@theholocron/cli 4.19.0 → 5.0.0-alpha.11

package/dist/cli.mjs

@@ -2154,12 +2154,11 @@ function render$10(inputs) {
 		main: "./src/index.ts",
 		exports: { ".": "./src/index.ts" },
 		scripts: {
-			build: "tsdown",
-			lint: "eslint .",
-			typecheck: "tsc --noEmit",
-			test: "vitest run",
+			"delivery.build": "tsdown",
+			"sourceQuality.staticAnalysis": "holocron run sourceQuality.staticAnalysis --",
+			"verification.typeSafety": "holocron run verification.typeSafety --",
+			"verification.unitTests": "holocron run verification.unitTests --",
 			"test:watch": "vitest",
-			"test:coverage": "vitest run --coverage",
 			validate: "tsx scripts/validate.mjs"
 		},
 		peerDependencies: { "@theholocron/cli": "workspace:*" },
@@ -2879,7 +2878,7 @@ function runPluginCreate(input) {
 			execFn("pnpm", [
 				"--filter",
 				pkg,
-				"typecheck"
+				"verification.typeSafety"
 			], {
 				cwd,
 				stdio: "inherit"
@@ -2887,7 +2886,7 @@ function runPluginCreate(input) {
 			execFn("pnpm", [
 				"--filter",
 				pkg,
-				"lint"
+				"sourceQuality.staticAnalysis"
 			], {
 				cwd,
 				stdio: "inherit"
@@ -2895,7 +2894,7 @@ function runPluginCreate(input) {
 			execFn("pnpm", [
 				"--filter",
 				pkg,
-				"test"
+				"verification.unitTests"
 			], {
 				cwd,
 				stdio: "inherit"
@@ -3018,6 +3017,193 @@ function printNextSteps$1(print, inputs) {
 * "revoke this token at <url>" reminder — same pattern as `rando vc
 * setup` for the ephemeral GH admin PAT.
 */
+/**
+* `holocron publish --sync-trust <old-file> <new-file>` — bulk-migrates npm
+* Trusted Publisher (OIDC) config to a new workflow filename across every
+* public package. See issue #689 / `scripts/npm-trust-migrate.sh` (the
+* shell-script prototype this supersedes) for the full "why": npm ties
+* Trusted Publisher to a workflow FILENAME per package, so renaming the
+* release workflow breaks OIDC publish (`ENEEDAUTH`) until every package's
+* config is updated to match.
+*
+* Requires npm@11.15.0+ (`npm trust`) — always shells out through
+* `npx -y npm@latest` regardless of the locally-installed npm version.
+*
+* npm's `trust` mutations — and reads, once a short-lived OTP grant lapses —
+* require a fresh interactive browser 2FA approval (an `EOTP` error with an
+* `authUrl`). No token bypasses this (npm's own docs: Granular Access Tokens
+* with the bypass-2FA option are explicitly unsupported for trust commands).
+* This command can't drive that browser step itself, so on the first `EOTP`
+* it stops immediately, prints the `authUrl`, and returns — the operator
+* approves it and re-runs; already-migrated packages are skipped on the next
+* pass, so it's safe to resume from wherever it stopped.
