@pagopa/dx-cli 0.22.4 → 0.23.0

package/dist/adapters/commander/commands/savemoney.js

@@ -1,5 +1,7 @@
 import { azure, loadConfig } from "@pagopa/dx-savemoney";
-import { Command } from "commander";
+import { Command, InvalidArgumentError } from "commander";
+import { oraPromise } from "ora";
+import { z } from "zod";
 import { exitWithError } from "../index.js";
 export const makeSavemoneyCommand = () => new Command("savemoney")
     .description("Analyze Azure subscriptions and report unused or inefficient resources")
@@ -7,7 +9,8 @@ export const makeSavemoneyCommand = () => new Command("savemoney")
     .option("-f, --format <format>", "Report format: json, table, detailed-json, or lint (default: table)", "table")
     .option("-l, --location <string>", "Preferred Azure location for resources (overrides config file)", "italynorth")
     .option("-d, --days <number>", "Number of days for metrics analysis (overrides config file)", "30")
-    .option("-t, --tags <tags...>", "Filter resources by tags (key=value key2=value2). Only resources matching ALL specified tags are analyzed.")
+    .option("-t, --tags <tags...>", "Filter findings by resource tags (key=value key2=value2). Advisor subscription-level findings remain global.")
+    .option("-s, --source <source>", "Restrict findings to a single source: 'advisor', 'custom', or 'all' (default: all)", parseSourceOption, "all")
     .action(async function (options) {
     const { verbose } = this.optsWithGlobals();
     try {
@@ -19,11 +22,21 @@ export const makeSavemoneyCommand = () => new Command("savemoney")
             ...config,
             filterTags,
             preferredLocation: options.location || config.preferredLocation,
+            sources: options.source === "all"
+                ? (config.sources ?? ["advisor", "custom"])
+                : [options.source],
             timespanDays: Number.parseInt(options.days, 10) || config.timespanDays,
             verbose: verbose ?? false,
         };
-        // Run analysis
-        await azure.analyzeAzureResources(finalConfig, options.format);
+        // Run analysis showing a progress spinner on stderr so the CLI doesn't
+        // look frozen during the (potentially several-minute) Azure round-trips.
+        const reports = await oraPromise(azure.analyzeAzureResources(finalConfig), {
+            failText: "Analysis failed",
+            stream: process.stderr,
+            successText: "Analysis complete",
+            text: "Analyzing Azure resources",
+        });
+        await azure.generateReport(reports, options.format);
     }
     catch (error) {
         exitWithError(this)(error instanceof Error
@@ -31,12 +44,24 @@ export const makeSavemoneyCommand = () => new Command("savemoney")
             : new Error(`Analysis failed: ${String(error)}`));
     }
 });
+const SourceSchema = z.enum(["advisor", "all", "custom"]);
+/**
+ * Parses the `--source` option via a zod enum, accepting `all`, `advisor`,
+ * or `custom` and rejecting any other value with a Commander-friendly error.
+ */
+export function parseSourceOption(value) {
+    const result = SourceSchema.safeParse(value);
+    if (!result.success) {
+        throw new InvalidArgumentError(`Allowed values are: ${SourceSchema.options.join(", ")}`);
+    }
+    return result.data;
+}
 /**
  * Parses an array of "key=value" strings (from commander variadic option) into a Map<string, string>.
  * Returns an empty Map when the option is not provided or empty.
  * Supports values that contain "=" (only the first "=" is treated as separator).
  */
-function parseTagsOption(tagsOption) {
+export function parseTagsOption(tagsOption) {
     const result = new Map();
     if (!tagsOption || tagsOption.length === 0) {
         return result;

package/dist/adapters/commander/commands/spec.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Spec Command
+ *
+ * Implements the `dx spec` subcommand. Calls the injected `getSpec` factory
+ * and writes the result as pretty-printed JSON to stdout.  The command has no
+ * dependencies and requires no authentication.
+ */
+import { Command } from "commander";
+import type { CliSpec } from "../../../domain/spec.js";
+export declare const makeSpecCommand: (getSpec: () => CliSpec) => Command;

