@theholocron/cli 1.0.0 → 1.1.0

package/dist/config-DWlIfFZm.mjs

@@ -0,0 +1,113 @@
+import { r as REQUIRED_CAPABILITIES, t as CARDINALITY } from "./capabilities-QjjhVlDd.mjs";
+//#region src/config.ts
+/**
+* `holocron.config.json` schema, parser, and provider resolution.
+*
+* ESLint-style entry forms:
+*
+*   "source": "github"                              ← single, short
+*   "deployment": ["vercel", { team: "rando" }]    ← single, with options
+*   "notifications": ["slack", "discord"]          ← multi, short
+*   "notifications": [
+*     ["slack",   { channel: "#ops" }],
+*     ["discord", { webhook: "env:HOOK" }]
+*   ]                                              ← multi, with options
+*
+* Discriminator: an array entry is a `[provider, options]` tuple when
+* the length is 2 AND element[1] is a non-array, non-null object.
+* Otherwise it's a multi-provider list (string[] or tuple[]).
+*
+* Validation rules:
+*   - `vault` is REQUIRED (every project has secrets somewhere)
+*   - Entries for `'many'` capabilities are normalized to an array of
+*     normalized tuples; entries for `'single'` capabilities are
+*     normalized to one tuple
+*   - Tokens / secret values never appear in config — providers read
+*     them from env (or pull from `vault` at runtime)
+*/
+var ConfigError = class extends Error {
+	name = "ConfigError";
+};
+const PLUGIN_PREFIX = "@theholocron/holocron-plugin-";
+const COMMUNITY_PREFIX = "holocron-plugin-";
+/**
+* Resolve `"github"` → `"@theholocron/holocron-plugin-github"`.
+* Fully-qualified names (scoped or not) are honored verbatim, which
+* is how third-party plugins published outside the org work.
+*/
+function resolvePluginPackage(provider) {
+	if (!provider) throw new ConfigError("provider name is empty");
+	if (provider.startsWith("@")) return provider;
+	if (provider.startsWith(COMMUNITY_PREFIX)) return provider;
+	if (provider.includes("/")) return provider;
+	return PLUGIN_PREFIX + provider;
+}
+/** A bare `[provider, options]` tuple, with both elements present? */
+function isOptionsTuple(value) {
+	if (!Array.isArray(value)) return false;
+	if (value.length !== 2) return false;
+	if (typeof value[0] !== "string") return false;
+	const opt = value[1];
+	return typeof opt === "object" && opt !== null && !Array.isArray(opt);
+}
+function normalizeEntry(entry) {
+	if (typeof entry === "string") return {
+		provider: entry,
+		packageName: resolvePluginPackage(entry),
+		options: {}
+	};
+	const [provider, options] = entry;
+	return {
+		provider,
+		packageName: resolvePluginPackage(provider),
+		options
+	};
+}
+function resolveEntry(key, raw) {
+	const cardinality = CARDINALITY[key];
+	if (typeof raw === "string") {
+		if (cardinality === "many") throw new ConfigError(`\`${key}\` accepts multiple providers; wrap a single one in an array: ["${raw}"]`);
+		return {
+			cardinality: "single",
+			tuple: normalizeEntry(raw)
+		};
+	}
+	if (!Array.isArray(raw)) throw new ConfigError(`\`${key}\` entry must be a string or array, got ${typeof raw}`);
+	if (isOptionsTuple(raw)) {
+		if (cardinality === "many") return {
+			cardinality: "many",
+			tuples: [normalizeEntry(raw)]
+		};
+		return {
+			cardinality: "single",
+			tuple: normalizeEntry(raw)
+		};
+	}
+	if (cardinality === "single") throw new ConfigError(`\`${key}\` accepts exactly one provider; got a multi-provider list with ${raw.length} entries`);
+	return {
+		cardinality: "many",
+		tuples: raw.map((entry, idx) => {
+			if (typeof entry === "string") return normalizeEntry(entry);
+			if (isOptionsTuple(entry)) return normalizeEntry(entry);
+			throw new ConfigError(`\`${key}[${idx}]\` must be a provider string or [provider, options] tuple`);
+		})
+	};
+}
+function resolveConfig(raw) {
+	if (!raw.project?.name) throw new ConfigError("`project.name` is required");
+	if (!raw.providers || typeof raw.providers !== "object") throw new ConfigError("`providers` block is required");
+	const providers = {};
+	for (const [key, entry] of Object.entries(raw.providers)) {
+		if (entry === void 0) continue;
+		providers[key] = resolveEntry(key, entry);
+	}
+	for (const required of REQUIRED_CAPABILITIES) if (!providers[required]) throw new ConfigError(`required capability \`${required}\` is missing from providers`);
+	return {
+		project: raw.project,
+		providers,
+		apps: raw.apps ?? [],
+		doctor: raw.doctor ?? {}
+	};
+}
+//#endregion
+export { resolvePluginPackage as i, resolveConfig as n, resolveEntry as r, ConfigError as t };

package/dist/index-CSxf0Yc7.d.mts

@@ -0,0 +1,485 @@
+//#region src/capabilities/index.d.ts
+/**
+ * Capability interfaces — the contracts that providers implement.
