@theholocron/cli 3.1.0 → 3.2.0

package/dist/cli.mjs

@@ -1,4 +1,12 @@
 #!/usr/bin/env node
+(function() {
+	try {
+		var e = "undefined" != typeof window ? window : "undefined" != typeof global ? global : "undefined" != typeof globalThis ? globalThis : "undefined" != typeof self ? self : {};
+		e.SENTRY_RELEASE = { id: "holocron@3.1.1" };
+		var n = new e.Error().stack;
+		n && (e._sentryDebugIds = e._sentryDebugIds || {}, e._sentryDebugIds[n] = "9c44dac0-ac25-4e90-a623-6c67cc9d66a1", e._sentryDebugIdIdentifier = "sentry-dbid-9c44dac0-ac25-4e90-a623-6c67cc9d66a1");
+	} catch (e) {}
+})();
 import { createRequire } from "node:module";
 import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
 import path, { basename, dirname, join, relative, resolve } from "node:path";
@@ -17,6 +25,7 @@ import { access, copyFile, mkdir, readFile, readdir, rm, stat, symlink, unlink,
 import { pathToFileURL } from "node:url";
 import { createGitHubClient } from "@theholocron/github-client";
 import { promisify } from "node:util";
+import * as Sentry from "@sentry/node";
 //#region src/env.ts
 function createEnvLookup(source = process.env) {
 	return {
@@ -2485,7 +2494,7 @@ var stale_default$1 = "name: Stale\n\non: # yamllint disable-line rule:truthy\n
 var sync_github_default$1 = "name: Sync GitHub Templates\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n    paths:\n      - packages/cli/src/templates/index.ts\n      - packages/cli/src/commands/setup-workflows.ts\n\nconcurrency:\n  group: sync-github-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n\njobs:\n  sync:\n    name: Sync\n    uses: theholocron/.github/.github/workflows/sync-github.yml@main\n    with:\n      secondary-repos: theholocron/.github-private\n    secrets:\n      HOLOCRON_SYNC_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN }}\n";
 //#endregion
 //#region src/commands/workflows/test.yml
-var test_default$1 = "name: Test\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\nconcurrency:\n  group: test-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n\njobs:\n  test:\n    name: Test\n    uses: theholocron/.github/.github/workflows/test.yml@main\n    secrets: inherit\n";
+var test_default$1 = "name: Test\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\nconcurrency:\n  group: test-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n  id-token: write\n\njobs:\n  test:\n    name: Test\n    uses: theholocron/.github/.github/workflows/test.yml@main\n    secrets: inherit\n";
 //#endregion
 //#region src/commands/workflows/typecheck.yml
 var typecheck_default$1 = "name: Typecheck\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\nconcurrency:\n  group: typecheck-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n\njobs:\n  typecheck:\n    name: Typecheck\n    uses: theholocron/.github/.github/workflows/typecheck.yml@main\n    secrets: inherit\n";
@@ -4477,6 +4486,58 @@ async function fileExists(path) {
 	}
 }
 //#endregion
+//#region src/telemetry.ts
+const DSN = "https://95cbb72ad5636c94e119a5405ee8f55f@o4508238154104832.ingest.us.sentry.io/4511810950791168";
+function isEnabled() {
+	return !process.env.NO_HOLOCRON_TELEMETRY && true;
+}
+function init(version) {
+	if (!isEnabled()) return;
+	Sentry.init({
+		dsn: DSN,
+		release: `holocron@${version}`,
+		environment: process.env.CI ? "ci" : "local",
+		tracesSampleRate: 1,
+		beforeSend: scrubError
+	});
+	Sentry.startSession();
+	Sentry.setTag("os", process.platform);
+	Sentry.setTag("node", process.version);
+	Sentry.setTag("ci", String(Boolean(process.env.CI)));
+}
+function startCommand(name) {
+	if (!isEnabled()) return () => {};
+	Sentry.setTag("command", name);
+	const span = Sentry.startInactiveSpan({
+		name,
+		op: "holocron.command",
+		forceTransaction: true
+	});
+	return (ok) => {
+		span.setStatus({ code: ok ? 1 : 2 });
+		span.end();
+	};
+}
+function captureException(err) {
+	if (!isEnabled()) return;
+	Sentry.captureException(err);
+}
+function endSession() {
+	if (!isEnabled()) return;
+	Sentry.endSession();
+}
+async function flush() {
+	if (!isEnabled()) return;
+	await Sentry.close(2e3);
+}
+const TOKEN_RE = /\b(ghp_|ghs_|glpat-|xoxb-|xoxp-|npm_|sk-|[A-Z][A-Z0-9_]{2,}_TOKEN[=\s])[^\s"]*/g;
+function redact(raw) {
+	return raw.replace(TOKEN_RE, "[REDACTED]");
+}
+function scrubError(event, _hint) {
+	return JSON.parse(redact(JSON.stringify(event)));
+}
+//#endregion
 //#region src/token-args.ts
 var TokenParseError = class extends Error {
 	name = "TokenParseError";
@@ -4651,463 +4712,475 @@ function tokenContext(rawTokens) {
 		throw err;
 	}
 }
+init(CLI_VERSION);
 const updateCheckPromise = checkForUpdates(CLI_VERSION);
-await yargs(hideBin(process.argv)).scriptName("").usage("holocron <command> [options]").option("dry-run", {
-	type: "boolean",
-	default: false,
-	describe: "Print what would be mutated without calling capability mutators. Commands branch on this; read-only commands ignore it."
