@theholocron/cli 5.0.0-alpha.152 → 5.0.0-alpha.154

package/dist/index.d.mts

@@ -4,18 +4,19 @@ import { PackageJson } from "@theholocron/pkg-utils";
 import { ConfigFileError } from "@theholocron/datapad";
 import { LogLevel } from "@theholocron/observability/core";
 import { WorkspacePackage } from "@theholocron/astromech";
-import { QualifiedConfig } from "@commitlint/types";
-//#region src/auth/auth-resolver.d.ts
+//#region src/auth/auth-resolver/auth-resolver.type.d.ts
 type ResolveTokenConfig = Omit<ResolveTokenConfig$1, "getKeyringToken">;
-/** Wraps `createResolveToken` from `@theholocron/http` and injects the
- *  system keyring so plugins stay at a one-liner call site. */
-declare function createResolveToken(config: ResolveTokenConfig): (input?: ResolveTokenInput) => string;
 interface FeatureResolverConfig {
   /** Env var name for this feature, e.g. `"HOLOCRON_ISSUES_TOKEN"`. */
   envName: string;
   /** Keyring account key, e.g. `"github.issues"`. */
   keyringKey: string;
 }
+//#endregion
+//#region src/auth/auth-resolver/auth-resolver.d.ts
+/** Wraps `createResolveToken` from `@theholocron/http` and injects the
+ *  system keyring so plugins stay at a one-liner call site. */
+declare function createResolveToken(config: ResolveTokenConfig): (input?: ResolveTokenInput) => string;
 /**
  * Build a strict, single-feature token resolver.
  *
@@ -25,7 +26,7 @@ interface FeatureResolverConfig {
  */
 declare function createFeatureResolver(config: FeatureResolverConfig): (input?: ResolveTokenInput) => string;
 //#endregion
-//#region src/auth/keyring.d.ts
+//#region src/auth/keyring/keyring.d.ts
 /**
  * Keyring-backed bootstrap credential store.
  *
@@ -69,7 +70,7 @@ declare function deleteToken(provider: string): boolean;
  */
 declare function listStoredProviders(): string[];
 //#endregion
-//#region src/commands/auth.d.ts
+//#region src/commands/auth/auth.type.d.ts
 interface VerifyTokenSuccess {
   ok: true;
   /** "workplace: acme" / "user: cnewton@x" — surfaced in success output. */
@@ -82,7 +83,7 @@ interface VerifyTokenFailure {
 }
 type VerifyTokenResult = VerifyTokenSuccess | VerifyTokenFailure;
 //#endregion
-//#region src/config/config.d.ts
+//#region src/config/config/config.type.d.ts
 /** Structured-logging config. The Axiom **token** never lives here — only in
  *  env vars or the OS keyring — but the non-secret dataset name may. */
 interface LogConfig {
@@ -582,6 +583,8 @@ interface ResolvedHolocronConfig {
   telemetry?: TelemetryConfig;
   eslint?: EslintConfig;
 }
+//#endregion
+//#region src/config/config/config.d.ts
 declare class ConfigError extends Error {
   name: string;
 }
@@ -594,94 +597,7 @@ declare function resolvePluginPackage(provider: string): string;
 declare function resolveEntry(key: CapabilityKey, raw: RawProviderEntry): ResolvedProviderEntry;
 declare function resolveConfig(raw: HolocronConfig): ResolvedHolocronConfig;
 //#endregion
-//#region src/commands/setup/derived-properties.d.ts
-/**
- * Derived custom-properties (#677). Unlike the existing 6 GitHub
- * custom-properties fields (`lifecycle`, `open_source`, `runtime_environment`,
- * `uses_external_packages`, `monorepo`, `branch_protection_level`) — which
- * mirror what `holocron.config.ts` already states explicitly — these four are
- * *derived*: signal that isn't an explicit config field today (framework
- * choice, repo archetype, capability drift). See
- * `.notes/tech-holocron-platform.spec.md` → "Custom-properties sync — field
- * definitions (#677)" for the full design.
- */
-type HolocronProfile = "library" | "cli" | "plugin" | "template" | "app" | "docs" | "platform";
-/** The `package.json` shape profile derivation reads — `@theholocron/pkg-utils`'s `PackageJson`, under the name Sentinel already imports. */
-type PackageJsonLike = PackageJson;
-interface DeriveProfileInput {
-  rootPackageJson: PackageJsonLike | null;
-  repoName: string;
-  isMonorepo: boolean;
-  /** `packages/*` package.json contents, monorepo repos only — used to find the primary published artifact. */
-  workspacePackageJsons: PackageJsonLike[];
-}
-/**
- * Repo archetype, in priority order:
- * 1. `*-template` repo name → `template` (independent of package shape).