+ *
+ * Each capability has a stable key (`'source'`, `'ci'`, …) and a
+ * cardinality (`'single'` = one provider; `'many'` = several active
+ * at once). The cardinality is part of the type contract via
+ * `CardinalityFor<K>` so config resolution + command code can branch
+ * statically.
+ *
+ * See `.notes/tech-architecture.spec.md` for the design narrative
+ * (status: proposed, issue: #74).
+ */
+type CapabilityKey = "source" | "ci" | "secrets" | "environments" | "issues" | "deployment" | "storage" | "auth" | "vault" | "dns" | "tooling" | "notifications" | "analytics" | "observability";
+type Cardinality = "single" | "many";
+declare const CARDINALITY: {
+  readonly source: "single";
+  readonly ci: "single";
+  readonly secrets: "single";
+  readonly environments: "single";
+  readonly issues: "single";
+  readonly deployment: "single";
+  readonly storage: "single";
+  readonly auth: "single";
+  readonly vault: "single";
+  readonly dns: "single";
+  readonly tooling: "many";
+  readonly notifications: "many";
+  readonly analytics: "many";
+  readonly observability: "many";
+};
+/** Vault is required; everything else is optional in the config. */
+declare const REQUIRED_CAPABILITIES: readonly CapabilityKey[];
+interface ProviderIdentity {
+  readonly key: CapabilityKey;
+  readonly providerName: string;
+}
+/**
+ * Surfaced from every capability call that hits a vendor API. Wraps
+ * the underlying error with `status` (HTTP) and `details` so
+ * orchestrators (`holocron setup`, `doctor`) can soft-skip rather
+ * than abort.
+ */
+declare class ProviderApiError extends Error {
+  readonly status: number | undefined;
+  readonly details?: unknown | undefined;
+  name: string;
+  constructor(message: string, status: number | undefined, details?: unknown | undefined);
+}
+interface Ruleset {
+  id: number;
+  name: string;
+  enforcement: "active" | "evaluate" | "disabled";
+  target?: string;
+}
+interface RepoSettings {
+  allow_squash_merge?: boolean;
+  allow_merge_commit?: boolean;
+  allow_rebase_merge?: boolean;
+  allow_auto_merge?: boolean;
+  delete_branch_on_merge?: boolean;
+  default_branch?: string;
+  has_issues?: boolean;
+  has_discussions?: boolean;
+}
+interface RepoRef {
+  owner: string;
+  name: string;
+  defaultBranch: string;
+}
+interface Source extends ProviderIdentity {
+  readonly key: "source";
+  /** Auth sanity-check. Throws ProviderApiError on auth failure. */
+  whoami(): Promise<{
+    login: string;
+  }>;
+  getRepo(): Promise<RepoRef>;
+  listRulesets(): Promise<Ruleset[]>;
+  createRuleset(payload: Record<string, unknown>): Promise<Ruleset>;
+  updateRuleset(id: number, payload: Record<string, unknown>): Promise<Ruleset>;
+  updateRepoSettings(settings: RepoSettings): Promise<void>;
+  enableVulnerabilityAlerts(): Promise<void>;
+  enableAutomatedSecurityFixes(): Promise<void>;
+  enableSecretScanning(): Promise<void>;
+  enablePrivateVulnerabilityReporting(): Promise<void>;
+  listWorkflowFiles(): Promise<string[]>;
+  readWorkflowFile(name: string): Promise<string | null>;
+  writeWorkflowFile(name: string, contents: string): Promise<void>;
+  removeWorkflowFile(name: string): Promise<void>;
+}
+type CiRunStatus = "queued" | "in_progress" | "completed" | "cancelled" | "failure" | "success" | "skipped";
+interface CiRun {
+  id: string | number;
+  workflowName: string;
+  branch: string;
+  sha: string;
+  status: CiRunStatus;
+  url: string;
+  startedAt: string;
+  completedAt?: string;
+}
+interface CiRunFilter {
+  branch?: string;
+  status?: CiRunStatus;
+  limit?: number;
+}
+interface Ci extends ProviderIdentity {
+  readonly key: "ci";
+  listRuns(filter?: CiRunFilter): Promise<CiRun[]>;
+  getRun(id: string | number): Promise<CiRun>;
+}
+type SecretScope = {
