@theholocron/cli 2.0.0-alpha.1 → 2.0.0-alpha.11

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { $ as Tooling, A as Environments, B as ProviderApiError, C as DeploymentTarget, D as DnsRecordType, E as DnsRecord, F as LifecycleSlot, G as ResolvedCapability, H as REQUIRED_CAPABILITIES, I as NormalizedAuthUser, J as Secrets, K as Ruleset, L as Notifications, M as IssueSearchFilter, N as Issues, O as Environment, P as LifecycleResult, Q as StorageBranch, R as Observability, S as DeploymentRecord, T as Dns, U as RepoRef, V as ProviderIdentity, W as RepoSettings, X as StatusCategory, Y as Source, Z as Storage, _ as ConnectionStringOptions, a as AuthEventType, at as WebhookVerificationError, b as DeploymentProject, c as CARDINALITY, d as Cardinality, et as ToolingDoctorReport, f as CardinalityFor, g as CiRunStatus, h as CiRunFilter, i as AuthEvent, it as WebhookDashboardInfo, j as Issue, k as EnvironmentReviewer, l as CapabilityImpls, m as CiRun, n as Auth, nt as TrackerUser, o as AuthIdentity, ot as isMulti, p as Ci, q as SecretScope, r as AuthDescription, rt as Vault, s as AuthUser, t as Analytics, tt as TrackerDoctorReport, u as CapabilityKey, v as CreateAuthUserInput, w as DeploymentTrigger, x as DeploymentProjectSettings, y as Deployment, z as ParseWebhookInput } from "./index-CSxf0Yc7.mjs";
+import { Analytics, Auth, AuthDescription, AuthEvent, AuthEventType, AuthIdentity, AuthUser, CARDINALITY, CapabilityImpls, CapabilityKey, Cardinality, CardinalityFor, Ci, CiRun, CiRunFilter, CiRunStatus, ConnectionStringOptions, CreateAuthUserInput, Deployment, DeploymentProject, DeploymentProjectSettings, DeploymentRecord, DeploymentTarget, DeploymentTrigger, Dns, DnsRecord, DnsRecordType, EnsureResult, Environment, EnvironmentReviewer, Environments, Issue, IssueSearchFilter, Issues, LifecycleResult, LifecycleSlot, NormalizedAuthUser, Notifications, Observability, ParseWebhookInput, ProviderApiError, ProviderIdentity, REQUIRED_CAPABILITIES, RepoRef, RepoSettings, ResolvedCapability, Ruleset, SecretScope, Secrets, Source, StatusCategory, Storage, StorageBranch, Tooling, ToolingDoctorReport, TrackerDoctorReport, TrackerUser, Vault, WebhookDashboardInfo, WebhookVerificationError, isMulti } from "./capabilities/index.mjs";
 
 //#region src/config.d.ts
 type ProviderOptions = Record<string, unknown>;
@@ -6,6 +6,22 @@ type SingleEntry = string | [provider: string, options: ProviderOptions];
 type MultiEntry = Array<string | [provider: string, options: ProviderOptions]>;
 type RawProviderEntry = SingleEntry | MultiEntry;
 type RawProvidersConfig = Partial<Record<CapabilityKey, RawProviderEntry>>;
+interface RepoPolicyConfig {
+  /**
+   * "balanced" — squash-only merges, delete-branch-on-merge, issues/discussions/projects
+   * enabled, auto-merge enabled, web sign-off required, always suggest updating, no wiki;
+   * plus a ruleset that blocks force-push + deletion and requires a pull request (0 reviews).
+   *
+   * "strict" — everything in "balanced" plus required status checks from `requiredChecks`.
+   *
+   * "none" — skips repo settings + ruleset entirely.
+   *
+   * @default "balanced"
+   */
+  preset?: "balanced" | "strict" | "none";
+  /** CI check context names required on the default branch (used by "strict"). */
+  requiredChecks?: string[];
+}
 interface AppConfig {
   name: string;
   path: string;
@@ -18,6 +34,38 @@ interface HolocronConfig {
   project: {
     name: string;
     description?: string;
+    /**
+     * Repo coord — `"owner/name"`. When set, `PluginLoader` injects
+     * it into every plugin's `RuntimeContext.repo` so plugins that
+     * need a repo (github, etc.) don't require `--repo` on every
+     * invocation. `--repo` on the command line still overrides.
