@theholocron/cli 5.0.0-alpha.9 → 5.0.0-alpha.90

package/dist/index.d.mts

@@ -1,7 +1,9 @@
-import { Analytics, Auth, AuthDescription, AuthEvent, AuthEventType, AuthIdentity, AuthUser, CARDINALITY, CapabilityImpls, CapabilityKey, Cardinality, CardinalityFor, Ci, CiRun, CiRunFilter, CiRunStatus, ConnectionStringOptions, CreateAuthUserInput, Deployment, DeploymentProject, DeploymentProjectSettings, DeploymentRecord, DeploymentTarget, DeploymentTrigger, Dns, DnsRecord, DnsRecordType, EnsureResult, Environment, EnvironmentReviewer, Environments, Errors, Issue, IssueSearchFilter, Issues, LabelDef, LifecycleResult, LifecycleSlot, Logs, NormalizedAuthUser, Notifications, PagesConfig, ParseWebhookInput, ProviderApiError, ProviderIdentity, PullRequest, REQUIRED_CAPABILITIES, RepoRef, RepoSettings, ResolvedCapability, Ruleset, SecretScope, Secrets, Source, StatusCategory, Storage, StorageBranch, TeamEntry, TeamPermission, Tooling, ToolingDoctorReport, TrackerDoctorReport, TrackerUser, Vault, WebhookDashboardInfo, WebhookVerificationError, Wiki, WikiDnsRecord, WikiProvisionOpts, WikiProxyConfig, Workers, isMulti } from "./plugin/capabilities.mjs";
+import { Analytics, Auth, AuthDescription, AuthEvent, AuthEventType, AuthIdentity, AuthUser, CARDINALITY, CapabilityImpls, CapabilityKey, Cardinality, CardinalityFor, Ci, CiRun, CiRunFilter, CiRunStatus, ConnectionStringOptions, CreateAuthUserInput, DeployFunctionConfig, DeployFunctionResult, DeployScriptConfig, DeployScriptResult, Deployment, DeploymentProject, DeploymentProjectSettings, DeploymentRecord, DeploymentTarget, DeploymentTrigger, Dns, DnsRecord, DnsRecordRequest, DnsRecordType, EnsureResult, Environment, EnvironmentReviewer, Environments, Errors, Issue, IssueSearchFilter, Issues, LabelDef, LifecycleResult, LifecycleSlot, Logs, NormalizedAuthUser, Notifications, PagesConfig, ParseWebhookInput, ProviderApiError, ProviderIdentity, PullRequest, REQUIRED_CAPABILITIES, RepoRef, RepoSettings, ResolvedCapability, Ruleset, SecretScope, Secrets, Source, StatusCategory, Storage, StorageBranch, TeamEntry, TeamPermission, Tooling, ToolingDoctorReport, TrackerDoctorReport, TrackerUser, Vault, WebhookDashboardInfo, WebhookVerificationError, Wiki, WikiProvisionOpts, WikiProxyConfig, Workers, isMulti } from "./plugin/capabilities.mjs";
 import { AuthError, RequestOptions, ResolveTokenConfig as ResolveTokenConfig$1, ResolveTokenInput, RestClient, RestClientConfig, createRestClient } from "@theholocron/http-client";
 import { ConfigFileError } from "@theholocron/datapad";
+import { WorkspacePackage } from "@theholocron/astromech";
 import { LogLevel } from "@theholocron/observability/core";
+import { QualifiedConfig } from "@commitlint/types";
 //#region src/auth/auth-resolver.d.ts
 type ResolveTokenConfig = Omit<ResolveTokenConfig$1, "getKeyringToken">;
 /** Wraps `createResolveToken` from `@theholocron/http` and injects the
@@ -161,6 +163,21 @@ interface RepoProperties {
 interface RepoConfig {
   /** "owner/name" — the GitHub repository coordinate. Derived from the git remote when absent. */
   name?: string;
+  /**
+   * GitHub's repo-level default branch (`HEAD`) — what a fresh clone checks
+   * out, what `gh pr create`/the compare UI target by default, and what
+   * Sentinel's `validateConfig()` reads (D6: the App only ever reads config
+   * from the repo's default branch, never a PR ref, as a security boundary
+   * — never widen that to read PR branches instead of fixing this field).
