@capraconsulting/cals-cli 3.13.1 → 3.15.0

package/lib/cals-cli.mjs

@@ -1,1046 +1,39 @@
 #!/usr/bin/env node
-import * as process$1 from 'node:process';
+import * as process from 'node:process';
 import process__default from 'node:process';
-import semver from 'semver';
 import yargs from 'yargs';
 import { hideBin } from 'yargs/helpers';
+import keytar from 'keytar';
+import readline from 'node:readline';
+import chalk from 'chalk';
 import fs from 'node:fs';
-import yaml from 'js-yaml';
-import pMap from 'p-map';
-import AJV from 'ajv';
+import path from 'node:path';
+import os from 'node:os';
+import cachedir from 'cachedir';
 import { Buffer } from 'node:buffer';
 import { performance } from 'node:perf_hooks';
 import { Octokit } from '@octokit/rest';
-import fetch from 'node-fetch';
 import pLimit from 'p-limit';
-import keytar from 'keytar';
-import { deprecate } from 'node:util';
-import path from 'node:path';
-import https from 'node:https';
-import os from 'node:os';
-import cachedir from 'cachedir';
-import readline from 'node:readline';
-import chalk from 'chalk';
-import { sprintf } from 'sprintf-js';
-import { read } from 'read';
 import { findUp } from 'find-up';
+import yaml from 'js-yaml';
+import AJV from 'ajv';
 import { execa } from 'execa';
 
-var version = "3.13.1";
+var version = "3.15.0";
 var engines = {
-	node: ">=22.14.0"
-};
-
-function groupBy(array, iteratee) {
-    return array.reduce((result, item) => {
-        const key = iteratee(item);
-        if (!result[key]) {
-            result[key] = [];
-        }
-        result[key].push(item);
-        return result;
-    }, {});
-}
-function uniq(array) {
-    return Array.from(new Set(array));
-}
-function sortBy(arr, getKey) {
-    return [...arr].sort((a, b) => getKey(a).localeCompare(getKey(b)));
-}
-function sumBy(array, iteratee) {
-    return array.reduce((sum, item) => sum + iteratee(item), 0);
-}
-
-var type = "object";
-var properties = {
-	snyk: {
-		type: "object",
-		properties: {
-			accountId: {
-				type: "string"
-			}
-		},
-		required: [
-			"accountId"
-		]
-	},
-	github: {
-		type: "object",
-		properties: {
-			users: {
-				type: "array",
-				items: {
-					$ref: "#/definitions/User"
-				}
-			},
-			teams: {
-				type: "array",
-				items: {
-					type: "object",
-					properties: {
-						organization: {
-							type: "string"
-						},
-						teams: {
-							type: "array",
-							items: {
-								$ref: "#/definitions/Team"
-							}
-						}
-					},
-					required: [
-						"organization",
-						"teams"
-					]
-				}
-			}
-		},
-		required: [
-			"teams",
-			"users"
-		]
-	},
-	projects: {
-		type: "array",
-		items: {
-			$ref: "#/definitions/Project"
-		}
-	}
-};
-var required = [
-	"github",
-	"projects"
-];
-var definitions = {
-	User: {
-		anyOf: [
-			{
-				$ref: "#/definitions/UserBot"
-			},
-			{
-				$ref: "#/definitions/UserEmployee"
-			},
-			{
-				$ref: "#/definitions/UserExternal"
-			}
-		]
-	},
-	UserBot: {
-		type: "object",
-		properties: {
-			type: {
-				type: "string",
-				"const": "bot"
-			},
-			login: {
-				type: "string"
-			},
-			name: {
-				type: "string"
-			}
-		},
-		required: [
-			"login",
-			"name",
-			"type"
-		]
-	},
-	UserEmployee: {
-		type: "object",
-		properties: {
-			type: {
-				type: "string",
-				"const": "employee"
-			},
-			login: {
-				type: "string"
-			},
-			capraUsername: {
-				type: "string"
-			},
-			name: {
-				type: "string"
-			}
-		},
-		required: [
-			"capraUsername",
-			"login",
-			"name",
-			"type"
-		]
-	},
-	UserExternal: {
-		type: "object",
-		properties: {
-			type: {
-				type: "string",
-				"const": "external"
-			},
-			login: {
-				type: "string"
-			},
-			name: {
-				type: "string"
-			}
-		},
-		required: [
-			"login",
-			"name",
-			"type"
-		]
-	},
-	Team: {
-		type: "object",
-		properties: {
-			name: {
-				type: "string"
-			},
-			members: {
-				type: "array",
-				items: {
-					type: "string"
-				}
-			}
-		},
-		required: [
-			"members",
-			"name"
-		]
-	},
-	Project: {
-		type: "object",
-		properties: {
-			name: {
-				type: "string"
-			},
-			github: {
-				type: "array",
-				items: {
-					type: "object",
-					properties: {
-						organization: {
-							type: "string"
-						},
-						repos: {
-							type: "array",
-							items: {
-								$ref: "#/definitions/DefinitionRepo"
-							}
-						},
-						teams: {
-							type: "array",
-							items: {
-								$ref: "#/definitions/RepoTeam"
-							}
-						}
-					},
-					required: [
-						"organization"
-					]
-				}
-			},
-			tags: {
-				type: "array",
-				items: {
-					type: "string"
-				}
-			},
-			responsible: {
-				description: "Some external-defined entity being responsible for the project.",
-				type: "string"
-			}
-		},
-		required: [
-			"github",
-			"name"
-		]
-	},
-	DefinitionRepo: {
-		type: "object",
-		properties: {
-			name: {
-				type: "string"
-			},
-			previousNames: {
-				type: "array",
-				items: {
-					$ref: "#/definitions/DefinitionRepoPreviousName"
-				}
-			},
-			archived: {
-				type: "boolean"
-			},
-			issues: {
-				type: "boolean"
-			},
-			wiki: {
-				type: "boolean"
-			},
-			teams: {
-				type: "array",
-				items: {
-					$ref: "#/definitions/RepoTeam"
-				}
-			},
-			snyk: {
-				type: "boolean"
-			},
-			"public": {
-				type: "boolean"
-			},
-			responsible: {
-				description: "Some external-defined entity being responsible for the repository.\n\nWill override the project-defined responsible.",
-				type: "string"
-			}
-		},
-		required: [
-			"name"
-		]
-	},
-	DefinitionRepoPreviousName: {
-		type: "object",
-		properties: {
-			name: {
-				type: "string"
-			},
-			project: {
-				type: "string"
-			}
-		},
-		required: [
-			"name",
-			"project"
-		]
-	},
-	RepoTeam: {
-		type: "object",
-		properties: {
-			name: {
-				type: "string"
-			},
-			permission: {
-				$ref: "#/definitions/Permission"
-			}
-		},
-		required: [
-			"name",
-			"permission"
-		]
-	},
-	Permission: {
-		"enum": [
-			"admin",
-			"pull",
-			"push"
-		],
-		type: "string"
-	}
-};
-var $schema = "http://json-schema.org/draft-07/schema#";
-var schema = {
-	type: type,
-	properties: properties,
-	required: required,
-	definitions: definitions,
-	$schema: $schema
-};
-
-function getTeamId(org, teamName) {
-    return `${org}/${teamName}`;
-}
-function getRepoId(orgName, repoName) {
-    return `${orgName}/${repoName}`;
-}
-function checkAgainstSchema(value) {
-    const ajv = new AJV({ allErrors: true });
-    const valid = ajv.validate(schema, value);
-    return valid
-        ? { definition: value }
-        : { error: ajv.errorsText() ?? "Unknown error" };
-}
-function requireValidDefinition(definition) {
-    // Verify no duplicates in users and extract known logins.
-    const loginList = definition.github.users.reduce((acc, user) => {
-        if (acc.includes(user.login)) {
-            throw new Error(`Duplicate login: ${user.login}`);
-        }
-        return [...acc, user.login];
-    }, []);
-    // Verify no duplicates in teams and extract team names.
-    const teamIdList = definition.github.teams.reduce((acc, orgTeams) => {
-        return orgTeams.teams.reduce((acc1, team) => {
-            const id = getTeamId(orgTeams.organization, team.name);
-            if (acc1.includes(id)) {
-                throw new Error(`Duplicate team: ${id}`);
-            }
-            return [...acc1, id];
-        }, acc);
-    }, []);
-    // Verify team members exists as users.
-    definition.github.teams
-        .flatMap((it) => it.teams)
-        .forEach((team) => {
-        team.members.forEach((login) => {
-            if (!loginList.includes(login)) {
-                throw new Error(`Team member ${login} in team ${team.name} is not registered in user list`);
-            }
-        });
-    });
-    // Verify no duplicates in project names.
-    definition.projects.reduce((acc, project) => {
-        if (acc.includes(project.name)) {
-            throw new Error(`Duplicate project: ${project.name}`);
-        }
-        return [...acc, project.name];
-    }, []);
-    definition.projects.forEach((project) => {
-        project.github.forEach((org) => {
-            (org.teams || []).forEach((team) => {
-                const id = getTeamId(org.organization, team.name);
-                if (!teamIdList.includes(id)) {
-                    throw new Error(`Project team ${id} in project ${project.name} is not registered in team list`);
-                }
-            }) // Verify repo teams exists as teams.
-            ;
-            (org.repos || []).forEach((repo) => {
-                (repo.teams || []).forEach((team) => {
-                    const id = getTeamId(org.organization, team.name);
-                    if (!teamIdList.includes(id)) {
-                        throw new Error(`Repo team ${id} for repo ${repo.name} in project ${project.name} is not registered in team list`);
-                    }
-                });
-            });
-        });
-    });
-    // Verify no duplicates in repos.
-    definition.projects
-        .flatMap((project) => project.github.flatMap((org) => (org.repos || []).map((repo) => getRepoId(org.organization, repo.name))))
-        .reduce((acc, repoName) => {
-        if (acc.includes(repoName)) {
-            throw new Error(`Duplicate repo: ${repoName}`);
-        }
-        return [...acc, repoName];
-    }, []);
-}
-class DefinitionFile {
-    path;
-    constructor(path) {
-        this.path = path;
-    }
-    async getContents() {
-        return new Promise((resolve, reject) => fs.readFile(this.path, "utf-8", (err, data) => {
-            if (err)
-                reject(err);
-            else
-                resolve(data);
-        }));
-    }
-    async getDefinition() {
-        return parseDefinition(await this.getContents());
-    }
-}
-function parseDefinition(value) {
-    const result = checkAgainstSchema(yaml.load(value));
-    if ("error" in result) {
-        throw new Error(`Definition content invalid: ${result.error}`);
-    }
-    requireValidDefinition(result.definition);
-    return result.definition;
-}
-function getRepos(definition) {
-    return definition.projects.flatMap((project) => project.github.flatMap((org) => (org.repos || []).map((repo) => ({
-        id: getRepoId(org.organization, repo.name),
-        orgName: org.organization,
-        project,
-        repo,
-    }))));
-}
-function getGitHubOrgs(definition) {
-    const githubOrganizations = definition.projects.flatMap((project) => project.github.map((it) => it.organization));
-    return uniq(githubOrganizations);
-}
-
-class GitHubTokenCliProvider {
-    keyringService = "cals";
-    keyringAccount = "github-token";
-    async getToken() {
-        if (process__default.env.CALS_GITHUB_TOKEN) {
-            return process__default.env.CALS_GITHUB_TOKEN;
-        }
-        const result = await keytar.getPassword(this.keyringService, this.keyringAccount);
-        if (result == null) {
-            process__default.stderr.write("No token found. Register using `cals github set-token`\n");
-            return undefined;
-        }
-        return result;
-    }
-    async markInvalid() {
-        await keytar.deletePassword(this.keyringService, this.keyringAccount);
-    }
-    async setToken(value) {
-        await keytar.setPassword(this.keyringService, this.keyringAccount, value);
-    }
-}
-
-function getGroup(repo) {
-    const projectTopics = [];
-    let isInfra = false;
-    repo.repositoryTopics.edges.forEach((edge) => {
-        const name = edge.node.topic.name;
-        if (name.startsWith("customer-")) {
-            projectTopics.push(name.substring(9));
-        }
-        if (name.startsWith("project-")) {
-            projectTopics.push(name.substring(8));
-        }
-        if (name === "infrastructure") {
-            isInfra = true;
-        }
-    });
-    if (projectTopics.length > 1) {
-        console.warn(`Repo ${repo.name} has multiple project groups: ${projectTopics.join(", ")}. Picking first`);
-    }
-    if (projectTopics.length > 0) {
-        return projectTopics[0];
-    }
-    if (isInfra) {
-        return "infrastructure";
-    }
-    return null;
-}
-function ifnull(a, other) {
-    return a === null ? other : a;
-}
-function getGroupedRepos(repos) {
-    return Object.values(repos.reduce((acc, repo) => {
-        const group = ifnull(getGroup(repo), "(unknown)");
-        const value = acc[group] || { name: group, items: [] };
-        return {
-            ...acc,
-            [group]: {
-                ...value,
-                items: [...value.items, repo],
-            },
-        };
-    }, {})).sort((a, b) => a.name.localeCompare(b.name));
-}
-function includesTopic(repo, topic) {
-    return repo.repositoryTopics.edges.some((it) => it.node.topic.name === topic);
-}
-async function undefinedForNotFound(value) {
-    try {
-        return await value;
-    }
-    catch (e) {
-        if (e.name === "HttpError" && e.status === 404) {
-            return undefined;
-        }
-        throw e;
-    }
-}
-
-class GitHubService {
-    config;
-    octokit;
-    cache;
-    tokenProvider;
-    semaphore;
-    constructor(props) {
-        this.config = props.config;
-        this.octokit = props.octokit;
-        this.cache = props.cache;
-        this.tokenProvider = props.tokenProvider;
-        // Control concurrency to GitHub API at service level so we
-        // can maximize concurrency all other places.
