref }}\n          commit-message: \"chore: fix linting issues\\n\\nSigned-off-by: ${{ steps.app-bot.outputs.name }} <${{ steps.app-bot.outputs.email }}>\"\n          commit-options: \"--no-verify\"\n          commit-user-name: ${{ steps.app-bot.outputs.name }}\n          commit-user-email: ${{ steps.app-bot.outputs.email }}\n          commit-author: \"${{ steps.app-bot.outputs.name }} <${{ steps.app-bot.outputs.email }}>\"\n\n\n  conclusion:\n    name: Conclusion\n    runs-on: ubuntu-latest\n    if: always()\n    needs: [super-lint]\n    steps:\n      - name: Check job statuses\n        run: |\n          if [[ \"$RESULTS\" == *\"failure\"* ]] || [[ \"$RESULTS\" == *\"cancelled\"* ]]; then\n            exit 1\n          fi\n        env:\n          RESULTS: ${{ join(needs.*.result, ',') }}\n";
 //#endregion
-//#region src/templates/workflows/post-release.yml
-var post_release_default = "name: Post-release Sync\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      HOLOCRON_SYNC_TOKEN:\n        required: false\n      GH_TOKEN:\n        description: >\n          Generic GitHub token fallback for gh CLI calls. Used when\n          HOLOCRON_SYNC_TOKEN is not set.\n        required: false\n\njobs:\n  broadcast:\n    name: Broadcast readme sync\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    steps:\n      - name: Trigger broadcast readme sync\n        run: |\n          gh workflow run sync-broadcast.yml \\\n            --repo theholocron/.github \\\n            --field \"steps=readme\"\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN }}\n";
+//#region src/templates/workflows/preview.yml
+var preview_default = "name: Preview\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      type:\n        description: \"Type of deployment: docs or storybook\"\n        required: true\n        type: string\n      name:\n        description: Repo name prefix used to filter the docs site package (<name>-site); omit to run pnpm -C docs build\n        required: false\n        type: string\n        default: \"\"\n      storybook-projects:\n        description: >\n          JSON array of { \"name\"?, \"workingDir\", \"outputDir\"? } objects for storybook deploys.\n          Each is built via `pnpm -C <workingDir> build:storybook`. If \"name\" is provided the\n          output is placed under `sandbox/<name>/`; omit \"name\" for single-repo deploys and the\n          output lands directly in `sandbox/`.\n        type: string\n        required: false\n        default: \"[]\"\n      build-script:\n        description: pnpm script that builds the Storybook static output (single storybook, type:storybook only)\n        type: string\n        required: false\n        default: build:storybook\n      output-dir:\n        description: Directory where Storybook writes its static output (single storybook, type:storybook only)\n        type: string\n        required: false\n        default: storybook-static\n      cloudflare-project:\n        description: >\n          Cloudflare Pages project name. Falls back to the CLOUDFLARE_PAGES_PROJECT\n          org variable when omitted — set that variable once and all repos get previews\n          without per-repo config.\n        required: false\n        type: string\n        default: \"\"\n\njobs:\n  deploy-preview:\n    name: Preview\n    if: ${{ github.event.action != 'closed' }}\n    runs-on: ubuntu-latest\n    permissions:\n      contents: read\n      deployments: write\n      pull-requests: write\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - name: Build docs site\n        if: ${{ inputs.type == 'docs' && inputs.name != '' }}\n        env:\n          SITE_NAME: ${{ inputs.name }}\n        run: pnpm --filter @theholocron/\"$SITE_NAME\"-site build\n\n      - name: Build docs site\n        if: ${{ inputs.type == 'docs' && inputs.name == '' }}\n        run: pnpm -C docs build\n\n      - name: Build Storybook projects\n        if: ${{ inputs.storybook-projects != '[]' }}\n        env:\n          PROJECTS: ${{ inputs.storybook-projects }}\n        run: |\n          echo \"$PROJECTS\" | jq -c '.[]' | while IFS= read -r project; do\n            workingDir=$(echo \"$project\" | jq -r '.workingDir')\n            pnpm -C \"$workingDir\" build:storybook\n          done\n\n      - name: Build Storybook\n        if: ${{ inputs.type == 'storybook' && inputs.storybook-projects == '[]' }}\n        env:\n          BUILD_SCRIPT: ${{ inputs.build-script }}\n        run: pnpm run \"$BUILD_SCRIPT\"\n\n      - name: Assemble site\n        env:\n          DEPLOY_TYPE: ${{ inputs.type }}\n          SITE_NAME: ${{ inputs.name }}\n          PROJECTS: ${{ inputs.storybook-projects }}\n          STORYBOOK_OUTPUT_DIR: ${{ inputs.output-dir }}\n        run: |\n          mkdir -p _site\n          if [ \"$DEPLOY_TYPE\" = \"docs\" ]; then\n            if [ -n \"$SITE_NAME\" ]; then\n              # Site built with base: /<name>/ — nest under _site/<name>/ so asset\n              # paths match (/name/_astro/... → served at /name/_astro/...).\n              mkdir -p \"_site/${SITE_NAME}\"\n              cp -r docs/dist/. \"_site/${SITE_NAME}/\"\n              # Redirect root to the base path so the preview URL lands correctly.\n              printf \"/ /%s/ 301\\n\" \"$SITE_NAME\" > _site/_redirects\n            else\n              cp -r docs/dist/. _site/\n            fi\n          fi\n          if [ \"$PROJECTS\" != \"[]\" ]; then\n            echo \"$PROJECTS\" | jq -c '.[]' | while IFS= read -r project; do\n              name=$(echo \"$project\" | jq -r '.name // \"\"')\n              workingDir=$(echo \"$project\" | jq -r '.workingDir')\n              outputDir=$(echo \"$project\" | jq -r '.outputDir // \"storybook-static\"')\n              if [ -n \"$name\" ]; then\n                target=\"_site/sandbox/${name}\"\n              else\n                target=\"_site/sandbox\"\n              fi\n              mkdir -p \"$target\"\n              cp -r \"${workingDir}/${outputDir}/.\" \"$target/\"\n            done\n          elif [ \"$DEPLOY_TYPE\" = \"storybook\" ]; then\n            mkdir -p _site/sandbox\n            cp -r \"${STORYBOOK_OUTPUT_DIR}/.\" _site/sandbox/\n          fi\n\n      - name: Install Wrangler\n        # The action's install step runs npm/pnpm in the repo root; pnpm fails\n        # because it rejects adding to a workspace root without -w, and npm fails\n        # because package.json contains pnpm catalog: references it cannot parse.\n        # Pre-installing from /tmp (no package.json) lets the action find wrangler\n        # already on PATH and skip its own install entirely.\n        working-directory: /tmp\n        run: npm install -g wrangler@4\n\n      - uses: cloudflare/wrangler-action@ebbaa1584979971c8614a24965b4405ff95890e0 # v4.0.0\n        id: deploy\n        name: Deploy to Cloudflare Pages\n        # Skip when neither the per-repo input nor the org variable is set.\n        if: ${{ inputs.cloudflare-project != '' || vars.CLOUDFLARE_PAGES_PROJECT != '' }}\n        with:\n          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}\n          accountId: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}\n          packageManager: npm\n          command: >-\n            pages deploy _site\n            --project-name ${{ inputs.cloudflare-project || vars.CLOUDFLARE_PAGES_PROJECT }}\n            --branch ${{ github.event.repository.name }}-pr-${{ github.event.pull_request.number }}\n            --commit-dirty=true\n\n      - name: Report preview URL\n        if: ${{ steps.deploy.outputs.pages-deployment-alias-url != '' }}\n        env:\n          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n          ALIAS: ${{ steps.deploy.outputs.pages-deployment-alias-url }}\n          SITE_NAME: ${{ inputs.name }}\n          PROJECT: ${{ inputs.cloudflare-project || vars.CLOUDFLARE_PAGES_PROJECT }}\n        run: |\n          PREVIEW_URL=\"${ALIAS%/}${SITE_NAME:+/${SITE_NAME}}/\"\n          # GITHUB_HEAD_REF is the PR branch name — links the deployment to this PR's sidebar widget.