@theholocron/cli 2.0.0-alpha.0 → 2.0.0-alpha.1

package/README.md

@@ -3,22 +3,26 @@
 The Holocron CLI — a pluggable, capability-based orchestrator for
 spinning up and operating software projects.
 
-## Status
+## Install
 
-**v2 alpha.** The shape is being built up per
-[`.notes/tech-architecture.spec.md`](../../.notes/tech-architecture.spec.md).
-Most commands aren't wired yet.
+```bash
+npm i -g @theholocron/cli@alpha
+holocron --help
+```
 
 ## What's in here
 
 - `src/capabilities/` — the 14 capability interfaces that providers
-  implement
+	implement
 - `src/config.ts` — `holocron.config.json` parser + plugin resolution
-- `src/cli.ts` — yargs entry, dispatches subcommands (WIP)
+- `src/cli.ts` — yargs entry, dispatches subcommands
+- `src/commands/` — `setup`, `doctor`, `deploy`, `secret set`,
+	`secrets sync`, `npm publish-initial`
 
-## Install (when published)
+## Status
 
-```bash
-pnpm add -D @theholocron/cli
-pnpm holocron --help
-```
+**`v2.0.0-alpha.0`** — published on npm under the `alpha` dist-tag.
+[Release notes](https://github.com/theholocron/holocron/releases/tag/v2.0.0-alpha.0).
+Design in
+[`.notes/tech-architecture.spec.md`](../../.notes/tech-architecture.spec.md).
+APIs may still shift before stable v2.0.0.

package/dist/capabilities/index.d.mts

@@ -1,2 +1,2 @@
-import { $ as Tooling, A as Environments, B as ProviderApiError, C as DeploymentTarget, D as DnsRecordType, E as DnsRecord, F as LifecycleSlot, G as ResolvedCapability, H as REQUIRED_CAPABILITIES, I as NormalizedAuthUser, J as Secrets, K as Ruleset, L as Notifications, M as IssueSearchFilter, N as Issues, O as Environment, P as LifecycleResult, Q as StorageBranch, R as Observability, S as DeploymentRecord, T as Dns, U as RepoRef, V as ProviderIdentity, W as RepoSettings, X as StatusCategory, Y as Source, Z as Storage, _ as ConnectionStringOptions, a as AuthEventType, at as WebhookVerificationError, b as DeploymentProject, c as CARDINALITY, d as Cardinality, et as ToolingDoctorReport, f as CardinalityFor, g as CiRunStatus, h as CiRunFilter, i as AuthEvent, it as WebhookDashboardInfo, j as Issue, k as EnvironmentReviewer, l as CapabilityImpls, m as CiRun, n as Auth, nt as TrackerUser, o as AuthIdentity, ot as isMulti, p as Ci, q as SecretScope, r as AuthDescription, rt as Vault, s as AuthUser, t as Analytics, tt as TrackerDoctorReport, u as CapabilityKey, v as CreateAuthUserInput, w as DeploymentTrigger, x as DeploymentProjectSettings, y as Deployment, z as ParseWebhookInput } from "../index-DDxKXqtR.mjs";
+import { $ as Tooling, A as Environments, B as ProviderApiError, C as DeploymentTarget, D as DnsRecordType, E as DnsRecord, F as LifecycleSlot, G as ResolvedCapability, H as REQUIRED_CAPABILITIES, I as NormalizedAuthUser, J as Secrets, K as Ruleset, L as Notifications, M as IssueSearchFilter, N as Issues, O as Environment, P as LifecycleResult, Q as StorageBranch, R as Observability, S as DeploymentRecord, T as Dns, U as RepoRef, V as ProviderIdentity, W as RepoSettings, X as StatusCategory, Y as Source, Z as Storage, _ as ConnectionStringOptions, a as AuthEventType, at as WebhookVerificationError, b as DeploymentProject, c as CARDINALITY, d as Cardinality, et as ToolingDoctorReport, f as CardinalityFor, g as CiRunStatus, h as CiRunFilter, i as AuthEvent, it as WebhookDashboardInfo, j as Issue, k as EnvironmentReviewer, l as CapabilityImpls, m as CiRun, n as Auth, nt as TrackerUser, o as AuthIdentity, ot as isMulti, p as Ci, q as SecretScope, r as AuthDescription, rt as Vault, s as AuthUser, t as Analytics, tt as TrackerDoctorReport, u as CapabilityKey, v as CreateAuthUserInput, w as DeploymentTrigger, x as DeploymentProjectSettings, y as Deployment, z as ParseWebhookInput } from "../index-CSxf0Yc7.mjs";
 export { Analytics, Auth, AuthDescription, AuthEvent, AuthEventType, AuthIdentity, AuthUser, CARDINALITY, CapabilityImpls, CapabilityKey, Cardinality, CardinalityFor, Ci, CiRun, CiRunFilter, CiRunStatus, ConnectionStringOptions, CreateAuthUserInput, Deployment, DeploymentProject, DeploymentProjectSettings, DeploymentRecord, DeploymentTarget, DeploymentTrigger, Dns, DnsRecord, DnsRecordType, Environment, EnvironmentReviewer, Environments, Issue, IssueSearchFilter, Issues, LifecycleResult, LifecycleSlot, NormalizedAuthUser, Notifications, Observability, ParseWebhookInput, ProviderApiError, ProviderIdentity, REQUIRED_CAPABILITIES, RepoRef, RepoSettings, ResolvedCapability, Ruleset, SecretScope, Secrets, Source, StatusCategory, Storage, StorageBranch, Tooling, ToolingDoctorReport, TrackerDoctorReport, TrackerUser, Vault, WebhookDashboardInfo, WebhookVerificationError, isMulti };