-        this.semaphore = pLimit(6);
-        this.octokit.hook.wrap("request", async (request, options) => {
-            this._requestCount++;
-            if (options.method !== "GET") {
-                return this.semaphore(() => request(options));
-            }
-            // Try to cache ETag for GET requests to save on rate limiting.
-            // Hits on ETag does not count towards rate limiting.
-            const rest = {
-                ...options,
-            };
-            delete rest.method;
-            delete rest.baseUrl;
-            delete rest.headers;
-            delete rest.mediaType;
-            delete rest.request;
-            // Build a key that is used to identify this request.
-            const key = Buffer.from(JSON.stringify(rest)).toString("base64");
-            const cacheItem = this.cache.retrieveJson(key);
-            if (cacheItem !== undefined) {
-                // Copying doesn't work, seems we need to mutate this.
-                options.headers["If-None-Match"] = cacheItem.data.etag;
-            }
-            const getResponse = async (allowRetry = true) => {
-                try {
-                    return await request(options);
-                }
-                catch (e) {
-                    // Handle no change in ETag.
-                    if (e.status === 304) {
-                        return undefined;
-                    }
-                    // GitHub seems to throw a lot of 502 errors.
-                    // Let's give it a few seconds and retry one time.
-                    if (e.status === 502 && allowRetry) {
-                        await new Promise((resolve) => setTimeout(resolve, 2000));
-                        return await getResponse(false);
-                    }
-                    throw e;
-                }
-            };
-            const response = await this.semaphore(async () => {
-                return getResponse();
-            });
-            if (response === undefined) {
-                // Undefined is returned for cached data.
-                if (cacheItem === undefined) {
-                    throw new Error("Missing expected cache item");
-                }
-                // Use previous value.
-                return cacheItem.data.data;
-            }
-            // New value. Store Etag.
-            if (response.headers.etag) {
-                this.cache.storeJson(key, {
-                    etag: response.headers.etag,
-                    data: response,
-                });
-            }
-            return response;
-        });
-    }
-    _requestCount = 0;
-    get requestCount() {
-        return this._requestCount;
-    }
-    async runGraphqlQuery(query) {
-        const token = await this.tokenProvider.getToken();
-        if (token === undefined) {
-            throw new Error("Missing token for GitHub");
-        }
-        const url = "https://api.github.com/graphql";
-        const headers = {
-            Authorization: `Bearer ${token}`,
-        };
-        let requestDuration = -1;
-        const response = await this.semaphore(() => {
-            const requestStart = performance.now();
-            const result = fetch(url, {
-                method: "POST",
-                headers,
-                body: JSON.stringify({ query }),
-                agent: this.config.agent,
-            });
-            requestDuration = performance.now() - requestStart;
-            return result;
-        });
-        if (response.status === 401) {
-            process$1.stderr.write("Unauthorized\n");
-            await this.tokenProvider.markInvalid();
-        }
-        // If you get 502 after 10s, it is a timeout.
-        if (response.status === 502) {
-            throw new Error(`Response from Github likely timed out (10s max) after elapsed ${requestDuration}ms with status ${response.status}: ${await response.text()}`);
-        }
-        if (!response.ok) {
-            throw new Error(`Response from GitHub not OK (${response.status}): ${await response.text()}`);
-        }
-        const json = (await response.json());
-        if (json.errors) {
-            throw new Error(`Error from GitHub GraphQL API: ${JSON.stringify(json.errors)}`);
-        }
-        if (json.data == null) {
-            throw new Error("No data received from GitHub GraphQL API (unknown reason)");
-        }
-        return json.data;
-    }
-    async getOrgRepoList({ org }) {
-        const getQuery = (after) => `{
-  organization(login: "${org}") {
-    repositories(first: 100${after === null ? "" : `, after: "${after}"`}) {
-      totalCount
-      pageInfo {
-        hasNextPage
-        endCursor
-      }
-      nodes {
-        name
-        owner {
-          login
-        }
-        defaultBranchRef {
-          name
-        }
-        createdAt
-        updatedAt
-        isArchived
-        sshUrl
-        repositoryTopics(first: 100) {
-          edges {
-            node {
-              topic {
-                name
-              }
-            }
-          }
-        }
-      }
-    }
-  }
-}`;
-        return this.cache.json(`repos-${org}`, async () => {
-            const repos = [];
-            let after = null;
-            while (true) {
-                const query = getQuery(after);
-                const res = await this.runGraphqlQuery(query);
-                if (res.organization == null) {
-                    throw new Error("Missing organization");
-                }
-                if (res.organization.repositories.nodes == null) {
-                    throw new Error("Missing organization nodes");
-                }
-                repos.push(...res.organization.repositories.nodes);
-                if (!res.organization.repositories.pageInfo.hasNextPage) {
-                    break;
-                }
-                after = res.organization.repositories.pageInfo.endCursor;
-            }
-            return repos.sort((a, b) => a.name.localeCompare(b.name));
-        });
-    }
-    async getOrgMembersList(org) {
-        const options = this.octokit.orgs.listMembers.endpoint.merge({
-            org,
-        });
-        return ((await undefinedForNotFound(this.octokit.paginate(options))) || []);
-    }
-    async getOrgMembersInvitedList(org) {
-        const options = this.octokit.orgs.listPendingInvitations.endpoint.merge({
-            org,
-        });
-        return ((await undefinedForNotFound(this.octokit.paginate(options))) || []);
-    }
-    async getOrgMembersListIncludingInvited(org) {
-        return [
-            ...(await this.getOrgMembersList(org)).map((it) => ({
-                type: "member",
-                login: it.login,
-                data: it,
-            })),
-            ...(await this.getOrgMembersInvitedList(org)).map((it) => ({
-                type: "invited",
-                // TODO: Fix ?? case properly
-                login: it.login ?? "invalid",
-                data: it,
-            })),
-        ];
-    }
-    async getRepository(owner, repo) {
-        return this.cache.json(`get-repository-${owner}-${repo}`, async () => {
-            const response = await undefinedForNotFound(this.octokit.repos.get({
-                owner,
-                repo,
-            }));
-            return response === undefined ? undefined : response.data;
-        });
-    }
-    async getRepositoryTeamsList(repo) {
-        return this.cache.json(`repository-teams-list-${repo.id}`, async () => {
-            const options = this.octokit.repos.listTeams.endpoint.merge({
-                owner: repo.owner.login,
-                repo: repo.name,
-            });
-            return ((await undefinedForNotFound(this.octokit.paginate(options))) || []);
-        });
-    }
-    async getRepositoryHooks(owner, repo) {
-        return this.cache.json(`repository-hooks-${owner}-${repo}`, async () => {
-            const options = this.octokit.repos.listWebhooks.endpoint.merge({
-                owner,
-                repo,
-            });
-            return ((await undefinedForNotFound(this.octokit.paginate(options))) || []);
-        });
-    }
-    async getOrg(org) {
-        const orgResponse = await this.octokit.orgs.get({
-            org,
-        });
-        return orgResponse.data;
-    }
-    async getTeamList(org) {
-        return this.cache.json(`team-list-${org.login}`, async () => {
-            const options = this.octokit.teams.list.endpoint.merge({
-                org: org.login,
-            });
-            return (await this.octokit.paginate(options));
-        });
-    }
-    async getTeamMemberList(org, team) {
-        return this.cache.json(`team-member-list-${team.id}`, async () => {
-            const options = this.octokit.teams.listMembersInOrg.endpoint.merge({
-                org: org.login,
-                team_slug: team.slug,
-            });
-            return (await this.octokit.paginate(options));
-        });
-    }
-    async getTeamMemberInvitedList(org, team) {
-        return this.cache.json(`team-member-invited-list-${team.id}`, async () => {
-            const options = this.octokit.teams.listPendingInvitationsInOrg.endpoint.merge({
-                org: org.login,
-                team_slug: team.slug,
-            });
-            return (await this.octokit.paginate(options));
-        });
-    }
-    async getTeamMemberListIncludingInvited(org, team) {
-        return [
-            ...(await this.getTeamMemberList(org, team)).map((it) => ({
-                type: "member",
-                login: it.login,
-                data: it,
-            })),
-            ...(await this.getTeamMemberInvitedList(org, team)).map((it) => ({
-                type: "invited",
-                // TODO: Fix ?? case properly
-                login: it.login ?? "invalid",
-                data: it,
-            })),
-        ];
-    }
-    async getSearchedPullRequestList(owner) {
-        // NOTE: Changes to this must by synced with SearchedPullRequestListQueryResult.
-        const getQuery = (after) => `{
-  search(
-    query: "is:open is:pr user:${owner} owner:${owner} archived:false",
-    type: ISSUE,
-    first: 50${after === null
-            ? ""
-            : `,
-    after: "${after}"`}
-  ) {
-    pageInfo {
-      hasNextPage
-      endCursor
-    }
-    edges {
-      node {
-        __typename
-        ... on PullRequest {
-          number
-          baseRepository {
-            name
-            owner {
-              login
-            }
-            defaultBranchRef {
-              name
-            }
-          }
-          author {
-            login
-          }
-          title
-          commits(first: 3) {
-            nodes {
-              commit {
-                messageHeadline
-              }
-            }
-          }
-          createdAt
-          updatedAt
-        }
-      }
-    }
-  }
-}`;
-        const pulls = [];
-        let after = null;
-        while (true) {
-            const query = getQuery(after);
-            const res = await this.runGraphqlQuery(query);
-            pulls.push(...res.search.edges.map((it) => it.node));
-            if (!res.search.pageInfo.hasNextPage) {
-                break;
-            }
-            after = res.search.pageInfo.endCursor;
-        }
-        return pulls.sort((a, b) => a.createdAt.localeCompare(b.createdAt));
-    }
-    async getHasVulnerabilityAlertsEnabled(owner, repo) {
-        try {
-            const response = await this.octokit.repos.checkVulnerabilityAlerts({
-                owner: owner,
-                repo: repo,
-            });
-            if (response.status !== 204) {
-                console.log(response);
-                throw new Error("Unknown response - see previous log line");
-            }
-            return true;
-        }
-        catch (e) {
-            if (e.status === 404) {
-                return false;
-            }
-            throw e;
-        }
-    }
-    async enableVulnerabilityAlerts(owner, repo) {
-        await this.octokit.repos.enableVulnerabilityAlerts({
-            owner: owner,
-            repo: repo,
-        });
-    }
-    /**
-     * Get the vulnerability alerts for a repository.
-     */
-    async getVulnerabilityAlerts(owner, repo) {
-        // NOTE: Changes to this must by synced with VulnerabilityAlertsQueryResult.
-        const getQuery = (after) => `{
-  repository(owner: "${owner}", name: "${repo}") {
-    vulnerabilityAlerts(first: 100${after === null ? "" : `, after: "${after}"`}) {
-      pageInfo {
-        hasNextPage
-        endCursor
-      }
-      edges {
-        node {
-          state
-          dismissReason
-          vulnerableManifestFilename
-          vulnerableManifestPath
-          vulnerableRequirements
-          securityAdvisory {
-            description
-            identifiers { type value }
-            references { url }
-            severity
-          }
-          securityVulnerability {
-            package { name ecosystem }
-            firstPatchedVersion { identifier }
-            vulnerableVersionRange
-          }
-        }
-      }
-    }
-  }
-}`;
-        return this.cache.json(`vulnerability-alerts-${owner}-${repo}`, async () => {
-            const result = [];
-            let after = null;
-            while (true) {
-                const query = getQuery(after);
-                const res = await this.runGraphqlQuery(query);
-                result.push(...(res.repository?.vulnerabilityAlerts.edges?.map((it) => it.node) ?? []));
-                if (!res.repository?.vulnerabilityAlerts.pageInfo.hasNextPage) {
-                    break;
-                }
-                after = res.repository?.vulnerabilityAlerts.pageInfo.endCursor;
-            }
-            return result;
-        });
-    }
-    /**
-     * Get the Renovate Dependency Dashboard issue.
-     */
-    async getRenovateDependencyDashboardIssue(owner, repo) {
-        // NOTE: Changes to this must by synced with RenovateDependencyDashboardIssueQueryResult.
