@theholocron/cli 2.0.0-alpha.44 → 2.0.0-alpha.46

package/README.md

@@ -101,13 +101,12 @@ export default acmeConfig;
 - `src/loader.ts` — `PluginLoader` — dynamic-imports plugins, resolves
   capability config packages, builds the capability registry
 - `src/cli.ts` — yargs entry, dispatches subcommands
-- `src/commands/` — `setup`, `doctor`, `deploy`, `secret set`,
-  `secrets sync`, `npm publish-initial`
+- `src/commands/` — `setup`, `sync`, `doctor`, `deploy`, `secret set`,
+  `secrets sync`, `npm publish-initial`, `sync-github`, `upgrade node`,
+  `plugin create`, `auth`
 
 ## Status
 
-**`v2.0.0-alpha.0`** — published on npm under the `alpha` dist-tag.
-[Release notes](https://github.com/theholocron/holocron/releases/tag/v2.0.0-alpha.0).
-Design in
-[`.notes/tech-architecture.spec.md`](../../.notes/archive/tech-architecture.spec.md).
-APIs may still shift before stable v2.0.0.
+Published on npm under the `alpha` dist-tag. APIs may still shift before
+stable v2.0.0. Design in
+[`.notes/archive/tech-architecture.spec.md`](../../.notes/archive/tech-architecture.spec.md).

package/dist/cli.mjs

@@ -3,9 +3,10 @@ import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSy
 import path, { basename, dirname, join } from "node:path";
 import yargs from "yargs";
 import { hideBin } from "yargs/helpers";
-import { ProviderApiError } from "@theholocron/http-client";
+import { ProviderApiError, ProviderApiError as ProviderApiError$1 } from "@theholocron/http-client";
 import { Entry, findCredentials } from "@napi-rs/keyring";
 import { createHash } from "node:crypto";
+import { createGitHubClient } from "@theholocron/github-client";
 import { spawnSync } from "node:child_process";
 import { access, readFile, stat } from "node:fs/promises";
 import { pathToFileURL } from "node:url";
@@ -464,8 +465,7 @@ var PluginLoader = class {
 	*/
 	projectDefaults() {
 		const defaults = {};
-		const repo = this.config.project.repo;
-		if (repo) defaults.repo = typeof repo === "string" ? repo : repo.name;
+		if (this.config.project.repo) defaults.repo = this.config.project.repo.name;
 		return defaults;
 	}
 };
@@ -1059,7 +1059,7 @@ jobs:
         id: metadata
 
       - run: gh pr merge --auto --squash "$PR_URL"
-        # --squash is intentional: repoPolicy sets allow_merge_commit: false,
+        # --squash is intentional: repo protection sets allow_merge_commit: false,
         # so --merge would fail on any repo using the standard preset.
         name: Enable auto-merge for Dependabot PRs
         if: steps.metadata.outputs.update-type == 'version-update:semver-patch'
@@ -1234,8 +1234,8 @@ jobs:
           env.GPG_KEY_SET == 'true'
         with:
           branch: \${{ github.event.pull_request.head.ref || github.head_ref || github.ref }}
-          commit_message: "chore: fix linting issues"
-          commit_options: "--no-verify --signoff"
+          commit_message: "chore: fix linting issues\\n\\nSigned-off-by: super-linter <super-linter@super-linter.dev>"
+          commit_options: "--no-verify"
           commit_user_name: super-linter
           commit_user_email: super-linter@super-linter.dev
 `,
@@ -2006,7 +2006,6 @@ function generateThinCallerContent(name, withOverrides) {
 //#endregion
 //#region src/commands/sync-github.ts
 const DEFAULT_REPO = "theholocron/.github";
-const API_BASE = "https://api.github.com";
 /**
 * Extracts the `project.workflows` array from a `holocron.config.ts` source string.
 * Handles both plain string entries and `{ name, with }` object entries.
