aem-eds-kit 0.4.2 → 0.4.4

package/CHANGELOG.md

@@ -6,6 +6,24 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.4.4] - 2026-10-07
+
+### Added
+- **`eds scaffold ci`** - generate a GitHub Actions workflow (`.github/workflows/eds.yml`)
+  that runs the project's own `lint`/`build` (if present) plus the eds audits
+  (`doctor`, `audit loading`, `audit security`) as a PR gatekeeper. Also offered
+  in the interactive `eds scaffold` picker. Deterministic, no agent.
+
+## [0.4.3] - 2026-10-06
+
+### Changed
+- CLI: a blinking accent caret now trails the animated logo line at the
+  interactive entry points, matching the landing terminal.
+
+### Fixed
+- Landing hero headline no longer wraps "Design frame in." onto three lines
+  (tightened the clamp + tracking so each clause stays on one line).
+
 ## [0.4.2] - 2026-10-06
 
 ### Fixed
@@ -114,7 +132,9 @@ harness, gradient ANSI logo. Not published (superseded by 0.3.0).
 Initial CLI scaffold: `block create`, `block from-figma`, `block list`,
 `figma setup`, `doctor`, `preview`, `publish`. Not published.
 
-[Unreleased]: https://github.com/piotrgodycki/aem-eds-kit/compare/v0.4.2...HEAD
+[Unreleased]: https://github.com/piotrgodycki/aem-eds-kit/compare/v0.4.4...HEAD
+[0.4.4]: https://github.com/piotrgodycki/aem-eds-kit/releases/tag/v0.4.4
+[0.4.3]: https://github.com/piotrgodycki/aem-eds-kit/releases/tag/v0.4.3
 [0.4.2]: https://github.com/piotrgodycki/aem-eds-kit/releases/tag/v0.4.2
 [0.4.1]: https://github.com/piotrgodycki/aem-eds-kit/releases/tag/v0.4.1
 [0.4.0]: https://github.com/piotrgodycki/aem-eds-kit/releases/tag/v0.4.0

package/README.md

@@ -136,6 +136,14 @@ eds scaffold ue
 eds scaffold blocks            # all, or: eds scaffold blocks hero cards
 ```
 
+### `eds scaffold ci`
+
+Generate a GitHub Actions workflow (`.github/workflows/eds.yml`) that gatekeeps every PR and push to `main`: it installs deps, runs the project's own `lint`/`build` (if defined), then the eds audits - `doctor`, `audit loading`, `audit security` - which exit non-zero on problems. No agent, deterministic. Also offered in the interactive `eds scaffold` picker.
+
+```bash
+eds scaffold ci
+```
+
 ### `eds integrate [type]`
 
 Add a third-party service to `scripts/delayed.js` (the EDS-correct place - delayed phase, after LCP, zero CWV impact). Chat widgets use the facade pattern.

package/dist/bin/eds.js

@@ -247,11 +247,16 @@ var init_logger = __esm({
 ${logoArt()}
 
 `);
-        const frames = 16;
-        for (let step = 0; step < frames; step++) {
-          out.write(`\r\x1B[K  ${brandLine(dotsFrame(step), tagline)}`);
+        const caret = (on) => on ? brand.accent("\u258C") : " ";
+        const sweep = 14;
+        for (let step = 0; step < sweep; step++) {
+          out.write(`\r\x1B[K  ${brandLine(dotsFrame(step), tagline)} ${caret(step % 2 === 0)}`);
           await new Promise((r) => setTimeout(r, 70));
         }
+        for (let b = 0; b < 4; b++) {
+          out.write(`\r\x1B[K  ${brandLine(dotsStatic(), tagline)} ${caret(b % 2 === 0)}`);
+          await new Promise((r) => setTimeout(r, 200));
+        }
         out.write(`\r\x1B[K  ${brandLine(dotsStatic(), tagline)}
 `);
       },
@@ -2277,6 +2282,70 @@ export default function decorate(block) {
   }
 });
 
+// src/lib/scaffold/ci.ts
+import { existsSync as existsSync10 } from "fs";
+import { mkdir as mkdir3, writeFile as writeFile4 } from "fs/promises";
+import path12 from "path";
+async function writeCiWorkflow(projectRoot) {
+  const file = path12.join(projectRoot, ".github", "workflows", "eds.yml");
+  if (existsSync10(file)) return { path: CI_WORKFLOW_PATH, created: false };
+  await mkdir3(path12.dirname(file), { recursive: true });
+  await writeFile4(file, CI_WORKFLOW);
+  return { path: CI_WORKFLOW_PATH, created: true };
+}
+var CI_WORKFLOW_PATH, CI_WORKFLOW;
+var init_ci = __esm({
+  "src/lib/scaffold/ci.ts"() {
+    "use strict";
+    init_esm_shims();
+    CI_WORKFLOW_PATH = ".github/workflows/eds.yml";
+    CI_WORKFLOW = `name: EDS checks
+
+# Generated by aem-eds-kit (\`eds scaffold ci\`). Runs the project's own
+# lint/build plus the eds audits as a gatekeeper on every PR and push to main.