package/dist/adapters/commander/commands/spec.js

@@ -0,0 +1,13 @@
+/**
+ * Spec Command
+ *
+ * Implements the `dx spec` subcommand. Calls the injected `getSpec` factory
+ * and writes the result as pretty-printed JSON to stdout.  The command has no
+ * dependencies and requires no authentication.
+ */
+import { Command } from "commander";
+export const makeSpecCommand = (getSpec) => new Command("spec")
+    .description("Print the full CLI spec as JSON (commands, subcommands, flags, arguments). Useful for agents that need to understand the CLI without running --help on every command.")
+    .action(() => {
+    process.stdout.write(JSON.stringify(getSpec(), null, 2) + "\n");
+});

package/dist/adapters/commander/index.js

@@ -5,7 +5,9 @@ import { makeDoctorCommand } from "./commands/doctor.js";
 import { makeInfoCommand } from "./commands/info.js";
 import { makeInitCommand } from "./commands/init.js";
 import { makeSavemoneyCommand } from "./commands/savemoney.js";
+import { makeSpecCommand } from "./commands/spec.js";
 import { formatErrorDetailed, toErrorMessage } from "./error-reporting.js";
+import { extractCliSpec } from "./spec.js";
 /**
  * Returns true when the global `--verbose` flag is active on the closest
  * ancestor command that defines it (the root `dx` program in our CLI).
@@ -23,10 +25,12 @@ export const makeCli = (deps, config, cliDeps, version) => {
         .default("text"));
     program.addCommand(makeDoctorCommand(deps, config));
     program.addCommand(makeCodemodCommand(cliDeps));
-    program.addCommand(makeInitCommand(deps));
+    program.addCommand(makeInitCommand(deps.requireGitHubAuth));
     program.addCommand(makeSavemoneyCommand());
     program.addCommand(makeInfoCommand(deps));
-    program.addCommand(makeAddCommand(deps));
+    program.addCommand(makeAddCommand(deps.requireGitHubAuth));
+    // spec is registered last so the closure captures the complete command tree.
+    program.addCommand(makeSpecCommand(() => extractCliSpec(program, version)));
     return program;
 };
 /**

package/dist/adapters/commander/spec.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Commander Spec Adapter
+ *
+ * Maps a Commander `Command` tree to the technology-agnostic `CliSpec` domain
+ * type defined in `domain/spec.ts`.  This is the only place in the codebase
+ * that depends on Commander's introspection API.
+ */
+import { Command } from "commander";
+import type { CliSpec } from "../../domain/spec.js";
+/**
+ * Extracts the full CLI spec from a fully-constructed Commander `Command` tree.
+ *
+ * Should be called after all subcommands have been registered on `rootCommand`
+ * so the spec reflects the complete command surface.
+ */
+export declare const extractCliSpec: (rootCommand: Command, version: string) => CliSpec;

package/dist/adapters/commander/spec.js

@@ -0,0 +1,54 @@
+/**
+ * Commander Spec Adapter
+ *
+ * Maps a Commander `Command` tree to the technology-agnostic `CliSpec` domain
+ * type defined in `domain/spec.ts`.  This is the only place in the codebase
+ * that depends on Commander's introspection API.
+ */
+const INTERNAL_FLAGS = new Set(["--help", "--version"]);
+const INTERNAL_ROOT_COMMANDS = new Set(["spec"]);
+const mapOption = (opt) => ({
+    choices: opt.argChoices ?? [],
+    defaultValue: opt.defaultValue,
+    description: opt.description,
+    flags: opt.flags,
+    long: opt.long ?? undefined,
+    optional: opt.optional,
+    required: opt.required,
+    short: opt.short ?? undefined,
+});
+const mapArgument = (arg) => ({
+    choices: arg.argChoices ?? [],
+    defaultValue: arg.defaultValue,
+    description: arg.description,
+    name: arg.name(),
+    required: arg.required,
+    variadic: arg.variadic,
+});
+const mapCommand = (cmd) => ({
+    arguments: cmd.registeredArguments.map(mapArgument),
+    commands: cmd.commands.map(mapCommand),
+    description: cmd.description(),
+    name: cmd.name(),
+    options: cmd.options
+        .filter((opt) => !INTERNAL_FLAGS.has(opt.long ?? ""))
+        .map(mapOption),
+});
+/**
+ * Extracts the full CLI spec from a fully-constructed Commander `Command` tree.
+ *
+ * Should be called after all subcommands have been registered on `rootCommand`
+ * so the spec reflects the complete command surface.
+ */
+export const extractCliSpec = (rootCommand, version) => ({
+    commands: rootCommand.commands
+        .filter((cmd) => !INTERNAL_ROOT_COMMANDS.has(cmd.name()))
+        .map(mapCommand),
+    description: rootCommand.description(),
+    globalOptions: rootCommand.options
+        .filter((opt) => !INTERNAL_FLAGS.has(opt.long ?? ""))
+        .map(mapOption),
+    name: rootCommand.name(),
+    specVersion: "1",
+    version,
+});

