@theholocron/cli 3.60.0 → 3.62.0

package/dist/cli.mjs

@@ -9,9 +9,9 @@ import { AuthError, ProviderApiError, ProviderApiError as ProviderApiError$1, cr
 import { createEnvLookup } from "@theholocron/env-utils";
 import { Entry, findCredentials } from "@napi-rs/keyring";
 import { pathToFileURL } from "node:url";
+import { createLogger, parseLogLevel, resolveAxiomFromEnv } from "@theholocron/logger";
 import ora from "ora";
 import chalk from "chalk";
-import { createLogger, parseLogLevel, resolveAxiomFromEnv } from "@theholocron/logger";
 import { execFile, execFileSync, spawnSync } from "node:child_process";
 import { homedir } from "node:os";
 import { access, copyFile, mkdir, readFile, readdir, rm, stat, symlink, unlink, writeFile } from "node:fs/promises";
@@ -288,6 +288,94 @@ function resolveConfig(raw) {
 	};
 }
 //#endregion
+//#region src/logger.ts
+/**
+* CLI-side wiring for `@theholocron/logger`.
+*
+* `logger` is the operational-output channel — internal state, debug
+* traces, errors, structured context that routes to Axiom. It runs in
+* parallel to `print` (user-facing UX output) and does not replace it.
+*/
+/**
+* Resolve the explicit level to hand to `createLogger`, in priority order:
+*
+* 1. `--verbose` → `"debug"`   2. `--quiet` → `"error"`
+* 3. `HOLOCRON_LOG_LEVEL` env var
+* 4. `holocron.config` `log.level` (`configLevel`)
+*
+* Returns `undefined` when nothing applies — `createLogger` then defaults
+* to `"info"`. Resolving the full chain here (rather than passing
+* `configLevel` straight through) keeps config below the env var.
+*/
+function resolveLogLevel(argv, configLevel) {
+	if (argv.verbose) return "debug";
+	if (argv.quiet) return "error";
+	return parseLogLevel(env.get("HOLOCRON_LOG_LEVEL")) ?? configLevel;
+}
+let root;
+let rootLevel;
+let rootCommand;
+let rootAxiomKey;
+/**
+* Resolve Axiom credentials for the CLI. Env vars win — same contract as
+* `@theholocron/logger`'s `resolveAxiomFromEnv`. Failing that, the CLI-only
+* bridge pairs the OS-keyring token (`axiom.<org>` then bare `axiom`) with a
+* dataset from `HOLOCRON_AXIOM_DATASET` / `AXIOM_DATASET` or
+* `holocron.config` `log.axiom.dataset`. Returns `undefined` unless both a
+* token and a dataset are found.
+*/
+function resolveCliAxiom(opts) {
+	const fromEnv = resolveAxiomFromEnv();
+	if (fromEnv) return fromEnv;
+	const dataset = env.get("HOLOCRON_AXIOM_DATASET") || env.get("AXIOM_DATASET") || opts.configAxiomDataset;
+	if (!dataset) return void 0;
+	const org = opts.org ?? env.get("HOLOCRON_ORG");
+	const token = (org ? getToken(`axiom.${org}`) : null) ?? getToken("axiom");
+	return token ? {
+		dataset,
+		token
+	} : void 0;
+}
+/**
+* The process-wide root logger. Built once (from `cli.ts`'s middleware,
+* with the command name + flags + env). Rebuilt at most once more when a
+* command's handler supplies `holocron.config` context the flag/env-only
+* first pass could not have known — `log.level` (unless `--verbose` /
+* `--quiet` already fixed it) or `log.axiom.dataset` + the resolved org
+* for a keyring-backed Axiom transport. That rebuild generates a fresh
+* `runId`, which is harmless: nothing logs between the middleware and the
+* handler.