-        const getQuery = (after) => `{
-  repository(owner: "${owner}", name: "${repo}") {
-    issues(
-      orderBy: {field: UPDATED_AT, direction: DESC},
-      filterBy: {createdBy: "renovate[bot]"},
-      states: [OPEN],
-      first: 100${after === null ? "" : `, after: "${after}"`}
-    ) {
-      pageInfo {
-        hasNextPage
-        endCursor
-      }
-      edges {
-        node {
-          number
-          state
-          title
-          body
-          userContentEdits(first: 5) {
-            nodes {
-              createdAt
-              editor {
-                login
-              }
-            }
-          }
-        }
-      }
-    }
-  }
-}`;
-        const issues = await this.cache.json(`renovate-bot-issues-${owner}-${repo}`, async () => {
-            const result = [];
-            let after = null;
-            while (true) {
-                const query = getQuery(after);
-                const res = await this.runGraphqlQuery(query);
-                const nodes = res.repository?.issues.edges?.map((it) => it.node) ?? [];
-                result.push(...nodes
-                    .filter((it) => it.title === "Dependency Dashboard")
-                    .map((it) => ({
-                    number: it.number,
-                    body: it.body,
-                    lastUpdatedByRenovate: it.userContentEdits?.nodes?.filter((it) => it.editor?.login === "renovate")?.[0]?.createdAt ?? null,
-                })));
-                if (!res.repository?.issues.pageInfo.hasNextPage) {
-                    break;
-                }
-                after = res.repository?.issues.pageInfo.endCursor;
-            }
-            return result;
-        });
-        if (issues.length == 0) {
-            return undefined;
-        }
-        return issues[0];
-    }
-}
-async function createOctokit(config, tokenProvider) {
-    return new Octokit({
-        auth: await tokenProvider.getToken(),
-        request: {
-            agent: config.agent,
-        },
-    });
-}
-async function createGitHubService(props) {
-    const tokenProvider = props.tokenProvider ?? new GitHubTokenCliProvider();
-    return new GitHubService({
-        config: props.config,
-        octokit: await createOctokit(props.config, tokenProvider),
-        cache: props.cache,
-        tokenProvider,
-    });
-}
+	node: ">=22.14.0"
+};
 
-class SnykTokenCliProvider {
+class GitHubTokenCliProvider {
     keyringService = "cals";
-    keyringAccount = "snyk-token";
+    keyringAccount = "github-token";
     async getToken() {
-        if (process__default.env.CALS_SNYK_TOKEN) {
-            return process__default.env.CALS_SNYK_TOKEN;
+        if (process__default.env.CALS_GITHUB_TOKEN) {
+            return process__default.env.CALS_GITHUB_TOKEN;
         }
         const result = await keytar.getPassword(this.keyringService, this.keyringAccount);
         if (result == null) {
-            process__default.stderr.write("No token found. Register using `cals snyk set-token`\n");
+            process__default.stderr.write("No token found. Register using `cals github set-token`\n");
             return undefined;
         }
         return result;
@@ -1053,124 +46,95 @@ class SnykTokenCliProvider {
     }
 }
 
-class SnykService {
-    config;
-    tokenProvider;
-    constructor(props) {
-        this.config = props.config;
-        this.tokenProvider = props.tokenProvider;
-    }
-    async getProjects(definition) {
-        const snykAccountId = definition.snyk?.accountId;
-        if (snykAccountId === undefined) {
-            return [];
-        }
-        return this.getProjectsByAccountId(snykAccountId);
-    }
-    async getProjectsByAccountId(snykAccountId, 
-    /**
-     * The slug name of a Snyk organization.
-     *
-     * NOTE: This is only used to construct the browsable URL for a given project, and is not being used
-     * in API calls to Snyk.
-     *
-     * @default - the slug corresponding to Lifligs Snyk organization ("it").
-     */
-    snykOrgSlugId) {
-        const token = await this.tokenProvider.getToken();
-        if (token === undefined) {
-            throw new Error("Missing token for Snyk");
-        }
-        let backportedProjects = [];
-        const snykRestApiVersion = "2025-11-05";
-        let nextUrl = `/rest/orgs/${encodeURIComponent(snykAccountId)}/projects?version=${snykRestApiVersion}&meta.latest_dependency_total=true&meta.latest_issue_counts=true&limit=100`;
-        /* The Snyk REST API only allows us to retrieve 100 projects at a time.
-         * The "links.next" value in the response gives us a pointer to the next 100 results.
-         * We continue calling the Snyk API and retrieving more projects until links.next is null
-         * */
-        while (nextUrl) {
-            const response = await fetch(`https://api.snyk.io${nextUrl}`, {
-                method: "GET",
-                headers: {
-                    Accept: "application/json",
-                    Authorization: `token ${token}`,
-                },
-                agent: this.config.agent,
-            });
-            if (response.status === 401) {
-                process__default.stderr.write("Unauthorized - removing token\n");
-                await this.tokenProvider.markInvalid();
-            }
-            if (!response.ok) {
-                throw new Error(`Response from Snyk not OK (${response.status}): ${JSON.stringify(response)}`);
-            }
-            // Check if the Sunset header is present in the response
-            const sunsetHeader = response.headers.get("Sunset") || response.headers.get("sunset");
-            if (sunsetHeader) {
-                console.warn(`Snyk endpoint with version ${snykRestApiVersion} has been marked as deprecated with deprecation date ${sunsetHeader}`);
-            }
-            const jsonResponse = (await response.json());
-            /* We transform the data to a standard format that we used for data from Snyk API v1 in order for
-             the data to be backover compatible with existing consuments */
-            backportedProjects = [
-                ...backportedProjects,
-                ...jsonResponse.data.map((project) => {
-                    return {
-                        id: project.id,
-                        name: project.attributes.name,
-                        type: project.attributes.type,
-                        created: project.attributes.created,
-                        origin: project.attributes.origin,
-                        testFrequency: project.attributes.settings.recurring_tests.frequency,
-                        isMonitored: project.attributes.status === "active",
-                        totalDependencies: project.meta.latest_dependency_total.total,
-                        issueCountsBySeverity: project.meta.latest_issue_counts,
-                        lastTestedDate: project.meta.latest_dependency_total.updated_at,
-                        browseUrl: `https://app.snyk.io/org/${snykOrgSlugId ?? "it"}/project/${project.id}`,
-                    };
-                }),
-            ];
-            /* Update nextUrl with pointer to the next page of results based
-             * on the "links.next" field in the JSON response */
-            nextUrl = jsonResponse.links.next;
-        }
-        return backportedProjects;
-    }
+const CLEAR_WHOLE_LINE = 0;
+function clearLine(stdout) {
+    readline.clearLine(stdout, CLEAR_WHOLE_LINE);
+    readline.cursorTo(stdout, 0);
 }
-function createSnykService(props) {
-    return new SnykService({
-        config: props.config,
-        tokenProvider: props.tokenProvider ?? new SnykTokenCliProvider(),
+async function readInput(options) {
+    process__default.stdout.write(options.prompt);
+    // For silent mode, read character by character with raw mode to hide input
+    if (options.silent && process__default.stdin.isTTY) {
+        return new Promise((resolve, reject) => {
+            let input = "";
+            process__default.stdin.setRawMode(true);
+            process__default.stdin.resume();
+            process__default.stdin.setEncoding("utf8");
+            const timer = options.timeout
+                ? setTimeout(() => {
+                    cleanup();
+                    reject(new Error("Input timed out"));
+                }, options.timeout)
+                : null;
+            const cleanup = () => {
+                process__default.stdin.setRawMode(false);
+                process__default.stdin.pause();
+                process__default.stdin.removeListener("data", onData);
+                if (timer)
+                    clearTimeout(timer);
+            };
+            const onData = (char) => {
+                if (char === "\r" || char === "\n") {
+                    cleanup();
+                    process__default.stdout.write("\n");
+                    resolve(input);
+                }
+                else if (char === "\u0003") {
+                    // Ctrl+C
+                    cleanup();
+                    process__default.exit(1);
+                }
+                else if (char === "\u007F" || char === "\b") {
+                    // Backspace
+                    input = input.slice(0, -1);
+                }
+                else {
+                    input += char;
+                }
+            };
+            process__default.stdin.on("data", onData);
+        });
+    }
+    // Normal (non-silent) mode
+    const rl = readline.createInterface({
+        input: process__default.stdin,
+        output: process__default.stdout,
+    });
+    return new Promise((resolve, reject) => {
+        const timer = options.timeout
+            ? setTimeout(() => {
+                rl.close();
+                reject(new Error("Input timed out"));
+            }, options.timeout)
+            : null;
+        rl.question("", (answer) => {
+            if (timer)
+                clearTimeout(timer);
+            rl.close();
+            resolve(answer);
+        });
     });
 }
-
-function getGitHubRepo(snykProject) {
-    if (snykProject.origin === "github") {
-        const match = /^([^/]+)\/([^:]+)(:(.+))?$/.exec(snykProject.name);
-        if (match === null) {
-            throw Error(`Could not extract components from Snyk project name: ${snykProject.name} (id: ${snykProject.id})`);
-        }
-        return {
-            owner: match[1],
-            name: match[2],
-        };
+class Reporter {
+    stdout = process__default.stdout;
+    stderr = process__default.stderr;
+    format = chalk;
+    error(msg) {
+        clearLine(this.stderr);
+        this.stderr.write(`${this.format.red("error")} ${msg}\n`);
     }
-    if (snykProject.origin === "cli" && snykProject.remoteRepoUrl != null) {
-        // The remoteRepoUrl can be overridden when using the CLI, so don't
-        // fail if we cannot extract the value.
-        const match = /github.com\/([^/]+)\/(.+)\.git$/.exec(snykProject.remoteRepoUrl);
-        if (match === null) {
-            return undefined;
-        }
-        return {
-            owner: match[1],
-            name: match[2],
-        };
+    log(msg) {
+        clearLine(this.stdout);
+        this.stdout.write(`${msg}\n`);
+    }
+    warn(msg) {
+        clearLine(this.stderr);
+        this.stderr.write(`${this.format.yellow("warning")} ${msg}\n`);
+    }
+    info(msg) {
+        clearLine(this.stdout);
+        this.stdout.write(`${this.format.blue("info")} ${msg}\n`);
     }
-    return undefined;
-}
-function getGitHubRepoId(repo) {
-    return repo ? `${repo.owner}/${repo.name}` : undefined;
 }
 
 class CacheProvider {
@@ -1230,9 +194,6 @@ class Config {
     cwd = path.resolve(process__default.cwd());
     configFile = path.join(os.homedir(), ".cals-config.json");
     cacheDir = cachedir("cals-cli");
-    agent = new https.Agent({
-        keepAlive: true,
-    });
     configCached = undefined;
     get config() {
         const existingConfig = this.configCached;
@@ -1275,987 +236,316 @@ class Config {
     }
 }
 
-const CLEAR_WHOLE_LINE = 0;
-function clearLine(stdout) {
-    readline.clearLine(stdout, CLEAR_WHOLE_LINE);
-    readline.cursorTo(stdout, 0);
-}
-class Reporter {
-    constructor(opts = {}) {
-        this.nonInteractive = !!opts.nonInteractive;
-        this.isVerbose = !!opts.verbose;
-    }
-    stdout = process__default.stdout;
-    stderr = process__default.stderr;
-    nonInteractive;
-    isVerbose;
-    format = chalk;
-    error(msg) {
-        clearLine(this.stderr);
-        this.stderr.write(`${this.format.red("error")} ${msg}\n`);
-    }
-    log(msg) {
-        clearLine(this.stdout);
-        this.stdout.write(`${msg}\n`);
-    }
-    warn(msg) {
-        clearLine(this.stderr);
-        this.stderr.write(`${this.format.yellow("warning")} ${msg}\n`);
-    }
-    info(msg) {
-        clearLine(this.stdout);
-        this.stdout.write(`${this.format.blue("info")} ${msg}\n`);
-    }
-}
-
-function createReporter(argv) {
-    return new Reporter({
-        verbose: !!argv.verbose,
-        nonInteractive: !!argv.nonInteractive,
-    });
+function createReporter() {
+    return new Reporter();
 }
 function createCacheProvider(config, argv) {
     const cache = new CacheProvider(config);
-    // --validate-cache
-    if (argv.validateCache === true) {
+    if (argv.noCache === true) {
         cache.mustValidate = true;
     }
-    // old option: --no-cache
-    if (argv.cache === false) {
-        deprecate(() => {
-            cache.mustValidate = true;
-        }, "The --no-cache option is deprecated. See new --validate-cache option")();
-    }
     return cache;
-}
-function createConfig() {
-    return new Config();
-}
-const definitionFileOptionName = "definition-file";
-const definitionFileOptionValue = {
-    describe: "Path to definition file, which should be the latest resources.yaml file from https://github.com/capralifecycle/resources-definition",
-    demandOption: true,
-    type: "string",
-};
-function getDefinitionFile(argv) {
-    if (argv.definitionFile === undefined) {
-        throw Error("Missing --definition-file option");
-    }
-    const definitionFile = argv.definitionFile;
-    if (!fs.existsSync(definitionFile)) {
-        throw Error(`The file ${definitionFile} does not exist`);
-    }
-    return new DefinitionFile(definitionFile);
-}
-
-async function reportRateLimit(reporter, github, block) {
-    reporter.info(`Rate limit: ${(await github.octokit.rateLimit.get()).data.rate.remaining}`);
-    await block();
-    reporter.info(`Rate limit: ${(await github.octokit.rateLimit.get()).data.rate.remaining}`);
-}
-
-/**
- * Reorder a list to preserve same order as it had previously.
- *
- * Not a very pretty algorithm but it works for us.
- */
-function reorderListToSimilarAsBefore(oldList, updatedList, selector, insertLast = false) {
-    let result = [];
-    // Keep items present in old list.
-    let remaining1 = [...updatedList];
-    for (const old of oldList) {
-        let found = false;
-        for (const it of remaining1) {
-            if (selector(it) === selector(old)) {
-                found = true;
-                result.push(it);
-            }
-        }
-        if (found) {
-            remaining1 = remaining1.filter((it) => selector(old) !== selector(it));
-        }
-    }
-    const remaining = updatedList.filter((updated) => !result.some((it) => selector(it) == selector(updated)));
-    if (insertLast) {
-        result.push(...remaining);
-    }
-    else {
-        // Insert remaining at first position by ordering.
