@theholocron/cli 3.55.0 → 3.56.0

package/dist/cli.mjs

@@ -13,8 +13,8 @@ import ora from "ora";
 import chalk from "chalk";
 import { execFile, execFileSync, spawnSync } from "node:child_process";
 import { homedir } from "node:os";
-import { access, copyFile, mkdir, readFile, readdir, rm, stat, symlink, unlink, writeFile } from "node:fs/promises";
 import { createLogger, parseLogLevel } from "@theholocron/logger";
+import { access, copyFile, mkdir, readFile, readdir, rm, stat, symlink, unlink, writeFile } from "node:fs/promises";
 import { createHash } from "node:crypto";
 import { generateReadme } from "@theholocron/components-doc/markdown";
 import { getClients, getConfigs, getDocs, getPlugins, getSkills, getThemes, getUtils } from "@theholocron/registry-doc";
@@ -896,6 +896,66 @@ async function runDeploy(input) {
 	}
 }
 //#endregion
+//#region src/logger.ts
+/**
+* CLI-side wiring for `@theholocron/logger`.
+*
+* `logger` is the operational-output channel — internal state, debug
+* traces, errors, structured context that routes to Axiom. It runs in
+* parallel to `print` (user-facing UX output) and does not replace it.
+*/
+/**
+* Resolve the explicit level to hand to `createLogger`, in priority order:
+*
+* 1. `--verbose` → `"debug"`   2. `--quiet` → `"error"`
+* 3. `HOLOCRON_LOG_LEVEL` env var
+* 4. `holocron.config` `log.level` (`configLevel`)
+*
+* Returns `undefined` when nothing applies — `createLogger` then defaults
+* to `"info"`. Resolving the full chain here (rather than passing
+* `configLevel` straight through) keeps config below the env var.
+*/
+function resolveLogLevel(argv, configLevel) {
+	if (argv.verbose) return "debug";
+	if (argv.quiet) return "error";
+	return parseLogLevel(env.get("HOLOCRON_LOG_LEVEL")) ?? configLevel;
+}
+let root;
+let rootLevel;
+let rootCommand;
+/**
+* The process-wide root logger. Built once (from `cli.ts`'s middleware,
+* with the command name + flags + env). Rebuilt at most once more when a
+* command's handler supplies its `holocron.config` `log.level` — a case
+* the flag/env-only first pass could not have known — as long as no
+* higher-priority `--verbose` / `--quiet` already fixed the level. That
+* rebuild generates a fresh `runId`, which is harmless: nothing logs
+* between the middleware and the handler.
+*/
+function buildCliLogger(argv, opts = {}) {
+	const { command, configLevel } = opts;
+	if (command) rootCommand = command;
+	const level = resolveLogLevel(argv, configLevel);
+	const rebuildForConfig = configLevel !== void 0 && level !== rootLevel && !argv.verbose && !argv.quiet;
+	if (!root || rebuildForConfig) {
+		const built = createLogger(level ? { level } : {});
+		root = {
+			logger: rootCommand ? built.logger.child({ command: rootCommand }) : built.logger,
+			runId: built.runId
+		};
+		rootLevel = level;
+	}
+	return root;
+}
+/** Lazily-memoized `Logger` for module-level call sites with no `argv` in scope. */
+function getLogger() {
+	return (root ??= createLogger()).logger;
+}
+/** The current root logger's correlation id, if a root has been built. */
+function getRunId() {
+	return root?.runId;
+}
+//#endregion
 //#region src/commands/doctor.ts
 async function runDoctor(input) {
 	const print = input.print ?? ((line) => console.log(line));
@@ -924,7 +984,14 @@ async function runDoctor(input) {
 			rows.push(row);
 		}
 	}
+	const log = getLogger();
 	for (const row of rows) {
+		log[row.status === "fail" ? "warn" : "info"]({
+			capability: row.capability,
+			provider: row.provider,
+			status: row.status,
+			detail: row.message
+		}, `doctor: ${row.capability}`);
 		const label = `${pad(row.capability, 14)} via ${pad(row.provider, 14)}  ${row.message}`;
 		if (row.status === "ok") print(`  ${style.success(label)}`);
 		else if (row.status === "fail") print(`  ${style.fail(label)}`);
@@ -3112,59 +3179,6 @@ var dependabot_default = "version: 2\nupdates:\n  - package-ecosystem: npm\n
 //#region src/templates/labeler.yml
 var labeler_default = "bug:\n  - '^fix'\n\nchore:\n  - '^chore(?!\\(deps)'\n\nci:\n  - '^ci'\n\ndependencies:\n  - '^chore\\(deps'\n\ndocumentation:\n  - '^docs'\n\nenhancement:\n  - '^feat'\n\nperformance:\n  - '^perf'\n\nrefactor:\n  - '^refactor'\n\ntest:\n  - '^test'\n";
 //#endregion
-//#region src/logger.ts
-/**
-* CLI-side wiring for `@theholocron/logger`.