+*/
+function buildCliLogger(argv, opts = {}) {
+	const { command, configLevel } = opts;
+	if (command) rootCommand = command;
+	const level = resolveLogLevel(argv, configLevel);
+	const axiom = resolveCliAxiom(opts);
+	const axiomKey = axiom?.dataset;
+	const rebuildForConfig = configLevel !== void 0 && level !== rootLevel && !argv.verbose && !argv.quiet;
+	if (!root || rebuildForConfig || axiomKey !== void 0 && axiomKey !== rootAxiomKey) {
+		const built = createLogger({
+			...level ? { level } : {},
+			...axiom ? { axiom } : {}
+		});
+		root = {
+			logger: rootCommand ? built.logger.child({ command: rootCommand }) : built.logger,
+			runId: built.runId
+		};
+		rootLevel = level;
+		rootAxiomKey = axiomKey;
+	}
+	return root;
+}
+/** Lazily-memoized `Logger` for module-level call sites with no `argv` in scope. */
+function getLogger() {
+	return (root ??= createLogger()).logger;
+}
+/** The current root logger's correlation id, if a root has been built. */
+function getRunId() {
+	return root?.runId;
+}
+//#endregion
 //#region src/ui/progress.ts
 /**
 * Runs `fn`, showing an ora spinner for its duration in TTY environments.
@@ -356,6 +444,7 @@ function resolveAuthSetToken(input) {
 }
 async function runAuthSet(input) {
 	const print = input.print ?? ((l) => console.log(l));
+	const logger = input.logger ?? getLogger();
 	const importer = input.importer ?? defaultImporter$1;
 	const { provider } = input;
 	const keyringKey = input.org ? `${provider}.${input.org}` : provider;
@@ -374,6 +463,11 @@ async function runAuthSet(input) {
 			const hint = await tryLoadHint(importer, packageName);
 			if (hint) print(style.hint(`  hint: ${hint}`));
 		}
+		logger.warn({
+			provider,
+			keyringKey,
+			reason: "no token supplied"
+		}, `auth set: ${keyringKey}`);
 		return {
 			status: "fail",
 			message: "no token supplied"
@@ -387,6 +481,12 @@ async function runAuthSet(input) {
 			if (!verified.ok) {
 				print(style.fail(`token rejected by ${provider}: ${verified.message}`));
 				if (module.AUTH_HINT) print(style.hint(`  hint: ${module.AUTH_HINT}`));
+				logger.warn({
+					provider,
+					keyringKey,
+					verified: false,
+					reason: verified.message
+				}, `auth set: ${keyringKey}`);
 				return {
 					status: "fail",
 					message: verified.message
@@ -401,12 +501,24 @@ async function runAuthSet(input) {
 	}
 	if (!setToken(keyringKey, token)) {
 		print(style.fail(`keyring unavailable — token not stored. Use env vars instead.`));
+		logger.warn({
+			provider,
+			keyringKey,
+			reason: "keyring unavailable"
+		}, `auth set: ${keyringKey}`);
 		return {
 			status: "fail",
 			message: "keyring unavailable"
 		};
 	}
 	print(style.success(`stored ${keyringKey} token${subject ? ` (${subject})` : ""}`));
+	logger.info({
+		provider,
+		keyringKey,
+		verified: subject !== void 0,
+		...subject ? { subject } : {},
+		status: "ok"
+	}, `auth set: ${keyringKey}`);
 	return {
 		status: "ok",
 		...subject ? { message: subject } : {}
@@ -414,11 +526,20 @@ async function runAuthSet(input) {
 }
 function runAuthUnset(input) {
 	const print = input.print ?? ((l) => console.log(l));
+	const logger = input.logger ?? getLogger();
 	if (deleteToken(input.provider)) {
 		print(style.success(`removed ${input.provider} token`));
+		logger.info({
+			provider: input.provider,
+			status: "ok"
+		}, `auth unset: ${input.provider}`);
 		return { status: "ok" };
 	}
 	print(style.dim(`no stored token for ${input.provider}`));
+	logger.info({
+		provider: input.provider,
+		status: "skip"
+	}, `auth unset: ${input.provider}`);
 	return {
 		status: "skip",
 		message: "nothing to remove"
@@ -426,12 +547,19 @@ function runAuthUnset(input) {
 }
 async function runAuthCheck(input) {
 	const print = input.print ?? ((l) => console.log(l));
+	const logger = input.logger ?? getLogger();
 	const importer = input.importer ?? defaultImporter$1;
 	const { provider } = input;
