@theholocron/cli 3.1.1 → 3.3.0

package/dist/cli.mjs

@@ -17,6 +17,7 @@ import { access, copyFile, mkdir, readFile, readdir, rm, stat, symlink, unlink,
 import { pathToFileURL } from "node:url";
 import { createGitHubClient } from "@theholocron/github-client";
 import { promisify } from "node:util";
+import * as Sentry from "@sentry/node";
 //#region src/env.ts
 function createEnvLookup(source = process.env) {
 	return {
@@ -3838,7 +3839,7 @@ var greetings_default = "name: Greetings\n\non: # yamllint disable-line rule:tru
 var lint_default = "name: Lint\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      prettier-config:\n        type: string\n        required: false\n        default: prettier.config.js\n      yaml-config:\n        type: string\n        required: false\n        default: yamllint.config.yml\n      enable-auto-commit:\n        description: Auto-commit super-linter fixes via GPG-signed commit\n        type: boolean\n        required: false\n        default: false\n    secrets:\n      SUPER_LINTER_GPG_PRIVATE_KEY:\n        required: false\n      SUPER_LINTER_GPG_PASSPHRASE:\n        required: false\n\njobs:\n  super-lint:\n    name: Lint entire codebase\n    permissions:\n      contents: write\n      statuses: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    env:\n      GPG_KEY_SET: ${{ secrets.SUPER_LINTER_GPG_PRIVATE_KEY != '' }}\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n          token: ${{ github.token }}\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n        if: ${{ hashFiles('pnpm-lock.yaml') != '' }}\n\n      - uses: super-linter/super-linter/slim@4ce20838b8ab83717e78138c5b3a1407148e0918 # v8.7.0\n        name: Run Super Linter\n        env:\n          GITHUB_TOKEN: ${{ github.token }}\n          DEFAULT_BRANCH: ${{ github.event.pull_request.base.ref || github.event.repository.default_branch }}\n          ANNOTATE_ONLY: true\n          DISABLE_COMMENTS: false\n          IGNORE_GITIGNORED_FILES: true\n          LINTER_RULES_PATH: /\n          EDITORCONFIG_FILE_NAME: \".editorconfig-checker.json\"\n          FIX_ENV: true\n          FIX_GRAPHQL_PRETTIER: true\n          FIX_HTML_PRETTIER: true\n          FIX_JAVASCRIPT_PRETTIER: true\n          FIX_JSX_PRETTIER: true\n          FIX_MARKDOWN_PRETTIER: true\n          FIX_TSX: true\n          FIX_TYPESCRIPT_PRETTIER: true\n          PRETTIER_CONFIG: ${{ inputs.prettier-config }}\n          VALIDATE_DOCKERFILE: true\n          VALIDATE_EDITORCONFIG: true\n          VALIDATE_ENV: true\n          VALIDATE_GIT_COMMITLINT: true\n          VALIDATE_GIT_MERGE_CONFLICT_MARKERS: true\n          VALIDATE_GITHUB_ACTIONS: true\n          VALIDATE_GITLEAKS: true\n          VALIDATE_GRAPHQL_PRETTIER: true\n          VALIDATE_HTML_PRETTIER: true\n          VALIDATE_JAVASCRIPT_PRETTIER: true\n          VALIDATE_JSX_PRETTIER: true\n          VALIDATE_MARKDOWN_PRETTIER: true\n          VALIDATE_TSX: true\n          VALIDATE_TYPESCRIPT_PRETTIER: true\n          VALIDATE_YAML: true\n          YAML_CONFIG_FILE: ${{ inputs.yaml-config }}\n\n      - uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0\n        name: Import GPG Key\n        # Conditions mirror auto-commit exactly — no point importing GPG if the\n        # commit step will be skipped (fork PR, default branch, or secret unset).\n        if: >\n          inputs.enable-auto-commit == true &&\n          github.event.pull_request != null &&\n          github.event.pull_request.head.repo.full_name == github.repository &&\n          github.ref_name != github.event.repository.default_branch &&\n          env.GPG_KEY_SET == 'true'\n        with:\n          git_user_signingkey: true\n          git_commit_gpgsign: true\n          GPG_PRIVATE_KEY: ${{ secrets.SUPER_LINTER_GPG_PRIVATE_KEY }}\n          PASSPHRASE: ${{ secrets.SUPER_LINTER_GPG_PASSPHRASE }}\n\n      - uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d # v7.2.0\n        name: Commit and push linting fixes\n        if: >\n          inputs.enable-auto-commit == true &&\n          github.event.pull_request != null &&\n          github.event.pull_request.head.repo.full_name == github.repository &&\n          github.ref_name != github.event.repository.default_branch &&\n          env.GPG_KEY_SET == 'true'\n        with:\n          branch: ${{ github.event.pull_request.head.ref || github.head_ref || github.ref }}\n          commit_message: \"chore: fix linting issues\\n\\nSigned-off-by: super-linter <super-linter@super-linter.dev>\"\n          commit_options: \"--no-verify\"\n          commit_user_name: super-linter\n          commit_user_email: super-linter@super-linter.dev\n";
 //#endregion
 //#region src/templates/workflows/release.yml
-var release_default = "name: Release\n\n# Semantic-release with OIDC Trusted Publishing — no NPM_TOKEN required.\n# The calling repo must have a .releaserc.json that configures branches,\n# plugins, and any publish options. npm@11+ is installed to support OIDC.\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      run-build:\n        description: Run `pnpm build` before releasing\n        type: boolean\n        required: false\n        default: true\n    secrets:\n      HOLOCRON_RELEASE_TOKEN:\n        description: >\n          Fine-grained PAT (Contents + Issues + Pull requests: write) owned by\n          an admin. Required when the default branch is protected by a ruleset —\n          github.token cannot push through rulesets, but an admin PAT can.\n          Takes priority over HOLOCRON_SYNC_TOKEN. Falls back to github.token.\n        required: false\n      HOLOCRON_SYNC_TOKEN:\n        description: >\n          Legacy alias for HOLOCRON_RELEASE_TOKEN — kept for backward compatibility.\n          Prefer HOLOCRON_RELEASE_TOKEN for new repos.\n        required: false\n      HOLOCRON_READ_TOKEN:\n        description: >\n          Fine-grained PAT for read-only GitHub API calls (e.g. resolving git\n          committer identity via `gh api user`). Falls back to github.token.\n        required: false\n      GH_TOKEN:\n        description: >\n          Generic GitHub token fallback for `gh` CLI calls. Used when\n          HOLOCRON_READ_TOKEN is not set.\n        required: false\n\njobs:\n  release:\n    name: Semantic release\n    permissions:\n      contents: write\n      id-token: write\n      issues: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    # Do not cancel in-progress releases — a partial release is worse than a slow one.\n    concurrency:\n      group: release-${{ github.ref }}\n      cancel-in-progress: false\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n          # Use HOLOCRON_RELEASE_TOKEN when available — git push (tags, release commits)\n          # uses the checkout credential, not GITHUB_TOKEN env var. The\n          # built-in github.token cannot push through branch protection rulesets.