- * 2. Monorepo whose primary published artifact is a CLI (some workspace
- *    package has `bin`) → `platform` — matches `holocron` itself: the CLI is
- *    the deliverable, the plugin packages are supporting infrastructure for
- *    it, not separate products.
- * 3. Monorepo with no CLI but at least one non-private workspace package →
- *    `library` — matches `clients`/`configs`/`utils`/`themes`/
- *    `observability`: a family of published packages, none of them a CLI.
- *    Checked *before* falling into the root-package branch below, because
- *    these repos' own root `package.json` is private and often carries
- *    `@theholocron/astro-config` for a docs site built from the monorepo
- *    root — without this check they'd wrongly resolve to `docs` off that
- *    root-level signal alone, when the docs site is a secondary concern of
- *    a library collection, not what the repo fundamentally is.
- * 4. Single-package repo with `package.json#bin` → `cli`.
- * 5. Docs-only site (astro/starlight present, root package private, no
- *    publishable exports) → `docs`.
- * 6. Private, non-publishable, non-docs → `app`.
- * 7. Otherwise, a single publishable package → `library`.
- */
-declare function deriveProfile(input: DeriveProfileInput): HolocronProfile;
-/**
- * Detected build/framework tooling — the literal "does this repo need
- * next/vite/tsdown" signal `holocron.config.ts` has no field for today
- * (framework choice isn't a config concept, unlike `providers`/`tasks`).
- * Curated table, not exhaustive by design — add to `KNOWN_STACK_DEPS` as new
- * frameworks show up rather than trying to detect anything on npm.
- */
-declare function deriveStack(pkg: PackageJsonLike | null): string[];
-/** The provider capability keys actually wired in `providers: {}` — zero heuristics. */
-declare function deriveCapabilities(providers: ResolvedProvidersConfig | undefined): string[];
-declare function deriveCompliance(capabilities: readonly string[]): "compliant" | "non-compliant";
-/**
- * The Phase B refinement `deriveCompliance()`'s own doc comment names —
- * *why* a repo is non-compliant, not just that it is. `[]` when compliant.
- * Same `REQUIRED_BASELINE` `deriveCompliance()` checks against — one
- * table, not two independently-maintained baselines.
- */
-declare function missingCapabilities(capabilities: readonly string[]): string[];
-/**
- * Reads each workspace package's actual `package.json` content (not just
- * `readWorkspacePackages()`'s `{ slug, name, dir }` — `deriveProfile()`'s
- * `platform` detection needs `bin`, which that helper doesn't carry).
- * Missing/invalid files are skipped, matching `readWorkspacePackages()`'s
- * own soft-fail behavior.
- */
-declare function readWorkspacePackageJsons(repoRoot: string, workspacePackages: readonly WorkspacePackage[]): Promise<PackageJsonLike[]>;
-//#endregion
-//#region src/commit-lint/lint-message.d.ts
-interface CommitMessageViolation {
-  /** Rule name, e.g. `"subject-empty"`. */
-  rule: string;
-  /** commitlint's own message for the failure, e.g. `"subject may not be empty"`. */
-  message: string;
-}
-declare function lintCommitMessage(message: string, loaded: QualifiedConfig): Promise<CommitMessageViolation[]>;
-//#endregion
-//#region src/commit-lint/lint-commit-msg-file.d.ts
-interface LintCommitMsgFileResult {
-  valid: boolean;
-  violations: CommitMessageViolation[];
-}
-declare function lintCommitMsgFile(filePath: string, cwd?: string): Promise<LintCommitMsgFileResult>;
-//#endregion
-//#region src/config/compose.d.ts
+//#region src/config/compose/compose.type.d.ts
 type TaskEntry = NonNullable<HolocronConfig["tasks"]>[number];
 /** A single composable capability fragment. */
 interface Capability {
@@ -720,6 +636,8 @@ interface ComposedPreset {
   domain?: string;
   docs?: DocsConfig;
 }
+//#endregion
+//#region src/config/compose/compose.d.ts
 /**
  * Merge any number of capability fragments into a single preset object that
  * spreads directly into `defineConfig()`.
