@theholocron/cli 2.0.0-alpha.9 → 2.0.0

package/dist/index.d.mts

@@ -1,26 +1,62 @@
-import { $ as StorageBranch, A as EnvironmentReviewer, B as ParseWebhookInput, C as DeploymentTarget, D as DnsRecordType, E as DnsRecord, F as LifecycleResult, G as RepoSettings, H as ProviderIdentity, I as LifecycleSlot, J as SecretScope, K as ResolvedCapability, L as NormalizedAuthUser, M as Issue, N as IssueSearchFilter, O as EnsureResult, P as Issues, Q as Storage, R as Notifications, S as DeploymentRecord, T as Dns, U as REQUIRED_CAPABILITIES, V as ProviderApiError, W as RepoRef, X as Source, Y as Secrets, Z as StatusCategory, _ as ConnectionStringOptions, a as AuthEventType, at as WebhookDashboardInfo, b as DeploymentProject, c as CARDINALITY, d as Cardinality, et as Tooling, f as CardinalityFor, g as CiRunStatus, h as CiRunFilter, i as AuthEvent, it as Vault, j as Environments, k as Environment, l as CapabilityImpls, m as CiRun, n as Auth, nt as TrackerDoctorReport, o as AuthIdentity, ot as WebhookVerificationError, p as Ci, q as Ruleset, r as AuthDescription, rt as TrackerUser, s as AuthUser, st as isMulti, t as Analytics, tt as ToolingDoctorReport, u as CapabilityKey, v as CreateAuthUserInput, w as DeploymentTrigger, x as DeploymentProjectSettings, y as Deployment, z as Observability } from "./index-jxPVFH7-.mjs";
+import { Analytics, Auth, AuthDescription, AuthEvent, AuthEventType, AuthIdentity, AuthUser, CARDINALITY, CapabilityImpls, CapabilityKey, Cardinality, CardinalityFor, Ci, CiRun, CiRunFilter, CiRunStatus, ConnectionStringOptions, CreateAuthUserInput, Deployment, DeploymentProject, DeploymentProjectSettings, DeploymentRecord, DeploymentTarget, DeploymentTrigger, Dns, DnsRecord, DnsRecordType, EnsureResult, Environment, EnvironmentReviewer, Environments, Issue, IssueSearchFilter, Issues, LabelDef, LifecycleResult, LifecycleSlot, NormalizedAuthUser, Notifications, Observability, ParseWebhookInput, ProviderApiError, ProviderIdentity, REQUIRED_CAPABILITIES, RepoRef, RepoSettings, ResolvedCapability, Ruleset, SecretScope, Secrets, Source, StatusCategory, Storage, StorageBranch, TeamEntry, TeamPermission, Tooling, ToolingDoctorReport, TrackerDoctorReport, TrackerUser, Vault, WebhookDashboardInfo, WebhookVerificationError, isMulti } from "./capabilities/index.mjs";
+import { AuthError, RequestOptions, ResolveTokenConfig as ResolveTokenConfig$1, ResolveTokenInput, RestClient, RestClientConfig, createRestClient } from "@theholocron/http-client";
 
+//#region src/auth-resolver.d.ts
+type ResolveTokenConfig = Omit<ResolveTokenConfig$1, "getKeyringToken">;
+/** Wraps `createResolveToken` from `@theholocron/http` and injects the
+ *  system keyring so plugins stay at a one-liner call site. */
+declare function createResolveToken(config: ResolveTokenConfig): (input?: import("@theholocron/http-client").ResolveTokenInput) => string;
+//#endregion
 //#region src/config.d.ts
 type ProviderOptions = Record<string, unknown>;
+/**
+ * The shape a capability config package's default export must satisfy.
+ * Config packages let teams share a pre-bundled provider + options across
+ * repos (Level 1 of the shareable-configs story, issue #75).