+   * Synced by `holocron setup`. Omit to leave GitHub's current setting
+   * untouched — most repos never need this. Exists for a repo using a
+   * `main`/`alpha` prerelease-channel split (CLAUDE.md's Releases section)
+   * where active development happens on a non-`main` branch: set this to
+   * that branch so Sentinel validates against what's actually being
+   * developed, then change it back once that branch merges to `main` for a
+   * stable cut and stops being the active branch.
+   */
+  defaultBranch?: string;
   /**
    * Branch protection preset applied by `holocron setup`. When omitted,
    * no protection is applied and no `branch_protection_level` property is set.
@@ -487,6 +504,29 @@ interface HolocronConfig {
    * { analytics: "none" }
    */
   telemetry?: TelemetryConfig;
+  /**
+   * ESLint bundle option overrides that Sentinel's centralized static-
+   * analysis check (holocron#849) can't otherwise see. Bucket 1 checks
+   * never read a PR's own committed files for config — this is the
+   * declared source of truth Sentinel reads instead, so its check stays
+   * in sync with what each package's own `eslint.config.ts` already
+   * enforces locally and in CI.
+   */
+  eslint?: EslintConfig;
+}
+/**
+ * Repo-root-relative directories treated as browser-targeted for eslint's
+ * node-builtins compatibility checks — mirrors
+ * `@theholocron/eslint-config`'s `library({ browserPackages })` option.
+ * Only needed for a package whose own `eslint.config.ts` already declares
+ * `browserPackages` (a deliberate outlier, not the norm — see that
+ * package's own config file for why).
+ *
+ * @example
+ * { browserPackages: ["packages/github-client/src/app-auth"] }
+ */
+interface EslintConfig {
+  browserPackages?: string[];
 }
 interface ResolvedTuple {
   provider: string;
@@ -526,6 +566,7 @@ interface ResolvedHolocronConfig {
   env?: EnvConfig;
   log?: LogConfig;
   telemetry?: TelemetryConfig;
+  eslint?: EslintConfig;
 }
 declare class ConfigError extends Error {
   name: string;
@@ -539,6 +580,98 @@ declare function resolvePluginPackage(provider: string): string;
 declare function resolveEntry(key: CapabilityKey, raw: RawProviderEntry): ResolvedProviderEntry;
 declare function resolveConfig(raw: HolocronConfig): ResolvedHolocronConfig;
 //#endregion
+//#region src/commands/setup/derived-properties.d.ts
+/**
+ * Derived custom-properties (#677). Unlike the existing 6 GitHub
+ * custom-properties fields (`lifecycle`, `open_source`, `runtime_environment`,
+ * `uses_external_packages`, `monorepo`, `branch_protection_level`) — which
+ * mirror what `holocron.config.ts` already states explicitly — these four are
+ * *derived*: signal that isn't an explicit config field today (framework
+ * choice, repo archetype, capability drift). See
+ * `.notes/tech-holocron-platform.spec.md` → "Custom-properties sync — field
+ * definitions (#677)" for the full design.
+ */
+type HolocronProfile = "library" | "cli" | "plugin" | "template" | "app" | "docs" | "platform";
+interface PackageJsonLike {
+  name?: string;
+  private?: boolean;
+  bin?: unknown;
+  dependencies?: Record<string, string>;
+  devDependencies?: Record<string, string>;
+}
+interface DeriveProfileInput {
+  rootPackageJson: PackageJsonLike | null;
+  repoName: string;
+  isMonorepo: boolean;
+  /** `packages/*` package.json contents, monorepo repos only — used to find the primary published artifact. */
+  workspacePackageJsons: PackageJsonLike[];
+}
+/**
+ * Repo archetype, in priority order:
+ * 1. `*-template` repo name → `template` (independent of package shape).
+ * 2. Monorepo whose primary published artifact is a CLI (some workspace
+ *    package has `bin`) → `platform` — matches `holocron` itself: the CLI is
+ *    the deliverable, the plugin packages are supporting infrastructure for
+ *    it, not separate products.