-*
-* `logger` is the operational-output channel — internal state, debug
-* traces, errors, structured context that routes to Axiom. It runs in
-* parallel to `print` (user-facing UX output) and does not replace it.
-*/
-/**
-* Resolve the explicit level to hand to `createLogger`, in priority order:
-*
-* 1. `--verbose` → `"debug"`   2. `--quiet` → `"error"`
-* 3. `HOLOCRON_LOG_LEVEL` env var
-* 4. `holocron.config` `log.level` (`configLevel`)
-*
-* Returns `undefined` when nothing applies — `createLogger` then defaults
-* to `"info"`. Resolving the full chain here (rather than passing
-* `configLevel` straight through) keeps config below the env var.
-*/
-function resolveLogLevel(argv, configLevel) {
-	if (argv.verbose) return "debug";
-	if (argv.quiet) return "error";
-	return parseLogLevel(env.get("HOLOCRON_LOG_LEVEL")) ?? configLevel;
-}
-let root;
-let rootLevel;
-/**
-* The process-wide root logger. Built once (from `cli.ts`'s middleware,
-* with flags + env only). Rebuilt at most once more when a command's
-* handler supplies its `holocron.config` `log.level` — a case the
-* flag/env-only first pass could not have known — as long as no
-* higher-priority `--verbose` / `--quiet` already fixed the level. That
-* rebuild generates a fresh `runId`, which is harmless: nothing logs
-* between the middleware and the handler.
-*/
-function buildCliLogger(argv, configLevel) {
-	const level = resolveLogLevel(argv, configLevel);
-	const rebuildForConfig = configLevel !== void 0 && level !== rootLevel && !argv.verbose && !argv.quiet;
-	if (!root || rebuildForConfig) {
-		root = createLogger(level ? { level } : {});
-		rootLevel = level;
-	}
-	return root;
-}
-/** Lazily-memoized `Logger` for module-level call sites with no `argv` in scope. */
-function getLogger() {
-	return (root ??= createLogger()).logger;
-}
-/** The current root logger's correlation id, if a root has been built. */
-function getRunId() {
-	return root?.runId;
-}
-//#endregion
 //#region src/commands/setup-workflows/index.ts
 /**
 * Thin workflow wrapper templates for `holocron setup`.