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+jobs:
+  checks:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      # Install project dependencies when the repo has them.
+      - name: Install dependencies
+        run: |
+          if [ -f package-lock.json ]; then
+            npm ci
+          elif [ -f package.json ]; then
+            npm install
+          fi
+
+      # The project's own scripts, if defined (skipped otherwise).
+      - name: Lint
+        if: hashFiles('package.json') != ''
+        run: npm run lint --if-present
+      - name: Build
+        if: hashFiles('package.json') != ''
+        run: npm run build --if-present
+
+      # aem-eds-kit audits - run via npx, no install needed. Each exits
+      # non-zero on failures, so a bad PR fails the check.
+      - name: Project health (doctor)
+        run: npx --yes aem-eds-kit@latest doctor
+      - name: Loading & LCP budget
+        run: npx --yes aem-eds-kit@latest audit loading
+      - name: Security & exploit scan
+        run: npx --yes aem-eds-kit@latest audit security
+`;
+  }
+});
+
 // src/lib/scaffold/ue.ts
 function fieldReferenceFields() {
   return [
@@ -2538,14 +2607,15 @@ export default function decorate(block) {
 var scaffold_exports = {};
 __export(scaffold_exports, {
   scaffoldBlocks: () => scaffoldBlocks,
+  scaffoldCi: () => scaffoldCi,
   scaffoldInteractive: () => scaffoldInteractive,
   scaffoldUe: () => scaffoldUe
 });
-import { existsSync as existsSync10 } from "fs";
-import { mkdir as mkdir3, readFile as readFile8, writeFile as writeFile4 } from "fs/promises";
-import path12 from "path";
+import { existsSync as existsSync11 } from "fs";
+import { mkdir as mkdir4, readFile as readFile8, writeFile as writeFile5 } from "fs/promises";
+import path13 from "path";
 async function readJson(file) {
-  if (!existsSync10(file)) return null;
+  if (!existsSync11(file)) return null;
   try {
     return JSON.parse(await readFile8(file, "utf-8"));
   } catch {
@@ -2553,7 +2623,7 @@ async function readJson(file) {
   }
 }
 async function writeJson(file, data) {
-  await writeFile4(file, `${JSON.stringify(data, null, 2)}
+  await writeFile5(file, `${JSON.stringify(data, null, 2)}
 `);
 }
 async function scaffoldUe() {
@@ -2565,15 +2635,15 @@ async function scaffoldUe() {
   }
   logger.logoOnce(logo("Scaffold - Universal Editor"));
   const created = [];
-  const blockDir = path12.join(projectRoot, "blocks", "field-reference");
-  await mkdir3(blockDir, { recursive: true });
-  await writeFile4(path12.join(blockDir, "field-reference.js"), FIELD_REFERENCE_JS);
-  await writeFile4(path12.join(blockDir, "field-reference.css"), FIELD_REFERENCE_CSS);
-  await writeFile4(path12.join(blockDir, "_field-reference.json"), fieldReferenceModelFile());
+  const blockDir = path13.join(projectRoot, "blocks", "field-reference");
+  await mkdir4(blockDir, { recursive: true });
+  await writeFile5(path13.join(blockDir, "field-reference.js"), FIELD_REFERENCE_JS);
+  await writeFile5(path13.join(blockDir, "field-reference.css"), FIELD_REFERENCE_CSS);
+  await writeFile5(path13.join(blockDir, "_field-reference.json"), fieldReferenceModelFile());
   created.push("blocks/field-reference/ (all 17 fields + multifield)");
-  const defFile = path12.join(projectRoot, "component-definition.json");
-  const modelsFile = path12.join(projectRoot, "component-models.json");
-  const filtersFile = path12.join(projectRoot, "component-filters.json");
