@theholocron/cli 3.9.0 → 3.9.2

package/dist/cli.mjs

@@ -2616,7 +2616,7 @@ var dependencies_default$1 = "name: Dependencies\n\non: # yamllint disable-line
 var deploy_docs_default$1 = "name: Deploy Docs\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main]\n    paths:\n      - docs/**\n  workflow_dispatch:\n\nconcurrency:\n  group: pages\n  cancel-in-progress: false\n\npermissions:\n  contents: read\n  pages: write\n  id-token: write\n\njobs:\n  deploy-docs:\n    name: Deploy Docs\n    uses: theholocron/.github/.github/workflows/deploy-docs.yml@main\n    secrets: inherit\n";
 //#endregion
 //#region src/commands/workflows/deploy-storybook.yml
-var deploy_storybook_default = "name: Deploy Storybook\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main]\n    paths:\n      - src/**\n      - .storybook/**\n  workflow_dispatch:\n\nconcurrency:\n  group: pages\n  cancel-in-progress: false\n\npermissions:\n  contents: read\n  pages: write\n  id-token: write\n\njobs:\n  deploy-storybook:\n    name: Deploy Storybook\n    uses: theholocron/.github/.github/workflows/deploy-storybook.yml@main\n    secrets: inherit\n";
+var deploy_storybook_default$1 = "name: Deploy Storybook\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main]\n    paths:\n      - src/**\n      - .storybook/**\n  workflow_dispatch:\n\nconcurrency:\n  group: pages\n  cancel-in-progress: false\n\npermissions:\n  contents: read\n  pages: write\n  id-token: write\n\njobs:\n  deploy-storybook:\n    name: Deploy Storybook\n    uses: theholocron/.github/.github/workflows/deploy-storybook.yml@main\n    secrets: inherit\n";
 //#endregion
 //#region src/commands/workflows/greetings.yml
 var greetings_default$1 = "name: Greetings\n\non: # yamllint disable-line rule:truthy\n  pull_request:\n  issues:\n\npermissions:\n  issues: write\n  pull-requests: write\n\njobs:\n  greetings:\n    uses: theholocron/.github/.github/workflows/greetings.yml@main\n    secrets: inherit\n";
@@ -2663,7 +2663,7 @@ const WORKFLOW_TEMPLATES = {
 	bookkeeping: bookkeeping_default$1,
 	audit: audit_default$1,
 	"deploy-docs": deploy_docs_default$1,
-	"deploy-storybook": deploy_storybook_default
+	"deploy-storybook": deploy_storybook_default$1
 };
 const KNOWN_WORKFLOWS = new Set(Object.keys(WORKFLOW_TEMPLATES));
 /**
@@ -4046,7 +4046,7 @@ var setup_default = "name: Setup\ndescription: Prepare the environment and insta
 var setup_node_default = "name: Setup Node\ndescription: Install pnpm and Node.js with pnpm dependency caching.\n\ninputs:\n  node-version:\n    description: Node.js version\n    required: false\n    default: \"22.x\"\nruns:\n  using: composite\n\n  steps:\n    - name: Setup pnpm\n      if: ${{ hashFiles('pnpm-lock.yaml') != '' }}\n      uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4\n\n    - name: Setup Node.js\n      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0\n      with:\n        node-version: ${{ hashFiles('.node-version') != '' && '' || inputs.node-version }}\n        node-version-file: ${{ hashFiles('.node-version') != '' && '.node-version' || '' }}\n        cache: ${{ hashFiles('pnpm-lock.yaml') != '' && 'pnpm' || '' }}\n        # Do NOT add registry-url here. setup-node writes .npmrc with\n        # _authToken=${NODE_AUTH_TOKEN} and sets NPM_CONFIG_USERCONFIG to it.\n        # pnpm reads that file, fails env-var substitution when the token is\n        # empty, and loses auth entirely. Without registry-url, pnpm 10.15+\n        # handles Trusted Publishing via its own native OIDC exchange.\n\n    - name: Add node_modules/.bin to PATH\n      shell: bash\n      run: echo \"$GITHUB_WORKSPACE/node_modules/.bin\" >> $GITHUB_PATH\n";
 //#endregion
 //#region src/templates/workflows/audit.yml
-var audit_default = "name: Audit\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      build-script:\n        description: Script to build and upload bundle stats to Codecov\n        type: string\n        required: false\n        default: pnpm build\n      run-knip:\n        description: Run Knip to detect unused files, exports, and dependencies\n        type: boolean\n        required: false\n        default: false\n      knip-script:\n        description: Script that invokes Knip (must exit non-zero on findings)\n        type: string\n        required: false\n        default: pnpm run audit\n    secrets:\n      CODECOV_TOKEN:\n        required: false\n      LHCI_GITHUB_APP_TOKEN:\n        required: false\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  bundle-size:\n    name: Audit the bundle