+ * 3. Monorepo with no CLI but at least one non-private workspace package →
+ *    `library` — matches `clients`/`configs`/`utils`/`themes`/
+ *    `observability`: a family of published packages, none of them a CLI.
+ *    Checked *before* falling into the root-package branch below, because
+ *    these repos' own root `package.json` is private and often carries
+ *    `@theholocron/astro-config` for a docs site built from the monorepo
+ *    root — without this check they'd wrongly resolve to `docs` off that
+ *    root-level signal alone, when the docs site is a secondary concern of
+ *    a library collection, not what the repo fundamentally is.
+ * 4. Single-package repo with `package.json#bin` → `cli`.
+ * 5. Docs-only site (astro/starlight present, root package private, no
+ *    publishable exports) → `docs`.
+ * 6. Private, non-publishable, non-docs → `app`.
+ * 7. Otherwise, a single publishable package → `library`.
+ */
+declare function deriveProfile(input: DeriveProfileInput): HolocronProfile;
+/**
+ * Detected build/framework tooling — the literal "does this repo need
+ * next/vite/tsdown" signal `holocron.config.ts` has no field for today
+ * (framework choice isn't a config concept, unlike `providers`/`tasks`).
+ * Curated table, not exhaustive by design — add to `KNOWN_STACK_DEPS` as new
+ * frameworks show up rather than trying to detect anything on npm.
+ */
+declare function deriveStack(pkg: PackageJsonLike | null): string[];
+/** The provider capability keys actually wired in `providers: {}` — zero heuristics. */
+declare function deriveCapabilities(providers: ResolvedProvidersConfig | undefined): string[];
+declare function deriveCompliance(capabilities: readonly string[]): "compliant" | "non-compliant";
+/**
+ * The Phase B refinement `deriveCompliance()`'s own doc comment names —
+ * *why* a repo is non-compliant, not just that it is. `[]` when compliant.
+ * Same `REQUIRED_BASELINE` `deriveCompliance()` checks against — one
+ * table, not two independently-maintained baselines.
+ */
+declare function missingCapabilities(capabilities: readonly string[]): string[];
+/**
+ * Reads each workspace package's actual `package.json` content (not just
+ * `readWorkspacePackages()`'s `{ slug, name, dir }` — `deriveProfile()`'s
+ * `platform` detection needs `bin`, which that helper doesn't carry).
+ * Missing/invalid files are skipped, matching `readWorkspacePackages()`'s
+ * own soft-fail behavior.
+ */
+declare function readWorkspacePackageJsons(repoRoot: string, workspacePackages: readonly WorkspacePackage[]): Promise<PackageJsonLike[]>;
+//#endregion
+//#region src/commit-lint/lint-message.d.ts
+interface CommitMessageViolation {
+  /** Rule name, e.g. `"subject-empty"`. */
+  rule: string;
+  /** commitlint's own message for the failure, e.g. `"subject may not be empty"`. */
+  message: string;
+}
+declare function lintCommitMessage(message: string, loaded: QualifiedConfig): Promise<CommitMessageViolation[]>;
+//#endregion
+//#region src/commit-lint/lint-commit-msg-file.d.ts
+interface LintCommitMsgFileResult {
+  valid: boolean;
+  violations: CommitMessageViolation[];
+}
+declare function lintCommitMsgFile(filePath: string, cwd?: string): Promise<LintCommitMsgFileResult>;
+//#endregion
 //#region src/config/compose.d.ts
 type TaskEntry = NonNullable<HolocronConfig["tasks"]>[number];
 /** A single composable capability fragment. */
@@ -617,4 +750,56 @@ interface LoadedConfig {
  */
 declare function loadConfig(cwd: string): Promise<LoadedConfig>;
 //#endregion