@@ -2112,16 +2111,12 @@ function gitBlobSha(content) {
 async function runSyncGithub(input) {
 	const print = input.print ?? ((line) => console.log(line));
 	const repo = input.repo ?? DEFAULT_REPO;
-	const [owner, repoName] = repo.split("/");
 	const { token, dryRun = false, branch, createPr = false } = input;
 	const message = input.message ?? `chore: sync from theholocron/holocron`;
-	const fetchFn = input.fetch ?? globalThis.fetch;
-	const headers = {
-		Authorization: `Bearer ${token}`,
-		Accept: "application/vnd.github+json",
-		"Content-Type": "application/json",
-		"X-GitHub-Api-Version": "2022-11-28"
-	};
+	const client = createGitHubClient({
+		token,
+		fetch: input.fetch
+	});
 	print(`holocron sync-github${dryRun ? " (dry-run)" : ""}`);
 	print(`  repo:   ${repo}`);
 	if (branch) print(`  branch: ${branch}`);
@@ -2143,26 +2138,31 @@ async function runSyncGithub(input) {
 	}
 	let targetBranch = branch;
 	let defaultBranch;
-	if (!targetBranch || createPr) {
-		const repoRes = await fetchFn(`${API_BASE}/repos/${owner}/${repoName}`, { headers });
-		if (!repoRes.ok) {
-			const msg = "failed to fetch repo metadata";
-			print(`  ✗ ${msg}`);
-			return {
-				status: "fail",
-				created: 0,
-				updated: 0,
-				unchanged: 0,
-				message: msg
-			};
-		}
-		defaultBranch = (await repoRes.json()).default_branch;
+	if (!targetBranch || createPr) try {
+		defaultBranch = (await client.repos.getRepo(repo)).default_branch;
 		if (!targetBranch) targetBranch = defaultBranch;
+	} catch {
+		const msg = "failed to fetch repo metadata";
+		print(`  ✗ ${msg}`);
+		return {
+			status: "fail",
+			created: 0,
+			updated: 0,
+			unchanged: 0,
+			message: msg
+		};
 	}
 	const baseBranch = createPr && defaultBranch ? defaultBranch : targetBranch;
-	const refRes = await fetchFn(`${API_BASE}/repos/${owner}/${repoName}/git/ref/heads/${baseBranch}`, { headers });
-	if (!refRes.ok) {
-		const msg = `Branch ${baseBranch} not found`;
+	let headSha;
+	let baseTreeSha;
+	let existingBlobs;
+	try {
+		headSha = (await client.git.getRef(repo, baseBranch)).object.sha;
+		baseTreeSha = (await client.git.getCommit(repo, headSha)).tree.sha;
+		const treeData = await client.git.getTree(repo, baseTreeSha, true);
+		existingBlobs = new Map(treeData.tree.filter((i) => i.type === "blob").map((i) => [i.path, i.sha]));
+	} catch (err) {
+		const msg = err instanceof Error ? err.message : `Branch ${baseBranch} not found`;
 		print(`  ✗ ${msg}`);
 		return {
 			status: "fail",
@@ -2172,24 +2172,19 @@ async function runSyncGithub(input) {
 			message: msg
 		};
 	}
-	const { object: { sha: headSha } } = await refRes.json();
-	const { tree: { sha: baseTreeSha } } = await (await fetchFn(`${API_BASE}/repos/${owner}/${repoName}/git/commits/${headSha}`, { headers })).json();
-	const { tree: existingTree } = await (await fetchFn(`${API_BASE}/repos/${owner}/${repoName}/git/trees/${baseTreeSha}?recursive=1`, { headers })).json();
-	const existingBlobs = new Map(existingTree.filter((i) => i.type === "blob").map((i) => [i.path, i.sha]));
 	let allowedWorkflows;
 	let withOverrides;
 	if (repo !== DEFAULT_REPO) try {