 	const keyringKey = input.org ? `${provider}.${input.org}` : provider;
 	const token = getToken(keyringKey);
 	if (!token) {
 		print(style.dim(`no stored token for ${keyringKey}`));
+		logger.info({
+			provider,
+			keyringKey,
+			status: "skip",
+			reason: "no stored token"
+		}, `auth check: ${keyringKey}`);
 		return {
 			status: "skip",
 			message: "no stored token"
@@ -458,6 +586,13 @@ async function runAuthCheck(input) {
 		const verified = input.showSpinner !== false ? await withSpinner(`Verifying ${keyringKey} token…`, verify) : await verify();
 		if (verified.ok) {
 			print(style.success(`${keyringKey}: ok — ${verified.subject}`));
+			logger.info({
+				provider,
+				keyringKey,
+				verified: true,
+				subject: verified.subject,
+				status: "ok"
+			}, `auth check: ${keyringKey}`);
 			return {
 				status: "ok",
 				message: verified.subject
@@ -465,6 +600,13 @@ async function runAuthCheck(input) {
 		}
 		print(style.fail(`${keyringKey}: rejected — ${verified.message}`));
 		if (module.AUTH_HINT) print(style.hint(`  hint: ${module.AUTH_HINT}`));
+		logger.warn({
+			provider,
+			keyringKey,
+			verified: false,
+			reason: verified.message,
+			status: "fail"
+		}, `auth check: ${keyringKey}`);
 		return {
 			status: "fail",
 			message: verified.message
@@ -472,6 +614,12 @@ async function runAuthCheck(input) {
 	} catch (err) {
 		const msg = err instanceof Error ? err.message : String(err);
 		print(style.fail(`${keyringKey}: cannot verify — ${msg}`));
+		logger.warn({
+			provider,
+			keyringKey,
+			reason: msg,
+			status: "fail"
+		}, `auth check: ${keyringKey}`);
 		return {
 			status: "fail",
 			message: msg
@@ -480,28 +628,42 @@ async function runAuthCheck(input) {
 }
 async function runAuthList(input = {}) {
 	const print = input.print ?? ((l) => console.log(l));
+	const logger = input.logger ?? getLogger();
 	const importer = input.importer ?? defaultImporter$1;
 	const providers = listStoredProviders();
 	if (providers.length === 0) {
 		print(style.dim("no stored tokens."));
 		print(style.hint("run: holocron auth set <provider> <token>"));
+		logger.info({ providers: 0 }, "auth list: done");
 		return {
 			status: "ok",
 			message: "none"
 		};
 	}
+	let ok = 0;
+	let fail = 0;
 	for (const provider of providers.sort()) {
 		const check = await runAuthCheck({
 			provider,
 			importer,
 			print: () => {},
+			logger,
 			showSpinner: false
 		});
 		const label = `${provider}${check.message ? ` — ${check.message}` : ""}`;
-		if (check.status === "ok") print(`  ${style.success(label)}`);
-		else if (check.status === "fail") print(`  ${style.fail(label)}`);
-		else print(`  ${style.dim(`· ${label}`)}`);
+		if (check.status === "ok") {
+			ok += 1;
+			print(`  ${style.success(label)}`);
+		} else if (check.status === "fail") {
+			fail += 1;
+			print(`  ${style.fail(label)}`);
+		} else print(`  ${style.dim(`· ${label}`)}`);
 	}
+	logger.info({
+		providers: providers.length,
+		ok,
+		fail
+	}, "auth list: done");
 	return { status: "ok" };
 }
 async function tryLoadHint(importer, packageName) {
@@ -512,94 +674,6 @@ async function tryLoadHint(importer, packageName) {
 	}
 }
 //#endregion
-//#region src/logger.ts
-/**
-* CLI-side wiring for `@theholocron/logger`.
-*
-* `logger` is the operational-output channel — internal state, debug
-* traces, errors, structured context that routes to Axiom. It runs in
-* parallel to `print` (user-facing UX output) and does not replace it.
-*/
-/**
-* Resolve the explicit level to hand to `createLogger`, in priority order:
-*
-* 1. `--verbose` → `"debug"`   2. `--quiet` → `"error"`
-* 3. `HOLOCRON_LOG_LEVEL` env var
-* 4. `holocron.config` `log.level` (`configLevel`)
-*
-* Returns `undefined` when nothing applies — `createLogger` then defaults
-* to `"info"`. Resolving the full chain here (rather than passing
-* `configLevel` straight through) keeps config below the env var.