-export { Analytics, AppConfig, Auth, AuthDescription, AuthError, AuthEvent, AuthEventType, AuthIdentity, AuthUser, CARDINALITY, Capability, CapabilityConfigPackage, CapabilityImpls, CapabilityKey, Cardinality, CardinalityFor, ChromaticProjectConfig, Ci, CiRun, CiRunFilter, CiRunStatus, ComposedPreset, ConfigError, ConfigFileError, ConnectionStringOptions, CreateAuthUserInput, Deployment, DeploymentProject, DeploymentProjectSettings, DeploymentRecord, DeploymentTarget, DeploymentTrigger, Dns, DnsRecord, DnsRecordType, DocsConfig, DoctorConfig, EnsureResult, EnvConfig, Environment, EnvironmentReviewer, Environments, Errors, FeatureResolverConfig, HolocronConfig, Issue, IssueSearchFilter, Issues, LabelDef, LifecycleResult, LifecycleSlot, LoadedConfig, LogConfig, Logs, MultiEntry, NormalizedAuthUser, Notifications, PagesConfig, ParseWebhookInput, ProviderApiError, ProviderIdentity, ProviderOptions, PullRequest, REQUIRED_CAPABILITIES, RawProviderEntry, RawProvidersConfig, RepoConfig, RepoProperties, RepoProtection, RepoRef, RepoSettings, type RequestOptions, ResolveTokenConfig, type ResolveTokenInput, ResolvedCapability, ResolvedHolocronConfig, ResolvedProviderEntry, ResolvedProvidersConfig, ResolvedTuple, type RestClient, type RestClientConfig, Ruleset, SecretScope, Secrets, SingleEntry, Source, StatusCategory, Storage, StorageBranch, StorybookDeployProject, TaskEntryConfig, TeamEntry, TeamPermission, TelemetryConfig, Tooling, ToolingDoctorReport, TrackerDoctorReport, TrackerUser, Vault, WebhookDashboardInfo, WebhookVerificationError, Wiki, WikiDnsRecord, WikiProvisionOpts, WikiProxyConfig, Workers, WorkflowWithConfig, compose, createFeatureResolver, createResolveToken, createRestClient, defineConfig, deleteToken, getToken, isMulti, listStoredProviders, loadConfig, resolveConfig, resolveEntry, resolvePluginPackage, setToken };
+//#region src/formatting/config.d.ts
+/**
+ * The org's canonical prettier ignore-pattern list for a central Sentinel
+ * check (holocron#769/#819) — the `PRETTIER_CONFIG` object itself doesn't
+ * need a home here, since `@theholocron/prettier-config`'s default export
+ * already *is* one canonical, importable config (the same "one config,
+ * not N copies" reasoning `@theholocron/commitlint-config` established for
+ * commit-message linting, and `ALEX_CONFIG` established for inclusive
+ * language) — only the ignore list is a Sentinel-specific decision that
+ * belongs alongside `ALEX_IGNORE_PATTERNS`, not inside the config package.
+ *
+ * Reuses `ALEX_IGNORE_PATTERNS`' own entries (`.github/*`, `CHANGELOG.md`,
+ * `LICENSE` all independently confirmed to fail a real `prettier.check()`
+ * today — machine-generated or unparseable content, same reasoning that
+ * excluded them from alex), plus `pnpm-lock.yaml` — prettier-specific
+ * (alex never reads a lockfile, but prettier would try to reformat it):
+ * machine-written by pnpm's own writer, and not gitignored (lockfiles are
+ * tracked), so prettier picks it up by default. Reformatting it just
+ * fights every subsequent `pnpm install` (this repo's own `.prettierignore`
+ * already excludes it for that exact reason).
+ */
+declare const PRETTIER_IGNORE_PATTERNS: string[];
+//#endregion
+//#region src/inclusive-language/config.d.ts
+/**
+ * The org's canonical `alex` (inclusive-language) config, as raw parsed
+ * data rather than the pre-rendered file strings `createRcConfig()`/
+ * `createIgnoreConfig()` produce for `holocron setup` to write into a
+ * repo's own `.alexrc.json`/`.alexignore`.
+ *
+ * `.alexrc.json` is explicitly "generated by `holocron setup` — do not
+ * edit manually" (this repo's own `AGENTS.md`) — the real source of truth
+ * is this JSON file, one canonical copy, not each repo's synced one. A
+ * central Sentinel check (holocron#769/#793) reads it directly rather
+ * than fetching each repo's own copy via the Contents API — the same "one
+ * config, not N copies" reasoning `@theholocron/commitlint-config` already
+ * established for commit-message linting.
