@pagopa/dx-cli 0.22.4 → 0.23.1

package/README.md

@@ -185,6 +185,7 @@ dx savemoney [options]
 | `--days`     | `-d`  | Metric analysis period in days (overrides config file).                                                                                      | `30`         |
 | `--location` | `-l`  | Preferred Azure location for resources (overrides config file).                                                                              | `italynorth` |
 | `--tags`     | `-t`  | Filter resources by tags (`key=value key2=value2`). Only resources matching **all** specified tags are analyzed (variadic: space-separated). | N/A          |
+| `--source`   | `-s`  | Restrict findings to a specific source: `advisor`, `custom`, or `all`.                                                                       | `all`        |
 
 > `--verbose` / `-v` is inherited from the root command. See [Global Options](#global-options).
 
@@ -240,6 +241,7 @@ azure:
 - **Private Endpoints**: Unused or misconfigured endpoints
 - **Container Apps**: Not running, zero replicas, low resource usage
 - **Static Web Apps**: No traffic or very low usage patterns
+- **Azure Advisor recommendations**: Reserved Instance and Savings Plan opportunities, right-sizing suggestions, and other cost recommendations surfaced directly from Azure Advisor — with estimated monthly savings where available
 
 > [!NOTE]
 > Currently only Azure is supported. Support for additional cloud providers (AWS) is planned for future releases.
@@ -259,6 +261,22 @@ These options are available on every subcommand:
 dx --verbose init project
 ```
 
+## 🧪 Development
+
+Run the CLI test suite from the repository root with:
+
+```bash
+pnpm nx test @pagopa/dx-cli
+```
+
+Some integration tests assert generated file contents with Vitest snapshots. When a generator change intentionally updates those files, refresh the snapshots with:
+
+```bash
+pnpm nx test @pagopa/dx-cli -- --update
+```
+
+Review the updated `__snapshots__` files before committing them.
+
 ---
 
 <div align="center">

package/dist/adapters/commander/commands/add.d.ts

@@ -11,13 +11,9 @@ import { Command } from "commander";
 import { ResultAsync } from "neverthrow";
 import type { Payload as EnvironmentPayload } from "../../plop/generators/environment/index.js";
 import { AuthorizationResult, AuthorizationService } from "../../../domain/authorization.js";
-import { type GitHubService } from "../../../domain/github.js";
+import { GitHubAuthFactory } from "../../../domain/dependencies.js";
 /**
  * Authorize a Cloud Account (Azure Subscription, AWS Account, ...), creating a Pull Request for each account that requires authorization.
  */
 export declare const authorizeCloudAccounts: (authorizationService: AuthorizationService) => (envPayload: EnvironmentPayload) => ResultAsync<AuthorizationResult[], never>;
-export type AddCommandDependencies = {
-    authorizationService: AuthorizationService;
-    gitHubService: GitHubService;
-};
-export declare const makeAddCommand: (deps: AddCommandDependencies) => Command;
+export declare const makeAddCommand: (requireGitHubAuth: GitHubAuthFactory) => Command;

package/dist/adapters/commander/commands/add.js

@@ -81,17 +81,13 @@ const addEnvironmentAction = (authorizationService, gitHubService) => checkAddEn
     .andThen((payload) => authorizeCloudAccounts(authorizationService)(payload).map((authorizationPrs) => ({
     authorizationPrs,
 })));
-export const makeAddCommand = (deps) => new Command()
+export const makeAddCommand = (requireGitHubAuth) => new Command()
     .name("add")
     .description("Add a new component to your workspace")
     .addCommand(new Command("environment")
     .description("Add a new deployment environment")
     .action(async function () {
-    const result = await addEnvironmentAction(deps.authorizationService, deps.gitHubService);
-    if (result.isErr()) {
-        exitWithError(this)(result.error);
-    }
-    else {
-        displaySummary(result.value);
-    }
+    await requireGitHubAuth()
+        .andThen(({ authorizationService, gitHubService }) => addEnvironmentAction(authorizationService, gitHubService))
+        .match(displaySummary, exitWithError(this));
 }));

package/dist/adapters/commander/commands/init.d.ts

@@ -1,6 +1,6 @@
 import { Command } from "commander";