 		let entries = [];
-		const jsonRes = await fetchFn(`${API_BASE}/repos/${owner}/${repoName}/contents/holocron.config.json`, { headers });
-		if (jsonRes.ok) {
-			const data = await jsonRes.json();
+		try {
+			const data = await client.git.getContents(repo, "holocron.config.json");
 			entries = (JSON.parse(Buffer.from(data.content.replace(/\n/g, ""), "base64").toString("utf8"))?.project?.workflows ?? []).map((w) => typeof w === "string" ? { name: w } : w);
-		} else {
-			const tsRes = await fetchFn(`${API_BASE}/repos/${owner}/${repoName}/contents/holocron.config.ts`, { headers });
-			if (tsRes.ok) {
-				const data = await tsRes.json();
+		} catch (err) {
+			if (!(err instanceof ProviderApiError) || err.status !== 404) throw err;
+			try {
+				const data = await client.git.getContents(repo, "holocron.config.ts");
 				entries = parseWorkflowsFromTs(Buffer.from(data.content.replace(/\n/g, ""), "base64").toString("utf8"));
-			}
+			} catch {}
 		}
 		if (entries.length > 0) {
 			allowedWorkflows = new Set(entries.map((e) => e.name));
@@ -2227,45 +2222,30 @@ async function runSyncGithub(input) {
 		unchanged
 	};
 	const treeEntries = [];
-	for (const file of changedFiles) {
-		const blobRes = await fetchFn(`${API_BASE}/repos/${owner}/${repoName}/git/blobs`, {
-			method: "POST",
-			headers,
-			body: JSON.stringify({
-				content: file.content,
-				encoding: "utf-8"
-			})
-		});
-		if (!blobRes.ok) {
-			const err = await blobRes.json();
-			const msg = `failed to create blob for ${file.path}: ${err.message ?? blobRes.status}`;
-			print(`  ✗ ${msg}`);
-			return {
-				status: "fail",
-				created,
-				updated,
-				unchanged,
-				message: msg
-			};
-		}
-		const { sha: blobSha } = await blobRes.json();
+	for (const file of changedFiles) try {
+		const blob = await client.git.createBlob(repo, file.content);
 		treeEntries.push({
 			path: file.path,
 			mode: "100644",
 			type: "blob",
-			sha: blobSha
+			sha: blob.sha
 		});
+	} catch (err) {
+		const msg = `failed to create blob for ${file.path}: ${err instanceof Error ? err.message : String(err)}`;
+		print(`  ✗ ${msg}`);
+		return {
+			status: "fail",
+			created,
+			updated,
+			unchanged,
+			message: msg
+		};
 	}
-	const newTreeRes = await fetchFn(`${API_BASE}/repos/${owner}/${repoName}/git/trees`, {
-		method: "POST",
-		headers,
-		body: JSON.stringify({
-			base_tree: baseTreeSha,
-			tree: treeEntries
-		})
-	});
-	if (!newTreeRes.ok) {
-		const msg = `failed to create tree: ${(await newTreeRes.json()).message ?? newTreeRes.status}`;
+	let newTreeSha;
+	try {
+		newTreeSha = (await client.git.createTree(repo, treeEntries, baseTreeSha)).sha;
+	} catch (err) {
+		const msg = `failed to create tree: ${err instanceof Error ? err.message : String(err)}`;
 		print(`  ✗ ${msg}`);
 		return {
 			status: "fail",
@@ -2275,18 +2255,11 @@ async function runSyncGithub(input) {
 			message: msg
 		};
 	}
-	const { sha: newTreeSha } = await newTreeRes.json();
-	const newCommitRes = await fetchFn(`${API_BASE}/repos/${owner}/${repoName}/git/commits`, {
-		method: "POST",
-		headers,