package/dist/adapters/plop/generators/__tests__/temp-dir.d.ts

@@ -0,0 +1,2 @@
+export declare const cleanupTempDir: (tmpDir: string) => Promise<void>;
+export declare const readGeneratedFiles: (rootDir: string, filePaths: readonly string[]) => Promise<Record<string, string>>;

package/dist/adapters/plop/generators/__tests__/temp-dir.js

@@ -0,0 +1,13 @@
+/**
+ * Temp directory helpers for Plop generator integration tests.
+ */
+import fs from "node:fs/promises";
+import path from "node:path";
+export const cleanupTempDir = async (tmpDir) => {
+    await fs.rm(tmpDir, { force: true, recursive: true });
+};
+const readGeneratedFile = async (rootDir, filePath) => [
+    filePath,
+    await fs.readFile(path.join(rootDir, filePath), "utf-8"),
+];
+export const readGeneratedFiles = async (rootDir, filePaths) => Object.fromEntries(await Promise.all(filePaths.map((filePath) => readGeneratedFile(rootDir, filePath))));

package/dist/adapters/plop/generators/environment/__tests__/generation.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/adapters/plop/generators/environment/__tests__/generation.test.js

@@ -0,0 +1,213 @@
+import nodePlop from "node-plop";
+/**
+ * Contract tests for the environment generator.
+ *
+ * They generate real files in a temp directory while asserting only
+ * generator-specific behavior: which domain actions run for a given
+ * generator state and which high-value values are materialized into
+ * the generated infrastructure files.
+ */
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { afterAll, beforeAll, describe, expect, it, vi } from "vitest";
+import setGetTerraformBackend from "../../../actions/get-terraform-backend.js";
+import setInitCloudAccountsAction from "../../../actions/init-cloud-accounts.js";
+import setProvisionTerraformBackendAction from "../../../actions/provision-terraform-backend.js";
+import setEnvShortHelper from "../../../helpers/env-short.js";
+import setEqHelper from "../../../helpers/eq.js";
+import setResourcePrefixHelper from "../../../helpers/resource-prefix.js";
+import setTerraformStateKeyHelper from "../../../helpers/terraform-state-key.js";
+import { resolveTemplatesPath } from "../../../templates-path.js";
+import { cleanupTempDir, readGeneratedFiles, } from "../../__tests__/temp-dir.js";
+import getActions from "../actions.js";
+import { PLOP_ENVIRONMENT_GENERATOR_NAME } from "../index.js";
+vi.mock("../../../../terraform/fmt.js", () => ({
+    formatTerraformCode: vi.fn((content) => content),
+}));
+/**
+ * Register helpers and stub action types for the environment generator.
+ * Cloud-service action types are registered with DI mock objects.
+ */
+const registerEnvironmentSetup = (plop, mockCloudAccountService, mockGitHubService) => {
+    setEnvShortHelper(plop);
+    setResourcePrefixHelper(plop);
+    setEqHelper(plop);
+    setTerraformStateKeyHelper(plop);
+    setGetTerraformBackend(plop, mockCloudAccountService);
+    setProvisionTerraformBackendAction(plop, mockCloudAccountService);
+    setInitCloudAccountsAction(plop, mockCloudAccountService, mockGitHubService);
+};
+const mockTerraformBackend = {
+    resourceGroupName: "dx-d-itn-tf-rg",
+    storageAccountName: "dxditntfst",
+    subscriptionId: "00000000-0000-0000-0000-000000000000",
+    type: "azurerm",
+};
+const createMockCloudAccountService = (backend, isInitialized) => ({
+    getTerraformBackend: vi.fn().mockResolvedValue(backend),
+    hasUserPermissionToInitialize: vi.fn().mockResolvedValue(true),
+    initialize: vi.fn().mockResolvedValue(undefined),
+    isInitialized: vi.fn().mockResolvedValue(isInitialized),
+    provisionTerraformBackend: vi.fn().mockResolvedValue(backend),
+});
+const createMockGitHubService = () => ({
+    createBranch: vi.fn().mockResolvedValue(undefined),
+    createOrUpdateEnvironmentSecret: vi.fn().mockResolvedValue(undefined),
+    createPullRequest: vi.fn().mockResolvedValue(undefined),
+    getFileContent: vi.fn().mockResolvedValue(undefined),
+    getRepository: vi.fn().mockResolvedValue(undefined),
+    updateFile: vi.fn().mockResolvedValue(undefined),
+});
+const runEnvironmentGenerator = async ({ mockCloudAccountService, mockGitHubService, payload, tmpDirPrefix, }) => {
+    const originalCwd = process.cwd();
+    const tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), tmpDirPrefix));
+    process.chdir(tmpDir);
+    const plop = await nodePlop();
+    registerEnvironmentSetup(plop, mockCloudAccountService, mockGitHubService);
+    plop.setGenerator(PLOP_ENVIRONMENT_GENERATOR_NAME, {
+        actions: getActions(resolveTemplatesPath("environment")),
+        description: "Generate a new deployment environment",
+        prompts: [],
+    });
+    const generator = plop.getGenerator(PLOP_ENVIRONMENT_GENERATOR_NAME);
+    const result = await generator.runActions(payload);
+    const realFailures = result.failures.filter((f) => f.error !== "Aborted due to previous action failure");
+    if (realFailures.length > 0) {
+        const summary = realFailures.map((f) => `${f.type}: ${f.error}`).join("\n");
+        throw new Error(`Generator failed:\n${summary}`);
+    }