+  kind: "repo";
+} | {
+  kind: "environment";
+  name: string;
+} | {
+  kind: "organization";
+  name: string;
+};
+interface Secrets extends ProviderIdentity {
+  readonly key: "secrets";
+  /** List secret NAMES (not values) at the given scope. */
+  listSecrets(scope: SecretScope): Promise<string[]>;
+  /** Idempotent upsert. Adapter handles encryption. */
+  setSecret(scope: SecretScope, name: string, value: string): Promise<void>;
+  deleteSecret(scope: SecretScope, name: string): Promise<void>;
+}
+interface EnvironmentReviewer {
+  type: "User" | "Team";
+  /** Numeric id — GitHub's reviewer API silently ignores login strings. */
+  id: number;
+}
+interface Environment {
+  name: string;
+  reviewers?: EnvironmentReviewer[];
+  waitTimer?: number;
+  preventSelfReview?: boolean;
+}
+interface Environments extends ProviderIdentity {
+  readonly key: "environments";
+  listEnvironments(): Promise<Environment[]>;
+  upsertEnvironment(env: Environment): Promise<void>;
+  deleteEnvironment(name: string): Promise<void>;
+}
+type LifecycleSlot = "inProgress" | "inReview" | "done";
+type StatusCategory = "open" | "in-progress" | "in-review" | "done" | "other";
+interface TrackerUser {
+  id: string;
+  displayName: string;
+  emailAddress?: string;
+}
+interface Issue {
+  /** Human-readable key — "#42" for GitHub, "RANDO-42" for Jira. */
+  key: string;
+  /** Internal opaque id. */
+  id: string;
+  summary: string;
+  body?: string;
+  status: string;
+  statusCategory: StatusCategory;
+  assignee: TrackerUser | null;
+  updated: string;
+  url?: string;
+}
+interface IssueSearchFilter {
+  /** Restrict to issues assigned to a specific id, or 'currentUser'. */
+  assignee?: string | "currentUser";
+  /** Exclude issues in the `done` category. */
+  openOnly?: boolean;
+  /** Max number of issues to return. Adapters apply a sensible default. */
+  limit?: number;
+}
+interface LifecycleResult {
+  /** False when no API write happened (already at target state). */
+  transitioned: boolean;
+  /** Status name the issue is in after this call. */
+  status: string;
+  /** Adapter-specific note (e.g., "label set" / "closed (completed)"). */
+  via?: string;
+}
+interface TrackerDoctorReport {
+  /** "Authenticated as ..." subject for the spinner. */
+  authedAs: string;
+  /** Free-form "Project: RANDO" / "Repo: rando-id/rando" identifier. */
+  projectLabel: string;
+  /** Status values the adapter exposes. */
+  statuses: Array<{
+    name: string;
+    category: StatusCategory;
+  }>;
+  /**
+   * Per-lifecycle-slot readiness check. `resolved` indicates whether
+   * the configured value actually maps to something the tracker
+   * recognizes; the `note` is the rendered explanation.
+   */
+  lifecycle: Array<{
+    slot: LifecycleSlot;
+    value: string | null;
+    resolved: boolean;
+    note: string;
+  }>;
+}
+interface Issues extends ProviderIdentity {
+  readonly key: "issues";
+  /** Currently-authenticated user. */
+  getMyself(): Promise<TrackerUser>;
+  search(filter: IssueSearchFilter): Promise<Issue[]>;
+  get(key: string): Promise<Issue>;
+  create(input: {
+    summary: string;
+    body?: string;
+    labels?: string[]; /** Numeric id or exact title (case-insensitive). */
+    milestone?: string;
+  }): Promise<{
+    key: string;
+  }>;
+  /** Idempotent — `transitioned: false` if the issue is already at the target. */
+  transition(key: string, slot: LifecycleSlot): Promise<LifecycleResult>;
+  comment(key: string, body: string): Promise<void>;
+  doctor(): Promise<TrackerDoctorReport>;
+}
+/** Env-var scope on the deploy platform. */
+type DeploymentTarget = "development" | "preview" | "production";
+/**
+ * Named deployment trigger target — `undefined` means a branch
+ * preview (no named environment).