-		body: JSON.stringify({
-			message,
-			tree: newTreeSha,
-			parents: [headSha]
-		})
-	});
-	if (!newCommitRes.ok) {
-		const msg = `failed to create commit: ${(await newCommitRes.json()).message ?? newCommitRes.status}`;
+	let newCommitSha;
+	try {
+		newCommitSha = (await client.git.createCommit(repo, message, newTreeSha, [headSha])).sha;
+	} catch (err) {
+		const msg = `failed to create commit: ${err instanceof Error ? err.message : String(err)}`;
 		print(`  ✗ ${msg}`);
 		return {
 			status: "fail",
@@ -2296,32 +2269,16 @@ async function runSyncGithub(input) {
 			message: msg
 		};
 	}
-	const { sha: newCommitSha } = await newCommitRes.json();
-	let refUpdateRes;
-	if (createPr && branch) {
-		refUpdateRes = await fetchFn(`${API_BASE}/repos/${owner}/${repoName}/git/refs`, {
-			method: "POST",
-			headers,
-			body: JSON.stringify({
-				ref: `refs/heads/${branch}`,
-				sha: newCommitSha
-			})
-		});
-		if (refUpdateRes.status === 422) refUpdateRes = await fetchFn(`${API_BASE}/repos/${owner}/${repoName}/git/refs/heads/${branch}`, {
-			method: "PATCH",
-			headers,
-			body: JSON.stringify({
-				sha: newCommitSha,
-				force: true
-			})
-		});
-	} else refUpdateRes = await fetchFn(`${API_BASE}/repos/${owner}/${repoName}/git/refs/heads/${targetBranch}`, {
-		method: "PATCH",
-		headers,
-		body: JSON.stringify({ sha: newCommitSha })
-	});
-	if (!refUpdateRes.ok) {
-		const msg = `failed to update ref: ${(await refUpdateRes.json()).message ?? refUpdateRes.status}`;
+	try {
+		if (createPr && branch) try {
+			await client.git.createRef(repo, `refs/heads/${branch}`, newCommitSha);
+		} catch (err) {
+			if (!(err instanceof ProviderApiError) || err.status !== 422) throw err;
+			await client.git.updateRef(repo, `heads/${branch}`, newCommitSha, true);
+		}
+		else await client.git.updateRef(repo, `heads/${targetBranch}`, newCommitSha);
+	} catch (err) {
+		const msg = `failed to update ref: ${err instanceof Error ? err.message : String(err)}`;
 		print(`  ✗ ${msg}`);
 		return {
 			status: "fail",
@@ -2332,25 +2289,17 @@ async function runSyncGithub(input) {
 		};
 	}
 	let prUrl;
-	if (branch && createPr && !dryRun) {
-		const prRes = await fetchFn(`${API_BASE}/repos/${owner}/${repoName}/pulls`, {
-			method: "POST",
-			headers,
-			body: JSON.stringify({
-				title: message.split("\n")[0],
-				head: branch,
-				base: "main",
-				body: "Auto-generated by `holocron sync-github`. Review and merge to apply template updates."
-			})
-		});
-		if (prRes.ok) {
-			prUrl = (await prRes.json()).html_url;
-			print(`  → PR opened: ${prUrl}`);
-		} else {
-			const err = await prRes.json();
-			if (err.errors?.some((e) => e.message.includes("already exists"))) print(`  → PR already open for ${branch} — branch updated, ready to merge`);
-			else print(`  ⚠ PR creation failed: ${err.message ?? prRes.status}`);
-		}
+	if (branch && createPr && !dryRun) try {
+		prUrl = (await client.git.createPull(repo, {
+			title: message.split("\n")[0],
+			head: branch,
+			base: "main",
+			body: "Auto-generated by `holocron sync-github`. Review and merge to apply template updates."