+ */
+declare const ALEX_CONFIG: {
+  allow: string[];
+};
+/**
+ * Glob-ish path patterns `alex` skips. Kept as a literal here rather than
+ * importing `../templates/configs/alexjs/alexignore` directly — that file
+ * (like `commit-msg`/`pre-push`) is deliberately extensionless, matching
+ * the real filename `holocron setup` writes, which ECMAScript's own
+ * module resolution (`moduleResolution: "nodenext"`) can't import across
+ * a package boundary without an extension. Keep in sync with that file by
+ * hand; it changes rarely.
+ */
+declare const ALEX_IGNORE_PATTERNS: string[];
+//#endregion
+export { ALEX_CONFIG, ALEX_IGNORE_PATTERNS, Analytics, AppConfig, Auth, AuthDescription, AuthError, AuthEvent, AuthEventType, AuthIdentity, AuthUser, CARDINALITY, Capability, CapabilityConfigPackage, CapabilityImpls, CapabilityKey, Cardinality, CardinalityFor, ChromaticProjectConfig, Ci, CiRun, CiRunFilter, CiRunStatus, CommitMessageViolation, ComposedPreset, ConfigError, ConfigFileError, ConnectionStringOptions, CreateAuthUserInput, DeployFunctionConfig, DeployFunctionResult, DeployScriptConfig, DeployScriptResult, Deployment, DeploymentProject, DeploymentProjectSettings, DeploymentRecord, DeploymentTarget, DeploymentTrigger, DeriveProfileInput, Dns, DnsRecord, DnsRecordRequest, DnsRecordType, DocsConfig, DoctorConfig, EnsureResult, EnvConfig, Environment, EnvironmentReviewer, Environments, Errors, EslintConfig, FeatureResolverConfig, HolocronConfig, HolocronProfile, Issue, IssueSearchFilter, Issues, LabelDef, LifecycleResult, LifecycleSlot, LintCommitMsgFileResult, LoadedConfig, LogConfig, Logs, MultiEntry, NormalizedAuthUser, Notifications, PRETTIER_IGNORE_PATTERNS, PackageJsonLike, PagesConfig, ParseWebhookInput, ProviderApiError, ProviderIdentity, ProviderOptions, PullRequest, REQUIRED_CAPABILITIES, RawProviderEntry, RawProvidersConfig, RepoConfig, RepoProperties, RepoProtection, RepoRef, RepoSettings, type RequestOptions, ResolveTokenConfig, type ResolveTokenInput, ResolvedCapability, ResolvedHolocronConfig, ResolvedProviderEntry, ResolvedProvidersConfig, ResolvedTuple, type RestClient, type RestClientConfig, Ruleset, SecretScope, Secrets, SingleEntry, Source, StatusCategory, Storage, StorageBranch, StorybookDeployProject, TaskEntryConfig, TeamEntry, TeamPermission, TelemetryConfig, Tooling, ToolingDoctorReport, TrackerDoctorReport, TrackerUser, Vault, WebhookDashboardInfo, WebhookVerificationError, Wiki, WikiProvisionOpts, WikiProxyConfig, Workers, WorkflowWithConfig, compose, createFeatureResolver, createResolveToken, createRestClient, defineConfig, deleteToken, deriveCapabilities, deriveCompliance, deriveProfile, deriveStack, getToken, isMulti, lintCommitMessage, lintCommitMsgFile, listStoredProviders, loadConfig, missingCapabilities, readWorkspacePackageJsons, resolveConfig, resolveEntry, resolvePluginPackage, setToken };

package/dist/index.mjs

@@ -2,9 +2,11 @@ import { CARDINALITY, ProviderApiError, REQUIRED_CAPABILITIES, WebhookVerificati
 import { AuthError, createResolveToken as createResolveToken$1, createRestClient } from "@theholocron/http-client";
 import { createEnvLookup } from "@theholocron/env-utils";
 import { Entry, findCredentials } from "@napi-rs/keyring";
-import { execFile } from "node:child_process";
 import { readFile } from "node:fs/promises";
 import { basename, dirname, join } from "node:path";
+import load from "@commitlint/load";
+import lint from "@commitlint/lint";
+import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { loadTasksConfig } from "@theholocron/astromech/config";
 import { ConfigFileError, ConfigFileError as ConfigFileError$1, loadConfigFile } from "@theholocron/datapad";
@@ -113,6 +115,170 @@ function createFeatureResolver(config) {
 	};
 }
 //#endregion
+//#region src/commands/setup/derived-properties.ts
+/**
+* Repo archetype, in priority order:
+* 1. `*-template` repo name → `template` (independent of package shape).