 import { ResultAsync } from "neverthrow";
-import { GitHubService } from "../../../domain/github.js";
+import { GitHubAuthFactory } from "../../../domain/dependencies.js";
 import { Payload as MonorepoPayload } from "../../plop/generators/monorepo/index.js";
 export declare const checkInitPreconditions: () => ResultAsync<import("execa").Result<{
     environment: {
@@ -19,8 +19,4 @@ export declare const checkAddEnvironmentPreconditions: () => ResultAsync<import(
     shell: true;
 }>, Error>;
 export declare const confirmGitHubRepoCreation: (payload: MonorepoPayload) => ResultAsync<boolean, Error>;
-type InitCommandDependencies = {
-    gitHubService: GitHubService;
-};
-export declare const makeInitCommand: ({ gitHubService, }: InitCommandDependencies) => Command;
-export {};
+export declare const makeInitCommand: (requireGitHubAuth: GitHubAuthFactory) => Command;

package/dist/adapters/commander/commands/init.js

@@ -142,18 +142,19 @@ export const confirmGitHubRepoCreation = (payload) => ResultAsync.fromPromise(in
     type: "confirm",
 })
     .then(({ confirm }) => confirm), (cause) => new Error("Failed to read GitHub publish confirmation", { cause }));
-export const makeInitCommand = ({ gitHubService, }) => new Command()
+export const makeInitCommand = (requireGitHubAuth) => new Command()
     .name("init")
     .description("Initialize a new DX workspace")
     .action(async function () {
     await checkInitPreconditions()
-        .andThen(() => ResultAsync.fromPromise(getPlopInstance(), (cause) => new Error("Failed to initialize plop", { cause })))
-        .andThen((plop) => ResultAsync.fromPromise(runMonorepoGenerator(plop, gitHubService), handleGeneratorError))
+        .andThen(() => requireGitHubAuth())
+        .andThen((auth) => ResultAsync.fromPromise(getPlopInstance(), (cause) => new Error("Failed to initialize plop", { cause }))
+        .andThen((plop) => ResultAsync.fromPromise(runMonorepoGenerator(plop, auth.gitHubService), handleGeneratorError))
         .andTee((payload) => {
         process.chdir(payload.repoName);
     })
         .andThen((payload) => confirmGitHubRepoCreation(payload).andThen((confirmed) => confirmed
-        ? handleNewGitHubRepository(gitHubService)(payload)
-        : okAsync({ gitHubRepoCreationSkipped: true, payload })))
+        ? handleNewGitHubRepository(auth.gitHubService)(payload)
+        : okAsync({ gitHubRepoCreationSkipped: true, payload }))))
         .match(displaySummary, exitWithError(this));
 });

package/dist/adapters/commander/commands/savemoney.d.ts

@@ -1,2 +1,13 @@
 import { Command } from "commander";
 export declare const makeSavemoneyCommand: () => Command;
+/**
+ * Parses the `--source` option via a zod enum, accepting `all`, `advisor`,
+ * or `custom` and rejecting any other value with a Commander-friendly error.
+ */
+export declare function parseSourceOption(value: string): string;
+/**
+ * Parses an array of "key=value" strings (from commander variadic option) into a Map<string, string>.
+ * Returns an empty Map when the option is not provided or empty.
+ * Supports values that contain "=" (only the first "=" is treated as separator).
+ */
+export declare function parseTagsOption(tagsOption: string[] | undefined): Map<string, string>;

package/dist/adapters/commander/commands/savemoney.js

@@ -1,5 +1,7 @@
 import { azure, loadConfig } from "@pagopa/dx-savemoney";
-import { Command } from "commander";
+import { Command, InvalidArgumentError } from "commander";
+import { oraPromise } from "ora";
+import { z } from "zod";
 import { exitWithError } from "../index.js";
 export const makeSavemoneyCommand = () => new Command("savemoney")
     .description("Analyze Azure subscriptions and report unused or inefficient resources")
@@ -7,7 +9,8 @@ export const makeSavemoneyCommand = () => new Command("savemoney")
     .option("-f, --format <format>", "Report format: json, table, detailed-json, or lint (default: table)", "table")
     .option("-l, --location <string>", "Preferred Azure location for resources (overrides config file)", "italynorth")
     .option("-d, --days <number>", "Number of days for metrics analysis (overrides config file)", "30")
-    .option("-t, --tags <tags...>", "Filter resources by tags (key=value key2=value2). Only resources matching ALL specified tags are analyzed.")