@@ -3989,6 +4003,18 @@ const BALANCED_REPO_SETTINGS = {
 //#endregion
 //#region src/commands/setup/run-step.ts
 async function runStep(capability, step, dryRun, body, opts = {}) {
+	const result = await execStep(capability, step, dryRun, body, opts);
+	const { status, message, reason } = result;
+	getLogger()[status === "fail" ? "warn" : "info"]({
+		capability,
+		step,
+		status,
+		...message ? { detail: message } : {},
+		...reason ? { reason } : {}
+	}, `${capability}.${step}`);
+	return result;
+}
+async function execStep(capability, step, dryRun, body, opts = {}) {
 	if (dryRun) return {
 		capability,
 		step,
@@ -5597,7 +5623,7 @@ var security_default = "name: Security\n\non: # yamllint disable-line rule:truth
 var stale_default = "name: Stale\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      days-before-stale:\n        description: Days of inactivity before an issue or PR is marked stale (applies to both unless type-specific value is set)\n        type: number\n        required: false\n        default: 30\n      days-before-close:\n        description: Days after stale label before closing (applies to both unless type-specific value is set)\n        type: number\n        required: false\n        default: 5\n      days-before-issue-stale:\n        description: Days of inactivity before an issue is marked stale; overrides days-before-stale when set to a non-negative value\n        type: number\n        required: false\n        default: -1\n      days-before-issue-close:\n        description: Days after stale label before closing an issue; overrides days-before-close when set to a non-negative value\n        type: number\n        required: false\n        default: -1\n      days-before-pr-stale:\n        description: Days of inactivity before a PR is marked stale; overrides days-before-stale when set to a non-negative value\n        type: number\n        required: false\n        default: -1\n      days-before-pr-close:\n        description: Days after stale label before closing a PR; overrides days-before-close when set to a non-negative value\n        type: number\n        required: false\n        default: -1\n      exempt-issue-labels:\n        description: Comma-separated labels that exempt an issue from being marked stale\n        type: string\n        required: false\n        default: \"in-progress,wip\"\n      exempt-pr-labels:\n        description: Comma-separated labels that exempt a PR from being marked stale\n        type: string\n        required: false\n        default: \"\"\n      exempt-all-issue-milestones:\n        description: Issues assigned to any milestone are never marked stale\n        type: boolean\n        required: false\n        default: true\n      exempt-all-pr-milestones:\n        description: PRs assigned to any milestone are never marked stale\n        type: boolean\n        required: false\n        default: true\n      exempt-all-issue-projects:\n        description: Issues assigned to any project are never marked stale\n        type: boolean\n        required: false\n        default: true\n      exempt-all-pr-projects:\n        description: PRs assigned to any project are never marked stale\n        type: boolean\n        required: false\n        default: true\n\njobs:\n  stale:\n    name: Mark stale issues and pull requests\n    permissions:\n      contents: write\n      issues: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    steps:\n      - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0\n        name: Run Stale\n        with:\n          close-issue-message: >\n            This issue was closed because it has been stalled for\n            ${{ inputs.days-before-close }} days with no activity.