-*/
-function resolveLogLevel(argv, configLevel) {
-	if (argv.verbose) return "debug";
-	if (argv.quiet) return "error";
-	return parseLogLevel(env.get("HOLOCRON_LOG_LEVEL")) ?? configLevel;
-}
-let root;
-let rootLevel;
-let rootCommand;
-let rootAxiomKey;
-/**
-* Resolve Axiom credentials for the CLI. Env vars win — same contract as
-* `@theholocron/logger`'s `resolveAxiomFromEnv`. Failing that, the CLI-only
-* bridge pairs the OS-keyring token (`axiom.<org>` then bare `axiom`) with a
-* dataset from `HOLOCRON_AXIOM_DATASET` / `AXIOM_DATASET` or
-* `holocron.config` `log.axiom.dataset`. Returns `undefined` unless both a
-* token and a dataset are found.
-*/
-function resolveCliAxiom(opts) {
-	const fromEnv = resolveAxiomFromEnv();
-	if (fromEnv) return fromEnv;
-	const dataset = env.get("HOLOCRON_AXIOM_DATASET") || env.get("AXIOM_DATASET") || opts.configAxiomDataset;
-	if (!dataset) return void 0;
-	const org = opts.org ?? env.get("HOLOCRON_ORG");
-	const token = (org ? getToken(`axiom.${org}`) : null) ?? getToken("axiom");
-	return token ? {
-		dataset,
-		token
-	} : void 0;
-}
-/**
-* The process-wide root logger. Built once (from `cli.ts`'s middleware,
-* with the command name + flags + env). Rebuilt at most once more when a
-* command's handler supplies `holocron.config` context the flag/env-only
-* first pass could not have known — `log.level` (unless `--verbose` /
-* `--quiet` already fixed it) or `log.axiom.dataset` + the resolved org
-* for a keyring-backed Axiom transport. That rebuild generates a fresh
-* `runId`, which is harmless: nothing logs between the middleware and the
-* handler.
-*/
-function buildCliLogger(argv, opts = {}) {
-	const { command, configLevel } = opts;
-	if (command) rootCommand = command;
-	const level = resolveLogLevel(argv, configLevel);
-	const axiom = resolveCliAxiom(opts);
-	const axiomKey = axiom?.dataset;
-	const rebuildForConfig = configLevel !== void 0 && level !== rootLevel && !argv.verbose && !argv.quiet;
-	if (!root || rebuildForConfig || axiomKey !== void 0 && axiomKey !== rootAxiomKey) {
-		const built = createLogger({
-			...level ? { level } : {},
-			...axiom ? { axiom } : {}
-		});
-		root = {
-			logger: rootCommand ? built.logger.child({ command: rootCommand }) : built.logger,
-			runId: built.runId
-		};
-		rootLevel = level;
-		rootAxiomKey = axiomKey;
-	}
-	return root;
-}
-/** Lazily-memoized `Logger` for module-level call sites with no `argv` in scope. */
-function getLogger() {
-	return (root ??= createLogger()).logger;
-}
-/** The current root logger's correlation id, if a root has been built. */
-function getRunId() {
-	return root?.runId;
-}
-//#endregion
 //#region src/plugin/loader.ts
 /**
 * `PluginLoader` — loads provider plugins per the resolved config and
@@ -928,9 +1002,15 @@ async function listOrgRepos(org, token, fetchFn) {
 }
 async function runClone(input) {
 	const print = input.print ?? ((line) => console.log(line));
+	const logger = input.logger ?? getLogger();
 	const fetchFn = input.fetch ?? globalThis.fetch;
 	const dryRun = input.dryRun ?? false;
 	const targetDir = resolve(input.dir ?? join(homedir(), "Code", input.org));
+	logger.info({
+		org: input.org,
+		targetDir,
+		dryRun: dryRun || void 0
+	}, "clone: start");
 	const exec = input.exec ?? ((cmd, args, opts) => {
 		return { status: spawnSync(cmd, args, {
 			cwd: opts.cwd,
@@ -944,12 +1024,17 @@ async function runClone(input) {
 	try {
 		repos = await listOrgRepos(input.org, input.token, fetchFn);
 	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		logger.warn({
+			org: input.org,
+			reason: message
+		}, "clone: failed to list org repos");
 		return {
 			status: "fail",