+*/
+async function runSyncTrust(input) {
+	const print = input.print ?? ((line) => console.log(line));
+	const logger = input.logger ?? getLogger();
+	const cwd = input.cwd ?? process.cwd();
+	const repo = input.repo ?? "theholocron/holocron";
+	const dryRun = input.dryRun ?? false;
+	const exec = input.exec ?? defaultExec$1;
+	const packageNames = input.packages ?? discoverPublicPackages(cwd);
+	const npm = "npx";
+	const npmArgs = ["-y", "npm@latest"];
+	print(`Holocron publish --sync-trust${dryRun ? " (dry-run)" : ""}`);
+	print(`  ${input.oldFile} -> ${input.newFile}  (repo: ${repo})`);
+	print(`  ${packageNames.length} public packages`);
+	print("");
+	logger.info({
+		oldFile: input.oldFile,
+		newFile: input.newFile,
+		packages: packageNames.length
+	}, "sync-trust: start");
+	if (packageNames.length === 0) {
+		const message = "nothing to sync (no packages/* and root package.json is private or unnamed)";
+		print(`  ✗ ${message}`);
+		return {
+			status: "fail",
+			message,
+			packages: []
+		};
+	}
+	if (dryRun) {
+		for (const name of packageNames) print(`  … would sync ${name}`);
+		return {
+			status: "dry-run",
+			message: "dry-run — no npm calls made",
+			packages: []
+		};
+	}
+	const results = [];
+	for (const name of packageNames) {
+		print(`=== ${name} ===`);
+		const parsed = parseJson((await exec(npm, [
+			...npmArgs,
+			"trust",
+			"list",
+			name,
+			"--json"
+		], { cwd })).stdout);
+		if (isEotp(parsed)) {
+			const authUrl = parsed.error?.authUrl ?? "";
+			print(`  needs fresh 2FA — open and approve: ${authUrl}`);
+			print("  then re-run; already-migrated packages are skipped.");
+			results.push({
+				name,
+				status: "needs-auth",
+				message: authUrl
+			});
+			logger.warn({
+				package: name,
+				authUrl
+			}, "sync-trust: needs auth, stopping");
+			return {
+				status: "fail",
+				message: "npm 2FA grant needed — see printed authUrl",
+				packages: results
+			};
+		}
+		const entry = parsed;
+		if (entry.file === input.newFile) {
+			print(`  already on ${input.newFile}, skipping`);
+			results.push({
+				name,
+				status: "skipped"
+			});
+			continue;
+		}
+		if (entry.id) {
+			print(`  revoking existing trust (file=${entry.file ?? "?"}, id=${entry.id})`);
+			const revoke = await exec(npm, [
+				...npmArgs,
+				"trust",
+				"revoke",
+				name,
+				"--id",
+				entry.id,
+				"-y"
+			], { cwd });
+			if (revoke.exitCode !== 0 && isEotp(parseJson(revoke.stdout))) {
+				const authUrl = parseJson(revoke.stdout).error?.authUrl ?? "";
+				print(`  needs fresh 2FA — open and approve: ${authUrl}`);
+				results.push({
+					name,
+					status: "needs-auth",
+					message: authUrl
+				});
+				return {
+					status: "fail",
+					message: "npm 2FA grant needed — see printed authUrl",
+					packages: results
+				};
+			}
+		} else print("  no existing trust config found");
+		print(`  creating trust: ${input.newFile}`);
+		const create = await exec(npm, [
+			...npmArgs,
+			"trust",
+			"github",
+			name,
+			"--repo",
+			repo,
+			"--file",
+			input.newFile,
+			"--allow-publish",
+			"--allow-stage-publish",
+			"-y"
+		], { cwd });
+		if (create.exitCode === 0) {
+			print("  ✓ ok");
+			results.push({
+				name,
+				status: "ok"
+			});
+		} else {
+			const createParsed = parseJson(create.stdout);
+			if (isEotp(createParsed)) {
+				const authUrl = createParsed.error?.authUrl ?? "";
+				print(`  needs fresh 2FA — open and approve: ${authUrl}`);
+				results.push({
+					name,
+					status: "needs-auth",
+					message: authUrl
+				});
+				return {
+					status: "fail",
+					message: "npm 2FA grant needed — see printed authUrl",
+					packages: results
+				};
+			}
+			const message = create.stderr.trim() || create.stdout.trim() || `exit ${create.exitCode}`;
+			print(`  ✗ FAILED: ${message}`);
+			results.push({
+				name,
+				status: "fail",
+				message
+			});
+		}
+	}
+	const failed = results.filter((r) => r.status === "fail");
+	logger.info({
+		ok: results.filter((r) => r.status === "ok").length,
+		failed: failed.length
+	}, "sync-trust: done");
+	return {
+		status: failed.length > 0 ? "fail" : "ok",
+		...failed.length > 0 ? { message: `${failed.length} package(s) failed` } : {},
+		packages: results
+	};
+}
+function parseJson(raw) {
+	try {
+		return JSON.parse(raw);
+	} catch {
+		return;
+	}
+}
+function isEotp(parsed) {
+	return typeof parsed === "object" && parsed !== null && "error" in parsed && parsed.error?.code === "EOTP";
+}
 async function runPublish(input = {}) {
 	const print = input.print ?? ((line) => console.log(line));
 	const logger = input.logger ?? getLogger();
@@ -3138,6 +3324,170 @@ async function runPublish(input = {}) {
 		packageNames
 	};
 }
+/**
+* `holocron publish` (no `--initial`) — the steady-state publish
+* `exec.publishCmd` in `release.config.ts` should call, replacing each
+* repo's hand-typed `pnpm -r --filter=./packages/* publish ...` shell (which
+* differs, today, only in monorepo-vs-single-package, provenance on/off, and
+* whether a repo needs to skip already-published packages) with one uniform
+* invocation. Part of the config-resolution workstream, #676 — see
+* `.notes/tech-config-resolution.spec.md`.
