@theholocron/cli 3.47.0 → 3.49.0

package/dist/index.d.mts

@@ -1,6 +1,6 @@
-import { Analytics, Auth, AuthDescription, AuthEvent, AuthEventType, AuthIdentity, AuthUser, CARDINALITY, CapabilityImpls, CapabilityKey, Cardinality, CardinalityFor, Ci, CiRun, CiRunFilter, CiRunStatus, ConnectionStringOptions, CreateAuthUserInput, Deployment, DeploymentProject, DeploymentProjectSettings, DeploymentRecord, DeploymentTarget, DeploymentTrigger, Dns, DnsRecord, DnsRecordType, EnsureResult, Environment, EnvironmentReviewer, Environments, Issue, IssueSearchFilter, Issues, LabelDef, LifecycleResult, LifecycleSlot, NormalizedAuthUser, Notifications, Observability, PagesConfig, ParseWebhookInput, ProviderApiError, ProviderIdentity, PullRequest, REQUIRED_CAPABILITIES, RepoRef, RepoSettings, ResolvedCapability, Ruleset, SecretScope, Secrets, Source, StatusCategory, Storage, StorageBranch, TeamEntry, TeamPermission, Tooling, ToolingDoctorReport, TrackerDoctorReport, TrackerUser, Vault, WebhookDashboardInfo, WebhookVerificationError, Wiki, WikiDnsRecord, WikiProvisionOpts, WikiProxyConfig, Workers, isMulti } from "./capabilities/index.mjs";
+import { Analytics, Auth, AuthDescription, AuthEvent, AuthEventType, AuthIdentity, AuthUser, CARDINALITY, CapabilityImpls, CapabilityKey, Cardinality, CardinalityFor, Ci, CiRun, CiRunFilter, CiRunStatus, ConnectionStringOptions, CreateAuthUserInput, Deployment, DeploymentProject, DeploymentProjectSettings, DeploymentRecord, DeploymentTarget, DeploymentTrigger, Dns, DnsRecord, DnsRecordType, EnsureResult, Environment, EnvironmentReviewer, Environments, Issue, IssueSearchFilter, Issues, LabelDef, LifecycleResult, LifecycleSlot, NormalizedAuthUser, Notifications, Observability, PagesConfig, ParseWebhookInput, ProviderApiError, ProviderIdentity, PullRequest, REQUIRED_CAPABILITIES, RepoRef, RepoSettings, ResolvedCapability, Ruleset, SecretScope, Secrets, Source, StatusCategory, Storage, StorageBranch, TeamEntry, TeamPermission, Tooling, ToolingDoctorReport, TrackerDoctorReport, TrackerUser, Vault, WebhookDashboardInfo, WebhookVerificationError, Wiki, WikiDnsRecord, WikiProvisionOpts, WikiProxyConfig, Workers, isMulti } from "./plugin/capabilities.mjs";
 import { AuthError, RequestOptions, ResolveTokenConfig as ResolveTokenConfig$1, ResolveTokenInput, RestClient, RestClientConfig, createRestClient } from "@theholocron/http-client";
-//#region src/auth-resolver.d.ts
+//#region src/auth/auth-resolver.d.ts
 type ResolveTokenConfig = Omit<ResolveTokenConfig$1, "getKeyringToken">;
 /** Wraps `createResolveToken` from `@theholocron/http` and injects the
  *  system keyring so plugins stay at a one-liner call site. */
@@ -20,7 +20,51 @@ interface FeatureResolverConfig {
  */
 declare function createFeatureResolver(config: FeatureResolverConfig): (input?: ResolveTokenInput) => string;
 //#endregion
-//#region src/config.d.ts
+//#region src/auth/keyring.d.ts
+/**
+ * Keyring-backed bootstrap credential store.
+ *
+ * Every holocron plugin's bootstrap token (the one it needs before it
+ * can talk to its vendor's API) can be stored in the OS keyring under
+ * a single reverse-DNS service scope. Managed via `holocron auth`
+ * subcommands; consulted at position 4 in every plugin's auth
+ * precedence chain (after --token / HOLOCRON_<X>_TOKEN / <native>_TOKEN).
+ *
+ * See `.notes/tech-auth-bootstrap.spec.md` for the design rationale.