size\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    concurrency:\n      group: audit-${{ github.ref }}\n      cancel-in-progress: true\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: eval \"$BUILD_SCRIPT\"\n        name: Build and upload bundle stats\n        env:\n          BUILD_SCRIPT: ${{ inputs.build-script }}\n          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}\n\n  knip:\n    name: Knip\n    if: ${{ inputs.run-knip }}\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    concurrency:\n      group: knip-${{ github.ref }}\n      cancel-in-progress: true\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          persist-credentials: false\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: eval \"$KNIP_SCRIPT\"\n        name: Run Knip\n        env:\n          KNIP_SCRIPT: ${{ inputs.knip-script }}\n\n  performance:\n    name: Audit the performance\n    # Skip when no Lighthouse config exists. Detects the org-standard\n    # lighthouse.config.{js,cjs} and legacy .lighthouserc.* names.\n    if: ${{ hashFiles('lighthouse.config.js', 'lighthouse.config.cjs', 'lighthouse.config.json', '.lighthouserc.js', '.lighthouserc.cjs', '.lighthouserc.json', '.lighthouserc.yml', '.lighthouserc.yaml') != '' }}\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    concurrency:\n      group: performance-${{ github.ref }}\n      cancel-in-progress: true\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: npm install -g @lhci/cli@0.14.x\n        name: Install Lighthouse CLI\n\n      - name: Run Lighthouse CI\n        run: |\n          CONFIG_FLAG=\"\"\n          for f in lighthouse.config.js lighthouse.config.cjs lighthouse.config.json \\\n            .lighthouserc.js .lighthouserc.cjs .lighthouserc.json \\\n            .lighthouserc.yml .lighthouserc.yaml; do\n            if [ -f \"$f\" ]; then\n              CONFIG_FLAG=\"--config=$f\"\n              break\n            fi\n          done\n          lhci autorun $CONFIG_FLAG\n        env:\n          LHCI_GITHUB_APP_TOKEN: ${{ secrets.LHCI_GITHUB_APP_TOKEN }}\n";
+var audit_default = "name: Audit\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      build-script:\n        description: Script to build and upload bundle stats to Codecov\n        type: string\n        required: false\n        default: pnpm build\n      run-knip:\n        description: Run Knip to detect unused files, exports, and dependencies\n        type: boolean\n        required: false\n        default: false\n      run-performance:\n        description: Run Lighthouse CI performance audit (requires a lighthouse config file)\n        type: boolean\n        required: false\n        default: false\n      knip-script:\n        description: Script that invokes Knip (must exit non-zero on findings)\n        type: string\n        required: false\n        default: pnpm run audit\n    secrets:\n      CODECOV_TOKEN:\n        required: false\n      LHCI_GITHUB_APP_TOKEN:\n        required: false\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  bundle-size:\n    name: Audit the bundle size\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    concurrency:\n      group: audit-${{ github.ref }}\n      cancel-in-progress: true\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: eval \"$BUILD_SCRIPT\"\n        name: Build and upload bundle stats\n        env:\n          BUILD_SCRIPT: ${{ inputs.build-script }}\n          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}\n\n  knip:\n    name: Knip\n    if: ${{ inputs.run-knip }}\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    concurrency:\n      group: knip-${{ github.ref }}\n      cancel-in-progress: true\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          persist-credentials: false\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: eval \"$KNIP_SCRIPT\"\n        name: Run Knip\n        env:\n          KNIP_SCRIPT: ${{ inputs.knip-script }}\n\n  performance:\n    name: Audit the performance\n    if: ${{ inputs.run-performance }}\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    concurrency:\n      group: performance-${{ github.ref }}\n      cancel-in-progress: true\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: npm install -g @lhci/cli@0.14.x\n        name: Install Lighthouse CLI\n\n      - name: Run Lighthouse CI\n        run: |\n          CONFIG_FLAG=\"\"\n          for f in lighthouse.config.js lighthouse.config.cjs lighthouse.config.json \\\n            .lighthouserc.js .lighthouserc.cjs .lighthouserc.json \\\n            .lighthouserc.yml .lighthouserc.yaml; do\n            if [ -f \"$f\" ]; then\n              CONFIG_FLAG=\"--config=$f\"\n              break\n            fi\n          done\n          lhci autorun $CONFIG_FLAG\n        env:\n          LHCI_GITHUB_APP_TOKEN: ${{ secrets.LHCI_GITHUB_APP_TOKEN }}\n";