+     */
+    repo?: string;
+    /**
+     * Repo-level policy applied by `holocron setup`. Defines merge
+     * strategy, branch protection rulesets, and security defaults.
+     * Requires `source` capability to be configured.
+     */
+    repoPolicy?: RepoPolicyConfig;
+    /**
+     * CI workflow names to install as thin wrappers during `holocron setup`.
+     * Each name maps to a reusable workflow in `theholocron/.github`.
+     * Use the object form to pass `with:` inputs to the reusable workflow.
+     *
+     * Supported values: "lint" | "test" | "typecheck" | "codeql" | "review" |
+     *   "release" | "stale" | "greetings" | "dependencies" | "bookkeeping-pr" | "audit"
+     *
+     * `holocron setup` writes `.github/workflows/<name>.yml` for each entry,
+     * calling the corresponding `ci-<name>.yml@main` reusable workflow.
+     * Files are overwritten on each run — they are generated artifacts.
+     *
+     * @example
+     * ["lint", { "name": "release", "with": { "run-build": false } }]
+     */
+    workflows?: Array<string | {
+      name: string;
+      with?: Record<string, unknown>;
+    }>;
   };
   providers: RawProvidersConfig;
   apps?: AppConfig[];
@@ -55,4 +103,48 @@ declare function resolvePluginPackage(provider: string): string;
 declare function resolveEntry(key: CapabilityKey, raw: RawProviderEntry): ResolvedProviderEntry;
 declare function resolveConfig(raw: HolocronConfig): ResolvedHolocronConfig;
 //#endregion
-export { Analytics, AppConfig, Auth, AuthDescription, AuthEvent, AuthEventType, AuthIdentity, AuthUser, CARDINALITY, CapabilityImpls, CapabilityKey, Cardinality, CardinalityFor, Ci, CiRun, CiRunFilter, CiRunStatus, ConfigError, ConnectionStringOptions, CreateAuthUserInput, Deployment, DeploymentProject, DeploymentProjectSettings, DeploymentRecord, DeploymentTarget, DeploymentTrigger, Dns, DnsRecord, DnsRecordType, DoctorConfig, Environment, EnvironmentReviewer, Environments, HolocronConfig, Issue, IssueSearchFilter, Issues, LifecycleResult, LifecycleSlot, MultiEntry, NormalizedAuthUser, Notifications, Observability, ParseWebhookInput, ProviderApiError, ProviderIdentity, ProviderOptions, REQUIRED_CAPABILITIES, RawProviderEntry, RawProvidersConfig, RepoRef, RepoSettings, ResolvedCapability, ResolvedHolocronConfig, ResolvedProviderEntry, ResolvedProvidersConfig, ResolvedTuple, Ruleset, SecretScope, Secrets, SingleEntry, Source, StatusCategory, Storage, StorageBranch, Tooling, ToolingDoctorReport, TrackerDoctorReport, TrackerUser, Vault, WebhookDashboardInfo, WebhookVerificationError, isMulti, resolveConfig, resolveEntry, resolvePluginPackage };
+//#region src/keyring.d.ts
+/**
+ * Keyring-backed bootstrap credential store.
+ *
+ * Every holocron plugin's bootstrap token (the one it needs before it
+ * can talk to its vendor's API) can be stored in the OS keyring under
+ * a single reverse-DNS service scope. Managed via `holocron auth`
+ * subcommands; consulted at position 4 in every plugin's auth
+ * precedence chain (after --token / HOLOCRON_<X>_TOKEN / <native>_TOKEN).
+ *
+ * See `.notes/tech-auth-bootstrap.spec.md` for the design rationale.
+ *
+ * Failure model: keyring access is best-effort. Platforms without a
+ * supported credential store (some Linux CI images, sandboxed
+ * environments) will throw from the underlying library. Every export
+ * here catches and returns a null/empty result rather than propagating
+ * — the plugin's precedence chain then falls through to
+ * env-var-only paths, which is exactly how CI is meant to work.
+ */
+/**
+ * Store or overwrite a bootstrap token for a provider. Returns true on
+ * success, false when the underlying keyring is unsupported or errored.
+ */
+declare function setToken(provider: string, token: string): boolean;
+/**
+ * Read the bootstrap token for a provider. Returns `null` for both
+ * "not stored" and "keyring unavailable" — callers can treat them the
+ * same way (fall through to env-var precedence).
+ */
+declare function getToken(provider: string): string | null;
+/**
+ * Delete a stored token. Returns true when a token was removed, false
+ * when there was nothing to delete or the keyring is unavailable.