+		})).html_url;
+		print(`  → PR opened: ${prUrl}`);
+	} catch (err) {
+		if (err instanceof ProviderApiError && err.status === 422 && String(err.details).includes("already exists")) print(`  → PR already open for ${branch} — branch updated, ready to merge`);
+		else print(`  ⚠ PR creation failed: ${err instanceof Error ? err.message : String(err)}`);
 	}
 	return {
 		status: "ok",
@@ -4020,7 +3969,7 @@ async function upsertBranchProtection(source, dryRun, requiredChecks) {
 			message: "created"
 		};
 	} catch (err) {
-		if (!(err instanceof ProviderApiError) || err.status !== 403) return {
+		if (!(err instanceof ProviderApiError$1) || err.status !== 403) return {
 			capability: "source",
 			step,
 			status: "fail",
@@ -4037,7 +3986,7 @@ async function upsertBranchProtection(source, dryRun, requiredChecks) {
 			message: `classic protection on ${repo.defaultBranch}`
 		};
 	} catch (err) {
-		if (err instanceof ProviderApiError && err.status === 403) return {
+		if (err instanceof ProviderApiError$1 && err.status === 403) return {
 			capability: "source",
 			step,
 			status: "skip",
@@ -4059,7 +4008,7 @@ async function runSetup(input) {
 	const dryRun = input.context.dryRun ?? false;
 	const steps = [];
 	const repo = config.project.repo;
-	const effectivePreset = repo?.protection ?? config.project.repoPolicy?.preset;
+	const effectivePreset = repo?.protection;
 	print(`Holocron setup — ${config.project.name}${dryRun ? " (dry-run)" : ""}`);
 	print(`  config: ${input.loaded.filepath}`);
 	print("");
@@ -4096,7 +4045,7 @@ async function runSetup(input) {
 					const ctx = WORKFLOW_CHECK_CONTEXTS[name];
 					return ctx ? [ctx] : [];
 				}),
-				...repo?.requiredChecks ?? config.project.repoPolicy?.requiredChecks ?? []
+				...repo?.requiredChecks ?? []
 			] : [];
 			steps.push(await upsertBranchProtection(source, dryRun, requiredChecks));
 			print(formatStep(steps[steps.length - 1]));
@@ -4310,6 +4259,148 @@ function formatStep(step) {
 	return `    ${icon} ${step.step}${detail}`;
 }
 //#endregion
+//#region src/commands/sync.ts
+const SYNC_STEPS = [
+	"labels",
+	"properties",
+	"topics"
+];
+async function runSync(input) {
+	const print = input.print ?? ((line) => console.log(line));
+	const loader = input.loader ?? new PluginLoader(input.loaded.resolved, input.context);
+	await loader.load();
+	const config = input.loaded.resolved;
+	const dryRun = input.context.dryRun ?? false;
+	const requestedSteps = input.steps;
+	const steps = [];
+	print(`Holocron sync — ${config.project.name}${dryRun ? " (dry-run)" : ""}`);
+	print(`  config: ${input.loaded.filepath}`);
+	print("");
+	if (loader.has("source")) {
+		const source = loader.get("source");
+		print("  → source");
+		for (const stepName of SYNC_STEPS) {
+			if (requestedSteps !== void 0 && !requestedSteps.includes(stepName)) continue;
+			if (stepName === "labels") if (source.syncLabels) {
+				steps.push(await runSyncStep("source", "sync labels", dryRun, () => source.syncLabels(CANONICAL_LABELS, STALE_LABELS)));
+				print(formatSyncStep(steps[steps.length - 1]));
+			} else {
+				steps.push({
+					capability: "source",
+					step: "sync labels",
+					status: "skip",
+					message: "provider does not implement syncLabels"
+				});
+				print(formatSyncStep(steps[steps.length - 1]));
+			}
+			if (stepName === "properties") if (source.syncProperties) {
+				const repo = config.project.repo;
+				const properties = {};
+				const effectivePreset = repo?.protection;