 			cloned: 0,
 			skipped: 0,
 			failed: 0,
-			message: err instanceof Error ? err.message : String(err)
+			message
 		};
 	}
 	let cloned = 0;
@@ -997,8 +1082,16 @@ async function runClone(input) {
 	}
 	const summary = `${cloned} cloned, ${skipped} skipped, ${failed} failed`;
 	print(dryRun ? style.dim(`\n  dry-run: ${summary}`) : failed > 0 ? style.fail(`\n  ${summary}`) : style.success(`\n  ${summary}`));
+	const status = dryRun ? "dry-run" : failed > 0 ? "fail" : "ok";
+	logger[failed > 0 ? "warn" : "info"]({
+		org: input.org,
+		status,
+		cloned,
+		skipped,
+		failed
+	}, "clone: done");
 	return {
-		status: dryRun ? "dry-run" : failed > 0 ? "fail" : "ok",
+		status,
 		cloned,
 		skipped,
 		failed
@@ -1384,6 +1477,7 @@ async function runNew(input) {
 	const cwd = input.cwd ?? process.cwd();
 	const org = input.org ?? "theholocron";
 	const print = input.print ?? ((line) => console.log(line));
+	const logger = input.logger ?? getLogger();
 	const execFn = input.exec ?? defaultExec$3;
 	const readFn = input.readFile ?? defaultReadFile;
 	const writeFn = input.writeFile ?? defaultWriteFile;
@@ -1392,6 +1486,11 @@ async function runNew(input) {
 	const templateRepo = `${org}/${input.type}-template`;
 	const newRepo = `${org}/${input.name}`;
 	const repoDir = path.join(cwd, input.name);
+	logger.info({
+		repo: newRepo,
+		template: templateRepo,
+		dryRun: input.dryRun || void 0
+	}, "new: start");
 	if (input.dryRun) {
 		print(`  Would create ${newRepo} from template ${templateRepo}`);
 		print(`  Would clone to ${repoDir}`);
@@ -1400,6 +1499,10 @@ async function runNew(input) {
 		if (input.homepage) print(`  Would replace <homepage> → "${input.homepage}"`);
 		if (input.runtimeEnvironment) print(`  Would replace <runtime_environment> → "${input.runtimeEnvironment}"`);
 		print(`  Would generate holocron.config.ts`);
+		logger.info({
+			repo: newRepo,
+			status: "dry-run"
+		}, "new: done");
 		return { status: "dry-run" };
 	}
 	if (existsSync(repoDir)) throw new NewError(`\`${repoDir}\` already exists — delete it or pick a different name.`);
@@ -1555,6 +1658,12 @@ async function runNew(input) {
 		print(`    3. holocron setup  # wire up secrets, teams, labels, etc.`);
 		print(`    4. git push -u origin HEAD`);
 	} else print(`    2. git push -u origin HEAD`);
+	logger.info({
+		repo: newRepo,
+		repoDir,
+		filesPatched,
+		status: "ok"
+	}, "new: done");
 	return {
 		status: "ok",
 		repoDir,
@@ -1565,6 +1674,7 @@ async function runNew(input) {
 //#region src/commands/npm-bump-versions.ts
 async function runNpmBumpVersions(input) {
 	const print = input.print ?? ((line) => console.log(line));
+	const logger = input.logger ?? getLogger();
 	const cwd = input.cwd ?? process.cwd();
 	const { version, dryRun = false } = input;
 	const readFile = input.readFile ?? ((p) => readFileSync(p, "utf8"));
@@ -1574,6 +1684,10 @@ async function runNpmBumpVersions(input) {
 	const bumped = [];
 	const skipped = [];
 	print(`Bumping monorepo to ${version}${dryRun ? " (dry-run)" : ""}…`);
+	logger.info({
+		version,
+		dryRun: dryRun || void 0
+	}, "npm bump-versions: start");
 	function bumpFile(absPath, label) {
 		let pkg;
 		try {
@@ -1596,8 +1710,15 @@ async function runNpmBumpVersions(input) {
 	try {
 		entries = listDir(packagesDir);
 	} catch {
+		const status = dryRun ? "dry-run" : "ok";
+		logger.info({
+			version,
+			status,
+			bumped: bumped.length,
+			skipped: skipped.length
+		}, "npm bump-versions: done");
 		return {
-			status: dryRun ? "dry-run" : "ok",
+			status,
 			bumped,
 			skipped
 		};
@@ -1624,8 +1745,15 @@ async function runNpmBumpVersions(input) {
 		}