+    .option("-t, --tags <tags...>", "Filter findings by resource tags (key=value key2=value2). Advisor subscription-level findings remain global.")
+    .option("-s, --source <source>", "Restrict findings to a single source: 'advisor', 'custom', or 'all' (default: all)", parseSourceOption, "all")
     .action(async function (options) {
     const { verbose } = this.optsWithGlobals();
     try {
@@ -19,11 +22,21 @@ export const makeSavemoneyCommand = () => new Command("savemoney")
             ...config,
             filterTags,
             preferredLocation: options.location || config.preferredLocation,
+            sources: options.source === "all"
+                ? (config.sources ?? ["advisor", "custom"])
+                : [options.source],
             timespanDays: Number.parseInt(options.days, 10) || config.timespanDays,
             verbose: verbose ?? false,
         };
-        // Run analysis
-        await azure.analyzeAzureResources(finalConfig, options.format);
+        // Run analysis showing a progress spinner on stderr so the CLI doesn't
+        // look frozen during the (potentially several-minute) Azure round-trips.
+        const reports = await oraPromise(azure.analyzeAzureResources(finalConfig), {
+            failText: "Analysis failed",
+            stream: process.stderr,
+            successText: "Analysis complete",
+            text: "Analyzing Azure resources",
+        });
+        await azure.generateReport(reports, options.format);
     }
     catch (error) {
         exitWithError(this)(error instanceof Error
@@ -31,12 +44,24 @@ export const makeSavemoneyCommand = () => new Command("savemoney")
             : new Error(`Analysis failed: ${String(error)}`));
     }
 });
+const SourceSchema = z.enum(["advisor", "all", "custom"]);
+/**
+ * Parses the `--source` option via a zod enum, accepting `all`, `advisor`,
+ * or `custom` and rejecting any other value with a Commander-friendly error.
+ */
+export function parseSourceOption(value) {
+    const result = SourceSchema.safeParse(value);
+    if (!result.success) {
+        throw new InvalidArgumentError(`Allowed values are: ${SourceSchema.options.join(", ")}`);
+    }
+    return result.data;
+}
 /**
  * Parses an array of "key=value" strings (from commander variadic option) into a Map<string, string>.
  * Returns an empty Map when the option is not provided or empty.
  * Supports values that contain "=" (only the first "=" is treated as separator).
  */
-function parseTagsOption(tagsOption) {
+export function parseTagsOption(tagsOption) {
     const result = new Map();
     if (!tagsOption || tagsOption.length === 0) {
         return result;

package/dist/adapters/commander/commands/spec.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Spec Command
+ *
+ * Implements the `dx spec` subcommand. Calls the injected `getSpec` factory
+ * and writes the result as pretty-printed JSON to stdout.  The command has no
+ * dependencies and requires no authentication.
+ */
+import { Command } from "commander";
+import type { CliSpec } from "../../../domain/spec.js";
+export declare const makeSpecCommand: (getSpec: () => CliSpec) => Command;

package/dist/adapters/commander/commands/spec.js

@@ -0,0 +1,13 @@
+/**
+ * Spec Command
+ *
+ * Implements the `dx spec` subcommand. Calls the injected `getSpec` factory
+ * and writes the result as pretty-printed JSON to stdout.  The command has no
+ * dependencies and requires no authentication.
+ */
+import { Command } from "commander";
+export const makeSpecCommand = (getSpec) => new Command("spec")
+    .description("Print the full CLI spec as JSON (commands, subcommands, flags, arguments). Useful for agents that need to understand the CLI without running --help on every command.")