+*
+* Deliberately does not do the `--initial` bootstrap dance (npm
+* login-if-needed, Trusted Publisher next-steps printout) — a steady-state
+* publish runs in CI, authenticated via OIDC automatically, no interactive
+* step involved. Reuses `hasPackagesDir()`'s monorepo-vs-single-package
+* detection rather than duplicating it.
+*/
+async function runSteadyPublish(input = {}) {
+	const print = input.print ?? ((line) => console.log(line));
+	const logger = input.logger ?? getLogger();
+	const cwd = input.cwd ?? process.cwd();
+	const tag = input.tag ?? "latest";
+	const dryRun = input.dryRun ?? false;
+	const otp = input.otp;
+	const exec = input.exec ?? defaultExec$1;
+	const provenance = input.provenance ?? true;
+	const skipAlreadyPublished = input.skipAlreadyPublished ?? false;
+	const entries = input.packages ?? discoverPublicPackageEntries(cwd);
+	const packageNames = entries.map((e) => e.name);
+	print(`Holocron publish${dryRun ? " (dry-run)" : ""}`);
+	print(`  cwd: ${cwd}`);
+	print(`  tag: ${tag}`);
+	print(`  provenance: ${provenance}`);
+	if (skipAlreadyPublished) print("  skip-already-published: true");
+	logger.info({
+		tag,
+		provenance,
+		skipAlreadyPublished,
+		dryRun: dryRun || void 0
+	}, "publish: start");
+	if (otp) print(`  otp: <${otp.length} chars>`);
+	print("");
+	if (entries.length === 0) {
+		const message = "nothing to publish (no packages/* and root package.json is private or unnamed)";
+		print(`  ✗ ${message}`);
+		logger.warn({ reason: message }, "publish: done");
+		return {
+			status: "fail",
+			message,
+			packageNames
+		};
+	}
+	const baseFlags = [
+		"--access",
+		"public",
+		"--no-git-checks",
+		"--tag",
+		tag,
+		...provenance ? ["--provenance"] : []
+	];
+	const otpFlags = otp ? ["--otp", otp] : [];
+	if (dryRun) {
+		print("");
+		if (skipAlreadyPublished) for (const entry of entries) print(`  … would check ${entry.name}@${entry.version}, publish if not already on npm`);
+		else {
+			const args = [
+				...hasPackagesDir(cwd) ? ["-r", "--filter=./packages/*"] : [],
+				"publish",
+				...baseFlags,
+				...otpFlags
+			];
+			print(`  … (dry-run) skipping actual publish`);
+			print(`    would run: pnpm ${args.join(" ")}`);
+		}
+		logger.info({
+			tag,
+			status: "dry-run",
+			packages: entries.length
+		}, "publish: done");
+		return {
+			status: "dry-run",
+			message: "dry-run — no publish executed",
+			packageNames
+		};
+	}
+	if (skipAlreadyPublished) {
+		print("  → publishing packages not already on npm…");
+		for (const entry of entries) {
+			const view = await exec("npm", [
+				"view",
+				`${entry.name}@${entry.version}`,
+				"version"
+			], { cwd });
+			if (view.exitCode === 0 && view.stdout.trim()) {
+				print(`    skip ${entry.name}@${entry.version} (already published)`);
+				continue;
+			}
+			const publish = await exec("pnpm", [
+				"--filter",
+				entry.dir,
+				"publish",
+				...baseFlags,
+				...otpFlags
+			], { cwd });
+			if (publish.exitCode !== 0) {
+				const message = `publish failed for ${entry.name}@${entry.version} (exit ${publish.exitCode}): ${publish.stderr.trim() || publish.stdout.trim() || "no output"}`;
+				print(`  ✗ ${message}`);
+				logger.warn({
+					tag,
+					package: entry.name,
+					reason: message
+				}, "publish: done");
+				return {
+					status: "fail",
+					message,
+					packageNames
+				};
+			}
+			print(`    ✓ ${entry.name}@${entry.version}`);
+		}
+		logger.info({
+			tag,
+			status: "ok",
+			packages: entries.length
+		}, "publish: done");
+		return {
+			status: "ok",
+			packageNames
+		};
+	}
+	print("  → publishing all public @theholocron/* packages…");
+	const publish = await exec("pnpm", [
+		...hasPackagesDir(cwd) ? ["-r", "--filter=./packages/*"] : [],
+		"publish",
+		...baseFlags,
+		...otpFlags
+	], { cwd });
+	if (publish.exitCode !== 0) {
+		const message = `publish failed (exit ${publish.exitCode}): ${publish.stderr.trim() || publish.stdout.trim() || "no output"}`;