+ *
+ * @example
+ * // @acme/holocron-vault/index.ts
+ * import type { CapabilityConfigPackage } from '@theholocron/cli'
+ * export default {
+ *   provider: '1password',
+ *   options: { vault: 'acme-app' },
+ * } satisfies CapabilityConfigPackage
+ */
+interface CapabilityConfigPackage {
+  provider: string;
+  options?: ProviderOptions;
+}
 type SingleEntry = string | [provider: string, options: ProviderOptions];
 type MultiEntry = Array<string | [provider: string, options: ProviderOptions]>;
 type RawProviderEntry = SingleEntry | MultiEntry;
 type RawProvidersConfig = Partial<Record<CapabilityKey, RawProviderEntry>>;
-interface RepoPolicyConfig {
+type RepoProtection = "balanced" | "strict" | "none";
+interface RepoProperties {
+  lifecycle?: "active" | "experimental" | "deprecated";
+  open_source?: boolean;
+  runtime_environment?: "node" | "browser" | "universal" | "none";
+  uses_external_packages?: boolean;
+}
+interface RepoConfig {
+  /** "owner/name" — the GitHub repository coordinate. Derived from the git remote when absent. */
+  name?: string;
   /**
-   * "balanced" — squash-only merges, delete-branch-on-merge, issues/discussions/projects
-   * enabled, auto-merge enabled, web sign-off required, always suggest updating, no wiki;
-   * plus a ruleset that blocks force-push + deletion and requires a pull request (0 reviews).
-   *
-   * "strict" — everything in "balanced" plus required status checks from `requiredChecks`.
-   *
-   * "none" — skips repo settings + ruleset entirely.
-   *
-   * @default "balanced"
+   * Branch protection preset applied by `holocron setup`. When omitted,
+   * no protection is applied and no `branch_protection_level` property is set.
    */
-  preset?: "balanced" | "strict" | "none";
-  /** CI check context names required on the default branch (used by "strict"). */
+  protection?: RepoProtection;
+  /** CI check context names required on the default branch (only used when `protection` is "strict"). */
   requiredChecks?: string[];
+  /**
+   * GitHub teams granted repository access. Synced by `holocron setup`, which
+   * also writes `.github/CODEOWNERS` for teams with write-or-higher permission.
+   * String shorthand defaults to `push` (Write).
+   */
+  teams?: TeamEntry[];
+  /** GitHub topics set on the repository. */
+  topics?: string[];
+  /** GitHub custom properties synced to the org dashboard. */
+  properties?: RepoProperties;
 }
 interface AppConfig {
   name: string;
@@ -31,38 +67,54 @@ interface DoctorConfig {
   checks?: string[];
 }
 interface HolocronConfig {
-  project: {
+  /** Project name. Derived from package.json when absent. */
+  name?: string;
+  description?: string;
+  /**
+   * Repository identity and metadata. When set, `PluginLoader` injects
+   * `repo.name` into every plugin's `RuntimeContext.repo` so plugins that
+   * need a repo (github, etc.) don't require `--repo` on every invocation.
+   * `--repo` on the command line still overrides.
+   */
+  repo?: RepoConfig;
+  /**
+   * CI workflow names to install as thin wrappers during `holocron setup`.
+   * Each name maps to a reusable workflow in `theholocron/.github`.
+   * Use the object form to pass `with:` inputs to the reusable workflow.
+   *
+   * Supported values: "lint" | "test" | "typecheck" | "codeql" | "review" |
+   *   "release" | "stale" | "greetings" | "dependencies" | "bookkeeping" | "audit"
+   *
+   * `holocron setup` writes `.github/workflows/<name>.yml` for each entry,
+   * calling the corresponding `ci-<name>.yml@main` reusable workflow.
+   * Files are overwritten on each run — they are generated artifacts.
+   *
+   * @example
+   * ["lint", { "name": "release", "with": { "run-build": false } }]
+   */
+  workflows?: Array<string | {
     name: string;
-    description?: string;
-    /**
-     * Repo coord — `"owner/name"`. When set, `PluginLoader` injects
-     * it into every plugin's `RuntimeContext.repo` so plugins that
-     * need a repo (github, etc.) don't require `--repo` on every
-     * invocation. `--repo` on the command line still overrides.
-     */
-    repo?: string;
-    /**
-     * Repo-level policy applied by `holocron setup`. Defines merge
-     * strategy, branch protection rulesets, and security defaults.