 //#endregion
 //#region src/templates/workflows/bookkeeping.yml
 var bookkeeping_default = "name: Bookkeeping\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      configuration-path:\n        description: Path to the labeler configuration file in the calling repo\n        type: string\n        required: false\n        default: .github/labeler.yml\n\njobs:\n  label:\n    name: Apply Labels\n    permissions:\n      contents: read\n      issues: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    concurrency:\n      group: bookkeeping-${{ github.event.pull_request.number || github.event.issue.number }}\n      cancel-in-progress: true\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          sparse-checkout: ${{ inputs.configuration-path || '.github/labeler.yml' }}\n          sparse-checkout-cone-mode: false\n\n      - uses: github/issue-labeler@c1b0f9f52a63158c4adc09425e858e87b32e9685 # v3.4\n        if: ${{ github.event_name == 'pull_request' && hashFiles(inputs.configuration-path || '.github/labeler.yml') != '' }}\n        # v3.4 bundles Node 20; allow it to run under Actions' current default.\n        env:\n          ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true\n        with:\n          # Fall back to default path when triggered directly (not via workflow_call)\n          # because inputs.* defaults only apply on workflow_call events.\n          configuration-path: ${{ inputs.configuration-path || '.github/labeler.yml' }}\n          include-title: 1\n          include-body: 0\n          sync-labels: 1\n          enable-versioned-regex: 0\n          repo-token: ${{ github.token }}\n";
@@ -4060,6 +4060,9 @@ var dependencies_default = "name: Dependencies\n\non: # yamllint disable-line ru
 //#region src/templates/workflows/deploy-docs.yml
 var deploy_docs_default = "name: Deploy Docs\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      name:\n        description: Repo name prefix used to derive package names (<name>-docs, <name>-site)\n        required: true\n        type: string\n      use-turbo:\n        description: Build content packages with pnpm turbo build (default true)\n        required: false\n        type: boolean\n        default: true\n\njobs:\n  build:\n    name: Build\n    runs-on: ubuntu-latest\n    permissions:\n      contents: read\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - name: Build content packages\n        if: ${{ inputs.use-turbo }}\n        env:\n          DOCS_NAME: ${{ inputs.name }}\n        run: pnpm turbo build --filter=@theholocron/\"$DOCS_NAME\"-docs\n\n      - name: Build content packages\n        if: ${{ !inputs.use-turbo }}\n        env:\n          DOCS_NAME: ${{ inputs.name }}\n        run: pnpm --filter @theholocron/\"$DOCS_NAME\"-docs build\n\n      - name: Build docs site\n        env:\n          DOCS_NAME: ${{ inputs.name }}\n        run: pnpm --filter @theholocron/\"$DOCS_NAME\"-site build\n\n      - uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1\n        name: Upload pages artifact\n        with:\n          path: docs/dist\n\n  deploy:\n    name: Deploy\n    needs: build\n    runs-on: ubuntu-latest\n    permissions:\n      pages: write\n      id-token: write\n    environment:\n      name: github-pages\n      url: ${{ steps.deployment.outputs.page_url }}\n    steps:\n      - uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5\n        id: deployment\n        name: Deploy to GitHub Pages\n";
 //#endregion
+//#region src/templates/workflows/deploy-storybook.yml
+var deploy_storybook_default = "name: Deploy Storybook\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      build-script:\n        description: pnpm script that builds the Storybook static output\n        type: string\n        required: false\n        default: build:storybook\n      output-dir:\n        description: Directory where Storybook writes its static output\n        type: string\n        required: false\n        default: storybook-static\n\njobs:\n  build:\n    name: Build\n    runs-on: ubuntu-latest\n    permissions:\n      contents: read\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - name: Build Storybook\n        run: pnpm run \"$BUILD_SCRIPT\"\n        env:\n          BUILD_SCRIPT: ${{ inputs.build-script }}\n\n      - uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1\n        name: Upload pages artifact\n        with:\n          path: ${{ inputs.output-dir }}\n\n  deploy:\n    name: Deploy\n    needs: build\n    runs-on: ubuntu-latest\n    permissions:\n      pages: write\n      id-token: write\n    environment:\n      name: github-pages\n      url: ${{ steps.deployment.outputs.page_url }}\n    steps:\n      - uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5\n        id: deployment\n        name: Deploy to GitHub Pages\n";