\n          PAYLOAD=$(printf '{\"ref\":\"%s\",\"environment\":\"%s\",\"description\":\"Cloudflare Pages\",\"production_environment\":false,\"auto_merge\":false,\"required_contexts\":[]}' \\\n            \"$GITHUB_HEAD_REF\" \"${PROJECT} (Preview)\")\n          DEPLOY_ID=$(echo \"$PAYLOAD\" | gh api \"repos/${GITHUB_REPOSITORY}/deployments\" \\\n            --method POST --input - | jq -r '.id')\n          gh api \"repos/${GITHUB_REPOSITORY}/deployments/${DEPLOY_ID}/statuses\" \\\n            --method POST --field state=success --field environment_url=\"${PREVIEW_URL}\"\n\n  cleanup:\n    name: Clean up Preview\n    if: ${{ github.event.action == 'closed' }}\n    runs-on: ubuntu-latest\n    permissions:\n      contents: read\n      deployments: write\n      pull-requests: write\n    steps:\n      - name: Delete Cloudflare Pages deployments for branch\n        if: ${{ inputs.cloudflare-project != '' || vars.CLOUDFLARE_PAGES_PROJECT != '' }}\n        env:\n          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}\n          CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}\n          PROJECT: ${{ inputs.cloudflare-project || vars.CLOUDFLARE_PAGES_PROJECT }}\n          BRANCH: ${{ github.event.repository.name }}-pr-${{ github.event.pull_request.number }}\n          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n        run: |\n          DEPLOYMENTS=$(curl -s \\\n            \"https://api.cloudflare.com/client/v4/accounts/${CLOUDFLARE_ACCOUNT_ID}/pages/projects/${PROJECT}/deployments\" \\\n            -H \"Authorization: Bearer ${CLOUDFLARE_API_TOKEN}\" \\\n            | jq -r --arg b \"$BRANCH\" \\\n              '.result[] | select(.deployment_trigger.metadata.branch == $b) | .id')\n\n          if [ -z \"$DEPLOYMENTS\" ]; then\n            echo \"No deployments found for branch ${BRANCH} — nothing to clean up.\"\n            exit 0\n          fi\n\n          for id in $DEPLOYMENTS; do\n            echo \"Deleting CF Pages deployment: $id\"\n            curl -s -X DELETE \\\n              \"https://api.cloudflare.com/client/v4/accounts/${CLOUDFLARE_ACCOUNT_ID}/pages/projects/${PROJECT}/deployments/${id}?force=true\" \\\n              -H \"Authorization: Bearer ${CLOUDFLARE_API_TOKEN}\" | jq -r 'if .success then \"  ✓ deleted\" else \"  ✗ \\(.errors[0].message)\" end'\n          done\n\n          # Mark the GitHub Deployment environment as inactive.\n          ENV_NAME=\"${PROJECT} (Preview)\"\n          gh api \"repos/${GITHUB_REPOSITORY}/deployments\" \\\n            | jq -r \".[] | select(.environment == \\\"${ENV_NAME}\\\") | .id\" \\\n            | while read -r deploy_id; do\n                gh api \"repos/${GITHUB_REPOSITORY}/deployments/${deploy_id}/statuses\" \\\n                  --method POST --field state=inactive 2>/dev/null || true\n              done\n";
 //#endregion
 //#region src/templates/workflows/release.yml
-var release_default = "name: Release\n\n# Semantic-release with OIDC Trusted Publishing.\n# actions/setup-node writes a default NODE_AUTH_TOKEN=${{ github.token }}\n# which shadows OIDC auth. We explicitly clear it so npm falls through to\n# the Trusted Publisher OIDC exchange.\n# The calling repo must have a .releaserc.json that configures branches,\n# plugins, and any publish options. npm@11+ is installed to support OIDC.\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      dry-run:\n        description: >\n          When true, runs semantic-release --dry-run: analyzes commits and\n          previews the next release without git writes or publish. Only\n          meaningful for workflow_dispatch triggers; push-triggered runs\n          always run fully.\n        type: boolean\n        required: false\n        default: false\n      run-build:\n        description: Run `pnpm build` before releasing\n        type: boolean\n        required: false\n        default: true\n      sentry-project:\n        description: >\n          Sentry project slug for sourcemap upload and release creation after\n          publishing. Omit to skip the Sentry release step entirely.\n        type: string\n        required: false\n        default: \"\"\n    secrets:\n      HOLOCRON_RELEASE_TOKEN:\n        description: >\n          Fine-grained PAT (Contents + Issues + Pull requests: write) owned by\n          an admin. Required when the default branch is protected by a ruleset —\n          github.token cannot push through rulesets, but an admin PAT can.\n          Takes priority over HOLOCRON_SYNC_TOKEN. Falls back to github.token.\n        required: false\n      HOLOCRON_SYNC_TOKEN:\n        description: >\n          Legacy alias for HOLOCRON_RELEASE_TOKEN — kept for backward compatibility.\n          Prefer HOLOCRON_RELEASE_TOKEN for new repos.\n        required: false\n      HOLOCRON_READ_TOKEN:\n        description: >\n          Fine-grained PAT for read-only GitHub API calls (e.g. resolving git\n          committer identity via `gh api user`). Falls back to github.token.\n        required: false\n      GH_TOKEN:\n        description: >\n          Generic GitHub token fallback for `gh` CLI calls. Used when\n          HOLOCRON_READ_TOKEN is not set.\n        required: false\n      SENTRY_AUTH_TOKEN:\n        description: >\n          Sentry auth token for sourcemap upload and release creation.\n          Required when sentry-project is set. Use the org-level secret.\n        required: false\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  release:\n    name: Semantic release\n    permissions:\n      contents: write\n      id-token: write\n      issues: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    # Do not cancel in-progress releases — a partial release is worse than a slow one.\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n          persist-credentials: false\n          # Use HOLOCRON_RELEASE_TOKEN when available — git push (tags, release commits)\n          # uses the checkout credential, not GITHUB_TOKEN env var. The\n          # built-in github.token cannot push through branch protection rulesets.\n          token: ${{ secrets.HOLOCRON_RELEASE_TOKEN || secrets.HOLOCRON_SYNC_TOKEN || github.token }}\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - name: Configure git identity\n        run: |\n          GIT_NAME=$(gh api user --jq .name 2>/dev/null || echo \"github-actions[bot]\")\n          GIT_EMAIL=$(gh api user --jq '\"\\(.id)+\\(.login)@users.noreply.github.com\"' 2>/dev/null || echo \"41898282+github-actions[bot]@users.noreply.github.com\")\n          git config --global user.name \"$GIT_NAME\"\n          git config --global user.email \"$GIT_EMAIL\"\n          git config --global format.signoff true\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_READ_TOKEN || secrets.GH_TOKEN || github.token }}\n\n      - name: Upgrade npm for OIDC support\n        run: npm install -g npm@11 sigstore\n        # sigstore is required by libnpmpublish/provenance.js at module parse\n        # time — before any config takes effect. Some npm 11.x builds stopped\n        # bundling it; installing it globally into the same prefix ensures it\n        # resolves regardless of npm version. (Discovered 2026-07-09.)\n\n      - run: pnpm build\n        name: Build\n        if: ${{ inputs.run-build == true }}\n\n      - name: Release\n        run: |\n          if [ \"$DRY_RUN\" = \"true\" ]; then\n            npx semantic-release --dry-run\n          else\n            npx semantic-release\n          fi\n        env:\n          DRY_RUN: ${{ inputs.dry-run }}\n          # Prefer HOLOCRON_RELEASE_TOKEN (fine-grained PAT, Contents+Issues+PRs write,\n          # owned by an admin with ruleset bypass) so @semantic-release/git can\n          # push the version-bump commit through branch protection. Falls back to\n          # HOLOCRON_SYNC_TOKEN (legacy) then github.token for unprotected repos.\n          GITHUB_TOKEN: ${{ secrets.HOLOCRON_RELEASE_TOKEN || secrets.HOLOCRON_SYNC_TOKEN || github.token }}\n          HUSKY: \"0\"\n          NPM_CONFIG_PROVENANCE: true\n\n      - name: Get release version\n        id: release_version\n        if: ${{ inputs.sentry-project != '' && inputs.dry-run != true }}\n        env:\n          SENTRY_PROJECT: ${{ inputs.sentry-project }}\n        run: |\n          TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo \"\")\n          if [ -n \"$TAG\" ]; then\n            echo \"release=${SENTRY_PROJECT}@${TAG#v}\" >> \"$GITHUB_OUTPUT\"\n          fi\n\n      - name: Create Sentry release\n        if: ${{ inputs.sentry-project != '' && steps.release_version.outputs.release != '' && inputs.dry-run != true }}\n        uses: getsentry/action-release@ff07929a6537bac57790c3451cf4d364aca38528 # v3\n        env:\n          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}\n          SENTRY_ORG: theholocron\n          SENTRY_PROJECT: ${{ inputs.sentry-project }}\n        with:\n          environment: production\n          version: ${{ steps.release_version.outputs.release }}\n          sourcemaps: \"**/dist\"\n";