+ */
+type DeploymentTrigger = "production" | "staging";
+interface DeploymentProject {
+  id: string;
+  name: string;
+  framework?: string;
+  /** True when the project is linked to a Git provider. */
+  gitLinked?: boolean;
+  rootDirectory?: string | null;
+}
+interface DeploymentProjectSettings {
+  previewDeploymentsDisabled?: boolean;
+  /** Vercel-specific: whether the GitHub integration creates deployments
+   * for every push (false → only on-demand triggers). */
+  gitProviderCreateDeployments?: boolean;
+}
+interface DeploymentRecord {
+  id: string;
+  url: string;
+  /** Branch this deployment was made from (null if not git-sourced). */
+  branch: string | null;
+  /** Named environment if one was targeted; undefined for branch previews. */
+  target?: DeploymentTrigger;
+  status: "queued" | "building" | "ready" | "error" | "cancelled";
+}
+interface Deployment extends ProviderIdentity {
+  readonly key: "deployment";
+  listProjects(): Promise<DeploymentProject[]>;
+  /** Create if missing, otherwise return existing. Idempotent. */
+  ensureProject(input: {
+    name: string;
+    framework?: string; /** "owner/repo" — passed when linking to a Git provider. */
+    repo?: string;
+    rootDirectory?: string;
+  }): Promise<DeploymentProject>;
+  updateProjectSettings(projectId: string, settings: DeploymentProjectSettings): Promise<DeploymentProject>;
+  listEnvVars(projectId: string, target: DeploymentTarget): Promise<string[]>;
+  setEnvVar(projectId: string, target: DeploymentTarget, name: string, value: string): Promise<void>;
+  /**
+   * Kick off a deployment of the given branch. Omit `target` for a
+   * branch preview; pass `'production'` / `'staging'` to deploy into
+   * a named environment.
+   */
+  triggerDeployment(input: {
+    projectId: string;
+    branch: string;
+    target?: DeploymentTrigger;
+  }): Promise<DeploymentRecord>;
+  getDeployment(deploymentId: string): Promise<DeploymentRecord>;
+}
+interface StorageBranch {
+  id: string;
+  name: string;
+  /** Parent branch id; null for the root/main branch. */
+  parentId: string | null;
+  createdAt: string;
+}
+interface ConnectionStringOptions {
+  /** Use the pooled (PgBouncer) URL when available. Defaults to false. */
+  pooled?: boolean;
+}
+interface Storage extends ProviderIdentity {
+  readonly key: "storage";
+  /**
+   * Connection string for the given scope. Scope is provider-specific:
+   *
+   *   - branch-based providers (Neon, PlanetScale): scope = branch
+   *     name or id
+   *   - flat providers (single Postgres instance): scope is ignored
+   *
+   * Callers (or the orchestrator) decide how a deploy target maps to
+   * a scope; the storage plugin doesn't own that mapping.
+   */
+  getConnectionString(scope: string, options?: ConnectionStringOptions): Promise<string>;
+  listBranches?(): Promise<StorageBranch[]>;
+  createBranch?(input: {
+    name: string;
+    from?: string;
+  }): Promise<StorageBranch>;
+  destroyBranch?(branch: string): Promise<void>;
+  /** Restore one branch to match another (e.g., reset preview → main). */
+  resetBranch?(input: {
+    branch: string;
+    from: string;
+  }): Promise<void>;
+  /**
+   * Provider-specific feature toggle. For Postgres providers this is
+   * `CREATE EXTENSION IF NOT EXISTS ...` per branch.