+    .action(() => {
+    process.stdout.write(JSON.stringify(getSpec(), null, 2) + "\n");
+});

package/dist/adapters/commander/index.js

@@ -5,7 +5,9 @@ import { makeDoctorCommand } from "./commands/doctor.js";
 import { makeInfoCommand } from "./commands/info.js";
 import { makeInitCommand } from "./commands/init.js";
 import { makeSavemoneyCommand } from "./commands/savemoney.js";
+import { makeSpecCommand } from "./commands/spec.js";
 import { formatErrorDetailed, toErrorMessage } from "./error-reporting.js";
+import { extractCliSpec } from "./spec.js";
 /**
  * Returns true when the global `--verbose` flag is active on the closest
  * ancestor command that defines it (the root `dx` program in our CLI).
@@ -23,10 +25,12 @@ export const makeCli = (deps, config, cliDeps, version) => {
         .default("text"));
     program.addCommand(makeDoctorCommand(deps, config));
     program.addCommand(makeCodemodCommand(cliDeps));
-    program.addCommand(makeInitCommand(deps));
+    program.addCommand(makeInitCommand(deps.requireGitHubAuth));
     program.addCommand(makeSavemoneyCommand());
     program.addCommand(makeInfoCommand(deps));
-    program.addCommand(makeAddCommand(deps));
+    program.addCommand(makeAddCommand(deps.requireGitHubAuth));
+    // spec is registered last so the closure captures the complete command tree.
+    program.addCommand(makeSpecCommand(() => extractCliSpec(program, version)));
     return program;
 };
 /**

package/dist/adapters/commander/spec.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Commander Spec Adapter
+ *
+ * Maps a Commander `Command` tree to the technology-agnostic `CliSpec` domain
+ * type defined in `domain/spec.ts`.  This is the only place in the codebase
+ * that depends on Commander's introspection API.
+ */
+import { Command } from "commander";
+import type { CliSpec } from "../../domain/spec.js";
+/**
+ * Extracts the full CLI spec from a fully-constructed Commander `Command` tree.
+ *
+ * Should be called after all subcommands have been registered on `rootCommand`
+ * so the spec reflects the complete command surface.
+ */
+export declare const extractCliSpec: (rootCommand: Command, version: string) => CliSpec;

package/dist/adapters/commander/spec.js

@@ -0,0 +1,54 @@
+/**
+ * Commander Spec Adapter
+ *
+ * Maps a Commander `Command` tree to the technology-agnostic `CliSpec` domain
+ * type defined in `domain/spec.ts`.  This is the only place in the codebase
+ * that depends on Commander's introspection API.
+ */
+const INTERNAL_FLAGS = new Set(["--help", "--version"]);
+const INTERNAL_ROOT_COMMANDS = new Set(["spec"]);
+const mapOption = (opt) => ({
+    choices: opt.argChoices ?? [],
+    defaultValue: opt.defaultValue,
+    description: opt.description,
+    flags: opt.flags,
+    long: opt.long ?? undefined,
+    optional: opt.optional,
+    required: opt.required,
+    short: opt.short ?? undefined,
+});
+const mapArgument = (arg) => ({
+    choices: arg.argChoices ?? [],
+    defaultValue: arg.defaultValue,
+    description: arg.description,
+    name: arg.name(),
+    required: arg.required,
+    variadic: arg.variadic,
+});
+const mapCommand = (cmd) => ({
+    arguments: cmd.registeredArguments.map(mapArgument),
+    commands: cmd.commands.map(mapCommand),
+    description: cmd.description(),
+    name: cmd.name(),
+    options: cmd.options
+        .filter((opt) => !INTERNAL_FLAGS.has(opt.long ?? ""))
+        .map(mapOption),
+});
+/**
+ * Extracts the full CLI spec from a fully-constructed Commander `Command` tree.
+ *
+ * Should be called after all subcommands have been registered on `rootCommand`
+ * so the spec reflects the complete command surface.