+		print(`  ✗ ${message}`);
+		if (publish.stdout.includes("EOTP") || publish.stderr.includes("EOTP")) {
+			print("");
+			print("  → hint: your npm account requires 2FA for writes. Re-run with `--otp <code>`:");
+			print(`    pnpm exec holocron publish --otp <6-digit-code>`);
+		}
+		logger.warn({
+			tag,
+			reason: message
+		}, "publish: done");
+		return {
+			status: "fail",
+			message,
+			packageNames
+		};
+	}
+	print("    ✓ publish complete");
+	logger.info({
+		tag,
+		status: "ok",
+		packages: entries.length
+	}, "publish: done");
+	return {
+		status: "ok",
+		packageNames
+	};
+}
 function hasPackagesDir(cwd) {
 	return existsSync(join(cwd, "packages"));
 }
@@ -3151,6 +3501,37 @@ function publicPackageName(pkgPath) {
 		return;
 	}
 }
+/** Read a `package.json`'s `name` + `version`, when it's public (`!private && name`). */
+function publicPackageEntry(pkgPath, dir) {
+	if (!existsSync(pkgPath)) return void 0;
+	try {
+		const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
+		return !pkg.private && pkg.name && pkg.version ? {
+			name: pkg.name,
+			version: pkg.version,
+			dir
+		} : void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* Same repo-layout detection as {@link discoverPublicPackages}, but carrying
+* version + a `pnpm --filter`-ready path — {@link runSteadyPublish}'s
+* `skipAlreadyPublished` mode needs both to check `npm view <pkg>@<version>`
+* and publish one workspace at a time.
+*/
+function discoverPublicPackageEntries(cwd) {
+	if (!hasPackagesDir(cwd)) {
+		const entry = publicPackageEntry(join(cwd, "package.json"), ".");
+		return entry ? [entry] : [];
+	}
+	const packagesDir = join(cwd, "packages");
+	return readdirSync(packagesDir, { withFileTypes: true }).filter((e) => e.isDirectory()).flatMap((e) => {
+		const entry = publicPackageEntry(join(packagesDir, e.name, "package.json"), `./packages/${e.name}`);
+		return entry ? [entry] : [];
+	});
+}
 /**
 * Monorepo (`packages/` present): every public `packages/*` workspace.
 * Single package (no `packages/`): the root `package.json`, if it's public —
@@ -3180,7 +3561,7 @@ function printNextSteps(print, env, packageNames, repoName) {
 	print("");
 	print("  → next: configure Trusted Publisher for each package on npm:");
 	for (const name of packageNames) print(`    https://www.npmjs.com/package/${name}/access`);
-	print(`    Publisher: GitHub Actions   Org: theholocron   Repo: ${repoName}   Workflow: release.yml`);
+	print(`    Publisher: GitHub Actions   Org: theholocron   Repo: ${repoName}   Workflow: delivery.publish.yml`);
 	if (env.get("NPM_TOKEN")) {
 		print("");
 		print("  → cleanup: $NPM_TOKEN was used. Revoke it now (no API for self-revoke; UI-only):");
@@ -3563,12 +3944,21 @@ var alexrc_default = { allow: [
 ] };
 //#endregion
 //#region src/templates/configs/alexjs/create-config.ts
-const { workflowHeader: workflowHeader$8 } = createHeader({ source: "packages/cli/src/templates/configs/alexjs/create-config.ts" });
+const { workflowHeader: workflowHeader$9 } = createHeader({ source: "packages/cli/src/templates/configs/alexjs/create-config.ts" });
 function createRcConfig() {
 	return JSON.stringify(alexrc_default, null, 2) + "\n";
 }
 function createIgnoreConfig$1() {
-	return `${workflowHeader$8()}${alexignore_default}`;
+	return `${workflowHeader$9()}${alexignore_default}`;
+}
+//#endregion
+//#region src/templates/configs/commit-msg/commit-msg
+var commit_msg_default = "# --config <resolved shared path> (config-resolution workstream, #676) — falls\n# back to commitlint's own auto-discovery of a local commitlint.config.ts when\n# the shared package's built dist/ isn't present (not installed, or a stale\n# install predating this file).\nCOMMITLINT_CONFIG=\"node_modules/@theholocron/commitlint-config/dist/index.js\"\nif [ -f \"$COMMITLINT_CONFIG\" ]; then\n	npx --no -- commitlint --config \"$COMMITLINT_CONFIG\" --edit \"$1\"\nelse\n	npx --no -- commitlint --edit \"$1\"\nfi\n";
+//#endregion