-        for (const it of remaining) {
-            let found = false;
-            for (let i = 0; i < result.length; i++) {
-                if (selector(result[i]).localeCompare(selector(it)) > 0) {
-                    found = true;
-                    result = [...result.slice(0, i), it, ...result.slice(i)];
-                    break;
-                }
-            }
-            if (!found) {
-                result.push(it);
-            }
-        }
-    }
-    return result;
-}
-
-async function getReposFromGitHub(github, orgs) {
-    return (await pMap(orgs, async (org) => {
-        const repos = await github.getOrgRepoList({ org: org.login });
-        return pMap(repos, async (repo) => {
-            const detailedRepo = await github.getRepository(repo.owner.login, repo.name);
-            if (detailedRepo === undefined) {
-                throw Error(`Repo not found: ${repo.owner.login}/${repo.name}`);
-            }
-            return {
-                basic: repo,
-                repository: detailedRepo,
-                teams: await github.getRepositoryTeamsList(detailedRepo),
-            };
-        });
-    })).flat();
-}
-async function getTeams(github, orgs) {
-    const intermediate = await pMap(orgs, async (org) => {
-        const teams = await github.getTeamList(org);
-        return {
-            org,
-            teams: await pMap(teams, async (team) => ({
-                team,
-                users: await github.getTeamMemberListIncludingInvited(org, team),
-            })),
-        };
-    });
-    // Transform output.
-    return intermediate.reduce((prev, cur) => {
-        prev[cur.org.login] = cur.teams;
-        return prev;
-    }, {});
-}
-function getCommonTeams(ownerRepos) {
-    return ownerRepos.length === 0
-        ? []
-        : ownerRepos[0].teams.filter((team) => ownerRepos.every((repo) => repo.teams.some((otherTeam) => otherTeam.name === team.name &&
-            otherTeam.permission === team.permission)));
-}
-function getSpecificTeams(teams, commonTeams) {
-    return teams.filter((team) => !commonTeams.some((it) => it.name === team.name && it.permission === team.permission));
-}
-function getFormattedTeams(oldTeams, teams) {
-    const result = teams.length === 0
-        ? undefined
-        : teams.map((it) => ({
-            name: it.name,
-            permission: it.permission,
-        }));
-    return result
-        ? reorderListToSimilarAsBefore(oldTeams ?? [], result, (it) => it.name)
-        : undefined;
-}
-async function getOrgs(github, orgs) {
-    return pMap(orgs, (it) => github.getOrg(it));
-}
-function removeDuplicates(items, selector) {
-    const ids = [];
-    const result = [];
-    for (const item of items) {
-        const id = selector(item);
-        if (!ids.includes(id)) {
-            result.push(item);
-            ids.push(id);
-        }
-    }
-    return result;
-}
-async function getMembers(github, orgs) {
-    return removeDuplicates((await pMap(orgs, (org) => github.getOrgMembersListIncludingInvited(org.login)))
-        .flat()
-        .map((it) => it.login), (it) => it);
-}
-async function getSnykRepos(snyk, definition) {
-    return (await snyk.getProjects(definition))
-        .map((it) => getGitHubRepo(it))
-        .filter((it) => it !== undefined)
-        .map((it) => getRepoId(it.owner, it.name));
-}
-async function getProjects(github, orgs, definition, snyk) {
-    const snykReposPromise = getSnykRepos(snyk, definition);
-    const repos = await getReposFromGitHub(github, orgs);
-    const snykRepos = await snykReposPromise;
-    const definitionRepos = Object.fromEntries(getRepos(definition).map((repo) => [repo.id, repo]));
-    const projectGroups = Object.values(repos.reduce((acc, cur) => {
-        const org = cur.repository.owner.login;
-        const repoId = getRepoId(org, cur.repository.name);
-        const projectName = definitionRepos[repoId]?.project?.name ?? "Unknown";
-        const project = acc[projectName] || {
-            name: projectName,
-            definition: definitionRepos[repoId]?.project,
-            repos: [],
-        };
-        return {
-            ...acc,
-            [projectName]: {
-                ...project,
-                repos: {
-                    ...project.repos,
-                    [org]: [...(project.repos[org] || []), cur],
-                },
-            },
-        };
-    }, {}));
-    const projects = projectGroups.map((project) => {
-        const github = Object.entries(project.repos).map(([org, list]) => {
-            const commonTeams = getCommonTeams(list);
-            const oldOrg = project.definition?.github?.find((it) => it.organization == org);
-            const repos = list.map((repo) => {
-                const repoId = getRepoId(repo.basic.owner.login, repo.basic.name);
-                const definitionRepo = definitionRepos[repoId];
-                const result = {
-                    name: repo.basic.name,
-                    previousNames: definitionRepo?.repo.previousNames,
-                    archived: repo.repository.archived ? true : undefined,
-                    issues: repo.repository.has_issues ? undefined : false,
-                    wiki: repo.repository.has_wiki ? undefined : false,
-                    teams: getFormattedTeams(definitionRepo?.repo?.teams ?? [], getSpecificTeams(repo.teams, commonTeams)),
-                    snyk: snykRepos.includes(repoId) ? true : undefined,
-                    public: repo.repository.private ? undefined : true,
-                    responsible: definitionRepo?.repo.responsible,
-                };
-                // Try to preserve property order.
-                return Object.fromEntries(reorderListToSimilarAsBefore(definitionRepo ? Object.entries(definitionRepo.repo) : [], Object.entries(result), (it) => it[0], true));
-            });
-            const teams = getFormattedTeams(oldOrg?.teams ?? [], commonTeams);
-            return {
-                organization: org,
-                teams: teams,
-                repos: reorderListToSimilarAsBefore(oldOrg?.repos ?? [], repos, (it) => it.name),
-            };
-        });
-        return {
-            name: project.name,
-            github: reorderListToSimilarAsBefore(project.definition?.github ?? [], github, (it) => it.organization),
-        };
-    });
-    return reorderListToSimilarAsBefore(definition.projects, projects, (it) => it.name);
-}
-function buildGitHubTeamsList(definition, list) {
-    const result = Object.entries(list).map(([org, teams]) => ({
-        organization: org,
-        teams: teams.map((team) => ({
-            name: team.team.name,
-            members: team.users
-                .map((it) => it.login)
-                .sort((a, b) => a.localeCompare(b)),
-        })),
-    }));
-    return reorderListToSimilarAsBefore(definition.github.teams, result, (it) => it.organization);
-}
-function buildGitHubUsersList(definition, members) {
-    const result = members.map((memberLogin) => definition.github.users.find((user) => user.login === memberLogin) || {
-        type: "external",
-        login: memberLogin,
-        // TODO: Fetch name from GitHub?
-        name: "*Unknown*",
-    });
-    return reorderListToSimilarAsBefore(definition.github.users, result, (it) => it.login);
-}
-async function dumpSetup(_config, reporter, github, snyk, outfile, definitionFile) {
-    reporter.info("Fetching data. This might take some time");
-    const definition = await definitionFile.getDefinition();
-    const orgs = await getOrgs(github, getGitHubOrgs(definition));
-    const teams = getTeams(github, orgs);
-    const members = getMembers(github, orgs);
-    const projects = getProjects(github, orgs, definition, snyk);
-    const generatedDefinition = {
-        snyk: definition.snyk,
-        github: {
-            users: buildGitHubUsersList(definition, await members),
-            teams: buildGitHubTeamsList(definition, await teams),
-        },
-        projects: await projects,
-    };
-    // TODO: An earlier version we had preserved comments by using yawn-yaml
-    //  package. However it often produced invalid yaml, so we have removed
-    //  it. We might want to revisit it to preserve comments.
-    const doc = yaml.load(await definitionFile.getContents());
-    doc.snyk = generatedDefinition.snyk;
-    doc.projects = generatedDefinition.projects;
-    doc.github = generatedDefinition.github;
-    // Convert to/from plain JSON so that undefined elements are removed.
-    fs.writeFileSync(outfile, yaml.dump(JSON.parse(JSON.stringify(doc))));
-    reporter.info(`Saved to ${outfile}`);
-    reporter.info(`Number of GitHub requests: ${github.requestCount}`);
-}
-const command$h = {
-    command: "dump-setup",
-    describe: "Dump active setup as YAML. Will be formated same as the definition file.",
-    builder: (yargs) => yargs
-        .positional("outfile", {
-        type: "string",
-    })
-        .option(definitionFileOptionName, definitionFileOptionValue)
-        .demandOption("outfile"),
-    handler: async (argv) => {
-        const reporter = createReporter(argv);
-        const config = createConfig();
-        const github = await createGitHubService({
-            config,
-            cache: createCacheProvider(config, argv),
-        });
-        const snyk = createSnykService({ config });
-        await reportRateLimit(reporter, github, () => dumpSetup(config, reporter, github, snyk, argv.outfile, getDefinitionFile(argv)));
-    },
-};
-
-const command$g = {
-    command: "validate",
-    describe: "Validate definition file.",
-    builder: (yargs) => yargs.option(definitionFileOptionName, definitionFileOptionValue),
-    handler: async (argv) => {
-        const reporter = createReporter(argv);
-        await getDefinitionFile(argv).getDefinition();
-        reporter.info("Valid!");
-    },
-};
-
-const command$f = {
-    command: "definition",
-    describe: "CALS definition file management",
-    builder: (yargs) => yargs
-        .command(command$h)
-        .command(command$g)
-        .demandCommand()
-        .usage("cals definition"),
-    handler: () => {
-        yargs(hideBin(process__default.argv)).showHelp();
-    },
-};
-
-const command$e = {
-    command: "delete-cache",
-    describe: "Delete cached data",
-    handler: (argv) => {
-        const config = createConfig();
-        const cache = createCacheProvider(config, argv);
-        const reporter = createReporter(argv);
-        cache.cleanup();
-        reporter.info("Cache deleted");
-    },
-};
-
-const command$d = {
-    command: "getting-started",
-    describe: "Getting started",
-    handler: (argv) => {
-        const reporter = createReporter(argv);
-        reporter.log("For getting started, see https://liflig.atlassian.net/wiki/x/E8MNAQ");
-    },
-};
-
-async function analyzeDirectory(reporter, config, github, org) {
-    const repos = await github.getOrgRepoList({ org });
-    const reposDict = repos.reduce((acc, cur) => ({ ...acc, [cur.name]: cur }), {});
-    const dirs = fs
-        .readdirSync(config.cwd)
-        .filter((it) => fs.statSync(path.join(config.cwd, it)).isDirectory())
-        // Skip hidden folders
-        .filter((it) => !it.startsWith("."))
-        .sort((a, b) => a.localeCompare(b));
-    const stats = {
-        unknown: 0,
-        archived: 0,
-        ok: 0,
-    };
-    dirs.forEach((it) => {
-        if (!(it in reposDict)) {
-            reporter.warn(sprintf("%-30s  <-- Not found in repository list (maybe changed name?)", it));
-            stats.unknown++;
-            return;
-        }
-        if (reposDict[it].isArchived) {
-            reporter.info(sprintf("%-30s  <-- Archived", it));
-            stats.archived++;
-            return;
-        }
-        stats.ok += 1;
-    });
-    reporter.info(sprintf("Stats: unknown=%d  archived=%d  ok=%d", stats.unknown, stats.archived, stats.ok));
-    reporter.info("Use `cals github generate-clone-commands` to check for repositories not checked out");
-}
-const command$c = {
-    command: "analyze-directory",
-    describe: "Analyze directory for git repos",
-    builder: (yargs) => yargs.options("org", {
-        required: true,
-        describe: "Specify GitHub organization",
-        type: "string",
-    }),
-    handler: async (argv) => {
-        const config = createConfig();
-        const github = await createGitHubService({
-            config,
-            cache: createCacheProvider(config, argv),
-        });
-        const reporter = createReporter(argv);
-        return analyzeDirectory(reporter, config, github, argv.org);
-    },
-};
-
-function getChangedRepoAttribs(definitionRepo, actualRepo) {
-    const attribs = [];
-    const archived = definitionRepo.archived || false;
-    if (archived !== actualRepo.archived) {
-        attribs.push({
-            archived,
-        });
-    }
-    const issues = definitionRepo.issues ?? true;
-    if (issues !== actualRepo.has_issues && !actualRepo.archived) {
-        attribs.push({
-            issues,
-        });
-    }
-    const wiki = definitionRepo.wiki ?? true;
-    if (wiki !== actualRepo.has_wiki && !actualRepo.archived) {
-        attribs.push({
-            wiki,
-        });
-    }
-    const isPrivate = definitionRepo.public !== true;
-    if (isPrivate !== actualRepo.private) {
-        attribs.push({
-            private: isPrivate,
-        });
-    }
-    return attribs;
-}
-/**
- * Get teams from both the project level and the repository level
- * and ensure that repository level override project level.
- */
-function getExpectedTeams(projectTeams, repoTeams) {
-    return [
-        ...repoTeams,
-        ...projectTeams.filter((it) => !repoTeams.find((repoTeam) => repoTeam.name === it.name)),
-    ];
-}
-async function getRepoTeamChanges({ github, org, projectRepo, repo, }) {
-    const changes = [];
-    const expectedTeams = getExpectedTeams(org.teams ?? [], projectRepo.teams ?? []);
-    const existingTeams = await github.getRepositoryTeamsList(repo);
-    // Check for teams to be added / modified.
-    for (const repoteam of expectedTeams) {
-        const found = existingTeams.find((it) => repoteam.name === it.name);
-        if (found !== undefined) {
-            if (found.permission !== repoteam.permission) {
-                changes.push({
-                    type: "repo-team-permission",
-                    org: org.organization,
-                    repo: repo.name,
-                    team: found.name,
-                    permission: repoteam.permission,
-                    current: {
-                        permission: found.permission,
-                    },
-                });
-            }
-        }
-        else {
-            changes.push({
-                type: "repo-team-add",
-                org: org.organization,
-                repo: repo.name,
-                team: repoteam.name,
-                permission: repoteam.permission,
-            });
-        }
-    }
-    // Check for teams that should not be registered.