-}).option("token", {
-	type: "string",
-	array: true,
-	describe: "Vendor token override for plugins. Bare form: --token <value> (fallback for all plugins, single-plugin commands). Keyed form: --token vendor=value (targets a specific provider; repeat for each). Example: --token github=ghp_xxx --token vercel=v_yyy"
-}).option("cwd", {
-	type: "string",
-	default: process.cwd(),
-	describe: "Directory to search for holocron.config.json"
-}).command("version", "Print the CLI version", () => {}, () => {
-	console.log(`holocron ${CLI_VERSION}`);
-}).command("clone", "Clone all repos in a GitHub org as siblings under a single directory", (y) => y.option("org", {
-	type: "string",
-	demandOption: true,
-	describe: "GitHub org to clone (e.g., theholocron)"
-}).option("dir", {
-	type: "string",
-	describe: "Parent directory to clone into (default: ~/Code/<org>)"
-}), async (argv) => {
-	const tokens = tokenContext(argv.token);
-	if (!tokens) return;
-	let token;
-	try {
-		token = resolveCloneToken({ cliToken: tokens.cliTokens?.["github"] ?? tokens.cliToken });
-	} catch (err) {
-		console.error(`clone: ${err instanceof AuthError ? err.message : String(err)}`);
-		process.exitCode = 1;
-		return;
-	}
-	if ((await runClone({
-		org: argv.org,
-		token,
-		dryRun: argv.dryRun,
-		...argv.dir ? { dir: argv.dir } : {}
-	})).status === "fail") process.exitCode = 1;
-}).command("doctor", "Load the config and run a smoke check against every provider", (y) => y.option("repo", {
-	type: "string",
-	describe: "Repo coords (\"owner/name\"). Defaults to plugin-specific resolution."
-}), async (argv) => {
-	const tokens = tokenContext(argv.token);
-	if (!tokens) return;
-	if ((await runDoctor({
-		loaded: await loadConfig(argv.cwd),
-		context: {
-			repoRoot: argv.cwd,
-			dryRun: argv.dryRun,
-			...argv.repo ? { repo: argv.repo } : {},
-			...tokens
+let finishCommand = () => {};
+try {
+	await yargs(hideBin(process.argv)).middleware((argv) => {
+		finishCommand = startCommand(argv._.slice(0, 2).join(" ") || "unknown");
+	}).scriptName("").usage("holocron <command> [options]").option("dry-run", {
+		type: "boolean",
+		default: false,
+		describe: "Print what would be mutated without calling capability mutators. Commands branch on this; read-only commands ignore it."
+	}).option("token", {
+		type: "string",
+		array: true,
+		describe: "Vendor token override for plugins. Bare form: --token <value> (fallback for all plugins, single-plugin commands). Keyed form: --token vendor=value (targets a specific provider; repeat for each). Example: --token github=ghp_xxx --token vercel=v_yyy"
+	}).option("cwd", {
+		type: "string",
+		default: process.cwd(),
+		describe: "Directory to search for holocron.config.json"
+	}).command("version", "Print the CLI version", () => {}, () => {
+		console.log(`holocron ${CLI_VERSION}`);
+	}).command("clone", "Clone all repos in a GitHub org as siblings under a single directory", (y) => y.option("org", {
+		type: "string",
+		demandOption: true,
+		describe: "GitHub org to clone (e.g., theholocron)"
+	}).option("dir", {
+		type: "string",
+		describe: "Parent directory to clone into (default: ~/Code/<org>)"
+	}), async (argv) => {
+		const tokens = tokenContext(argv.token);
+		if (!tokens) return;
+		let token;
+		try {
+			token = resolveCloneToken({ cliToken: tokens.cliTokens?.["github"] ?? tokens.cliToken });
+		} catch (err) {
+			console.error(`clone: ${err instanceof AuthError ? err.message : String(err)}`);
+			process.exitCode = 1;
+			return;
 		}
-	})).summary.fail > 0) process.exitCode = 1;
-}).command("setup", "Apply infra setup actions across every configured capability", (y) => y.option("repo", {
-	type: "string",
-	describe: "Repo coords (\"owner/name\"). Defaults to plugin-specific resolution."
-}), async (argv) => {
-	const tokens = tokenContext(argv.token);
-	if (!tokens) return;
-	if ((await runSetup({
-		loaded: await loadConfig(argv.cwd),
-		context: {
-			repoRoot: argv.cwd,
+		if ((await runClone({
+			org: argv.org,
+			token,
 			dryRun: argv.dryRun,
-			...argv.repo ? { repo: argv.repo } : {},
-			...tokens
-		}
-	})).summary.fail > 0) process.exitCode = 1;
-}).command("skills", "Manage agent skills from the @theholocron/skills registry", (y) => y.command("install", "Copy skills from @theholocron/skills into .agents/ with agent symlinks", () => {}, async (argv) => {
-	await runSkillsInstall({
-		loaded: await loadConfig(argv.cwd),
-		context: {
-			repoRoot: argv.cwd,
-			dryRun: argv.dryRun
-		}
-	});
-}).command("remove [names..]", "Remove installed skills via npx skills remove", (yy) => yy.positional("names", {
-	type: "string",
-	array: true,
-	describe: "Skill name(s) to remove (omit to remove all installed skills)"
-}), (argv) => {
-	if (runSkillsRemove({
-		context: {
-			repoRoot: argv.cwd,
-			dryRun: argv.dryRun
-		},
-		...argv.names?.length ? { names: argv.names } : {}
-	}).status === "fail") process.exitCode = 1;
-}).command("update [name]", "Update installed skills to their latest upstream versions via npx skills update", (yy) => yy.positional("name", {
-	type: "string",
-	describe: "Skill name to update (omit to update all installed skills)"
-}), (argv) => {
-	if (runSkillsUpdate({
-		context: {
-			repoRoot: argv.cwd,
+			...argv.dir ? { dir: argv.dir } : {}
+		})).status === "fail") process.exitCode = 1;
+	}).command("doctor", "Load the config and run a smoke check against every provider", (y) => y.option("repo", {
+		type: "string",
+		describe: "Repo coords (\"owner/name\"). Defaults to plugin-specific resolution."