+//#endregion
 //#region src/templates/workflows/greetings.yml
 var greetings_default = "name: Greetings\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n\njobs:\n  greeting:\n    name: Greet first-time contributors\n    permissions:\n      issues: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    # Group by the issue/PR number so duplicate events don't race each other.\n    concurrency:\n      group: greetings-${{ github.event.issue.number || github.event.pull_request.number }}\n      cancel-in-progress: false\n    steps:\n      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0\n        name: Greet on first contribution\n        with:\n          script: |\n            // Only greet on the initial open — ignore synchronize, reopened, etc.\n            if (context.payload.action !== 'opened') return;\n\n            const actor = context.actor;\n            const { owner, repo } = context.repo;\n\n            // Payload inspection is more reliable than context.eventName for detecting\n            // whether this is an issue vs. PR event — works regardless of how GitHub\n            // propagates event names through workflow_call chains.\n            const isIssue = !!context.payload.issue && !context.payload.pull_request;\n            // listForRepo returns both issues and PRs (GitHub treats PRs as issues),\n            // sorted newest-first. Filter by type to track first-issue and first-PR\n            // independently, and avoid search-index eventual-consistency lag.\n            const { data: recent } = await github.rest.issues.listForRepo({\n              owner, repo,\n              creator: actor,\n              state: 'all',\n              per_page: 100\n            });\n\n            const sameType = recent.filter(item =>\n              isIssue ? !item.pull_request : !!item.pull_request\n            );\n\n            if (sameType.length !== 1) return;\n            const body = isIssue\n              ? `Hey @${actor}!\\n\\nWe really appreciate you taking the time to report an issue. The collaborators on this project attempt to help as many people as possible, but we are a limited number of volunteers, so it is possible that this will not be addressed as swiftly.\\n\\nYour patience is much appreciated and we will get back to you as quickly as possible.`\n              : `Hey @${actor}!\\n\\nWe really appreciate you taking the time to help out with this PR. The collaborators on this project attempt to help as many people as possible, but we are a limited number of volunteers, so it is possible that this will not be addressed as swiftly.\\n\\nYour patience is much appreciated and we will get back to you as quickly as possible.`;\n\n            await github.rest.issues.createComment({\n              owner,\n              repo,\n              issue_number: context.issue.number,\n              body\n            });\n";
 //#endregion
@@ -4079,7 +4082,7 @@ var stale_default = "name: Stale\n\non: # yamllint disable-line rule:truthy\n  w
 var sync_github_default = "name: Sync GitHub Templates\n\n# Builds the holocron CLI from source and pushes updated workflow templates\n# and composite actions to downstream .github repos. Runs whenever the\n# template source files change on main or alpha.\n#\n# Secrets required:\n#   HOLOCRON_SYNC_TOKEN — fine-grained PAT (resource owner: org) with:\n#                  Contents:      Read and write  (git trees, blobs, refs)\n#                  Pull requests: Read and write  (open sync PR)\n#                  Workflows:     Read and write  (write .github/workflows/*.yml)\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      primary-repo:\n        description: >\n          Primary .github repo — receives composite actions, reusable workflows,\n          and thin-caller templates. Requires a PR (branch protection assumed).\n        type: string\n        required: false\n        default: theholocron/.github\n      secondary-repos:\n        description: >\n          Space-separated list of secondary repos (reusable workflows + thin\n          callers only, no composite actions). Changes are delivered via pull\n          request, same as the primary repo.