-     * Requires `source` capability to be configured.
-     */
-    repoPolicy?: RepoPolicyConfig;
-    /**
-     * CI workflow names to install as thin wrappers during `holocron setup`.
-     * Each name maps to a reusable workflow in `theholocron/.github`.
-     *
-     * Supported values: "lint" | "test" | "typecheck" | "codeql" | "review" |
-     *   "release" | "stale" | "greetings" | "dependencies" | "bookkeeping-pr" | "audit"
-     *
-     * `holocron setup` writes `.github/workflows/<name>.yml` for each entry,
-     * calling the corresponding `ci-<name>.yml@main` reusable workflow.
-     * Files are overwritten on each run — they are generated artifacts.
-     */
-    workflows?: string[];
-  };
+    with?: Record<string, unknown>;
+  }>;
   providers: RawProvidersConfig;
   apps?: AppConfig[];
   doctor?: DoctorConfig;
+  /**
+   * Agent runtime that determines where skills are installed by `holocron setup`.
+   * Skills are installed to `.agents/skills/<name>/` (canonical) with a
+   * relative symlink at the agent-specific path:
+   * - `"claude"` → `.claude/skills/<name>` → `../../.agents/skills/<name>`
+   * - `"codex"` | `"gemini"` → logged as unsupported; skipped gracefully.
+   */
+  agent?: "claude" | "codex" | "gemini";
+  /**
+   * Skill names from `@theholocron/skills` to install during `holocron setup`.
+   * Installed paths are gitignored and managed by setup — do not commit them.
+   *
+   * @example
+   * ["git-safety", "pr-workflow", "commit-standards"]
+   */
+  skills?: string[];
 }
 interface ResolvedTuple {
   provider: string;
@@ -79,10 +131,18 @@ type ResolvedProviderEntry = {
 };
 type ResolvedProvidersConfig = Partial<Record<CapabilityKey, ResolvedProviderEntry>>;
 interface ResolvedHolocronConfig {
-  project: HolocronConfig["project"];
+  name: string;
+  description?: string;
+  repo?: RepoConfig;
+  workflows?: Array<string | {
+    name: string;
+    with?: Record<string, unknown>;
+  }>;
   providers: ResolvedProvidersConfig;
   apps: AppConfig[];
   doctor: DoctorConfig;
+  agent?: "claude" | "codex" | "gemini";
+  skills?: string[];
 }
 declare class ConfigError extends Error {
   name: string;
@@ -96,6 +156,9 @@ declare function resolvePluginPackage(provider: string): string;
 declare function resolveEntry(key: CapabilityKey, raw: RawProviderEntry): ResolvedProviderEntry;
 declare function resolveConfig(raw: HolocronConfig): ResolvedHolocronConfig;
 //#endregion
+//#region src/define-config.d.ts
+declare function defineConfig(config: HolocronConfig): HolocronConfig;
+//#endregion
 //#region src/keyring.d.ts
 /**
  * Keyring-backed bootstrap credential store.
@@ -140,4 +203,20 @@ declare function deleteToken(provider: string): boolean;
  */
 declare function listStoredProviders(): string[];
 //#endregion
-export { Analytics, AppConfig, Auth, AuthDescription, AuthEvent, AuthEventType, AuthIdentity, AuthUser, CARDINALITY, CapabilityImpls, CapabilityKey, Cardinality, CardinalityFor, Ci, CiRun, CiRunFilter, CiRunStatus, ConfigError, ConnectionStringOptions, CreateAuthUserInput, Deployment, DeploymentProject, DeploymentProjectSettings, DeploymentRecord, DeploymentTarget, DeploymentTrigger, Dns, DnsRecord, DnsRecordType, DoctorConfig, EnsureResult, Environment, EnvironmentReviewer, Environments, HolocronConfig, Issue, IssueSearchFilter, Issues, LifecycleResult, LifecycleSlot, MultiEntry, NormalizedAuthUser, Notifications, Observability, ParseWebhookInput, ProviderApiError, ProviderIdentity, ProviderOptions, REQUIRED_CAPABILITIES, RawProviderEntry, RawProvidersConfig, RepoPolicyConfig, RepoRef, RepoSettings, ResolvedCapability, ResolvedHolocronConfig, ResolvedProviderEntry, ResolvedProvidersConfig, ResolvedTuple, Ruleset, SecretScope, Secrets, SingleEntry, Source, StatusCategory, Storage, StorageBranch, Tooling, ToolingDoctorReport, TrackerDoctorReport, TrackerUser, Vault, WebhookDashboardInfo, WebhookVerificationError, deleteToken, getToken, isMulti, listStoredProviders, resolveConfig, resolveEntry, resolvePluginPackage, setToken };
+//#region src/load-config.d.ts
+declare class ConfigFileError extends Error {
+  name: string;
+}
+interface LoadedConfig {
+  resolved: ResolvedHolocronConfig;
+  /** Absolute path to the file the config was read from. */
+  filepath: string;
+}
+/**
+ * Read + parse + resolve `holocron.config.*` from the given directory.