package/dist/cli.mjs

@@ -233,11 +233,25 @@ async function runNpmPublishInitial(input = {}) {
 	const cwd = input.cwd ?? process.cwd();
 	const tag = input.tag ?? "alpha";
 	const dryRun = input.dryRun ?? false;
+	const otp = input.otp;
 	const env = input.env ?? process.env;
 	const exec = input.exec ?? defaultExec;
+	const publishArgs = [
+		"-r",
+		"--filter=./packages/*",
+		"--filter=!@theholocron/cli-utils",
+		"publish",
+		"--access",
+		"public",
+		"--no-git-checks",
+		"--tag",
+		tag,
+		...otp ? ["--otp", otp] : []
+	];
 	print(`Holocron npm publish-initial${dryRun ? " (dry-run)" : ""}`);
 	print(`  cwd: ${cwd}`);
 	print(`  tag: ${tag}`);
+	if (otp) print(`  otp: <${otp.length} chars>`);
 	print("");
 	print("  → verifying npm auth (`npm whoami`)…");
 	const whoami = await exec("npm", ["whoami"], { cwd });
@@ -254,7 +268,7 @@ async function runNpmPublishInitial(input = {}) {
 	if (dryRun) {
 		print("");
 		print("  … (dry-run) skipping actual publish");
-		print(`    would run: pnpm -r --filter='./packages/*' --filter='!@theholocron/cli-utils' publish --access public --no-git-checks --tag ${tag}`);
+		print(`    would run: pnpm ${publishArgs.join(" ")}`);
 		printNextSteps(print, env);
 		return {
 			status: "dry-run",
@@ -264,20 +278,15 @@ async function runNpmPublishInitial(input = {}) {
 	}
 	print("");
 	print("  → publishing all public @theholocron/* packages…");
-	const publish = await exec("pnpm", [
-		"-r",
-		"--filter=./packages/*",
-		"--filter=!@theholocron/cli-utils",
-		"publish",
-		"--access",
-		"public",
-		"--no-git-checks",
-		"--tag",
-		tag
-	], { cwd });
+	const publish = await exec("pnpm", publishArgs, { cwd });
 	if (publish.exitCode !== 0) {
 		const message = `publish failed (exit ${publish.exitCode}): ${publish.stderr.trim() || publish.stdout.trim() || "no output"}`;
 		print(`  ✗ ${message}`);
+		if (publish.stdout.includes("EOTP") || publish.stderr.includes("EOTP")) {
+			print("");
+			print("  → hint: your npm account requires 2FA for writes. Re-run with `--otp <code>`:");
+			print(`    pnpm exec tsx packages/cli/src/cli.ts npm publish-initial --otp <6-digit-code>`);
+		}
 		return {
 			status: "fail",
 			message,
@@ -810,11 +819,15 @@ await yargs(hideBin(process.argv)).scriptName("holocron").usage("$0 <command> [o
 	type: "string",
 	default: "alpha",
 	describe: "npm distribution tag (defaults to alpha)"
+}).option("otp", {
+	type: "string",
+	describe: "One-time password from your authenticator (required if npm needs 2FA for writes)"
 }), async (argv) => {
 	if ((await runNpmPublishInitial({
 		cwd: argv.cwd,
 		tag: argv.tag,
-		dryRun: argv.dryRun
+		dryRun: argv.dryRun,
+		...argv.otp ? { otp: argv.otp } : {}
 	})).status === "fail") process.exitCode = 1;
 }).command("config show", "Print the resolved holocron config", () => {}, async (argv) => {
 	const loaded = await loadConfig(argv.cwd);

