@theholocron/cli 3.5.4 → 3.7.0

package/dist/capabilities/index.d.mts

@@ -157,6 +157,26 @@ interface Source extends ProviderIdentity {
    * Optional — providers that don't support setting a homepage omit this.
    */
   syncHomepage?(homepage: string): Promise<string>;
+  /**
+   * Enable or update GitHub Pages for the repository.
+   * Idempotent: POST to create, PUT to update existing settings.
+   * Requires HOLOCRON_DEPLOY_TOKEN (pages:write + repo scope) — passed
+   * explicitly because it is a different PAT from the main admin token.
+   * Optional — providers without a Pages concept omit this.
+   */
+  configurePages?(config: PagesConfig, token: string): Promise<void>;
+}
+interface PagesConfig {
+  /** GitHub Pages build source. */
+  build: "workflow" | "branch";
+  /**
+   * Custom domain / CNAME (e.g. "docs.theholocron.dev").
+   * When set and `homepage` is absent in holocron.config, setup derives
+   * homepage as `https://{domain}/`.
+   */
+  domain?: string;
+  /** Enforce HTTPS. Only effective once the custom domain is DNS-verified. */
+  https?: boolean;
 }
 type CiRunStatus = "queued" | "in_progress" | "completed" | "cancelled" | "failure" | "success" | "skipped";
 interface CiRun {
@@ -571,4 +591,4 @@ type CardinalityFor<K extends CapabilityKey> = (typeof CARDINALITY)[K];
 type ResolvedCapability<K extends CapabilityKey> = CardinalityFor<K> extends "many" ? CapabilityImpls[K][] : CapabilityImpls[K];
 declare function isMulti<K extends CapabilityKey>(key: K): CardinalityFor<K> extends "many" ? true : false;
 //#endregion
-export { Analytics, Auth, AuthDescription, AuthEvent, AuthEventType, AuthIdentity, AuthUser, CARDINALITY, CapabilityImpls, CapabilityKey, Cardinality, CardinalityFor, Ci, CiRun, CiRunFilter, CiRunStatus, ConnectionStringOptions, CreateAuthUserInput, Deployment, DeploymentProject, DeploymentProjectSettings, DeploymentRecord, DeploymentTarget, DeploymentTrigger, Dns, DnsRecord, DnsRecordType, EnsureResult, Environment, EnvironmentReviewer, Environments, Issue, IssueSearchFilter, Issues, LabelDef, LifecycleResult, LifecycleSlot, NormalizedAuthUser, Notifications, Observability, ParseWebhookInput, ProviderApiError, ProviderIdentity, REQUIRED_CAPABILITIES, RepoRef, RepoSettings, ResolvedCapability, Ruleset, SecretScope, Secrets, Source, StatusCategory, Storage, StorageBranch, TeamEntry, TeamPermission, Tooling, ToolingDoctorReport, TrackerDoctorReport, TrackerUser, Vault, WebhookDashboardInfo, WebhookVerificationError, isMulti };
+export { Analytics, Auth, AuthDescription, AuthEvent, AuthEventType, AuthIdentity, AuthUser, CARDINALITY, CapabilityImpls, CapabilityKey, Cardinality, CardinalityFor, Ci, CiRun, CiRunFilter, CiRunStatus, ConnectionStringOptions, CreateAuthUserInput, Deployment, DeploymentProject, DeploymentProjectSettings, DeploymentRecord, DeploymentTarget, DeploymentTrigger, Dns, DnsRecord, DnsRecordType, EnsureResult, Environment, EnvironmentReviewer, Environments, Issue, IssueSearchFilter, Issues, LabelDef, LifecycleResult, LifecycleSlot, NormalizedAuthUser, Notifications, Observability, PagesConfig, ParseWebhookInput, ProviderApiError, ProviderIdentity, REQUIRED_CAPABILITIES, RepoRef, RepoSettings, ResolvedCapability, Ruleset, SecretScope, Secrets, Source, StatusCategory, Storage, StorageBranch, TeamEntry, TeamPermission, Tooling, ToolingDoctorReport, TrackerDoctorReport, TrackerUser, Vault, WebhookDashboardInfo, WebhookVerificationError, isMulti };

package/dist/cli.mjs

@@ -2,8 +2,7 @@
 import { createRequire } from "node:module";
 import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
 import path, { basename, dirname, join, relative, resolve } from "node:path";
-import { stdin, stdout } from "node:process";
-import { createInterface } from "node:readline";
+import { input, select } from "@inquirer/prompts";
 import yargs from "yargs";
 import { hideBin } from "yargs/helpers";
 import { AuthError, ProviderApiError, ProviderApiError as ProviderApiError$1 } from "@theholocron/http-client";
@@ -248,17 +247,24 @@ function resolveConfig(raw) {
 		providers[key] = resolveEntry(key, entry);
 	}
 	for (const required of REQUIRED_CAPABILITIES) if (!providers[required]) throw new ConfigError(`required capability \`${required}\` is missing from providers`);
+	let docs;
+	if (raw.docs !== void 0) {
+		if (!raw.docs.build) throw new ConfigError("`docs.build` is required when `docs` is set");
+		docs = raw.docs;
+	}
+	const homepage = raw.homepage ?? (docs?.domain ? `https://${docs.domain}/` : void 0);
 	return {
 		name: raw.name,
 		description: raw.description,
-		homepage: raw.homepage,
+		homepage,
 		repo: raw.repo,
 		workflows: raw.workflows,
 		providers,
 		apps: raw.apps ?? [],
 		doctor: raw.doctor ?? {},
 		agent: raw.agent,
-		skills: raw.skills
+		skills: raw.skills,
+		docs
 	};
 }
 //#endregion
@@ -810,19 +816,21 @@ function pad(s, width) {
 /**
 * `holocron new <type> <name>` — create a GitHub repo from a template and
 * bootstrap it by replacing all template-slug casing variants with the new
-* project name.
+* project name, then generate a `holocron.config.ts` from the answers given
+* during the interactive wizard.
 *
 * Flow:
 *   1. Preflight — verify `gh` CLI is available.
-*   2. Resolve type, name, description (prompt via readline if missing).
+*   2. Resolve type, name, description, homepage, vault/deployment/agent options.
 *   3. `gh repo create <org>/<name> --template <org>/<type>-template --private --clone`
 *      → clones to `<cwd>/<name>/`
 *   4. Detect template slug from cloned package.json.
 *   5. Replace all casing variants of the slug across every text file.
-*   6. Replace `<description>` placeholder if a description was given.
-*   7. Commit the patched files (-s for DCO).
-*   8. Unless --no-verify: `pnpm install` in the new repo.
-*   9. Print next steps.