\n          token: ${{ secrets.HOLOCRON_RELEASE_TOKEN || secrets.HOLOCRON_SYNC_TOKEN || github.token }}\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - name: Configure git identity\n        run: |\n          GIT_NAME=$(gh api user --jq .name 2>/dev/null || echo \"github-actions[bot]\")\n          GIT_EMAIL=$(gh api user --jq '\"\\(.id)+\\(.login)@users.noreply.github.com\"' 2>/dev/null || echo \"41898282+github-actions[bot]@users.noreply.github.com\")\n          git config --global user.name \"$GIT_NAME\"\n          git config --global user.email \"$GIT_EMAIL\"\n          git config --global format.signoff true\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_READ_TOKEN || secrets.GH_TOKEN || github.token }}\n\n      - run: npm install -g npm@11 sigstore\n        name: Upgrade npm for OIDC support\n        # sigstore is required by libnpmpublish/provenance.js at module parse\n        # time — before any config takes effect. Some npm 11.x builds stopped\n        # bundling it; installing it globally into the same prefix ensures it\n        # resolves regardless of npm version. (Discovered 2026-07-09.)\n\n      - run: pnpm build\n        name: Build\n        if: ${{ inputs.run-build == true }}\n\n      - run: npx semantic-release\n        name: Release\n        env:\n          # Prefer HOLOCRON_RELEASE_TOKEN (fine-grained PAT, Contents+Issues+PRs write,\n          # owned by an admin with ruleset bypass) so @semantic-release/git can\n          # push the version-bump commit through branch protection. Falls back to\n          # HOLOCRON_SYNC_TOKEN (legacy) then github.token for unprotected repos.\n          GITHUB_TOKEN: ${{ secrets.HOLOCRON_RELEASE_TOKEN || secrets.HOLOCRON_SYNC_TOKEN || github.token }}\n          NPM_CONFIG_PROVENANCE: true\n";
+var release_default = "name: Release\n\n# Semantic-release with OIDC Trusted Publishing — no NPM_TOKEN required.\n# The calling repo must have a .releaserc.json that configures branches,\n# plugins, and any publish options. npm@11+ is installed to support OIDC.\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      run-build:\n        description: Run `pnpm build` before releasing\n        type: boolean\n        required: false\n        default: true\n      sentry-project:\n        description: >\n          Sentry project slug for sourcemap upload and release creation after\n          publishing. Omit to skip the Sentry release step entirely.\n        type: string\n        required: false\n        default: \"\"\n    secrets:\n      HOLOCRON_RELEASE_TOKEN:\n        description: >\n          Fine-grained PAT (Contents + Issues + Pull requests: write) owned by\n          an admin. Required when the default branch is protected by a ruleset —\n          github.token cannot push through rulesets, but an admin PAT can.\n          Takes priority over HOLOCRON_SYNC_TOKEN. Falls back to github.token.\n        required: false\n      HOLOCRON_SYNC_TOKEN:\n        description: >\n          Legacy alias for HOLOCRON_RELEASE_TOKEN — kept for backward compatibility.\n          Prefer HOLOCRON_RELEASE_TOKEN for new repos.\n        required: false\n      HOLOCRON_READ_TOKEN:\n        description: >\n          Fine-grained PAT for read-only GitHub API calls (e.g. resolving git\n          committer identity via `gh api user`). Falls back to github.token.\n        required: false\n      GH_TOKEN:\n        description: >\n          Generic GitHub token fallback for `gh` CLI calls. Used when\n          HOLOCRON_READ_TOKEN is not set.\n        required: false\n      SENTRY_AUTH_TOKEN:\n        description: >\n          Sentry auth token for sourcemap upload and release creation.\n          Required when sentry-project is set. Use the org-level secret.\n        required: false\n\njobs:\n  release:\n    name: Semantic release\n    permissions:\n      contents: write\n      id-token: write\n      issues: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 30\n    # Do not cancel in-progress releases — a partial release is worse than a slow one.\n    concurrency:\n      group: release-${{ github.ref }}\n      cancel-in-progress: false\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          fetch-depth: 0\n          # Use HOLOCRON_RELEASE_TOKEN when available — git push (tags, release commits)\n          # uses the checkout credential, not GITHUB_TOKEN env var. The\n          # built-in github.token cannot push through branch protection rulesets.\n          token: ${{ secrets.HOLOCRON_RELEASE_TOKEN || secrets.HOLOCRON_SYNC_TOKEN || github.token }}\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - name: Configure git identity\n        run: |\n          GIT_NAME=$(gh api user --jq .name 2>/dev/null || echo \"github-actions[bot]\")\n          GIT_EMAIL=$(gh api user --jq '\"\\(.id)+\\(.login)@users.noreply.github.com\"' 2>/dev/null || echo \"41898282+github-actions[bot]@users.noreply.github.com\")\n          git config --global user.name \"$GIT_NAME\"\n          git config --global user.email \"$GIT_EMAIL\"\n          git config --global format.signoff true\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_READ_TOKEN || secrets.GH_TOKEN || github.token }}\n\n      - run: npm install -g npm@11 sigstore\n        name: Upgrade npm for OIDC support\n        # sigstore is required by libnpmpublish/provenance.js at module parse\n        # time — before any config takes effect. Some npm 11.x builds stopped\n        # bundling it; installing it globally into the same prefix ensures it\n        # resolves regardless of npm version. (Discovered 2026-07-09.)\n\n      - run: pnpm build\n        name: Build\n        if: ${{ inputs.run-build == true }}\n\n      - run: npx semantic-release\n        name: Release\n        env:\n          # Prefer HOLOCRON_RELEASE_TOKEN (fine-grained PAT, Contents+Issues+PRs write,\n          # owned by an admin with ruleset bypass) so @semantic-release/git can\n          # push the version-bump commit through branch protection. Falls back to\n          # HOLOCRON_SYNC_TOKEN (legacy) then github.token for unprotected repos.\n          GITHUB_TOKEN: ${{ secrets.HOLOCRON_RELEASE_TOKEN || secrets.HOLOCRON_SYNC_TOKEN || github.token }}\n          NPM_CONFIG_PROVENANCE: true\n\n      - name: Get release version\n        id: release_version\n        if: ${{ inputs.sentry-project != '' }}\n        run: |\n          TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo \"\")\n          if [ -n \"$TAG\" ]; then\n            echo \"release=${{ inputs.sentry-project }}@${TAG#v}\" >> \"$GITHUB_OUTPUT\"\n          fi\n\n      - name: Create Sentry release\n        if: ${{ inputs.sentry-project != '' && steps.release_version.outputs.release != '' }}\n        uses: getsentry/action-release@v3\n        env:\n          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}\n          SENTRY_ORG: theholocron\n          SENTRY_PROJECT: ${{ inputs.sentry-project }}\n        with:\n          environment: production\n          version: ${{ steps.release_version.outputs.release }}\n          sourcemaps: \"**/dist\"\n";
 //#endregion
 //#region src/templates/workflows/review.yml