package/dist/{index-DDxKXqtR.d.mts → index-CSxf0Yc7.d.mts}

@@ -11,8 +11,8 @@
  * See `.notes/tech-architecture.spec.md` for the design narrative
  * (status: proposed, issue: #74).
  */
-type CapabilityKey = 'source' | 'ci' | 'secrets' | 'environments' | 'issues' | 'deployment' | 'storage' | 'auth' | 'vault' | 'dns' | 'tooling' | 'notifications' | 'analytics' | 'observability';
-type Cardinality = 'single' | 'many';
+type CapabilityKey = "source" | "ci" | "secrets" | "environments" | "issues" | "deployment" | "storage" | "auth" | "vault" | "dns" | "tooling" | "notifications" | "analytics" | "observability";
+type Cardinality = "single" | "many";
 declare const CARDINALITY: {
   readonly source: "single";
   readonly ci: "single";
@@ -50,7 +50,7 @@ declare class ProviderApiError extends Error {
 interface Ruleset {
   id: number;
   name: string;
-  enforcement: 'active' | 'evaluate' | 'disabled';
+  enforcement: "active" | "evaluate" | "disabled";
   target?: string;
 }
 interface RepoSettings {
@@ -69,7 +69,7 @@ interface RepoRef {
   defaultBranch: string;
 }
 interface Source extends ProviderIdentity {
-  readonly key: 'source';
+  readonly key: "source";
   /** Auth sanity-check. Throws ProviderApiError on auth failure. */
   whoami(): Promise<{
     login: string;
@@ -88,7 +88,7 @@ interface Source extends ProviderIdentity {
   writeWorkflowFile(name: string, contents: string): Promise<void>;
   removeWorkflowFile(name: string): Promise<void>;
 }
-type CiRunStatus = 'queued' | 'in_progress' | 'completed' | 'cancelled' | 'failure' | 'success' | 'skipped';
+type CiRunStatus = "queued" | "in_progress" | "completed" | "cancelled" | "failure" | "success" | "skipped";
 interface CiRun {
   id: string | number;
   workflowName: string;
@@ -105,21 +105,21 @@ interface CiRunFilter {
   limit?: number;
 }
 interface Ci extends ProviderIdentity {
-  readonly key: 'ci';
+  readonly key: "ci";
   listRuns(filter?: CiRunFilter): Promise<CiRun[]>;
   getRun(id: string | number): Promise<CiRun>;
 }
 type SecretScope = {
-  kind: 'repo';
+  kind: "repo";
 } | {
-  kind: 'environment';
+  kind: "environment";
   name: string;
 } | {
-  kind: 'organization';
+  kind: "organization";
   name: string;
 };
 interface Secrets extends ProviderIdentity {
-  readonly key: 'secrets';
+  readonly key: "secrets";
   /** List secret NAMES (not values) at the given scope. */
   listSecrets(scope: SecretScope): Promise<string[]>;
   /** Idempotent upsert. Adapter handles encryption. */
@@ -127,7 +127,7 @@ interface Secrets extends ProviderIdentity {
   deleteSecret(scope: SecretScope, name: string): Promise<void>;
 }
 interface EnvironmentReviewer {
-  type: 'User' | 'Team';
+  type: "User" | "Team";
   /** Numeric id — GitHub's reviewer API silently ignores login strings. */
   id: number;
 }
@@ -138,13 +138,13 @@ interface Environment {
   preventSelfReview?: boolean;
 }
 interface Environments extends ProviderIdentity {
-  readonly key: 'environments';
+  readonly key: "environments";
   listEnvironments(): Promise<Environment[]>;
   upsertEnvironment(env: Environment): Promise<void>;
   deleteEnvironment(name: string): Promise<void>;
 }
-type LifecycleSlot = 'inProgress' | 'inReview' | 'done';
-type StatusCategory = 'open' | 'in-progress' | 'in-review' | 'done' | 'other';
+type LifecycleSlot = "inProgress" | "inReview" | "done";
+type StatusCategory = "open" | "in-progress" | "in-review" | "done" | "other";