+//#region src/templates/configs/commit-msg/create-config.ts
+const { workflowHeader: workflowHeader$8 } = createHeader({ source: "packages/cli/src/templates/configs/commit-msg/create-config.ts" });
+function createConfig$7() {
+	return `${workflowHeader$8("shebang")}${commit_msg_default}`;
 }
 //#endregion
 //#region src/templates/configs/devmoji/create-config.ts
@@ -3673,7 +4063,7 @@ function createConfig$2(holocronScript = "pnpm exec holocron") {
 }
 //#endregion
 //#region src/templates/configs/prepare-commit-msg/prepare-commit-msg
-var prepare_commit_msg_default = "NAME=$(git config user.name)\nEMAIL=$(git config user.email)\n\nif [ -z \"$NAME\" ]; then\n	echo \"empty git config user.name\"\n	exit 1\nfi\n\nif [ -z \"$EMAIL\" ]; then\n	echo \"empty git config user.email\"\n	exit 1\nfi\n\ngit interpret-trailers --if-exists doNothing --trailer \\\n	\"Signed-off-by: $NAME <$EMAIL>\" \\\n	--in-place \"$1\"\n\nnpx devmoji -e\n";
+var prepare_commit_msg_default = "NAME=$(git config user.name)\nEMAIL=$(git config user.email)\n\nif [ -z \"$NAME\" ]; then\n	echo \"empty git config user.name\"\n	exit 1\nfi\n\nif [ -z \"$EMAIL\" ]; then\n	echo \"empty git config user.email\"\n	exit 1\nfi\n\ngit interpret-trailers --if-exists doNothing --trailer \\\n	\"Signed-off-by: $NAME <$EMAIL>\" \\\n	--in-place \"$1\"\n\n# --config <resolved shared path> (config-resolution workstream, #676) — falls\n# back to devmoji's own auto-discovery of a local devmoji.config.cjs when the\n# shared package's built dist/ isn't present (not installed, or a stale\n# install predating this file).\nDEVMOJI_CONFIG=\"node_modules/@theholocron/devmoji-config/dist/index.cjs\"\nif [ -f \"$DEVMOJI_CONFIG\" ]; then\n	npx devmoji --config \"$DEVMOJI_CONFIG\" -e\nelse\n	npx devmoji -e\nfi\n";
 //#endregion
 //#region src/templates/configs/prepare-commit-msg/create-config.ts
 const { workflowHeader: workflowHeader$3 } = createHeader({ source: "packages/cli/src/templates/configs/prepare-commit-msg/create-config.ts" });
@@ -4518,6 +4908,10 @@ const { workflowHeader: workflowHeader$1 } = createHeader({
 	source: "packages/cli/src/commands/setup/run-setup.ts",
 	tool: "holocron setup"
 });
+const { workflowHeader: thinCallerHeader } = createHeader({
+	source: "packages/astromech/src/thin-callers.ts",
+	tool: "holocron setup"
+});
 async function runSetup(input) {
 	const print = input.print ?? ((line) => console.log(line));
 	const logger = getLogger();
@@ -4552,7 +4946,7 @@ async function runSetup(input) {
 			}, { skipCodes: SECURITY_SKIP_CODES[method] }));
 			print(formatStep(steps[steps.length - 1]));
 		}
-		const usesAdvancedCodeQL = (config.tasks ?? []).map((e) => typeof e === "string" ? e : e.name).includes("codeql");
+		const usesAdvancedCodeQL = (config.tasks ?? []).map((e) => typeof e === "string" ? e : e.name).includes("security.codeScanning");
 		steps.push(await runStep("source", usesAdvancedCodeQL ? "disableDefaultCodeScanning" : "enableCodeScanning", dryRun, async () => {
 			if (usesAdvancedCodeQL) await source.disableDefaultCodeScanning();
 			else return await source.enableCodeScanning();
@@ -4589,7 +4983,8 @@ async function runSetup(input) {
 		}).thinCallers();
 		for (const entry of tasks) {
 			const name = typeof entry === "string" ? entry : entry.name;
-			if (!KNOWN_WORKFLOWS.has(name)) {
+			const isCombinedContentOnly = name === "knowledge.docs" || name === "knowledge.components";
+			if (!KNOWN_WORKFLOWS.has(name) && !isCombinedContentOnly) {
 				steps.push({
 					capability: "source",
 					step: `write workflow ${name}`,
@@ -4599,12 +4994,12 @@ async function runSetup(input) {
 				print(formatStep(steps[steps.length - 1]));
 				continue;
 			}
-			const filename = name === "deploy" ? "deploy.yml" : `${name}.yml`;
+			const filename = `${name}.yml`;
 			const content = files.get(filename);
 			if (content === void 0) continue;
-			const step = name === "deploy" && content.includes("workflows/preview.yml@main") ? "write workflow deploy (with preview)" : `write workflow ${name}`;