\n          days-before-close: ${{ inputs.days-before-close }}\n          days-before-issue-close: ${{ inputs.days-before-issue-close }}\n          days-before-issue-stale: ${{ inputs.days-before-issue-stale }}\n          days-before-pr-close: ${{ inputs.days-before-pr-close }}\n          days-before-pr-stale: ${{ inputs.days-before-pr-stale }}\n          days-before-stale: ${{ inputs.days-before-stale }}\n          exempt-all-issue-milestones: ${{ inputs.exempt-all-issue-milestones }}\n          exempt-all-issue-projects: ${{ inputs.exempt-all-issue-projects }}\n          exempt-all-pr-milestones: ${{ inputs.exempt-all-pr-milestones }}\n          exempt-all-pr-projects: ${{ inputs.exempt-all-pr-projects }}\n          exempt-issue-labels: ${{ inputs.exempt-issue-labels }}\n          exempt-pr-labels: ${{ inputs.exempt-pr-labels }}\n          stale-issue-label: wontfix\n          stale-issue-message: >\n            This issue is stale because it has been open ${{ inputs.days-before-stale }}\n            days with no activity. Remove the stale label or comment, or this will be\n            closed in ${{ inputs.days-before-close }} days.\n          stale-pr-label: wontfix\n          stale-pr-message: >\n            This PR is stale because it has been open ${{ inputs.days-before-stale }}\n            days with no activity. Remove the stale label or comment, or this will be\n            closed in ${{ inputs.days-before-close }} days.\n";
 //#endregion
 //#region src/templates/workflows/sync.yml
-var sync_default = "name: Sync\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      steps:\n        description: >\n          Sync steps to run (default: all). Valid values:\n          labels, properties, teams, topics, keywords, description, homepage, readme, workflows, wiki.\n          Pass a space-separated list to run a subset, e.g. \"readme\" or \"readme wiki\".\n        type: string\n        required: false\n    secrets:\n      HOLOCRON_ADMIN_TOKEN:\n        description: Fine-grained PAT with admin scopes (labels, properties, teams).\n        required: false\n      HOLOCRON_DEPLOY_TOKEN:\n        description: Fine-grained PAT for GitHub Pages configuration.\n        required: false\n      HOLOCRON_ISSUES_TOKEN:\n        description: Fine-grained PAT for issue management.\n        required: false\n      HOLOCRON_ORG_TOKEN:\n        description: Org-scoped fine-grained PAT for team sync and org properties.\n        required: false\n      HOLOCRON_READ_TOKEN:\n        description: Fine-grained PAT for read-only GitHub API calls.\n        required: false\n      HOLOCRON_SYNC_TOKEN:\n        required: false\n      GH_TOKEN:\n        description: >\n          Generic GitHub token fallback for gh CLI calls. Used when\n          HOLOCRON_SYNC_TOKEN is not set.\n        required: false\n\njobs:\n  sync:\n    name: Sync repo from config\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    permissions:\n      contents: write\n      pull-requests: write\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          token: ${{ secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN || github.token }}\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - name: Run holocron sync\n        run: |\n          if [ -n \"$STEPS\" ]; then\n            # shellcheck disable=SC2086\n            pnpm --workspace-root exec holocron sync --steps $STEPS\n          else\n            pnpm --workspace-root exec holocron sync\n          fi\n        env:\n          HOLOCRON_ADMIN_TOKEN: ${{ secrets.HOLOCRON_ADMIN_TOKEN }}\n          HOLOCRON_DEPLOY_TOKEN: ${{ secrets.HOLOCRON_DEPLOY_TOKEN }}\n          HOLOCRON_ISSUES_TOKEN: ${{ secrets.HOLOCRON_ISSUES_TOKEN }}\n          HOLOCRON_ORG_TOKEN: ${{ secrets.HOLOCRON_ORG_TOKEN }}\n          HOLOCRON_READ_TOKEN: ${{ secrets.HOLOCRON_READ_TOKEN }}\n          HOLOCRON_SYNC_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN }}\n          STEPS: ${{ inputs.steps }}\n\n      - name: Format generated files\n        run: pnpm exec prettier --write README.md docs/src/content/docs/index.mdx 2>/dev/null || true\n\n      - uses: theholocron/.github/.github/actions/auto-commit@main\n        id: auto-commit\n        name: Commit sync changes\n        with:\n          token: ${{ secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN || github.token }}\n          branch: chore/auto-sync\n          commit-message: \"chore: sync from holocron.config\"\n          commit-options: \"--no-verify\"\n\n      - name: Open PR if changes were committed\n        if: steps.auto-commit.outputs.changes-detected == 'true'\n        run: |\n          gh pr create \\\n            --title \"chore: sync README and repo metadata\" \\\n            --body \"Automated sync triggered by changes to config or package files. Merge to apply.