+ * Search order: json → js → ts. Throws `ConfigFileError` if nothing
+ * found, or `ConfigError` if the config is malformed / invalid.
+ */
+declare function loadConfig(cwd: string): Promise<LoadedConfig>;
+//#endregion
+export { Analytics, AppConfig, Auth, AuthDescription, AuthError, AuthEvent, AuthEventType, AuthIdentity, AuthUser, CARDINALITY, CapabilityConfigPackage, CapabilityImpls, CapabilityKey, Cardinality, CardinalityFor, Ci, CiRun, CiRunFilter, CiRunStatus, ConfigError, ConfigFileError, ConnectionStringOptions, CreateAuthUserInput, Deployment, DeploymentProject, DeploymentProjectSettings, DeploymentRecord, DeploymentTarget, DeploymentTrigger, Dns, DnsRecord, DnsRecordType, DoctorConfig, EnsureResult, Environment, EnvironmentReviewer, Environments, HolocronConfig, Issue, IssueSearchFilter, Issues, LabelDef, LifecycleResult, LifecycleSlot, LoadedConfig, MultiEntry, NormalizedAuthUser, Notifications, Observability, ParseWebhookInput, ProviderApiError, ProviderIdentity, ProviderOptions, REQUIRED_CAPABILITIES, RawProviderEntry, RawProvidersConfig, RepoConfig, RepoProperties, RepoProtection, RepoRef, RepoSettings, type RequestOptions, ResolveTokenConfig, type ResolveTokenInput, ResolvedCapability, ResolvedHolocronConfig, ResolvedProviderEntry, ResolvedProvidersConfig, ResolvedTuple, type RestClient, type RestClientConfig, Ruleset, SecretScope, Secrets, SingleEntry, Source, StatusCategory, Storage, StorageBranch, TeamEntry, TeamPermission, Tooling, ToolingDoctorReport, TrackerDoctorReport, TrackerUser, Vault, WebhookDashboardInfo, WebhookVerificationError, createResolveToken, createRestClient, defineConfig, deleteToken, getToken, isMulti, listStoredProviders, loadConfig, resolveConfig, resolveEntry, resolvePluginPackage, setToken };

package/dist/index.mjs

@@ -1,3 +1,328 @@
-import { a as isMulti, i as WebhookVerificationError, n as ProviderApiError, r as REQUIRED_CAPABILITIES, t as CARDINALITY } from "./capabilities-DapaKOlX.mjs";
-import { a as ConfigError, c as resolvePluginPackage, i as setToken, n as getToken, o as resolveConfig, r as listStoredProviders, s as resolveEntry, t as deleteToken } from "./keyring-DwNEmrBc.mjs";
-export { CARDINALITY, ConfigError, ProviderApiError, REQUIRED_CAPABILITIES, WebhookVerificationError, deleteToken, getToken, isMulti, listStoredProviders, resolveConfig, resolveEntry, resolvePluginPackage, setToken };
+import { CARDINALITY, ProviderApiError, REQUIRED_CAPABILITIES, WebhookVerificationError, isMulti } from "./capabilities/index.mjs";
+import { AuthError, createResolveToken as createResolveToken$1, createRestClient } from "@theholocron/http-client";
+import { Entry, findCredentials } from "@napi-rs/keyring";
+import { execFile } from "node:child_process";
+import { readFile, stat } from "node:fs/promises";
+import { basename, dirname, join } from "node:path";
+import { pathToFileURL } from "node:url";
+import { promisify } from "node:util";
+//#region src/keyring.ts
+/**
+* Keyring-backed bootstrap credential store.