\n        type: string\n        required: false\n        default: \"\"\n      sync-branch:\n        description: Branch name used for the primary and secondary repo PRs\n        type: string\n        required: false\n        default: chore/sync-templates\n    secrets:\n      HOLOCRON_SYNC_TOKEN:\n        required: true\n      HOLOCRON_READ_TOKEN:\n        description: >\n          Fine-grained PAT for read-only GitHub API calls (e.g. resolving git\n          committer identity via `gh api user`). Falls back to HOLOCRON_SYNC_TOKEN.\n        required: false\n      GH_TOKEN:\n        description: >\n          Generic GitHub token fallback for `gh` CLI calls. Used when neither\n          HOLOCRON_READ_TOKEN nor HOLOCRON_SYNC_TOKEN is set.\n        required: false\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  sync:\n    name: Sync templates\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    permissions:\n      contents: read\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: pnpm build\n        name: Build CLI\n\n      - name: Cache actionlint\n        id: cache-actionlint\n        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0\n        with:\n          path: /tmp/actionlint\n          key: actionlint-v1.7.7-linux-amd64\n\n      - name: Download actionlint\n        if: steps.cache-actionlint.outputs.cache-hit != 'true'\n        run: |\n          curl -fsSL https://github.com/rhysd/actionlint/releases/download/v1.7.7/actionlint_1.7.7_linux_amd64.tar.gz \\\n            | tar -xz -C /tmp actionlint\n\n      - name: Validate generated workflows\n        run: |\n          node packages/cli/dist/cli.mjs sync-github \\\n            --repo \"$PRIMARY_REPO\" \\\n            --output-dir /tmp/sync-validate\n          /tmp/actionlint /tmp/sync-validate/.github/workflows/*.yml\n        env:\n          PRIMARY_REPO: ${{ inputs.primary-repo }}\n\n      - name: Sync primary repo (PR)\n        run: |\n          GIT_NAME=$(gh api user --jq .name 2>/dev/null || echo \"github-actions[bot]\")\n          GIT_EMAIL=$(gh api user --jq '\"\\(.id)+\\(.login)@users.noreply.github.com\"' 2>/dev/null || echo \"41898282+github-actions[bot]@users.noreply.github.com\")\n          COMMIT_MSG=\"chore: sync from theholocron/holocron\"$'\\n\\n'\"Signed-off-by: $GIT_NAME <$GIT_EMAIL>\"\n          node packages/cli/dist/cli.mjs sync-github \\\n            --repo \"$PRIMARY_REPO\" \\\n            --branch \"$SYNC_BRANCH\" \\\n            --pr \\\n            --message \"$COMMIT_MSG\"\n          GH_TOKEN=\"$HOLOCRON_SYNC_TOKEN\" gh pr merge --auto --squash \\\n            --repo \"$PRIMARY_REPO\" \"$SYNC_BRANCH\" 2>/dev/null || true\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_READ_TOKEN || secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN }}\n          HOLOCRON_SYNC_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN }}\n          PRIMARY_REPO: ${{ inputs.primary-repo }}\n          SYNC_BRANCH: ${{ inputs.sync-branch }}\n\n      - name: Sync secondary repos (PR)\n        if: ${{ inputs.secondary-repos != '' }}\n        run: |\n          GIT_NAME=$(gh api user --jq .name 2>/dev/null || echo \"github-actions[bot]\")\n          GIT_EMAIL=$(gh api user --jq '\"\\(.id)+\\(.login)@users.noreply.github.com\"' 2>/dev/null || echo \"41898282+github-actions[bot]@users.noreply.github.com\")\n          COMMIT_MSG=\"chore: sync from theholocron/holocron\"$'\\n\\n'\"Signed-off-by: $GIT_NAME <$GIT_EMAIL>\"\n          for repo in $SECONDARY_REPOS; do\n            node packages/cli/dist/cli.mjs sync-github \\\n              --repo \"$repo\" \\\n              --branch \"$SYNC_BRANCH\" \\\n              --pr \\\n              --message \"$COMMIT_MSG\"\n            GH_TOKEN=\"$HOLOCRON_SYNC_TOKEN\" gh pr merge --auto --squash \\\n              --repo \"$repo\" \"$SYNC_BRANCH\" 2>/dev/null || true\n          done\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_READ_TOKEN || secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN }}\n          HOLOCRON_SYNC_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN }}\n          SECONDARY_REPOS: ${{ inputs.secondary-repos }}\n          SYNC_BRANCH: ${{ inputs.sync-branch }}\n";
 //#endregion
 //#region src/templates/workflows/test.yml