+    return { originalCwd, tmpDir };
+};
+describe("environment generator — file generation (no init)", () => {
+    let tmpDir;
+    let originalCwd;
+    const payload = {
+        env: {
+            cloudAccounts: [
+                {
+                    csp: "azure",
+                    defaultLocation: "italynorth",
+                    displayName: "DEV-DX",
+                    id: "sub-dev-123",
+                },
+            ],
+            name: "dev",
+            prefix: "dx",
+        },
+        github: {
+            owner: "pagopa",
+            repo: "my-project",
+        },
+        tags: {
+            BusinessUnit: "Platform",
+            CostCenter: "TS000",
+            ManagementTeam: "Engineering",
+        },
+        workspace: {
+            domain: "payments",
+        },
+    };
+    const mockCloudAccountService = createMockCloudAccountService(mockTerraformBackend, true);
+    const mockGitHubService = createMockGitHubService();
+    beforeAll(async () => {
+        ({ originalCwd, tmpDir } = await runEnvironmentGenerator({
+            mockCloudAccountService,
+            mockGitHubService,
+            payload,
+            tmpDirPrefix: "dx-cli-env-test-",
+        }));
+    });
+    afterAll(async () => {
+        process.chdir(originalCwd);
+        await cleanupTempDir(tmpDir);
+    });
+    it("materializes bootstrapper files from payload and backend state", async () => {
+        const generatedFiles = await readGeneratedFiles(tmpDir, [
+            `.github/workflows/_release-terraform-apply-bootstrapper-${payload.env.name}.yaml`,
+            `infra/bootstrapper/${payload.env.name}/main.tf`,
+            `infra/bootstrapper/${payload.env.name}/providers.tf`,
+            `infra/bootstrapper/${payload.env.name}/backend.tf`,
+            `infra/bootstrapper/${payload.env.name}/locals.tf`,
+        ]);
+        expect(generatedFiles).toMatchSnapshot();
+    });
+    it("skips init-only side effects and core files when init is absent", async () => {
+        const corePath = path.join(tmpDir, "infra", "core", payload.env.name);
+        expect(mockCloudAccountService.getTerraformBackend).toHaveBeenCalledWith(payload.env.cloudAccounts[0].id, payload.env);
+        expect(mockCloudAccountService.initialize).not.toHaveBeenCalled();
+        expect(mockCloudAccountService.provisionTerraformBackend).not.toHaveBeenCalled();
+        await expect(fs.stat(corePath)).rejects.toThrow();
+    });
+});
+describe("environment generator — file generation (with init)", () => {
+    let tmpDir;
+    let originalCwd;
+    const cloudAccount = {
+        csp: "azure",
+        defaultLocation: "italynorth",
+        displayName: "DEV-DX",
+        id: "sub-dev-123",
+    };
+    const payload = {
+        env: {
+            cloudAccounts: [cloudAccount],
+            name: "dev",
+            prefix: "dx",
+        },
+        github: {
+            owner: "pagopa",
+            repo: "my-project",
+        },
+        init: {
+            cloudAccountsToInitialize: [cloudAccount],
+            runnerAppCredentials: {
+                clientId: "test-app-client-id",
+                id: "test-app-id",
+                installationId: "test-installation-id",
+                key: "test-private-key",
+            },
+            terraformBackend: {
+                cloudAccount,
+            },
+        },
+        tags: {
+            BusinessUnit: "Platform",
+            CostCenter: "TS000",
+            ManagementTeam: "Engineering",
+        },
+        workspace: {
+            domain: "payments",
+        },
+    };
+    const mockCloudAccountService = createMockCloudAccountService(mockTerraformBackend, false);
+    const mockGitHubService = createMockGitHubService();
+    beforeAll(async () => {
+        ({ originalCwd, tmpDir } = await runEnvironmentGenerator({
+            mockCloudAccountService,
+            mockGitHubService,
+            payload,
+            tmpDirPrefix: "dx-cli-env-init-test-",
+        }));
+    });
+    afterAll(async () => {
+        process.chdir(originalCwd);
+        await cleanupTempDir(tmpDir);
+    });
+    it("runs init-specific actions when init is provided", () => {
+        expect(mockCloudAccountService.initialize).toHaveBeenCalledWith(cloudAccount, payload.env, 
+        // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+        payload.init.runnerAppCredentials, payload.github, mockGitHubService, payload.tags);
+        expect(mockCloudAccountService.provisionTerraformBackend).toHaveBeenCalledWith(cloudAccount, payload.env, payload.tags);
+        expect(mockCloudAccountService.getTerraformBackend).not.toHaveBeenCalled();
+    });
+    it("materializes init-specific infrastructure files", async () => {
+        const generatedFiles = await readGeneratedFiles(tmpDir, [
+            `infra/core/${payload.env.name}/main.tf`,
+            `infra/core/${payload.env.name}/providers.tf`,
+            `infra/core/${payload.env.name}/backend.tf`,
+            `infra/bootstrapper/${payload.env.name}/main.tf`,
+        ]);
+        expect(generatedFiles).toMatchSnapshot();
+    });
+});