 interface TrackerUser {
   id: string;
   displayName: string;
@@ -165,7 +165,7 @@ interface Issue {
 }
 interface IssueSearchFilter {
   /** Restrict to issues assigned to a specific id, or 'currentUser'. */
-  assignee?: string | 'currentUser';
+  assignee?: string | "currentUser";
   /** Exclude issues in the `done` category. */
   openOnly?: boolean;
   /** Max number of issues to return. Adapters apply a sensible default. */
@@ -202,7 +202,7 @@ interface TrackerDoctorReport {
   }>;
 }
 interface Issues extends ProviderIdentity {
-  readonly key: 'issues';
+  readonly key: "issues";
   /** Currently-authenticated user. */
   getMyself(): Promise<TrackerUser>;
   search(filter: IssueSearchFilter): Promise<Issue[]>;
@@ -221,12 +221,12 @@ interface Issues extends ProviderIdentity {
   doctor(): Promise<TrackerDoctorReport>;
 }
 /** Env-var scope on the deploy platform. */
-type DeploymentTarget = 'development' | 'preview' | 'production';
+type DeploymentTarget = "development" | "preview" | "production";
 /**
  * Named deployment trigger target — `undefined` means a branch
  * preview (no named environment).
  */
-type DeploymentTrigger = 'production' | 'staging';
+type DeploymentTrigger = "production" | "staging";
 interface DeploymentProject {
   id: string;
   name: string;
@@ -248,10 +248,10 @@ interface DeploymentRecord {
   branch: string | null;
   /** Named environment if one was targeted; undefined for branch previews. */
   target?: DeploymentTrigger;
-  status: 'queued' | 'building' | 'ready' | 'error' | 'cancelled';
+  status: "queued" | "building" | "ready" | "error" | "cancelled";
 }
 interface Deployment extends ProviderIdentity {
-  readonly key: 'deployment';
+  readonly key: "deployment";
   listProjects(): Promise<DeploymentProject[]>;
   /** Create if missing, otherwise return existing. Idempotent. */
   ensureProject(input: {
@@ -287,7 +287,7 @@ interface ConnectionStringOptions {
   pooled?: boolean;
 }
 interface Storage extends ProviderIdentity {
-  readonly key: 'storage';
+  readonly key: "storage";
   /**
    * Connection string for the given scope. Scope is provider-specific:
    *
@@ -343,7 +343,7 @@ interface WebhookDashboardInfo {
   url: string;
 }
 interface Auth extends ProviderIdentity {
-  readonly key: 'auth';
+  readonly key: "auth";
   /** Env-var keys the runtime app needs. */
   describe(): Promise<AuthDescription>;
   /** Reachability probe — proves the configured key works. */
@@ -362,7 +362,7 @@ interface Auth extends ProviderIdentity {
     secretRef: string;
   }): Promise<void>;
 }
-type AuthEventType = 'user.created' | 'user.updated' | 'user.deleted';
+type AuthEventType = "user.created" | "user.updated" | "user.deleted";
 interface NormalizedAuthUser {
   id: string;
   email: string;
@@ -389,7 +389,7 @@ declare class WebhookVerificationError extends Error {
   name: string;
 }
 interface Vault extends ProviderIdentity {
-  readonly key: 'vault';
+  readonly key: "vault";
   /**
    * Read a secret by reference. The reference format is
    * provider-specific (1P: "op://Vault/Item/field"; HashiCorp Vault:
@@ -414,7 +414,7 @@ interface Vault extends ProviderIdentity {
    */
   readEnvironment?(environmentId: string): Promise<Record<string, string>>;
 }
-type DnsRecordType = 'A' | 'AAAA' | 'CNAME' | 'TXT' | 'MX' | 'NS' | 'SRV' | 'CAA';
+type DnsRecordType = "A" | "AAAA" | "CNAME" | "TXT" | "MX" | "NS" | "SRV" | "CAA";