+var release_default = "name: Release\n\n# Semantic-release with OIDC Trusted Publishing.\n# actions/setup-node writes a default NODE_AUTH_TOKEN=${{ github.token }}\n# which shadows OIDC auth. We explicitly clear it so npm falls through to\n# the Trusted Publisher OIDC exchange.\n# The calling repo must have a .releaserc.json that configures branches,\n# plugins, and any publish options. npm@11+ is installed to support OIDC.\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      dry-run:\n        description: >\n          When true, runs semantic-release --dry-run: analyzes commits and\n          previews the next release without git writes or publish. Only\n          meaningful for workflow_dispatch triggers; push-triggered runs\n          always run fully.\n        type: boolean\n        required: false\n        default: false\n      post-release:\n        description: >\n          When true, dispatches a readme sync broadcast after a successful\n          release. Enable for packages consumed by other repos via the\n          registry-doc system so downstream README installation blocks\n          stay current.\n        type: boolean\n        required: false\n        default: false\n      run-build:\n        description: Run `pnpm build` before releasing\n        type: boolean\n        required: false\n        default: true\n      sentry-project:\n        description: >\n          Sentry project slug for sourcemap upload and release creation after\n          publishing. Omit to skip the Sentry release step entirely.\n        type: string\n        required: false\n        default: \"\"\n    secrets:\n      HOLOCRON_RELEASE_TOKEN:\n        description: >\n          Fine-grained PAT (Contents + Issues + Pull requests: write) owned by\n          an admin. Required when the default branch is protected by a ruleset —\n          github.token cannot push through rulesets, but an admin PAT can.\n          Takes priority over HOLOCRON_SYNC_TOKEN. Falls back to github.token.\n        required: false\n      HOLOCRON_SYNC_TOKEN:\n        description: >\n          Legacy alias for HOLOCRON_RELEASE_TOKEN — kept for backward compatibility.\n          Prefer HOLOCRON_RELEASE_TOKEN for new repos.\n        required: false\n      HOLOCRON_READ_TOKEN:\n        description: >\n          Fine-grained PAT for read-only GitHub API calls (e.g. resolving git\n          committer identity via `gh api user`). Falls back to github.token.\n        required: false\n      GH_TOKEN:\n        description: >\n          Generic GitHub token fallback for `gh` CLI calls. Used when\n          HOLOCRON_READ_TOKEN is not set.\n        required: false\n      SENTRY_AUTH_TOKEN:\n        description: >\n          Sentry auth token for sourcemap upload and release creation.\n          Required when sentry-project is set. Use the org-level secret.\n        required: false\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  release:\n    name: Semantic release\n    permissions:\n      contents: write\n      id-token: write\n      issues: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    # Do not cancel in-progress releases — a partial release is worse than a slow one.\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n          persist-credentials: false\n          # Use HOLOCRON_RELEASE_TOKEN when available — git push (tags, release commits)\n          # uses the checkout credential, not GITHUB_TOKEN env var. The\n          # built-in github.token cannot push through branch protection rulesets.\n          token: ${{ secrets.HOLOCRON_RELEASE_TOKEN || secrets.HOLOCRON_SYNC_TOKEN || github.token }}\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - name: Configure git identity\n        run: |\n          GIT_NAME=$(gh api user --jq .name 2>/dev/null || echo \"github-actions[bot]\")\n          GIT_EMAIL=$(gh api user --jq '\"\\(.id)+\\(.login)@users.noreply.github.com\"' 2>/dev/null || echo \"41898282+github-actions[bot]@users.noreply.github.com\")\n          git config --global user.name \"$GIT_NAME\"\n          git config --global user.email \"$GIT_EMAIL\"\n          git config --global format.signoff true\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_READ_TOKEN || secrets.GH_TOKEN || github.token }}\n\n      - name: Upgrade npm for OIDC support\n        run: npm install -g npm@11 sigstore\n        # sigstore is required by libnpmpublish/provenance.js at module parse\n        # time — before any config takes effect. Some npm 11.x builds stopped\n        # bundling it; installing it globally into the same prefix ensures it\n        # resolves regardless of npm version. (Discovered 2026-07-09.)\n\n      - run: pnpm build\n        name: Build\n        if: ${{ inputs.run-build == true }}\n\n      - name: Release\n        run: |\n          if [ \"$DRY_RUN\" = \"true\" ]; then\n            npx semantic-release --dry-run\n          else\n            npx semantic-release\n          fi\n        env:\n          DRY_RUN: ${{ inputs.dry-run }}\n          # Prefer HOLOCRON_RELEASE_TOKEN (fine-grained PAT, Contents+Issues+PRs write,\n          # owned by an admin with ruleset bypass) so @semantic-release/git can\n          # push the version-bump commit through branch protection. Falls back to\n          # HOLOCRON_SYNC_TOKEN (legacy) then github.token for unprotected repos.\n          GITHUB_TOKEN: ${{ secrets.HOLOCRON_RELEASE_TOKEN || secrets.HOLOCRON_SYNC_TOKEN || github.token }}\n          HUSKY: \"0\"\n          NPM_CONFIG_PROVENANCE: true\n\n      - name: Get release version\n        id: release_version\n        if: ${{ inputs.sentry-project != '' && inputs.dry-run != true }}\n        env:\n          SENTRY_PROJECT: ${{ inputs.sentry-project }}\n        run: |\n          TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo \"\")\n          if [ -n \"$TAG\" ]; then\n            echo \"release=${SENTRY_PROJECT}@${TAG#v}\" >> \"$GITHUB_OUTPUT\"\n          fi\n\n      - name: Create Sentry release\n        if: ${{ inputs.sentry-project != '' && steps.release_version.outputs.release != '' && inputs.dry-run != true }}\n        uses: getsentry/action-release@ff07929a6537bac57790c3451cf4d364aca38528 # v3\n        env:\n          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}\n          SENTRY_ORG: theholocron\n          SENTRY_PROJECT: ${{ inputs.sentry-project }}\n        with:\n          environment: production\n          version: ${{ steps.release_version.outputs.release }}\n          sourcemaps: \"**/dist\"\n\n  sync-readme:\n    name: Post-release readme sync\n    needs: release\n    if: ${{ inputs.post-release == true && inputs.dry-run != true }}\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    steps:\n      - name: Trigger broadcast readme sync\n        run: |\n          gh workflow run sync-dispatch.yml \\\n            --repo theholocron/.github \\\n            --field \"steps=readme\"\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN }}\n";
 //#endregion
 //#region src/templates/workflows/review.yml