+  const defFile = path13.join(projectRoot, "component-definition.json");
+  const modelsFile = path13.join(projectRoot, "component-models.json");
+  const filtersFile = path13.join(projectRoot, "component-filters.json");
   const blockDefs = [
     {
       title: "Field Reference",
@@ -2636,18 +2706,18 @@ async function scaffoldBlocks(names) {
   const createdIds = [];
   const skipped = [];
   for (const b of selected) {
-    const dir = path12.join(projectRoot, "blocks", b.id);
-    if (existsSync10(dir)) {
+    const dir = path13.join(projectRoot, "blocks", b.id);
+    if (existsSync11(dir)) {
       skipped.push(b.id);
       continue;
     }
-    await mkdir3(dir, { recursive: true });
-    await writeFile4(path12.join(dir, `${b.id}.js`), b.js);
-    await writeFile4(path12.join(dir, `${b.id}.css`), b.css);
-    await writeFile4(path12.join(dir, `_${b.id}.json`), b.model);
+    await mkdir4(dir, { recursive: true });
+    await writeFile5(path13.join(dir, `${b.id}.js`), b.js);
+    await writeFile5(path13.join(dir, `${b.id}.css`), b.css);
+    await writeFile5(path13.join(dir, `_${b.id}.json`), b.model);
     createdIds.push(b.id);
   }
-  const filtersFile = path12.join(projectRoot, "component-filters.json");
+  const filtersFile = path13.join(projectRoot, "component-filters.json");
   const filters = mergeSectionFilter(
     await readJson(filtersFile),
     selected.map((b) => b.id)
@@ -2660,6 +2730,28 @@ async function scaffoldBlocks(names) {
   logger.info("");
   logger.info(box([`${createdIds.length} block(s) scaffolded + registered`]));
 }
+async function scaffoldCi() {
+  const projectRoot = findProjectRoot();
+  if (!projectRoot) {
+    logger.error("Not inside an EDS project (no fstab.yaml found).");
+    process.exitCode = 1;
+    return;
+  }
+  logger.logoOnce(logo("Scaffold - CI workflow"));
+  const res = await writeCiWorkflow(projectRoot);
+  logger.info(heading("GitHub Actions"));
+  if (res.created) {
+    logger.info(accentLine(res.path, "doctor + audit loading + audit security + lint/build"));
+  } else {
+    logger.info(statusLine("warn", res.path, "already exists - skipped"));
+  }
+  logger.info("");
+  logger.info(
+    box([
+      res.created ? "CI workflow scaffolded - commit it and it runs on every PR" : "CI workflow left untouched"
+    ])
+  );
+}
 async function scaffoldInteractive() {
   const { select, checkbox } = await import("@inquirer/prompts");
   logger.logoOnce(logo("Scaffold"));
@@ -2668,7 +2760,8 @@ async function scaffoldInteractive() {
     choices: [
       { name: "Universal Editor config + field-reference (all 17 field types)", value: "ue" },
       { name: "Standard blocks (hero, cards, columns, accordion, embed)", value: "blocks" },
-      { name: "Both", value: "both" }
+      { name: "GitHub Actions CI (doctor + audits + lint/build)", value: "ci" },
+      { name: "UE config + standard blocks", value: "both" }
     ]
   });
   if (what === "ue" || what === "both") await scaffoldUe();
@@ -2679,6 +2772,7 @@ async function scaffoldInteractive() {
     });
     await scaffoldBlocks(picked);
   }
+  if (what === "ci") await scaffoldCi();
 }
 var init_scaffold = __esm({
   "src/commands/scaffold.ts"() {
@@ -2687,6 +2781,7 @@ var init_scaffold = __esm({
     init_logger();
     init_project();
     init_blocks();
+    init_ci();
     init_ue();
     init_ui();
   }
@@ -2791,9 +2886,9 @@ var integrate_exports = {};
 __export(integrate_exports, {
   integrate: () => integrate