+   */
+  enableExtension?(input: {
+    branch: string;
+    extension: string;
+  }): Promise<void>;
+}
+interface AuthDescription {
+  provider: string;
+  /** Env-var names the app needs at runtime (CLERK_PUBLISHABLE_KEY, etc.). */
+  envKeys: string[];
+}
+interface AuthIdentity {
+  provider: string;
+  /** Provider-specific health signal (user count, role, account name, etc.). */
+  details?: Record<string, unknown>;
+}
+interface AuthUser {
+  id: string;
+  email: string;
+}
+interface CreateAuthUserInput {
+  email: string;
+  password: string;
+  firstName?: string;
+  lastName?: string;
+}
+interface WebhookDashboardInfo {
+  url: string;
+}
+interface Auth extends ProviderIdentity {
+  readonly key: "auth";
+  /** Env-var keys the runtime app needs. */
+  describe(): Promise<AuthDescription>;
+  /** Reachability probe — proves the configured key works. */
+  whoami(): Promise<AuthIdentity>;
+  /** Idempotent webhook backend provisioning (Clerk: Svix app). */
+  ensureWebhookApp?(): Promise<{
+    alreadyExists: boolean;
+  }>;
+  /** Deep-link to the provider's webhook config dashboard. */
+  getWebhookDashboardUrl?(): Promise<WebhookDashboardInfo>;
+  /** Seed a user (test fixtures, admin bootstrap). */
+  createUser?(input: CreateAuthUserInput): Promise<AuthUser>;
+  /** Wire the auth provider's webhook into the project's repo. */
+  syncWebhook?(input: {
+    repo: string;
+    secretRef: string;
+  }): Promise<void>;
+}
+type AuthEventType = "user.created" | "user.updated" | "user.deleted";
+interface NormalizedAuthUser {
+  id: string;
+  email: string;
+  firstName?: string | null;
+  lastName?: string | null;
+  /** Provider-native fields preserved verbatim for consumers that need them. */
+  raw?: Record<string, unknown>;
+}
+interface AuthEvent {
+  type: AuthEventType;
+  user: NormalizedAuthUser;
+  /** ISO timestamp of when the event occurred. */
+  occurredAt: string;
+}
+interface ParseWebhookInput {
+  /** Raw request body (string or Buffer). */
+  body: string | Buffer;
+  /** Incoming HTTP headers — needed for signature verification. */
+  headers: Record<string, string | string[] | undefined>;
+  /** The signing secret the auth provider issued for this webhook endpoint. */
+  signingSecret: string;
+}
+declare class WebhookVerificationError extends Error {
+  name: string;
+}
+interface Vault extends ProviderIdentity {
+  readonly key: "vault";
+  /**
+   * Read a secret by reference. The reference format is
+   * provider-specific (1P: "op://Vault/Item/field"; HashiCorp Vault:
+   * "kv/path#field"; etc.). Adapters validate the reference shape.
+   */
+  read(reference: string): Promise<string>;
+  /** Write or update a secret. */
+  write(reference: string, value: string): Promise<void>;
+  /** List secret keys available to the project. */
+  list(): Promise<string[]>;
+  /**
+   * Optional environment notion within the vault (e.g., 1P
+   * Environments — named KEY=VALUE bundles). Adapters without
+   * environments return [].
+   */
+  environments?(): Promise<string[]>;
+  /**
+   * Optional bulk read of an environment's KEY=VALUE pairs. Powers
+   * the `holocron secrets sync` flow where the orchestrator pulls a
+   * whole environment from the vault then fans the values out to
+   * destinations (CI secrets, deployment env vars, local .env).
+   */
+  readEnvironment?(environmentId: string): Promise<Record<string, string>>;
+}
+type DnsRecordType = "A" | "AAAA" | "CNAME" | "TXT" | "MX" | "NS" | "SRV" | "CAA";
+interface DnsRecord {
+  id?: string;
+  type: DnsRecordType;
+  name: string;
+  content: string;
+  ttl?: number;
+  priority?: number;
+}
+interface Dns extends ProviderIdentity {
+  readonly key: "dns";
+  listRecords(domain: string): Promise<DnsRecord[]>;
+  upsertRecord(domain: string, record: DnsRecord): Promise<DnsRecord>;
+  deleteRecord(domain: string, id: string): Promise<void>;
+}
+interface ToolingDoctorReport {
+  ok: boolean;
+  message: string;
+}
+interface Tooling extends ProviderIdentity {
+  readonly key: "tooling";
+  /** Sync the tool's authoritative state from the repo. */
+  sync(): Promise<void>;
+  doctor(): Promise<ToolingDoctorReport>;
+}
+interface Notifications extends ProviderIdentity {
+  readonly key: "notifications";
+  /**
+   * Send a message. `channel` is provider-specific (Slack channel id,
+   * Discord webhook url-name, etc.); adapters resolve from config.