+	}), async (argv) => {
+		const tokens = tokenContext(argv.token);
+		if (!tokens) return;
+		if ((await runDoctor({
+			loaded: await loadConfig(argv.cwd),
+			context: {
+				repoRoot: argv.cwd,
+				dryRun: argv.dryRun,
+				...argv.repo ? { repo: argv.repo } : {},
+				...tokens
+			}
+		})).summary.fail > 0) process.exitCode = 1;
+	}).command("setup", "Apply infra setup actions across every configured capability", (y) => y.option("repo", {
+		type: "string",
+		describe: "Repo coords (\"owner/name\"). Defaults to plugin-specific resolution."
+	}), async (argv) => {
+		const tokens = tokenContext(argv.token);
+		if (!tokens) return;
+		if ((await runSetup({
+			loaded: await loadConfig(argv.cwd),
+			context: {
+				repoRoot: argv.cwd,
+				dryRun: argv.dryRun,
+				...argv.repo ? { repo: argv.repo } : {},
+				...tokens
+			}
+		})).summary.fail > 0) process.exitCode = 1;
+	}).command("skills", "Manage agent skills from the @theholocron/skills registry", (y) => y.command("install", "Copy skills from @theholocron/skills into .agents/ with agent symlinks", () => {}, async (argv) => {
+		await runSkillsInstall({
+			loaded: await loadConfig(argv.cwd),
+			context: {
+				repoRoot: argv.cwd,
+				dryRun: argv.dryRun
+			}
+		});
+	}).command("remove [names..]", "Remove installed skills via npx skills remove", (yy) => yy.positional("names", {
+		type: "string",
+		array: true,
+		describe: "Skill name(s) to remove (omit to remove all installed skills)"
+	}), (argv) => {
+		if (runSkillsRemove({
+			context: {
+				repoRoot: argv.cwd,
+				dryRun: argv.dryRun
+			},
+			...argv.names?.length ? { names: argv.names } : {}
+		}).status === "fail") process.exitCode = 1;
+	}).command("update [name]", "Update installed skills to their latest upstream versions via npx skills update", (yy) => yy.positional("name", {
+		type: "string",
+		describe: "Skill name to update (omit to update all installed skills)"
+	}), (argv) => {
+		if (runSkillsUpdate({
+			context: {
+				repoRoot: argv.cwd,
+				dryRun: argv.dryRun
+			},
+			...argv.name ? { name: argv.name } : {}
+		}).status === "fail") process.exitCode = 1;
+	}).demandCommand(1, "Run `holocron skills --help` to see available skills subcommands."), () => {}).command("secret set <name> [value]", "Set a single secret via the configured `secrets` capability", (y) => y.positional("name", {
+		type: "string",
+		demandOption: true,
+		describe: "Secret name (e.g., NPM_TOKEN)"
+	}).positional("value", {
+		type: "string",
+		describe: "Secret value (positional). If omitted, sources from --from-stdin, --from-env, or env var matching <name>."
+	}).option("from-stdin", {
+		type: "boolean",
+		default: false,
+		describe: "Read the secret value from stdin"
+	}).option("from-env", {
+		type: "string",
+		describe: "Read the secret value from the named env var (otherwise: env var matching <name>)"
+	}).option("scope", {
+		type: "string",
+		default: "repo",
+		describe: "Scope: \"repo\" (default), \"env=<name>\", or \"org=<name>\""
+	}), async (argv) => {
+		const tokens = tokenContext(argv.token);
+		if (!tokens) return;
+		const scopeArg = argv.scope;
+		const scope = parseScope(scopeArg);
+		if ((await runSecretSet({
+			loaded: await loadConfig(argv.cwd),
+			context: {
+				repoRoot: argv.cwd,
+				dryRun: argv.dryRun,
+				...tokens
+			},
+			name: argv.name,
+			...argv.value ? { value: argv.value } : {},
+			...argv.fromStdin ? { fromStdin: true } : {},
+			...argv.fromEnv ? { fromEnv: argv.fromEnv } : {},
+			scope
+		})).status === "fail") process.exitCode = 1;
+	}).command("secrets sync <environmentId>", "Read a vault environment + fan KEY=VALUEs out to secrets + deployment env vars", (y) => y.positional("environmentId", {
+		type: "string",
+		demandOption: true,
+		describe: "Vault environment id to read (1P Environment id, etc.)"
+	}).option("project-id", {
+		type: "string",
+		describe: "Deployment project id (e.g., Vercel prj_*). Required when deployment is loaded."
+	}).option("target", {
+		type: "array",
+		default: ["production", "preview"],
+		describe: "Deployment targets to sync to. Defaults to production + preview."
+	}), async (argv) => {
+		const tokens = tokenContext(argv.token);
+		if (!tokens) return;
+		if ((await runSecretsSync({
+			loaded: await loadConfig(argv.cwd),
+			context: {
+				repoRoot: argv.cwd,
+				dryRun: argv.dryRun,
+				...tokens
+			},
+			environmentId: argv.environmentId,
+			...argv.projectId ? { projectId: argv.projectId } : {},
+			targets: argv.target
+		})).summary.fail > 0) process.exitCode = 1;
+	}).command("deploy <branch>", "Trigger a deployment via the configured `deployment` capability", (y) => y.positional("branch", {
+		type: "string",
+		demandOption: true,
+		describe: "Git branch to deploy"
+	}).option("project-id", {
+		type: "string",
+		demandOption: true,
+		describe: "Deployment project id (e.g., Vercel prj_*)"
+	}).option("target", {
+		type: "string",
+		choices: ["production", "staging"],
+		describe: "Named environment to deploy into. Omit for a branch preview."