+*
+* Every holocron plugin's bootstrap token (the one it needs before it
+* can talk to its vendor's API) can be stored in the OS keyring under
+* a single reverse-DNS service scope. Managed via `holocron auth`
+* subcommands; consulted at position 4 in every plugin's auth
+* precedence chain (after --token / HOLOCRON_<X>_TOKEN / <native>_TOKEN).
+*
+* See `.notes/tech-auth-bootstrap.spec.md` for the design rationale.
+*
+* Failure model: keyring access is best-effort. Platforms without a
+* supported credential store (some Linux CI images, sandboxed
+* environments) will throw from the underlying library. Every export
+* here catches and returns a null/empty result rather than propagating
+* — the plugin's precedence chain then falls through to
+* env-var-only paths, which is exactly how CI is meant to work.
+*/
+const SERVICE = "com.theholocron.cli";
+/**
+* Store or overwrite a bootstrap token for a provider. Returns true on
+* success, false when the underlying keyring is unsupported or errored.
+*/
+function setToken(provider, token) {
+	try {
+		new Entry(SERVICE, provider).setPassword(token);
+		return true;
+	} catch {
+		return false;
+	}
+}
+/**
+* Read the bootstrap token for a provider. Returns `null` for both
+* "not stored" and "keyring unavailable" — callers can treat them the
+* same way (fall through to env-var precedence).
+*/
+function getToken(provider) {
+	try {
+		return new Entry(SERVICE, provider).getPassword();
+	} catch {
+		return null;
+	}
+}
+/**
+* Delete a stored token. Returns true when a token was removed, false
+* when there was nothing to delete or the keyring is unavailable.
+* Distinguishing the two cases isn't worth the surface area — the
+* command output makes the situation clear either way.
+*/
+function deleteToken(provider) {
+	try {
+		return new Entry(SERVICE, provider).deletePassword();
+	} catch {
+		return false;
+	}
+}
+/**
+* List provider slugs with a stored token in this service scope.
+* Uses the library's `findCredentials(service)` — supported on all
+* platforms the underlying credential store supports.
+*/
+function listStoredProviders() {
+	try {
+		return findCredentials(SERVICE).map((c) => c.account);
+	} catch {
+		return [];
+	}
+}
+//#endregion
+//#region src/auth-resolver.ts
+/** Wraps `createResolveToken` from `@theholocron/http` and injects the
+*  system keyring so plugins stay at a one-liner call site. */
+function createResolveToken(config) {
+	return createResolveToken$1({
+		...config,
+		getKeyringToken: getToken
+	});
+}
+//#endregion
+//#region src/config.ts
+/**
+* `holocron.config.json` schema, parser, and provider resolution.
+*
+* ESLint-style entry forms:
+*
+*   "source": "github"                              ← single, short
+*   "deployment": ["vercel", { team: "rando" }]    ← single, with options
+*   "notifications": ["slack", "discord"]          ← multi, short
+*   "notifications": [
+*     ["slack",   { channel: "#ops" }],
+*     ["discord", { webhook: "env:HOOK" }]
+*   ]                                              ← multi, with options
+*
+* Discriminator: an array entry is a `[provider, options]` tuple when
+* the length is 2 AND element[1] is a non-array, non-null object.
+* Otherwise it's a multi-provider list (string[] or tuple[]).