@@ -743,15 +661,17 @@ interface ComposedPreset {
  */
 declare function compose(...args: (Capability | Capability[])[]): ComposedPreset;
 //#endregion
-//#region src/config/define-config.d.ts
+//#region src/config/define-config/define-config.d.ts
 declare function defineConfig(config: HolocronConfig): HolocronConfig;
 //#endregion
-//#region src/config/load-config.d.ts
+//#region src/config/load-config/load-config.type.d.ts
 interface LoadedConfig {
   resolved: ResolvedHolocronConfig;
   /** Absolute path to the file the config was read from. */
   filepath: string;
 }
+//#endregion
+//#region src/config/load-config/load-config.d.ts
 /**
  * Read + parse + resolve `holocron.config.*` starting from the given
  * directory, walking up through ancestors to the nearest `.git` boundary
@@ -763,77 +683,77 @@ interface LoadedConfig {
  */
 declare function loadConfig(cwd: string): Promise<LoadedConfig>;
 //#endregion
-//#region src/editorconfig/config.d.ts
+//#region src/commands/setup/derived-properties/derived-properties.type.d.ts
 /**
- * The paths editorconfig-checker skips, read from the same
- * `editorconfig-checker.json` template `holocron repo setup` writes as a repo's
- * `.editorconfig-checker.json` — so Sentinel's central editorconfig check
- * (holocron#927) excludes exactly what CI's editorconfig-checker does, from
- * one source.
- *
- * The exclusion that matters most is `\.md$` / `\.mdx$`: the generated
- * `.editorconfig` gives every file tab indentation, but
- * `@theholocron/prettier-config` formats markdown with spaces, so a README's
- * indented code example would fail one tool or the other. Markdown is left
- * to prettier and markdownlint.
- *
- * Each entry is a regular-expression source, matched against a
- * repo-relative path, as editorconfig-checker itself treats them.
+ * Derived custom-properties (#677). Unlike the existing 6 GitHub
+ * custom-properties fields (`lifecycle`, `open_source`, `runtime_environment`,
+ * `uses_external_packages`, `monorepo`, `branch_protection_level`) — which
+ * mirror what `holocron.config.ts` already states explicitly — these four are
+ * *derived*: signal that isn't an explicit config field today (framework
+ * choice, repo archetype, capability drift). See
+ * `.notes/tech-holocron-platform.spec.md` → "Custom-properties sync — field
+ * definitions (#677)" for the full design.
  */
-declare const EDITORCONFIG_CHECKER_EXCLUDE: readonly string[];
-/** `true` when `path` matches any {@link EDITORCONFIG_CHECKER_EXCLUDE} pattern. */
-declare function isEditorConfigExcluded(path: string): boolean;
+type HolocronProfile = "library" | "cli" | "plugin" | "template" | "app" | "docs" | "platform";
+/** The `package.json` shape profile derivation reads — `@theholocron/pkg-utils`'s `PackageJson`, under the name Sentinel already imports. */
+type PackageJsonLike = PackageJson;
+interface DeriveProfileInput {
+  rootPackageJson: PackageJsonLike | null;
+  repoName: string;
+  isMonorepo: boolean;
+  /** `packages/*` package.json contents, monorepo repos only — used to find the primary published artifact. */
+  workspacePackageJsons: PackageJsonLike[];
+}
 //#endregion
-//#region src/formatting/config.d.ts
+//#region src/commands/setup/derived-properties/derived-properties.d.ts
 /**
- * The org's canonical prettier ignore-pattern list for a central Sentinel
- * check (holocron#769/#819) — the `PRETTIER_CONFIG` object itself doesn't
- * need a home here, since `@theholocron/prettier-config`'s default export
- * already *is* one canonical, importable config (the same "one config,
- * not N copies" reasoning `@theholocron/commitlint-config` established for
- * commit-message linting, and `ALEX_CONFIG` established for inclusive
- * language) — only the ignore list is a Sentinel-specific decision that
- * belongs alongside `ALEX_IGNORE_PATTERNS`, not inside the config package.
- *
- * Reuses `ALEX_IGNORE_PATTERNS`' own entries (`.github/*`, `CHANGELOG.md`,
- * `LICENSE` all independently confirmed to fail a real `prettier.check()`
- * today — machine-generated or unparseable content, same reasoning that
- * excluded them from alex), plus `pnpm-lock.yaml` — prettier-specific
- * (alex never reads a lockfile, but prettier would try to reformat it):
- * machine-written by pnpm's own writer, and not gitignored (lockfiles are
- * tracked), so prettier picks it up by default. Reformatting it just
- * fights every subsequent `pnpm install` (this repo's own `.prettierignore`
- * already excludes it for that exact reason).