 		bumpFile(pkgFile, `packages/${entry}`);
 	}
+	const status = dryRun ? "dry-run" : "ok";
+	logger.info({
+		version,
+		status,
+		bumped: bumped.length,
+		skipped: skipped.length
+	}, "npm bump-versions: done");
 	return {
-		status: dryRun ? "dry-run" : "ok",
+		status,
 		bumped,
 		skipped
 	};
@@ -1659,6 +1787,7 @@ async function runNpmBumpVersions(input) {
 */
 async function runNpmPublishInitial(input = {}) {
 	const print = input.print ?? ((line) => console.log(line));
+	const logger = input.logger ?? getLogger();
 	const cwd = input.cwd ?? process.cwd();
 	const tag = input.tag ?? "alpha";
 	const dryRun = input.dryRun ?? false;
@@ -1679,6 +1808,10 @@ async function runNpmPublishInitial(input = {}) {
 	print(`Holocron npm publish-initial${dryRun ? " (dry-run)" : ""}`);
 	print(`  cwd: ${cwd}`);
 	print(`  tag: ${tag}`);
+	logger.info({
+		tag,
+		dryRun: dryRun || void 0
+	}, "npm publish-initial: start");
 	if (otp) print(`  otp: <${otp.length} chars>`);
 	print("");
 	print("  → verifying npm auth (`npm whoami`)…");
@@ -1686,10 +1819,12 @@ async function runNpmPublishInitial(input = {}) {
 	if (whoami.exitCode !== 0) {
 		const message = "npm is not authenticated. Run `npm login --auth-type=web` (browser flow, no token stored) or `npm login`, then re-run this command.";
 		print(`  ✗ ${message}`);
+		const packageNames = input.packages ?? discoverPublicPackages(cwd);
+		logger.warn({ reason: "npm not authenticated" }, "npm publish-initial: done");
 		return {
 			status: "fail",
 			message,
-			packageNames: input.packages ?? discoverPublicPackages(cwd)
+			packageNames
 		};
 	}
 	print(`    ✓ authed as ${whoami.stdout.trim() || "<unknown>"}`);
@@ -1700,6 +1835,11 @@ async function runNpmPublishInitial(input = {}) {
 		print("  … (dry-run) skipping actual publish");
 		print(`    would run: pnpm ${publishArgs.join(" ")}`);
 		printNextSteps$1(print, env, packageNames, repoName);
+		logger.info({
+			tag,
+			status: "dry-run",
+			packages: packageNames.length
+		}, "npm publish-initial: done");
 		return {
 			status: "dry-run",
 			message: "dry-run — no publish executed",
@@ -1717,6 +1857,10 @@ async function runNpmPublishInitial(input = {}) {
 			print("  → hint: your npm account requires 2FA for writes. Re-run with `--otp <code>`:");
 			print(`    pnpm exec tsx packages/cli/src/cli.ts npm publish-initial --otp <6-digit-code>`);
 		}
+		logger.warn({
+			tag,
+			reason: message
+		}, "npm publish-initial: done");
 		return {
 			status: "fail",
 			message,
@@ -1725,6 +1869,11 @@ async function runNpmPublishInitial(input = {}) {
 	}
 	print("    ✓ publish complete");
 	printNextSteps$1(print, env, packageNames, repoName);
+	logger.info({
+		tag,
+		status: "ok",
+		packages: packageNames.length
+	}, "npm publish-initial: done");
 	return {
 		status: "ok",
 		packageNames
@@ -2704,6 +2853,7 @@ function resolvePath(template, inputs) {
 function runPluginCreate(input) {
 	const cwd = input.cwd ?? process.cwd();
 	const print = input.print ?? ((line) => console.log(line));
+	const logger = input.logger ?? getLogger();
 	const write = input.writeFile ?? defaultWrite;
 	preflight(cwd);
 	validateSlug(input.slug);
@@ -2730,6 +2880,11 @@ function runPluginCreate(input) {
 	const filesWritten = [];
 	print(`Scaffolding @theholocron/holocron-plugin-${inputs.slug}${input.dryRun ? " (dry-run)" : ""}`);
 	print(`  → ${packageDir}`);
+	logger.info({
+		slug: inputs.slug,
+		capability: inputs.capability,
+		dryRun: input.dryRun || void 0
+	}, "plugin create: start");
 	for (const template of TEMPLATES) {
 		const resolvedPath = resolvePath(template.path, inputs);
 		const filepath = path.join(packageDir, resolvedPath);