\" \\\n            --base main \\\n            --head chore/auto-sync \\\n          || echo \"PR already open — branch updated.\"\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN || github.token }}\n\n      - name: Broadcast wiki sync if navbar changed\n        if: >-\n          steps.auto-commit.outputs.changes-detected == 'true' &&\n          github.event_name == 'push' &&\n          (inputs.steps == '' || contains(inputs.steps, 'wiki'))\n        run: |\n          if git diff HEAD~1 --name-only | grep -q 'fern/docs.yml'; then\n            gh workflow run sync-dispatch.yml \\\n              --repo theholocron/.github \\\n              --field \"steps=wiki\" \\\n            || echo \"skipping broadcast — insufficient permissions\"\n          fi\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN || github.token }}\n";
+var sync_default = "name: Sync\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      steps:\n        description: >\n          Sync steps to run (default: all). Valid values:\n          labels, properties, teams, topics, keywords, description, homepage, readme, workflows, wiki.\n          Pass a space-separated list to run a subset, e.g. \"readme\" or \"readme wiki\".\n        type: string\n        required: false\n    secrets:\n      HOLOCRON_ADMIN_TOKEN:\n        description: Fine-grained PAT with admin scopes (labels, properties, teams).\n        required: false\n      HOLOCRON_DEPLOY_TOKEN:\n        description: Fine-grained PAT for GitHub Pages configuration.\n        required: false\n      HOLOCRON_ISSUES_TOKEN:\n        description: Fine-grained PAT for issue management.\n        required: false\n      HOLOCRON_ORG_TOKEN:\n        description: Org-scoped fine-grained PAT for team sync and org properties.\n        required: false\n      HOLOCRON_READ_TOKEN:\n        description: Fine-grained PAT for read-only GitHub API calls.\n        required: false\n      HOLOCRON_SYNC_TOKEN:\n        required: false\n      GH_TOKEN:\n        description: >\n          Generic GitHub token fallback for gh CLI calls. Used when\n          HOLOCRON_SYNC_TOKEN is not set.\n        required: false\n\njobs:\n  sync:\n    name: Sync repo from config\n    runs-on: ubuntu-latest\n    timeout-minutes: 10\n    permissions:\n      contents: write\n      pull-requests: write\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n        with:\n          token: ${{ secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN || github.token }}\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - run: pnpm build\n        name: Build CLI\n\n      - name: Run holocron sync\n        run: |\n          if [ -n \"$STEPS\" ]; then\n            # shellcheck disable=SC2086\n            pnpm --workspace-root exec holocron sync --steps $STEPS\n          else\n            pnpm --workspace-root exec holocron sync\n          fi\n        env:\n          HOLOCRON_ADMIN_TOKEN: ${{ secrets.HOLOCRON_ADMIN_TOKEN }}\n          HOLOCRON_DEPLOY_TOKEN: ${{ secrets.HOLOCRON_DEPLOY_TOKEN }}\n          HOLOCRON_ISSUES_TOKEN: ${{ secrets.HOLOCRON_ISSUES_TOKEN }}\n          HOLOCRON_ORG_TOKEN: ${{ secrets.HOLOCRON_ORG_TOKEN }}\n          HOLOCRON_READ_TOKEN: ${{ secrets.HOLOCRON_READ_TOKEN }}\n          HOLOCRON_SYNC_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN }}\n          STEPS: ${{ inputs.steps }}\n\n      - name: Format generated files\n        run: pnpm exec prettier --write README.md docs/src/content/docs/index.mdx 2>/dev/null || true\n\n      - uses: theholocron/.github/.github/actions/auto-commit@main\n        id: auto-commit\n        name: Commit sync changes\n        with:\n          token: ${{ secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN || github.token }}\n          branch: chore/auto-sync\n          commit-message: \"chore: sync from holocron.config\"\n          commit-options: \"--no-verify\"\n\n      - name: Open PR if changes were committed\n        if: steps.auto-commit.outputs.changes-detected == 'true'\n        run: |\n          gh pr create \\\n            --title \"chore: sync README and repo metadata\" \\\n            --body \"Automated sync triggered by changes to config or package files. Merge to apply.