 var review_default = "name: Review\n\n# ReviewDog is the annotation layer — posts inline PR diff annotations.\n# Runs on pull_request only: inline annotations require PR context,\n# and branch protection ensures all changes go through PRs anyway.\n# super-linter (lint.yml) is the CI gate covering push + PR events.\n# Gitleaks and YAML are intentionally duplicated: super-linter gates\n# merges; ReviewDog surfaces exact line annotations in the PR diff.\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n\njobs:\n  reviewdog:\n    name: Review PRs\n    runs-on: ubuntu-latest\n    timeout-minutes: 20\n    permissions:\n      contents: read\n      pull-requests: write\n\n    steps:\n      - name: Checkout repository\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          fetch-depth: 0\n\n      - name: Setup\n        if: ${{ hashFiles('pnpm-lock.yaml') != '' }}\n        uses: theholocron/.github/.github/actions/setup@main\n\n      - name: Install ReviewDog\n        uses: reviewdog/action-setup@d8a7baabd7f3e8544ee4dbde3ee41d0011c3a93f # v1\n        with:\n          reviewdog_version: latest\n\n      # Detect which tools are relevant for this repo, excluding node_modules.\n      # hashFiles('**/*') recurses into node_modules/.pnpm and produces false\n      # positives for repos that don't own those file types.\n      # -print -quit stops find after the first match without a pipe, avoiding\n      # the SIGPIPE/pipefail exit-141 that find|head-1 triggers under\n      # GitHub Actions' default bash --noprofile --norc -e -o pipefail mode.\n      - name: Detect project features\n        id: detect\n        shell: bash\n        run: |\n          has() { find . -not -path '*/node_modules/*' -name \"$1\" -print -quit 2>/dev/null | grep -q .; }\n          has_ext() { find . -not -path '*/node_modules/*' -name \"$1\" -print -quit 2>/dev/null | grep -q .; }\n          { { has 'eslint.config.js' || has 'eslint.config.mjs' || has 'eslint.config.cjs' || \\\n              has 'eslint.config.ts' || has '.eslintrc' || has '.eslintrc.js' || \\\n              has '.eslintrc.cjs' || has '.eslintrc.json' || has '.eslintrc.yaml' || \\\n              has '.eslintrc.yml'; } && grep -qF '\"eslint\":' package.json 2>/dev/null; } && echo \"eslint=true\" >> \"$GITHUB_OUTPUT\" || echo \"eslint=false\" >> \"$GITHUB_OUTPUT\"\n          { has 'tsconfig.json' && grep -qF '\"typescript\":' package.json 2>/dev/null; } && echo \"tsconfig=true\" >> \"$GITHUB_OUTPUT\" || echo \"tsconfig=false\" >> \"$GITHUB_OUTPUT\"\n          has_ext '*.sh' && echo \"shell=true\" >> \"$GITHUB_OUTPUT\" || echo \"shell=false\" >> \"$GITHUB_OUTPUT\"\n          has 'Dockerfile' || has_ext '*.Dockerfile' || has 'Containerfile' && \\\n            echo \"docker=true\" >> \"$GITHUB_OUTPUT\" || echo \"docker=false\" >> \"$GITHUB_OUTPUT\"\n          has_ext '.env*' && echo \"dotenv=true\" >> \"$GITHUB_OUTPUT\" || echo \"dotenv=false\" >> \"$GITHUB_OUTPUT\"\n          has_ext '*.md' && echo \"markdown=true\" >> \"$GITHUB_OUTPUT\" || echo \"markdown=false\" >> \"$GITHUB_OUTPUT\"\n\n      #\n      # Always applicable\n      #\n\n      - name: Gitleaks (secrets)\n        uses: reviewdog/action-gitleaks@2b7b5685e3e3eecddab5d30cfa04f18123031421 # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / gitleaks\"\n          fail_level: error\n          gitleaks_flags: --log-opts=${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }}\n\n      - name: YamlLint\n        if: ${{ hashFiles('yamllint.config.yml') != '' }}\n        uses: reviewdog/action-yamllint@b5f7217d8c815ae374d1d55840d5e569d82f01f0 # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / yamllint\"\n          fail_level: error\n          yamllint_flags: -c ${{ github.workspace }}/yamllint.config.yml ${{ github.workspace }}\n\n      - name: ActionLint (GitHub Actions)\n        if: ${{ hashFiles('.github/workflows/*.yml', '.github/workflows/*.yaml') != '' }}\n        uses: reviewdog/action-actionlint@6fb7acc99f4a1008869fa8a0f09cfca740837d9d # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / actionlint\"\n          fail_level: error\n\n      #\n      # TypeScript / JavaScript\n      #\n\n      - name: ESLint\n        if: steps.detect.outputs.eslint == 'true'\n        uses: reviewdog/action-eslint@556a3fdaf8b4201d4d74d406013386aa4f7dab96 # v1.34.0\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / eslint\"\n          fail_level: error\n          eslint_flags: .\n\n      - name: TypeScript\n        if: steps.detect.outputs.tsconfig == 'true'\n        uses: EPMatt/reviewdog-action-tsc@63d923a3c5b4497671940b8874f58a404e2351b5 # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / tsc\"\n          fail_level: error\n\n      #\n      # Shell\n      #\n\n      - name: ShellCheck\n        if: steps.detect.outputs.shell == 'true'\n        uses: reviewdog/action-shellcheck@4c07458293ac342d477251099501a718ae5ef86e # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / shellcheck\"\n          fail_level: none\n\n      #\n      # Docker\n      #\n\n      - name: Hadolint\n        if: steps.detect.outputs.docker == 'true'\n        uses: reviewdog/action-hadolint@1b2cfa6ba72072ad35158d7ff3aa49bbdc03506d # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / hadolint\"\n          fail_level: none\n\n      #\n      # Environment files\n      #\n\n      - name: dotenv-linter\n        if: steps.detect.outputs.dotenv == 'true'\n        uses: dotenv-linter/action-dotenv-linter@afde61cfda2ecffe7bea35837b6f20b956c88689 # v3.0.0\n        with:\n          reporter: github-code-suggestions\n\n      #\n      # Documentation\n      #\n\n      - name: Alex (inclusive language)\n        if: steps.detect.outputs.markdown == 'true'\n        uses: reviewdog/action-alex@347481655add010a2ae302df34b57c9bcfa0d6e4 # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / alex\"\n";
 //#endregion
+//#region src/templates/workflows/security.yml
+var security_default = "name: Security\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      language:\n        description: CodeQL language to analyze\n        type: string\n        required: false\n        default: javascript-typescript\n\njobs:\n  analyze:\n    name: Analyze (${{ inputs.language }})\n    permissions:\n      actions: read\n      contents: read\n      security-events: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 45\n    # Do not cancel in-progress security scans.\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0\n        name: Initialize CodeQL\n        with:\n          languages: ${{ inputs.language }}\n\n      - uses: github/codeql-action/autobuild@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0\n        name: Autobuild\n\n      - uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0\n        name: Analyze\n        with:\n          category: /language:${{ inputs.language }}\n";
+//#endregion
 //#region src/templates/workflows/stale.yml
 var stale_default = "name: Stale\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      days-before-stale:\n        description: Days of inactivity before an issue is marked stale\n        type: number\n        required: false\n        default: 30\n      days-before-close:\n        description: Days of inactivity after stale label before closing\n        type: number\n        required: false\n        default: 5\n\njobs:\n  stale:\n    name: Mark stale issues and pull requests\n    permissions:\n      contents: write\n      issues: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    steps:\n      - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0\n        name: Run Stale\n        with:\n          close-issue-message: >\n            This issue was closed because it has been stalled for\n            ${{ inputs.days-before-close }} days with no activity.\n          days-before-close: ${{ inputs.days-before-close }}\n          days-before-stale: ${{ inputs.days-before-stale }}\n          exempt-all-pr-milestones: true\n          stale-issue-label: wontfix\n          stale-issue-message: >\n            This issue is stale because it has been open ${{ inputs.days-before-stale }}\n            days with no activity. Remove the stale label or comment, or this will be\n            closed in ${{ inputs.days-before-close }} days.\n          stale-pr-label: wontfix\n          stale-pr-message: >\n            This PR is stale because it has been open ${{ inputs.days-before-stale }}\n            days with no activity. Remove the stale label or comment, or this will be\n            closed in ${{ inputs.days-before-close }} days.\n";
 //#endregion
 //#region src/templates/workflows/sync.yml