+			const step = content.includes("workflows/preview.yml@main") ? `write workflow ${name} (with preview)` : `write workflow ${name}`;
 			steps.push(await runStep("source", step, dryRun, async () => {
-				await source.writeWorkflowFile(filename, `${workflowHeader$1()}${content}`);
+				await source.writeWorkflowFile(filename, `${thinCallerHeader()}${content}`);
 			}));
 			print(formatStep(steps[steps.length - 1]));
 		}
@@ -4665,6 +5060,10 @@ async function runSetup(input) {
 			await source.writeRepoFile(".husky/prepare-commit-msg", createConfig$1());
 		}));
 		print(formatStep(steps[steps.length - 1]));
+		steps.push(await runStep("source", "write .husky/commit-msg", dryRun, async () => {
+			await source.writeRepoFile(".husky/commit-msg", createConfig$7());
+		}));
+		print(formatStep(steps[steps.length - 1]));
 		if (hooksEnabled) {
 			steps.push(await runStep("source", "write .husky/pre-push", dryRun, async () => {
 				await source.writeRepoFile(".husky/pre-push", createConfig$2(config.holocronScript));
@@ -4699,7 +5098,7 @@ async function runSetup(input) {
 			print(formatStep(steps[steps.length - 1]));
 		}
 		{
-			const hasTestWorkflow = (config.tasks ?? []).map((e) => typeof e === "string" ? e : e.name).includes("test");
+			const hasTestWorkflow = (config.tasks ?? []).map((e) => typeof e === "string" ? e : e.name).includes("verification.unitTests");
 			const existing = await readFile(join(input.context.repoRoot, "codecov.yml"), "utf8").catch(() => null);
 			if (!hasTestWorkflow && existing == null) steps.push({
 				capability: "source",
@@ -4718,6 +5117,34 @@ async function runSetup(input) {
 			}));
 			print(formatStep(steps[steps.length - 1]));
 		}
+		{
+			const astromechTurbo = createAstromech({
+				cwd: input.context.repoRoot,
+				config: { tasks: config.tasks },
+				logger
+			});
+			const content = astromechTurbo.turboConfig();
+			if (content === null) steps.push({
+				capability: "source",
+				step: "write turbo.json",
+				status: "skip",
+				message: "no fan-out-eligible tasks configured"
+			});
+			else {
+				steps.push(await runStep("source", "write turbo.json", dryRun, async () => {
+					await source.writeRepoFile("turbo.json", content);
+				}));
+				print(formatStep(steps[steps.length - 1]));
+				const rootPkg = await readFile(join(input.context.repoRoot, "package.json"), "utf8").then((raw) => JSON.parse(raw)).catch(() => null);
+				const workspaceYaml = await readFile(join(input.context.repoRoot, "pnpm-workspace.yaml"), "utf8").catch(() => "");
+				const rootScripts = Object.keys(rootPkg?.scripts ?? {});
+				const workspaceFix = astromechTurbo.ensureRootWorkspaceMember(workspaceYaml, rootScripts);
+				if (workspaceFix.changed) steps.push(await runStep("source", "fix pnpm-workspace.yaml (root workspace member, #692)", dryRun, async () => {
+					await source.writeRepoFile("pnpm-workspace.yaml", workspaceFix.content);
+				}));
+			}
+			print(formatStep(steps[steps.length - 1]));
+		}
 		if (source.syncLabels) {
 			steps.push(await runStep("source", "sync labels", dryRun, async () => {
 				return source.syncLabels(CANONICAL_LABELS, STALE_LABELS);
@@ -4856,7 +5283,7 @@ async function runSetup(input) {
 	if (loader.has("deployment")) {
 		const deploy = loader.get("deployment");
 		print(style.step("deployment"));
-		const deployEntry = (config.tasks ?? []).map((e) => typeof e === "string" ? { name: e } : e).find((e) => e.name === "deploy");
+		const deployEntry = (config.tasks ?? []).map((e) => typeof e === "string" ? { name: e } : e).find((e) => e.name === "delivery.deploy" || e.name === "knowledge.docs" || e.name === "knowledge.components");
 		const previewCfg = deployEntry?.with ? extractPreviewConfig(deployEntry.with, {
 			org: config.org,
 			domain: config.domain
@@ -5580,7 +6007,7 @@ async function runSyncWiki(input) {
 //#endregion
 //#region src/commands/sync.ts
 const { workflowHeader } = createHeader({