+ * Repo archetype, in priority order:
+ * 1. `*-template` repo name → `template` (independent of package shape).
+ * 2. Monorepo whose primary published artifact is a CLI (some workspace
+ *    package has `bin`) → `platform` — matches `holocron` itself: the CLI is
+ *    the deliverable, the plugin packages are supporting infrastructure for
+ *    it, not separate products.
+ * 3. Monorepo with no CLI but at least one non-private workspace package →
+ *    `library` — matches `clients`/`configs`/`utils`/`themes`/
+ *    `observability`: a family of published packages, none of them a CLI.
+ *    Checked *before* falling into the root-package branch below, because
+ *    these repos' own root `package.json` is private and often carries
+ *    `@theholocron/astro-config` for a docs site built from the monorepo
+ *    root — without this check they'd wrongly resolve to `docs` off that
+ *    root-level signal alone, when the docs site is a secondary concern of
+ *    a library collection, not what the repo fundamentally is.
+ * 4. Single-package repo with `package.json#bin` → `cli`.
+ * 5. Docs-only site (astro/starlight present, root package private, no
+ *    publishable exports) → `docs`.
+ * 6. Private, non-publishable, non-docs → `app`.
+ * 7. Otherwise, a single publishable package → `library`.
  */
-declare const PRETTIER_IGNORE_PATTERNS: string[];
-//#endregion
-//#region src/inclusive-language/config.d.ts
+declare function deriveProfile(input: DeriveProfileInput): HolocronProfile;
 /**
- * The org's canonical `alex` (inclusive-language) config, as raw parsed
- * data rather than the pre-rendered file strings `createRcConfig()`/
- * `createIgnoreConfig()` produce for `holocron repo setup` to write into a
- * repo's own `.alexrc.json`/`.alexignore`.
- *
- * `.alexrc.json` is explicitly "generated by `holocron repo setup` — do not
- * edit manually" (this repo's own `AGENTS.md`) — the real source of truth
- * is this JSON file, one canonical copy, not each repo's synced one. A
- * central Sentinel check (holocron#769/#793) reads it directly rather
- * than fetching each repo's own copy via the Contents API — the same "one
- * config, not N copies" reasoning `@theholocron/commitlint-config` already
- * established for commit-message linting.
+ * Detected build/framework tooling — the literal "does this repo need
+ * next/vite/tsdown" signal `holocron.config.ts` has no field for today
+ * (framework choice isn't a config concept, unlike `providers`/`tasks`).
+ * Curated table, not exhaustive by design — add to `KNOWN_STACK_DEPS` as new
+ * frameworks show up rather than trying to detect anything on npm.
  */
-declare const ALEX_CONFIG: {
-  allow: string[];
-};
+declare function deriveStack(pkg: PackageJsonLike | null): string[];
+/** The provider capability keys actually wired in `providers: {}` — zero heuristics. */
+declare function deriveCapabilities(providers: ResolvedProvidersConfig | undefined): string[];
+declare function deriveCompliance(capabilities: readonly string[]): "compliant" | "non-compliant";
 /**
- * Glob-ish path patterns `alex` skips. Kept as a literal here rather than
- * importing `../templates/configs/alexjs/alexignore` directly — that file
- * (like `commit-msg`/`pre-push`) is deliberately extensionless, matching
- * the real filename `holocron repo setup` writes, which ECMAScript's own
- * module resolution (`moduleResolution: "nodenext"`) can't import across
- * a package boundary without an extension. Keep in sync with that file by
- * hand; it changes rarely.
+ * The Phase B refinement `deriveCompliance()`'s own doc comment names —
+ * *why* a repo is non-compliant, not just that it is. `[]` when compliant.
+ * Same `REQUIRED_BASELINE` `deriveCompliance()` checks against — one
+ * table, not two independently-maintained baselines.
  */
-declare const ALEX_IGNORE_PATTERNS: string[];
+declare function missingCapabilities(capabilities: readonly string[]): string[];
+/**
+ * Reads each workspace package's actual `package.json` content (not just
+ * `readWorkspacePackages()`'s `{ slug, name, dir }` — `deriveProfile()`'s
+ * `platform` detection needs `bin`, which that helper doesn't carry).
+ * Missing/invalid files are skipped, matching `readWorkspacePackages()`'s
+ * own soft-fail behavior.