 var review_default = "name: Review\n\n# ReviewDog is the annotation layer — posts inline PR diff annotations.\n# Runs on pull_request only: inline annotations require PR context,\n# and branch protection ensures all changes go through PRs anyway.\n# super-linter (lint.yml) is the CI gate covering push + PR events.\n# Gitleaks and YAML are intentionally duplicated: super-linter gates\n# merges; ReviewDog surfaces exact line annotations in the PR diff.\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n\nconcurrency:\n  group: review-${{ github.workflow }}-${{ github.ref }}\n  cancel-in-progress: true\n\njobs:\n  reviewdog:\n    name: Review PRs\n    runs-on: ubuntu-latest\n    timeout-minutes: 20\n    permissions:\n      contents: read\n      pull-requests: write\n\n    steps:\n      - name: Checkout repository\n        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        with:\n          fetch-depth: 0\n\n      - name: Setup\n        if: ${{ hashFiles('pnpm-lock.yaml') != '' }}\n        uses: theholocron/.github/.github/actions/setup@main\n\n      - name: Install ReviewDog\n        uses: reviewdog/action-setup@d8a7baabd7f3e8544ee4dbde3ee41d0011c3a93f # v1\n        with:\n          reviewdog_version: latest\n\n      # Detect which tools are relevant for this repo, excluding node_modules.\n      # hashFiles('**/*') recurses into node_modules/.pnpm and produces false\n      # positives for repos that don't own those file types.\n      # -print -quit stops find after the first match without a pipe, avoiding\n      # the SIGPIPE/pipefail exit-141 that find|head-1 triggers under\n      # GitHub Actions' default bash --noprofile --norc -e -o pipefail mode.\n      - name: Detect project features\n        id: detect\n        shell: bash\n        run: |\n          has() { find . -not -path '*/node_modules/*' -name \"$1\" -print -quit 2>/dev/null | grep -q .; }\n          has_ext() { find . -not -path '*/node_modules/*' -name \"$1\" -print -quit 2>/dev/null | grep -q .; }\n          { { has 'eslint.config.js' || has 'eslint.config.mjs' || has 'eslint.config.cjs' || \\\n              has 'eslint.config.ts' || has '.eslintrc' || has '.eslintrc.js' || \\\n              has '.eslintrc.cjs' || has '.eslintrc.json' || has '.eslintrc.yaml' || \\\n              has '.eslintrc.yml'; } && grep -qF '\"eslint\":' package.json 2>/dev/null; } && echo \"eslint=true\" >> \"$GITHUB_OUTPUT\" || echo \"eslint=false\" >> \"$GITHUB_OUTPUT\"\n          { has 'tsconfig.json' && grep -qF '\"typescript\":' package.json 2>/dev/null; } && echo \"tsconfig=true\" >> \"$GITHUB_OUTPUT\" || echo \"tsconfig=false\" >> \"$GITHUB_OUTPUT\"\n          has_ext '*.sh' && echo \"shell=true\" >> \"$GITHUB_OUTPUT\" || echo \"shell=false\" >> \"$GITHUB_OUTPUT\"\n          has 'Dockerfile' || has_ext '*.Dockerfile' || has 'Containerfile' && \\\n            echo \"docker=true\" >> \"$GITHUB_OUTPUT\" || echo \"docker=false\" >> \"$GITHUB_OUTPUT\"\n          has_ext '.env*' && echo \"dotenv=true\" >> \"$GITHUB_OUTPUT\" || echo \"dotenv=false\" >> \"$GITHUB_OUTPUT\"\n          has_ext '*.md' && echo \"markdown=true\" >> \"$GITHUB_OUTPUT\" || echo \"markdown=false\" >> \"$GITHUB_OUTPUT\"\n\n      #\n      # Always applicable\n      #\n\n      - name: Gitleaks (secrets)\n        uses: reviewdog/action-gitleaks@2b7b5685e3e3eecddab5d30cfa04f18123031421 # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / gitleaks\"\n          gitleaks_flags: --log-opts=${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }}\n\n      - name: YamlLint\n        if: ${{ hashFiles('yamllint.config.yml') != '' }}\n        uses: reviewdog/action-yamllint@b5f7217d8c815ae374d1d55840d5e569d82f01f0 # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / yamllint\"\n          yamllint_flags: -c ${{ github.workspace }}/yamllint.config.yml ${{ github.workspace }}\n\n      - name: ActionLint (GitHub Actions)\n        if: ${{ hashFiles('.github/workflows/*.yml', '.github/workflows/*.yaml') != '' }}\n        uses: reviewdog/action-actionlint@6fb7acc99f4a1008869fa8a0f09cfca740837d9d # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / actionlint\"\n\n      #\n      # TypeScript / JavaScript\n      #\n\n      - name: ESLint\n        if: steps.detect.outputs.eslint == 'true'\n        uses: reviewdog/action-eslint@556a3fdaf8b4201d4d74d406013386aa4f7dab96 # v1.34.0\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / eslint\"\n          eslint_flags: .\n\n      - name: TypeScript\n        if: steps.detect.outputs.tsconfig == 'true'\n        uses: EPMatt/reviewdog-action-tsc@63d923a3c5b4497671940b8874f58a404e2351b5 # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / tsc\"\n\n      #\n      # Shell\n      #\n\n      - name: ShellCheck\n        if: steps.detect.outputs.shell == 'true'\n        uses: reviewdog/action-shellcheck@4c07458293ac342d477251099501a718ae5ef86e # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / shellcheck\"\n          fail_level: none\n\n      #\n      # Docker\n      #\n\n      - name: Hadolint\n        if: steps.detect.outputs.docker == 'true'\n        uses: reviewdog/action-hadolint@1b2cfa6ba72072ad35158d7ff3aa49bbdc03506d # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / hadolint\"\n          fail_level: none\n\n      #\n      # Environment files\n      #\n\n      - name: dotenv-linter\n        if: steps.detect.outputs.dotenv == 'true'\n        uses: dotenv-linter/action-dotenv-linter@afde61cfda2ecffe7bea35837b6f20b956c88689 # v3.0.0\n        with:\n          reporter: github-code-suggestions\n\n      #\n      # Documentation\n      #\n\n      - name: Alex (inclusive language)\n        if: steps.detect.outputs.markdown == 'true'\n        uses: reviewdog/action-alex@347481655add010a2ae302df34b57c9bcfa0d6e4 # v1\n        with:\n          reporter: github-pr-annotations\n          tool_name: \"Review / alex\"\n";
@@ -4477,6 +4478,58 @@ async function fileExists(path) {
 	}
 }
 //#endregion
+//#region src/telemetry.ts
+const DSN = "https://95cbb72ad5636c94e119a5405ee8f55f@o4508238154104832.ingest.us.sentry.io/4511810950791168";
+function isEnabled() {
+	return !process.env.NO_HOLOCRON_TELEMETRY && true;
+}
+function init(version) {
+	if (!isEnabled()) return;
+	Sentry.init({
+		dsn: DSN,
+		release: `holocron@${version}`,
+		environment: process.env.CI ? "ci" : "local",
+		tracesSampleRate: 1,
+		beforeSend: scrubError
+	});
+	Sentry.startSession();
+	Sentry.setTag("os", process.platform);
+	Sentry.setTag("node", process.version);
+	Sentry.setTag("ci", String(Boolean(process.env.CI)));
+}
+function startCommand(name) {
+	if (!isEnabled()) return () => {};
+	Sentry.setTag("command", name);
+	const span = Sentry.startInactiveSpan({
+		name,
+		op: "holocron.command",
+		forceTransaction: true
+	});
+	return (ok) => {
+		span.setStatus({ code: ok ? 1 : 2 });
+		span.end();
+	};
+}
+function captureException(err) {
+	if (!isEnabled()) return;
+	Sentry.captureException(err);
+}
+function endSession() {
+	if (!isEnabled()) return;
+	Sentry.endSession();
+}
+async function flush() {
+	if (!isEnabled()) return;
+	await Sentry.close(2e3);
+}
+const TOKEN_RE = /\b(ghp_|ghs_|glpat-|xoxb-|xoxp-|npm_|sk-|[A-Z][A-Z0-9_]{2,}_TOKEN[=\s])[^\s"]*/g;
+function redact(raw) {
+	return raw.replace(TOKEN_RE, "[REDACTED]");
+}
+function scrubError(event, _hint) {
+	return JSON.parse(redact(JSON.stringify(event)));
+}
+//#endregion
 //#region src/token-args.ts
 var TokenParseError = class extends Error {
 	name = "TokenParseError";
@@ -4651,463 +4704,475 @@ function tokenContext(rawTokens) {
 		throw err;
 	}
 }
+init(CLI_VERSION);
 const updateCheckPromise = checkForUpdates(CLI_VERSION);
-await yargs(hideBin(process.argv)).scriptName("").usage("holocron <command> [options]").option("dry-run", {
-	type: "boolean",
-	default: false,
-	describe: "Print what would be mutated without calling capability mutators. Commands branch on this; read-only commands ignore it."