+*   6. Replace `<description>` and `<homepage>` placeholders.
+*   7. Generate and write `holocron.config.ts` based on wizard answers.
+*   8. Commit the patched files (-s for DCO).
+*   9. Unless --no-verify: `pnpm install` in the new repo.
+*  10. Print next steps.
 */
 var NewError = class extends Error {
 	name = "NewError";
@@ -856,6 +864,63 @@ function deriveVariants(slug, name) {
 		return true;
 	});
 }
+/** Validate a repo name: must be lowercase kebab-case. Returns `true` on success or an error string. */
+function validateRepoName(v) {
+	return /^[a-z][a-z0-9-]*$/.test(v.trim()) ? true : "Must be lowercase kebab-case (e.g. my-tool)";
+}
+/** Parse a comma-separated topics string into a trimmed, non-empty array. */
+function parseTopics(raw) {
+	return raw ? String(raw).split(",").map((t) => t.trim()).filter(Boolean) : [];
+}
+/**
+* Generate the content of `holocron.config.ts` for a newly-scaffolded repo.
+* Uses the `node()` preset from `@theholocron/holocron-config` as the baseline
+* and layers in the provider/agent choices made during the wizard.
+*/
+function generateHolocronConfig(opts) {
+	const lines = [
+		`import { defineConfig } from "@theholocron/cli";`,
+		`import { node } from "@theholocron/holocron-config";`,
+		``,
+		`const { repo, workflows, providers } = node();`,
+		`export default defineConfig({`
+	];
+	if (opts.description) lines.push(`\tdescription: ${JSON.stringify(opts.description)},`);
+	if (opts.homepage) lines.push(`\thomepage: ${JSON.stringify(opts.homepage)},`);
+	const topics = opts.topics?.length ? opts.topics : [];
+	const hasRuntimeOverride = opts.runtimeEnvironment != null && opts.runtimeEnvironment !== "node";
+	if (topics.length > 0 || hasRuntimeOverride) {
+		lines.push(`\trepo: {`);
+		if (topics.length > 0) lines.push(`\t\ttopics: ${JSON.stringify(topics)},`);
+		lines.push(`\t\t...repo,`);
+		if (hasRuntimeOverride) lines.push(`\t\tproperties: { ...repo.properties, runtime_environment: ${JSON.stringify(opts.runtimeEnvironment)} },`);
+		lines.push(`\t},`);
+	} else lines.push(`\trepo,`);
+	lines.push(`\tworkflows,`);
+	const hasVault = opts.vaultProvider && opts.vaultProvider !== "none";
+	const hasDeployment = opts.deploymentProvider && opts.deploymentProvider !== "none";
+	if (hasVault || hasDeployment) {
+		lines.push(`\tproviders: {`);
+		lines.push(`\t\t...providers,`);
+		if (opts.vaultProvider === "doppler") {
+			const proj = JSON.stringify(opts.vaultProject ?? opts.name);
+			const cfg = JSON.stringify(opts.vaultConfig ?? "dev");
+			lines.push(`\t\tvault: ["doppler", { project: ${proj}, config: ${cfg} }],`);
+		} else if (opts.vaultProvider === "1password") {
+			const vault = JSON.stringify(opts.vaultProject ?? opts.name);
+			lines.push(`\t\tvault: ["1password", { vault: ${vault} }],`);
+		} else if (opts.vaultProvider === "infisical") {
+			const proj = JSON.stringify(opts.vaultProject ?? opts.name);
+			lines.push(`\t\tvault: ["infisical", { project: ${proj} }],`);
+		}
+		if (opts.deploymentProvider === "vercel") lines.push(`\t\tdeployment: "vercel",`);
+		lines.push(`\t},`);
+	} else lines.push(`\tproviders,`);
+	if (opts.agent && opts.agent !== "none") lines.push(`\tagent: ${JSON.stringify(opts.agent)},`);
+	lines.push(`});`);
+	lines.push(``);
+	return lines.join("\n");
+}
 const SKIP_DIRS$1 = /* @__PURE__ */ new Set([
 	".git",
 	"node_modules",
@@ -877,7 +942,7 @@ function isBinary(content) {
 	for (let i = 0; i < Math.min(content.length, 8e3); i++) if (content.charCodeAt(i) === 0) return true;
 	return false;
 }
-function patchFiles(dir, variants, description, print, readFn, writeFn, walkFn) {
+function patchFiles(dir, variants, description, homepage, runtimeEnvironment, print, readFn, writeFn, walkFn) {
 	const patched = [];
 	for (const filepath of walkFn(dir)) {
 		let content;
@@ -890,6 +955,8 @@ function patchFiles(dir, variants, description, print, readFn, writeFn, walkFn)
 		const original = content;
 		for (const [search, replacement] of variants) content = content.split(search).join(replacement);
 		if (description !== void 0) content = content.split("<description>").join(description);
+		if (homepage !== void 0) content = content.split("<homepage>").join(homepage);
+		if (runtimeEnvironment !== void 0) content = content.split("<runtime_environment>").join(runtimeEnvironment);
 		if (content !== original) {
 			writeFn(filepath, content);
 			print(`  ✓ ${path.relative(dir, filepath)}`);
@@ -932,6 +999,9 @@ async function runNew(input) {
 		print(`  Would clone to ${repoDir}`);
 		print(`  Would patch all casing variants of "${input.type}-template" → "${input.name}"`);
 		if (input.description) print(`  Would replace <description> → "${input.description}"`);
+		if (input.homepage) print(`  Would replace <homepage> → "${input.homepage}"`);
+		if (input.runtimeEnvironment) print(`  Would replace <runtime_environment> → "${input.runtimeEnvironment}"`);
+		print(`  Would generate holocron.config.ts`);
 		return { status: "dry-run" };
 	}
 	if (existsSync(repoDir)) throw new NewError(`\`${repoDir}\` already exists — delete it or pick a different name.`);
@@ -955,27 +1025,40 @@ async function runNew(input) {
 	const pkgJsonPath = path.join(repoDir, "package.json");
 	if (existsSync(pkgJsonPath)) try {
 		const pkg = JSON.parse(readFn(pkgJsonPath));
-		if (typeof pkg.name === "string") templateSlug = pkg.name.split("/").pop() ?? templateSlug;
+		if (typeof pkg.name === "string") templateSlug = pkg.name.split("/").at(-1) || templateSlug;
 	} catch {}
 	print(`  Detected template slug: ${templateSlug}`);
 	print(`  Patching files…`);
-	const filesPatched = patchFiles(repoDir, deriveVariants(templateSlug, input.name), input.description, print, readFn, writeFn, walkFn);
+	const filesPatched = patchFiles(repoDir, deriveVariants(templateSlug, input.name), input.description, input.homepage, input.runtimeEnvironment, print, readFn, writeFn, walkFn);
 	print(`  ${filesPatched.length} file${filesPatched.length === 1 ? "" : "s"} patched`);
-	if (filesPatched.length > 0) {
-		execFn("git", ["add", "-A"], {
-			cwd: repoDir,
-			stdio: "inherit"
-		});
-		execFn("git", [
-			"commit",
-			"-s",
-			"-m",
-			`chore: bootstrap from ${templateSlug}`
-		], {
-			cwd: repoDir,
-			stdio: "inherit"
-		});
-	}
+	const configContent = generateHolocronConfig({