package/dist/adapters/plop/generators/environment/actions.js

@@ -1,5 +1,5 @@
 import { getLogger } from "@logtape/logtape";
-import * as path from "node:path";
+import path from "node:path";
 import { formatTerraformCode } from "../../../terraform/fmt.js";
 import { terraformStateKey } from "../../helpers/terraform-state-key.js";
 import { payloadSchema } from "./prompts.js";
@@ -11,7 +11,7 @@ const addModule = (context, templatesPath, init = false) => {
     return (name) => [
         {
             base: templatesPath,
-            data: { cloudAccountsByCsp, includesProdIO, init },
+            data: { cloudAccountsByCsp, includesProdIO, init: init || undefined },
             destination: path.join(cwd, "infra"),
             force: true,
             templateFiles: path.join(templatesPath, name),
@@ -23,7 +23,7 @@ const addModule = (context, templatesPath, init = false) => {
             base: path.join(templatesPath, "shared"),
             data: {
                 cloudAccountsByCsp,
-                init,
+                init: init || undefined,
                 terraformBackendKey: terraformStateKey(context, name),
             },
             destination: path.join(cwd, "infra", name, "{{env.name}}"),

package/dist/adapters/plop/generators/monorepo/__tests__/generation.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/adapters/plop/generators/monorepo/__tests__/generation.test.js