 interface DnsRecord {
   id?: string;
   type: DnsRecordType;
@@ -424,7 +424,7 @@ interface DnsRecord {
   priority?: number;
 }
 interface Dns extends ProviderIdentity {
-  readonly key: 'dns';
+  readonly key: "dns";
   listRecords(domain: string): Promise<DnsRecord[]>;
   upsertRecord(domain: string, record: DnsRecord): Promise<DnsRecord>;
   deleteRecord(domain: string, id: string): Promise<void>;
@@ -434,13 +434,13 @@ interface ToolingDoctorReport {
   message: string;
 }
 interface Tooling extends ProviderIdentity {
-  readonly key: 'tooling';
+  readonly key: "tooling";
   /** Sync the tool's authoritative state from the repo. */
   sync(): Promise<void>;
   doctor(): Promise<ToolingDoctorReport>;
 }
 interface Notifications extends ProviderIdentity {
-  readonly key: 'notifications';
+  readonly key: "notifications";
   /**
    * Send a message. `channel` is provider-specific (Slack channel id,
    * Discord webhook url-name, etc.); adapters resolve from config.
@@ -448,14 +448,14 @@ interface Notifications extends ProviderIdentity {
   send(channel: string, message: string): Promise<void>;
 }
 interface Analytics extends ProviderIdentity {
-  readonly key: 'analytics';
+  readonly key: "analytics";
   describe(): Promise<{
     provider: string;
     dsnEnvKey: string;
   }>;
 }
 interface Observability extends ProviderIdentity {
-  readonly key: 'observability';
+  readonly key: "observability";
   describe(): Promise<{
     provider: string;
     dsnEnvKey: string;
@@ -479,7 +479,7 @@ interface CapabilityImpls {
 }
 type CardinalityFor<K extends CapabilityKey> = (typeof CARDINALITY)[K];
 /** Resolved runtime shape: single → one impl; many → array. */
-type ResolvedCapability<K extends CapabilityKey> = CardinalityFor<K> extends 'many' ? CapabilityImpls[K][] : CapabilityImpls[K];
-declare function isMulti<K extends CapabilityKey>(key: K): CardinalityFor<K> extends 'many' ? true : false;
+type ResolvedCapability<K extends CapabilityKey> = CardinalityFor<K> extends "many" ? CapabilityImpls[K][] : CapabilityImpls[K];
+declare function isMulti<K extends CapabilityKey>(key: K): CardinalityFor<K> extends "many" ? true : false;
 //#endregion
 export { Tooling as $, Environments as A, ProviderApiError as B, DeploymentTarget as C, DnsRecordType as D, DnsRecord as E, LifecycleSlot as F, ResolvedCapability as G, REQUIRED_CAPABILITIES as H, NormalizedAuthUser as I, Secrets as J, Ruleset as K, Notifications as L, IssueSearchFilter as M, Issues as N, Environment as O, LifecycleResult as P, StorageBranch as Q, Observability as R, DeploymentRecord as S, Dns as T, RepoRef as U, ProviderIdentity as V, RepoSettings as W, StatusCategory as X, Source as Y, Storage as Z, ConnectionStringOptions as _, AuthEventType as a, WebhookVerificationError as at, DeploymentProject as b, CARDINALITY as c, Cardinality as d, ToolingDoctorReport as et, CardinalityFor as f, CiRunStatus as g, CiRunFilter as h, AuthEvent as i, WebhookDashboardInfo as it, Issue as j, EnvironmentReviewer as k, CapabilityImpls as l, CiRun as m, Auth as n, TrackerUser as nt, AuthIdentity as o, isMulti as ot, Ci as p, SecretScope as q, AuthDescription as r, Vault as rt, AuthUser as s, Analytics as t, TrackerDoctorReport as tt, CapabilityKey as u, CreateAuthUserInput as v, DeploymentTrigger as w, DeploymentProjectSettings as x, Deployment as y, ParseWebhookInput as z };