-    for (const team of existingTeams) {
-        if (!expectedTeams.some((it) => team.name === it.name)) {
-            changes.push({
-                type: "repo-team-remove",
-                org: org.organization,
-                repo: repo.name,
-                team: team.name,
-            });
-        }
-    }
-    return changes;
-}
-async function getProjectRepoChanges({ github, org, projectRepo, }) {
-    const changes = [];
-    const repo = await github.getRepository(org.organization, projectRepo.name);
-    if (repo === undefined) {
-        changes.push({
-            type: "repo-create",
-            org: org.organization,
-            repo: projectRepo.name,
-        });
-        return changes;
-    }
-    const attribs = getChangedRepoAttribs(projectRepo, repo);
-    if (attribs.length > 0) {
-        changes.push({
-            type: "repo-update",
-            org: org.organization,
-            repo: repo.name,
-            attribs,
-        });
-    }
-    changes.push(...(await getRepoTeamChanges({
-        github,
-        org,
-        projectRepo,
-        repo,
-    })));
-    return changes;
-}
-/**
- * Generate change set items for projects.
- */
-async function createChangeSetItemsForProjects(github, definition, limitToOrg) {
-    const changes = [];
-    const orgs = definition.projects
-        .flatMap((it) => it.github)
-        .filter((org) => limitToOrg === undefined || limitToOrg === org.organization);
-    changes.push(...(await pMap(orgs, async (org) => pMap(org.repos || [], (projectRepo) => getProjectRepoChanges({
-        github,
-        org,
-        projectRepo,
-    }))))
-        .flat()
-        .flat());
-    return changes;
-}
-/**
- * Get user list based on team memberships in an organization.
- */
-function getUsersForOrg(definition, org) {
-    const teams = definition.github.teams.find((it) => it.organization == org);
-    if (teams === undefined)
-        return [];
-    const memberLogins = new Set(teams.teams.flatMap((it) => it.members));
-    return definition.github.users.filter((user) => memberLogins.has(user.login));
-}
-/**
- * Generate change set items for organization members.
- */
-async function createChangeSetItemsForMembers(github, definition, org) {
-    const changes = [];
-    const users = getUsersForOrg(definition, org.login);
-    const usersLogins = users.map((it) => it.login);
-    const foundLogins = [];
-    const members = await github.getOrgMembersListIncludingInvited(org.login);
-    members.forEach((user) => {
-        if (usersLogins.includes(user.login)) {
-            foundLogins.push(user.login);
-        }
-        else {
-            changes.push({
-                type: "member-remove",
-                org: org.login,
-                user: user.login,
-            });
-        }
-    });
-    for (const user of users.filter((it) => !foundLogins.includes(it.login))) {
-        changes.push({
-            type: "member-add",
-            org: org.login,
-            user: user.login,
+}
+function createConfig() {
+    return new Config();
+}
+
+async function authenticate({ reporter, token, tokenProvider, }) {
+    if (token === undefined) {
+        reporter.info("Need API token to talk to GitHub");
+        reporter.info("https://github.com/settings/tokens/new?scopes=repo:status,read:repo_hook");
+        const inputToken = await readInput({
+            prompt: "Enter GitHub token: ",
+            silent: true,
         });
+        token = inputToken;
     }
-    return changes;
+    await tokenProvider.setToken(token);
+    reporter.info("Token saved to keychain");
 }
-/**
- * Generate change set items for organization teams.
- */
-async function createChangeSetItemsForTeams(github, definition, org) {
-    const changes = [];
-    const teams = (definition.github.teams.find((it) => it.organization === org.login) || {
-        teams: [],
-    }).teams;
-    const actualTeams = await github.getTeamList(org);
-    const actualTeamNames = actualTeams.map((it) => it.name);
-    const wantedTeamNames = teams.map((it) => it.name);
-    actualTeams
-        .filter((it) => !wantedTeamNames.includes(it.name))
-        .forEach((it) => {
-        changes.push({
-            type: "team-remove",
-            org: org.login,
-            team: it.name,
-        });
-    });
-    teams
-        .filter((it) => !actualTeamNames.includes(it.name))
-        .forEach((team) => {
-        changes.push({
-            type: "team-add",
-            org: org.login,
-            team: team.name,
+const command$5 = {
+    command: "auth [token]",
+    describe: "Authenticate with GitHub",
+    builder: (yargs) => yargs.positional("token", {
+        describe: "GitHub token (prompted if not provided)",
+        type: "string",
+    }),
+    handler: async (argv) => {
+        await authenticate({
+            reporter: createReporter(),
+            token: argv.token,
+            tokenProvider: new GitHubTokenCliProvider(),
         });
-        // Must add all members when creating new team.
-        for (const member of team.members) {
-            changes.push({
-                type: "team-member-add",
-                org: org.login,
-                team: team.name,
-                user: member,
-                // TODO: Allow to specify maintainers?
-                role: "member",
-            });
-        }
-    });
-    const overlappingTeams = actualTeams.filter((it) => wantedTeamNames.includes(it.name));
-    await pMap(overlappingTeams, async (actualTeam) => {
-        const wantedTeam = teams.find((it) => it.name === actualTeam.name);
-        const actualMembers = await github.getTeamMemberListIncludingInvited(org, actualTeam);
-        actualMembers
-            .filter((it) => !wantedTeam.members.includes(it.login))
-            .forEach((it) => {
-            changes.push({
-                type: "team-member-remove",
-                org: org.login,
-                team: actualTeam.name,
-                user: it.login,
+    },
+};
+
+class GitHubService {
+    octokit;
+    cache;
+    tokenProvider;
+    semaphore;
+    constructor(props) {
+        this.octokit = props.octokit;
+        this.cache = props.cache;
+        this.tokenProvider = props.tokenProvider;
+        // Control concurrency to GitHub API at service level so we
+        // can maximize concurrency all other places.
+        this.semaphore = pLimit(6);
+        this.octokit.hook.wrap("request", async (request, options) => {
+            if (options.method !== "GET") {
+                return this.semaphore(() => request(options));
+            }
+            // Try to cache ETag for GET requests to save on rate limiting.
+            // Hits on ETag does not count towards rate limiting.
+            const rest = {
+                ...options,
+            };
+            delete rest.method;
+            delete rest.baseUrl;
+            delete rest.headers;
+            delete rest.mediaType;
+            delete rest.request;
+            // Build a key that is used to identify this request.
+            const key = Buffer.from(JSON.stringify(rest)).toString("base64");
+            const cacheItem = this.cache.retrieveJson(key);
+            if (cacheItem !== undefined) {
+                // Copying doesn't work, seems we need to mutate this.
+                options.headers["If-None-Match"] = cacheItem.data.etag;
+            }
+            const getResponse = async (allowRetry = true) => {
+                try {
+                    return await request(options);
+                }
+                catch (e) {
+                    // Handle no change in ETag.
+                    if (e.status === 304) {
+                        return undefined;
+                    }
+                    // GitHub seems to throw a lot of 502 errors.
+                    // Let's give it a few seconds and retry one time.
+                    if (e.status === 502 && allowRetry) {
+                        await new Promise((resolve) => setTimeout(resolve, 2000));
+                        return await getResponse(false);
+                    }
+                    throw e;
+                }
+            };
+            const response = await this.semaphore(async () => {
+                return getResponse();
             });
+            if (response === undefined) {
+                // Undefined is returned for cached data.
+                if (cacheItem === undefined) {
+                    throw new Error("Missing expected cache item");
+                }
+                // Use previous value.
+                return cacheItem.data.data;
+            }
+            // New value. Store Etag.
+            if (response.headers.etag) {
+                this.cache.storeJson(key, {
+                    etag: response.headers.etag,
+                    data: response,
+                });
+            }
+            return response;
         });
-        const actualMembersNames = actualMembers.map((it) => it.login);
-        wantedTeam.members
-            .filter((it) => !actualMembersNames.includes(it))
-            .forEach((it) => {
-            changes.push({
-                type: "team-member-add",
-                org: org.login,
-                team: actualTeam.name,
-                user: it,
-                // TODO: Allow to specify maintainers?
-                role: "member",
+    }
+    async runGraphqlQuery(query) {
+        const token = await this.tokenProvider.getToken();
+        if (token === undefined) {
+            throw new Error("Missing token for GitHub");
+        }
+        const url = "https://api.github.com/graphql";
+        const headers = {
+            Authorization: `Bearer ${token}`,
+        };
+        let requestDuration = -1;
+        const response = await this.semaphore(() => {
+            const requestStart = performance.now();
+            const result = fetch(url, {
+                method: "POST",
+                headers,
+                body: JSON.stringify({ query }),
             });
+            requestDuration = performance.now() - requestStart;
+            return result;
         });
-        // TODO: team-member-permission (member/maintainer)
-    });
-    return changes;
-}
-/**
- * Remove redundant change set items due to effects by other
- * change set items.
- */
-function cleanupChangeSetItems(items) {
-    const hasTeamRemove = ({ org, team }) => items.some((it) => it.type === "team-remove" && it.org === org && it.team === team);
-    const hasMemberRemove = ({ org }) => items.some((it) => it.type === "member-remove" && it.org === org);
-    return items.filter((item) => !((item.type === "team-member-remove" && hasTeamRemove(item)) ||
-        (item.type === "repo-team-remove" && hasTeamRemove(item)) ||
-        (item.type === "team-member-remove" && hasMemberRemove(item))));
-}
-
-function buildLookup(github) {
-    // We operate using the Octokit SDK, so cache the objects to avoid
-    // excessive lookups to the API for them.
-    const orgCache = {};
-    const orgTeamListCache = {};
-    async function getOrg(orgName) {
-        if (!(orgName in orgCache)) {
-            orgCache[orgName] = await github.getOrg(orgName);
+        if (response.status === 401) {
+            process.stderr.write("Unauthorized\n");
+            await this.tokenProvider.markInvalid();
         }
-        return orgCache[orgName];
-    }
-    async function getOrgTeamList(orgName) {
-        if (!(orgName in orgTeamListCache)) {
-            const org = await getOrg(orgName);
-            orgTeamListCache[orgName] = await github.getTeamList(org);
+        // If you get 502 after 10s, it is a timeout.
+        if (response.status === 502) {
+            throw new Error(`Response from Github likely timed out (10s max) after elapsed ${requestDuration}ms with status ${response.status}: ${await response.text()}`);
         }
-        return orgTeamListCache[orgName];
+        if (!response.ok) {
+            throw new Error(`Response from GitHub not OK (${response.status}): ${await response.text()}`);
+        }
+        const json = (await response.json());
+        if (json.errors) {
+            throw new Error(`Error from GitHub GraphQL API: ${JSON.stringify(json.errors)}`);
+        }
+        if (json.data == null) {
+            throw new Error("No data received from GitHub GraphQL API (unknown reason)");
+        }
+        return json.data;
     }
-    async function getOrgTeam(orgName, teamName) {
-        const teams = await getOrgTeamList(orgName);
-        const team = teams.find((it) => it.name === teamName);
-        if (team === undefined) {
-            throw new Error(`Team ${orgName}/${teamName} not found`);
+    async getOrgRepoList({ org }) {
+        const getQuery = (after) => `{
+  organization(login: "${org}") {
+    repositories(first: 100${after === null ? "" : `, after: "${after}"`}) {
+      totalCount
+      pageInfo {
+        hasNextPage
+        endCursor
+      }
+      nodes {
+        name
+        owner {
+          login
+        }
+        defaultBranchRef {
+          name
+        }
+        createdAt
+        updatedAt
+        isArchived
+        sshUrl
+        repositoryTopics(first: 100) {
+          edges {
+            node {
+              topic {
+                name
+              }
+            }
+          }
         }
-        return team;
+      }
     }
-    return {
-        getOrgTeam,
-    };
-}
-const notImplementedChangeSetItems = [
-    "repo-create",
-];
-function isNotImplementedChangeSetItem(changeItem) {
-    return notImplementedChangeSetItems.includes(changeItem.type);
-}
-/**
- * Execute a change set item.
- */
-async function executeChangeSetItem(github, changeItem, reporter, lookup) {
-    // We return to ensure all code paths are followed during compiling.
-    // If a change item type is missing we will get a compile error.