+		name: input.name,
+		type: input.type,
+		description: input.description,
+		homepage: input.homepage,
+		vaultProvider: input.vaultProvider,
+		vaultProject: input.vaultProject,
+		vaultConfig: input.vaultConfig,
+		deploymentProvider: input.deploymentProvider,
+		agent: input.agent,
+		runtimeEnvironment: input.runtimeEnvironment,
+		topics: input.topics
+	});
+	writeFn(path.join(repoDir, "holocron.config.ts"), configContent);
+	print(`  Generated holocron.config.ts`);
+	execFn("git", ["add", "-A"], {
+		cwd: repoDir,
+		stdio: "inherit"
+	});
+	execFn("git", [
+		"commit",
+		"-s",
+		"-m",
+		`chore: bootstrap from ${templateSlug}`
+	], {
+		cwd: repoDir,
+		stdio: "inherit"
+	});
 	if (!input.noVerify) {
 		print("");
 		print("  Installing dependencies…");
@@ -993,16 +1076,27 @@ async function runNew(input) {
 				message: "pnpm install failed; inspect output above"
 			};
 		}
+		print("");
+		print("  Running holocron setup…");
+		try {
+			execFn("holocron", ["setup"], {
+				cwd: repoDir,
+				stdio: "inherit"
+			});
+		} catch {
+			print("  ✗ holocron setup failed — run it manually after checking your config");
+		}
 	}
 	print("");
 	print(`  Scaffolded ${newRepo} (${filesPatched.length} file${filesPatched.length === 1 ? "" : "s"} patched).`);
 	print("");
 	print("  Next:");
 	print(`    1. cd ${repoDir}`);
-	if (input.noVerify) print(`    2. pnpm install`);
-	const step = input.noVerify ? 3 : 2;
-	print(`    ${step}. holocron setup  # wire up secrets, teams, labels, etc.`);
-	print(`    ${step + 1}. git push -u origin HEAD`);
+	if (input.noVerify) {
+		print(`    2. pnpm install`);
+		print(`    3. holocron setup  # wire up secrets, teams, labels, etc.`);
+		print(`    4. git push -u origin HEAD`);
+	} else print(`    2. git push -u origin HEAD`);
 	return {
 		status: "ok",
 		repoDir,
@@ -2070,6 +2164,18 @@ export default defineConfig({
 *      pnpm --filter <pkg> typecheck lint test.
 *   6. Print next steps.
 */
+/**
+* Resolve `capability`, `vendorEnv`, and `baseUrl` from argv or by calling
+* the supplied prompt functions for any that are absent. Extracted from
+* `cli.ts` so the resolution logic is unit-testable.
+*/
+async function resolvePluginCreateInputs(args, prompts) {
+	return {
+		capability: args.capability ?? await prompts.selectCapability(),
+		vendorEnv: args.vendorEnv ?? await prompts.inputVendorEnv(),
+		baseUrl: args.baseUrl ?? await prompts.inputBaseUrl()
+	};
+}
 var PluginCreateError = class extends Error {
 	name = "PluginCreateError";
 };
@@ -3173,6 +3279,29 @@ async function runSetup(input) {
 			print(formatStep(steps[steps.length - 1]));
 		}
 	}
+	if (loader.has("source") && config.docs) {
+		const source = loader.get("source");
+		const deployToken = process.env.HOLOCRON_DEPLOY_TOKEN;
+		print(style.step("docs"));
+		if (!deployToken) {
+			steps.push({
+				capability: "source",
+				step: "configure GitHub Pages",
+				status: "skip",
+				message: "HOLOCRON_DEPLOY_TOKEN not set — skipping Pages setup"
+			});
+			print(formatStep(steps[steps.length - 1]));
+		} else if (source.configurePages) {
+			steps.push(await runStep("source", "configure GitHub Pages", dryRun, async () => {
+				await source.configurePages(config.docs, deployToken);
+				const parts = [config.docs.build];
+				if (config.docs.domain) parts.push(`domain: ${config.docs.domain}`);
+				if (config.docs.https) parts.push("https: enforced");
+				return parts.join(", ");
+			}));
+			print(formatStep(steps[steps.length - 1]));
+		}
+	}
 	if (loader.has("deployment")) {
 		const deploy = loader.get("deployment");
 		print(style.step("deployment"));
@@ -3916,7 +4045,7 @@ var lint_default = "name: Lint\n\non: # yamllint disable-line rule:truthy\n  wor
 var release_default = "name: Release\n\n# Semantic-release with OIDC Trusted Publishing.\n# actions/setup-node writes a default NODE_AUTH_TOKEN=${{ github.token }}\n# which shadows OIDC auth. We explicitly clear it so npm falls through to\n# the Trusted Publisher OIDC exchange.\n# The calling repo must have a .releaserc.json that configures branches,\n# plugins, and any publish options. npm@11+ is installed to support OIDC.\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      run-build:\n        description: Run `pnpm build` before releasing\n        type: boolean\n        required: false\n        default: true\n      sentry-project:\n        description: >\n          Sentry project slug for sourcemap upload and release creation after\n          publishing. Omit to skip the Sentry release step entirely.\n        type: string\n        required: false\n        default: \"\"\n    secrets:\n      HOLOCRON_RELEASE_TOKEN:\n        description: >\n          Fine-grained PAT (Contents + Issues + Pull requests: write) owned by\n          an admin. Required when the default branch is protected by a ruleset —\n          github.token cannot push through rulesets, but an admin PAT can.\n          Takes priority over HOLOCRON_SYNC_TOKEN. Falls back to github.token.\n        required: false\n      HOLOCRON_SYNC_TOKEN:\n        description: >\n          Legacy alias for HOLOCRON_RELEASE_TOKEN — kept for backward compatibility.\n          Prefer HOLOCRON_RELEASE_TOKEN for new repos.\n        required: false\n      HOLOCRON_READ_TOKEN:\n        description: >\n          Fine-grained PAT for read-only GitHub API calls (e.g. resolving git\n          committer identity via `gh api user`). Falls back to github.token.\n        required: false\n      GH_TOKEN:\n        description: >\n          Generic GitHub token fallback for `gh` CLI calls. Used when\n          HOLOCRON_READ_TOKEN is not set.\n        required: false\n      SENTRY_AUTH_TOKEN:\n        description: >\n          Sentry auth token for sourcemap upload and release creation.\n          Required when sentry-project is set. Use the org-level secret.\n        required: false\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  release:\n    name: Semantic release\n    permissions:\n      contents: write\n      id-token: write\n      issues: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    # Do not cancel in-progress releases — a partial release is worse than a slow one.