-}).option("token", {
-	type: "string",
-	array: true,
-	describe: "Vendor token override for plugins. Bare form: --token <value> (fallback for all plugins, single-plugin commands). Keyed form: --token vendor=value (targets a specific provider; repeat for each). Example: --token github=ghp_xxx --token vercel=v_yyy"
-}).option("cwd", {
-	type: "string",
-	default: process.cwd(),
-	describe: "Directory to search for holocron.config.json"
-}).command("version", "Print the CLI version", () => {}, () => {
-	console.log(`holocron ${CLI_VERSION}`);
-}).command("clone", "Clone all repos in a GitHub org as siblings under a single directory", (y) => y.option("org", {
-	type: "string",
-	demandOption: true,
-	describe: "GitHub org to clone (e.g., theholocron)"
-}).option("dir", {
-	type: "string",
-	describe: "Parent directory to clone into (default: ~/Code/<org>)"
-}), async (argv) => {
-	const tokens = tokenContext(argv.token);
-	if (!tokens) return;
-	let token;
-	try {
-		token = resolveCloneToken({ cliToken: tokens.cliTokens?.["github"] ?? tokens.cliToken });
-	} catch (err) {
-		console.error(`clone: ${err instanceof AuthError ? err.message : String(err)}`);
-		process.exitCode = 1;
-		return;
-	}
-	if ((await runClone({
-		org: argv.org,
-		token,
-		dryRun: argv.dryRun,
-		...argv.dir ? { dir: argv.dir } : {}
-	})).status === "fail") process.exitCode = 1;
-}).command("doctor", "Load the config and run a smoke check against every provider", (y) => y.option("repo", {
-	type: "string",
-	describe: "Repo coords (\"owner/name\"). Defaults to plugin-specific resolution."
-}), async (argv) => {
-	const tokens = tokenContext(argv.token);
-	if (!tokens) return;
-	if ((await runDoctor({
-		loaded: await loadConfig(argv.cwd),
-		context: {
-			repoRoot: argv.cwd,
-			dryRun: argv.dryRun,
-			...argv.repo ? { repo: argv.repo } : {},
-			...tokens
+let finishCommand = () => {};
+try {
+	await yargs(hideBin(process.argv)).middleware((argv) => {
+		finishCommand = startCommand(argv._.slice(0, 2).join(" ") || "unknown");
+	}).scriptName("").usage("holocron <command> [options]").option("dry-run", {
+		type: "boolean",
+		default: false,
+		describe: "Print what would be mutated without calling capability mutators. Commands branch on this; read-only commands ignore it."
+	}).option("token", {
+		type: "string",
+		array: true,
+		describe: "Vendor token override for plugins. Bare form: --token <value> (fallback for all plugins, single-plugin commands). Keyed form: --token vendor=value (targets a specific provider; repeat for each). Example: --token github=ghp_xxx --token vercel=v_yyy"
+	}).option("cwd", {
+		type: "string",
+		default: process.cwd(),
+		describe: "Directory to search for holocron.config.json"
+	}).command("version", "Print the CLI version", () => {}, () => {
+		console.log(`holocron ${CLI_VERSION}`);
+	}).command("clone", "Clone all repos in a GitHub org as siblings under a single directory", (y) => y.option("org", {
+		type: "string",
+		demandOption: true,
+		describe: "GitHub org to clone (e.g., theholocron)"
+	}).option("dir", {
+		type: "string",
+		describe: "Parent directory to clone into (default: ~/Code/<org>)"
+	}), async (argv) => {
+		const tokens = tokenContext(argv.token);
+		if (!tokens) return;
+		let token;
+		try {
+			token = resolveCloneToken({ cliToken: tokens.cliTokens?.["github"] ?? tokens.cliToken });
+		} catch (err) {
+			console.error(`clone: ${err instanceof AuthError ? err.message : String(err)}`);
+			process.exitCode = 1;
+			return;
 		}
-	})).summary.fail > 0) process.exitCode = 1;
-}).command("setup", "Apply infra setup actions across every configured capability", (y) => y.option("repo", {
-	type: "string",
-	describe: "Repo coords (\"owner/name\"). Defaults to plugin-specific resolution."
-}), async (argv) => {
-	const tokens = tokenContext(argv.token);
-	if (!tokens) return;
-	if ((await runSetup({
-		loaded: await loadConfig(argv.cwd),
-		context: {
-			repoRoot: argv.cwd,
+		if ((await runClone({
+			org: argv.org,
+			token,
 			dryRun: argv.dryRun,
-			...argv.repo ? { repo: argv.repo } : {},
-			...tokens
-		}
-	})).summary.fail > 0) process.exitCode = 1;
-}).command("skills", "Manage agent skills from the @theholocron/skills registry", (y) => y.command("install", "Copy skills from @theholocron/skills into .agents/ with agent symlinks", () => {}, async (argv) => {
-	await runSkillsInstall({
-		loaded: await loadConfig(argv.cwd),
-		context: {
-			repoRoot: argv.cwd,
-			dryRun: argv.dryRun
-		}
-	});
-}).command("remove [names..]", "Remove installed skills via npx skills remove", (yy) => yy.positional("names", {
-	type: "string",
-	array: true,
-	describe: "Skill name(s) to remove (omit to remove all installed skills)"
-}), (argv) => {
-	if (runSkillsRemove({
-		context: {
-			repoRoot: argv.cwd,
-			dryRun: argv.dryRun
-		},
-		...argv.names?.length ? { names: argv.names } : {}
-	}).status === "fail") process.exitCode = 1;
-}).command("update [name]", "Update installed skills to their latest upstream versions via npx skills update", (yy) => yy.positional("name", {
-	type: "string",
-	describe: "Skill name to update (omit to update all installed skills)"
-}), (argv) => {
-	if (runSkillsUpdate({
-		context: {
-			repoRoot: argv.cwd,
+			...argv.dir ? { dir: argv.dir } : {}
+		})).status === "fail") process.exitCode = 1;
+	}).command("doctor", "Load the config and run a smoke check against every provider", (y) => y.option("repo", {
+		type: "string",
+		describe: "Repo coords (\"owner/name\"). Defaults to plugin-specific resolution."
+	}), async (argv) => {
+		const tokens = tokenContext(argv.token);
+		if (!tokens) return;
+		if ((await runDoctor({
+			loaded: await loadConfig(argv.cwd),
+			context: {
+				repoRoot: argv.cwd,
+				dryRun: argv.dryRun,
+				...argv.repo ? { repo: argv.repo } : {},
+				...tokens
+			}
+		})).summary.fail > 0) process.exitCode = 1;
+	}).command("setup", "Apply infra setup actions across every configured capability", (y) => y.option("repo", {
+		type: "string",
+		describe: "Repo coords (\"owner/name\"). Defaults to plugin-specific resolution."
+	}), async (argv) => {
+		const tokens = tokenContext(argv.token);
+		if (!tokens) return;
+		if ((await runSetup({
+			loaded: await loadConfig(argv.cwd),
+			context: {
+				repoRoot: argv.cwd,
+				dryRun: argv.dryRun,
+				...argv.repo ? { repo: argv.repo } : {},
+				...tokens
+			}
+		})).summary.fail > 0) process.exitCode = 1;
+	}).command("skills", "Manage agent skills from the @theholocron/skills registry", (y) => y.command("install", "Copy skills from @theholocron/skills into .agents/ with agent symlinks", () => {}, async (argv) => {
+		await runSkillsInstall({
+			loaded: await loadConfig(argv.cwd),
+			context: {
+				repoRoot: argv.cwd,
+				dryRun: argv.dryRun
+			}
+		});
+	}).command("remove [names..]", "Remove installed skills via npx skills remove", (yy) => yy.positional("names", {
+		type: "string",
+		array: true,
+		describe: "Skill name(s) to remove (omit to remove all installed skills)"
+	}), (argv) => {
+		if (runSkillsRemove({
+			context: {
+				repoRoot: argv.cwd,
+				dryRun: argv.dryRun
+			},
+			...argv.names?.length ? { names: argv.names } : {}
+		}).status === "fail") process.exitCode = 1;
+	}).command("update [name]", "Update installed skills to their latest upstream versions via npx skills update", (yy) => yy.positional("name", {
+		type: "string",
+		describe: "Skill name to update (omit to update all installed skills)"
+	}), (argv) => {
+		if (runSkillsUpdate({
+			context: {
+				repoRoot: argv.cwd,
+				dryRun: argv.dryRun
+			},
+			...argv.name ? { name: argv.name } : {}
+		}).status === "fail") process.exitCode = 1;
+	}).demandCommand(1, "Run `holocron skills --help` to see available skills subcommands."), () => {}).command("secret set <name> [value]", "Set a single secret via the configured `secrets` capability", (y) => y.positional("name", {
+		type: "string",
+		demandOption: true,
+		describe: "Secret name (e.g., NPM_TOKEN)"
+	}).positional("value", {
+		type: "string",
+		describe: "Secret value (positional). If omitted, sources from --from-stdin, --from-env, or env var matching <name>."