+	}), async (argv) => {
+		const tokens = tokenContext(argv.token);
+		if (!tokens) return;
+		if ((await runDeploy({
+			loaded: await loadConfig(argv.cwd),
+			context: {
+				repoRoot: argv.cwd,
+				dryRun: argv.dryRun,
+				...tokens
+			},
+			projectId: argv.projectId,
+			branch: argv.branch,
+			...argv.target ? { target: argv.target } : {}
+		})).status === "fail") process.exitCode = 1;
+	}).command("npm", "npm-related monorepo utilities", (y) => y.command("bump-versions <new-version>", "Bump all non-private package versions in lockstep (semantic-release prepareCmd)", (yy) => yy.positional("new-version", {
+		type: "string",
+		demandOption: true,
+		describe: "Version to set (e.g., 4.2.0 or 2.0.0-alpha.1)"
+	}), async (argv) => {
+		if ((await runNpmBumpVersions({
+			version: argv.newVersion,
+			cwd: argv.cwd,
 			dryRun: argv.dryRun
-		},
-		...argv.name ? { name: argv.name } : {}
-	}).status === "fail") process.exitCode = 1;
-}).demandCommand(1, "Run `holocron skills --help` to see available skills subcommands."), () => {}).command("secret set <name> [value]", "Set a single secret via the configured `secrets` capability", (y) => y.positional("name", {
-	type: "string",
-	demandOption: true,
-	describe: "Secret name (e.g., NPM_TOKEN)"
-}).positional("value", {
-	type: "string",
-	describe: "Secret value (positional). If omitted, sources from --from-stdin, --from-env, or env var matching <name>."
-}).option("from-stdin", {
-	type: "boolean",
-	default: false,
-	describe: "Read the secret value from stdin"
-}).option("from-env", {
-	type: "string",
-	describe: "Read the secret value from the named env var (otherwise: env var matching <name>)"
-}).option("scope", {
-	type: "string",
-	default: "repo",
-	describe: "Scope: \"repo\" (default), \"env=<name>\", or \"org=<name>\""
-}), async (argv) => {
-	const tokens = tokenContext(argv.token);
-	if (!tokens) return;
-	const scopeArg = argv.scope;
-	const scope = parseScope(scopeArg);
-	if ((await runSecretSet({
-		loaded: await loadConfig(argv.cwd),
-		context: {
-			repoRoot: argv.cwd,
-			dryRun: argv.dryRun,
-			...tokens
-		},
-		name: argv.name,
-		...argv.value ? { value: argv.value } : {},
-		...argv.fromStdin ? { fromStdin: true } : {},
-		...argv.fromEnv ? { fromEnv: argv.fromEnv } : {},
-		scope
-	})).status === "fail") process.exitCode = 1;
-}).command("secrets sync <environmentId>", "Read a vault environment + fan KEY=VALUEs out to secrets + deployment env vars", (y) => y.positional("environmentId", {
-	type: "string",
-	demandOption: true,
-	describe: "Vault environment id to read (1P Environment id, etc.)"
-}).option("project-id", {
-	type: "string",
-	describe: "Deployment project id (e.g., Vercel prj_*). Required when deployment is loaded."
-}).option("target", {
-	type: "array",
-	default: ["production", "preview"],
-	describe: "Deployment targets to sync to. Defaults to production + preview."
-}), async (argv) => {
-	const tokens = tokenContext(argv.token);
-	if (!tokens) return;
-	if ((await runSecretsSync({
-		loaded: await loadConfig(argv.cwd),
-		context: {
-			repoRoot: argv.cwd,
-			dryRun: argv.dryRun,
-			...tokens
-		},
-		environmentId: argv.environmentId,
-		...argv.projectId ? { projectId: argv.projectId } : {},
-		targets: argv.target
-	})).summary.fail > 0) process.exitCode = 1;
-}).command("deploy <branch>", "Trigger a deployment via the configured `deployment` capability", (y) => y.positional("branch", {
-	type: "string",
-	demandOption: true,
-	describe: "Git branch to deploy"
-}).option("project-id", {
-	type: "string",
-	demandOption: true,
-	describe: "Deployment project id (e.g., Vercel prj_*)"
-}).option("target", {
-	type: "string",
-	choices: ["production", "staging"],
-	describe: "Named environment to deploy into. Omit for a branch preview."
-}), async (argv) => {
-	const tokens = tokenContext(argv.token);
-	if (!tokens) return;
-	if ((await runDeploy({
-		loaded: await loadConfig(argv.cwd),
-		context: {
-			repoRoot: argv.cwd,
-			dryRun: argv.dryRun,
-			...tokens
-		},
-		projectId: argv.projectId,
-		branch: argv.branch,
-		...argv.target ? { target: argv.target } : {}
-	})).status === "fail") process.exitCode = 1;
-}).command("npm", "npm-related monorepo utilities", (y) => y.command("bump-versions <new-version>", "Bump all non-private package versions in lockstep (semantic-release prepareCmd)", (yy) => yy.positional("new-version", {
-	type: "string",
-	demandOption: true,
-	describe: "Version to set (e.g., 4.2.0 or 2.0.0-alpha.1)"
-}), async (argv) => {
-	if ((await runNpmBumpVersions({
-		version: argv.newVersion,
-		cwd: argv.cwd,
-		dryRun: argv.dryRun
-	})).status === "fail") process.exitCode = 1;
-}).command("publish-initial", "One-shot bootstrap publish for trusted-publishing-eligible packages", (yy) => yy.option("tag", {
-	type: "string",
-	default: "alpha",
-	describe: "npm distribution tag (defaults to alpha)"
-}).option("otp", {
-	type: "string",
-	describe: "One-time password from your authenticator (required if npm needs 2FA for writes)"
-}), async (argv) => {
-	if ((await runNpmPublishInitial({
-		cwd: argv.cwd,
-		tag: argv.tag,
-		dryRun: argv.dryRun,
-		...argv.otp ? { otp: argv.otp } : {}
-	})).status === "fail") process.exitCode = 1;
-}).demandCommand(1, "Run `holocron npm --help` to see available npm subcommands."), () => {}).command("sync [steps..]", "Sync state from config to the provider and local files (labels, properties, topics, keywords, description)", (y) => y.positional("steps", {
-	type: "string",
-	array: true,
-	describe: "Steps to run: labels, properties, topics, keywords, description (default: all)"
-}).option("repo", {
-	type: "string",
-	describe: "Repo coords (\"owner/name\"). Defaults to plugin-specific resolution."