\n    concurrency:\n      group: release-${{ github.ref }}\n      cancel-in-progress: false\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n          persist-credentials: false\n          # Use HOLOCRON_RELEASE_TOKEN when available — git push (tags, release commits)\n          # uses the checkout credential, not GITHUB_TOKEN env var. The\n          # built-in github.token cannot push through branch protection rulesets.\n          token: ${{ secrets.HOLOCRON_RELEASE_TOKEN || secrets.HOLOCRON_SYNC_TOKEN || github.token }}\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - name: Configure git identity\n        run: |\n          GIT_NAME=$(gh api user --jq .name 2>/dev/null || echo \"github-actions[bot]\")\n          GIT_EMAIL=$(gh api user --jq '\"\\(.id)+\\(.login)@users.noreply.github.com\"' 2>/dev/null || echo \"41898282+github-actions[bot]@users.noreply.github.com\")\n          git config --global user.name \"$GIT_NAME\"\n          git config --global user.email \"$GIT_EMAIL\"\n          git config --global format.signoff true\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_READ_TOKEN || secrets.GH_TOKEN || github.token }}\n\n      - name: Upgrade npm for OIDC support\n        run: npm install -g npm@11 sigstore\n        # sigstore is required by libnpmpublish/provenance.js at module parse\n        # time — before any config takes effect. Some npm 11.x builds stopped\n        # bundling it; installing it globally into the same prefix ensures it\n        # resolves regardless of npm version. (Discovered 2026-07-09.)\n\n      - run: pnpm build\n        name: Build\n        if: ${{ inputs.run-build == true }}\n\n      - run: npx semantic-release\n        name: Release\n        env:\n          # Prefer HOLOCRON_RELEASE_TOKEN (fine-grained PAT, Contents+Issues+PRs write,\n          # owned by an admin with ruleset bypass) so @semantic-release/git can\n          # push the version-bump commit through branch protection. Falls back to\n          # HOLOCRON_SYNC_TOKEN (legacy) then github.token for unprotected repos.\n          GITHUB_TOKEN: ${{ secrets.HOLOCRON_RELEASE_TOKEN || secrets.HOLOCRON_SYNC_TOKEN || github.token }}\n          HUSKY: \"0\"\n          NPM_CONFIG_PROVENANCE: true\n\n      - name: Get release version\n        id: release_version\n        if: ${{ inputs.sentry-project != '' }}\n        env:\n          SENTRY_PROJECT: ${{ inputs.sentry-project }}\n        run: |\n          TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo \"\")\n          if [ -n \"$TAG\" ]; then\n            echo \"release=${SENTRY_PROJECT}@${TAG#v}\" >> \"$GITHUB_OUTPUT\"\n          fi\n\n      - name: Create Sentry release\n        if: ${{ inputs.sentry-project != '' && steps.release_version.outputs.release != '' }}\n        uses: getsentry/action-release@ff07929a6537bac57790c3451cf4d364aca38528 # v3\n        env:\n          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}\n          SENTRY_ORG: theholocron\n          SENTRY_PROJECT: ${{ inputs.sentry-project }}\n        with:\n          environment: production\n          version: ${{ steps.release_version.outputs.release }}\n          sourcemaps: \"**/dist\"\n";
 //#endregion
 //#region src/templates/workflows/review.yml
-var review_default = "name: Review\n\n# ReviewDog is the annotation layer — posts inline PR diff annotations.\n# Runs on pull_request only: inline annotations require PR context,\n# and branch protection ensures all changes go through PRs anyway.\n# super-linter (lint.yml) is the CI gate covering push + PR events.\n# Gitleaks and YAML are intentionally duplicated: super-linter gates\n# merges; ReviewDog surfaces exact line annotations in the PR diff.\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n\nconcurrency:\n  group: review-${{ github.workflow }}-${{ github.ref }}\n  cancel-in-progress: true\n\njobs:\n  reviewdog:\n    name: Review PRs\n    runs-on: ubuntu-latest\n    timeout-minutes: 20\n    permissions:\n      contents: read\n      pull-requests: write\n\n    steps:\n      - name: Checkout repository\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          fetch-depth: 0\n\n      - name: Setup\n        if: ${{ hashFiles('pnpm-lock.yaml') != '' }}\n        uses: theholocron/.github/.github/actions/setup@main\n\n      - name: Install ReviewDog\n        uses: reviewdog/action-setup@d8a7baabd7f3e8544ee4dbde3ee41d0011c3a93f # v1\n        with:\n          reviewdog_version: latest\n\n      # Detect which tools are relevant for this repo, excluding node_modules.\n      # hashFiles('**/*') recurses into node_modules/.pnpm and produces false\n      # positives for repos that don't own those file types.\n      # -print -quit stops find after the first match without a pipe, avoiding\n      # the SIGPIPE/pipefail exit-141 that find|head-1 triggers under\n      # GitHub Actions' default bash --noprofile --norc -e -o pipefail mode.\n      - name: Detect project features\n        id: detect\n        shell: bash\n        run: |\n          has() { find . -not -path '*/node_modules/*' -name \"$1\" -print -quit 2>/dev/null | grep -q .; }\n          has_ext() { find . -not -path '*/node_modules/*' -name \"$1\" -print -quit 2>/dev/null | grep -q .; }\n          { { has 'eslint.config.js' || has 'eslint.config.mjs' || has 'eslint.config.cjs' || \\\n              has 'eslint.config.ts' || has '.eslintrc' || has '.eslintrc.js' || \\\n              has '.eslintrc.cjs' || has '.eslintrc.json' || has '.eslintrc.yaml' || \\\n              has '.eslintrc.yml'; } && grep -qF '\"eslint\":' package.json 2>/dev/null; } && echo \"eslint=true\" >> \"$GITHUB_OUTPUT\" || echo \"eslint=false\" >> \"$GITHUB_OUTPUT\"\n          { has 'tsconfig.json' && grep -qF '\"typescript\":' package.json 2>/dev/null; } && echo \"tsconfig=true\" >> \"$GITHUB_OUTPUT\" || echo \"tsconfig=false\" >> \"$GITHUB_OUTPUT\"\n          has_ext '*.sh' && echo \"shell=true\" >> \"$GITHUB_OUTPUT\" || echo \"shell=false\" >> \"$GITHUB_OUTPUT\"\n          has 'Dockerfile' || has_ext '*.Dockerfile' || has 'Containerfile' && \\\n            echo \"docker=true\" >> \"$GITHUB_OUTPUT\" || echo \"docker=false\" >> \"$GITHUB_OUTPUT\"\n          has_ext '.env*' && echo \"dotenv=true\" >> \"$GITHUB_OUTPUT\" || echo \"dotenv=false\" >> \"$GITHUB_OUTPUT\"\n          has_ext '*.md' && echo \"markdown=true\" >> \"$GITHUB_OUTPUT\" || echo \"markdown=false\" >> \"$GITHUB_OUTPUT\"\n\n      #\n      # Always applicable\n      #\n\n      - name: Gitleaks (secrets)\n        uses: reviewdog/action-gitleaks@2b7b5685e3e3eecddab5d30cfa04f18123031421 # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / gitleaks\"\n          gitleaks_flags: --log-opts=${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }}\n\n      - name: YamlLint\n        if: ${{ hashFiles('yamllint.config.yml') != '' }}\n        uses: reviewdog/action-yamllint@b5f7217d8c815ae374d1d55840d5e569d82f01f0 # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / yamllint\"\n          yamllint_flags: -c ${{ github.workspace }}/yamllint.config.yml ${{ github.workspace }}\n\n      - name: ActionLint (GitHub Actions)\n        if: ${{ hashFiles('.github/workflows/*.yml', '.github/workflows/*.yaml') != '' }}\n        uses: reviewdog/action-actionlint@6fb7acc99f4a1008869fa8a0f09cfca740837d9d # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / actionlint\"\n\n      #\n      # TypeScript / JavaScript\n      #\n\n      - name: ESLint\n        if: steps.detect.outputs.eslint == 'true'\n        uses: reviewdog/action-eslint@556a3fdaf8b4201d4d74d406013386aa4f7dab96 # v1.34.0\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / eslint\"\n          eslint_flags: .\n\n      - name: TypeScript\n        if: steps.detect.outputs.tsconfig == 'true'\n        uses: EPMatt/reviewdog-action-tsc@63d923a3c5b4497671940b8874f58a404e2351b5 # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / tsc\"\n\n      #\n      # Shell\n      #\n\n      - name: ShellCheck\n        if: steps.detect.outputs.shell == 'true'\n        uses: reviewdog/action-shellcheck@4c07458293ac342d477251099501a718ae5ef86e # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / shellcheck\"\n          fail_level: none\n\n      #\n      # Docker\n      #\n\n      - name: Hadolint\n        if: steps.detect.outputs.docker == 'true'\n        uses: reviewdog/action-hadolint@1b2cfa6ba72072ad35158d7ff3aa49bbdc03506d # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / hadolint\"\n          fail_level: none\n\n      #\n      # Environment files\n      #\n\n      - name: dotenv-linter\n        if: steps.detect.outputs.dotenv == 'true'\n        uses: dotenv-linter/action-dotenv-linter@afde61cfda2ecffe7bea35837b6f20b956c88689 # v3.0.0\n        with:\n          reporter: github-code-suggestions\n\n      #\n      # Documentation\n      #\n\n      - name: Alex (inclusive language)\n        if: steps.detect.outputs.markdown == 'true'\n        uses: reviewdog/action-alex@347481655add010a2ae302df34b57c9bcfa0d6e4 # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / alex\"\n";
+var review_default = "name: Review\n\n# ReviewDog is the annotation layer — posts inline PR diff annotations.\n# Runs on pull_request only: inline annotations require PR context,\n# and branch protection ensures all changes go through PRs anyway.\n# super-linter (lint.yml) is the CI gate covering push + PR events.\n# Gitleaks and YAML are intentionally duplicated: super-linter gates\n# merges; ReviewDog surfaces exact line annotations in the PR diff.\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n\nconcurrency:\n  group: review-${{ github.workflow }}-${{ github.ref }}\n  cancel-in-progress: true\n\njobs:\n  reviewdog:\n    name: Review PRs\n    runs-on: ubuntu-latest\n    timeout-minutes: 20\n    permissions:\n      contents: read\n      pull-requests: write\n\n    steps:\n      - name: Checkout repository\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          fetch-depth: 0\n\n      - name: Setup\n        if: ${{ hashFiles('pnpm-lock.yaml') != '' }}\n        uses: theholocron/.github/.github/actions/setup@main\n\n      - name: Install ReviewDog\n        uses: reviewdog/action-setup@d8a7baabd7f3e8544ee4dbde3ee41d0011c3a93f # v1\n        with:\n          reviewdog_version: latest\n\n      # Detect which tools are relevant for this repo, excluding node_modules.\n      # hashFiles('**/*') recurses into node_modules/.pnpm and produces false\n      # positives for repos that don't own those file types.\n      # -print -quit stops find after the first match without a pipe, avoiding\n      # the SIGPIPE/pipefail exit-141 that find|head-1 triggers under\n      # GitHub Actions' default bash --noprofile --norc -e -o pipefail mode.\n      - name: Detect project features\n        id: detect\n        shell: bash\n        run: |\n          has() { find . -not -path '*/node_modules/*' -name \"$1\" -print -quit 2>/dev/null | grep -q .; }\n          has_ext() { find . -not -path '*/node_modules/*' -name \"$1\" -print -quit 2>/dev/null | grep -q .; }\n          { { has 'eslint.config.js' || has 'eslint.config.mjs' || has 'eslint.config.cjs' || \\\n              has 'eslint.config.ts' || has '.eslintrc' || has '.eslintrc.js' || \\\n              has '.eslintrc.cjs' || has '.eslintrc.json' || has '.eslintrc.yaml' || \\\n              has '.eslintrc.yml'; } && grep -qF '\"eslint\":' package.json 2>/dev/null; } && echo \"eslint=true\" >> \"$GITHUB_OUTPUT\" || echo \"eslint=false\" >> \"$GITHUB_OUTPUT\"\n          { has 'tsconfig.json' && grep -qF '\"typescript\":' package.json 2>/dev/null; } && echo \"tsconfig=true\" >> \"$GITHUB_OUTPUT\" || echo \"tsconfig=false\" >> \"$GITHUB_OUTPUT\"\n          has_ext '*.sh' && echo \"shell=true\" >> \"$GITHUB_OUTPUT\" || echo \"shell=false\" >> \"$GITHUB_OUTPUT\"\n          has 'Dockerfile' || has_ext '*.Dockerfile' || has 'Containerfile' && \\\n            echo \"docker=true\" >> \"$GITHUB_OUTPUT\" || echo \"docker=false\" >> \"$GITHUB_OUTPUT\"\n          has_ext '.env*' && echo \"dotenv=true\" >> \"$GITHUB_OUTPUT\" || echo \"dotenv=false\" >> \"$GITHUB_OUTPUT\"\n          has_ext '*.md' && echo \"markdown=true\" >> \"$GITHUB_OUTPUT\" || echo \"markdown=false\" >> \"$GITHUB_OUTPUT\"\n\n      #\n      # Always applicable\n      #\n\n      - name: Gitleaks (secrets)\n        uses: reviewdog/action-gitleaks@2b7b5685e3e3eecddab5d30cfa04f18123031421 # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / gitleaks\"\n          fail_level: error\n          gitleaks_flags: --log-opts=${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }}\n\n      - name: YamlLint\n        if: ${{ hashFiles('yamllint.config.yml') != '' }}\n        uses: reviewdog/action-yamllint@b5f7217d8c815ae374d1d55840d5e569d82f01f0 # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / yamllint\"\n          fail_level: error\n          yamllint_flags: -c ${{ github.workspace }}/yamllint.config.yml ${{ github.workspace }}\n\n      - name: ActionLint (GitHub Actions)\n        if: ${{ hashFiles('.github/workflows/*.yml', '.github/workflows/*.yaml') != '' }}\n        uses: reviewdog/action-actionlint@6fb7acc99f4a1008869fa8a0f09cfca740837d9d # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / actionlint\"\n          fail_level: error\n\n      #\n      # TypeScript / JavaScript\n      #\n\n      - name: ESLint\n        if: steps.detect.outputs.eslint == 'true'\n        uses: reviewdog/action-eslint@556a3fdaf8b4201d4d74d406013386aa4f7dab96 # v1.34.0\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / eslint\"\n          fail_level: error\n          eslint_flags: .