\" \\\n            --base main \\\n            --head chore/auto-sync \\\n          || echo \"PR already open — branch updated.\"\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN || github.token }}\n\n      - name: Broadcast wiki sync if navbar changed\n        if: >-\n          steps.auto-commit.outputs.changes-detected == 'true' &&\n          github.event_name == 'push' &&\n          (inputs.steps == '' || contains(inputs.steps, 'wiki'))\n        run: |\n          if git diff HEAD~1 --name-only | grep -q 'fern/docs.yml'; then\n            gh workflow run sync-dispatch.yml \\\n              --repo theholocron/.github \\\n              --field \"steps=wiki\" \\\n            || echo \"skipping broadcast — insufficient permissions\"\n          fi\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN || secrets.GH_TOKEN || github.token }}\n";
 //#endregion
 //#region src/templates/workflows/sync-dispatch.yml
 var sync_dispatch_default = "name: Sync Dispatch\n\non: # yamllint disable-line rule:truthy\n  workflow_dispatch:\n    inputs:\n      steps:\n        description: >\n          Sync steps to pass to each repo's sync.yml. Default is \"readme\"\n          (only README marker blocks are updated).\n        type: string\n        required: false\n        default: readme\n\npermissions:\n  contents: read\n\njobs:\n  broadcast:\n    name: Broadcast sync to all repos\n    runs-on: ubuntu-latest\n    timeout-minutes: 15\n    steps:\n      - name: Dispatch sync to all repos with sync.yml\n        run: |\n          gh api /orgs/theholocron/repos --paginate --jq '.[].name' \\\n            | while IFS= read -r repo; do\n              gh api \"/repos/theholocron/$repo/contents/.github/workflows/sync.yml\" --silent 2>/dev/null || continue\n              echo \"Dispatching sync to theholocron/$repo\"\n              gh workflow run sync.yml \\\n                --repo \"theholocron/$repo\" \\\n                --field \"steps=$STEPS\" \\\n              || echo \"Warning: could not dispatch to theholocron/$repo — skipping\"\n            done\n        env:\n          GH_TOKEN: ${{ secrets.HOLOCRON_SYNC_TOKEN }}\n          STEPS: ${{ inputs.steps }}\n";
@@ -6164,14 +6190,26 @@ async function fileExists(path) {
 }
 //#endregion
 //#region src/telemetry.ts
-const DSN = "https://95cbb72ad5636c94e119a5405ee8f55f@o4508238154104832.ingest.us.sentry.io/4511810950791168";
+const FALLBACK_DSN = "https://95cbb72ad5636c94e119a5405ee8f55f@o4508238154104832.ingest.us.sentry.io/4511810950791168";
+/**
+* Resolve the Sentry DSN — the `errors` capability's self-contained
+* activation, per ADR-0007:
+*
+*   HOLOCRON_SENTRY_DSN  →  SENTRY_DSN  →  built-in fallback
+*
+* A consumer repo with `SENTRY_DSN` set gets CLI errors routed to its own
+* project with no config. Opt out entirely with `HOLOCRON_TELEMETRY=false`.
+*/
+function resolveDsn() {
+	return env.get("HOLOCRON_SENTRY_DSN") ?? env.get("SENTRY_DSN") ?? FALLBACK_DSN;
+}
 function isEnabled() {
-	return !(env.get("HOLOCRON_TELEMETRY") === "false" || Boolean(env.get("NO_HOLOCRON_TELEMETRY"))) && true;
+	return !(env.get("HOLOCRON_TELEMETRY") === "false" || Boolean(env.get("NO_HOLOCRON_TELEMETRY"))) && resolveDsn() !== "";
 }
 function init(version) {
 	if (!isEnabled()) return;
 	Sentry.init({
-		dsn: DSN,
+		dsn: resolveDsn(),
 		release: `holocron@${version}`,
 		environment: env.get("CI") ? "ci" : "local",
 		tracesSampleRate: 1,
@@ -6394,9 +6432,10 @@ try {
 		default: false,
 		describe: "Set the log level to error — suppress info and warn."