 });
-import { existsSync as existsSync11 } from "fs";
-import { mkdir as mkdir4, readFile as readFile9, writeFile as writeFile5 } from "fs/promises";
-import path13 from "path";
+import { existsSync as existsSync12 } from "fs";
+import { mkdir as mkdir5, readFile as readFile9, writeFile as writeFile6 } from "fs/promises";
+import path14 from "path";
 import chalk8 from "chalk";
 async function integrate(type) {
   const projectRoot = findProjectRoot();
@@ -2822,10 +2917,10 @@ async function integrate(type) {
     values[f.name] = answer.trim();
   }
   const block2 = wrapBlock(integration.name, integration.code(values));
-  const delayedPath = path13.join(projectRoot, "scripts", "delayed.js");
-  await mkdir4(path13.dirname(delayedPath), { recursive: true });
-  const existing = existsSync11(delayedPath) ? await readFile9(delayedPath, "utf-8") : DELAYED_HEADER;
-  await writeFile5(delayedPath, `${existing.replace(/\s*$/, "")}
+  const delayedPath = path14.join(projectRoot, "scripts", "delayed.js");
+  await mkdir5(path14.dirname(delayedPath), { recursive: true });
+  const existing = existsSync12(delayedPath) ? await readFile9(delayedPath, "utf-8") : DELAYED_HEADER;
+  await writeFile6(delayedPath, `${existing.replace(/\s*$/, "")}
 ${block2}`);
   logger.info(heading("Added"));
   logger.info(accentLine(integration.name, "\u2192 scripts/delayed.js"));
@@ -2866,8 +2961,8 @@ var setup_exports = {};
 __export(setup_exports, {
   figmaSetup: () => figmaSetup
 });
-import { existsSync as existsSync12 } from "fs";
-import { mkdir as mkdir5, writeFile as writeFile6 } from "fs/promises";
+import { existsSync as existsSync13 } from "fs";
+import { mkdir as mkdir6, writeFile as writeFile7 } from "fs/promises";
 import chalk9 from "chalk";
 async function figmaSetup() {
   const { select, confirm } = await import("@inquirer/prompts");
@@ -2947,14 +3042,14 @@ async function figmaSetup() {
   });
   if (shouldSave) {
     const configDir = globalConfigDir();
-    if (!existsSync12(configDir)) {
-      await mkdir5(configDir, { recursive: true });
+    if (!existsSync13(configDir)) {
+      await mkdir6(configDir, { recursive: true });
     }
     const config = {};
     if (selectedAgent !== "none") {
       config.agent = selectedAgent;
     }
-    await writeFile6(globalConfigPath(), `${JSON.stringify(config, null, 2)}
+    await writeFile7(globalConfigPath(), `${JSON.stringify(config, null, 2)}
 `, {
       mode: 384
     });
@@ -2981,9 +3076,9 @@ var doctor_exports = {};
 __export(doctor_exports, {
   doctor: () => doctor
 });
-import { existsSync as existsSync13 } from "fs";
+import { existsSync as existsSync14 } from "fs";
 import { readFile as readFile10, readdir as readdir2 } from "fs/promises";
-import path14 from "path";
+import path15 from "path";
 import { parse as parseYaml } from "yaml";
 async function doctor(options = {}) {
   const projectRoot = findProjectRoot();
@@ -3005,7 +3100,7 @@ async function doctor(options = {}) {
   });
   if (project.hasFstab) {
     try {
-      const content = await readFile10(path14.join(projectRoot, "fstab.yaml"), "utf-8");
+      const content = await readFile10(path15.join(projectRoot, "fstab.yaml"), "utf-8");
       parseYaml(content);
       results.push({ name: "fstab.yaml valid YAML", status: "pass", message: "Valid" });
     } catch {
@@ -3027,11 +3122,11 @@ async function doctor(options = {}) {
     message: project.hasBlocks ? "Found" : "Missing \u2014 no blocks yet"