-	source: "packages/cli/src/commands/sync.ts",
+	source: "packages/astromech/src/thin-callers.ts",
 	tool: "holocron sync"
 });
 const SYNC_STEPS = [
@@ -5594,6 +6021,7 @@ const SYNC_STEPS = [
 	"readme",
 	"workflows",
 	"scripts",
+	"turbo",
 	"wiki"
 ];
 const LOCAL_STEPS = /* @__PURE__ */ new Set([
@@ -5603,6 +6031,7 @@ const LOCAL_STEPS = /* @__PURE__ */ new Set([
 	"readme",
 	"workflows",
 	"scripts",
+	"turbo",
 	"wiki"
 ]);
 async function runSync(input) {
@@ -5751,6 +6180,7 @@ async function runSync(input) {
 		"readme",
 		"workflows",
 		"scripts",
+		"turbo",
 		"wiki"
 	]) {
 		if (requestedSteps !== void 0 && !requestedSteps.includes(stepName)) continue;
@@ -5855,7 +6285,8 @@ async function runSync(input) {
 				}).thinCallers();
 				for (const entry of taskEntries) {
 					const name = typeof entry === "string" ? entry : entry.name;
-					if (!KNOWN_WORKFLOWS.has(name)) {
+					const isCombinedContentOnly = name === "knowledge.docs" || name === "knowledge.components";
+					if (!KNOWN_WORKFLOWS.has(name) && !isCombinedContentOnly) {
 						steps.push({
 							capability: "local",
 							step: `sync workflow ${name}`,
@@ -5865,10 +6296,10 @@ async function runSync(input) {
 						print(formatSyncStep(steps[steps.length - 1]));
 						continue;
 					}
-					const filename = name === "deploy" ? "deploy.yml" : `${name}.yml`;
+					const filename = `${name}.yml`;
 					const content = files.get(filename);
 					if (content === void 0) continue;
-					const step = `sync workflow ${name}${name === "deploy" && content.includes("workflows/preview.yml@main") ? " (with preview)" : ""}`;
+					const step = `sync workflow ${name}${content.includes("workflows/preview.yml@main") ? " (with preview)" : ""}`;
 					steps.push(await runSyncStep("local", step, dryRun, async () => {
 						await writeWorkflowFile(input.context.repoRoot, filename, `${workflowHeader()}${content}`);
 					}));
@@ -5900,6 +6331,38 @@ async function runSync(input) {
 			}));
 			print(formatSyncStep(steps[steps.length - 1]));
 		}
+		if (stepName === "turbo") {
+			const astromechTurbo = createAstromech({
+				cwd: input.context.repoRoot,
+				config: { tasks: config.tasks },
+				logger
+			});
+			const content = astromechTurbo.turboConfig();
+			if (content === null) {
+				steps.push({
+					capability: "local",
+					step: "sync turbo.json",
+					status: "skip",
+					message: "no fan-out-eligible tasks configured"
+				});
+				print(formatSyncStep(steps[steps.length - 1]));
+			} else {
+				steps.push(await runSyncStep("local", "sync turbo.json", dryRun, async () => {
+					await writeFile(join(input.context.repoRoot, "turbo.json"), content, "utf8");
+				}));
+				print(formatSyncStep(steps[steps.length - 1]));
+				const rootPkg = await readFile(join(input.context.repoRoot, "package.json"), "utf8").then((raw) => JSON.parse(raw)).catch(() => null);
+				const workspaceYaml = await readFile(join(input.context.repoRoot, "pnpm-workspace.yaml"), "utf8").catch(() => "");
+				const rootScripts = Object.keys(rootPkg?.scripts ?? {});
+				const workspaceFix = astromechTurbo.ensureRootWorkspaceMember(workspaceYaml, rootScripts);
+				if (workspaceFix.changed) {
+					steps.push(await runSyncStep("local", "fix pnpm-workspace.yaml (root workspace member, #692)", dryRun, async () => {
+						await writeFile(join(input.context.repoRoot, "pnpm-workspace.yaml"), workspaceFix.content, "utf8");
+					}));
+					print(formatSyncStep(steps[steps.length - 1]));
+				}
+			}
+		}
 		if (stepName === "wiki") {
 			const result = await runSyncWiki({
 				loaded: input.loaded,
@@ -7743,24 +8206,59 @@ try {
 	}).command("publish", "Publish @theholocron/* packages to npm", (y) => y.option("initial", {
 		type: "boolean",
 		default: false,
-		describe: "One-shot bootstrap publish for trusted-publishing-eligible packages (npm needs the package to exist before Trusted Publishing can be configured for it). Required today — a non-initial `publish` isn't implemented yet."