+	}).option("from-stdin", {
+		type: "boolean",
+		default: false,
+		describe: "Read the secret value from stdin"
+	}).option("from-env", {
+		type: "string",
+		describe: "Read the secret value from the named env var (otherwise: env var matching <name>)"
+	}).option("scope", {
+		type: "string",
+		default: "repo",
+		describe: "Scope: \"repo\" (default), \"env=<name>\", or \"org=<name>\""
+	}), async (argv) => {
+		const tokens = tokenContext(argv.token);
+		if (!tokens) return;
+		const scopeArg = argv.scope;
+		const scope = parseScope(scopeArg);
+		if ((await runSecretSet({
+			loaded: await loadConfig(argv.cwd),
+			context: {
+				repoRoot: argv.cwd,
+				dryRun: argv.dryRun,
+				...tokens
+			},
+			name: argv.name,
+			...argv.value ? { value: argv.value } : {},
+			...argv.fromStdin ? { fromStdin: true } : {},
+			...argv.fromEnv ? { fromEnv: argv.fromEnv } : {},
+			scope
+		})).status === "fail") process.exitCode = 1;
+	}).command("secrets sync <environmentId>", "Read a vault environment + fan KEY=VALUEs out to secrets + deployment env vars", (y) => y.positional("environmentId", {
+		type: "string",
+		demandOption: true,
+		describe: "Vault environment id to read (1P Environment id, etc.)"
+	}).option("project-id", {
+		type: "string",
+		describe: "Deployment project id (e.g., Vercel prj_*). Required when deployment is loaded."
+	}).option("target", {
+		type: "array",
+		default: ["production", "preview"],
+		describe: "Deployment targets to sync to. Defaults to production + preview."
+	}), async (argv) => {
+		const tokens = tokenContext(argv.token);
+		if (!tokens) return;
+		if ((await runSecretsSync({
+			loaded: await loadConfig(argv.cwd),
+			context: {
+				repoRoot: argv.cwd,
+				dryRun: argv.dryRun,
+				...tokens
+			},
+			environmentId: argv.environmentId,
+			...argv.projectId ? { projectId: argv.projectId } : {},
+			targets: argv.target
+		})).summary.fail > 0) process.exitCode = 1;
+	}).command("deploy <branch>", "Trigger a deployment via the configured `deployment` capability", (y) => y.positional("branch", {
+		type: "string",
+		demandOption: true,
+		describe: "Git branch to deploy"
+	}).option("project-id", {
+		type: "string",
+		demandOption: true,
+		describe: "Deployment project id (e.g., Vercel prj_*)"
+	}).option("target", {
+		type: "string",
+		choices: ["production", "staging"],
+		describe: "Named environment to deploy into. Omit for a branch preview."
+	}), async (argv) => {
+		const tokens = tokenContext(argv.token);
+		if (!tokens) return;
+		if ((await runDeploy({
+			loaded: await loadConfig(argv.cwd),
+			context: {
+				repoRoot: argv.cwd,
+				dryRun: argv.dryRun,
+				...tokens
+			},
+			projectId: argv.projectId,
+			branch: argv.branch,
+			...argv.target ? { target: argv.target } : {}
+		})).status === "fail") process.exitCode = 1;
+	}).command("npm", "npm-related monorepo utilities", (y) => y.command("bump-versions <new-version>", "Bump all non-private package versions in lockstep (semantic-release prepareCmd)", (yy) => yy.positional("new-version", {
+		type: "string",
+		demandOption: true,
+		describe: "Version to set (e.g., 4.2.0 or 2.0.0-alpha.1)"
+	}), async (argv) => {
+		if ((await runNpmBumpVersions({
+			version: argv.newVersion,
+			cwd: argv.cwd,
 			dryRun: argv.dryRun
-		},
-		...argv.name ? { name: argv.name } : {}
-	}).status === "fail") process.exitCode = 1;
-}).demandCommand(1, "Run `holocron skills --help` to see available skills subcommands."), () => {}).command("secret set <name> [value]", "Set a single secret via the configured `secrets` capability", (y) => y.positional("name", {
-	type: "string",
-	demandOption: true,
-	describe: "Secret name (e.g., NPM_TOKEN)"
-}).positional("value", {
-	type: "string",
-	describe: "Secret value (positional). If omitted, sources from --from-stdin, --from-env, or env var matching <name>."
-}).option("from-stdin", {
-	type: "boolean",
-	default: false,
-	describe: "Read the secret value from stdin"
-}).option("from-env", {
-	type: "string",
-	describe: "Read the secret value from the named env var (otherwise: env var matching <name>)"
-}).option("scope", {
-	type: "string",
-	default: "repo",
-	describe: "Scope: \"repo\" (default), \"env=<name>\", or \"org=<name>\""
-}), async (argv) => {
-	const tokens = tokenContext(argv.token);
-	if (!tokens) return;
-	const scopeArg = argv.scope;
-	const scope = parseScope(scopeArg);
-	if ((await runSecretSet({
-		loaded: await loadConfig(argv.cwd),
-		context: {
-			repoRoot: argv.cwd,
-			dryRun: argv.dryRun,
-			...tokens
-		},
-		name: argv.name,
-		...argv.value ? { value: argv.value } : {},
-		...argv.fromStdin ? { fromStdin: true } : {},
-		...argv.fromEnv ? { fromEnv: argv.fromEnv } : {},
-		scope
-	})).status === "fail") process.exitCode = 1;
-}).command("secrets sync <environmentId>", "Read a vault environment + fan KEY=VALUEs out to secrets + deployment env vars", (y) => y.positional("environmentId", {
-	type: "string",
-	demandOption: true,
-	describe: "Vault environment id to read (1P Environment id, etc.)"
-}).option("project-id", {
-	type: "string",
-	describe: "Deployment project id (e.g., Vercel prj_*). Required when deployment is loaded."
-}).option("target", {
-	type: "array",
-	default: ["production", "preview"],
-	describe: "Deployment targets to sync to. Defaults to production + preview."
-}), async (argv) => {
-	const tokens = tokenContext(argv.token);
-	if (!tokens) return;
-	if ((await runSecretsSync({
-		loaded: await loadConfig(argv.cwd),
-		context: {
-			repoRoot: argv.cwd,
-			dryRun: argv.dryRun,
-			...tokens
-		},
-		environmentId: argv.environmentId,
-		...argv.projectId ? { projectId: argv.projectId } : {},
-		targets: argv.target
-	})).summary.fail > 0) process.exitCode = 1;
-}).command("deploy <branch>", "Trigger a deployment via the configured `deployment` capability", (y) => y.positional("branch", {
-	type: "string",
-	demandOption: true,
-	describe: "Git branch to deploy"
-}).option("project-id", {
-	type: "string",
-	demandOption: true,
-	describe: "Deployment project id (e.g., Vercel prj_*)"
-}).option("target", {
-	type: "string",
-	choices: ["production", "staging"],
-	describe: "Named environment to deploy into. Omit for a branch preview."