\n\n      - name: TypeScript\n        if: steps.detect.outputs.tsconfig == 'true'\n        uses: EPMatt/reviewdog-action-tsc@63d923a3c5b4497671940b8874f58a404e2351b5 # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / tsc\"\n          fail_level: error\n\n      #\n      # Shell\n      #\n\n      - name: ShellCheck\n        if: steps.detect.outputs.shell == 'true'\n        uses: reviewdog/action-shellcheck@4c07458293ac342d477251099501a718ae5ef86e # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / shellcheck\"\n          fail_level: none\n\n      #\n      # Docker\n      #\n\n      - name: Hadolint\n        if: steps.detect.outputs.docker == 'true'\n        uses: reviewdog/action-hadolint@1b2cfa6ba72072ad35158d7ff3aa49bbdc03506d # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / hadolint\"\n          fail_level: none\n\n      #\n      # Environment files\n      #\n\n      - name: dotenv-linter\n        if: steps.detect.outputs.dotenv == 'true'\n        uses: dotenv-linter/action-dotenv-linter@afde61cfda2ecffe7bea35837b6f20b956c88689 # v3.0.0\n        with:\n          reporter: github-code-suggestions\n\n      #\n      # Documentation\n      #\n\n      - name: Alex (inclusive language)\n        if: steps.detect.outputs.markdown == 'true'\n        uses: reviewdog/action-alex@347481655add010a2ae302df34b57c9bcfa0d6e4 # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / alex\"\n";
 //#endregion
 //#region src/templates/workflows/stale.yml
 var stale_default = "name: Stale\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      days-before-stale:\n        description: Days of inactivity before an issue is marked stale\n        type: number\n        required: false\n        default: 30\n      days-before-close:\n        description: Days of inactivity after stale label before closing\n        type: number\n        required: false\n        default: 5\n\njobs:\n  stale:\n    name: Mark stale issues and pull requests\n    permissions:\n      contents: write\n      issues: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    steps:\n      - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0\n        name: Run Stale\n        with:\n          close-issue-message: >\n            This issue was closed because it has been stalled for\n            ${{ inputs.days-before-close }} days with no activity.\n          days-before-close: ${{ inputs.days-before-close }}\n          days-before-stale: ${{ inputs.days-before-stale }}\n          exempt-all-pr-milestones: true\n          stale-issue-label: wontfix\n          stale-issue-message: >\n            This issue is stale because it has been open ${{ inputs.days-before-stale }}\n            days with no activity. Remove the stale label or comment, or this will be\n            closed in ${{ inputs.days-before-close }} days.\n          stale-pr-label: wontfix\n          stale-pr-message: >\n            This PR is stale because it has been open ${{ inputs.days-before-stale }}\n            days with no activity. Remove the stale label or comment, or this will be\n            closed in ${{ inputs.days-before-close }} days.\n";
@@ -3925,7 +4054,7 @@ var stale_default = "name: Stale\n\non: # yamllint disable-line rule:truthy\n  w
 var sync_github_default = "name: Sync GitHub Templates\n\n# Builds the holocron CLI from source and pushes updated workflow templates\n# and composite actions to downstream .github repos. Runs whenever the\n# template source files change on main or alpha.\n#\n# Secrets required:\n#   HOLOCRON_SYNC_TOKEN — fine-grained PAT (resource owner: org) with:\n#                  Contents:      Read and write  (git trees, blobs, refs)\n#                  Pull requests: Read and write  (open sync PR)\n#                  Workflows:     Read and write  (write .github/workflows/*.yml)\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      primary-repo:\n        description: >\n          Primary .github repo — receives composite actions, reusable workflows,\n          and thin-caller templates. Requires a PR (branch protection assumed).\n        type: string\n        required: false\n        default: theholocron/.github\n      secondary-repos:\n        description: >\n          Space-separated list of secondary repos (reusable workflows + thin\n          callers only, no composite actions). Changes are delivered via pull\n          request, same as the primary repo.\n        type: string\n        required: false\n        default: \"\"\n      sync-branch:\n        description: Branch name used for the primary and secondary repo PRs\n        type: string\n        required: false\n        default: chore/sync-templates\n    secrets:\n      HOLOCRON_SYNC_TOKEN:\n        required: true\n      HOLOCRON_READ_TOKEN:\n        description: >\n          Fine-grained PAT for read-only GitHub API calls (e.g. resolving git\n          committer identity via `gh api user`). Falls back to HOLOCRON_SYNC_TOKEN.\n        required: false\n      GH_TOKEN:\n        description: >\n          Generic GitHub token fallback for `gh` CLI calls. Used when neither\n          HOLOCRON_READ_TOKEN nor HOLOCRON_SYNC_TOKEN is set.