+				if (effectivePreset && effectivePreset !== "none") properties["branch_protection_level"] = effectivePreset;
+				const isMonorepo = await access(join(input.context.repoRoot, "pnpm-workspace.yaml")).then(() => true).catch(() => false);
+				properties["monorepo"] = String(isMonorepo);
+				const manual = repo?.properties ?? {};
+				if (manual.lifecycle) properties["lifecycle"] = manual.lifecycle;
+				if (manual.open_source !== void 0) properties["open_source"] = String(manual.open_source);
+				if (manual.runtime_environment) properties["runtime_environment"] = manual.runtime_environment;
+				if (manual.uses_external_packages !== void 0) properties["uses_external_packages"] = String(manual.uses_external_packages);
+				steps.push(await runSyncStep("source", "sync properties", dryRun, () => source.syncProperties(properties)));
+				print(formatSyncStep(steps[steps.length - 1]));
+			} else {
+				steps.push({
+					capability: "source",
+					step: "sync properties",
+					status: "skip",
+					message: "provider does not implement syncProperties"
+				});
+				print(formatSyncStep(steps[steps.length - 1]));
+			}
+			if (stepName === "topics") {
+				const topics = config.project.repo?.topics ?? [];
+				if (topics.length === 0) {
+					steps.push({
+						capability: "source",
+						step: "sync topics",
+						status: "skip",
+						message: "no topics configured"
+					});
+					print(formatSyncStep(steps[steps.length - 1]));
+				} else if (source.syncTopics) {
+					steps.push(await runSyncStep("source", "sync topics", dryRun, () => source.syncTopics(topics)));
+					print(formatSyncStep(steps[steps.length - 1]));
+				} else {
+					steps.push({
+						capability: "source",
+						step: "sync topics",
+						status: "skip",
+						message: "provider does not implement syncTopics"
+					});
+					print(formatSyncStep(steps[steps.length - 1]));
+				}
+			}
+		}
+		if (requestedSteps) {
+			for (const name of requestedSteps) if (!SYNC_STEPS.includes(name)) {
+				steps.push({
+					capability: "source",
+					step: `sync ${name}`,
+					status: "skip",
+					message: `unknown step "${name}"`
+				});
+				print(formatSyncStep(steps[steps.length - 1]));
+			}
+		}
+	}
+	const summary = steps.reduce((acc, s) => {
+		if (s.status === "ok") acc.ok += 1;
+		else if (s.status === "fail") acc.fail += 1;
+		else if (s.status === "skip") acc.skip += 1;
+		else if (s.status === "dry-run") acc.dryRun += 1;
+		return acc;
+	}, {
+		ok: 0,
+		fail: 0,
+		skip: 0,
+		dryRun: 0
+	});
+	print("");
+	print(`  ${summary.ok} ok, ${summary.fail} fail, ${summary.skip} skipped${dryRun ? `, ${summary.dryRun} would-do` : ""}`);
+	return {
+		steps,
+		summary
+	};
+}
+async function runSyncStep(capability, step, dryRun, body) {
+	if (dryRun) return {
+		capability,
+		step,
+		status: "dry-run"
+	};
+	try {
+		const note = await body();
+		const result = {
+			capability,
+			step,
+			status: "ok"
+		};
+		if (typeof note === "string") result.message = note;
+		return result;
+	} catch (err) {
+		return {
+			capability,
+			step,
+			status: "fail",
+			message: err instanceof Error ? err.message : String(err)
+		};
+	}
+}
+function formatSyncStep(step) {
+	const icon = step.status === "ok" ? "✓" : step.status === "fail" ? "✗" : step.status === "dry-run" ? "…" : "·";
+	const detail = step.message ? `  (${step.message})` : "";
+	return `    ${icon} ${step.step}${detail}`;
+}
+//#endregion
 //#region src/load-config.ts
 /**
 * `holocron.config.{json,js,ts}` file loader.