+*
+* Validation rules:
+*   - `vault` is REQUIRED (every project has secrets somewhere)
+*   - Entries for `'many'` capabilities are normalized to an array of
+*     normalized tuples; entries for `'single'` capabilities are
+*     normalized to one tuple
+*   - Tokens / secret values never appear in config — providers read
+*     them from env (or pull from `vault` at runtime)
+*/
+var ConfigError = class extends Error {
+	name = "ConfigError";
+};
+const PLUGIN_PREFIX = "@theholocron/holocron-plugin-";
+const COMMUNITY_PREFIX = "holocron-plugin-";
+/**
+* Resolve `"github"` → `"@theholocron/holocron-plugin-github"`.
+* Fully-qualified names (scoped or not) are honored verbatim, which
+* is how third-party plugins published outside the org work.
+*/
+function resolvePluginPackage(provider) {
+	if (!provider) throw new ConfigError("provider name is empty");
+	if (provider.startsWith("@")) return provider;
+	if (provider.startsWith(COMMUNITY_PREFIX)) return provider;
+	if (provider.includes("/")) return provider;
+	return PLUGIN_PREFIX + provider;
+}
+/** A bare `[provider, options]` tuple, with both elements present? */
+function isOptionsTuple(value) {
+	if (!Array.isArray(value)) return false;
+	if (value.length !== 2) return false;
+	if (typeof value[0] !== "string") return false;
+	const opt = value[1];
+	return typeof opt === "object" && opt !== null && !Array.isArray(opt);
+}
+function normalizeEntry(entry) {
+	if (typeof entry === "string") return {
+		provider: entry,
+		packageName: resolvePluginPackage(entry),
+		options: {}
+	};
+	const [provider, options] = entry;
+	return {
+		provider,
+		packageName: resolvePluginPackage(provider),
+		options
+	};
+}
+function resolveEntry(key, raw) {
+	const cardinality = CARDINALITY[key];
+	if (typeof raw === "string") {
+		if (cardinality === "many") throw new ConfigError(`\`${key}\` accepts multiple providers; wrap a single one in an array: ["${raw}"]`);
+		return {
+			cardinality: "single",
+			tuple: normalizeEntry(raw)
+		};
+	}
+	if (!Array.isArray(raw)) throw new ConfigError(`\`${key}\` entry must be a string or array, got ${typeof raw}`);
+	if (isOptionsTuple(raw)) {
+		if (cardinality === "many") return {
+			cardinality: "many",
+			tuples: [normalizeEntry(raw)]
+		};
+		return {
+			cardinality: "single",
+			tuple: normalizeEntry(raw)
+		};
+	}
+	if (cardinality === "single") throw new ConfigError(`\`${key}\` accepts exactly one provider; got a multi-provider list with ${raw.length} entries`);
+	return {
+		cardinality: "many",
+		tuples: raw.map((entry, idx) => {
+			if (typeof entry === "string") return normalizeEntry(entry);
+			if (isOptionsTuple(entry)) return normalizeEntry(entry);
+			throw new ConfigError(`\`${key}[${idx}]\` must be a provider string or [provider, options] tuple`);
+		})
+	};
+}
+function resolveConfig(raw) {
+	if (!raw.name) throw new ConfigError("`name` is required");
+	if (!raw.providers || typeof raw.providers !== "object") throw new ConfigError("`providers` block is required");
+	const providers = {};
+	for (const [key, entry] of Object.entries(raw.providers)) {
+		if (entry === void 0) continue;
+		providers[key] = resolveEntry(key, entry);
+	}
+	for (const required of REQUIRED_CAPABILITIES) if (!providers[required]) throw new ConfigError(`required capability \`${required}\` is missing from providers`);
+	return {
+		name: raw.name,
+		description: raw.description,
+		repo: raw.repo,
+		workflows: raw.workflows,
+		providers,
+		apps: raw.apps ?? [],
+		doctor: raw.doctor ?? {},
+		agent: raw.agent,
+		skills: raw.skills
+	};
+}
+//#endregion
+//#region src/define-config.ts
+function defineConfig(config) {
+	return config;
+}
+//#endregion
+//#region src/load-config.ts
+/**
+* `holocron.config.{json,js,ts}` file loader.
+*
+* Search order: json → js → ts. JSON is parsed directly; JS is loaded
+* via native dynamic import; TS is loaded via `tsImport` from tsx (a
+* runtime dep) so operators can write typed configs with `defineConfig`
+* without needing a separate build step.