+ * Distinguishing the two cases isn't worth the surface area — the
+ * command output makes the situation clear either way.
+ */
+declare function deleteToken(provider: string): boolean;
+/**
+ * List provider slugs with a stored token in this service scope.
+ * Uses the library's `findCredentials(service)` — supported on all
+ * platforms the underlying credential store supports.
+ */
+declare function listStoredProviders(): string[];
+//#endregion
+export { Analytics, AppConfig, Auth, AuthDescription, AuthEvent, AuthEventType, AuthIdentity, AuthUser, CARDINALITY, CapabilityImpls, CapabilityKey, Cardinality, CardinalityFor, Ci, CiRun, CiRunFilter, CiRunStatus, ConfigError, ConnectionStringOptions, CreateAuthUserInput, Deployment, DeploymentProject, DeploymentProjectSettings, DeploymentRecord, DeploymentTarget, DeploymentTrigger, Dns, DnsRecord, DnsRecordType, DoctorConfig, EnsureResult, Environment, EnvironmentReviewer, Environments, HolocronConfig, Issue, IssueSearchFilter, Issues, LifecycleResult, LifecycleSlot, MultiEntry, NormalizedAuthUser, Notifications, Observability, ParseWebhookInput, ProviderApiError, ProviderIdentity, ProviderOptions, REQUIRED_CAPABILITIES, RawProviderEntry, RawProvidersConfig, RepoPolicyConfig, RepoRef, RepoSettings, ResolvedCapability, ResolvedHolocronConfig, ResolvedProviderEntry, ResolvedProvidersConfig, ResolvedTuple, Ruleset, SecretScope, Secrets, SingleEntry, Source, StatusCategory, Storage, StorageBranch, Tooling, ToolingDoctorReport, TrackerDoctorReport, TrackerUser, Vault, WebhookDashboardInfo, WebhookVerificationError, deleteToken, getToken, isMulti, listStoredProviders, resolveConfig, resolveEntry, resolvePluginPackage, setToken };

package/dist/index.mjs

@@ -1,3 +1,184 @@
-import { a as isMulti, i as WebhookVerificationError, n as ProviderApiError, r as REQUIRED_CAPABILITIES, t as CARDINALITY } from "./capabilities-QjjhVlDd.mjs";
-import { i as resolvePluginPackage, n as resolveConfig, r as resolveEntry, t as ConfigError } from "./config-DWlIfFZm.mjs";
-export { CARDINALITY, ConfigError, ProviderApiError, REQUIRED_CAPABILITIES, WebhookVerificationError, isMulti, resolveConfig, resolveEntry, resolvePluginPackage };
+import { CARDINALITY, ProviderApiError, REQUIRED_CAPABILITIES, WebhookVerificationError, isMulti } from "./capabilities/index.mjs";
+import { Entry, findCredentials } from "@napi-rs/keyring";
+//#region src/config.ts
+/**
+* `holocron.config.json` schema, parser, and provider resolution.
+*
+* ESLint-style entry forms:
+*
+*   "source": "github"                              ← single, short
+*   "deployment": ["vercel", { team: "rando" }]    ← single, with options
+*   "notifications": ["slack", "discord"]          ← multi, short
+*   "notifications": [
+*     ["slack",   { channel: "#ops" }],
+*     ["discord", { webhook: "env:HOOK" }]
+*   ]                                              ← multi, with options
+*
+* Discriminator: an array entry is a `[provider, options]` tuple when
+* the length is 2 AND element[1] is a non-array, non-null object.
+* Otherwise it's a multi-provider list (string[] or tuple[]).
+*
+* Validation rules:
+*   - `vault` is REQUIRED (every project has secrets somewhere)
+*   - Entries for `'many'` capabilities are normalized to an array of
+*     normalized tuples; entries for `'single'` capabilities are
+*     normalized to one tuple
+*   - Tokens / secret values never appear in config — providers read
+*     them from env (or pull from `vault` at runtime)
+*/
+var ConfigError = class extends Error {
+	name = "ConfigError";
+};
+const PLUGIN_PREFIX = "@theholocron/holocron-plugin-";
+const COMMUNITY_PREFIX = "holocron-plugin-";
+/**
+* Resolve `"github"` → `"@theholocron/holocron-plugin-github"`.
+* Fully-qualified names (scoped or not) are honored verbatim, which
+* is how third-party plugins published outside the org work.