+* 2. Monorepo whose primary published artifact is a CLI (some workspace
+*    package has `bin`) → `platform` — matches `holocron` itself: the CLI is
+*    the deliverable, the plugin packages are supporting infrastructure for
+*    it, not separate products.
+* 3. Monorepo with no CLI but at least one non-private workspace package →
+*    `library` — matches `clients`/`configs`/`utils`/`themes`/
+*    `observability`: a family of published packages, none of them a CLI.
+*    Checked *before* falling into the root-package branch below, because
+*    these repos' own root `package.json` is private and often carries
+*    `@theholocron/astro-config` for a docs site built from the monorepo
+*    root — without this check they'd wrongly resolve to `docs` off that
+*    root-level signal alone, when the docs site is a secondary concern of
+*    a library collection, not what the repo fundamentally is.
+* 4. Single-package repo with `package.json#bin` → `cli`.
+* 5. Docs-only site (astro/starlight present, root package private, no
+*    publishable exports) → `docs`.
+* 6. Private, non-publishable, non-docs → `app`.
+* 7. Otherwise, a single publishable package → `library`.
+*/
+function deriveProfile(input) {
+	if (/-template$/.test(input.repoName)) return "template";
+	if (input.isMonorepo) {
+		if (input.workspacePackageJsons.some((pkg) => Boolean(pkg.bin))) return "platform";
+		if (input.workspacePackageJsons.some((pkg) => pkg.private !== true)) return "library";
+	}
+	const pkg = input.rootPackageJson;
+	if (pkg?.bin) return "cli";
+	const deps = {
+		...pkg?.dependencies,
+		...pkg?.devDependencies
+	};
+	const isDocsSite = Boolean(deps["@theholocron/astro-config"] || deps["astro"]);
+	if (pkg?.private && isDocsSite) return "docs";
+	if (pkg?.private) return "app";
+	return "library";
+}
+const KNOWN_STACK_DEPS = [
+	"next",
+	"vite",
+	"astro",
+	"tsdown",
+	"rollup",
+	"webpack",
+	"storybook",
+	"vitest",
+	"playwright",
+	"turbo"
+];
+/**
+* Detected build/framework tooling — the literal "does this repo need
+* next/vite/tsdown" signal `holocron.config.ts` has no field for today
+* (framework choice isn't a config concept, unlike `providers`/`tasks`).
+* Curated table, not exhaustive by design — add to `KNOWN_STACK_DEPS` as new
+* frameworks show up rather than trying to detect anything on npm.
+*/
+function deriveStack(pkg) {
+	const deps = {
+		...pkg?.dependencies,
+		...pkg?.devDependencies
+	};
+	return KNOWN_STACK_DEPS.filter((name) => name in deps);
+}
+/** The provider capability keys actually wired in `providers: {}` — zero heuristics. */
+function deriveCapabilities(providers) {
+	return Object.keys(providers ?? {}).sort();
+}
+/**
+* `source` + `ci` are the minimal baseline every repo `holocron setup`
+* touches wires — every `holocron.config.ts` in this org already satisfies
+* this, so `non-compliant` here means drift (a provider manually removed
+* after setup), not an unmet aspirational policy. Deliberately not a richer
+* per-profile policy yet (e.g. "a `library` must have `deployment`") — that's
+* a Phase B (GitHub App) refinement once it can post *why* on a check run.
+*/
+const REQUIRED_BASELINE = ["source", "ci"];
+function deriveCompliance(capabilities) {
+	return REQUIRED_BASELINE.every((key) => capabilities.includes(key)) ? "compliant" : "non-compliant";
+}
+/**
+* The Phase B refinement `deriveCompliance()`'s own doc comment names —
+* *why* a repo is non-compliant, not just that it is. `[]` when compliant.
+* Same `REQUIRED_BASELINE` `deriveCompliance()` checks against — one
+* table, not two independently-maintained baselines.