+ */
+export const extractCliSpec = (rootCommand, version) => ({
+    commands: rootCommand.commands
+        .filter((cmd) => !INTERNAL_ROOT_COMMANDS.has(cmd.name()))
+        .map(mapCommand),
+    description: rootCommand.description(),
+    globalOptions: rootCommand.options
+        .filter((opt) => !INTERNAL_FLAGS.has(opt.long ?? ""))
+        .map(mapOption),
+    name: rootCommand.name(),
+    specVersion: "1",
+    version,
+});

package/dist/adapters/plop/generators/environment/actions.js

@@ -1,5 +1,5 @@
 import { getLogger } from "@logtape/logtape";
-import * as path from "node:path";
+import path from "node:path";
 import { formatTerraformCode } from "../../../terraform/fmt.js";
 import { terraformStateKey } from "../../helpers/terraform-state-key.js";
 import { payloadSchema } from "./prompts.js";
@@ -11,7 +11,7 @@ const addModule = (context, templatesPath, init = false) => {
     return (name) => [
         {
             base: templatesPath,
-            data: { cloudAccountsByCsp, includesProdIO, init },
+            data: { cloudAccountsByCsp, includesProdIO, init: init || undefined },
             destination: path.join(cwd, "infra"),
             force: true,
             templateFiles: path.join(templatesPath, name),
@@ -23,7 +23,7 @@ const addModule = (context, templatesPath, init = false) => {
             base: path.join(templatesPath, "shared"),
             data: {
                 cloudAccountsByCsp,
-                init,
+                init: init || undefined,
                 terraformBackendKey: terraformStateKey(context, name),
             },
             destination: path.join(cwd, "infra", name, "{{env.name}}"),

package/dist/adapters/plop/index.js

@@ -1,7 +1,6 @@
 import { AzureCliCredential } from "@azure/identity";
 import { getLogger } from "@logtape/logtape";
 import nodePlop from "node-plop";
-import path from "node:path";
 import { Octokit } from "octokit";
 import { oraPromise } from "ora";
 import { RepositoryNotFoundError } from "../../domain/github.js";
@@ -9,10 +8,10 @@ import { AzureSubscriptionRepository } from "../azure/cloud-account-repository.j
 import { AzureCloudAccountService } from "../azure/cloud-account-service.js";
 import createDeploymentEnvironmentGenerator, { payloadSchema as environmentPayloadSchema, PLOP_ENVIRONMENT_GENERATOR_NAME, } from "../plop/generators/environment/index.js";
 import createMonorepoGenerator, { payloadSchema as monorepoPayloadSchema, PLOP_MONOREPO_GENERATOR_NAME, } from "../plop/generators/monorepo/index.js";
+import { resolveTemplatesPath } from "./templates-path.js";
 export const setMonorepoGenerator = (plop) => {
     const octokit = new Octokit({ auth: process.env.GITHUB_TOKEN });
-    const templatesPath = path.join(import.meta.dirname, "../../../templates/monorepo");
-    createMonorepoGenerator(plop, templatesPath, octokit);
+    createMonorepoGenerator(plop, resolveTemplatesPath("monorepo"), octokit);
 };
 const validatePayload = async (payload, github) => {
     try {
@@ -94,6 +93,5 @@ export const setDeploymentEnvironmentGenerator = (plop, gitHubService, github) =
     const credential = new AzureCliCredential();
     const cloudAccountRepository = new AzureSubscriptionRepository(credential);
     const cloudAccountService = new AzureCloudAccountService(credential);
-    const templatesPath = path.join(import.meta.dirname, "../../../templates/environment");
-    createDeploymentEnvironmentGenerator(plop, templatesPath, cloudAccountRepository, cloudAccountService, gitHubService, github);
+    createDeploymentEnvironmentGenerator(plop, resolveTemplatesPath("environment"), cloudAccountRepository, cloudAccountService, gitHubService, github);
 };

package/dist/adapters/plop/templates-path.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Resolves CLI plop templates from a single place so runtime wiring and tests
+ * stay aligned with the package layout.
+ */
+export declare const resolveTemplatesPath: (generatorName: "environment" | "monorepo") => string;

package/dist/adapters/plop/templates-path.js

@@ -0,0 +1,6 @@
+import path from "node:path";
+/**
+ * Resolves CLI plop templates from a single place so runtime wiring and tests
+ * stay aligned with the package layout.