   });
   if (project.hasBlocks) {
-    const blocksDir = path14.join(projectRoot, "blocks");
+    const blocksDir = path15.join(projectRoot, "blocks");
     const entries = await readdir2(blocksDir, { withFileTypes: true });
     let aggregatedModels = "";
-    const aggregatedPath = path14.join(projectRoot, "component-models.json");
-    if (existsSync13(aggregatedPath)) {
+    const aggregatedPath = path15.join(projectRoot, "component-models.json");
+    if (existsSync14(aggregatedPath)) {
       try {
         aggregatedModels = await readFile10(aggregatedPath, "utf-8");
       } catch {
@@ -3040,8 +3135,8 @@ async function doctor(options = {}) {
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
       const blockName = entry.name;
-      const jsFile = path14.join(blocksDir, blockName, `${blockName}.js`);
-      const hasJs = existsSync13(jsFile);
+      const jsFile = path15.join(blocksDir, blockName, `${blockName}.js`);
+      const hasJs = existsSync14(jsFile);
       results.push({
         name: `blocks/${blockName} has JS`,
         status: hasJs ? "pass" : "warn",
@@ -3057,15 +3152,15 @@ async function doctor(options = {}) {
           });
         }
       }
-      const hasPerBlockModel = existsSync13(path14.join(blocksDir, blockName, `_${blockName}.json`));
+      const hasPerBlockModel = existsSync14(path15.join(blocksDir, blockName, `_${blockName}.json`));
       const hasAggregatedModel = aggregatedModels.includes(`"${blockName}"`);
       results.push({
         name: `blocks/${blockName} UE model`,
         status: hasPerBlockModel || hasAggregatedModel ? "pass" : "warn",
         message: hasPerBlockModel || hasAggregatedModel ? hasPerBlockModel ? `_${blockName}.json` : "in component-models.json" : "no Universal Editor model \u2014 authors can't edit this block in UE"
       });
-      const metaFile = path14.join(blocksDir, blockName, ".eds-meta.json");
-      if (existsSync13(metaFile)) {
+      const metaFile = path15.join(blocksDir, blockName, ".eds-meta.json");
+      if (existsSync14(metaFile)) {
         try {
           const meta = JSON.parse(await readFile10(metaFile, "utf-8"));
           const syncDate = new Date(meta.lastSyncedAt);
@@ -3087,8 +3182,8 @@ async function doctor(options = {}) {
       }
     }
   }
-  const queryFile = path14.join(projectRoot, "helix-query.yaml");
-  if (existsSync13(queryFile)) {
+  const queryFile = path15.join(projectRoot, "helix-query.yaml");
+  if (existsSync14(queryFile)) {
     try {
       const content = await readFile10(queryFile, "utf-8");
       parseYaml(content);
@@ -3147,9 +3242,9 @@ var audit_loading_exports = {};
 __export(audit_loading_exports, {
   auditLoading: () => auditLoading
 });
-import { existsSync as existsSync14 } from "fs";
+import { existsSync as existsSync15 } from "fs";
 import { readFile as readFile11, readdir as readdir3, stat as stat3 } from "fs/promises";
-import path15 from "path";
+import path16 from "path";
 import chalk10 from "chalk";
 async function auditLoading(options = {}) {
   const projectRoot = findProjectRoot();
@@ -3183,8 +3278,8 @@ async function auditLoading(options = {}) {
   printResults(results);
 }
 async function checkHeadHtml(root, results) {
-  const filePath = path15.join(root, "head.html");
-  if (!existsSync14(filePath)) {
+  const filePath = path16.join(root, "head.html");
+  if (!existsSync15(filePath)) {
     results.push({
       rule: "head.html exists",
       status: "warn",