+ *
+ * Failure model: keyring access is best-effort. Platforms without a
+ * supported credential store (some Linux CI images, sandboxed
+ * environments) will throw from the underlying library. Every export
+ * here catches and returns a null/empty result rather than propagating
+ * — the plugin's precedence chain then falls through to
+ * env-var-only paths, which is exactly how CI is meant to work.
+ */
+/**
+ * Store or overwrite a bootstrap token for a provider. Returns true on
+ * success, false when the underlying keyring is unsupported or errored.
+ */
+declare function setToken(provider: string, token: string): boolean;
+/**
+ * Read the bootstrap token for a provider. Returns `null` for both
+ * "not stored" and "keyring unavailable" — callers can treat them the
+ * same way (fall through to env-var precedence).
+ */
+declare function getToken(provider: string): string | null;
+/**
+ * Delete a stored token. Returns true when a token was removed, false
+ * when there was nothing to delete or the keyring is unavailable.
+ * Distinguishing the two cases isn't worth the surface area — the
+ * command output makes the situation clear either way.
+ */
+declare function deleteToken(provider: string): boolean;
+/**
+ * List provider slugs with a stored token in this service scope.
+ * Uses the library's `findCredentials(service)` — supported on all
+ * platforms the underlying credential store supports.
+ */
+declare function listStoredProviders(): string[];
+//#endregion
+//#region src/config/config.d.ts
 type ProviderOptions = Record<string, unknown>;
 /**
  * The shape a capability config package's default export must satisfy.
@@ -106,8 +150,7 @@ interface EnvConfig {
    * Namespace prefixes used by this project's env vars.
    * Listed from least- to most-specific (cascade model — last wins).
    * Tooling reads this to generate `.env.example`, validate required
-   * vars, and produce documentation. Runtime code passes the same
-   * value to `createEnvParser({ namespaces })` from `@theholocron/env-utils`.
+   * vars, and produce documentation.
    *
    * @example
    * // Project-only prefix
@@ -379,7 +422,7 @@ declare function resolvePluginPackage(provider: string): string;
 declare function resolveEntry(key: CapabilityKey, raw: RawProviderEntry): ResolvedProviderEntry;
 declare function resolveConfig(raw: HolocronConfig): ResolvedHolocronConfig;
 //#endregion
-//#region src/compose.d.ts
+//#region src/config/compose.d.ts
 type WorkflowEntry = NonNullable<HolocronConfig["workflows"]>[number];
 /** A single composable capability fragment. */
 interface Capability {
@@ -436,61 +479,10 @@ interface ComposedPreset {
  */
 declare function compose(...args: (Capability | Capability[])[]): ComposedPreset;
 //#endregion
-//#region src/define-config.d.ts
+//#region src/config/define-config.d.ts
 declare function defineConfig(config: HolocronConfig): HolocronConfig;
 //#endregion
-//#region src/env.d.ts
-interface EnvLookup {
-  get(key: string): string | undefined;
-  first(...keys: string[]): string | undefined;
-}
-declare function createEnvLookup(source?: NodeJS.ProcessEnv): EnvLookup;
-//#endregion
-//#region src/keyring.d.ts
-/**
- * Keyring-backed bootstrap credential store.
- *
- * Every holocron plugin's bootstrap token (the one it needs before it
- * can talk to its vendor's API) can be stored in the OS keyring under
- * a single reverse-DNS service scope. Managed via `holocron auth`
- * subcommands; consulted at position 4 in every plugin's auth
- * precedence chain (after --token / HOLOCRON_<X>_TOKEN / <native>_TOKEN).
- *
- * See `.notes/tech-auth-bootstrap.spec.md` for the design rationale.
- *
- * Failure model: keyring access is best-effort. Platforms without a
- * supported credential store (some Linux CI images, sandboxed
- * environments) will throw from the underlying library. Every export
- * here catches and returns a null/empty result rather than propagating
- * — the plugin's precedence chain then falls through to
- * env-var-only paths, which is exactly how CI is meant to work.
- */
-/**
- * Store or overwrite a bootstrap token for a provider. Returns true on
- * success, false when the underlying keyring is unsupported or errored.
- */
-declare function setToken(provider: string, token: string): boolean;
-/**
- * Read the bootstrap token for a provider. Returns `null` for both
- * "not stored" and "keyring unavailable" — callers can treat them the
- * same way (fall through to env-var precedence).