+ */
+declare function readWorkspacePackageJsons(repoRoot: string, workspacePackages: readonly WorkspacePackage[]): Promise<PackageJsonLike[]>;
 //#endregion
-export { ALEX_CONFIG, ALEX_IGNORE_PATTERNS, Analytics, AppConfig, Auth, AuthDescription, AuthError, AuthEvent, AuthEventType, AuthIdentity, AuthUser, CARDINALITY, Capability, CapabilityConfigPackage, CapabilityImpls, CapabilityKey, Cardinality, CardinalityFor, ChromaticProjectConfig, Ci, CiRun, CiRunFilter, CiRunStatus, CommitMessageViolation, ComposedPreset, ConfigError, ConfigFileError, ConnectionStringOptions, CreateAuthUserInput, DeployFunctionConfig, DeployFunctionResult, DeployScriptConfig, DeployScriptResult, Deployment, DeploymentProject, DeploymentProjectSettings, DeploymentRecord, DeploymentTarget, DeploymentTrigger, DeriveProfileInput, Dns, DnsRecord, DnsRecordRequest, DnsRecordType, DocsConfig, DoctorConfig, EDITORCONFIG_CHECKER_EXCLUDE, EnsureResult, EnvConfig, Environment, EnvironmentReviewer, Environments, Errors, EslintConfig, FeatureResolverConfig, HolocronConfig, HolocronProfile, Issue, IssueSearchFilter, Issues, LabelDef, LifecycleResult, LifecycleSlot, LintCommitMsgFileResult, LoadedConfig, LogConfig, Logs, Monitoring, MonitoringAssertion, MonitoringAssertionComparison, MonitoringAssertionSource, MonitoringCheck, MonitoringCheckInput, MonitoringHttpMethod, MultiEntry, NormalizedAuthUser, Notifications, PRETTIER_IGNORE_PATTERNS, PackageJsonLike, PagesConfig, ParseWebhookInput, ProviderApiError, ProviderIdentity, ProviderOptions, PullRequest, REQUIRED_CAPABILITIES, RawProviderEntry, RawProvidersConfig, RepoConfig, RepoProperties, RepoProtection, RepoRef, RepoSettings, type RequestOptions, ResolveTokenConfig, type ResolveTokenInput, ResolvedCapability, ResolvedHolocronConfig, ResolvedProviderEntry, ResolvedProvidersConfig, ResolvedTuple, type RestClient, type RestClientConfig, Ruleset, SecretScope, Secrets, SingleEntry, Source, StatusCategory, Storage, StorageBranch, StorybookDeployProject, TaskEntryConfig, TeamEntry, TeamPermission, TelemetryConfig, Tooling, ToolingDoctorReport, TrackerDoctorReport, TrackerUser, Vault, type VerifyTokenFailure, type VerifyTokenResult, type VerifyTokenSuccess, WebhookDashboardInfo, WebhookVerificationError, Wiki, WikiProvisionOpts, WikiProxyConfig, Workers, WorkflowWithConfig, compose, createFeatureResolver, createResolveToken, createRestClient, defineConfig, deleteToken, deriveCapabilities, deriveCompliance, deriveProfile, deriveStack, getToken, isEditorConfigExcluded, isMulti, lintCommitMessage, lintCommitMsgFile, listStoredProviders, loadConfig, missingCapabilities, readWorkspacePackageJsons, resolveConfig, resolveEntry, resolvePluginPackage, setToken };
+export { Analytics, type AppConfig, Auth, AuthDescription, AuthError, AuthEvent, AuthEventType, AuthIdentity, AuthUser, CARDINALITY, type Capability, type CapabilityConfigPackage, CapabilityImpls, CapabilityKey, Cardinality, CardinalityFor, type ChromaticProjectConfig, Ci, CiRun, CiRunFilter, CiRunStatus, type ComposedPreset, ConfigError, ConfigFileError, ConnectionStringOptions, CreateAuthUserInput, DeployFunctionConfig, DeployFunctionResult, DeployScriptConfig, DeployScriptResult, Deployment, DeploymentProject, DeploymentProjectSettings, DeploymentRecord, DeploymentTarget, DeploymentTrigger, type DeriveProfileInput, Dns, DnsRecord, DnsRecordRequest, DnsRecordType, type DocsConfig, type DoctorConfig, EnsureResult, type EnvConfig, Environment, EnvironmentReviewer, Environments, Errors, type EslintConfig, type FeatureResolverConfig, type HolocronConfig, type HolocronProfile, Issue, IssueSearchFilter, Issues, LabelDef, LifecycleResult, LifecycleSlot, type LoadedConfig, type LogConfig, Logs, Monitoring, MonitoringAssertion, MonitoringAssertionComparison, MonitoringAssertionSource, MonitoringCheck, MonitoringCheckInput, MonitoringHttpMethod, type