-}), async (argv) => {
-	const tokens = tokenContext(argv.token);
-	if (!tokens) return;
-	if ((await runSync({
-		loaded: await loadConfig(argv.cwd),
-		context: {
-			repoRoot: argv.cwd,
+		})).status === "fail") process.exitCode = 1;
+	}).command("publish-initial", "One-shot bootstrap publish for trusted-publishing-eligible packages", (yy) => yy.option("tag", {
+		type: "string",
+		default: "alpha",
+		describe: "npm distribution tag (defaults to alpha)"
+	}).option("otp", {
+		type: "string",
+		describe: "One-time password from your authenticator (required if npm needs 2FA for writes)"
+	}), async (argv) => {
+		if ((await runNpmPublishInitial({
+			cwd: argv.cwd,
+			tag: argv.tag,
 			dryRun: argv.dryRun,
-			...argv.repo ? { repo: argv.repo } : {},
-			...tokens
-		},
-		...argv.steps && argv.steps.length > 0 ? { steps: argv.steps } : {}
-	})).summary.fail > 0) process.exitCode = 1;
-}).command("sync-github", "Sync workflow templates and composite actions to theholocron/.github via the GitHub API", (y) => y.option("repo", {
-	type: "string",
-	default: "theholocron/.github",
-	describe: "Target org/repo (default: theholocron/.github)"
-}).option("branch", {
-	type: "string",
-	describe: "Push to this branch instead of the default branch (enables PR-based workflow for protected repos)"
-}).option("pr", {
-	type: "boolean",
-	default: false,
-	describe: "Open a PR after pushing to --branch (no-op without --branch)"
-}).option("message", {
-	type: "string",
-	describe: "Commit message (default: chore: sync from theholocron/holocron)"
-}).option("output-dir", {
-	type: "string",
-	describe: "Write generated files to this local directory instead of pushing (for validation)"
-}), async (argv) => {
-	const outputDir = argv["output-dir"];
-	const parsed = tokenContext(argv.token);
-	if (!parsed) return;
-	let token;
-	if (outputDir) token = "no-token-needed";
-	else try {
-		token = resolveSyncToken({ cliToken: parsed.cliTokens?.["github"] ?? parsed.cliToken });
-	} catch (err) {
-		console.error(`sync-github: ${err instanceof AuthError ? err.message : String(err)}`);
-		process.exitCode = 1;
-		return;
-	}
-	if ((await runSyncGithub({
-		token,
-		repo: argv.repo,
-		dryRun: argv.dryRun,
-		...argv.branch ? { branch: argv.branch } : {},
-		...argv.pr ? { createPr: true } : {},
-		...argv.message ? { message: argv.message } : {},
-		...outputDir ? { outputDir } : {}
-	})).status === "fail") process.exitCode = 1;
-}).command("config show", "Print the resolved holocron config", () => {}, async (argv) => {
-	const loaded = await loadConfig(argv.cwd);
-	console.log(JSON.stringify(loaded.resolved, null, 2));
-}).command("new [type] [name]", "Scaffold a new repo from a GitHub template (e.g. cli, react, nextjs, node, monorepo, base)", (y) => y.positional("type", {
-	type: "string",
-	describe: "Template type — maps to theholocron/<type>-template (e.g. cli, react, nextjs, node, monorepo, base)"
-}).positional("name", {
-	type: "string",
-	describe: "New repo name (kebab-case, e.g. my-tool)"
-}).option("description", {
-	type: "string",
-	describe: "Short description — replaces <description> placeholders in the template"
-}).option("org", {
-	type: "string",
-	default: "theholocron",
-	describe: "GitHub org that owns the template and will own the new repo"
-}).option("verify", {
-	type: "boolean",
-	default: true,
-	describe: "Run pnpm install after bootstrapping (default true; --no-verify skips)"
-}), async (argv) => {
-	try {
-		let type = argv.type;
-		let name = argv.name;
-		let description = argv.description;
-		if (!type || !name || description === void 0) {
-			const rl = createInterface({
-				input: stdin,
-				output: stdout
-			});
-			const ask = (question) => new Promise((resolve) => rl.question(`  ${question} `, (answer) => resolve(answer.trim())));
-			try {
-				if (!type) {
-					console.log("  Known types: base, cli, monorepo, nextjs, node, react");
-					type = await ask("Template type:");
-				}
-				if (!name) name = await ask("Repo name (kebab-case):");
-				if (description === void 0) description = await ask("Short description (Enter to skip):");
-			} finally {
-				rl.close();
-			}
-		}
-		if (!type) {
-			console.error("new: template type is required");
-			process.exitCode = 1;
-			return;
-		}
-		if (!name) {
-			console.error("new: repo name is required");
+			...argv.otp ? { otp: argv.otp } : {}
+		})).status === "fail") process.exitCode = 1;
+	}).demandCommand(1, "Run `holocron npm --help` to see available npm subcommands."), () => {}).command("sync [steps..]", "Sync state from config to the provider and local files (labels, properties, topics, keywords, description)", (y) => y.positional("steps", {
+		type: "string",
+		array: true,
+		describe: "Steps to run: labels, properties, topics, keywords, description (default: all)"
+	}).option("repo", {
+		type: "string",
+		describe: "Repo coords (\"owner/name\"). Defaults to plugin-specific resolution."