-}), async (argv) => {
-	const tokens = tokenContext(argv.token);
-	if (!tokens) return;
-	if ((await runDeploy({
-		loaded: await loadConfig(argv.cwd),
-		context: {
-			repoRoot: argv.cwd,
-			dryRun: argv.dryRun,
-			...tokens
-		},
-		projectId: argv.projectId,
-		branch: argv.branch,
-		...argv.target ? { target: argv.target } : {}
-	})).status === "fail") process.exitCode = 1;
-}).command("npm", "npm-related monorepo utilities", (y) => y.command("bump-versions <new-version>", "Bump all non-private package versions in lockstep (semantic-release prepareCmd)", (yy) => yy.positional("new-version", {
-	type: "string",
-	demandOption: true,
-	describe: "Version to set (e.g., 4.2.0 or 2.0.0-alpha.1)"
-}), async (argv) => {
-	if ((await runNpmBumpVersions({
-		version: argv.newVersion,
-		cwd: argv.cwd,
-		dryRun: argv.dryRun
-	})).status === "fail") process.exitCode = 1;
-}).command("publish-initial", "One-shot bootstrap publish for trusted-publishing-eligible packages", (yy) => yy.option("tag", {
-	type: "string",
-	default: "alpha",
-	describe: "npm distribution tag (defaults to alpha)"
-}).option("otp", {
-	type: "string",
-	describe: "One-time password from your authenticator (required if npm needs 2FA for writes)"
-}), async (argv) => {
-	if ((await runNpmPublishInitial({
-		cwd: argv.cwd,
-		tag: argv.tag,
-		dryRun: argv.dryRun,
-		...argv.otp ? { otp: argv.otp } : {}
-	})).status === "fail") process.exitCode = 1;
-}).demandCommand(1, "Run `holocron npm --help` to see available npm subcommands."), () => {}).command("sync [steps..]", "Sync state from config to the provider and local files (labels, properties, topics, keywords, description)", (y) => y.positional("steps", {
-	type: "string",
-	array: true,
-	describe: "Steps to run: labels, properties, topics, keywords, description (default: all)"
-}).option("repo", {
-	type: "string",
-	describe: "Repo coords (\"owner/name\"). Defaults to plugin-specific resolution."
-}), async (argv) => {
-	const tokens = tokenContext(argv.token);
-	if (!tokens) return;
-	if ((await runSync({
-		loaded: await loadConfig(argv.cwd),
-		context: {
-			repoRoot: argv.cwd,
+		})).status === "fail") process.exitCode = 1;
+	}).command("publish-initial", "One-shot bootstrap publish for trusted-publishing-eligible packages", (yy) => yy.option("tag", {
+		type: "string",
+		default: "alpha",
+		describe: "npm distribution tag (defaults to alpha)"
+	}).option("otp", {
+		type: "string",
+		describe: "One-time password from your authenticator (required if npm needs 2FA for writes)"
+	}), async (argv) => {
+		if ((await runNpmPublishInitial({
+			cwd: argv.cwd,
+			tag: argv.tag,
 			dryRun: argv.dryRun,
-			...argv.repo ? { repo: argv.repo } : {},
-			...tokens
-		},
-		...argv.steps && argv.steps.length > 0 ? { steps: argv.steps } : {}
-	})).summary.fail > 0) process.exitCode = 1;
-}).command("sync-github", "Sync workflow templates and composite actions to theholocron/.github via the GitHub API", (y) => y.option("repo", {
-	type: "string",
-	default: "theholocron/.github",
-	describe: "Target org/repo (default: theholocron/.github)"
-}).option("branch", {
-	type: "string",
-	describe: "Push to this branch instead of the default branch (enables PR-based workflow for protected repos)"
-}).option("pr", {
-	type: "boolean",
-	default: false,
-	describe: "Open a PR after pushing to --branch (no-op without --branch)"
-}).option("message", {
-	type: "string",
-	describe: "Commit message (default: chore: sync from theholocron/holocron)"
-}).option("output-dir", {
-	type: "string",
-	describe: "Write generated files to this local directory instead of pushing (for validation)"
-}), async (argv) => {
-	const outputDir = argv["output-dir"];
-	const parsed = tokenContext(argv.token);
-	if (!parsed) return;
-	let token;
-	if (outputDir) token = "no-token-needed";
-	else try {
-		token = resolveSyncToken({ cliToken: parsed.cliTokens?.["github"] ?? parsed.cliToken });
-	} catch (err) {
-		console.error(`sync-github: ${err instanceof AuthError ? err.message : String(err)}`);
-		process.exitCode = 1;
-		return;
-	}
-	if ((await runSyncGithub({
-		token,
-		repo: argv.repo,
-		dryRun: argv.dryRun,
-		...argv.branch ? { branch: argv.branch } : {},
-		...argv.pr ? { createPr: true } : {},
-		...argv.message ? { message: argv.message } : {},
-		...outputDir ? { outputDir } : {}
-	})).status === "fail") process.exitCode = 1;
-}).command("config show", "Print the resolved holocron config", () => {}, async (argv) => {
-	const loaded = await loadConfig(argv.cwd);
-	console.log(JSON.stringify(loaded.resolved, null, 2));
-}).command("new [type] [name]", "Scaffold a new repo from a GitHub template (e.g. cli, react, nextjs, node, monorepo, base)", (y) => y.positional("type", {
-	type: "string",
-	describe: "Template type — maps to theholocron/<type>-template (e.g. cli, react, nextjs, node, monorepo, base)"
-}).positional("name", {
-	type: "string",
-	describe: "New repo name (kebab-case, e.g. my-tool)"
-}).option("description", {
-	type: "string",
-	describe: "Short description — replaces <description> placeholders in the template"
-}).option("org", {
-	type: "string",
-	default: "theholocron",
-	describe: "GitHub org that owns the template and will own the new repo"
-}).option("verify", {
-	type: "boolean",
-	default: true,
-	describe: "Run pnpm install after bootstrapping (default true; --no-verify skips)"
-}), async (argv) => {
-	try {
-		let type = argv.type;
-		let name = argv.name;
-		let description = argv.description;
-		if (!type || !name || description === void 0) {
-			const rl = createInterface({
-				input: stdin,
-				output: stdout
-			});
-			const ask = (question) => new Promise((resolve) => rl.question(`  ${question} `, (answer) => resolve(answer.trim())));
-			try {
-				if (!type) {
-					console.log("  Known types: base, cli, monorepo, nextjs, node, react");
-					type = await ask("Template type:");
-				}
-				if (!name) name = await ask("Repo name (kebab-case):");
-				if (description === void 0) description = await ask("Short description (Enter to skip):");
-			} finally {
-				rl.close();
-			}
-		}
-		if (!type) {
-			console.error("new: template type is required");
-			process.exitCode = 1;
-			return;
-		}
-		if (!name) {
-			console.error("new: repo name is required");
+			...argv.otp ? { otp: argv.otp } : {}
+		})).status === "fail") process.exitCode = 1;
+	}).demandCommand(1, "Run `holocron npm --help` to see available npm subcommands."), () => {}).command("sync [steps..]", "Sync state from config to the provider and local files (labels, properties, topics, keywords, description)", (y) => y.positional("steps", {
+		type: "string",
+		array: true,
+		describe: "Steps to run: labels, properties, topics, keywords, description (default: all)"
+	}).option("repo", {
+		type: "string",
+		describe: "Repo coords (\"owner/name\"). Defaults to plugin-specific resolution."