MultiEntry, NormalizedAuthUser, Notifications, type PackageJsonLike, PagesConfig, ParseWebhookInput, ProviderApiError, ProviderIdentity, type ProviderOptions, PullRequest, REQUIRED_CAPABILITIES, type RawProviderEntry, type RawProvidersConfig, type RepoConfig, type RepoProperties, type RepoProtection, RepoRef, RepoSettings, type RequestOptions, type ResolveTokenConfig, type ResolveTokenInput, ResolvedCapability, type ResolvedHolocronConfig, type ResolvedProviderEntry, type ResolvedProvidersConfig, type ResolvedTuple, type RestClient, type RestClientConfig, Ruleset, SecretScope, Secrets, type SingleEntry, Source, StatusCategory, Storage, StorageBranch, type StorybookDeployProject, type TaskEntry, type TaskEntryConfig, TeamEntry, TeamPermission, type TelemetryConfig, Tooling, ToolingDoctorReport, TrackerDoctorReport, TrackerUser, Vault, type VerifyTokenFailure, type VerifyTokenResult, type VerifyTokenSuccess, WebhookDashboardInfo, WebhookVerificationError, Wiki, WikiProvisionOpts, WikiProxyConfig, Workers, type WorkflowWithConfig, compose, createFeatureResolver, createResolveToken, createRestClient, defineConfig, deleteToken, deriveCapabilities, deriveCompliance, deriveProfile, deriveStack, getToken, isMulti, listStoredProviders, loadConfig, missingCapabilities, readWorkspacePackageJsons, resolveConfig, resolveEntry, resolvePluginPackage, setToken };

package/dist/index.mjs

@@ -4,13 +4,10 @@ import { createEnvLookup, withEnvPrefix } from "@theholocron/env-utils";
 import { Entry, findCredentials } from "@napi-rs/keyring";
 import { basename, dirname, join } from "node:path";
 import { readPackageJson } from "@theholocron/pkg-utils";
-import { readFile } from "node:fs/promises";
-import load from "@commitlint/load";
-import lint from "@commitlint/lint";
 import { loadTasksConfig } from "@theholocron/astromech/config";
 import { ConfigFileError, ConfigFileError as ConfigFileError$1, loadConfigFile } from "@theholocron/datapad";
 import { readGitRemote } from "@theholocron/git-utils";
-//#region src/env.ts
+//#region src/env/env.ts
 /** Singleton env for simple global lookups throughout the CLI. */
 const env = createEnvLookup();
 withEnvPrefix(env, "HOLOCRON");
@@ -22,7 +19,7 @@ function makeEnv(source) {
 	return createEnvLookup(source);
 }
 //#endregion
-//#region src/auth/keyring.ts
+//#region src/auth/keyring/keyring.ts
 /**
 * Keyring-backed bootstrap credential store.
 *
@@ -92,7 +89,7 @@ function listStoredProviders() {
 	}
 }
 //#endregion
-//#region src/auth/auth-resolver.ts
+//#region src/auth/auth-resolver/auth-resolver.ts
 /** Wraps `createResolveToken` from `@theholocron/http` and injects the
 *  system keyring so plugins stay at a one-liner call site. */
 function createResolveToken(config) {
@@ -118,7 +115,7 @@ function createFeatureResolver(config) {
 	};
 }
 //#endregion
-//#region src/commands/setup/derived-properties.ts
+//#region src/commands/setup/derived-properties/derived-properties.ts
 /**
 * Repo archetype, in priority order:
 * 1. `*-template` repo name → `template` (independent of package shape).
@@ -225,64 +222,7 @@ async function readWorkspacePackageJsons(repoRoot, workspacePackages) {
 	return results;
 }
 //#endregion
-//#region src/commit-lint/lint-message.ts
-/**
-* Lints one commit message string against an already-loaded commitlint
-* config. The genuinely environment-independent half of commit-message
-* linting (holocron#789) — *obtaining* a `QualifiedConfig` differs by
-* caller (Sentinel isolates itself from any ambient config since it runs
-* standalone, away from a real repo checkout; `lintCommitMsgFile` below
-* just lets cosmiconfig discover the invoking repo's own
-* `commitlint.config.*`, matching `commitlint --edit`'s own contract) —
-* but linting one message against a loaded config is identical either way.