-    if (isNotImplementedChangeSetItem(changeItem)) {
-        reporter.warn("Not currently implemented - do it manually");
-        return true;
-    }
-    switch (changeItem.type) {
-        case "member-remove":
-            await github.octokit.orgs.removeMembershipForUser({
-                org: changeItem.org,
-                username: changeItem.user,
-            });
-            return true;
-        case "member-add":
-            await github.octokit.orgs.setMembershipForUser({
-                org: changeItem.org,
-                username: changeItem.user,
-                role: "member",
-            });
-            return true;
-        case "team-remove":
-            await github.octokit.teams.deleteInOrg({
-                org: changeItem.org,
-                team_slug: (await lookup.getOrgTeam(changeItem.org, changeItem.team))
-                    .slug,
-            });
-            return true;
-        case "team-add":
-            await github.octokit.teams.create({
-                org: changeItem.org,
-                name: changeItem.team,
-                privacy: "closed",
-            });
-            return true;
-        case "team-member-permission":
-            await github.octokit.teams.addOrUpdateMembershipForUserInOrg({
-                org: changeItem.org,
-                team_slug: (await lookup.getOrgTeam(changeItem.org, changeItem.team))
-                    .slug,
-                username: changeItem.user,
-                role: changeItem.role,
-            });
-            return true;
-        case "team-member-remove":
-            await github.octokit.teams.removeMembershipForUserInOrg({
-                org: changeItem.org,
-                team_slug: (await lookup.getOrgTeam(changeItem.org, changeItem.team))
-                    .slug,
-                username: changeItem.user,
-            });
-            return true;
-        case "team-member-add":
-            await github.octokit.teams.addOrUpdateMembershipForUserInOrg({
-                org: changeItem.org,
-                team_slug: (await lookup.getOrgTeam(changeItem.org, changeItem.team))
-                    .slug,
-                username: changeItem.user,
-            });
-            return true;
-        case "repo-update": {
-            const upd = {
-                owner: changeItem.org,
-                repo: changeItem.repo,
-            };
-            for (const attrib of changeItem.attribs) {
-                if ("archived" in attrib) {
-                    upd.archived = attrib.archived;
-                }
-                else if ("issues" in attrib) {
-                    upd.has_issues = attrib.issues;
+  }
+}`;
+        return this.cache.json(`repos-${org}`, async () => {
+            const repos = [];
+            let after = null;
+            while (true) {
+                const query = getQuery(after);
+                const res = await this.runGraphqlQuery(query);
+                if (res.organization == null) {
+                    throw new Error("Missing organization");
                 }
-                else if ("wiki" in attrib) {
-                    upd.has_wiki = attrib.wiki;
+                if (res.organization.repositories.nodes == null) {
+                    throw new Error("Missing organization nodes");
                 }
-                else if ("private" in attrib) {
-                    upd.private = attrib.private;
+                repos.push(...res.organization.repositories.nodes);
+                if (!res.organization.repositories.pageInfo.hasNextPage) {
+                    break;
                 }
+                after = res.organization.repositories.pageInfo.endCursor;
             }
-            await github.octokit.repos.update(upd);
-            return true;
-        }
-        case "repo-team-remove":
-            await github.octokit.teams.removeRepoInOrg({
-                org: changeItem.org,
-                owner: changeItem.org,
-                repo: changeItem.repo,
-                team_slug: (await lookup.getOrgTeam(changeItem.org, changeItem.team))
-                    .slug,
-            });
-            return true;
-        case "repo-team-add":
-        case "repo-team-permission":
-            await github.octokit.teams.addOrUpdateRepoPermissionsInOrg({
-                org: changeItem.org,
-                owner: changeItem.org,
-                repo: changeItem.repo,
-                team_slug: (await lookup.getOrgTeam(changeItem.org, changeItem.team))
-                    .slug,
-                permission: changeItem.permission,
-            });
-            return true;
+            return repos.sort((a, b) => a.name.localeCompare(b.name));
+        });
     }
 }
-/**
- * Execute a change set.
- */
-async function executeChangeSet(github, changes, reporter) {
-    const lookup = buildLookup(github);
-    for (const changeItem of changes) {
-        reporter.info(`Executing ${JSON.stringify(changeItem)}`);
-        await executeChangeSetItem(github, changeItem, reporter, lookup);
-    }
+async function createOctokit(tokenProvider) {
+    return new Octokit({
+        auth: await tokenProvider.getToken(),
+    });
 }
-
-function createOrgGetter(github) {
-    const orgs = {};
-    // Use a semaphore for each orgName to restrict multiple
-    // concurrent requests of the same org.
-    const semaphores = {};
-    function getSemaphore(orgName) {
-        if (!(orgName in semaphores)) {
-            semaphores[orgName] = pLimit(1);
-        }
-        return semaphores[orgName];
-    }
-    return async (orgName) => await getSemaphore(orgName)(async () => {
-        if (!(orgName in orgs)) {
-            const org = await github.getOrg(orgName);
-            orgs[orgName] = {
-                org,
-                teams: await github.getTeamList(org),
-            };
-        }
-        return orgs[orgName];
+async function createGitHubService(props) {
+    const tokenProvider = props.tokenProvider ?? new GitHubTokenCliProvider();
+    return new GitHubService({
+        octokit: await createOctokit(tokenProvider),
+        cache: props.cache,
+        tokenProvider,
     });
 }
-async function process(reporter, github, definition, getOrg, execute, limitToOrg) {
-    let changes = [];
-    for (const orgName of getGitHubOrgs(definition)) {
-        if (limitToOrg !== undefined && limitToOrg !== orgName) {
-            continue;
+
+function getGroup(repo) {
+    const projectTopics = [];
+    let isInfra = false;
+    repo.repositoryTopics.edges.forEach((edge) => {
+        const name = edge.node.topic.name;
+        if (name.startsWith("customer-")) {
+            projectTopics.push(name.substring(9));
         }
-        const org = (await getOrg(orgName)).org;
-        changes = [
-            ...changes,
-            ...(await createChangeSetItemsForMembers(github, definition, org)),
-        ];
-        changes = [
-            ...changes,
-            ...(await createChangeSetItemsForTeams(github, definition, org)),
-        ];
-    }
-    changes = [
-        ...changes,
-        ...(await createChangeSetItemsForProjects(github, definition, limitToOrg)),
-    ];
-    changes = cleanupChangeSetItems(changes);
-    const ignored = changes.filter(isNotImplementedChangeSetItem);
-    changes = changes.filter((it) => !ignored.includes(it));
-    if (ignored.length > 0) {
-        reporter.info("Not implemented:");
-        for (const change of ignored) {
-            reporter.info(`  - ${JSON.stringify(change)}`);
+        if (name.startsWith("project-")) {
+            projectTopics.push(name.substring(8));
         }
-    }
-    if (changes.length === 0) {
-        reporter.info("No actions to be performed");
-    }
-    else {
-        reporter.info("To be performed:");
-        for (const change of changes) {
-            reporter.info(`  - ${JSON.stringify(change)}`);
+        if (name === "infrastructure") {
+            isInfra = true;
         }
+    });
+    if (projectTopics.length > 1) {
+        console.warn(`Repo ${repo.name} has multiple project groups: ${projectTopics.join(", ")}. Picking first`);
     }
-    if (execute && changes.length > 0) {
-        const answer = await read({
-            prompt: "Confirm you want to execute the changes [y/N]: ",
-            timeout: 60000,
-        });
-        if (answer.toLowerCase() === "y") {
-            reporter.info("Executing changes");
-            await executeChangeSet(github, changes, reporter);
-        }
-        else {
-            reporter.info("Skipping");
-        }
+    if (projectTopics.length > 0) {
+        return projectTopics[0];
+    }
+    if (isInfra) {
+        return "infrastructure";
     }
-    reporter.info(`Number of GitHub requests: ${github.requestCount}`);
+    return null;
+}
+function ifnull(a, other) {
+    return a === null ? other : a;
+}
+function getGroupedRepos(repos) {
+    return Object.values(repos.reduce((acc, repo) => {
+        const group = ifnull(getGroup(repo), "(unknown)");
+        const value = acc[group] || { name: group, items: [] };
+        return {
+            ...acc,
+            [group]: {
+                ...value,
+                items: [...value.items, repo],
+            },
+        };
+    }, {})).sort((a, b) => a.name.localeCompare(b.name));
+}
+function includesTopic(repo, topic) {
+    return repo.repositoryTopics.edges.some((it) => it.node.topic.name === topic);
 }
-const command$b = {
-    command: "configure",
-    describe: "Configure CALS GitHub resources",
-    builder: (yargs) => yargs
-        .options("execute", {
-        describe: "Execute the detected changes",
-        type: "boolean",
-    })
-        .options("org", {
-        describe: "Filter resources by GitHub organization",
-        type: "string",
-    })
-        .option(definitionFileOptionName, definitionFileOptionValue),
-    handler: async (argv) => {
-        const reporter = createReporter(argv);
-        const config = createConfig();
-        const github = await createGitHubService({
-            config,
-            cache: createCacheProvider(config, argv),
-        });
-        const definition = await getDefinitionFile(argv).getDefinition();
-        await reportRateLimit(reporter, github, async () => {
-            const orgGetter = createOrgGetter(github);
-            await process(reporter, github, definition, orgGetter, !!argv.execute, argv.org);
-        });
-    },
-};
 
-async function generateCloneCommands({ reporter, config, github, org, ...opt }) {
-    if (!opt.listGroups && !opt.all && opt.group === undefined) {
+async function generateCloneCommands({ config, github, org, ...opt }) {
+    if (!opt.all && opt.group === undefined) {
         yargs(hideBin(process__default.argv)).showHelp();
         return;
     }
     const repos = await github.getOrgRepoList({ org });
     const groups = getGroupedRepos(repos);
-    if (opt.listGroups) {
-        groups.forEach((it) => {
-            reporter.log(it.name);
-        });
-        return;
-    }
-    groups.forEach((group) => {
+    for (const group of groups) {
         if (opt.group !== undefined && opt.group !== group.name) {
-            return;
+            continue;
         }
         group.items
             .filter((it) => opt.includeArchived || !it.isArchived)
             .filter((it) => opt.name === undefined || it.name.includes(opt.name))
             .filter((it) => opt.topic === undefined || includesTopic(it, opt.topic))
-            .filter((it) => !opt.excludeExisting ||
-            !fs.existsSync(path.resolve(config.cwd, it.name)))
+            .filter((it) => !opt.skipCloned || !fs.existsSync(path.resolve(config.cwd, it.name)))
             .forEach((repo) => {
             // The output of this is used to pipe into e.g. bash.
-            // We cannot use reporter.log as it adds additional characters.
-            process__default.stdout.write(sprintf('[ ! -e "%s" ] && git clone %s\n', repo.name, repo.sshUrl));
+            process__default.stdout.write(`[ ! -e "${repo.name}" ] && git clone ${repo.sshUrl}\n`);
         });
-    });
+    }
 }
-const command$a = {
-    command: "generate-clone-commands",
-    describe: "Generate shell commands to clone GitHub repos for an organization",
+const command$4 = {
+    command: "clone [group]",
+    describe: "Generate git clone commands (pipe to bash to execute)",
     builder: (yargs) => yargs
         .positional("group", {
-        describe: "Group to generate commands for",
+        describe: "Clone only repos in this group",
+        type: "string",
     })
         .options("org", {
-        demandOption: true,
-        describe: "Specify GitHub organization",
+        alias: "o",
+        default: "capralifecycle",
+        requiresArg: true,
+        describe: "GitHub organization",
         type: "string",
     })
         .option("all", {
-        describe: "Use all groups",
-        type: "boolean",
-    })
-        .option("list-groups", {
-        alias: "l",
-        describe: "List available groups",
+        describe: "Clone all repos",
         type: "boolean",
     })
         .option("include-archived", {
@@ -2266,90 +556,58 @@ const command$a = {
         .option("name", {
         describe: "Filter to include the specified name",
         type: "string",
+        requiresArg: true,
     })
         .option("topic", {
         alias: "t",
         describe: "Filter by specific topic",
         type: "string",
+        requiresArg: true,
     })
-        .option("exclude-existing", {
-        alias: "x",
-        describe: "Exclude if existing in working directory",
+        .option("skip-cloned", {
+        alias: "s",
+        describe: "Skip repos already cloned in working directory",
         type: "boolean",
     }),
     handler: async (argv) => {
         const config = createConfig();
         return generateCloneCommands({
-            reporter: createReporter(argv),
             config,
             github: await createGitHubService({
-                config,
                 cache: createCacheProvider(config, argv),
             }),
             all: !!argv.all,
-            listGroups: !!argv["list-groups"],
             includeArchived: !!argv["include-archived"],
             name: argv.name,
             topic: argv.topic,
-            excludeExisting: !!argv["exclude-existing"],
+            skipCloned: !!argv["skip-cloned"],
             group: argv.group,
             org: argv.org,
         });
     },
 };
 
-async function listPullRequestsStats({ reporter, github, }) {
-    // This is only an initial attempt to get some insights into
-    // open pull requests. Feel free to change.
-    const pulls = await github.getSearchedPullRequestList("capralifecycle");
-    const cutoffOld = new Date(Date.now() - 86400 * 1000 * 60);
-    const categories = pulls
-        .reduce((acc, cur) => {
-        const key = `${cur.baseRepository.owner.login}/${cur.baseRepository.name}`;
-        const old = new Date(cur.createdAt) < cutoffOld;
-        const snyk = cur.title.includes("[Snyk]");
-        // Cheat by mutating.
-        let t = acc.find((it) => it.key === key);
-        if (t === undefined) {
-            t = {
-                key,
-                old: [],
-                oldSnyk: [],
-                recent: [],
-                recentSnyk: [],
-            };
-            acc.push(t);
-        }
-        t[snyk ? (old ? "oldSnyk" : "recentSnyk") : old ? "old" : "recent"].push(cur);
-        return acc;
-    }, [])
-        .sort((a, b) => a.key.localeCompare(b.key));
-    if (categories.length === 0) {
-        reporter.log("No pull requests found");
-    }
-    else {
-        reporter.log("Pull requests stats:");
-        reporter.log("A pull request is considered old after 60 days");
-        reporter.log("");
-        reporter.log(sprintf("%-40s %12s %2s %12s %2s", "", "normal", "", "snyk", ""));
-        reporter.log(sprintf("%-40s %7s %7s %7s %7s", "Repo", "old", "recent", "old", "recent"));
-        categories.forEach((cat) => {
-            reporter.log(sprintf("%-40s %7s %7s %7s %7s", cat.key, cat.old.length === 0 ? "" : cat.old.length, cat.recent.length === 0 ? "" : cat.recent.length, cat.oldSnyk.length === 0 ? "" : cat.oldSnyk.length, cat.recentSnyk.length === 0 ? "" : cat.recentSnyk.length));
-        });
-    }
-}
-const command$9 = {
-    command: "list-pull-requests-stats",
-    describe: "List stats for pull requests with special filter",
+const command$3 = {
+    command: "groups",
+    describe: "List available repository groups in a GitHub organization",
+    builder: (yargs) => yargs.options("org", {
+        alias: "o",
+        default: "capralifecycle",
+        requiresArg: true,
+        describe: "GitHub organization",
+        type: "string",
+    }),
     handler: async (argv) => {
         const config = createConfig();
-        await listPullRequestsStats({
-            reporter: createReporter(argv),
-            github: await createGitHubService({
-                config,
-                cache: createCacheProvider(config, argv),
-            }),
+        const reporter = createReporter();
+        const github = await createGitHubService({
+            cache: createCacheProvider(config, argv),
         });
+        const repos = await github.getOrgRepoList({ org: argv.org });
+        const groups = getGroupedRepos(repos);
+        for (const group of groups) {
+            reporter.log(group.name);
+        }
     },
 };
 
@@ -2383,181 +641,268 @@ async function listRepos({ reporter, github, includeArchived, name = undefined,
         if (!csv && compact) {
             reporter.log(`${group.name}`);
         }
-        else if (!csv) {
-            reporter.log("");
-            reporter.log(`======== ${group.name} ========`);
+        else if (!csv) {
+            reporter.log("");
+            reporter.log(`======== ${group.name} ========`);
+        }
+        group.items.forEach((repo) => {
+            if (csv) {
+                // We assume we have no repos or group names with a comma in its name.