 var sync_default = "name: Sync\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      steps:\n        description: >\n          Sync steps to run (default: all). Valid values:\n          labels, properties, teams, topics, keywords, description, homepage, readme, workflows.\n          Pass a space-separated list to run a subset, e.g. \"readme\" or \"readme description\".\n        type: string\n        required: false\n    secrets:\n      HOLOCRON_ADMIN_TOKEN:\n        description: Fine-grained PAT with admin scopes (labels, properties, teams).\n        required: false\n      HOLOCRON_DEPLOY_TOKEN:\n        description: Fine-grained PAT for GitHub Pages configuration.\n        required: false\n      HOLOCRON_ISSUES_TOKEN:\n        description: Fine-grained PAT for issue management.\n        required: false\n      HOLOCRON_ORG_TOKEN:\n        description: Org-scoped fine-grained PAT for team sync and org properties.\n        required: false\n      HOLOCRON_READ_TOKEN:\n        description: Fine-grained PAT for read-only GitHub API calls.\n        required: false\n      HOLOCRON_SYNC_TOKEN:\n        required: false\n      GH_TOKEN:\n        description: >\n          Generic GitHub token fallback for gh CLI calls. Used when\n          HOLOCRON_SYNC_TOKEN is not set.\n        required: false\n\njobs:\n  sync:\n    name: Sync repo from config\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    permissions:\n      contents: write\n      pull-requests: write\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          token: ${{ secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN || github.token }}\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - name: Run holocron sync\n        run: |\n          if [ -n \"$STEPS\" ]; then\n            # shellcheck disable=SC2086\n            pnpm --workspace-root exec holocron sync --steps $STEPS\n          else\n            pnpm --workspace-root exec holocron sync\n          fi\n        env:\n          HOLOCRON_ADMIN_TOKEN: ${{ secrets.HOLOCRON_ADMIN_TOKEN }}\n          HOLOCRON_DEPLOY_TOKEN: ${{ secrets.HOLOCRON_DEPLOY_TOKEN }}\n          HOLOCRON_ISSUES_TOKEN: ${{ secrets.HOLOCRON_ISSUES_TOKEN }}\n          HOLOCRON_ORG_TOKEN: ${{ secrets.HOLOCRON_ORG_TOKEN }}\n          HOLOCRON_READ_TOKEN: ${{ secrets.HOLOCRON_READ_TOKEN }}\n          HOLOCRON_SYNC_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN }}\n          STEPS: ${{ inputs.steps }}\n\n      - name: Format generated files\n        run: pnpm exec prettier --write README.md docs/src/content/docs/index.mdx 2>/dev/null || true\n\n      - uses: theholocron/.github/.github/actions/auto-commit@main\n        id: auto-commit\n        name: Commit sync changes\n        with:\n          token: ${{ secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN || github.token }}\n          branch: chore/auto-sync\n          commit-message: \"chore: sync from holocron.config\"\n          commit-options: \"--no-verify\"\n\n      - name: Open PR if changes were committed\n        if: steps.auto-commit.outputs.changes-detected == 'true'\n        run: |\n          gh pr create \\\n            --title \"chore: sync README and repo metadata\" \\\n            --body \"Automated sync triggered by changes to config or package files. Merge to apply.\" \\\n            --base main \\\n            --head chore/auto-sync \\\n          || echo \"PR already open — branch updated.\"\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN || github.token }}\n";
 //#endregion
-//#region src/templates/workflows/sync-broadcast.yml
-var sync_broadcast_default = "name: Sync Broadcast\n\non: # yamllint disable-line rule:truthy\n  workflow_dispatch:\n    inputs:\n      steps:\n        description: >\n          Sync steps to pass to each repo's sync.yml. Default is \"readme\"\n          (only README marker blocks are updated).\n        type: string\n        required: false\n        default: readme\n\npermissions:\n  contents: read\n\njobs:\n  broadcast:\n    name: Broadcast sync to all repos\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    steps:\n      - name: Dispatch sync to all repos with sync.yml\n        run: |\n          gh api /orgs/theholocron/repos --paginate --jq '.[].name' \\\n            | while IFS= read -r repo; do\n              gh api \"/repos/theholocron/$repo/contents/.github/workflows/sync.yml\" --silent 2>/dev/null || continue\n              echo \"Dispatching sync to theholocron/$repo\"\n              gh workflow run sync.yml \\\n                --repo \"theholocron/$repo\" \\\n                --field \"steps=$STEPS\" \\\n              || echo \"Warning: could not dispatch to theholocron/$repo — skipping\"\n            done\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN }}\n          STEPS: ${{ inputs.steps }}\n";
+//#region src/templates/workflows/sync-dispatch.yml
+var sync_dispatch_default = "name: Sync Dispatch\n\non: # yamllint disable-line rule:truthy\n  workflow_dispatch:\n    inputs:\n      steps:\n        description: >\n          Sync steps to pass to each repo's sync.yml. Default is \"readme\"\n          (only README marker blocks are updated).\n        type: string\n        required: false\n        default: readme\n\npermissions:\n  contents: read\n\njobs:\n  broadcast:\n    name: Broadcast sync to all repos\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    steps:\n      - name: Dispatch sync to all repos with sync.yml\n        run: |\n          gh api /orgs/theholocron/repos --paginate --jq '.[].name' \\\n            | while IFS= read -r repo; do\n              gh api \"/repos/theholocron/$repo/contents/.github/workflows/sync.yml\" --silent 2>/dev/null || continue\n              echo \"Dispatching sync to theholocron/$repo\"\n              gh workflow run sync.yml \\\n                --repo \"theholocron/$repo\" \\\n                --field \"steps=$STEPS\" \\\n              || echo \"Warning: could not dispatch to theholocron/$repo — skipping\"\n            done\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN }}\n          STEPS: ${{ inputs.steps }}\n";
 //#endregion
 //#region src/templates/workflows/sync-github.yml
-var sync_github_default = "name: Sync GitHub Templates\n\n# Builds the holocron CLI from source and pushes updated workflow templates\n# and composite actions to downstream .github repos. Runs whenever the\n# template source files change on main or alpha.\n#\n# Secrets required:\n#   HOLOCRON_SYNC_TOKEN — fine-grained PAT (resource owner: org) with:\n#                  Actions:       Read and write  (dispatch workflow runs via gh workflow run)\n#                  Contents:      Read and write  (git trees, blobs, refs)\n#                  Pull requests: Read and write  (open sync PR)\n#                  Workflows:     Read and write  (write .github/workflows/*.yml)\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      primary-repo:\n        description: >\n          Primary .github repo — receives composite actions, reusable workflows,\n          and thin-caller templates. Requires a PR (branch protection assumed).\n        type: string\n        required: false\n        default: theholocron/.github\n      secondary-repos:\n        description: >\n          Space-separated list of secondary repos (reusable workflows + thin\n          callers only, no composite actions). Changes are delivered via pull\n          request, same as the primary repo.\n        type: string\n        required: false\n        default: \"\"\n      sync-branch:\n        description: Branch name used for the primary and secondary repo PRs\n        type: string\n        required: false\n        default: chore/sync-templates\n    secrets:\n      HOLOCRON_SYNC_TOKEN:\n        required: true\n      HOLOCRON_READ_TOKEN:\n        description: >\n          Fine-grained PAT for read-only GitHub API calls (e.g. resolving git\n          committer identity via `gh api user`). Falls back to HOLOCRON_SYNC_TOKEN.\n        required: false\n      GH_TOKEN:\n        description: >\n          Generic GitHub token fallback for `gh` CLI calls. Used when neither\n          HOLOCRON_READ_TOKEN nor HOLOCRON_SYNC_TOKEN is set.