+*/
+function missingCapabilities(capabilities) {
+	return REQUIRED_BASELINE.filter((key) => !capabilities.includes(key));
+}
+/**
+* Reads each workspace package's actual `package.json` content (not just
+* `readWorkspacePackages()`'s `{ slug, name, dir }` — `deriveProfile()`'s
+* `platform` detection needs `bin`, which that helper doesn't carry).
+* Missing/invalid files are skipped, matching `readWorkspacePackages()`'s
+* own soft-fail behavior.
+*/
+async function readWorkspacePackageJsons(repoRoot, workspacePackages) {
+	const results = [];
+	for (const { slug, dir = "packages" } of workspacePackages) try {
+		const raw = await readFile(join(repoRoot, dir, slug, "package.json"), "utf8");
+		results.push(JSON.parse(raw));
+	} catch {}
+	return results;
+}
+//#endregion
+//#region src/commit-lint/lint-message.ts
+/**
+* Lints one commit message string against an already-loaded commitlint
+* config. The genuinely environment-independent half of commit-message
+* linting (holocron#789) — *obtaining* a `QualifiedConfig` differs by
+* caller (Sentinel isolates itself from any ambient config since it runs
+* standalone, away from a real repo checkout; `lintCommitMsgFile` below
+* just lets cosmiconfig discover the invoking repo's own
+* `commitlint.config.*`, matching `commitlint --edit`'s own contract) —
+* but linting one message against a loaded config is identical either way.
+*
+* Real `@commitlint/lint` — the same programmatic API `@commitlint/cli`
+* itself uses internally — never a reimplementation of commitlint's rules.
+*/
+/** `parserPreset.parserOpts`, if the loaded config sets one — same lookup `@commitlint/cli`'s own `selectParserOpts()` does. */
+function selectParserOpts(parserPreset) {
+	return parserPreset?.parserOpts;
+}
+async function lintCommitMessage(message, loaded) {
+	const opts = {
+		/* istanbul ignore next -- see comment above */
+		parserOpts: selectParserOpts(loaded.parserPreset) ?? {},
+		plugins: loaded.plugins,
+		/* istanbul ignore next -- see comment above */
+		ignores: loaded.ignores ?? [],
+		defaultIgnores: loaded.defaultIgnores !== false
+	};
+	const outcome = await lint(message, loaded.rules, opts);
+	if (outcome.valid) return [];
+	return outcome.errors.map((error) => ({
+		rule: error.name,
+		message: error.message
+	}));
+}
+//#endregion
+//#region src/commit-lint/lint-commit-msg-file.ts
+/**
+* `holocron lint commit-msg <file>` — a real programmatic replacement for
+* shelling out to `commitlint --edit "$1"` from `.husky/commit-msg`
+* (holocron#789). Matches that CLI's own contract exactly: `file` is a
+* path to the commit message being written (the arg git's `commit-msg`
+* hook passes as `$1`), no `--config` override needed — `@commitlint/load`
+* runs from `cwd` with no seed, so cosmiconfig's own normal upward search
+* discovers the invoking repo's real `commitlint.config.*` file, exactly
+* as `commitlint --edit` (no `--config` flag) already does today. Unlike
+* Sentinel's `loadIsolatedConfig()`, no isolation is needed here — this
+* runs inside a real repo checkout with a real `node_modules`, not
+* standalone on a server.
+*/
+async function lintCommitMsgFile(filePath, cwd = process.cwd()) {
+	const violations = await lintCommitMessage(await readFile(filePath, "utf8"), await load({}, { cwd }));
+	return {
+		valid: violations.length === 0,
+		violations
+	};
+}
+//#endregion
 //#region src/config/config.ts
 var ConfigError = class extends Error {
 	name = "ConfigError";
@@ -217,7 +383,8 @@ function resolveConfig(raw) {
 		docs,
 		env: raw.env,
 		log: raw.log,
-		telemetry: raw.telemetry
+		telemetry: raw.telemetry,
+		eslint: raw.eslint
 	};
 }
 //#endregion
@@ -389,4 +556,69 @@ function parseGitRemoteUrl(url) {
 	if (sshMatch) return sshMatch[1];
 }
 //#endregion
-export { AuthError, CARDINALITY, ConfigError, ConfigFileError, ProviderApiError, REQUIRED_CAPABILITIES, WebhookVerificationError, compose, createFeatureResolver, createResolveToken, createRestClient, defineConfig, deleteToken, getToken, isMulti, listStoredProviders, loadConfig, resolveConfig, resolveEntry, resolvePluginPackage, setToken };
+//#region src/inclusive-language/config.ts
+/**
+* The org's canonical `alex` (inclusive-language) config, as raw parsed
+* data rather than the pre-rendered file strings `createRcConfig()`/
+* `createIgnoreConfig()` produce for `holocron setup` to write into a
+* repo's own `.alexrc.json`/`.alexignore`.