+                process__default.stdout.write(`${repo.name},${group.name}\n`);
+                return;
+            }
+            if (compact) {
+                reporter.log(`- ${repo.name}`);
+                return;
+            }
+            reporter.log(`${repo.name}`);
+            reporter.log(`- Created: ${repo.createdAt}`);
+            reporter.log(`- Updated: ${repo.updatedAt}`);
+            if (repo.repositoryTopics.edges.length === 0) {
+                reporter.log("- Topics: (none)");
+            }
+            else {
+                reporter.log("- Topics:");
+                repo.repositoryTopics.edges.forEach((edge) => {
+                    reporter.log(`  - ${edge.node.topic.name}`);
+                });
+            }
+        });
+    });
+    if (csv) {
+        return;
+    }
+    reporter.log("");
+    reporter.log(`Total number of repos: ${repos.length}`);
+    const missingGroup = getReposMissingGroup(repos);
+    if (missingGroup.length > 0) {
+        reporter.log("");
+        reporter.log("Repos missing group/customer topic:");
+        missingGroup.forEach((repo) => {
+            reporter.log(`- ${repo.name}`);
+        });
+        reporter.log("Useful search query: https://github.com/capralifecycle?q=topics%3A0");
+    }
+    const days = 180;
+    const oldRepos = getOldRepos(repos, days);
+    if (oldRepos.length > 0) {
+        reporter.log("");
+        reporter.log(`Repositories not updated for ${days} days:`);
+        oldRepos.forEach((repo) => {
+            reporter.log(`- ${repo.name} - ${repo.updatedAt}`);
+        });
+    }
+}
+const command$2 = {
+    command: "repos",
+    describe: "List repositories in a GitHub organization",
+    builder: (yargs) => yargs
+        .options("org", {
+        alias: "o",
+        default: "capralifecycle",
+        requiresArg: true,
+        describe: "GitHub organization",
+        type: "string",
+    })
+        .option("include-archived", {
+        alias: "a",
+        describe: "Include archived repos",
+        type: "boolean",
+    })
+        .options("compact", {
+        alias: "c",
+        describe: "Compact output list",
+        type: "boolean",
+    })
+        .options("csv", {
+        describe: "Output as a CSV list that can be used for automation",
+        type: "boolean",
+    })
+        .option("name", {
+        describe: "Filter to include the specified name",
+        type: "string",
+        requiresArg: true,
+    })
+        .option("topic", {
+        alias: "t",
+        describe: "Filter by specific topic",
+        type: "string",
+        requiresArg: true,
+    }),
+    handler: async (argv) => {
+        const config = createConfig();
+        await listRepos({
+            reporter: createReporter(),
+            github: await createGitHubService({
+                cache: createCacheProvider(config, argv),
+            }),
+            includeArchived: !!argv["include-archived"],
+            name: argv.name,
+            topic: argv.topic,
+            compact: !!argv.compact,
+            csv: !!argv.csv,
+            org: argv.org,
+        });
+    },
+};
+
+var type = "object";
+var properties = {
+	projects: {
+		type: "array",
+		items: {
+			$ref: "#/definitions/Project"
+		}
+	}
+};
+var required = [
+	"projects"
+];
+var definitions = {
+	Project: {
+		type: "object",
+		properties: {
+			name: {
+				type: "string"
+			},
+			github: {
+				type: "array",
+				items: {
+					type: "object",
+					properties: {
+						organization: {
+							type: "string"
+						},
+						repos: {
+							type: "array",
+							items: {
+								$ref: "#/definitions/DefinitionRepo"
+							}
+						}
+					},
+					required: [
+						"organization"
+					]
+				}
+			},
+			tags: {
+				type: "array",
+				items: {
+					type: "string"
+				}
+			}
+		},
+		required: [
+			"github",
+			"name"
+		]
+	},
+	DefinitionRepo: {
+		type: "object",
+		properties: {
+			name: {
+				type: "string"
+			},
+			previousNames: {
+				type: "array",
+				items: {
+					$ref: "#/definitions/DefinitionRepoPreviousName"
+				}
+			},
+			archived: {
+				type: "boolean"
+			}
+		},
+		required: [
+			"name"
+		]
+	},
+	DefinitionRepoPreviousName: {
+		type: "object",
+		properties: {
+			name: {
+				type: "string"
+			},
+			project: {
+				type: "string"
+			}
+		},
+		required: [
+			"name",
+			"project"
+		]
+	}
+};
+var $schema = "http://json-schema.org/draft-07/schema#";
+var schema = {
+	type: type,
+	properties: properties,
+	required: required,
+	definitions: definitions,
+	$schema: $schema
+};
+
+function getRepoId(orgName, repoName) {
+    return `${orgName}/${repoName}`;
+}
+function checkAgainstSchema(value) {
+    const ajv = new AJV({ allErrors: true });
+    const valid = ajv.validate(schema, value);
+    return valid
+        ? { definition: value }
+        : { error: ajv.errorsText() ?? "Unknown error" };
+}
+function requireValidDefinition(definition) {
+    // Verify no duplicates in project names.
+    definition.projects.reduce((acc, project) => {
+        if (acc.includes(project.name)) {
+            throw new Error(`Duplicate project: ${project.name}`);
+        }
+        return [...acc, project.name];
+    }, []);
+    // Verify no duplicates in repos.
+    definition.projects
+        .flatMap((project) => project.github.flatMap((org) => (org.repos || []).map((repo) => getRepoId(org.organization, repo.name))))
+        .reduce((acc, repoName) => {
+        if (acc.includes(repoName)) {
+            throw new Error(`Duplicate repo: ${repoName}`);
         }
-        group.items.forEach((repo) => {
-            if (csv) {
-                // We assume we have no repos or group names with a comma in its name.
-                process__default.stdout.write(`${repo.name},${group.name}\n`);
-                return;
-            }
-            if (compact) {
-                reporter.log(`- ${repo.name}`);
-                return;
-            }
-            reporter.log(`${repo.name}`);
-            reporter.log(`- Created: ${repo.createdAt}`);
-            reporter.log(`- Updated: ${repo.updatedAt}`);
-            if (repo.repositoryTopics.edges.length === 0) {
-                reporter.log("- Topics: (none)");
-            }
-            else {
-                reporter.log("- Topics:");
-                repo.repositoryTopics.edges.forEach((edge) => {
-                    reporter.log(`  - ${edge.node.topic.name}`);
-                });
-            }
-        });
-    });
-    if (csv) {
-        return;
+        return [...acc, repoName];
+    }, []);
+}
+class DefinitionFile {
+    path;
+    constructor(path) {
+        this.path = path;
     }
-    reporter.log("");
-    reporter.log(`Total number of repos: ${repos.length}`);
-    const missingGroup = getReposMissingGroup(repos);
-    if (missingGroup.length > 0) {
-        reporter.log("");
-        reporter.log("Repos missing group/customer topic:");
-        missingGroup.forEach((repo) => {
-            reporter.log(`- ${repo.name}`);
-        });
-        reporter.log("Useful search query: https://github.com/capralifecycle?q=topics%3A0");
+    async getContents() {
+        return new Promise((resolve, reject) => fs.readFile(this.path, "utf-8", (err, data) => {
+            if (err)
+                reject(err);
+            else
+                resolve(data);
+        }));
     }
-    const days = 180;
-    const oldRepos = getOldRepos(repos, days);
-    if (oldRepos.length > 0) {
-        reporter.log("");
-        reporter.log(`Repositories not updated for ${days} days:`);
-        oldRepos.forEach((repo) => {
-            reporter.log(`- ${repo.name} - ${repo.updatedAt}`);
-        });
+    async getDefinition() {
+        return parseDefinition(await this.getContents());
     }
 }
-const command$8 = {
-    command: "list-repos",
-    describe: "List Git repos for a GitHub organization",
-    builder: (yargs) => yargs
-        .options("org", {
-        required: true,
-        describe: "Specify GitHub organization",
-        type: "string",
-    })
-        .option("include-archived", {
-        alias: "a",
-        describe: "Include archived repos",
-        type: "boolean",
-    })
-        .options("compact", {
-        alias: "c",
-        describe: "Compact output list",
-        type: "boolean",
-    })
-        .options("csv", {
-        describe: "Output as a CSV list that can be used for automation",
-        type: "boolean",
-    })
-        .option("name", {
-        describe: "Filter to include the specified name",
-        type: "string",
-    })
-        .option("topic", {
-        alias: "t",
-        describe: "Filter by specific topic",
-        type: "string",
-    }),
-    handler: async (argv) => {
-        const config = createConfig();
-        await listRepos({
-            reporter: createReporter(argv),
-            github: await createGitHubService({
-                config,
-                cache: createCacheProvider(config, argv),
-            }),
-            includeArchived: !!argv["include-archived"],
-            name: argv.name,
-            topic: argv.topic,
-            compact: !!argv.compact,
-            csv: !!argv.csv,
-            org: argv.org,
-        });
-    },
-};
-
-const e = encodeURIComponent;
-async function listWebhooks(reporter, _cache, github, org) {
-    const repos = (await github.getOrgRepoList({ org })).filter((it) => !it.isArchived);
-    for (const repo of repos) {
-        reporter.log("");
-        reporter.log(`${repo.name}: https://github.com/capralifecycle/${e(repo.name)}/settings/hooks`);
-        const hooks = await github.getRepositoryHooks(repo.owner.login, repo.name);
-        for (const hook of hooks) {
-            if (hook.config.url === undefined ||
-                !hook.config.url.includes("jenkins")) {
-                continue;
-            }
-            switch (hook.name) {
-                case "web":
-                    reporter.log(sprintf("    web: %s (%s) (%s)", hook.config.url, hook.last_response.code, hook.events.join(", ")));
-                    break;
-                case "jenkinsgit":
-                    reporter.log(sprintf("    jenkinsgit: %s (%s) (%s)", 
-                    // This is undocumented.