@@ -2777,7 +2932,14 @@ function runPluginCreate(input) {
 			});
 			print("  ✓ scaffold verified");
 		} catch (err) {
-			print(`  ✗ verify failed — ${err instanceof Error ? err.message : String(err)}`);
+			const message = err instanceof Error ? err.message : String(err);
+			print(`  ✗ verify failed — ${message}`);
+			logger.warn({
+				slug: inputs.slug,
+				files: filesWritten.length,
+				reason: message,
+				status: "fail"
+			}, "plugin create: done");
 			return {
 				status: "fail",
 				packagePath: packageDir,
@@ -2787,6 +2949,12 @@ function runPluginCreate(input) {
 		}
 	}
 	if (!input.dryRun) printNextSteps(print, inputs);
+	logger.info({
+		slug: inputs.slug,
+		capability: inputs.capability,
+		files: filesWritten.length,
+		status: input.dryRun ? "dry-run" : "ok"
+	}, "plugin create: done");
 	return {
 		status: "ok",
 		packagePath: packageDir,
@@ -2852,6 +3020,7 @@ function printNextSteps(print, inputs) {
 //#region src/commands/secret-set.ts
 async function runSecretSet(input) {
 	const print = input.print ?? ((line) => console.log(line));
+	const logger = input.logger ?? getLogger();
 	const loader = input.loader ?? new PluginLoader(input.loaded.resolved, input.context);
 	await loader.load();
 	const dryRun = input.context.dryRun ?? false;
@@ -2874,6 +3043,12 @@ async function runSecretSet(input) {
 		const secrets = loader.get("secrets");
 		await secrets.setSecret(scope, input.name, value);
 		print(`  ✓ set ${input.name} via ${secrets.providerName}`);
+		logger.info({
+			key: input.name,
+			scope: describeScope(scope),
+			provider: secrets.providerName,
+			status: "ok"
+		}, `secret set: ${input.name}`);
 		return {
 			status: "ok",
 			name: input.name,
@@ -2882,6 +3057,11 @@ async function runSecretSet(input) {
 	} catch (err) {
 		const message = err instanceof Error ? err.message : String(err);
 		print(`  ✗ ${message}`);
+		logger.warn({
+			key: input.name,
+			scope: describeScope(scope),
+			reason: message
+		}, `secret set: ${input.name}`);
 		return {
 			status: "fail",
 			name: input.name,
@@ -4931,25 +5111,50 @@ const defaultExec = (cmd, args, opts) => {
 };
 async function runSkillsInstall(input) {
 	const print = input.print ?? ((line) => console.log(line));
+	const logger = input.logger ?? getLogger();
 	const config = input.loaded.resolved;
 	if (!config.agent || !config.skills?.length) {
 		print("Nothing to install — set `agent` and `skills` in holocron.config.ts");
+		logger.info({
+			status: "skip",
+			reason: "no agent/skills configured"
+		}, "skills install: done");
 		return;
 	}
 	if (input.context.dryRun) {
 		print(`Would install ${config.skills.length} skill(s) for agent: ${config.agent}`);
 		for (const name of config.skills) print(`  → would install: ${name}`);
+		logger.info({
+			agent: config.agent,
+			skills: config.skills,
+			status: "dry-run"
+		}, "skills install: done");
 		return;
 	}
 	print(`Installing ${config.skills.length} skill(s) for agent: ${config.agent}`);
+	logger.info({
+		agent: config.agent,
+		count: config.skills.length
+	}, "skills install: start");
 	try {
 		print(`  → ${await installSkills({
 			agent: config.agent,
 			skills: config.skills,
 			repoRoot: input.context.repoRoot
 		})}`);
+		logger.info({
+			agent: config.agent,
+			skills: config.skills,
+			status: "ok"
+		}, "skills install: done");
 	} catch (err) {
-		print(`  ✗ ${err instanceof Error ? err.message : String(err)}`);
+		const message = err instanceof Error ? err.message : String(err);
+		print(`  ✗ ${message}`);
+		logger.warn({
+			agent: config.agent,
+			reason: message,
+			status: "fail"
+		}, "skills install: done");
 	}
 }