-var test_default = "name: Test\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      CHROMATIC_PROJECT_TOKEN:\n        required: false\n      CYPRESS_RECORD_KEY:\n        required: false\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  unit:\n    name: Run tests and collect coverage\n    permissions:\n      contents: read\n      id-token: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: pnpm test:coverage\n        name: Run tests with coverage\n\n      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0\n        name: Upload coverage to Codecov\n        with:\n          use_oidc: true\n\n      - uses: codecov/test-results-action@0fa95f0e1eeaafde2c782583b36b28ad0d8c77d3 # v1\n        name: Upload test results to Codecov\n        if: ${{ !cancelled() }}\n        with:\n          use_oidc: true\n          files: '**/test-report.junit.xml'\n\n  storybook:\n    name: Run Storybook interaction tests\n    # Skip when no Storybook config exists.\n    if: ${{ hashFiles('.storybook/main.ts', '.storybook/main.js', '.storybook/main.cjs') != '' }}\n    permissions:\n      contents: read\n      id-token: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    # container:\n    #   # Use the Playwright image if you need cross-browser testing beyond chromium.\n    #   # https://playwright.dev/docs/docker#pull-the-image\n    #   image: mcr.microsoft.com/playwright:v1.54.1-noble\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: pnpm exec playwright install chromium --with-deps\n        name: Install Playwright\n\n      - run: pnpm test:storybook\n        name: Run Storybook tests\n\n      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0\n        name: Upload coverage to Codecov\n        with:\n          use_oidc: true\n\n      - uses: codecov/test-results-action@0fa95f0e1eeaafde2c782583b36b28ad0d8c77d3 # v1\n        name: Upload test results to Codecov\n        if: ${{ !cancelled() }}\n        with:\n          use_oidc: true\n          files: '**/test-report.junit.xml'\n\n  visual-and-composition:\n    name: Test Visual and Composition\n    # Skip when no Chromatic config exists.\n    if: ${{ hashFiles('chromatic.config.json', 'chromatic.config.ts', 'chromatic.config.js') != '' }}\n    permissions:\n      contents: read\n      statuses: write # Chromatic posts a commit status check back to the PR\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: chromaui/action@v13\n        name: Publish to Chromatic\n        with:\n          projectToken: ${{ secrets.CHROMATIC_PROJECT_TOKEN }}\n          token: ${{ secrets.GITHUB_TOKEN }}\n          buildScriptName: build:storybook\n\n  interaction-and-accessibility:\n    name: Test Interactions and Accessibility\n    # Skip when no Storybook config exists.\n    if: ${{ hashFiles('.storybook/main.ts', '.storybook/main.js', '.storybook/main.cjs') != '' }}\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    container:\n      # Make sure to grab the latest version of the Playwright image.\n      # https://playwright.dev/docs/docker#pull-the-image\n      image: mcr.microsoft.com/playwright:v1.54.1-noble\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: pnpm test:storybook\n        name: Run interaction and accessibility tests\n\n  user-flow:\n    name: Test User Flow\n    # Skip when no Cypress config exists.\n    if: ${{ hashFiles('cypress.config.ts', 'cypress.config.js', 'cypress.config.cjs') != '' }}\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    strategy:\n      fail-fast: false # https://github.com/cypress-io/github-action/issues/48\n      matrix:\n        containers: [1, 2]\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: cypress-io/github-action@1052aa98bbbe4f55210f844878213c07d9c8c399 # v6.7.13\n        name: Cypress run\n        with:\n          start: pnpm dev\n          wait-on: \"http://localhost:5173\"\n          record: true\n          parallel: true\n        env:\n          CYPRESS_RECORD_KEY: ${{ secrets.CYPRESS_RECORD_KEY }}\n          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n";