@@ -3264,8 +3359,8 @@ async function checkHeadHtml(root, results) {
   }
 }
 async function checkScriptsJs(root, results) {
-  const filePath = path15.join(root, "scripts", "scripts.js");
-  if (!existsSync14(filePath)) {
+  const filePath = path16.join(root, "scripts", "scripts.js");
+  if (!existsSync15(filePath)) {
     results.push({
       rule: "scripts/scripts.js exists",
       status: "warn",
@@ -3351,8 +3446,8 @@ async function checkScriptsJs(root, results) {
   }
 }
 async function checkStylesCss(root, results) {
-  const filePath = path15.join(root, "styles", "styles.css");
-  if (!existsSync14(filePath)) return;
+  const filePath = path16.join(root, "styles", "styles.css");
+  if (!existsSync15(filePath)) return;
   const stats = await stat3(filePath);
   const sizeKb = stats.size / 1024;
   results.push({
@@ -3372,8 +3467,8 @@ async function checkStylesCss(root, results) {
   }
 }
 async function checkDelayedJs(root, results) {
-  const filePath = path15.join(root, "scripts", "delayed.js");
-  if (!existsSync14(filePath)) {
+  const filePath = path16.join(root, "scripts", "delayed.js");
+  if (!existsSync15(filePath)) {
     results.push({
       rule: "scripts/delayed.js exists",
       status: "info",
@@ -3393,14 +3488,14 @@ async function checkDelayedJs(root, results) {
   }
 }
 async function checkBlocks(root, results) {
-  const blocksDir = path15.join(root, "blocks");
-  if (!existsSync14(blocksDir)) return;
+  const blocksDir = path16.join(root, "blocks");
+  if (!existsSync15(blocksDir)) return;
   const entries = await readdir3(blocksDir, { withFileTypes: true });
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
     const blockName = entry.name;
-    const jsFile = path15.join(blocksDir, blockName, `${blockName}.js`);
-    if (!existsSync14(jsFile)) continue;
+    const jsFile = path16.join(blocksDir, blockName, `${blockName}.js`);
+    if (!existsSync15(jsFile)) continue;
     const content = await readFile11(jsFile, "utf-8");
     const lines = content.split("\n");
     const heavyLibs = [
@@ -3451,8 +3546,8 @@ async function checkBlocks(root, results) {
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
     const blockName = entry.name;
-    const cssFile = path15.join(blocksDir, blockName, `${blockName}.css`);
-    if (!existsSync14(cssFile)) continue;
+    const cssFile = path16.join(blocksDir, blockName, `${blockName}.css`);
+    if (!existsSync15(cssFile)) continue;
     const content = await readFile11(cssFile, "utf-8");
     const selectorPattern = /^([a-z][a-z0-9-]*)\s*\{/gm;
     for (const selectorMatch of content.matchAll(selectorPattern)) {
@@ -3469,8 +3564,8 @@ async function checkBlocks(root, results) {
   }
 }
 async function checkAemJs(root, results) {
-  const filePath = path15.join(root, "scripts", "aem.js");
-  if (!existsSync14(filePath)) {
+  const filePath = path16.join(root, "scripts", "aem.js");
+  if (!existsSync15(filePath)) {
     results.push({
       rule: "scripts/aem.js exists",
       status: "warn",
@@ -3542,14 +3637,14 @@ var audit_security_exports = {};
 __export(audit_security_exports, {
   auditSecurity: () => auditSecurity
 });
-import { existsSync as existsSync15 } from "fs";
+import { existsSync as existsSync16 } from "fs";
 import { readFile as readFile12, readdir as readdir4 } from "fs/promises";
-import path16 from "path";
+import path17 from "path";
 import chalk11 from "chalk";
 async function* walk(dir) {
   const entries = await readdir4(dir, { withFileTypes: true });