@@ -4532,7 +4623,25 @@ await yargs(hideBin(process.argv)).scriptName("holocron").usage("$0 <command> [o
 		dryRun: argv.dryRun,
 		...argv.otp ? { otp: argv.otp } : {}
 	})).status === "fail") process.exitCode = 1;
-}).demandCommand(1, "Run `holocron npm --help` to see available npm subcommands."), () => {}).command("sync-github", "Sync workflow templates and composite actions to theholocron/.github via the GitHub API", (y) => y.option("repo", {
+}).demandCommand(1, "Run `holocron npm --help` to see available npm subcommands."), () => {}).command("sync [steps..]", "Sync source-level state (labels, properties, topics) from config to the provider", (y) => y.positional("steps", {
+	type: "string",
+	array: true,
+	describe: "Steps to run: labels, properties, topics (default: all)"
+}).option("repo", {
+	type: "string",
+	describe: "Repo coords (\"owner/name\"). Defaults to plugin-specific resolution."
+}), async (argv) => {
+	if ((await runSync({
+		loaded: await loadConfig(argv.cwd),
+		context: {
+			repoRoot: argv.cwd,
+			dryRun: argv.dryRun,
+			...argv.repo ? { repo: argv.repo } : {},
+			...argv.token ? { cliToken: argv.token } : {}
+		},
+		...argv.steps && argv.steps.length > 0 ? { steps: argv.steps } : {}
+	})).summary.fail > 0) process.exitCode = 1;
+}).command("sync-github", "Sync workflow templates and composite actions to theholocron/.github via the GitHub API", (y) => y.option("repo", {
 	type: "string",
 	default: "theholocron/.github",
 	describe: "Target org/repo (default: theholocron/.github)"

package/dist/index.d.mts

@@ -30,26 +30,6 @@ type SingleEntry = string | [provider: string, options: ProviderOptions];
 type MultiEntry = Array<string | [provider: string, options: ProviderOptions]>;
 type RawProviderEntry = SingleEntry | MultiEntry;
 type RawProvidersConfig = Partial<Record<CapabilityKey, RawProviderEntry>>;
-interface RepoPolicyConfig {
-  /**
-   * "balanced" — squash-only merges, delete-branch-on-merge, issues/discussions/projects
-   * enabled, auto-merge enabled, web sign-off required, always suggest updating, no wiki;
-   * plus a ruleset that blocks force-push + deletion and requires a pull request (0 reviews).
-   *
-   * "strict" — everything in "balanced" plus required status checks from `requiredChecks`.
-   *
-   * "none" — skips repo settings + ruleset entirely.
-   *
-   * @default "balanced"
-   * @deprecated Use `project.repo.protection` instead.
-   */
-  preset?: "balanced" | "strict" | "none";
-  /**
-   * CI check context names required on the default branch (used by "strict").
-   * @deprecated Use `project.repo.requiredChecks` instead.
-   */
-  requiredChecks?: string[];
-}
 type RepoProtection = "balanced" | "strict" | "none";
 interface RepoProperties {
   lifecycle?: "active" | "experimental" | "deprecated";
@@ -91,12 +71,6 @@ interface HolocronConfig {
      * `--repo` on the command line still overrides.
      */
     repo?: RepoConfig;
-    /**
-     * Repo-level policy applied by `holocron setup`. Defines merge
-     * strategy, branch protection rulesets, and security defaults.
-     * Requires `source` capability to be configured.
-     */
-    repoPolicy?: RepoPolicyConfig;
     /**
      * CI workflow names to install as thin wrappers during `holocron setup`.
      * Each name maps to a reusable workflow in `theholocron/.github`.