+	}), async (argv) => {
+		const tokens = tokenContext(argv.token);
+		if (!tokens) return;
+		if ((await runSync({
+			loaded: await loadConfig(argv.cwd),
+			context: {
+				repoRoot: argv.cwd,
+				dryRun: argv.dryRun,
+				...argv.repo ? { repo: argv.repo } : {},
+				...tokens
+			},
+			...argv.steps && argv.steps.length > 0 ? { steps: argv.steps } : {}
+		})).summary.fail > 0) process.exitCode = 1;
+	}).command("sync-github", "Sync workflow templates and composite actions to theholocron/.github via the GitHub API", (y) => y.option("repo", {
+		type: "string",
+		default: "theholocron/.github",
+		describe: "Target org/repo (default: theholocron/.github)"
+	}).option("branch", {
+		type: "string",
+		describe: "Push to this branch instead of the default branch (enables PR-based workflow for protected repos)"
+	}).option("pr", {
+		type: "boolean",
+		default: false,
+		describe: "Open a PR after pushing to --branch (no-op without --branch)"
+	}).option("message", {
+		type: "string",
+		describe: "Commit message (default: chore: sync from theholocron/holocron)"
+	}).option("output-dir", {
+		type: "string",
+		describe: "Write generated files to this local directory instead of pushing (for validation)"
+	}), async (argv) => {
+		const outputDir = argv["output-dir"];
+		const parsed = tokenContext(argv.token);
+		if (!parsed) return;
+		let token;
+		if (outputDir) token = "no-token-needed";
+		else try {
+			token = resolveSyncToken({ cliToken: parsed.cliTokens?.["github"] ?? parsed.cliToken });
+		} catch (err) {
+			console.error(`sync-github: ${err instanceof AuthError ? err.message : String(err)}`);
 			process.exitCode = 1;
 			return;
 		}
-		if ((await runNew({
-			type,
-			name,
-			...description ? { description } : {},
-			org: argv.org,
+		if ((await runSyncGithub({
+			token,
+			repo: argv.repo,
 			dryRun: argv.dryRun,
-			noVerify: !argv.verify,
-			cwd: argv.cwd
+			...argv.branch ? { branch: argv.branch } : {},
+			...argv.pr ? { createPr: true } : {},
+			...argv.message ? { message: argv.message } : {},
+			...outputDir ? { outputDir } : {}
 		})).status === "fail") process.exitCode = 1;
-	} catch (err) {
-		if (err instanceof NewError) {
-			console.error(`new: ${err.message}`);
-			process.exitCode = 1;
-			return;
+	}).command("config show", "Print the resolved holocron config", () => {}, async (argv) => {
+		const loaded = await loadConfig(argv.cwd);
+		console.log(JSON.stringify(loaded.resolved, null, 2));
+	}).command("new [type] [name]", "Scaffold a new repo from a GitHub template (e.g. cli, react, nextjs, node, monorepo, base)", (y) => y.positional("type", {
+		type: "string",
+		describe: "Template type — maps to theholocron/<type>-template (e.g. cli, react, nextjs, node, monorepo, base)"
+	}).positional("name", {
+		type: "string",
+		describe: "New repo name (kebab-case, e.g. my-tool)"
+	}).option("description", {
+		type: "string",
+		describe: "Short description — replaces <description> placeholders in the template"
+	}).option("org", {
+		type: "string",
+		default: "theholocron",
+		describe: "GitHub org that owns the template and will own the new repo"
+	}).option("verify", {
+		type: "boolean",
+		default: true,
+		describe: "Run pnpm install after bootstrapping (default true; --no-verify skips)"
+	}), async (argv) => {
+		try {
+			let type = argv.type;
+			let name = argv.name;
+			let description = argv.description;
+			if (!type || !name || description === void 0) {
+				const rl = createInterface({
+					input: stdin,
+					output: stdout
+				});
+				const ask = (question) => new Promise((resolve) => rl.question(`  ${question} `, (answer) => resolve(answer.trim())));
+				try {
+					if (!type) {
+						console.log("  Known types: base, cli, monorepo, nextjs, node, react");
+						type = await ask("Template type:");
+					}
+					if (!name) name = await ask("Repo name (kebab-case):");
+					if (description === void 0) description = await ask("Short description (Enter to skip):");
+				} finally {
+					rl.close();
+				}
+			}
+			if (!type) {
+				console.error("new: template type is required");
+				process.exitCode = 1;
+				return;
+			}
+			if (!name) {
+				console.error("new: repo name is required");
+				process.exitCode = 1;
+				return;
+			}
+			if ((await runNew({
+				type,
+				name,
+				...description ? { description } : {},
+				org: argv.org,
+				dryRun: argv.dryRun,
+				noVerify: !argv.verify,
+				cwd: argv.cwd
+			})).status === "fail") process.exitCode = 1;
+		} catch (err) {
+			if (err instanceof NewError) {
+				console.error(`new: ${err.message}`);
+				process.exitCode = 1;
+				return;
+			}
+			throw err;
 		}
-		throw err;
-	}
-}).command("plugin create <slug> <vendor>", "Scaffold a new @theholocron/holocron-plugin-<slug> package", (y) => y.positional("slug", {
-	type: "string",
-	demandOption: true,
-	describe: "Package slug (kebab-case)"
-}).positional("vendor", {
-	type: "string",
-	demandOption: true,
-	describe: "Vendor display name (PascalCase)"
-}).option("capability", {
-	type: "string",
-	describe: "Capability key: source|ci|secrets|environments|issues|deployment|storage|auth|vault|dns|tooling|notifications|analytics|observability"
-}).option("token-env", {
-	type: "string",
-	describe: "Holocron env var name (defaults to HOLOCRON_<VENDOR>_TOKEN)"
-}).option("vendor-env", {
-	type: "string",
-	describe: "Vendor-native env var name"
-}).option("base-url", {
-	type: "string",
-	describe: "REST base URL"
-}).option("verify", {
-	type: "boolean",
-	default: true,
-	describe: "Run post-scaffold pnpm install + typecheck + lint + test (default true; --no-verify skips)"
-}), async (argv) => {
-	try {
-		const capabilityKeys = Object.keys(CARDINALITY).join(", ");
-		const needsPrompt = !argv.capability || !argv.vendorEnv || !argv.baseUrl;
-		let capability;
-		let vendorEnv;
-		let baseUrl;
-		if (needsPrompt) {
-			const rl = createInterface({
-				input: stdin,
-				output: stdout
-			});
-			const ask = (question) => new Promise((resolve) => rl.question(`  ${question} `, (answer) => resolve(answer.trim())));
-			try {
-				if (!argv.capability) {
-					console.log(`  Available capabilities: ${capabilityKeys}`);
-					capability = await ask("Capability:");
-				} else capability = argv.capability;
-				vendorEnv = argv.vendorEnv ? argv.vendorEnv : await ask(`Vendor-native env var for the ${argv.vendor} token (e.g. MYVENDOR_API_KEY):`);
-				baseUrl = argv.baseUrl ? argv.baseUrl : await ask(`REST base URL for the ${argv.vendor} API (e.g. https://api.myvendor.com):`);
-			} finally {
-				rl.close();
+	}).command("plugin create <slug> <vendor>", "Scaffold a new @theholocron/holocron-plugin-<slug> package", (y) => y.positional("slug", {
+		type: "string",
+		demandOption: true,
+		describe: "Package slug (kebab-case)"
+	}).positional("vendor", {
+		type: "string",
+		demandOption: true,
+		describe: "Vendor display name (PascalCase)"
+	}).option("capability", {
+		type: "string",
+		describe: "Capability key: source|ci|secrets|environments|issues|deployment|storage|auth|vault|dns|tooling|notifications|analytics|observability"
+	}).option("token-env", {
+		type: "string",
+		describe: "Holocron env var name (defaults to HOLOCRON_<VENDOR>_TOKEN)"
+	}).option("vendor-env", {
+		type: "string",
+		describe: "Vendor-native env var name"
+	}).option("base-url", {
+		type: "string",