+   */
+  send(channel: string, message: string): Promise<void>;
+}
+interface Analytics extends ProviderIdentity {
+  readonly key: "analytics";
+  describe(): Promise<{
+    provider: string;
+    dsnEnvKey: string;
+  }>;
+}
+interface Observability extends ProviderIdentity {
+  readonly key: "observability";
+  describe(): Promise<{
+    provider: string;
+    dsnEnvKey: string;
+  }>;
+}
+interface CapabilityImpls {
+  source: Source;
+  ci: Ci;
+  secrets: Secrets;
+  environments: Environments;
+  issues: Issues;
+  deployment: Deployment;
+  storage: Storage;
+  auth: Auth;
+  vault: Vault;
+  dns: Dns;
+  tooling: Tooling;
+  notifications: Notifications;
+  analytics: Analytics;
+  observability: Observability;
+}
+type CardinalityFor<K extends CapabilityKey> = (typeof CARDINALITY)[K];
+/** Resolved runtime shape: single → one impl; many → array. */
+type ResolvedCapability<K extends CapabilityKey> = CardinalityFor<K> extends "many" ? CapabilityImpls[K][] : CapabilityImpls[K];
+declare function isMulti<K extends CapabilityKey>(key: K): CardinalityFor<K> extends "many" ? true : false;
+//#endregion
+export { Tooling as $, Environments as A, ProviderApiError as B, DeploymentTarget as C, DnsRecordType as D, DnsRecord as E, LifecycleSlot as F, ResolvedCapability as G, REQUIRED_CAPABILITIES as H, NormalizedAuthUser as I, Secrets as J, Ruleset as K, Notifications as L, IssueSearchFilter as M, Issues as N, Environment as O, LifecycleResult as P, StorageBranch as Q, Observability as R, DeploymentRecord as S, Dns as T, RepoRef as U, ProviderIdentity as V, RepoSettings as W, StatusCategory as X, Source as Y, Storage as Z, ConnectionStringOptions as _, AuthEventType as a, WebhookVerificationError as at, DeploymentProject as b, CARDINALITY as c, Cardinality as d, ToolingDoctorReport as et, CardinalityFor as f, CiRunStatus as g, CiRunFilter as h, AuthEvent as i, WebhookDashboardInfo as it, Issue as j, EnvironmentReviewer as k, CapabilityImpls as l, CiRun as m, Auth as n, TrackerUser as nt, AuthIdentity as o, isMulti as ot, Ci as p, SecretScope as q, AuthDescription as r, Vault as rt, AuthUser as s, Analytics as t, TrackerDoctorReport as tt, CapabilityKey as u, CreateAuthUserInput as v, DeploymentTrigger as w, DeploymentProjectSettings as x, Deployment as y, ParseWebhookInput as z };

package/dist/index.d.mts

@@ -0,0 +1,58 @@
+import { $ as Tooling, A as Environments, B as ProviderApiError, C as DeploymentTarget, D as DnsRecordType, E as DnsRecord, F as LifecycleSlot, G as ResolvedCapability, H as REQUIRED_CAPABILITIES, I as NormalizedAuthUser, J as Secrets, K as Ruleset, L as Notifications, M as IssueSearchFilter, N as Issues, O as Environment, P as LifecycleResult, Q as StorageBranch, R as Observability, S as DeploymentRecord, T as Dns, U as RepoRef, V as ProviderIdentity, W as RepoSettings, X as StatusCategory, Y as Source, Z as Storage, _ as ConnectionStringOptions, a as AuthEventType, at as WebhookVerificationError, b as DeploymentProject, c as CARDINALITY, d as Cardinality, et as ToolingDoctorReport, f as CardinalityFor, g as CiRunStatus, h as CiRunFilter, i as AuthEvent, it as WebhookDashboardInfo, j as Issue, k as EnvironmentReviewer, l as CapabilityImpls, m as CiRun, n as Auth, nt as TrackerUser, o as AuthIdentity, ot as isMulti, p as Ci, q as SecretScope, r as AuthDescription, rt as Vault, s as AuthUser, t as Analytics, tt as TrackerDoctorReport, u as CapabilityKey, v as CreateAuthUserInput, w as DeploymentTrigger, x as DeploymentProjectSettings, y as Deployment, z as ParseWebhookInput } from "./index-CSxf0Yc7.mjs";