+*
+* `.alexrc.json` is explicitly "generated by `holocron setup` — do not
+* edit manually" (this repo's own `AGENTS.md`) — the real source of truth
+* is this JSON file, one canonical copy, not each repo's synced one. A
+* central Sentinel check (holocron#769/#793) reads it directly rather
+* than fetching each repo's own copy via the Contents API — the same "one
+* config, not N copies" reasoning `@theholocron/commitlint-config` already
+* established for commit-message linting.
+*/
+const ALEX_CONFIG = { allow: [
+	"dead",
+	"execute",
+	"execution",
+	"executes",
+	"failure",
+	"failures",
+	"hook",
+	"hooks",
+	"husky",
+	"period"
+] };
+/**
+* Glob-ish path patterns `alex` skips. Kept as a literal here rather than
+* importing `../templates/configs/alexjs/alexignore` directly — that file
+* (like `commit-msg`/`pre-push`) is deliberately extensionless, matching
+* the real filename `holocron setup` writes, which ECMAScript's own
+* module resolution (`moduleResolution: "nodenext"`) can't import across
+* a package boundary without an extension. Keep in sync with that file by
+* hand; it changes rarely.
+*/
+const ALEX_IGNORE_PATTERNS = [
+	".github/*",
+	"CHANGELOG.md",
+	"LICENSE"
+];
+//#endregion
+//#region src/formatting/config.ts
+/**
+* The org's canonical prettier ignore-pattern list for a central Sentinel
+* check (holocron#769/#819) — the `PRETTIER_CONFIG` object itself doesn't
+* need a home here, since `@theholocron/prettier-config`'s default export
+* already *is* one canonical, importable config (the same "one config,
+* not N copies" reasoning `@theholocron/commitlint-config` established for
+* commit-message linting, and `ALEX_CONFIG` established for inclusive
+* language) — only the ignore list is a Sentinel-specific decision that
+* belongs alongside `ALEX_IGNORE_PATTERNS`, not inside the config package.
+*
+* Reuses `ALEX_IGNORE_PATTERNS`' own entries (`.github/*`, `CHANGELOG.md`,
+* `LICENSE` all independently confirmed to fail a real `prettier.check()`
+* today — machine-generated or unparseable content, same reasoning that
+* excluded them from alex), plus `pnpm-lock.yaml` — prettier-specific
+* (alex never reads a lockfile, but prettier would try to reformat it):
+* machine-written by pnpm's own writer, and not gitignored (lockfiles are
+* tracked), so prettier picks it up by default. Reformatting it just
+* fights every subsequent `pnpm install` (this repo's own `.prettierignore`
+* already excludes it for that exact reason).
+*/
+const PRETTIER_IGNORE_PATTERNS = [...ALEX_IGNORE_PATTERNS, "pnpm-lock.yaml"];
+//#endregion
+export { ALEX_CONFIG, ALEX_IGNORE_PATTERNS, AuthError, CARDINALITY, ConfigError, ConfigFileError, PRETTIER_IGNORE_PATTERNS, ProviderApiError, REQUIRED_CAPABILITIES, WebhookVerificationError, compose, createFeatureResolver, createResolveToken, createRestClient, defineConfig, deleteToken, deriveCapabilities, deriveCompliance, deriveProfile, deriveStack, getToken, isMulti, lintCommitMessage, lintCommitMsgFile, listStoredProviders, loadConfig, missingCapabilities, readWorkspacePackageJsons, resolveConfig, resolveEntry, resolvePluginPackage, setToken };