-                    hook.config.jenkins_url, hook.last_response.code, hook.events.join(", ")));
-                    break;
-                case "docker":
-                    reporter.log(sprintf("    docker (%s) (%s)", hook.last_response.code, hook.events.join(", ")));
-                    break;
-                default:
-                    reporter.log(`  ${hook.name}: <unknown type>`);
-                    reporter.log(JSON.stringify(hook));
-            }
-        }
+function parseDefinition(value) {
+    const result = checkAgainstSchema(yaml.load(value));
+    if ("error" in result) {
+        throw new Error(`Definition content invalid: ${result.error}`);
     }
+    requireValidDefinition(result.definition);
+    return result.definition;
 }
-const command$7 = {
-    command: "list-webhooks",
-    describe: "List webhooks for repositories in for a GitHub organization",
-    builder: (yargs) => yargs.options("org", {
-        required: true,
-        describe: "Specify GitHub organization",
-        type: "string",
-    }),
-    handler: async (argv) => {
-        const config = createConfig();
-        const cacheProvider = createCacheProvider(config, argv);
-        await listWebhooks(createReporter(argv), cacheProvider, await createGitHubService({ config, cache: cacheProvider }), argv.org);
-    },
-};
-
-async function setToken$1({ reporter, token, tokenProvider, }) {
-    if (token === undefined) {
-        reporter.info("Need API token to talk to GitHub");
-        reporter.info("https://github.com/settings/tokens/new?scopes=repo:status,read:repo_hook");
-        const inputToken = await read({
-            prompt: "Enter new GitHub API token: ",
-            silent: true,
-        });
-        token = inputToken;
-    }
-    await tokenProvider.setToken(token);
-    reporter.info("Token saved");
+function getRepos(definition) {
+    return definition.projects.flatMap((project) => project.github.flatMap((org) => (org.repos || []).map((repo) => ({
+        id: getRepoId(org.organization, repo.name),
+        orgName: org.organization,
+        project,
+        repo,
+    }))));
 }
-const command$6 = {
-    command: "set-token",
-    describe: "Set GitHub token for API calls",
-    builder: (yargs) => yargs.positional("token", {
-        describe: "Token. If not provided it will be requested as input. Can be generated at https://github.com/settings/tokens/new?scopes=repo:status,read:repo_hook",
-    }),
-    handler: async (argv) => {
-        await setToken$1({
-            reporter: createReporter(argv),
-            token: argv.token,
-            tokenProvider: new GitHubTokenCliProvider(),
-        });
-    },
-};
 
 function wasUpdated(output) {
     return output.startsWith("Updating ");
@@ -2887,7 +1232,7 @@ async function getExpectedRepos(reporter, github, cals, rootdir) {
     };
 }
 async function getInput(prompt) {
-    return read({
+    return readInput({
         prompt,
         timeout: 60000,
     });
@@ -2912,7 +1257,7 @@ async function askMoveConfirm() {
             return false;
     }
 }
-async function sync$1({ reporter, github, cals, rootdir, askClone, askMove, }) {
+async function sync({ reporter, github, cals, rootdir, clone, move, }) {
     const { expectedRepos, definitionRepo } = await getExpectedRepos(reporter, github, cals, rootdir);
     const unknownDirs = [];
     const foundRepos = [];
@@ -2972,8 +1317,8 @@ async function sync$1({ reporter, github, cals, rootdir, askClone, askMove, }) {
         for (const it of movedRepos) {
             reporter.info(`  ${it.actualRelpath} -> ${getRelpath(it)}`);
         }
-        if (!askMove) {
-            reporter.info("To move these repos on disk add --ask-move option");
+        if (!move) {
+            reporter.info("To move these repos on disk add --move option");
         }
         else {
             const shouldMove = await askMoveConfirm();
@@ -3005,8 +1350,8 @@ async function sync$1({ reporter, github, cals, rootdir, askClone, askMove, }) {
         for (const it of missingRepos) {
             reporter.info(`  ${it.id}`);
         }
-        if (!askClone) {
-            reporter.info("To clone these repos add --ask-clone option for dialog");
+        if (!clone) {
+            reporter.info("To clone these repos add --clone option");
         }
         else {
             reporter.info("You must already have working credentials for GitHub set up for clone to work");
@@ -3050,20 +1395,21 @@ async function loadCalsManifest(config, reporter) {
         cals,
     };
 }
-const command$5 = {
+const command$1 = {
     command: "sync",
     describe: "Sync repositories for working directory",
     builder: (yargs) => yargs
-        .option("ask-clone", {
+        .option("clone", {
         alias: "c",
-        describe: "Ask to clone new missing repos",
+        describe: "Prompt to clone missing repos",
         type: "boolean",
     })
-        .option("ask-move", {
-        describe: "Ask to actual move renamed repos",
+        .option("move", {
+        alias: "m",
+        describe: "Prompt to move renamed repos",
         type: "boolean",
     })
-        .usage(`cals github sync
+        .usage(`cals sync
 
 Synchronize all checked out GitHub repositories within the working directory
 grouped by the project in the resource definition file. The command can also
@@ -3100,238 +1446,109 @@ will be stored there.`),
     handler: async (argv) => {
         const config = createConfig();
         const github = await createGitHubService({
-            config,
             cache: createCacheProvider(config, argv),
         });
-        const reporter = createReporter(argv);
+        const reporter = createReporter();
         const manifest = await loadCalsManifest(config, reporter);
         if (manifest === null)
             return;
         const { dir, cals } = manifest;
-        return sync$1({
+        return sync({
             reporter,
             github,
             cals,
             rootdir: dir,
-            askClone: !!argv["ask-clone"],
-            askMove: !!argv["ask-move"],
+            clone: !!argv.clone,
+            move: !!argv.move,
         });
     },
 };
 
-const command$4 = {
-    command: "github",
-    describe: "Integration with GitHub",
-    builder: (yargs) => yargs
-        .command(command$c)
-        .command(command$b)
-        .command(command$a)
-        .command(command$9)
-        .command(command$8)
-        .command(command$7)
-        .command(command$6)
-        .command(command$5)
-        .demandCommand()
-        .usage(`cals github
-
-Notes:
-  Before doing anything against GitHub you need to configure a token
-  used for authentication. The following command will ask for a token
-  and provide a link to generate one:
-  $ cals github set-token
-
-  Quick clone all repos:
-  $ cals github generate-clone-commands --org capralifecycle --all -x | bash
-
-  And for a specific project:
-  $ cals github generate-clone-commands --org capralifecycle -x buildtools | bash
-
-  Keeping up to date with removed/renamed repos:
-  $ cals github analyze-directory --org capralifecycle
-
-  Some responses are cached for some time. Use the --validate-cache
-  option to avoid stale cache. The cache can also be cleared with
-  the "cals delete-cache" command.`),
-    handler: () => {
-        yargs(hideBin(process__default.argv)).showHelp();
-    },
-};
-
-function totalSeverityCount(project) {
-    return ((project.issueCountsBySeverity.critical ?? 0) +
-        project.issueCountsBySeverity.high +
-        project.issueCountsBySeverity.medium +
-        project.issueCountsBySeverity.low);
-}
-function buildStatsLine(stats) {
-    function item(num, str) {
-        return num === 0 ? " ".repeat(str.length + 4) : sprintf("%3d %s", num, str);
-    }
-    return sprintf("%s  %s  %s  %s", item(stats.critical ?? 0, "critical"), item(stats.high, "high"), item(stats.medium, "medium"), item(stats.low, "low"));
-}
-async function report({ reporter, snyk, definitionFile, }) {
-    const definition = await definitionFile.getDefinition();
-    const reposWithIssues = (await snyk.getProjects(definition)).filter((it) => totalSeverityCount(it) > 0);
-    const definitionRepos = getRepos(definition);
-    function getProject(p) {
-        const id = getGitHubRepoId(getGitHubRepo(p));
-        const def = id === undefined ? undefined : definitionRepos.find((it) => it.id === id);
-        return def === undefined ? undefined : def.project;
-    }
-    const enhancedRepos = reposWithIssues.map((repo) => ({
-        repo,
-        project: getProject(repo),
-    }));
-    function getProjectName(project) {
-        return project ? project.name : "unknown project";
-    }
-    const byProjects = sortBy(Object.values(groupBy(enhancedRepos, (it) => it.project ? it.project.name : "unknown")), (it) => getProjectName(it[0].project));
-    if (byProjects.length === 0) {
-        reporter.info("No issues found");
-    }
-    else {
-        reporter.info(sprintf("%-70s %s", "Total count", buildStatsLine({
-            critical: sumBy(reposWithIssues, (it) => it.issueCountsBySeverity.critical ?? 0),
-            high: sumBy(reposWithIssues, (it) => it.issueCountsBySeverity.high),
-            medium: sumBy(reposWithIssues, (it) => it.issueCountsBySeverity.medium),
-            low: sumBy(reposWithIssues, (it) => it.issueCountsBySeverity.low),
-        })));
-        reporter.info("Issues by project:");
-        byProjects.forEach((repos) => {
-            const project = repos[0].project;
-            const totalCount = {
-                critical: sumBy(repos, (it) => it.repo.issueCountsBySeverity.critical ?? 0),
-                high: sumBy(repos, (it) => it.repo.issueCountsBySeverity.high),
-                medium: sumBy(repos, (it) => it.repo.issueCountsBySeverity.medium),
-                low: sumBy(repos, (it) => it.repo.issueCountsBySeverity.low),
-            };
-            reporter.info("");
-            reporter.info(sprintf("%-70s %s", getProjectName(project), buildStatsLine(totalCount)));
-            for (const { repo } of repos) {
-                reporter.info(sprintf("  %-68s %s", repo.name, buildStatsLine(repo.issueCountsBySeverity)));
-            }
-        });
-    }
-}
-const command$3 = {
-    command: "report",
-    describe: "Report Snyk projects status",
-    builder: (yargs) => yargs.option(definitionFileOptionName, definitionFileOptionValue),
-    handler: async (argv) => report({
-        reporter: createReporter(argv),
-        snyk: createSnykService({ config: createConfig() }),
-        definitionFile: getDefinitionFile(argv),
+const command = {
+    command: "topics",
+    describe: "List customer topics in a GitHub organization",
+    builder: (yargs) => yargs.options("org", {
+        alias: "o",
+        default: "capralifecycle",
+        requiresArg: true,
+        describe: "GitHub organization",
+        type: "string",
     }),
-};
-
-async function setToken({ reporter, token, tokenProvider, }) {
-    if (token === undefined) {
-        reporter.info("Need API token to talk to Snyk");
-        reporter.info("See https://app.snyk.io/account");
-        // noinspection UnnecessaryLocalVariableJS
-        const inputToken = await read({
-            prompt: "Enter new Snyk API token: ",
-            silent: true,
+    handler: async (argv) => {
+        const config = createConfig();
+        const reporter = createReporter();
+        const github = await createGitHubService({
+            cache: createCacheProvider(config, argv),
         });
-        token = inputToken;
-    }
-    await tokenProvider.setToken(token);
-    reporter.info("Token saved");
-}
-const command$2 = {
-    command: "set-token",
-    describe: "Set Snyk token for API calls",
-    builder: (yargs) => yargs.positional("token", {
-        describe: "Token. If not provided it will be requested as input",
-    }),
-    handler: async (argv) => setToken({
-        reporter: createReporter(argv),
-        token: argv.token,
-        tokenProvider: new SnykTokenCliProvider(),
-    }),
+        const repos = await github.getOrgRepoList({ org: argv.org });
+        const topics = new Set();
+        for (const repo of repos) {
+            for (const edge of repo.repositoryTopics.edges) {
+                const name = edge.node.topic.name;
+                if (name.startsWith("customer-")) {
+                    topics.add(name);
+                }
+            }
+        }
+        const sorted = [...topics].sort((a, b) => a.localeCompare(b));
+        for (const topic of sorted) {
+            reporter.log(topic);
+        }
+    },
 };
 
-async function sync({ reporter, snyk, definitionFile, }) {
-    const definition = await definitionFile.getDefinition();
-    const knownRepos = (await snyk.getProjects(definition))
-        .map((it) => getGitHubRepo(it))
-        .filter((it) => it !== undefined);
-    const allReposWithSnyk = getRepos(definition).filter((it) => it.repo.snyk === true);
-    const allReposWithSnykStr = allReposWithSnyk.map((it) => getRepoId(it.orgName, it.repo.name));
-    const missingInSnyk = allReposWithSnyk.filter((it) => !knownRepos.some((r) => r.owner === it.orgName && r.name === it.repo.name));
-    const extraInSnyk = knownRepos.filter((it) => !allReposWithSnykStr.includes(`${it.owner}/${it.name}`));
-    if (missingInSnyk.length === 0) {
-        reporter.info("All seems fine");
-    }
-    else {
-        missingInSnyk.forEach((it) => {
-            reporter.info(`Not in Snyk: ${it.project.name} / ${it.repo.name}`);
-        });
-        extraInSnyk.forEach((it) => {
-            reporter.info(`Should not be in Snyk? ${it.owner}/${it.name}`);
-        });
+function parseVersion(v) {
+    return v
+        .replace(/^[^\d]*/, "")
+        .split(".")
+        .map(Number);
+}
+function satisfiesMinVersion(current, required) {
+    const cur = parseVersion(current);
+    const req = parseVersion(required.replace(/^>=?\s*/, ""));
+    for (let i = 0; i < 3; i++) {
+        if ((cur[i] ?? 0) > (req[i] ?? 0))
+            return true;
+        if ((cur[i] ?? 0) < (req[i] ?? 0))
+            return false;
     }
+    return true;
 }
-const command$1 = {
-    command: "sync",
-    describe: "Sync Snyk projects (currently only reports, no automation)",
-    builder: (yargs) => yargs.option(definitionFileOptionName, definitionFileOptionValue),
-    handler: async (argv) => sync({
-        reporter: createReporter(argv),
-        snyk: createSnykService({ config: createConfig() }),
-        definitionFile: getDefinitionFile(argv),
-    }),
-};
-
-const command = {
-    command: "snyk",
-    describe: "Integration with Snyk",
-    builder: (yargs) => yargs
-        .command(command$2)
-        .command(command$3)
-        .command(command$1)
-        .demandCommand()
-        .usage(`cals snyk
-
-Notes:
-  Before doing anything against Snyk you need to configure a token
-  used for authentication. The following command will ask for a token
-  and provide a link to generate one:
-  $ cals snyk set-token`),
-    handler: () => {
-        yargs(hideBin(process__default.argv)).showHelp();
-    },
-};
-
 async function main() {
-    if (!semver.satisfies(process__default.version, engines.node)) {
+    if (!satisfiesMinVersion(process__default.version, engines.node)) {
         console.error(`Required node version ${engines.node} not satisfied with current version ${process__default.version}.`);
         process__default.exit(1);
     }
     await yargs(hideBin(process__default.argv))
-        .usage(`cals-cli v${version} (build: ${"2026-01-22T15:26:47+0000"})`)
+        .usage(`cals v${version} (build: ${"2026-01-30T15:20:39.822Z"})
+
+A CLI for managing GitHub repositories.
+
+Before using, authenticate with: cals auth`)
         .scriptName("cals")
         .locale("en")
+        .strict()
+        .strictCommands()
+        .strictOptions()
         .help("help")
-        .command(command$e)
-        .command(command$f)
+        .command(command$5)
         .command(command$4)
-        .command(command$d)
+        .command(command$3)
+        .command(command$2)
+        .command(command$1)
         .command(command)
         .version(version)
         .demandCommand()
-        .option("non-interactive", {
-        describe: "Non-interactive mode",
-        type: "boolean",
-    })
-        .option("verbose", {
-        describe: "Verbose output",
-        type: "boolean",
-    })
-        .option("validate-cache", {
-        describe: "Only read from cache if validated against server",
+        .option("no-cache", {
+        describe: "Bypass cache and fetch fresh data",
         type: "boolean",
     })
+        .example("cals auth", "Set GitHub token")
+        .example("cals repos", "List repositories")
+        .example("cals groups", "List repository groups")
+        .example("cals topics", "List customer topics")
+        .example("cals clone --all | bash", "Clone all repos")
+        .example("cals sync", "Pull latest changes")
         .parse();
 }