+	}), async (argv) => {
+		const tokens = tokenContext(argv.token);
+		if (!tokens) return;
+		if ((await runSync({
+			loaded: await loadConfig(argv.cwd),
+			context: {
+				repoRoot: argv.cwd,
+				dryRun: argv.dryRun,
+				...argv.repo ? { repo: argv.repo } : {},
+				...tokens
+			},
+			...argv.steps && argv.steps.length > 0 ? { steps: argv.steps } : {}
+		})).summary.fail > 0) process.exitCode = 1;
+	}).command("sync-github", "Sync workflow templates and composite actions to theholocron/.github via the GitHub API", (y) => y.option("repo", {
+		type: "string",
+		default: "theholocron/.github",
+		describe: "Target org/repo (default: theholocron/.github)"
+	}).option("branch", {
+		type: "string",
+		describe: "Push to this branch instead of the default branch (enables PR-based workflow for protected repos)"
+	}).option("pr", {
+		type: "boolean",
+		default: false,
+		describe: "Open a PR after pushing to --branch (no-op without --branch)"
+	}).option("message", {
+		type: "string",
+		describe: "Commit message (default: chore: sync from theholocron/holocron)"
+	}).option("output-dir", {
+		type: "string",
+		describe: "Write generated files to this local directory instead of pushing (for validation)"
+	}), async (argv) => {
+		const outputDir = argv["output-dir"];
+		const parsed = tokenContext(argv.token);
+		if (!parsed) return;
+		let token;
+		if (outputDir) token = "no-token-needed";
+		else try {
+			token = resolveSyncToken({ cliToken: parsed.cliTokens?.["github"] ?? parsed.cliToken });
+		} catch (err) {
+			console.error(`sync-github: ${err instanceof AuthError ? err.message : String(err)}`);
 			process.exitCode = 1;
 			return;
 		}
-		if ((await runNew({
-			type,
-			name,
-			...description ? { description } : {},
-			org: argv.org,
+		if ((await runSyncGithub({
+			token,
+			repo: argv.repo,
 			dryRun: argv.dryRun,
-			noVerify: !argv.verify,
-			cwd: argv.cwd
+			...argv.branch ? { branch: argv.branch } : {},
+			...argv.pr ? { createPr: true } : {},
+			...argv.message ? { message: argv.message } : {},
+			...outputDir ? { outputDir } : {}
 		})).status === "fail") process.exitCode = 1;
-	} catch (err) {
-		if (err instanceof NewError) {
-			console.error(`new: ${err.message}`);
-			process.exitCode = 1;
-			return;
+	}).command("config show", "Print the resolved holocron config", () => {}, async (argv) => {
+		const loaded = await loadConfig(argv.cwd);
+		console.log(JSON.stringify(loaded.resolved, null, 2));
+	}).command("new [type] [name]", "Scaffold a new repo from a GitHub template (e.g. cli, react, nextjs, node, monorepo, base)", (y) => y.positional("type", {
+		type: "string",
+		describe: "Template type — maps to theholocron/<type>-template (e.g. cli, react, nextjs, node, monorepo, base)"
+	}).positional("name", {
+		type: "string",
+		describe: "New repo name (kebab-case, e.g. my-tool)"
+	}).option("description", {
+		type: "string",
+		describe: "Short description — replaces <description> placeholders in the template"
+	}).option("org", {
+		type: "string",
+		default: "theholocron",
+		describe: "GitHub org that owns the template and will own the new repo"
+	}).option("verify", {
+		type: "boolean",
+		default: true,
+		describe: "Run pnpm install after bootstrapping (default true; --no-verify skips)"
+	}), async (argv) => {
+		try {
+			let type = argv.type;
+			let name = argv.name;
+			let description = argv.description;
+			if (!type || !name || description === void 0) {
+				const rl = createInterface({
+					input: stdin,
+					output: stdout
+				});
+				const ask = (question) => new Promise((resolve) => rl.question(`  ${question} `, (answer) => resolve(answer.trim())));
+				try {
+					if (!type) {
+						console.log("  Known types: base, cli, monorepo, nextjs, node, react");
+						type = await ask("Template type:");
+					}
+					if (!name) name = await ask("Repo name (kebab-case):");
+					if (description === void 0) description = await ask("Short description (Enter to skip):");
+				} finally {
+					rl.close();
+				}
+			}
+			if (!type) {
+				console.error("new: template type is required");
+				process.exitCode = 1;
+				return;
+			}
+			if (!name) {
+				console.error("new: repo name is required");
+				process.exitCode = 1;
+				return;
+			}
+			if ((await runNew({
+				type,
+				name,
+				...description ? { description } : {},
+				org: argv.org,
+				dryRun: argv.dryRun,
+				noVerify: !argv.verify,
+				cwd: argv.cwd
+			})).status === "fail") process.exitCode = 1;
+		} catch (err) {
+			if (err instanceof NewError) {
+				console.error(`new: ${err.message}`);
+				process.exitCode = 1;
+				return;
+			}
+			throw err;
 		}
-		throw err;
-	}
-}).command("plugin create <slug> <vendor>", "Scaffold a new @theholocron/holocron-plugin-<slug> package", (y) => y.positional("slug", {
-	type: "string",
-	demandOption: true,
-	describe: "Package slug (kebab-case)"
-}).positional("vendor", {
-	type: "string",