\n        required: false\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  sync:\n    name: Sync templates\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    permissions:\n      contents: read\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: pnpm build\n        name: Build CLI\n\n      - name: Cache actionlint\n        id: cache-actionlint\n        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0\n        with:\n          path: /tmp/actionlint\n          key: actionlint-v1.7.7-linux-amd64\n\n      - name: Download actionlint\n        if: steps.cache-actionlint.outputs.cache-hit != 'true'\n        run: |\n          curl -fsSL https://github.com/rhysd/actionlint/releases/download/v1.7.7/actionlint_1.7.7_linux_amd64.tar.gz \\\n            | tar -xz -C /tmp actionlint\n\n      - name: Validate generated workflows\n        run: |\n          node packages/cli/dist/cli.mjs sync-github \\\n            --repo \"$PRIMARY_REPO\" \\\n            --output-dir /tmp/sync-validate\n          /tmp/actionlint /tmp/sync-validate/.github/workflows/*.yml\n        env:\n          PRIMARY_REPO: ${{ inputs.primary-repo }}\n\n      - name: Sync primary repo (PR)\n        run: |\n          GIT_NAME=$(gh api user --jq .name 2>/dev/null || echo \"github-actions[bot]\")\n          GIT_EMAIL=$(gh api user --jq '\"\\(.id)+\\(.login)@users.noreply.github.com\"' 2>/dev/null || echo \"41898282+github-actions[bot]@users.noreply.github.com\")\n          COMMIT_MSG=\"chore: sync from theholocron/holocron\"$'\\n\\n'\"Signed-off-by: $GIT_NAME <$GIT_EMAIL>\"\n          node packages/cli/dist/cli.mjs sync-github \\\n            --repo \"$PRIMARY_REPO\" \\\n            --branch \"$SYNC_BRANCH\" \\\n            --pr \\\n            --message \"$COMMIT_MSG\"\n          GH_TOKEN=\"$HOLOCRON_SYNC_TOKEN\" gh pr merge --auto --squash \\\n            --repo \"$PRIMARY_REPO\" \"$SYNC_BRANCH\" 2>/dev/null || true\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_READ_TOKEN || secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN }}\n          HOLOCRON_SYNC_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN }}\n          PRIMARY_REPO: ${{ inputs.primary-repo }}\n          SYNC_BRANCH: ${{ inputs.sync-branch }}\n\n      - name: Sync secondary repos (PR)\n        if: ${{ inputs.secondary-repos != '' }}\n        run: |\n          GIT_NAME=$(gh api user --jq .name 2>/dev/null || echo \"github-actions[bot]\")\n          GIT_EMAIL=$(gh api user --jq '\"\\(.id)+\\(.login)@users.noreply.github.com\"' 2>/dev/null || echo \"41898282+github-actions[bot]@users.noreply.github.com\")\n          COMMIT_MSG=\"chore: sync from theholocron/holocron\"$'\\n\\n'\"Signed-off-by: $GIT_NAME <$GIT_EMAIL>\"\n          for repo in $SECONDARY_REPOS; do\n            node packages/cli/dist/cli.mjs sync-github \\\n              --repo \"$repo\" \\\n              --branch \"$SYNC_BRANCH\" \\\n              --pr \\\n              --message \"$COMMIT_MSG\"\n            GH_TOKEN=\"$HOLOCRON_SYNC_TOKEN\" gh pr merge --auto --squash \\\n              --repo \"$repo\" \"$SYNC_BRANCH\" 2>/dev/null || true\n          done\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_READ_TOKEN || secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN }}\n          HOLOCRON_SYNC_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN }}\n          SECONDARY_REPOS: ${{ inputs.secondary-repos }}\n          SYNC_BRANCH: ${{ inputs.sync-branch }}\n";
 //#endregion
 //#region src/templates/workflows/test.yml
-var test_default = "name: Test\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  unit:\n    name: Run tests and collect coverage\n    permissions:\n      contents: read\n      id-token: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: pnpm test -- --coverage\n        name: Run tests with coverage\n\n      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0\n        name: Upload coverage to Codecov\n        with:\n          use_oidc: true\n\n      - uses: codecov/test-results-action@0fa95f0e1eeaafde2c782583b36b28ad0d8c77d3 # v1\n        name: Upload test results to Codecov\n        if: ${{ !cancelled() }}\n        with:\n          use_oidc: true\n          files: '**/test-report.junit.xml'\n";
+var test_default = "name: Test\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  unit:\n    name: Run tests and collect coverage\n    permissions:\n      contents: read\n      id-token: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: pnpm test:coverage\n        name: Run tests with coverage\n\n      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0\n        name: Upload coverage to Codecov\n        with:\n          use_oidc: true\n\n      - uses: codecov/test-results-action@0fa95f0e1eeaafde2c782583b36b28ad0d8c77d3 # v1\n        name: Upload test results to Codecov\n        if: ${{ !cancelled() }}\n        with:\n          use_oidc: true\n          files: '**/test-report.junit.xml'\n";
 //#endregion
 //#region src/templates/workflows/typecheck.yml
 var typecheck_default = "name: Typecheck\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  typecheck:\n    name: tsc --noEmit\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: pnpm typecheck\n        name: Type check\n";
@@ -5058,6 +5187,24 @@ try {
 	}).option("description", {
 		type: "string",
 		describe: "Short description — replaces <description> placeholders in the template"
+	}).option("homepage", {
+		type: "string",
+		describe: "Homepage URL — replaces <homepage> placeholders and appears in holocron.config.ts"
+	}).option("vault", {
+		type: "string",
+		describe: "Vault provider: none, doppler, 1password, infisical"
+	}).option("deployment", {
+		type: "string",
+		describe: "Deployment provider: none, vercel"
+	}).option("agent", {
+		type: "string",
+		describe: "AI agent: claude, none"
+	}).option("runtime-environment", {
+		type: "string",
+		describe: "Runtime environment: node, browser, universal, none"
+	}).option("topics", {
+		type: "string",
+		describe: "Comma-separated repo topics (e.g. typescript,nodejs)"
 	}).option("org", {
 		type: "string",
 		default: "theholocron",
@@ -5065,29 +5212,135 @@ try {
 	}).option("verify", {
 		type: "boolean",
 		default: true,
-		describe: "Run pnpm install after bootstrapping (default true; --no-verify skips)"
+		describe: "Run pnpm install + holocron setup after bootstrapping (--no-verify skips)"
 	}), async (argv) => {
 		try {
 			let type = argv.type;
 			let name = argv.name;
 			let description = argv.description;
-			if (!type || !name || description === void 0) {
-				const rl = createInterface({
-					input: stdin,
-					output: stdout