+		describe: "One-shot bootstrap publish for trusted-publishing-eligible packages (npm needs the package to exist before Trusted Publishing can be configured for it). Skips the steady-state OIDC path below — use only for a package's very first publish."
 	}).option("tag", {
 		type: "string",
-		default: "alpha",
-		describe: "npm distribution tag (defaults to alpha)"
+		describe: "npm distribution tag. Defaults to alpha for --initial, latest for a steady-state publish."
 	}).option("otp", {
 		type: "string",
 		describe: "One-time password from your authenticator (required if npm needs 2FA for writes)"
+	}).option("sync-trust", {
+		type: "array",
+		describe: "Migrate npm Trusted Publisher config to a new workflow filename across every public package: --sync-trust <old-file> <new-file>. See issue #689 — npm requires fresh interactive 2FA per package; re-run after approving the printed authUrl if it stops early."
+	}).option("repo", {
+		type: "string",
+		describe: "owner/repo for Trusted Publisher config (--sync-trust). Defaults to theholocron/holocron."
+	}).option("provenance", {
+		type: "boolean",
+		default: true,
+		describe: "Publish with --provenance (steady-state only). Default on — free under CI/OIDC."
+	}).option("skip-already-published", {
+		type: "boolean",
+		default: false,
+		describe: "Steady-state only: check `npm view <pkg>@<version>` before publishing each package and skip it if that exact version already exists, instead of one bulk publish. For repos that ship many independently-versioned packages where a release doesn't bump every one."
 	}), async (argv) => {
-		if (!argv.initial) {
-			getLogger().error("publish: only `--initial` is supported today. Run `holocron publish --initial`.");
-			process.exitCode = 1;
+		if (argv.syncTrust) {
+			const [oldFile, newFile] = argv.syncTrust;
+			if (!oldFile || !newFile) {
+				getLogger().error("publish --sync-trust requires exactly two values: <old-file> <new-file>");
+				process.exitCode = 1;
+				return;
+			}
+			if ((await runSyncTrust({
+				cwd: argv.cwd,
+				oldFile,
+				newFile,
+				dryRun: argv.dryRun,
+				...argv.repo ? { repo: argv.repo } : {}
+			})).status === "fail") process.exitCode = 1;
+			return;
+		}
+		if (argv.initial) {
+			if ((await runPublish({
+				cwd: argv.cwd,
+				dryRun: argv.dryRun,
+				...argv.tag ? { tag: argv.tag } : {},
+				...argv.otp ? { otp: argv.otp } : {}
+			})).status === "fail") process.exitCode = 1;
 			return;
 		}
-		if ((await runPublish({
+		if ((await runSteadyPublish({
 			cwd: argv.cwd,
-			tag: argv.tag,
 			dryRun: argv.dryRun,
+			provenance: argv.provenance,
+			skipAlreadyPublished: argv.skipAlreadyPublished,
+			...argv.tag ? { tag: argv.tag } : {},
 			...argv.otp ? { otp: argv.otp } : {}
 		})).status === "fail") process.exitCode = 1;
 	}).command("sync [steps..]", "Sync state from config to the provider and local files (labels, properties, teams, topics, keywords, description, homepage, readme, workflows, scripts, wiki)", (y) => y.positional("steps", {