   for (const entry of entries) {
-    const full = path16.join(dir, entry.name);
+    const full = path17.join(dir, entry.name);
     if (entry.isDirectory()) {
       if (IGNORE_DIRS.has(entry.name)) continue;
       yield* walk(full);
@@ -3583,11 +3678,11 @@ function scanContent(content, relFile, ext) {
   return findings;
 }
 async function auditDependencies(root) {
-  if (!existsSync15(path16.join(root, "package.json"))) {
+  if (!existsSync16(path17.join(root, "package.json"))) {
     return { status: "skipped", note: "no package.json" };
   }
-  const hasLock = existsSync15(path16.join(root, "package-lock.json")) || existsSync15(path16.join(root, "npm-shrinkwrap.json"));
-  if (!hasLock && !existsSync15(path16.join(root, "node_modules"))) {
+  const hasLock = existsSync16(path17.join(root, "package-lock.json")) || existsSync16(path17.join(root, "npm-shrinkwrap.json"));
+  if (!hasLock && !existsSync16(path17.join(root, "node_modules"))) {
     return { status: "skipped", note: "no package-lock.json / node_modules \u2014 run npm install" };
   }
   try {
@@ -3619,9 +3714,9 @@ async function auditSecurity(options = {}) {
   }
   const findings = [];
   for await (const file of walk(projectRoot)) {
-    const ext = path16.extname(file).slice(1).toLowerCase();
+    const ext = path17.extname(file).slice(1).toLowerCase();
     if (!SCAN_EXT.has(ext)) continue;
-    const rel = path16.relative(projectRoot, file);
+    const rel = path17.relative(projectRoot, file);
     if (rel.endsWith("aem.js") || rel.endsWith("lib-franklin.js")) continue;
     const content = await readFile12(file, "utf-8");
     findings.push(...scanContent(content, rel, ext));
@@ -4041,12 +4136,12 @@ var menu_exports = {};
 __export(menu_exports, {
   mainMenu: () => mainMenu
 });
-import { existsSync as existsSync16 } from "fs";
+import { existsSync as existsSync17 } from "fs";
 import { readdir as readdir5 } from "fs/promises";
-import path17 from "path";
+import path18 from "path";
 async function listBlockNames(projectRoot) {
-  const dir = path17.join(projectRoot, "blocks");
-  if (!existsSync16(dir)) return [];
+  const dir = path18.join(projectRoot, "blocks");
+  if (!existsSync17(dir)) return [];
   const entries = await readdir5(dir, { withFileTypes: true });
   return entries.filter((e) => e.isDirectory()).map((e) => e.name);
 }
@@ -4161,7 +4256,7 @@ import { Command } from "commander";
 // package.json
 var package_default = {
   name: "aem-eds-kit",
-  version: "0.4.2",
+  version: "0.4.4",
   description: "CLI for AEM Edge Delivery Services with Figma MCP integration",
   type: "module",
   engines: {
@@ -4270,6 +4365,10 @@ scaffold.command("blocks [names...]").description("Scaffold standard blocks (her
   const { scaffoldBlocks: scaffoldBlocks2 } = await Promise.resolve().then(() => (init_scaffold(), scaffold_exports));
   await scaffoldBlocks2(names);
 });
+scaffold.command("ci").description("Scaffold a GitHub Actions workflow (doctor + audits + project lint/build)").action(async () => {
+  const { scaffoldCi: scaffoldCi2 } = await Promise.resolve().then(() => (init_scaffold(), scaffold_exports));
+  await scaffoldCi2();
+});
 program.command("integrate [type]").description("Add a third-party service (GTM, GA4, chat, consent) to scripts/delayed.js").action(async (type) => {
   const { integrate: integrate2 } = await Promise.resolve().then(() => (init_integrate(), integrate_exports));
   await integrate2(type);