@@ -0,0 +1,79 @@
+import nodePlop from "node-plop";
+/**
+ * Contract tests for the monorepo generator.
+ *
+ * They generate a real repository in a temp directory, but they only
+ * assert the generator-specific contract: payload interpolation,
+ * injected action outputs, and post-processing we own. They
+ * intentionally avoid asserting generic Plop copy/render behavior.
+ */
+import * as fs from "node:fs/promises";
+import * as os from "node:os";
+import * as path from "node:path";
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+import { resolveTemplatesPath } from "../../../templates-path.js";
+import { cleanupTempDir, readGeneratedFiles, } from "../../__tests__/temp-dir.js";
+import getActions from "../actions.js";
+import { PLOP_MONOREPO_GENERATOR_NAME } from "../index.js";
+/**
+ * Register stub versions of the custom action types that would normally
+ * call external services (GitHub API, Node.js releases, shell commands).
+ */
+const registerStubActions = (plop) => {
+    plop.setActionType("getNodeVersion", async (data) => {
+        data.nodeVersion = "22.14.0";
+        return "Fetched latest version: 22.14.0";
+    });
+    plop.setActionType("fetchGithubRelease", async (data, ctx) => {
+        const resultKey = ctx.resultKey;
+        data[resultKey] = "1.11.0";
+        return `Fetched latest version: 1.11.0`;
+    });
+    plop.setActionType("setupPnpm", async () => "Monorepo bootstrapped");
+};
+describe("monorepo generator — file generation", () => {
+    let tmpDir;
+    let originalCwd;
+    const payload = {
+        repoDescription: "A test repository for DX",
+        repoName: "my-test-repo",
+        repoOwner: "pagopa",
+    };
+    beforeAll(async () => {
+        originalCwd = process.cwd();
+        tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), "dx-cli-monorepo-test-"));
+        process.chdir(tmpDir);
+        const plop = await nodePlop();
+        registerStubActions(plop);
+        plop.setGenerator(PLOP_MONOREPO_GENERATOR_NAME, {
+            actions: getActions(resolveTemplatesPath("monorepo")),
+            description: "A scaffold for a monorepo repository",
+            prompts: [],
+        });
+        const generator = plop.getGenerator(PLOP_MONOREPO_GENERATOR_NAME);
+        const result = await generator.runActions(payload);
+        const realFailures = result.failures.filter((f) => f.error !== "Aborted due to previous action failure");
+        if (realFailures.length > 0) {
+            const summary = realFailures
+                .map((f) => `${f.type}: ${f.error}`)
+                .join("\n");
+            throw new Error(`Generator failed:\n${summary}`);
+        }
+    });
+    afterAll(async () => {
+        process.chdir(originalCwd);
+        await cleanupTempDir(tmpDir);
+    });
+    it("materializes repository metadata from the generator payload", async () => {
+        const generatedFiles = await readGeneratedFiles(path.join(tmpDir, payload.repoName), ["package.json"]);
+        expect(generatedFiles).toMatchSnapshot();
+    });
+    it("propagates action outputs into generated version files", async () => {
+        const generatedFiles = await readGeneratedFiles(path.join(tmpDir, payload.repoName), [".node-version", ".terraform-version", ".pre-commit-config.yaml"]);
+        expect(generatedFiles).toMatchSnapshot();
+    });
+    it("applies the repository-specific gitignore customization", async () => {
+        const generatedFiles = await readGeneratedFiles(path.join(tmpDir, payload.repoName), [".gitignore"]);
+        expect(generatedFiles).toMatchSnapshot();
+    });
+});

package/dist/adapters/plop/index.js

@@ -1,7 +1,6 @@
 import { AzureCliCredential } from "@azure/identity";
 import { getLogger } from "@logtape/logtape";
 import nodePlop from "node-plop";
-import path from "node:path";
 import { Octokit } from "octokit";
 import { oraPromise } from "ora";
 import { RepositoryNotFoundError } from "../../domain/github.js";
@@ -9,10 +8,10 @@ import { AzureSubscriptionRepository } from "../azure/cloud-account-repository.j
 import { AzureCloudAccountService } from "../azure/cloud-account-service.js";
 import createDeploymentEnvironmentGenerator, { payloadSchema as environmentPayloadSchema, PLOP_ENVIRONMENT_GENERATOR_NAME, } from "../plop/generators/environment/index.js";
 import createMonorepoGenerator, { payloadSchema as monorepoPayloadSchema, PLOP_MONOREPO_GENERATOR_NAME, } from "../plop/generators/monorepo/index.js";
+import { resolveTemplatesPath } from "./templates-path.js";
 export const setMonorepoGenerator = (plop) => {
     const octokit = new Octokit({ auth: process.env.GITHUB_TOKEN });
-    const templatesPath = path.join(import.meta.dirname, "../../../templates/monorepo");
-    createMonorepoGenerator(plop, templatesPath, octokit);
+    createMonorepoGenerator(plop, resolveTemplatesPath("monorepo"), octokit);
 };
 const validatePayload = async (payload, github) => {
     try {
@@ -94,6 +93,5 @@ export const setDeploymentEnvironmentGenerator = (plop, gitHubService, github) =
     const credential = new AzureCliCredential();
     const cloudAccountRepository = new AzureSubscriptionRepository(credential);
     const cloudAccountService = new AzureCloudAccountService(credential);
-    const templatesPath = path.join(import.meta.dirname, "../../../templates/environment");
-    createDeploymentEnvironmentGenerator(plop, templatesPath, cloudAccountRepository, cloudAccountService, gitHubService, github);
+    createDeploymentEnvironmentGenerator(plop, resolveTemplatesPath("environment"), cloudAccountRepository, cloudAccountService, gitHubService, github);
 };