-*
-* Real `@commitlint/lint` — the same programmatic API `@commitlint/cli`
-* itself uses internally — never a reimplementation of commitlint's rules.
-*/
-/** `parserPreset.parserOpts`, if the loaded config sets one — same lookup `@commitlint/cli`'s own `selectParserOpts()` does. */
-function selectParserOpts(parserPreset) {
-	return parserPreset?.parserOpts;
-}
-async function lintCommitMessage(message, loaded) {
-	const opts = {
-		/* istanbul ignore next -- see comment above */
-		parserOpts: selectParserOpts(loaded.parserPreset) ?? {},
-		plugins: loaded.plugins,
-		/* istanbul ignore next -- see comment above */
-		ignores: loaded.ignores ?? [],
-		defaultIgnores: loaded.defaultIgnores !== false
-	};
-	const outcome = await lint(message, loaded.rules, opts);
-	if (outcome.valid) return [];
-	return outcome.errors.map((error) => ({
-		rule: error.name,
-		message: error.message
-	}));
-}
-//#endregion
-//#region src/commit-lint/lint-commit-msg-file.ts
-/**
-* `holocron run lint commit-msg <file>` — a real programmatic replacement for
-* shelling out to `commitlint --edit "$1"` from `.husky/commit-msg`
-* (holocron#789). Matches that CLI's own contract exactly: `file` is a
-* path to the commit message being written (the arg git's `commit-msg`
-* hook passes as `$1`), no `--config` override needed — `@commitlint/load`
-* runs from `cwd` with no seed, so cosmiconfig's own normal upward search
-* discovers the invoking repo's real `commitlint.config.*` file, exactly
-* as `commitlint --edit` (no `--config` flag) already does today. Unlike
-* Sentinel's `loadIsolatedConfig()`, no isolation is needed here — this
-* runs inside a real repo checkout with a real `node_modules`, not
-* standalone on a server.
-*/
-async function lintCommitMsgFile(filePath, cwd = process.cwd()) {
-	const violations = await lintCommitMessage(await readFile(filePath, "utf8"), await load({}, { cwd }));
-	return {
-		valid: violations.length === 0,
-		violations
-	};
-}
-//#endregion
-//#region src/config/config.ts
+//#region src/config/config/config.ts
 var ConfigError = class extends Error {
 	name = "ConfigError";
 };
@@ -391,7 +331,7 @@ function resolveConfig(raw) {
 	};
 }
 //#endregion
-//#region src/config/compose.ts
+//#region src/config/compose/compose.ts
 function taskName(e) {
 	return typeof e === "string" ? e : e.name;
 }
@@ -479,12 +419,12 @@ function compose(...args) {
 	};
 }
 //#endregion
-//#region src/config/define-config.ts
+//#region src/config/define-config/define-config.ts
 function defineConfig(config) {
 	return config;
 }
 //#endregion
-//#region src/config/load-config.ts
+//#region src/config/load-config/load-config.ts
 /**
 * `holocron.config.{ts,js,mjs,cjs,json}` loader.
 *
@@ -541,97 +481,4 @@ async function readPackageJsonName(dir) {
 	return name === void 0 ? void 0 : name.replace(/^@[^/]+\//, "");
 }
 //#endregion
-//#region src/editorconfig/config.ts
-/**
-* The paths editorconfig-checker skips, read from the same
-* `editorconfig-checker.json` template `holocron repo setup` writes as a repo's
-* `.editorconfig-checker.json` — so Sentinel's central editorconfig check
-* (holocron#927) excludes exactly what CI's editorconfig-checker does, from
-* one source.
-*
-* The exclusion that matters most is `\.md$` / `\.mdx$`: the generated
-* `.editorconfig` gives every file tab indentation, but
-* `@theholocron/prettier-config` formats markdown with spaces, so a README's
-* indented code example would fail one tool or the other. Markdown is left
-* to prettier and markdownlint.
-*
-* Each entry is a regular-expression source, matched against a
-* repo-relative path, as editorconfig-checker itself treats them.
-*/
-const EDITORCONFIG_CHECKER_EXCLUDE = [
-	"(^|.+/)LICENSE$",
-	"^public/.*",
-	"\\.md$",
-	"\\.mdx$"
-];
-/** `true` when `path` matches any {@link EDITORCONFIG_CHECKER_EXCLUDE} pattern. */
-function isEditorConfigExcluded(path) {
-	return EDITORCONFIG_CHECKER_EXCLUDE.some((pattern) => new RegExp(pattern).test(path));
-}
-//#endregion
-//#region src/inclusive-language/config.ts
-/**
-* The org's canonical `alex` (inclusive-language) config, as raw parsed
-* data rather than the pre-rendered file strings `createRcConfig()`/
-* `createIgnoreConfig()` produce for `holocron repo setup` to write into a
-* repo's own `.alexrc.json`/`.alexignore`.