+		describe: "REST base URL"
+	}).option("verify", {
+		type: "boolean",
+		default: true,
+		describe: "Run post-scaffold pnpm install + typecheck + lint + test (default true; --no-verify skips)"
+	}), async (argv) => {
+		try {
+			const capabilityKeys = Object.keys(CARDINALITY).join(", ");
+			const needsPrompt = !argv.capability || !argv.vendorEnv || !argv.baseUrl;
+			let capability;
+			let vendorEnv;
+			let baseUrl;
+			if (needsPrompt) {
+				const rl = createInterface({
+					input: stdin,
+					output: stdout
+				});
+				const ask = (question) => new Promise((resolve) => rl.question(`  ${question} `, (answer) => resolve(answer.trim())));
+				try {
+					if (!argv.capability) {
+						console.log(`  Available capabilities: ${capabilityKeys}`);
+						capability = await ask("Capability:");
+					} else capability = argv.capability;
+					vendorEnv = argv.vendorEnv ? argv.vendorEnv : await ask(`Vendor-native env var for the ${argv.vendor} token (e.g. MYVENDOR_API_KEY):`);
+					baseUrl = argv.baseUrl ? argv.baseUrl : await ask(`REST base URL for the ${argv.vendor} API (e.g. https://api.myvendor.com):`);
+				} finally {
+					rl.close();
+				}
+			} else {
+				capability = argv.capability;
+				vendorEnv = argv.vendorEnv;
+				baseUrl = argv.baseUrl;
 			}
-		} else {
-			capability = argv.capability;
-			vendorEnv = argv.vendorEnv;
-			baseUrl = argv.baseUrl;
+			if (runPluginCreate({
+				slug: argv.slug,
+				vendorName: argv.vendor,
+				capability,
+				vendorEnv,
+				baseUrl,
+				...argv.tokenEnv ? { tokenEnv: argv.tokenEnv } : {},
+				dryRun: argv.dryRun,
+				noVerify: !argv.verify,
+				cwd: argv.cwd
+			}).status === "fail") process.exitCode = 1;
+		} catch (err) {
+			if (err instanceof PluginCreateError) {
+				console.error(`plugin create: ${err.message}`);
+				process.exitCode = 1;
+				return;
+			}
+			throw err;
 		}
-		if (runPluginCreate({
-			slug: argv.slug,
-			vendorName: argv.vendor,
-			capability,
-			vendorEnv,
-			baseUrl,
-			...argv.tokenEnv ? { tokenEnv: argv.tokenEnv } : {},
+	}).command("upgrade", "Upgrade toolchain version pins across the repo", (y) => y.command("node <to>", "Scan the repo and update every Node.js version pin to a new major", (yy) => yy.positional("to", {
+		type: "number",
+		demandOption: true,
+		describe: "Target Node.js major version (e.g., 22)"
+	}).option("from", {
+		type: "number",
+		describe: "Current major version to replace. Auto-detected from .nvmrc / engines.node when omitted."
+	}), async (argv) => {
+		let extra = [];
+		try {
+			const raw = readFileSync(join(argv.cwd, "holocron.config.json"), "utf8");
+			const upgradeNode = JSON.parse(raw).upgrade?.node;
+			if (Array.isArray(upgradeNode?.extra)) extra = upgradeNode.extra;
+		} catch {}
+		const report = await runUpgradeNode({
+			to: argv.to,
+			...argv.from != null ? { from: argv.from } : {},
+			cwd: argv.cwd,
 			dryRun: argv.dryRun,
-			noVerify: !argv.verify,
-			cwd: argv.cwd
-		}).status === "fail") process.exitCode = 1;
-	} catch (err) {
-		if (err instanceof PluginCreateError) {
-			console.error(`plugin create: ${err.message}`);
+			extra
+		});
+		if (report.status === "fail") {
+			if (report.message) console.error(`upgrade node: ${report.message}`);
 			process.exitCode = 1;
-			return;
 		}
-		throw err;
-	}
-}).command("upgrade", "Upgrade toolchain version pins across the repo", (y) => y.command("node <to>", "Scan the repo and update every Node.js version pin to a new major", (yy) => yy.positional("to", {
-	type: "number",
-	demandOption: true,
-	describe: "Target Node.js major version (e.g., 22)"
-}).option("from", {
-	type: "number",
-	describe: "Current major version to replace. Auto-detected from .nvmrc / engines.node when omitted."
-}), async (argv) => {
-	let extra = [];
-	try {
-		const raw = readFileSync(join(argv.cwd, "holocron.config.json"), "utf8");
-		const upgradeNode = JSON.parse(raw).upgrade?.node;
-		if (Array.isArray(upgradeNode?.extra)) extra = upgradeNode.extra;
-	} catch {}
-	const report = await runUpgradeNode({
-		to: argv.to,
-		...argv.from != null ? { from: argv.from } : {},
-		cwd: argv.cwd,
-		dryRun: argv.dryRun,
-		extra
-	});
-	if (report.status === "fail") {
-		if (report.message) console.error(`upgrade node: ${report.message}`);
-		process.exitCode = 1;
-	}
-}).demandCommand(1, "Run `holocron upgrade --help` to see available upgrade subcommands."), () => {}).command("auth <subcommand>", "Manage bootstrap credentials in the OS keyring", (y) => y.command("set <provider> [value]", "Verify + store a bootstrap token for a provider", (yy) => yy.positional("provider", {
-	type: "string",
-	demandOption: true
-}).positional("value", { type: "string" }), async (argv) => {
-	if ((await runAuthSet({
-		provider: argv.provider,
-		...argv.value ? { positional: argv.value } : {}
-	})).status === "fail") process.exitCode = 1;
-}).command("unset <provider>", "Remove a stored bootstrap token", (yy) => yy.positional("provider", {
-	type: "string",
-	demandOption: true
-}), (argv) => {
-	runAuthUnset({ provider: argv.provider });
-}).command("check <provider>", "Re-verify a stored bootstrap token", (yy) => yy.positional("provider", {
-	type: "string",
-	demandOption: true
-}), async (argv) => {
-	if ((await runAuthCheck({ provider: argv.provider })).status === "fail") process.exitCode = 1;
-}).command("list", "List every provider with a stored bootstrap token", () => {}, async () => {
-	await runAuthList();
-}).demandCommand(1, "Run `holocron auth --help` to see available auth subcommands."), () => {}).demandCommand(1, "Run `holocron --help` to see available commands.").strict().help().parse();
+	}).demandCommand(1, "Run `holocron upgrade --help` to see available upgrade subcommands."), () => {}).command("auth <subcommand>", "Manage bootstrap credentials in the OS keyring", (y) => y.command("set <provider> [value]", "Verify + store a bootstrap token for a provider", (yy) => yy.positional("provider", {
+		type: "string",
+		demandOption: true
+	}).positional("value", { type: "string" }), async (argv) => {
+		if ((await runAuthSet({
+			provider: argv.provider,
+			...argv.value ? { positional: argv.value } : {}
+		})).status === "fail") process.exitCode = 1;
+	}).command("unset <provider>", "Remove a stored bootstrap token", (yy) => yy.positional("provider", {
+		type: "string",
+		demandOption: true
+	}), (argv) => {
+		runAuthUnset({ provider: argv.provider });
+	}).command("check <provider>", "Re-verify a stored bootstrap token", (yy) => yy.positional("provider", {
+		type: "string",
+		demandOption: true
+	}), async (argv) => {
+		if ((await runAuthCheck({ provider: argv.provider })).status === "fail") process.exitCode = 1;
+	}).command("list", "List every provider with a stored bootstrap token", () => {}, async () => {
+		await runAuthList();
+	}).demandCommand(1, "Run `holocron auth --help` to see available auth subcommands."), () => {}).demandCommand(1, "Run `holocron --help` to see available commands.").strict().help().parse();
+} catch (err) {
+	captureException(err);
+	if (!process.exitCode) process.exitCode = 1;
+}
+finishCommand(!process.exitCode);
+endSession();
 (await updateCheckPromise)?.();
+await flush();
 /**
 * Parse `--scope` strings: `repo` | `env=NAME` | `org=NAME`.
 */
@@ -5125,3 +5190,5 @@ function parseScope(s) {
 }
 //#endregion
 export {};
+
+//# sourceMappingURL=cli.mjs.map