- */
-declare function getToken(provider: string): string | null;
-/**
- * Delete a stored token. Returns true when a token was removed, false
- * when there was nothing to delete or the keyring is unavailable.
- * Distinguishing the two cases isn't worth the surface area — the
- * command output makes the situation clear either way.
- */
-declare function deleteToken(provider: string): boolean;
-/**
- * List provider slugs with a stored token in this service scope.
- * Uses the library's `findCredentials(service)` — supported on all
- * platforms the underlying credential store supports.
- */
-declare function listStoredProviders(): string[];
-//#endregion
-//#region src/load-config.d.ts
+//#region src/config/load-config.d.ts
 declare class ConfigFileError extends Error {
   name: string;
 }
@@ -506,4 +498,4 @@ interface LoadedConfig {
  */
 declare function loadConfig(cwd: string): Promise<LoadedConfig>;
 //#endregion
-export { Analytics, AppConfig, Auth, AuthDescription, AuthError, AuthEvent, AuthEventType, AuthIdentity, AuthUser, CARDINALITY, Capability, CapabilityConfigPackage, CapabilityImpls, CapabilityKey, Cardinality, CardinalityFor, ChromaticProjectConfig, Ci, CiRun, CiRunFilter, CiRunStatus, ComposedPreset, ConfigError, ConfigFileError, ConnectionStringOptions, CreateAuthUserInput, Deployment, DeploymentProject, DeploymentProjectSettings, DeploymentRecord, DeploymentTarget, DeploymentTrigger, Dns, DnsRecord, DnsRecordType, DocsConfig, DoctorConfig, EnsureResult, EnvConfig, EnvLookup, Environment, EnvironmentReviewer, Environments, FeatureResolverConfig, HolocronConfig, Issue, IssueSearchFilter, Issues, LabelDef, LifecycleResult, LifecycleSlot, LoadedConfig, MultiEntry, NormalizedAuthUser, Notifications, Observability, PagesConfig, ParseWebhookInput, ProviderApiError, ProviderIdentity, ProviderOptions, PullRequest, REQUIRED_CAPABILITIES, RawProviderEntry, RawProvidersConfig, RepoConfig, RepoProperties, RepoProtection, RepoRef, RepoSettings, type RequestOptions, ResolveTokenConfig, type ResolveTokenInput, ResolvedCapability, ResolvedHolocronConfig, ResolvedProviderEntry, ResolvedProvidersConfig, ResolvedTuple, type RestClient, type RestClientConfig, Ruleset, SecretScope, Secrets, SingleEntry, Source, StatusCategory, Storage, StorageBranch, StorybookDeployProject, TeamEntry, TeamPermission, Tooling, ToolingDoctorReport, TrackerDoctorReport, TrackerUser, Vault, WebhookDashboardInfo, WebhookVerificationError, Wiki, WikiDnsRecord, WikiProvisionOpts, WikiProxyConfig, Workers, WorkflowWithConfig, compose, createEnvLookup, createFeatureResolver, createResolveToken, createRestClient, defineConfig, deleteToken, getToken, isMulti, listStoredProviders, loadConfig, resolveConfig, resolveEntry, resolvePluginPackage, setToken };
+export { Analytics, AppConfig, Auth, AuthDescription, AuthError, AuthEvent, AuthEventType, AuthIdentity, AuthUser, CARDINALITY, Capability, CapabilityConfigPackage, CapabilityImpls, CapabilityKey, Cardinality, CardinalityFor, ChromaticProjectConfig, Ci, CiRun, CiRunFilter, CiRunStatus, ComposedPreset, ConfigError, ConfigFileError, ConnectionStringOptions, CreateAuthUserInput, Deployment, DeploymentProject, DeploymentProjectSettings, DeploymentRecord, DeploymentTarget, DeploymentTrigger, Dns, DnsRecord, DnsRecordType, DocsConfig, DoctorConfig, EnsureResult, EnvConfig, Environment, EnvironmentReviewer, Environments, FeatureResolverConfig, HolocronConfig, Issue, IssueSearchFilter, Issues, LabelDef, LifecycleResult, LifecycleSlot, LoadedConfig, MultiEntry, NormalizedAuthUser, Notifications, Observability, PagesConfig, ParseWebhookInput, ProviderApiError, ProviderIdentity, ProviderOptions, PullRequest, REQUIRED_CAPABILITIES, RawProviderEntry, RawProvidersConfig, RepoConfig, RepoProperties, RepoProtection, RepoRef, RepoSettings, type