+
+//#region src/config.d.ts
+type ProviderOptions = Record<string, unknown>;
+type SingleEntry = string | [provider: string, options: ProviderOptions];
+type MultiEntry = Array<string | [provider: string, options: ProviderOptions]>;
+type RawProviderEntry = SingleEntry | MultiEntry;
+type RawProvidersConfig = Partial<Record<CapabilityKey, RawProviderEntry>>;
+interface AppConfig {
+  name: string;
+  path: string;
+  kind?: string;
+}
+interface DoctorConfig {
+  checks?: string[];
+}
+interface HolocronConfig {
+  project: {
+    name: string;
+    description?: string;
+  };
+  providers: RawProvidersConfig;
+  apps?: AppConfig[];
+  doctor?: DoctorConfig;
+}
+interface ResolvedTuple {
+  provider: string;
+  /** Resolved package name (`@theholocron/holocron-plugin-<provider>` for short refs). */
+  packageName: string;
+  options: ProviderOptions;
+}
+type ResolvedProviderEntry = {
+  cardinality: "single";
+  tuple: ResolvedTuple;
+} | {
+  cardinality: "many";
+  tuples: ResolvedTuple[];
+};
+type ResolvedProvidersConfig = Partial<Record<CapabilityKey, ResolvedProviderEntry>>;
+interface ResolvedHolocronConfig {
+  project: HolocronConfig["project"];
+  providers: ResolvedProvidersConfig;
+  apps: AppConfig[];
+  doctor: DoctorConfig;
+}
+declare class ConfigError extends Error {
+  name: string;
+}
+/**
+ * Resolve `"github"` → `"@theholocron/holocron-plugin-github"`.
+ * Fully-qualified names (scoped or not) are honored verbatim, which
+ * is how third-party plugins published outside the org work.
+ */
+declare function resolvePluginPackage(provider: string): string;
+declare function resolveEntry(key: CapabilityKey, raw: RawProviderEntry): ResolvedProviderEntry;
+declare function resolveConfig(raw: HolocronConfig): ResolvedHolocronConfig;
+//#endregion
+export { Analytics, AppConfig, Auth, AuthDescription, AuthEvent, AuthEventType, AuthIdentity, AuthUser, CARDINALITY, CapabilityImpls, CapabilityKey, Cardinality, CardinalityFor, Ci, CiRun, CiRunFilter, CiRunStatus, ConfigError, ConnectionStringOptions, CreateAuthUserInput, Deployment, DeploymentProject, DeploymentProjectSettings, DeploymentRecord, DeploymentTarget, DeploymentTrigger, Dns, DnsRecord, DnsRecordType, DoctorConfig, Environment, EnvironmentReviewer, Environments, HolocronConfig, Issue, IssueSearchFilter, Issues, LifecycleResult, LifecycleSlot, MultiEntry, NormalizedAuthUser, Notifications, Observability, ParseWebhookInput, ProviderApiError, ProviderIdentity, ProviderOptions, REQUIRED_CAPABILITIES, RawProviderEntry, RawProvidersConfig, RepoRef, RepoSettings, ResolvedCapability, ResolvedHolocronConfig, ResolvedProviderEntry, ResolvedProvidersConfig, ResolvedTuple, Ruleset, SecretScope, Secrets, SingleEntry, Source, StatusCategory, Storage, StorageBranch, Tooling, ToolingDoctorReport, TrackerDoctorReport, TrackerUser, Vault, WebhookDashboardInfo, WebhookVerificationError, isMulti, resolveConfig, resolveEntry, resolvePluginPackage };

package/dist/index.mjs

@@ -0,0 +1,3 @@
+import { a as isMulti, i as WebhookVerificationError, n as ProviderApiError, r as REQUIRED_CAPABILITIES, t as CARDINALITY } from "./capabilities-QjjhVlDd.mjs";
+import { i as resolvePluginPackage, n as resolveConfig, r as resolveEntry, t as ConfigError } from "./config-DWlIfFZm.mjs";
+export { CARDINALITY, ConfigError, ProviderApiError, REQUIRED_CAPABILITIES, WebhookVerificationError, isMulti, resolveConfig, resolveEntry, resolvePluginPackage };