\n        required: false\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  sync:\n    name: Sync templates\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    permissions:\n      contents: read\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: pnpm build\n        name: Build CLI\n\n      - name: Cache actionlint\n        id: cache-actionlint\n        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0\n        with:\n          path: /tmp/actionlint\n          key: actionlint-v1.7.7-linux-amd64\n\n      - name: Download actionlint\n        if: steps.cache-actionlint.outputs.cache-hit != 'true'\n        run: |\n          curl -fsSL https://github.com/rhysd/actionlint/releases/download/v1.7.7/actionlint_1.7.7_linux_amd64.tar.gz \\\n            | tar -xz -C /tmp actionlint\n\n      - name: Validate generated workflows\n        run: |\n          node packages/cli/dist/cli.mjs sync-github \\\n            --repo \"$PRIMARY_REPO\" \\\n            --output-dir /tmp/sync-validate\n          /tmp/actionlint /tmp/sync-validate/.github/workflows/*.yml\n        env:\n          PRIMARY_REPO: ${{ inputs.primary-repo }}\n\n      - name: Sync primary repo (PR)\n        run: |\n          GIT_NAME=$(gh api user --jq .name 2>/dev/null || echo \"github-actions[bot]\")\n          GIT_EMAIL=$(gh api user --jq '\"\\(.id)+\\(.login)@users.noreply.github.com\"' 2>/dev/null || echo \"41898282+github-actions[bot]@users.noreply.github.com\")\n          COMMIT_MSG=\"chore: sync from theholocron/holocron\"$'\\n\\n'\"Signed-off-by: $GIT_NAME <$GIT_EMAIL>\"\n          node packages/cli/dist/cli.mjs sync-github \\\n            --repo \"$PRIMARY_REPO\" \\\n            --branch \"$SYNC_BRANCH\" \\\n            --pr \\\n            --message \"$COMMIT_MSG\"\n          GH_TOKEN=\"$HOLOCRON_SYNC_TOKEN\" gh pr merge --auto --squash \\\n            --repo \"$PRIMARY_REPO\" \"$SYNC_BRANCH\" 2>/dev/null || true\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_READ_TOKEN || secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN }}\n          HOLOCRON_SYNC_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN }}\n          PRIMARY_REPO: ${{ inputs.primary-repo }}\n          SYNC_BRANCH: ${{ inputs.sync-branch }}\n\n      - name: Sync secondary repos (PR)\n        if: ${{ inputs.secondary-repos != '' }}\n        run: |\n          GIT_NAME=$(gh api user --jq .name 2>/dev/null || echo \"github-actions[bot]\")\n          GIT_EMAIL=$(gh api user --jq '\"\\(.id)+\\(.login)@users.noreply.github.com\"' 2>/dev/null || echo \"41898282+github-actions[bot]@users.noreply.github.com\")\n          COMMIT_MSG=\"chore: sync from theholocron/holocron\"$'\\n\\n'\"Signed-off-by: $GIT_NAME <$GIT_EMAIL>\"\n          for repo in $SECONDARY_REPOS; do\n            node packages/cli/dist/cli.mjs sync-github \\\n              --repo \"$repo\" \\\n              --branch \"$SYNC_BRANCH\" \\\n              --pr \\\n              --message \"$COMMIT_MSG\"\n            GH_TOKEN=\"$HOLOCRON_SYNC_TOKEN\" gh pr merge --auto --squash \\\n              --repo \"$repo\" \"$SYNC_BRANCH\" 2>/dev/null || true\n          done\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_READ_TOKEN || secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN }}\n          HOLOCRON_SYNC_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN }}\n          SECONDARY_REPOS: ${{ inputs.secondary-repos }}\n          SYNC_BRANCH: ${{ inputs.sync-branch }}\n";
+var sync_github_default = "name: Sync workflow templates\n\n# Builds the holocron CLI from source and pushes updated workflow templates\n# and composite actions to downstream .github repos. Runs whenever the\n# template source files change on main or alpha.\n#\n# Secrets required:\n#   HOLOCRON_SYNC_TOKEN — fine-grained PAT (resource owner: org) with:\n#                  Actions:       Read and write  (dispatch workflow runs via gh workflow run)\n#                  Contents:      Read and write  (git trees, blobs, refs)\n#                  Pull requests: Read and write  (open sync PR)\n#                  Workflows:     Read and write  (write .github/workflows/*.yml)\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      primary-repo:\n        description: >\n          Primary .github repo — receives composite actions, reusable workflows,\n          and thin-caller templates. Requires a PR (branch protection assumed).\n        type: string\n        required: false\n        default: theholocron/.github\n      secondary-repos:\n        description: >\n          Space-separated list of secondary repos (reusable workflows + thin\n          callers only, no composite actions). Changes are delivered via pull\n          request, same as the primary repo.\n        type: string\n        required: false\n        default: \"\"\n      sync-branch:\n        description: Branch name used for the primary and secondary repo PRs\n        type: string\n        required: false\n        default: chore/sync-templates\n    secrets:\n      HOLOCRON_SYNC_TOKEN:\n        required: true\n      HOLOCRON_READ_TOKEN:\n        description: >\n          Fine-grained PAT for read-only GitHub API calls (e.g. resolving git\n          committer identity via `gh api user`). Falls back to HOLOCRON_SYNC_TOKEN.\n        required: false\n      GH_TOKEN:\n        description: >\n          Generic GitHub token fallback for `gh` CLI calls. Used when neither\n          HOLOCRON_READ_TOKEN nor HOLOCRON_SYNC_TOKEN is set.\n        required: false\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  sync:\n    name: Sync templates\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    permissions:\n      contents: read\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: pnpm build\n        name: Build CLI\n\n      - name: Cache actionlint\n        id: cache-actionlint\n        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0\n        with:\n          path: /tmp/actionlint\n          key: actionlint-v1.7.7-linux-amd64\n\n      - name: Download actionlint\n        if: steps.cache-actionlint.outputs.cache-hit != 'true'\n        run: |\n          curl -fsSL https://github.com/rhysd/actionlint/releases/download/v1.7.7/actionlint_1.7.7_linux_amd64.tar.gz \\\n            | tar -xz -C /tmp actionlint\n\n      - name: Validate generated workflows\n        run: |\n          node packages/cli/dist/cli.mjs sync-github \\\n            --repo \"$PRIMARY_REPO\" \\\n            --output-dir /tmp/sync-validate\n          /tmp/actionlint /tmp/sync-validate/.github/workflows/*.yml\n        env:\n          PRIMARY_REPO: ${{ inputs.primary-repo }}\n\n      - name: Sync primary repo (PR)\n        run: |\n          GIT_NAME=$(gh api user --jq .name 2>/dev/null || echo \"github-actions[bot]\")\n          GIT_EMAIL=$(gh api user --jq '\"\\(.id)+\\(.login)@users.noreply.github.com\"' 2>/dev/null || echo \"41898282+github-actions[bot]@users.noreply.github.com\")\n          COMMIT_MSG=\"chore: sync from theholocron/holocron\"$'\\n\\n'\"Signed-off-by: $GIT_NAME <$GIT_EMAIL>\"\n          node packages/cli/dist/cli.mjs sync-github \\\n            --repo \"$PRIMARY_REPO\" \\\n            --branch \"$SYNC_BRANCH\" \\\n            --pr \\\n            --message \"$COMMIT_MSG\"\n          GH_TOKEN=\"$HOLOCRON_SYNC_TOKEN\" gh pr merge --auto --squash \\\n            --repo \"$PRIMARY_REPO\" \"$SYNC_BRANCH\" 2>/dev/null || true\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_READ_TOKEN || secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN }}\n          HOLOCRON_SYNC_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN }}\n          PRIMARY_REPO: ${{ inputs.primary-repo }}\n          SYNC_BRANCH: ${{ inputs.sync-branch }}\n\n      - name: Sync secondary repos (PR)\n        if: ${{ inputs.secondary-repos != '' }}\n        run: |\n          GIT_NAME=$(gh api user --jq .name 2>/dev/null || echo \"github-actions[bot]\")\n          GIT_EMAIL=$(gh api user --jq '\"\\(.id)+\\(.login)@users.noreply.github.com\"' 2>/dev/null || echo \"41898282+github-actions[bot]@users.noreply.github.com\")\n          COMMIT_MSG=\"chore: sync from theholocron/holocron\"$'\\n\\n'\"Signed-off-by: $GIT_NAME <$GIT_EMAIL>\"\n          for repo in $SECONDARY_REPOS; do\n            node packages/cli/dist/cli.mjs sync-github \\\n              --repo \"$repo\" \\\n              --branch \"$SYNC_BRANCH\" \\\n              --pr \\\n              --message \"$COMMIT_MSG\"\n            GH_TOKEN=\"$HOLOCRON_SYNC_TOKEN\" gh pr merge --auto --squash \\\n              --repo \"$repo\" \"$SYNC_BRANCH\" 2>/dev/null || true\n          done\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_READ_TOKEN || secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN }}\n          HOLOCRON_SYNC_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN }}\n          SECONDARY_REPOS: ${{ inputs.secondary-repos }}\n          SYNC_BRANCH: ${{ inputs.sync-branch }}\n";
 //#endregion
