From 46b3d11a41939764a882b8745c8e9654655b608c Mon Sep 17 00:00:00 2001
From: kloud-bot <ws@kloud.email>
Date: Wed, 1 Jul 2026 11:36:37 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=94=84=20Sync=20shared=20files=20from=20`?=
 =?UTF-8?q?ws-meta`?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .vitepress/data/dependencies.yaml  | 16 ++++++++--------
 .vitepress/data/env.reference.yaml | 30 +++++++++++-------------------
 .vitepress/data/extensions.yaml    |  2 +-
 3 files changed, 20 insertions(+), 28 deletions(-)

diff --git a/.vitepress/data/dependencies.yaml b/.vitepress/data/dependencies.yaml
index e5d655b..ab5643c 100644
--- a/.vitepress/data/dependencies.yaml
+++ b/.vitepress/data/dependencies.yaml
@@ -32,7 +32,7 @@ dependencies:
     home: https://github.com/ansible/ansible-lint
     license: MIT
     tool: true
-    version: 26.4.0
+    version: 26.6.0
 
   bat:
     cmd: bat --version
@@ -70,7 +70,7 @@ dependencies:
     home: https://github.com/anthropics/claude-code
     license: Anthropic PBC
     package: anthropics/claude-code
-    version: 2.1.186
+    version: 2.1.195
 
   community.docker:
     datasource: galaxy-collection
@@ -453,7 +453,7 @@ dependencies:
     home: https://nodejs.org
     license: MIT
     package: nodejs
-    version: 24.17.0
+    version: 24.18.0
 
   npm:
     cmd: npm --version
@@ -462,7 +462,7 @@ dependencies:
     home: https://github.com/npm/cli
     license: Artistic 2
     package: npm/cli
-    version: 11.13.0
+    version: 11.16.0
 
   oauth2-proxy:
     cmd: oauth2-proxy --version
@@ -528,7 +528,7 @@ dependencies:
     home: https://github.com/pnpm/pnpm
     license: MIT
     package: pnpm
-    version: 11.8.0
+    version: 11.9.0
 
   podman:
     cmd: podman --version
@@ -600,7 +600,7 @@ dependencies:
     home: https://github.com/astral-sh/ruff
     license: MIT
     tool: true
-    version: 0.15.18
+    version: 0.15.20
 
   ShellCheck:
     cmd: shellcheck --version
@@ -688,7 +688,7 @@ dependencies:
     home: https://github.com/astral-sh/uv
     package: astral-sh/uv
     license: MIT
-    version: 0.11.23
+    version: 0.11.25
 
   vim:
     cmd: vim --version
@@ -712,7 +712,7 @@ dependencies:
     home: https://github.com/kloudkit/ws-cli
     license: MIT
     package: github.com/kloudkit/ws-cli
-    version: 0.0.65
+    version: 0.0.69
 
   yamllint:
     cmd: yamllint --version
diff --git a/.vitepress/data/env.reference.yaml b/.vitepress/data/env.reference.yaml
index 227a061..d008136 100644
--- a/.vitepress/data/env.reference.yaml
+++ b/.vitepress/data/env.reference.yaml
@@ -816,9 +816,9 @@ envs:
         secret: true
         example: dGhpcyBpcyBhIHNlY3JldCBrZXkgZXhhbXBsZQ==
         since: 0.1.1
-        description: Master encryption key for secrets vault.
+        description: Master encryption key for seed secrets.
         longDescription: |
-          Used to encrypt and decrypt secrets in the vault.
+          Used to encrypt and decrypt secrets projected by the seed engine.
           Can be provided as:
 
           - A base64-encoded string.
@@ -835,26 +835,18 @@ envs:
 
   seed:
     properties:
-      allow_system:
-        type: boolean
-        default: false
-        since: 0.4.1
-        reference: /tools/seed
-        description: Allows seeding bare files onto system directories.
-        longDescription: |
-          Requires password-less `sudo` *(`WS_AUTH_DISABLE_SUDO=false`)*.
-          The `.seed.yaml` task tier and the deny-set are never affected.
-
       source:
         type: path
         default: ~/.ws/seed.d
         since: 0.4.1
         example: /mnt/seed
-        reference: /tools/seed
-        description: Projects this directory onto the filesystem at startup.
+        reference: /settings/seed
+        description: Directory projected onto the filesystem at startup.
         longDescription: |
-          Bare files mirror the filesystem tree, a hidden `.seed.yaml` runs as
-          Ansible tasks. Re-projected on every boot; empty or absent is a no-op.
+          Bare files mirror the filesystem tree; a hidden `.seed.yaml` manifest
+          overlays declarative behaviors (merge/append/prepend/block,
+          templating, whole-file secrets). Re-projected on every boot; empty or
+          absent is a no-op.
 
   server:
     properties:
@@ -1287,9 +1279,9 @@ deprecated:
     since: 0.3.0
     removed: 0.3.0
     message: |
-      Place your vault manifest at `~/.ws/vault/secrets.yaml`;
-      it is auto-discovered at boot. No environment variable
-      is required.
+      The secrets vault has been removed. Declare secrets in the seed
+      manifest at `<seed.source>/.seed.yaml` (the `secrets:` map and
+      `secret: true` entries); see /tools/seed.
 
   WS_ZSH_EXTRA_PLUGINS:
     use: WS_ZSH_ADDITIONAL_PLUGINS
diff --git a/.vitepress/data/extensions.yaml b/.vitepress/data/extensions.yaml
index 7032eb8..d484aa0 100644
--- a/.vitepress/data/extensions.yaml
+++ b/.vitepress/data/extensions.yaml
@@ -38,7 +38,7 @@ extensions:
     name: Ruff
     license: MIT
     home: https://github.com/astral-sh/ruff-vscode
-    version: 2026.46.0
+    version: 2026.56.0
 
   DavidAnson.vscode-markdownlint:
     name: markdownlint