+var test_default = "name: Test\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      run-storybook:\n        description: Run Storybook vitest interaction tests (requires .storybook/ setup)\n        type: boolean\n        required: false\n        default: false\n      run-interaction:\n        description: Run Storybook interaction tests in a full Playwright container\n        type: boolean\n        required: false\n        default: false\n      run-user-flow:\n        description: Run Cypress E2E user-flow tests (requires cypress.config.*)\n        type: boolean\n        required: false\n        default: false\n      run-chromatic:\n        description: Publish Storybook to Chromatic for visual regression testing\n        type: boolean\n        required: false\n        default: false\n    secrets:\n      CHROMATIC_PROJECT_TOKEN:\n        required: false\n      CYPRESS_RECORD_KEY:\n        required: false\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  unit:\n    name: Run tests and collect coverage\n    permissions:\n      contents: read\n      id-token: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: pnpm test:coverage\n        name: Run tests with coverage\n\n      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0\n        name: Upload coverage to Codecov\n        with:\n          use_oidc: true\n\n      - uses: codecov/test-results-action@0fa95f0e1eeaafde2c782583b36b28ad0d8c77d3 # v1\n        name: Upload test results to Codecov\n        if: ${{ !cancelled() }}\n        with:\n          use_oidc: true\n          files: '**/test-report.junit.xml'\n\n  storybook:\n    name: Run Storybook interaction tests\n    if: ${{ inputs.run-storybook }}\n    permissions:\n      contents: read\n      id-token: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    # container:\n    #   # Use the Playwright image if you need cross-browser testing beyond chromium.\n    #   # https://playwright.dev/docs/docker#pull-the-image\n    #   image: mcr.microsoft.com/playwright:v1.54.1-noble\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: pnpm exec playwright install chromium --with-deps\n        name: Install Playwright\n\n      - run: pnpm test:storybook\n        name: Run Storybook tests\n\n      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0\n        name: Upload coverage to Codecov\n        with:\n          use_oidc: true\n\n      - uses: codecov/test-results-action@0fa95f0e1eeaafde2c782583b36b28ad0d8c77d3 # v1\n        name: Upload test results to Codecov\n        if: ${{ !cancelled() }}\n        with:\n          use_oidc: true\n          files: '**/test-report.junit.xml'\n\n  visual-and-composition:\n    name: Test Visual and Composition\n    if: ${{ inputs.run-chromatic }}\n    permissions:\n      contents: read\n      statuses: write # Chromatic posts a commit status check back to the PR\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: chromaui/action@v13\n        name: Publish to Chromatic\n        with:\n          projectToken: ${{ secrets.CHROMATIC_PROJECT_TOKEN }}\n          token: ${{ secrets.GITHUB_TOKEN }}\n          buildScriptName: build:storybook\n\n  interaction-and-accessibility:\n    name: Test Interactions and Accessibility\n    if: ${{ inputs.run-interaction }}\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    container:\n      # Make sure to grab the latest version of the Playwright image.\n      # https://playwright.dev/docs/docker#pull-the-image\n      image: mcr.microsoft.com/playwright:v1.54.1-noble\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: pnpm test:storybook\n        name: Run interaction and accessibility tests\n\n  user-flow:\n    name: Test User Flow\n    if: ${{ inputs.run-user-flow }}\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    strategy:\n      fail-fast: false # https://github.com/cypress-io/github-action/issues/48\n      matrix:\n        containers: [1, 2]\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - uses: cypress-io/github-action@1052aa98bbbe4f55210f844878213c07d9c8c399 # v6.7.13\n        name: Cypress run\n        with:\n          start: pnpm dev\n          wait-on: \"http://localhost:5173\"\n          record: true\n          parallel: true\n        env:\n          CYPRESS_RECORD_KEY: ${{ secrets.CYPRESS_RECORD_KEY }}\n          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}\n";
 //#endregion
 //#region src/templates/workflows/typecheck.yml
 var typecheck_default = "name: Typecheck\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      TURBO_TOKEN:\n        required: false\n\njobs:\n  typecheck:\n    name: tsc --noEmit\n    permissions:\n      contents: read\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    env:\n      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}\n      TURBO_TEAM: ${{ vars.TURBO_TEAM }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: pnpm typecheck\n        name: Type check\n";
@@ -4104,6 +4107,7 @@ const REUSABLE_WORKFLOWS = {
 	codeql: codeql_default,
 	dependencies: dependencies_default,
 	"deploy-docs": deploy_docs_default,
+	"deploy-storybook": deploy_storybook_default,
 	greetings: greetings_default,
 	lint: lint_default,
 	release: release_default,