 function runSkillsRemove(input) {
@@ -5073,6 +5278,7 @@ async function updateIndexMdxDescription(repoRoot, description, dryRun, readFile
 }
 async function runSyncReadme(input) {
 	const { loaded, context, print = console.log, readFileFn = readFile, writeFileFn = writeFile } = input;
+	const logger = input.logger ?? getLogger();
 	const { repoRoot, dryRun = false } = context;
 	const namespaces = loaded.resolved.env?.namespaces ?? [];
 	print(style.header(`Syncing README installation block${dryRun ? " (dry-run)" : ""}…`));
@@ -5082,6 +5288,10 @@ async function runSyncReadme(input) {
 		const raw = await readFileFn(join(repoRoot, "package.json"), "utf8");
 		pkg = JSON.parse(raw);
 	} catch {
+		logger.warn({
+			repoRoot,
+			reason: "could not read package.json"
+		}, "sync readme: done");
 		return {
 			status: "fail",
 			updated: false,
@@ -5103,6 +5313,10 @@ async function runSyncReadme(input) {
 	const updated = await updateReadme(repoRoot, generateInstallBlock(pkg), markerSections, dryRun, readFileFn, writeFileFn);
 	if (!updated) {
 		print(style.warn("README.md not found or has no writable location for installation block"));
+		logger.warn({
+			repoRoot,
+			reason: "README.md not found / no marker block"
+		}, "sync readme: done");
 		return {
 			status: "fail",
 			updated: false,
@@ -5111,8 +5325,14 @@ async function runSyncReadme(input) {
 	}
 	if (description) await updateIndexMdxDescription(repoRoot, description, dryRun, readFileFn, writeFileFn);
 	print(dryRun ? style.hint("  would update README.md") : style.success("  updated README.md"));
+	const status = dryRun ? "dry-run" : "ok";
+	logger.info({
+		repoRoot,
+		status,
+		updated
+	}, "sync readme: done");
 	return {
-		status: dryRun ? "dry-run" : "ok",
+		status,
 		updated
 	};
 }
@@ -6217,19 +6437,38 @@ function defaultWalkFiles(dir) {
 }
 async function runUpgradeNode(input) {
 	const print = input.print ?? ((line) => console.log(line));
+	const logger = input.logger ?? getLogger();
 	const cwd = input.cwd ?? process.cwd();
 	const { to, dryRun = false, extra = [] } = input;
 	const _readFile = input.readFile ?? ((p) => readFileSync(p, "utf8"));
 	const _writeFile = input.writeFile ?? ((p, c) => writeFileSync(p, c));
 	const _walkFiles = input.walkFiles ?? defaultWalkFiles;
 	const from = input.from ?? detectFrom(cwd, _readFile);
-	if (from === null) return {
-		status: "fail",
-		updated: [],
-		message: "could not detect current Node version — pass --from <major>"
-	};
+	if (from === null) {
+		const message = "could not detect current Node version — pass --from <major>";
+		logger.warn({
+			to,
+			reason: message
+		}, "upgrade node: done");
+		return {
+			status: "fail",
+			updated: [],
+			message
+		};
+	}
+	logger.info({
+		from,
+		to,
+		dryRun: dryRun || void 0
+	}, "upgrade node: start");
 	if (from === to) {
 		print(`Already at Node.js ${to} — nothing to do.`);
+		logger.info({
+			from,
+			to,
+			updated: 0,
+			status: "ok"
+		}, "upgrade node: done");
 		return {
 			status: "ok",
 			updated: []
@@ -6253,11 +6492,23 @@ async function runUpgradeNode(input) {
 		const rel = abs.startsWith(cwd + "/") ? abs.slice(cwd.length + 1) : abs;
 		if (!dryRun) _writeFile(abs, patched);
 		print(`  ${dryRun ? "~" : "✓"} ${rel}`);
+		logger.debug({
+			file: rel,
+			from,
+			to
+		}, "upgrade node: patched");
 		updated.push(rel);
 	}
 	if (updated.length === 0) print(`  · no files contained Node.js ${from} pins`);
+	const status = dryRun ? "dry-run" : "ok";
+	logger.info({
+		from,
+		to,
+		updated: updated.length,
+		status
+	}, "upgrade node: done");
 	return {
-		status: dryRun ? "dry-run" : "ok",
+		status,
 		updated
 	};
 }