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { $ as Tooling, A as Environments, B as ProviderApiError, C as DeploymentTarget, D as DnsRecordType, E as DnsRecord, F as LifecycleSlot, G as ResolvedCapability, H as REQUIRED_CAPABILITIES, I as NormalizedAuthUser, J as Secrets, K as Ruleset, L as Notifications, M as IssueSearchFilter, N as Issues, O as Environment, P as LifecycleResult, Q as StorageBranch, R as Observability, S as DeploymentRecord, T as Dns, U as RepoRef, V as ProviderIdentity, W as RepoSettings, X as StatusCategory, Y as Source, Z as Storage, _ as ConnectionStringOptions, a as AuthEventType, at as WebhookVerificationError, b as DeploymentProject, c as CARDINALITY, d as Cardinality, et as ToolingDoctorReport, f as CardinalityFor, g as CiRunStatus, h as CiRunFilter, i as AuthEvent, it as WebhookDashboardInfo, j as Issue, k as EnvironmentReviewer, l as CapabilityImpls, m as CiRun, n as Auth, nt as TrackerUser, o as AuthIdentity, ot as isMulti, p as Ci, q as SecretScope, r as AuthDescription, rt as Vault, s as AuthUser, t as Analytics, tt as TrackerDoctorReport, u as CapabilityKey, v as CreateAuthUserInput, w as DeploymentTrigger, x as DeploymentProjectSettings, y as Deployment, z as ParseWebhookInput } from "./index-DDxKXqtR.mjs";
+import { $ as Tooling, A as Environments, B as ProviderApiError, C as DeploymentTarget, D as DnsRecordType, E as DnsRecord, F as LifecycleSlot, G as ResolvedCapability, H as REQUIRED_CAPABILITIES, I as NormalizedAuthUser, J as Secrets, K as Ruleset, L as Notifications, M as IssueSearchFilter, N as Issues, O as Environment, P as LifecycleResult, Q as StorageBranch, R as Observability, S as DeploymentRecord, T as Dns, U as RepoRef, V as ProviderIdentity, W as RepoSettings, X as StatusCategory, Y as Source, Z as Storage, _ as ConnectionStringOptions, a as AuthEventType, at as WebhookVerificationError, b as DeploymentProject, c as CARDINALITY, d as Cardinality, et as ToolingDoctorReport, f as CardinalityFor, g as CiRunStatus, h as CiRunFilter, i as AuthEvent, it as WebhookDashboardInfo, j as Issue, k as EnvironmentReviewer, l as CapabilityImpls, m as CiRun, n as Auth, nt as TrackerUser, o as AuthIdentity, ot as isMulti, p as Ci, q as SecretScope, r as AuthDescription, rt as Vault, s as AuthUser, t as Analytics, tt as TrackerDoctorReport, u as CapabilityKey, v as CreateAuthUserInput, w as DeploymentTrigger, x as DeploymentProjectSettings, y as Deployment, z as ParseWebhookInput } from "./index-CSxf0Yc7.mjs";
 
 //#region src/config.d.ts
 type ProviderOptions = Record<string, unknown>;
@@ -30,15 +30,15 @@ interface ResolvedTuple {
   options: ProviderOptions;
 }
 type ResolvedProviderEntry = {
-  cardinality: 'single';
+  cardinality: "single";
   tuple: ResolvedTuple;
 } | {
-  cardinality: 'many';
+  cardinality: "many";
   tuples: ResolvedTuple[];
 };
 type ResolvedProvidersConfig = Partial<Record<CapabilityKey, ResolvedProviderEntry>>;
 interface ResolvedHolocronConfig {
-  project: HolocronConfig['project'];
+  project: HolocronConfig["project"];
   providers: ResolvedProvidersConfig;
   apps: AppConfig[];
   doctor: DoctorConfig;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theholocron/cli",
-  "version": "2.0.0-alpha.0",
+  "version": "2.0.0-alpha.1",
   "description": "The Holocron CLI — a pluggable, capability-based orchestrator for spinning up and operating software projects.",
   "homepage": "https://github.com/theholocron/holocron/tree/main/packages/cli#readme",
   "bugs": "https://github.com/theholocron/holocron/issues",