@@ -216,4 +190,4 @@ interface LoadedConfig {
  */
 declare function loadConfig(cwd: string): Promise<LoadedConfig>;
 //#endregion
-export { Analytics, AppConfig, Auth, AuthDescription, AuthError, AuthEvent, AuthEventType, AuthIdentity, AuthUser, CARDINALITY, CapabilityConfigPackage, CapabilityImpls, CapabilityKey, Cardinality, CardinalityFor, Ci, CiRun, CiRunFilter, CiRunStatus, ConfigError, ConfigFileError, ConnectionStringOptions, CreateAuthUserInput, Deployment, DeploymentProject, DeploymentProjectSettings, DeploymentRecord, DeploymentTarget, DeploymentTrigger, Dns, DnsRecord, DnsRecordType, DoctorConfig, EnsureResult, Environment, EnvironmentReviewer, Environments, HolocronConfig, Issue, IssueSearchFilter, Issues, LabelDef, LifecycleResult, LifecycleSlot, LoadedConfig, MultiEntry, NormalizedAuthUser, Notifications, Observability, ParseWebhookInput, ProviderApiError, ProviderIdentity, ProviderOptions, REQUIRED_CAPABILITIES, RawProviderEntry, RawProvidersConfig, RepoConfig, RepoPolicyConfig, RepoProperties, RepoProtection, RepoRef, RepoSettings, type RequestOptions, ResolveTokenConfig, type ResolveTokenInput, ResolvedCapability, ResolvedHolocronConfig, ResolvedProviderEntry, ResolvedProvidersConfig, ResolvedTuple, type RestClient, type RestClientConfig, Ruleset, SecretScope, Secrets, SingleEntry, Source, StatusCategory, Storage, StorageBranch, Tooling, ToolingDoctorReport, TrackerDoctorReport, TrackerUser, Vault, WebhookDashboardInfo, WebhookVerificationError, createResolveToken, createRestClient, defineConfig, deleteToken, getToken, isMulti, listStoredProviders, loadConfig, resolveConfig, resolveEntry, resolvePluginPackage, setToken };
+export { Analytics, AppConfig, Auth, AuthDescription, AuthError, AuthEvent, AuthEventType, AuthIdentity, AuthUser, CARDINALITY, CapabilityConfigPackage, CapabilityImpls, CapabilityKey, Cardinality, CardinalityFor, Ci, CiRun, CiRunFilter, CiRunStatus, ConfigError, ConfigFileError, ConnectionStringOptions, CreateAuthUserInput, Deployment, DeploymentProject, DeploymentProjectSettings, DeploymentRecord, DeploymentTarget, DeploymentTrigger, Dns, DnsRecord, DnsRecordType, DoctorConfig, EnsureResult, Environment, EnvironmentReviewer, Environments, HolocronConfig, Issue, IssueSearchFilter, Issues, LabelDef, LifecycleResult, LifecycleSlot, LoadedConfig, MultiEntry, NormalizedAuthUser, Notifications, Observability, ParseWebhookInput, ProviderApiError, ProviderIdentity, ProviderOptions, REQUIRED_CAPABILITIES, RawProviderEntry, RawProvidersConfig, RepoConfig, RepoProperties, RepoProtection, RepoRef, RepoSettings, type RequestOptions, ResolveTokenConfig, type ResolveTokenInput, ResolvedCapability, ResolvedHolocronConfig, ResolvedProviderEntry, ResolvedProvidersConfig, ResolvedTuple, type RestClient, type RestClientConfig, Ruleset, SecretScope, Secrets, SingleEntry, Source, StatusCategory, Storage, StorageBranch, Tooling, ToolingDoctorReport, TrackerDoctorReport, TrackerUser, Vault, WebhookDashboardInfo, WebhookVerificationError, createResolveToken, createRestClient, defineConfig, deleteToken, getToken, isMulti, listStoredProviders, loadConfig, resolveConfig, resolveEntry, resolvePluginPackage, setToken };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theholocron/cli",
-  "version": "2.0.0-alpha.44",
+  "version": "2.0.0-alpha.46",
   "description": "The Holocron CLI — a pluggable, capability-based orchestrator for spinning up and operating software projects.",
   "homepage": "https://github.com/theholocron/holocron/tree/main/packages/cli#readme",
   "bugs": "https://github.com/theholocron/holocron/issues",
@@ -34,7 +34,8 @@
   ],
   "dependencies": {
     "@napi-rs/keyring": "^1.3.0",
-    "@theholocron/http-client": "^0.1.0",
+    "@theholocron/github-client": "^0.3.2",
+    "@theholocron/http-client": "^0.3.2",
     "tsx": "^4.22.4",
     "yargs": "^18.0.0"
   },