+ */
+export const resolveTemplatesPath = (generatorName) => path.join(import.meta.dirname, "../../../templates", generatorName);

package/dist/domain/dependencies.d.ts

@@ -1,12 +1,25 @@
+import { ResultAsync } from "neverthrow";
 import { AuthorizationService } from "./authorization.js";
 import { GitHubService } from "./github.js";
 import { PackageJsonReader } from "./package-json.js";
 import { RepositoryReader } from "./repository.js";
 import { ValidationReporter } from "./validation.js";
 export type Dependencies = {
-    authorizationService: AuthorizationService;
-    gitHubService: GitHubService;
     packageJsonReader: PackageJsonReader;
     repositoryReader: RepositoryReader;
+    requireGitHubAuth: GitHubAuthFactory;
     validationReporter: ValidationReporter;
 };
+/** Services that require a GitHub PAT to be instantiated. */
+export type GitHubAuthDeps = {
+    authorizationService: AuthorizationService;
+    gitHubService: GitHubService;
+};
+/**
+ * Lazily resolves GitHub-authenticated services.
+ * Commands that need GitHub access call this factory inside their action
+ * handler so that auth is only required when those commands actually run.
+ * Returns a `ResultAsync` so auth failures (e.g. missing GH_TOKEN) can be
+ * routed through the same neverthrow error pipeline used by the commands.
+ */
+export type GitHubAuthFactory = () => ResultAsync<GitHubAuthDeps, Error>;

package/dist/domain/spec.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Spec Domain
+ *
+ * Pure types that describe the shape of the CLI spec output.
+ * Technology-agnostic: no dependency on Commander or any CLI framework.
+ * Consumed by the Commander adapter and by agent tooling that parses `dx spec`.
+ */
+export type ArgumentSpec = {
+    /** Allowed values when the argument is constrained to a set */
+    choices: string[];
+    defaultValue: unknown;
+    description: string;
+    name: string;
+    required: boolean;
+    variadic: boolean;
+};
+export type CliSpec = {
+    /** Top-level subcommands with their own options, arguments, and nested commands. */
+    commands: CommandSpec[];
+    description: string;
+    /** Options defined directly on the root `dx` program (global flags). */
+    globalOptions: OptionSpec[];
+    name: string;
+    /** Stable version of the spec JSON shape. Increment on breaking changes. */
+    specVersion: "1";
+    version: string;
+};
+export type CommandSpec = {
+    arguments: ArgumentSpec[];
+    commands: CommandSpec[];
+    description: string;
+    name: string;
+    options: OptionSpec[];
+};
+export type OptionSpec = {
+    /** Allowed values when the option is an enum */
+    choices: string[];
+    defaultValue: unknown;
+    description: string;
+    /** Raw flags string as shown in help, e.g. "-v, --verbose" */
+    flags: string;
+    /** Long flag, e.g. "--verbose" */
+    long: string | undefined;
+    /** True when the option value is optional (e.g. `--output [mode]`) */
+    optional: boolean;
+    /** True when the option value is mandatory (e.g. `--output <mode>`) */
+    required: boolean;
+    /** Short flag, e.g. "-v" (undefined when not present) */
+    short: string | undefined;
+};

package/dist/domain/spec.js

@@ -0,0 +1,8 @@
+/**
+ * Spec Domain
+ *
+ * Pure types that describe the shape of the CLI spec output.
+ * Technology-agnostic: no dependency on Commander or any CLI framework.
+ * Consumed by the Commander adapter and by agent tooling that parses `dx spec`.
+ */
+export {};

package/dist/index.js

@@ -1,6 +1,6 @@
 import "core-js/actual/set/index.js";
 import { configure, getConsoleSink } from "@logtape/logtape";
-import * as assert from "node:assert/strict";
+import { errAsync, okAsync, ResultAsync } from "neverthrow";
 import { Octokit } from "octokit";
 import codemodRegistry from "./adapters/codemods/index.js";
 import { makeCli } from "./adapters/commander/index.js";
@@ -13,7 +13,6 @@ import { getConfig } from "./config.js";
 import { getInfo } from "./domain/info.js";
 import { applyCodemodById } from "./use-cases/apply-codemod.js";
 import { listCodemods } from "./use-cases/list-codemods.js";
-import { requestAuthorization } from "./use-cases/request-authorization.js";
 /**
  * Returns `true` when `-v` or `--verbose` is present in argv.