-	demandOption: true,
-	describe: "Vendor display name (PascalCase)"
-}).option("capability", {
-	type: "string",
-	describe: "Capability key: source|ci|secrets|environments|issues|deployment|storage|auth|vault|dns|tooling|notifications|analytics|observability"
-}).option("token-env", {
-	type: "string",
-	describe: "Holocron env var name (defaults to HOLOCRON_<VENDOR>_TOKEN)"
-}).option("vendor-env", {
-	type: "string",
-	describe: "Vendor-native env var name"
-}).option("base-url", {
-	type: "string",
-	describe: "REST base URL"
-}).option("verify", {
-	type: "boolean",
-	default: true,
-	describe: "Run post-scaffold pnpm install + typecheck + lint + test (default true; --no-verify skips)"
-}), async (argv) => {
-	try {
-		const capabilityKeys = Object.keys(CARDINALITY).join(", ");
-		const needsPrompt = !argv.capability || !argv.vendorEnv || !argv.baseUrl;
-		let capability;
-		let vendorEnv;
-		let baseUrl;
-		if (needsPrompt) {
-			const rl = createInterface({
-				input: stdin,
-				output: stdout
-			});
-			const ask = (question) => new Promise((resolve) => rl.question(`  ${question} `, (answer) => resolve(answer.trim())));
-			try {
-				if (!argv.capability) {
-					console.log(`  Available capabilities: ${capabilityKeys}`);
-					capability = await ask("Capability:");
-				} else capability = argv.capability;
-				vendorEnv = argv.vendorEnv ? argv.vendorEnv : await ask(`Vendor-native env var for the ${argv.vendor} token (e.g. MYVENDOR_API_KEY):`);
-				baseUrl = argv.baseUrl ? argv.baseUrl : await ask(`REST base URL for the ${argv.vendor} API (e.g. https://api.myvendor.com):`);
-			} finally {
-				rl.close();
+	}).command("plugin create <slug> <vendor>", "Scaffold a new @theholocron/holocron-plugin-<slug> package", (y) => y.positional("slug", {
+		type: "string",
+		demandOption: true,
+		describe: "Package slug (kebab-case)"
+	}).positional("vendor", {
+		type: "string",
+		demandOption: true,
+		describe: "Vendor display name (PascalCase)"
+	}).option("capability", {
+		type: "string",
+		describe: "Capability key: source|ci|secrets|environments|issues|deployment|storage|auth|vault|dns|tooling|notifications|analytics|observability"
+	}).option("token-env", {
+		type: "string",
+		describe: "Holocron env var name (defaults to HOLOCRON_<VENDOR>_TOKEN)"
+	}).option("vendor-env", {
+		type: "string",
+		describe: "Vendor-native env var name"
+	}).option("base-url", {
+		type: "string",
+		describe: "REST base URL"
+	}).option("verify", {
+		type: "boolean",
+		default: true,
+		describe: "Run post-scaffold pnpm install + typecheck + lint + test (default true; --no-verify skips)"
+	}), async (argv) => {
+		try {
+			const capabilityKeys = Object.keys(CARDINALITY).join(", ");
+			const needsPrompt = !argv.capability || !argv.vendorEnv || !argv.baseUrl;
+			let capability;
+			let vendorEnv;
+			let baseUrl;
+			if (needsPrompt) {
+				const rl = createInterface({
+					input: stdin,
+					output: stdout
+				});
+				const ask = (question) => new Promise((resolve) => rl.question(`  ${question} `, (answer) => resolve(answer.trim())));
+				try {
+					if (!argv.capability) {
+						console.log(`  Available capabilities: ${capabilityKeys}`);
+						capability = await ask("Capability:");
+					} else capability = argv.capability;
+					vendorEnv = argv.vendorEnv ? argv.vendorEnv : await ask(`Vendor-native env var for the ${argv.vendor} token (e.g. MYVENDOR_API_KEY):`);
+					baseUrl = argv.baseUrl ? argv.baseUrl : await ask(`REST base URL for the ${argv.vendor} API (e.g. https://api.myvendor.com):`);
+				} finally {
+					rl.close();
+				}
+			} else {
+				capability = argv.capability;
+				vendorEnv = argv.vendorEnv;
+				baseUrl = argv.baseUrl;
 			}
-		} else {
-			capability = argv.capability;
-			vendorEnv = argv.vendorEnv;
-			baseUrl = argv.baseUrl;
+			if (runPluginCreate({
+				slug: argv.slug,
+				vendorName: argv.vendor,
+				capability,
+				vendorEnv,
+				baseUrl,
+				...argv.tokenEnv ? { tokenEnv: argv.tokenEnv } : {},
+				dryRun: argv.dryRun,
+				noVerify: !argv.verify,
+				cwd: argv.cwd
+			}).status === "fail") process.exitCode = 1;
+		} catch (err) {
+			if (err instanceof PluginCreateError) {
+				console.error(`plugin create: ${err.message}`);
+				process.exitCode = 1;
+				return;
+			}
+			throw err;
 		}
-		if (runPluginCreate({
-			slug: argv.slug,
-			vendorName: argv.vendor,
-			capability,
-			vendorEnv,
-			baseUrl,
-			...argv.tokenEnv ? { tokenEnv: argv.tokenEnv } : {},
+	}).command("upgrade", "Upgrade toolchain version pins across the repo", (y) => y.command("node <to>", "Scan the repo and update every Node.js version pin to a new major", (yy) => yy.positional("to", {
+		type: "number",
+		demandOption: true,
+		describe: "Target Node.js major version (e.g., 22)"
+	}).option("from", {
+		type: "number",
+		describe: "Current major version to replace. Auto-detected from .nvmrc / engines.node when omitted."