+*/
+function resolvePluginPackage(provider) {
+	if (!provider) throw new ConfigError("provider name is empty");
+	if (provider.startsWith("@")) return provider;
+	if (provider.startsWith(COMMUNITY_PREFIX)) return provider;
+	if (provider.includes("/")) return provider;
+	return PLUGIN_PREFIX + provider;
+}
+/** A bare `[provider, options]` tuple, with both elements present? */
+function isOptionsTuple(value) {
+	if (!Array.isArray(value)) return false;
+	if (value.length !== 2) return false;
+	if (typeof value[0] !== "string") return false;
+	const opt = value[1];
+	return typeof opt === "object" && opt !== null && !Array.isArray(opt);
+}
+function normalizeEntry(entry) {
+	if (typeof entry === "string") return {
+		provider: entry,
+		packageName: resolvePluginPackage(entry),
+		options: {}
+	};
+	const [provider, options] = entry;
+	return {
+		provider,
+		packageName: resolvePluginPackage(provider),
+		options
+	};
+}
+function resolveEntry(key, raw) {
+	const cardinality = CARDINALITY[key];
+	if (typeof raw === "string") {
+		if (cardinality === "many") throw new ConfigError(`\`${key}\` accepts multiple providers; wrap a single one in an array: ["${raw}"]`);
+		return {
+			cardinality: "single",
+			tuple: normalizeEntry(raw)
+		};
+	}
+	if (!Array.isArray(raw)) throw new ConfigError(`\`${key}\` entry must be a string or array, got ${typeof raw}`);
+	if (isOptionsTuple(raw)) {
+		if (cardinality === "many") return {
+			cardinality: "many",
+			tuples: [normalizeEntry(raw)]
+		};
+		return {
+			cardinality: "single",
+			tuple: normalizeEntry(raw)
+		};
+	}
+	if (cardinality === "single") throw new ConfigError(`\`${key}\` accepts exactly one provider; got a multi-provider list with ${raw.length} entries`);
+	return {
+		cardinality: "many",
+		tuples: raw.map((entry, idx) => {
+			if (typeof entry === "string") return normalizeEntry(entry);
+			if (isOptionsTuple(entry)) return normalizeEntry(entry);
+			throw new ConfigError(`\`${key}[${idx}]\` must be a provider string or [provider, options] tuple`);
+		})
+	};
+}
+function resolveConfig(raw) {
+	if (!raw.project?.name) throw new ConfigError("`project.name` is required");
+	if (!raw.providers || typeof raw.providers !== "object") throw new ConfigError("`providers` block is required");
+	const providers = {};
+	for (const [key, entry] of Object.entries(raw.providers)) {
+		if (entry === void 0) continue;
+		providers[key] = resolveEntry(key, entry);
+	}
+	for (const required of REQUIRED_CAPABILITIES) if (!providers[required]) throw new ConfigError(`required capability \`${required}\` is missing from providers`);
+	return {
+		project: raw.project,
+		providers,
+		apps: raw.apps ?? [],
+		doctor: raw.doctor ?? {}
+	};
+}
+//#endregion
+//#region src/keyring.ts
+/**
+* Keyring-backed bootstrap credential store.
+*
+* Every holocron plugin's bootstrap token (the one it needs before it
+* can talk to its vendor's API) can be stored in the OS keyring under
+* a single reverse-DNS service scope. Managed via `holocron auth`
+* subcommands; consulted at position 4 in every plugin's auth
+* precedence chain (after --token / HOLOCRON_<X>_TOKEN / <native>_TOKEN).
+*
+* See `.notes/tech-auth-bootstrap.spec.md` for the design rationale.
+*
+* Failure model: keyring access is best-effort. Platforms without a
+* supported credential store (some Linux CI images, sandboxed
+* environments) will throw from the underlying library. Every export
+* here catches and returns a null/empty result rather than propagating
+* — the plugin's precedence chain then falls through to
+* env-var-only paths, which is exactly how CI is meant to work.
+*/
+const SERVICE = "com.theholocron.cli";
+/**
+* Store or overwrite a bootstrap token for a provider. Returns true on
+* success, false when the underlying keyring is unsupported or errored.
+*/
+function setToken(provider, token) {
+	try {
+		new Entry(SERVICE, provider).setPassword(token);
+		return true;
+	} catch {
+		return false;
+	}
+}
+/**
+* Read the bootstrap token for a provider. Returns `null` for both
+* "not stored" and "keyring unavailable" — callers can treat them the
+* same way (fall through to env-var precedence).