RequestOptions, ResolveTokenConfig, type ResolveTokenInput, ResolvedCapability, ResolvedHolocronConfig, ResolvedProviderEntry, ResolvedProvidersConfig, ResolvedTuple, type RestClient, type RestClientConfig, Ruleset, SecretScope, Secrets, SingleEntry, Source, StatusCategory, Storage, StorageBranch, StorybookDeployProject, TeamEntry, TeamPermission, Tooling, ToolingDoctorReport, TrackerDoctorReport, TrackerUser, Vault, WebhookDashboardInfo, WebhookVerificationError, Wiki, WikiDnsRecord, WikiProvisionOpts, WikiProxyConfig, Workers, WorkflowWithConfig, compose, createFeatureResolver, createResolveToken, createRestClient, defineConfig, deleteToken, getToken, isMulti, listStoredProviders, loadConfig, resolveConfig, resolveEntry, resolvePluginPackage, setToken };

package/dist/index.mjs

@@ -1,27 +1,22 @@
-import { CARDINALITY, ProviderApiError, REQUIRED_CAPABILITIES, WebhookVerificationError, isMulti } from "./capabilities/index.mjs";
+import { CARDINALITY, ProviderApiError, REQUIRED_CAPABILITIES, WebhookVerificationError, isMulti } from "./plugin/capabilities.mjs";
 import { AuthError, createResolveToken as createResolveToken$1, createRestClient } from "@theholocron/http-client";
+import { createEnvLookup } from "@theholocron/env-utils";
 import { Entry, findCredentials } from "@napi-rs/keyring";
 import { execFile } from "node:child_process";
 import { readFile, stat } from "node:fs/promises";
 import { basename, dirname, join } from "node:path";
 import { pathToFileURL } from "node:url";
 import { promisify } from "node:util";
-//#region src/env.ts
-function createEnvLookup(source = process.env) {
-	return {
-		get(key) {
-			return source[key] || void 0;
-		},
-		first(...keys) {
-			for (const key of keys) {
-				const val = source[key];
-				if (val) return val;
-			}
-		}
-	};
+createEnvLookup();
+/**
+* Create an injectable env for commands that accept a fake env in tests.
+* Pass `input.env` when available, falls back to `process.env`.
+*/
+function makeEnv(source) {
+	return createEnvLookup(source);
 }
 //#endregion
-//#region src/keyring.ts
+//#region src/auth/keyring.ts
 /**
 * Keyring-backed bootstrap credential store.
 *
@@ -91,7 +86,7 @@ function listStoredProviders() {
 	}
 }
 //#endregion
-//#region src/auth-resolver.ts
+//#region src/auth/auth-resolver.ts
 /** Wraps `createResolveToken` from `@theholocron/http` and injects the
 *  system keyring so plugins stay at a one-liner call site. */
 function createResolveToken(config) {
@@ -109,7 +104,7 @@ function createResolveToken(config) {
 */
 function createFeatureResolver(config) {
 	return function resolveFeatureToken(input = {}) {
-		const env = createEnvLookup(input.env);
+		const env = makeEnv(input.env);
 		const keyring = input.keyring ?? getToken;
 		const token = input.cliToken || env.get(config.envName) || keyring(config.keyringKey);
 		if (!token) throw new AuthError(`no GitHub token found for this operation. Pass --token <PAT>, set ${config.envName}, or run: holocron auth set ${config.keyringKey} <PAT>`);
@@ -117,7 +112,7 @@ function createFeatureResolver(config) {
 	};
 }
 //#endregion
-//#region src/config.ts
+//#region src/config/config.ts
 /**
 * `holocron.config.json` schema, parser, and provider resolution.
 *
@@ -244,7 +239,7 @@ function resolveConfig(raw) {
 	};
 }
 //#endregion
-//#region src/compose.ts
+//#region src/config/compose.ts
 function workflowName(e) {
 	return typeof e === "string" ? e : e.name;
 }
@@ -334,12 +329,12 @@ function compose(...args) {
 	};
 }
 //#endregion
-//#region src/define-config.ts
+//#region src/config/define-config.ts
 function defineConfig(config) {
 	return config;
 }
 //#endregion
-//#region src/load-config.ts
+//#region src/config/load-config.ts
 /**
 * `holocron.config.{json,js,ts}` file loader.