  *
@@ -50,29 +49,33 @@ const configureLogging = async (verbose) => {
 };
 export const runCli = async (version) => {
     await configureLogging(detectVerboseFromArgv(process.argv));
-    // Creating the adapters
     const repositoryReader = makeRepositoryReader();
     const packageJsonReader = makePackageJsonReader();
     const validationReporter = makeValidationReporter();
-    const auth = await getGitHubPAT();
-    assert.ok(auth, "GitHub PAT is required. Please set the GH_TOKEN environment variable or login using GitHub CLI.");
-    const octokit = new Octokit({
-        auth,
+    /**
+     * Lazily creates GitHub-authenticated services on first call.
+     * Only commands that actually need GitHub (init, add) will trigger this,
+     * so credential-free commands (spec, doctor, info, …) never require a PAT.
+     */
+    const requireGitHubAuth = () => ResultAsync.fromPromise(getGitHubPAT(), (cause) => new Error("Failed to read GitHub PAT", { cause })).andThen((auth) => {
+        if (!auth) {
+            return errAsync(new Error("GitHub PAT is required. Please set the GH_TOKEN environment variable or login using GitHub CLI."));
+        }
+        const octokit = new Octokit({ auth });
+        const gitHubService = new OctokitGitHubService(octokit);
+        const authorizationService = makeAzureAuthorizationService(gitHubService);
+        return okAsync({ authorizationService, gitHubService });
     });
-    const gitHubService = new OctokitGitHubService(octokit);
-    const authorizationService = makeAzureAuthorizationService(gitHubService);
     const deps = {
-        authorizationService,
-        gitHubService,
         packageJsonReader,
         repositoryReader,
+        requireGitHubAuth,
         validationReporter,
     };
     const config = getConfig();
     const useCases = {
         applyCodemodById: applyCodemodById(codemodRegistry, getInfo(deps)),
         listCodemods: listCodemods(codemodRegistry),
-        requestAuthorization: requestAuthorization(authorizationService),
     };
     const program = makeCli(deps, config, useCases, version);
     program.parse();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pagopa/dx-cli",
-  "version": "0.22.4",
+  "version": "0.23.1",
   "type": "module",
   "description": "A CLI useful to manage DX tools.",
   "repository": {
@@ -48,7 +48,7 @@
     "semver": "^7.7.4",
     "yaml": "^2.8.4",
     "zod": "^4.4.2",
-    "@pagopa/dx-savemoney": "^0.2.6"
+    "@pagopa/dx-savemoney": "^0.3.1"
   },
   "devDependencies": {
     "@tsconfig/node24": "24.0.4",
@@ -56,15 +56,15 @@
     "@types/libsodium-wrappers": "^0.8.2",
     "@types/node": "^22.19.17",
     "@types/semver": "^7.7.1",
-    "@vitest/coverage-v8": "^3.2.4",
+    "@vitest/coverage-v8": "^4.1.8",
     "eslint": "^10.3.0",
     "fast-check": "^4.8.0",
     "memfs": "^4.57.2",
     "plop": "^4.0.5",
     "prettier": "3.8.3",
     "typescript": "~5.9.3",
-    "vitest": "^3.2.4",
-    "vitest-mock-extended": "^3.1.1",
+    "vitest": "^4.1.8",
+    "vitest-mock-extended": "^4.0.0",
     "@pagopa/eslint-config": "^6.0.4"
   },
   "engines": {

package/templates/monorepo/nx.json

@@ -68,7 +68,6 @@
         },
         "build": {
           "targetName": "build",
-          "configName": "tsconfig.json",
           "buildDepsName": "build-deps",
           "watchDepsName": "watch-deps"
         }

package/dist/adapters/azure/__tests__/cloud-account-repository.test.d.ts

@@ -1 +0,0 @@
-export {};