+*/
+function getToken(provider) {
+	try {
+		return new Entry(SERVICE, provider).getPassword();
+	} catch {
+		return null;
+	}
+}
+/**
+* Delete a stored token. Returns true when a token was removed, false
+* when there was nothing to delete or the keyring is unavailable.
+* Distinguishing the two cases isn't worth the surface area — the
+* command output makes the situation clear either way.
+*/
+function deleteToken(provider) {
+	try {
+		return new Entry(SERVICE, provider).deletePassword();
+	} catch {
+		return false;
+	}
+}
+/**
+* List provider slugs with a stored token in this service scope.
+* Uses the library's `findCredentials(service)` — supported on all
+* platforms the underlying credential store supports.
+*/
+function listStoredProviders() {
+	try {
+		return findCredentials(SERVICE).map((c) => c.account);
+	} catch {
+		return [];
+	}
+}
+//#endregion
+export { CARDINALITY, ConfigError, ProviderApiError, REQUIRED_CAPABILITIES, WebhookVerificationError, deleteToken, getToken, isMulti, listStoredProviders, resolveConfig, resolveEntry, resolvePluginPackage, setToken };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theholocron/cli",
-  "version": "2.0.0-alpha.1",
+  "version": "2.0.0-alpha.11",
   "description": "The Holocron CLI — a pluggable, capability-based orchestrator for spinning up and operating software projects.",
   "homepage": "https://github.com/theholocron/holocron/tree/main/packages/cli#readme",
   "bugs": "https://github.com/theholocron/holocron/issues",
@@ -33,8 +33,8 @@
     "README.md"
   ],
   "dependencies": {
-    "yargs": "^18.0.0",
-    "@theholocron/cli-utils": "0.0.0"
+    "@napi-rs/keyring": "^1.3.0",
+    "yargs": "^18.0.0"
   },
   "devDependencies": {
     "@theholocron/eslint-config": "^4.1.0",
@@ -46,7 +46,8 @@
     "globals": "^16.5.0",
     "tsdown": "^0.22.3",
     "typescript": "^5.9.3",
-    "vitest": "^3.2.6"
+    "vitest": "^3.2.6",
+    "@theholocron/cli-utils": "0.0.0"
   },
   "publishConfig": {
     "access": "public"

package/dist/capabilities-QjjhVlDd.mjs

@@ -1,43 +0,0 @@
-//#region src/capabilities/index.ts
-const CARDINALITY = {
-	source: "single",
-	ci: "single",
-	secrets: "single",
-	environments: "single",
-	issues: "single",
-	deployment: "single",
-	storage: "single",
-	auth: "single",
-	vault: "single",
-	dns: "single",
-	tooling: "many",
-	notifications: "many",
-	analytics: "many",
-	observability: "many"
-};
-/** Vault is required; everything else is optional in the config. */
-const REQUIRED_CAPABILITIES = ["vault"];
-/**
-* Surfaced from every capability call that hits a vendor API. Wraps
-* the underlying error with `status` (HTTP) and `details` so
-* orchestrators (`holocron setup`, `doctor`) can soft-skip rather
-* than abort.
-*/
-var ProviderApiError = class extends Error {
-	status;
-	details;
-	name = "ProviderApiError";
-	constructor(message, status, details) {
-		super(message);
-		this.status = status;
-		this.details = details;
-	}
-};
-var WebhookVerificationError = class extends Error {
-	name = "WebhookVerificationError";
-};
-function isMulti(key) {
-	return CARDINALITY[key] === "many";
-}
-//#endregion
-export { isMulti as a, WebhookVerificationError as i, ProviderApiError as n, REQUIRED_CAPABILITIES as r, CARDINALITY as t };

package/dist/cli.d.mts

@@ -1 +0,0 @@
-export { };

package/dist/config-DWlIfFZm.mjs

@@ -1,113 +0,0 @@
-import { r as REQUIRED_CAPABILITIES, t as CARDINALITY } from "./capabilities-QjjhVlDd.mjs";
-//#region src/config.ts
-/**
-* `holocron.config.json` schema, parser, and provider resolution.