 *
@@ -457,4 +452,4 @@ async function fileExists(path) {
 	}
 }
 //#endregion
-export { AuthError, CARDINALITY, ConfigError, ConfigFileError, ProviderApiError, REQUIRED_CAPABILITIES, WebhookVerificationError, compose, createEnvLookup, createFeatureResolver, createResolveToken, createRestClient, defineConfig, deleteToken, getToken, isMulti, listStoredProviders, loadConfig, resolveConfig, resolveEntry, resolvePluginPackage, setToken };
+export { AuthError, CARDINALITY, ConfigError, ConfigFileError, ProviderApiError, REQUIRED_CAPABILITIES, WebhookVerificationError, compose, createFeatureResolver, createResolveToken, createRestClient, defineConfig, deleteToken, getToken, isMulti, listStoredProviders, loadConfig, resolveConfig, resolveEntry, resolvePluginPackage, setToken };

package/dist/{capabilities/index.d.mts → plugin/capabilities.d.mts}

@@ -1,5 +1,5 @@
 import { ProviderApiError } from "@theholocron/http-client";
-//#region src/capabilities/index.d.ts
+//#region src/plugin/capabilities.d.ts
 /**
  * Capability interfaces — the contracts that providers implement.
  *

package/dist/{capabilities/index.mjs → plugin/capabilities.mjs}

@@ -1,5 +1,5 @@
 import { ProviderApiError } from "@theholocron/http-client";
-//#region src/capabilities/index.ts
+//#region src/plugin/capabilities.ts
 const CARDINALITY = {
 	source: "single",
 	ci: "single",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theholocron/cli",
-  "version": "3.47.0",
+  "version": "3.49.0",
   "description": "The Holocron CLI — a pluggable, capability-based orchestrator for spinning up and operating software projects.",
   "keywords": [
     "cli",
@@ -28,9 +28,9 @@
       "default": "./dist/index.mjs"
     },
     "./capabilities": {
-      "types": "./dist/capabilities/index.d.mts",
-      "import": "./dist/capabilities/index.mjs",
-      "default": "./dist/capabilities/index.mjs"
+      "types": "./dist/plugin/capabilities.d.mts",
+      "import": "./dist/plugin/capabilities.mjs",
+      "default": "./dist/plugin/capabilities.mjs"
     }
   },
   "bin": {
@@ -44,18 +44,19 @@
     "@napi-rs/keyring": "^1.3.0",
     "@sentry/node": "^10.70.0",
     "@theholocron/components-doc": "^1.6.0",
-    "@theholocron/github-client": "^1.12.0",
-    "@theholocron/http-client": "^1.12.0",
-    "@theholocron/registry-doc": "^1.7.0",
+    "@theholocron/env-utils": "^1.6.0",
+    "@theholocron/github-client": "^1.14.2",
+    "@theholocron/http-client": "^1.14.2",
+    "@theholocron/registry-doc": "^1.8.0",
     "chalk": "^6.0.0",
     "ora": "^9.4.1",
     "tsx": "4.23.12",
     "yargs": "^18.1.0"
   },
   "devDependencies": {
-    "@theholocron/eslint-config": "^7.29.0",
-    "@theholocron/tsconfig": "^7.29.0",
-    "@theholocron/vitest-config": "^7.29.0",
+    "@theholocron/eslint-config": "^7.32.1",
+    "@theholocron/tsconfig": "^7.32.1",
+    "@theholocron/vitest-config": "^7.32.1",
     "@types/node": "^26",
     "@types/yargs": "^17.0.35",
     "@vitest/coverage-v8": "^4.1.11",
@@ -65,7 +66,8 @@
     "globals": "^17.11.0",
     "tsdown": "^0.22.14",
     "typescript": "^5.9.3",
-    "vitest": "^4.1.11"
+    "vitest": "^4.1.11",
+    "@theholocron/rollup-plugin-transform-template": "3.49.0"
   },
   "engines": {
     "node": ">=22.0.0"