+	}), async (argv) => {
+		let extra = [];
+		try {
+			const raw = readFileSync(join(argv.cwd, "holocron.config.json"), "utf8");
+			const upgradeNode = JSON.parse(raw).upgrade?.node;
+			if (Array.isArray(upgradeNode?.extra)) extra = upgradeNode.extra;
+		} catch {}
+		const report = await runUpgradeNode({
+			to: argv.to,
+			...argv.from != null ? { from: argv.from } : {},
+			cwd: argv.cwd,
 			dryRun: argv.dryRun,
-			noVerify: !argv.verify,
-			cwd: argv.cwd
-		}).status === "fail") process.exitCode = 1;
-	} catch (err) {
-		if (err instanceof PluginCreateError) {
-			console.error(`plugin create: ${err.message}`);
+			extra
+		});
+		if (report.status === "fail") {
+			if (report.message) console.error(`upgrade node: ${report.message}`);
 			process.exitCode = 1;
-			return;
 		}
-		throw err;
-	}
-}).command("upgrade", "Upgrade toolchain version pins across the repo", (y) => y.command("node <to>", "Scan the repo and update every Node.js version pin to a new major", (yy) => yy.positional("to", {
-	type: "number",
-	demandOption: true,
-	describe: "Target Node.js major version (e.g., 22)"
-}).option("from", {
-	type: "number",
-	describe: "Current major version to replace. Auto-detected from .nvmrc / engines.node when omitted."
-}), async (argv) => {
-	let extra = [];
-	try {
-		const raw = readFileSync(join(argv.cwd, "holocron.config.json"), "utf8");
-		const upgradeNode = JSON.parse(raw).upgrade?.node;
-		if (Array.isArray(upgradeNode?.extra)) extra = upgradeNode.extra;
-	} catch {}
-	const report = await runUpgradeNode({
-		to: argv.to,
-		...argv.from != null ? { from: argv.from } : {},
-		cwd: argv.cwd,
-		dryRun: argv.dryRun,
-		extra
-	});
-	if (report.status === "fail") {
-		if (report.message) console.error(`upgrade node: ${report.message}`);
-		process.exitCode = 1;
-	}
-}).demandCommand(1, "Run `holocron upgrade --help` to see available upgrade subcommands."), () => {}).command("auth <subcommand>", "Manage bootstrap credentials in the OS keyring", (y) => y.command("set <provider> [value]", "Verify + store a bootstrap token for a provider", (yy) => yy.positional("provider", {
-	type: "string",
-	demandOption: true
-}).positional("value", { type: "string" }), async (argv) => {
-	if ((await runAuthSet({
-		provider: argv.provider,
-		...argv.value ? { positional: argv.value } : {}
-	})).status === "fail") process.exitCode = 1;
-}).command("unset <provider>", "Remove a stored bootstrap token", (yy) => yy.positional("provider", {
-	type: "string",
-	demandOption: true
-}), (argv) => {
-	runAuthUnset({ provider: argv.provider });
-}).command("check <provider>", "Re-verify a stored bootstrap token", (yy) => yy.positional("provider", {
-	type: "string",
-	demandOption: true
-}), async (argv) => {
-	if ((await runAuthCheck({ provider: argv.provider })).status === "fail") process.exitCode = 1;
-}).command("list", "List every provider with a stored bootstrap token", () => {}, async () => {
-	await runAuthList();
-}).demandCommand(1, "Run `holocron auth --help` to see available auth subcommands."), () => {}).demandCommand(1, "Run `holocron --help` to see available commands.").strict().help().parse();
+	}).demandCommand(1, "Run `holocron upgrade --help` to see available upgrade subcommands."), () => {}).command("auth <subcommand>", "Manage bootstrap credentials in the OS keyring", (y) => y.command("set <provider> [value]", "Verify + store a bootstrap token for a provider", (yy) => yy.positional("provider", {
+		type: "string",
+		demandOption: true
+	}).positional("value", { type: "string" }), async (argv) => {
+		if ((await runAuthSet({
+			provider: argv.provider,
+			...argv.value ? { positional: argv.value } : {}
+		})).status === "fail") process.exitCode = 1;
+	}).command("unset <provider>", "Remove a stored bootstrap token", (yy) => yy.positional("provider", {
+		type: "string",
+		demandOption: true
+	}), (argv) => {
+		runAuthUnset({ provider: argv.provider });
+	}).command("check <provider>", "Re-verify a stored bootstrap token", (yy) => yy.positional("provider", {
+		type: "string",
+		demandOption: true
+	}), async (argv) => {
+		if ((await runAuthCheck({ provider: argv.provider })).status === "fail") process.exitCode = 1;
+	}).command("list", "List every provider with a stored bootstrap token", () => {}, async () => {
+		await runAuthList();
+	}).demandCommand(1, "Run `holocron auth --help` to see available auth subcommands."), () => {}).demandCommand(1, "Run `holocron --help` to see available commands.").strict().help().parse();
+} catch (err) {
+	captureException(err);
+	if (!process.exitCode) process.exitCode = 1;
+}
+finishCommand(!process.exitCode);
+endSession();
 (await updateCheckPromise)?.();
+await flush();
 /**
 * Parse `--scope` strings: `repo` | `env=NAME` | `org=NAME`.
 */
@@ -5125,3 +5198,5 @@ function parseScope(s) {
 }
 //#endregion
 export {};
+
+//# sourceMappingURL=cli.mjs.map