-*
-* ESLint-style entry forms:
-*
-*   "source": "github"                              ← single, short
-*   "deployment": ["vercel", { team: "rando" }]    ← single, with options
-*   "notifications": ["slack", "discord"]          ← multi, short
-*   "notifications": [
-*     ["slack",   { channel: "#ops" }],
-*     ["discord", { webhook: "env:HOOK" }]
-*   ]                                              ← multi, with options
-*
-* Discriminator: an array entry is a `[provider, options]` tuple when
-* the length is 2 AND element[1] is a non-array, non-null object.
-* Otherwise it's a multi-provider list (string[] or tuple[]).
-*
-* Validation rules:
-*   - `vault` is REQUIRED (every project has secrets somewhere)
-*   - Entries for `'many'` capabilities are normalized to an array of
-*     normalized tuples; entries for `'single'` capabilities are
-*     normalized to one tuple
-*   - Tokens / secret values never appear in config — providers read
-*     them from env (or pull from `vault` at runtime)
-*/
-var ConfigError = class extends Error {
-	name = "ConfigError";
-};
-const PLUGIN_PREFIX = "@theholocron/holocron-plugin-";
-const COMMUNITY_PREFIX = "holocron-plugin-";
-/**
-* Resolve `"github"` → `"@theholocron/holocron-plugin-github"`.
-* Fully-qualified names (scoped or not) are honored verbatim, which
-* is how third-party plugins published outside the org work.
-*/
-function resolvePluginPackage(provider) {
-	if (!provider) throw new ConfigError("provider name is empty");
-	if (provider.startsWith("@")) return provider;
-	if (provider.startsWith(COMMUNITY_PREFIX)) return provider;
-	if (provider.includes("/")) return provider;
-	return PLUGIN_PREFIX + provider;
-}
-/** A bare `[provider, options]` tuple, with both elements present? */
-function isOptionsTuple(value) {
-	if (!Array.isArray(value)) return false;
-	if (value.length !== 2) return false;
-	if (typeof value[0] !== "string") return false;
-	const opt = value[1];
-	return typeof opt === "object" && opt !== null && !Array.isArray(opt);
-}
-function normalizeEntry(entry) {
-	if (typeof entry === "string") return {
-		provider: entry,
-		packageName: resolvePluginPackage(entry),
-		options: {}
-	};
-	const [provider, options] = entry;
-	return {
-		provider,
-		packageName: resolvePluginPackage(provider),
-		options
-	};
-}
-function resolveEntry(key, raw) {
-	const cardinality = CARDINALITY[key];
-	if (typeof raw === "string") {
-		if (cardinality === "many") throw new ConfigError(`\`${key}\` accepts multiple providers; wrap a single one in an array: ["${raw}"]`);
-		return {
-			cardinality: "single",
-			tuple: normalizeEntry(raw)
-		};
-	}
-	if (!Array.isArray(raw)) throw new ConfigError(`\`${key}\` entry must be a string or array, got ${typeof raw}`);
-	if (isOptionsTuple(raw)) {
-		if (cardinality === "many") return {
-			cardinality: "many",
-			tuples: [normalizeEntry(raw)]
-		};
-		return {
-			cardinality: "single",
-			tuple: normalizeEntry(raw)
-		};
-	}
-	if (cardinality === "single") throw new ConfigError(`\`${key}\` accepts exactly one provider; got a multi-provider list with ${raw.length} entries`);
-	return {
-		cardinality: "many",
-		tuples: raw.map((entry, idx) => {
-			if (typeof entry === "string") return normalizeEntry(entry);
-			if (isOptionsTuple(entry)) return normalizeEntry(entry);
-			throw new ConfigError(`\`${key}[${idx}]\` must be a provider string or [provider, options] tuple`);
-		})
-	};
-}
-function resolveConfig(raw) {
-	if (!raw.project?.name) throw new ConfigError("`project.name` is required");
-	if (!raw.providers || typeof raw.providers !== "object") throw new ConfigError("`providers` block is required");
-	const providers = {};
-	for (const [key, entry] of Object.entries(raw.providers)) {
-		if (entry === void 0) continue;
-		providers[key] = resolveEntry(key, entry);
-	}
-	for (const required of REQUIRED_CAPABILITIES) if (!providers[required]) throw new ConfigError(`required capability \`${required}\` is missing from providers`);
-	return {
-		project: raw.project,
-		providers,
-		apps: raw.apps ?? [],
-		doctor: raw.doctor ?? {}
-	};
-}
-//#endregion
-export { resolvePluginPackage as i, resolveConfig as n, resolveEntry as r, ConfigError as t };