package/dist/adapters/plop/templates-path.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Resolves CLI plop templates from a single place so runtime wiring and tests
+ * stay aligned with the package layout.
+ */
+export declare const resolveTemplatesPath: (generatorName: "environment" | "monorepo") => string;

package/dist/adapters/plop/templates-path.js

@@ -0,0 +1,6 @@
+import path from "node:path";
+/**
+ * Resolves CLI plop templates from a single place so runtime wiring and tests
+ * stay aligned with the package layout.
+ */
+export const resolveTemplatesPath = (generatorName) => path.join(import.meta.dirname, "../../../templates", generatorName);

package/dist/domain/__tests__/data.d.ts

@@ -1,18 +1,14 @@
-import { Octokit } from "octokit";
-import { DeepMockProxy, MockProxy } from "vitest-mock-extended";
+import type { MockProxy } from "vitest-mock-extended";
 import { Config } from "../../config.js";
-import { AuthorizationService } from "../authorization.js";
-import { GitHubService } from "../github.js";
+import { GitHubAuthFactory } from "../dependencies.js";
 import { PackageJson, PackageJsonReader } from "../package-json.js";
 import { RepositoryReader } from "../repository.js";
 import { ValidationReporter } from "../validation.js";
 export declare const makeMockPackageJson: (overrides?: Partial<PackageJson>) => PackageJson;
 export declare const makeMockDependencies: () => {
-    authorizationService: MockProxy<AuthorizationService>;
-    gitHubService: MockProxy<GitHubService>;
-    octokit: DeepMockProxy<Octokit>;
     packageJsonReader: MockProxy<PackageJsonReader>;
     repositoryReader: MockProxy<RepositoryReader>;
+    requireGitHubAuth: GitHubAuthFactory;
     validationReporter: MockProxy<ValidationReporter>;
 };
 export declare const makeMockConfig: () => Config;

package/dist/domain/__tests__/data.js

@@ -1,4 +1,4 @@
-import { mock, mockDeep } from "vitest-mock-extended";
+import { mock } from "vitest-mock-extended";
 export const makeMockPackageJson = (overrides = {}) => {
     const basePackageJson = {
         dependencies: new Map(),
@@ -13,11 +13,9 @@ export const makeMockPackageJson = (overrides = {}) => {
     };
 };
 export const makeMockDependencies = () => ({
-    authorizationService: mock(),
-    gitHubService: mock(),
-    octokit: mockDeep(),
     packageJsonReader: mock(),
     repositoryReader: mock(),
+    requireGitHubAuth: mock(),
     validationReporter: mock(),
 });
 export const makeMockConfig = () => ({

package/dist/domain/dependencies.d.ts

@@ -1,12 +1,25 @@
+import { ResultAsync } from "neverthrow";
 import { AuthorizationService } from "./authorization.js";
 import { GitHubService } from "./github.js";
 import { PackageJsonReader } from "./package-json.js";
 import { RepositoryReader } from "./repository.js";
 import { ValidationReporter } from "./validation.js";
 export type Dependencies = {
-    authorizationService: AuthorizationService;
-    gitHubService: GitHubService;
     packageJsonReader: PackageJsonReader;
     repositoryReader: RepositoryReader;
+    requireGitHubAuth: GitHubAuthFactory;
     validationReporter: ValidationReporter;
 };
+/** Services that require a GitHub PAT to be instantiated. */
+export type GitHubAuthDeps = {
+    authorizationService: AuthorizationService;
+    gitHubService: GitHubService;
+};
+/**
+ * Lazily resolves GitHub-authenticated services.
+ * Commands that need GitHub access call this factory inside their action
+ * handler so that auth is only required when those commands actually run.
+ * Returns a `ResultAsync` so auth failures (e.g. missing GH_TOKEN) can be
+ * routed through the same neverthrow error pipeline used by the commands.
+ */
+export type GitHubAuthFactory = () => ResultAsync<GitHubAuthDeps, Error>;