 //#region src/templates/workflows/tag.yml
 var tag_default = "name: Tag\n\n# Release Please — fully automated tag and GitHub Release from Conventional Commits.\n# No package.json or npm publishing required. Operates in \"simple\" mode by default:\n# analyzes commits since the last tag, maintains a rolling Release PR, and creates\n# a tag + GitHub Release when that PR is merged.\n#\n# The calling repo must have two files at the root:\n#   release-please-config.json    — declares packages and release-type\n#   .release-please-manifest.json — tracks the current version\n\non: # yamllint disable-line rule:truthy\n  # Self-trigger: when this workflow lives in theholocron/.github itself,\n  # push to main runs Release Please for that repo's own releases.\n  push:\n    branches:\n      - main\n  workflow_call:\n    inputs:\n      release-type:\n        description: Release Please release type (simple, node, python, etc.)\n        type: string\n        required: false\n        default: simple\n      config-file:\n        description: Path to release-please-config.json\n        type: string\n        required: false\n        default: release-please-config.json\n      manifest-file:\n        description: Path to .release-please-manifest.json\n        type: string\n        required: false\n        default: .release-please-manifest.json\n\njobs:\n  tag:\n    name: Tag release\n    permissions:\n      contents: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    steps:\n      - uses: google-github-actions/release-please-action@e4dc86ba9405554aeba3c6bb2d169500e7d3b4ee # v4.1.1\n        name: Run Release Please\n        with:\n          release-type: ${{ inputs.release-type }}\n          config-file: ${{ inputs.config-file }}\n          manifest-file: ${{ inputs.manifest-file }}\n";
@@ -5362,7 +5519,7 @@ var test_default = "name: Test\n\non: # yamllint disable-line rule:truthy\n  wor
 var typecheck_default = "name: Typecheck\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  typecheck:\n    name: tsc --noEmit\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: pnpm typecheck\n        name: Type check\n\n\n  conclusion:\n    name: Conclusion\n    runs-on: ubuntu-latest\n    if: always()\n    needs: [typecheck]\n    steps:\n      - name: Check job statuses\n        run: |\n          if [[ \"$RESULTS\" == *\"failure\"* ]] || [[ \"$RESULTS\" == *\"cancelled\"* ]]; then\n            exit 1\n          fi\n        env:\n          RESULTS: ${{ join(needs.*.result, ',') }}\n";
 //#endregion
 //#region src/templates/workflows/wiki.yml
-var wiki_default = "name: Wiki\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      fern-version:\n        description: >\n          Fern CLI version to install. Pin this to avoid breaking changes when\n          Fern updates their config schema.\n        type: string\n        required: false\n        default: \"5.35.4\"\n      preview:\n        description: >\n          When true, publishes a preview instead of production.\n          Requires preview-id to be set.\n        type: boolean\n        required: false\n        default: false\n      preview-id:\n        description: >\n          Stable ID for the preview URL. The preview is accessible at\n          {fern-org}-preview-{id}.docs.buildwithfern.com. Use the PR number\n          (e.g. \"pr-123\") so the same URL is reused on every push to\n          the branch.\n        type: string\n        required: false\n        default: \"\"\n      fern-org:\n        description: >\n          Fern workspace org slug (e.g. \"holocron\"). When set, a GitHub\n          deployment is created after a successful preview so the URL appears\n          in the PR sidebar widget — the same pattern as Cloudflare Pages previews.\n        type: string\n        required: false\n        default: \"\"\n      base-path:\n        description: >\n          Basepath appended to the preview URL (e.g. \"holocron\" when using\n          multi-source routing with wiki.theholocron.dev/holocron).\n          Omit for single-instance Fern sites.\n        type: string\n        required: false\n        default: \"\"\n    secrets:\n      HOLOCRON_FERN_TOKEN:\n        required: false\n      FERN_TOKEN:\n        required: false\n\njobs:\n  publish:\n    name: ${{ inputs.preview && 'Preview' || 'Publish' }} to Fern\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    permissions:\n      contents: read\n      deployments: write\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - name: Install Fern CLI\n        run: npm install -g \"fern-api@$FERN_VERSION\"\n        env:\n          FERN_VERSION: ${{ inputs.fern-version }}\n\n      - name: Publish docs\n        if: ${{ !inputs.preview }}\n        run: fern generate --docs\n        env:\n          FERN_TOKEN: ${{ secrets.HOLOCRON_FERN_TOKEN || secrets.FERN_TOKEN }}\n\n      - name: Preview docs\n        if: ${{ inputs.preview && inputs.preview-id != '' }}\n        run: fern generate --docs --preview --id \"$PREVIEW_ID\"\n        env:\n          FERN_TOKEN: ${{ secrets.HOLOCRON_FERN_TOKEN || secrets.FERN_TOKEN }}\n          PREVIEW_ID: ${{ inputs.preview-id }}\n\n      - name: Report preview URL\n        if: ${{ inputs.preview && inputs.preview-id != '' && inputs.fern-org != '' }}\n        env:\n          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n          FERN_ORG: ${{ inputs.fern-org }}\n          PREVIEW_ID: ${{ inputs.preview-id }}\n          BASE_PATH: ${{ inputs.base-path }}\n        run: |\n          PREVIEW_URL=\"https://${FERN_ORG}-preview-${PREVIEW_ID}.docs.buildwithfern.com${BASE_PATH:+/${BASE_PATH}}\"\n          PAYLOAD=$(printf '{\"ref\":\"%s\",\"environment\":\"fern (Preview)\",\"description\":\"Fern Docs\",\"production_environment\":false,\"auto_merge\":false,\"required_contexts\":[]}' \\\n            \"$GITHUB_HEAD_REF\")\n          DEPLOY_ID=$(echo \"$PAYLOAD\" | gh api \"repos/${GITHUB_REPOSITORY}/deployments\" \\\n            --method POST --input - | jq -r '.id')\n          gh api \"repos/${GITHUB_REPOSITORY}/deployments/${DEPLOY_ID}/statuses\" \\\n            --method POST --field state=success --field environment_url=\"$PREVIEW_URL\"\n";
+var wiki_default = "name: Wiki\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      fern-version:\n        description: >\n          Fern CLI version to install. Pin this to avoid breaking changes when\n          Fern updates their config schema.\n        type: string\n        required: false\n        default: \"5.35.4\"\n      preview:\n        description: >\n          When true, publishes a preview instead of production.\n          Requires preview-id to be set.\n        type: boolean\n        required: false\n        default: false\n      preview-id:\n        description: >\n          Stable ID for the preview URL. The preview is accessible at\n          {fern-org}-preview-{id}.docs.buildwithfern.com. Use the PR number\n          (e.g. \"pr-123\") so the same URL is reused on every push to\n          the branch.\n        type: string\n        required: false\n        default: \"\"\n      fern-org:\n        description: >\n          Fern workspace org slug (e.g. \"holocron\"). When set, a GitHub\n          deployment is created after a successful preview so the URL appears\n          in the PR sidebar widget — the same pattern as Cloudflare Pages previews.\n        type: string\n        required: false\n        default: \"\"\n      base-path:\n        description: >\n          Basepath appended to the preview URL (e.g. \"holocron\" when using\n          multi-source routing with wiki.theholocron.dev/holocron).\n          Omit for single-instance Fern sites.