-*
-* `.alexrc.json` is explicitly "generated by `holocron repo setup` — do not
-* edit manually" (this repo's own `AGENTS.md`) — the real source of truth
-* is this JSON file, one canonical copy, not each repo's synced one. A
-* central Sentinel check (holocron#769/#793) reads it directly rather
-* than fetching each repo's own copy via the Contents API — the same "one
-* config, not N copies" reasoning `@theholocron/commitlint-config` already
-* established for commit-message linting.
-*/
-const ALEX_CONFIG = { allow: [
-	"dead",
-	"execute",
-	"execution",
-	"executes",
-	"failure",
-	"failures",
-	"hook",
-	"hooks",
-	"husky",
-	"period"
-] };
-/**
-* Glob-ish path patterns `alex` skips. Kept as a literal here rather than
-* importing `../templates/configs/alexjs/alexignore` directly — that file
-* (like `commit-msg`/`pre-push`) is deliberately extensionless, matching
-* the real filename `holocron repo setup` writes, which ECMAScript's own
-* module resolution (`moduleResolution: "nodenext"`) can't import across
-* a package boundary without an extension. Keep in sync with that file by
-* hand; it changes rarely.
-*/
-const ALEX_IGNORE_PATTERNS = [
-	".github/*",
-	"CHANGELOG.md",
-	"LICENSE"
-];
-//#endregion
-//#region src/formatting/config.ts
-/**
-* The org's canonical prettier ignore-pattern list for a central Sentinel
-* check (holocron#769/#819) — the `PRETTIER_CONFIG` object itself doesn't
-* need a home here, since `@theholocron/prettier-config`'s default export
-* already *is* one canonical, importable config (the same "one config,
-* not N copies" reasoning `@theholocron/commitlint-config` established for
-* commit-message linting, and `ALEX_CONFIG` established for inclusive
-* language) — only the ignore list is a Sentinel-specific decision that
-* belongs alongside `ALEX_IGNORE_PATTERNS`, not inside the config package.
-*
-* Reuses `ALEX_IGNORE_PATTERNS`' own entries (`.github/*`, `CHANGELOG.md`,
-* `LICENSE` all independently confirmed to fail a real `prettier.check()`
-* today — machine-generated or unparseable content, same reasoning that
-* excluded them from alex), plus `pnpm-lock.yaml` — prettier-specific
-* (alex never reads a lockfile, but prettier would try to reformat it):
-* machine-written by pnpm's own writer, and not gitignored (lockfiles are
-* tracked), so prettier picks it up by default. Reformatting it just
-* fights every subsequent `pnpm install` (this repo's own `.prettierignore`
-* already excludes it for that exact reason).
-*/
-const PRETTIER_IGNORE_PATTERNS = [...ALEX_IGNORE_PATTERNS, "pnpm-lock.yaml"];
-//#endregion
-export { ALEX_CONFIG, ALEX_IGNORE_PATTERNS, AuthError, CARDINALITY, ConfigError, ConfigFileError, EDITORCONFIG_CHECKER_EXCLUDE, PRETTIER_IGNORE_PATTERNS, ProviderApiError, REQUIRED_CAPABILITIES, WebhookVerificationError, compose, createFeatureResolver, createResolveToken, createRestClient, defineConfig, deleteToken, deriveCapabilities, deriveCompliance, deriveProfile, deriveStack, getToken, isEditorConfigExcluded, isMulti, lintCommitMessage, lintCommitMsgFile, listStoredProviders, loadConfig, missingCapabilities, readWorkspacePackageJsons, resolveConfig, resolveEntry, resolvePluginPackage, setToken };
+export { AuthError, CARDINALITY, ConfigError, ConfigFileError, ProviderApiError, REQUIRED_CAPABILITIES, WebhookVerificationError, compose, createFeatureResolver, createResolveToken, createRestClient, defineConfig, deleteToken, deriveCapabilities, deriveCompliance, deriveProfile, deriveStack, getToken, isMulti, listStoredProviders, loadConfig, missingCapabilities, readWorkspacePackageJsons, resolveConfig, resolveEntry, resolvePluginPackage, setToken };