+*
+* All three forms are validated through the same `resolveConfig` path.
+* Implements the lookup-order contract from issue #75 / #81.
+*/
+const execFileAsync = promisify(execFile);
+const CANDIDATE_FILENAMES = [
+	"holocron.config.json",
+	"holocron.config.js",
+	"holocron.config.ts"
+];
+var ConfigFileError = class extends Error {
+	name = "ConfigFileError";
+};
+/**
+* Read + parse + resolve `holocron.config.*` from the given directory.
+* Search order: json → js → ts. Throws `ConfigFileError` if nothing
+* found, or `ConfigError` if the config is malformed / invalid.
+*/
+async function loadConfig(cwd) {
+	for (const filename of CANDIDATE_FILENAMES) {
+		const fullPath = join(cwd, filename);
+		if (await fileExists(fullPath)) {
+			if (filename.endsWith(".json")) return {
+				resolved: await loadJson(fullPath),
+				filepath: fullPath
+			};
+			if (filename.endsWith(".ts")) return {
+				resolved: await loadTs(fullPath),
+				filepath: fullPath
+			};
+			return {
+				resolved: await loadJs(fullPath),
+				filepath: fullPath
+			};
+		}
+	}
+	throw new ConfigFileError(`no holocron.config.{json,js,ts} found in ${cwd}. Create one — see the README for the schema.`);
+}
+async function loadJson(filepath) {
+	const raw = await readFile(filepath, "utf8");
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch (err) {
+		throw new ConfigError(`${filepath} is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	return resolveConfig(await deriveDefaults(dirname(filepath), parsed));
+}
+async function loadJs(filepath) {
+	const mod = await import(pathToFileURL(filepath).href);
+	return resolveConfig(await deriveDefaults(dirname(filepath), extractRaw(filepath, mod)));
+}
+async function loadTs(filepath) {
+	const { tsImport } = await import("tsx/esm/api");
+	const mod = await tsImport(pathToFileURL(filepath).href, import.meta.url);
+	return resolveConfig(await deriveDefaults(dirname(filepath), extractRaw(filepath, mod)));
+}
+function extractRaw(filepath, mod) {
+	const outer = mod.default;
+	const raw = outer?.__esModule === true ? outer.default : outer;
+	if (raw === void 0 || raw === null) throw new ConfigFileError(`${filepath} must have a default export (use \`export default defineConfig({…})\`)`);
+	return raw;
+}
+async function deriveDefaults(configDir, raw) {
+	const result = { ...raw };
+	if (!result.name) result.name = await readPackageJsonName(configDir) ?? basename(configDir);
+	if (result.repo && !result.repo.name) {
+		const repoName = await readGitRemote(configDir);
+		if (repoName) result.repo = {
+			...result.repo,
+			name: repoName
+		};
+	}
+	return result;
+}
+async function readPackageJsonName(dir) {
+	try {
+		const content = await readFile(join(dir, "package.json"), "utf8");
+		const pkg = JSON.parse(content);
+		return typeof pkg.name === "string" ? pkg.name.replace(/^@[^/]+\//, "") : void 0;
+	} catch {
+		return;
+	}
+}
+async function readGitRemote(dir) {
+	try {
+		const { stdout } = await execFileAsync("git", [
+			"remote",
+			"get-url",
+			"origin"
+		], { cwd: dir });
+		return parseGitRemoteUrl(stdout.trim());
+	} catch {
+		return;
+	}
+}
+function parseGitRemoteUrl(url) {
+	const httpsMatch = url.match(/github\.com\/([^/]+\/[^/]+?)(?:\.git)?$/);
+	if (httpsMatch) return httpsMatch[1];
+	const sshMatch = url.match(/github\.com:([^/]+\/[^/]+?)(?:\.git)?$/);
+	if (sshMatch) return sshMatch[1];
+}
+async function fileExists(path) {
+	try {
+		return (await stat(path)).isFile();