 	}).middleware((argv) => {
-		finishCommand = startCommand(argv._.slice(0, 2).join(" ") || "unknown");
+		const name = argv._.slice(0, 2).join(" ") || "unknown";
+		finishCommand = startCommand(name);
 		printRunId = Boolean(argv.debug || argv.verbose);
-		buildCliLogger(argv);
+		buildCliLogger(argv, { command: name });
 	}).command("version", "Print the CLI version", () => {}, () => {
 		console.log(`holocron ${CLI_VERSION}`);
 	}).command("clone", "Clone all repos in a GitHub org as siblings under a single directory", (y) => y.option("org", {
@@ -6430,7 +6469,7 @@ try {
 		const tokens = tokenContext(argv.token);
 		if (!tokens) return;
 		const loaded = await loadConfig(argv.cwd);
-		buildCliLogger(argv, loaded.resolved.log?.level);
+		buildCliLogger(argv, { configLevel: loaded.resolved.log?.level });
 		if ((await runDoctor({
 			loaded,
 			context: {
@@ -6448,7 +6487,7 @@ try {
 		const tokens = tokenContext(argv.token);
 		if (!tokens) return;
 		const loaded = await loadConfig(argv.cwd);
-		buildCliLogger(argv, loaded.resolved.log?.level);
+		buildCliLogger(argv, { configLevel: loaded.resolved.log?.level });
 		if ((await runSetup({
 			loaded,
 			context: {
@@ -6514,7 +6553,7 @@ try {
 		const scopeArg = argv.scope;
 		const scope = parseScope(scopeArg);
 		const loaded = await loadConfig(argv.cwd);
-		buildCliLogger(argv, loaded.resolved.log?.level);
+		buildCliLogger(argv, { configLevel: loaded.resolved.log?.level });
 		if ((await runSecretSet({
 			loaded,
 			context: {
@@ -6544,7 +6583,7 @@ try {
 		const tokens = tokenContext(argv.token);
 		if (!tokens) return;
 		const loaded = await loadConfig(argv.cwd);
-		buildCliLogger(argv, loaded.resolved.log?.level);
+		buildCliLogger(argv, { configLevel: loaded.resolved.log?.level });
 		if ((await runSecretsSync({
 			loaded,
 			context: {
@@ -6573,7 +6612,7 @@ try {
 		const tokens = tokenContext(argv.token);
 		if (!tokens) return;
 		const loaded = await loadConfig(argv.cwd);
-		buildCliLogger(argv, loaded.resolved.log?.level);
+		buildCliLogger(argv, { configLevel: loaded.resolved.log?.level });
 		if ((await runDeploy({
 			loaded,
 			context: {
@@ -6601,7 +6640,7 @@ try {
 		const tokens = tokenContext(argv.token);
 		if (!tokens) return;
 		const loaded = await loadConfig(argv.cwd);
-		buildCliLogger(argv, loaded.resolved.log?.level);
+		buildCliLogger(argv, { configLevel: loaded.resolved.log?.level });
 		if ((await runCleanupPreview({
 			loaded,
 			context: {
@@ -6649,7 +6688,7 @@ try {
 		const tokens = tokenContext(argv.token);
 		if (!tokens) return;
 		const loaded = await loadConfig(argv.cwd);
-		buildCliLogger(argv, loaded.resolved.log?.level);
+		buildCliLogger(argv, { configLevel: loaded.resolved.log?.level });
 		if ((await runSync({
 			loaded,
 			context: {
@@ -6706,7 +6745,7 @@ try {
 		default: false
 	}), async (argv) => {
 		const loaded = await loadConfig(argv.cwd);
-		buildCliLogger(argv, loaded.resolved.log?.level);
+		buildCliLogger(argv, { configLevel: loaded.resolved.log?.level });
 		if ((await runSyncReadme({
 			loaded,
 			context: {