\n        type: string\n        required: false\n        default: \"\"\n    secrets:\n      HOLOCRON_FERN_TOKEN:\n        required: false\n      FERN_TOKEN:\n        required: false\n\njobs:\n  publish:\n    name: ${{ inputs.preview && 'Preview' || 'Publish' }} to Wiki\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    permissions:\n      contents: read\n      deployments: write\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - name: Install Fern CLI\n        run: npm install -g \"fern-api@$FERN_VERSION\"\n        env:\n          FERN_VERSION: ${{ inputs.fern-version }}\n\n      - name: Publish docs\n        if: ${{ !inputs.preview }}\n        run: fern generate --docs\n        env:\n          FERN_TOKEN: ${{ secrets.HOLOCRON_FERN_TOKEN || secrets.FERN_TOKEN }}\n\n      - name: Preview docs\n        if: ${{ inputs.preview && inputs.preview-id != '' }}\n        run: fern generate --docs --preview --id \"$PREVIEW_ID\"\n        env:\n          FERN_TOKEN: ${{ secrets.HOLOCRON_FERN_TOKEN || secrets.FERN_TOKEN }}\n          PREVIEW_ID: ${{ inputs.preview-id }}\n\n      - name: Report preview URL\n        if: ${{ inputs.preview && inputs.preview-id != '' && inputs.fern-org != '' }}\n        env:\n          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n          FERN_ORG: ${{ inputs.fern-org }}\n          PREVIEW_ID: ${{ inputs.preview-id }}\n          BASE_PATH: ${{ inputs.base-path }}\n        run: |\n          PREVIEW_URL=\"https://${FERN_ORG}-preview-${PREVIEW_ID}.docs.buildwithfern.com${BASE_PATH:+/${BASE_PATH}}\"\n          PAYLOAD=$(printf '{\"ref\":\"%s\",\"environment\":\"wiki (Preview)\",\"description\":\"Wiki\",\"production_environment\":false,\"auto_merge\":false,\"required_contexts\":[]}' \\\n            \"$GITHUB_HEAD_REF\")\n          DEPLOY_ID=$(echo \"$PAYLOAD\" | gh api \"repos/${GITHUB_REPOSITORY}/deployments\" \\\n            --method POST --input - | jq -r '.id')\n          gh api \"repos/${GITHUB_REPOSITORY}/deployments/${DEPLOY_ID}/statuses\" \\\n            --method POST --field state=success --field environment_url=\"$PREVIEW_URL\"\n";
 //#endregion
 //#region src/templates/index.ts
 /**
@@ -5382,18 +5539,16 @@ const ACTIONS = {
 const REUSABLE_WORKFLOWS = {
 	audit: audit_default,
 	bookkeeping: bookkeeping_default,
-	codeql: codeql_default,
 	dependencies: dependencies_default,
 	deploy: deploy_default,
-	"cleanup-preview": cleanup_preview_default,
-	"deploy-preview": deploy_preview_default,
+	preview: preview_default,
+	security: security_default,
 	greetings: greetings_default,
 	lint: lint_default,
-	"post-release": post_release_default,
 	release: release_default,
 	review: review_default,
 	stale: stale_default,
-	"sync-broadcast": sync_broadcast_default,
+	"sync-dispatch": sync_dispatch_default,
 	tag: tag_default,
 	"sync-github": sync_github_default,
 	sync: sync_default,
@@ -5408,6 +5563,11 @@ const WORKFLOW_TEMPLATE_PROPERTIES = { bookkeeping: JSON.stringify({
 }, null, 2) };
 //#endregion
 //#region src/commands/sync-github.ts
+const { workflowHeader } = createHeader({
+	source: "packages/cli/src/commands/sync-github.ts",
+	tool: "holocron sync-github",
+	forPrimary: true
+});
 const DEFAULT_REPO = "theholocron/.github";
 function reusableHeader(source) {
 	return [
@@ -5424,17 +5584,17 @@ function buildBatch(repo) {
 	const isPrimaryGithubRepo = repo === DEFAULT_REPO;
 	if (isPrimaryGithubRepo) for (const [name, content] of Object.entries(ACTIONS)) files.push({
 		path: `.github/actions/${name}.yml`,
-		content: reusableHeader(`packages/cli/src/templates/index.ts`) + content
+		content: `${reusableHeader(`packages/cli/src/templates/index.ts`)}${content}`
 	});
 	if (isPrimaryGithubRepo) {
 		for (const [name, content] of Object.entries(REUSABLE_WORKFLOWS)) files.push({
 			path: `.github/workflows/${name}.yml`,
-			content: reusableHeader(`packages/cli/src/templates/index.ts`) + content
+			content: `${reusableHeader(`packages/cli/src/templates/index.ts`)}${content}`
 		});
 		for (const [name, content] of Object.entries(WORKFLOW_TEMPLATES)) {
 			files.push({
 				path: `workflow-templates/${name}.yml`,
-				content: workflowHeader(void 0, true) + content
+				content: `${workflowHeader()}${content}`
 			});
 			const props = WORKFLOW_TEMPLATE_PROPERTIES[name];
 			if (props) files.push({
@@ -5789,7 +5949,7 @@ async function runUpgradeNode(input) {
 	};
 }
 //#endregion
-//#region src/load-config.ts
+//#region src/config/load-config.ts
 /**
 * `holocron.config.{json,js,ts}` file loader.
 *
@@ -5910,21 +6070,21 @@ async function fileExists(path) {
 //#region src/telemetry.ts
 const DSN = "https://95cbb72ad5636c94e119a5405ee8f55f@o4508238154104832.ingest.us.sentry.io/4511810950791168";
 function isEnabled() {
-	return !process.env.NO_HOLOCRON_TELEMETRY && true;
+	return !env.get("NO_HOLOCRON_TELEMETRY") && true;
 }
 function init(version) {
 	if (!isEnabled()) return;
 	Sentry.init({
 		dsn: DSN,
 		release: `holocron@${version}`,
-		environment: process.env.CI ? "ci" : "local",
+		environment: env.get("CI") ? "ci" : "local",
 		tracesSampleRate: 1,
 		beforeSend: scrubError
 	});
 	Sentry.startSession();
 	Sentry.setTag("os", process.platform);
 	Sentry.setTag("node", process.version);
-	Sentry.setTag("ci", String(Boolean(process.env.CI)));
+	Sentry.setTag("ci", String(Boolean(env.get("CI"))));
 }
 function startCommand(name) {
 	if (!isEnabled()) return () => {};
@@ -5959,50 +6119,12 @@ function scrubError(event, _hint) {
 	return JSON.parse(redact(JSON.stringify(event)));
 }
 //#endregion
-//#region src/token-args.ts
-var TokenParseError = class extends Error {
-	name = "TokenParseError";
-};
-/**
-* Converts raw --token CLI values into a typed result.
-*
-* Bare form:   --token ghp_xxx            → { cliToken: "ghp_xxx" }
-* Keyed form:  --token github=ghp_xxx     → { cliTokens: { github: "ghp_xxx" } }
-* Mixed:       --token github=ghp_xxx --token v_yyy
-*                                         → { cliToken: "v_yyy", cliTokens: { github: "ghp_xxx" } }
-*
-* Values may contain "=" (e.g. base64 strings) — only the first "=" is treated as a separator.
-*/
-function parseTokenArgs(tokens) {
-	if (tokens.length === 0) return {};
-	const cliTokens = {};
-	const bare = [];
-	for (const raw of tokens) {
-		const eqIdx = raw.indexOf("=");
-		if (eqIdx === -1) {
-			bare.push(raw);
-			continue;
-		}
-		const vendor = raw.slice(0, eqIdx);
-		const value = raw.slice(eqIdx + 1);
-		if (vendor.trim() === "") throw new TokenParseError(`invalid --token value "${raw}": vendor name must not be empty`);
-		if (/\s/.test(vendor)) throw new TokenParseError(`invalid --token value "${raw}": vendor name must not contain whitespace`);
-		if (value === "") throw new TokenParseError(`invalid --token value "${raw}": token value must not be empty`);
-		cliTokens[vendor] = value;
-	}
-	if (bare.length > 1) throw new TokenParseError(`only one bare --token value is allowed; got ${bare.length.toString()} — use vendor=value form for multiple tokens`);
-	const result = {};
-	if (bare.length === 1) result.cliToken = bare[0];
-	if (Object.keys(cliTokens).length > 0) result.cliTokens = cliTokens;
-	return result;
-}
-//#endregion
 //#region src/update-notifier.ts
 const PACKAGE_NAME = "@theholocron/cli";
 const CACHE_TTL_MS = 1440 * 60 * 1e3;
 const FETCH_TIMEOUT_MS = 3e3;
 function getCacheDir() {
-	return process.env["HOLOCRON_CACHE_DIR"] ?? join(homedir(), ".cache", "holocron");
+	return env.get("HOLOCRON_CACHE_DIR") ?? join(homedir(), ".cache", "holocron");
 }
 function getCachePath() {
 	return join(getCacheDir(), "update-check.json");
@@ -6090,7 +6212,7 @@ function formatNotice(current, latest) {
 	].join("\n");
 }
 async function checkForUpdates(currentVersion) {
-	if (process.env["CI"] || process.env["NO_UPDATE_NOTIFIER"]) return null;
+	if (env.get("CI") || env.get("NO_UPDATE_NOTIFIER")) return null;
 	const channel = getChannel(currentVersion);
 	const cache = readCache();
 	const now = Date.now();
@@ -6126,7 +6248,7 @@ const { version: CLI_VERSION } = JSON.parse(readFileSync(new URL("../package.jso
 *   3. `org` from `holocron.config.ts`
 */
 function resolveOrg(argv, config) {
-	return argv.org ?? process.env["HOLOCRON_ORG"] ?? config.org;
+	return argv.org ?? env.get("HOLOCRON_ORG") ?? config.org;
 }
 /** Parses --token values and returns the context spread, or null on parse error (exits with code 1). */
 function tokenContext(rawTokens) {
@@ -6420,7 +6542,7 @@ try {
 			},
 			...argv.steps && argv.steps.length > 0 ? { steps: argv.steps } : {}
 		})).summary.fail > 0) process.exitCode = 1;
-	}).command("sync-github", "Sync workflow templates and composite actions to theholocron/.github via the GitHub API", (y) => y.option("repo", {
+	}).command("sync-github", "Sync workflow templates and composite actions to theholocron/.github", (y) => y.option("repo", {
 		type: "string",
 		default: "theholocron/.github",
 		describe: "Target org/repo (default: theholocron/.github)"