+	} catch {
+		return false;
+	}
+}
+//#endregion
+export { AuthError, CARDINALITY, ConfigError, ConfigFileError, ProviderApiError, REQUIRED_CAPABILITIES, WebhookVerificationError, createResolveToken, createRestClient, defineConfig, deleteToken, getToken, isMulti, listStoredProviders, loadConfig, resolveConfig, resolveEntry, resolvePluginPackage, setToken };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theholocron/cli",
-  "version": "2.0.0-alpha.9",
+  "version": "2.0.0",
   "description": "The Holocron CLI — a pluggable, capability-based orchestrator for spinning up and operating software projects.",
   "homepage": "https://github.com/theholocron/holocron/tree/main/packages/cli#readme",
   "bugs": "https://github.com/theholocron/holocron/issues",
@@ -34,26 +34,33 @@
   ],
   "dependencies": {
     "@napi-rs/keyring": "^1.3.0",
+    "@theholocron/github-client": "^1.1.0",
+    "@theholocron/http-client": "^1.1.0",
+    "chalk": "^5.4.1",
+    "ora": "^8.2.0",
+    "tsx": "^4.22.4",
     "yargs": "^18.0.0"
   },
   "devDependencies": {
-    "@theholocron/eslint-config": "^4.1.0",
-    "@theholocron/tsconfig": "^4.1.0",
-    "@tsconfig/node-lts": "^24.0.0",
+    "@theholocron/eslint-config": "^7.3.0",
+    "@theholocron/tsconfig": "^7.3.0",
+    "@theholocron/vitest-config": "^7.3.0",
+    "@types/node": "^26",
     "@types/yargs": "^17.0.35",
-    "@vitest/coverage-v8": "^3.2.6",
-    "eslint": "^9.36.0",
-    "globals": "^16.5.0",
+    "@vitest/coverage-v8": "^4.1.10",
+    "@vitest/eslint-plugin": "^1.6.23",
+    "eslint": "^10.7.0",
+    "eslint-plugin-n": "^18.2.2",
+    "globals": "^17.7.0",
     "tsdown": "^0.22.3",
     "typescript": "^5.9.3",
-    "vitest": "^3.2.6",
-    "@theholocron/cli-utils": "0.0.0"
+    "vitest": "^4.1.10"
   },
   "publishConfig": {
     "access": "public"
   },
   "scripts": {
-    "build": "tsdown",
+    "build": "tsdown --config-loader tsx",
     "start": "tsx ./src/cli.ts",
     "lint": "eslint .",
     "typecheck": "tsc --noEmit",

package/dist/capabilities-DapaKOlX.mjs

@@ -1,47 +0,0 @@
-//#region src/capabilities/index.ts
-const CARDINALITY = {
-	source: "single",
-	ci: "single",
-	secrets: "single",
-	environments: "single",
-	issues: "single",
-	deployment: "single",
-	storage: "single",
-	auth: "single",
-	vault: "single",
-	dns: "single",
-	tooling: "many",
-	notifications: "many",
-	analytics: "many",
-	observability: "many"
-};
-/**
-* No capabilities are strictly required — repos without secrets (e.g. org
-* community health repos) legitimately omit vault. Plugins validate their
-* own requirements at call time.
-*/
-const REQUIRED_CAPABILITIES = [];
-/**
-* Surfaced from every capability call that hits a vendor API. Wraps
-* the underlying error with `status` (HTTP) and `details` so
-* orchestrators (`holocron setup`, `doctor`) can soft-skip rather
-* than abort.
-*/
-var ProviderApiError = class extends Error {
-	status;
-	details;
-	name = "ProviderApiError";
-	constructor(message, status, details) {
-		super(message);
-		this.status = status;
-		this.details = details;
-	}
-};
-var WebhookVerificationError = class extends Error {
-	name = "WebhookVerificationError";
-};
-function isMulti(key) {
-	return CARDINALITY[key] === "many";
-}
-//#endregion
-export { isMulti as a, WebhookVerificationError as i, ProviderApiError as n, REQUIRED_CAPABILITIES as r, CARDINALITY as t };

package/dist/cli.d.mts

@@ -1 +0,0 @@
-export { };