-				});
-				const ask = (question) => new Promise((resolve) => rl.question(`  ${question} `, (answer) => resolve(answer.trim())));
-				try {
-					if (!type) {
-						console.log("  Known types: base, cli, monorepo, nextjs, node, react");
-						type = await ask("Template type:");
+			let homepage = argv.homepage;
+			let vaultProvider = argv.vault;
+			let vaultProject;
+			let vaultConfig;
+			let deploymentProvider = argv.deployment;
+			let agent = argv.agent;
+			let runtimeEnvironment = argv.runtimeEnvironment;
+			let topics = parseTopics(argv.topics);
+			if (!type) type = await select({
+				message: "Template type:",
+				choices: [
+					{
+						name: "node    — Node.js library or tool",
+						value: "node"
+					},
+					{
+						name: "cli     — CLI application (inquirer, chalk, yargs)",
+						value: "cli"
+					},
+					{
+						name: "monorepo — Turbo monorepo",
+						value: "monorepo"
+					},
+					{
+						name: "react   — React component library",
+						value: "react"
+					},
+					{
+						name: "nextjs  — Next.js application",
+						value: "nextjs"
+					},
+					{
+						name: "base    — Minimal repo (no package.json)",
+						value: "base"
 					}
-					if (!name) name = await ask("Repo name (kebab-case):");
-					if (description === void 0) description = await ask("Short description (Enter to skip):");
-				} finally {
-					rl.close();
-				}
+				]
+			});
+			if (!name) {
+				name = await input({
+					message: "Repo name (kebab-case):",
+					validate: validateRepoName
+				});
+				name = name.trim();
 			}
+			if (description === void 0) description = await input({ message: "Short description:" });
+			if (homepage === void 0) homepage = (await input({ message: "Homepage URL (optional, Enter to skip):" })).trim() || void 0;
+			if (!runtimeEnvironment) runtimeEnvironment = await select({
+				message: "Runtime environment:",
+				choices: [
+					{
+						name: "node      — Node.js process",
+						value: "node"
+					},
+					{
+						name: "browser   — Browser only",
+						value: "browser"
+					},
+					{
+						name: "universal — Node.js + browser",
+						value: "universal"
+					},
+					{
+						name: "none      — No runtime (docs, config, etc.)",
+						value: "none"
+					}
+				],
+				default: type === "base" ? "none" : "node"
+			});
+			if (!vaultProvider) vaultProvider = await select({
+				message: "Vault provider:",
+				choices: [
+					{
+						name: "None",
+						value: "none"
+					},
+					{
+						name: "Doppler",
+						value: "doppler"
+					},
+					{
+						name: "1Password",
+						value: "1password"
+					},
+					{
+						name: "Infisical",
+						value: "infisical"
+					}
+				]
+			});
+			if (vaultProvider === "doppler") {
+				vaultProject = await input({
+					message: "Doppler project name:",
+					default: name
+				});
+				vaultConfig = await input({
+					message: "Doppler config:",
+					default: "dev"
+				});
+			} else if (vaultProvider === "1password" || vaultProvider === "infisical") vaultProject = await input({
+				message: `${vaultProvider === "1password" ? "1Password vault" : "Infisical project"} name:`,
+				default: name
+			});
+			if (!deploymentProvider) deploymentProvider = await select({
+				message: "Deployment provider:",
+				choices: [{
+					name: "None",
+					value: "none"
+				}, {
+					name: "Vercel",
+					value: "vercel"
+				}]
+			});
+			if (!agent) agent = await select({
+				message: "AI agent:",
+				choices: [{
+					name: "Claude",
+					value: "claude"
+				}, {
+					name: "None",
+					value: "none"
+				}]
+			});
+			if (topics.length === 0) topics = parseTopics(await input({ message: "Topics (comma-separated, optional):" }));
 			if (!type) {
 				console.error("new: template type is required");
 				process.exitCode = 1;
@@ -5101,7 +5354,15 @@ try {
 			if ((await runNew({
 				type,
 				name,
-				...description ? { description } : {},
+				description: description || void 0,
+				homepage,
+				vaultProvider: vaultProvider ?? "none",
+				vaultProject,
+				vaultConfig,
+				deploymentProvider: deploymentProvider ?? "none",
+				agent: agent ?? "claude",
+				runtimeEnvironment: runtimeEnvironment ?? "node",
+				topics,
 				org: argv.org,
 				dryRun: argv.dryRun,
 				noVerify: !argv.verify,
@@ -5141,35 +5402,25 @@ try {
 		describe: "Run post-scaffold pnpm install + typecheck + lint + test (default true; --no-verify skips)"
 	}), async (argv) => {
 		try {
-			const capabilityKeys = Object.keys(CARDINALITY).join(", ");
-			const needsPrompt = !argv.capability || !argv.vendorEnv || !argv.baseUrl;
-			let capability;
-			let vendorEnv;
-			let baseUrl;
-			if (needsPrompt) {
-				const rl = createInterface({
-					input: stdin,
-					output: stdout
-				});
-				const ask = (question) => new Promise((resolve) => rl.question(`  ${question} `, (answer) => resolve(answer.trim())));
-				try {
-					if (!argv.capability) {
-						console.log(`  Available capabilities: ${capabilityKeys}`);
-						capability = await ask("Capability:");
-					} else capability = argv.capability;
-					vendorEnv = argv.vendorEnv ? argv.vendorEnv : await ask(`Vendor-native env var for the ${argv.vendor} token (e.g. MYVENDOR_API_KEY):`);
-					baseUrl = argv.baseUrl ? argv.baseUrl : await ask(`REST base URL for the ${argv.vendor} API (e.g. https://api.myvendor.com):`);
-				} finally {
-					rl.close();
-				}
-			} else {
-				capability = argv.capability;
-				vendorEnv = argv.vendorEnv;
-				baseUrl = argv.baseUrl;
-			}
+			const vendor = argv.vendor;
+			const { capability, vendorEnv, baseUrl } = await resolvePluginCreateInputs({
+				capability: argv.capability,
+				vendorEnv: argv.vendorEnv,
+				baseUrl: argv.baseUrl
+			}, {
+				selectCapability: () => select({
+					message: "Capability:",
+					choices: Object.keys(CARDINALITY).map((k) => ({
+						name: k,
+						value: k
+					}))
+				}),
+				inputVendorEnv: () => input({ message: `Vendor-native env var for the ${vendor} token (e.g. MYVENDOR_API_KEY):` }),
+				inputBaseUrl: () => input({ message: `REST base URL for the ${vendor} API (e.g. https://api.myvendor.com):` })
+			});
 			if (runPluginCreate({
 				slug: argv.slug,
-				vendorName: argv.vendor,
+				vendorName: vendor,
 				capability,
 				vendorEnv,
 				baseUrl,