@theholocron/cli 3.61.0 → 3.62.1

package/dist/cli.mjs

@@ -9,9 +9,9 @@ import { AuthError, ProviderApiError, ProviderApiError as ProviderApiError$1, cr
 import { createEnvLookup } from "@theholocron/env-utils";
 import { Entry, findCredentials } from "@napi-rs/keyring";
 import { pathToFileURL } from "node:url";
+import { createLogger, parseLogLevel, resolveAxiomFromEnv } from "@theholocron/logger";
 import ora from "ora";
 import chalk from "chalk";
-import { createLogger, parseLogLevel, resolveAxiomFromEnv } from "@theholocron/logger";
 import { execFile, execFileSync, spawnSync } from "node:child_process";
 import { homedir } from "node:os";
 import { access, copyFile, mkdir, readFile, readdir, rm, stat, symlink, unlink, writeFile } from "node:fs/promises";
@@ -288,6 +288,94 @@ function resolveConfig(raw) {
 	};
 }
 //#endregion
+//#region src/logger.ts
+/**
+* CLI-side wiring for `@theholocron/logger`.
+*
+* `logger` is the operational-output channel — internal state, debug
+* traces, errors, structured context that routes to Axiom. It runs in
+* parallel to `print` (user-facing UX output) and does not replace it.
+*/
+/**
+* Resolve the explicit level to hand to `createLogger`, in priority order:
+*
+* 1. `--verbose` → `"debug"`   2. `--quiet` → `"error"`
+* 3. `HOLOCRON_LOG_LEVEL` env var
+* 4. `holocron.config` `log.level` (`configLevel`)
+*
+* Returns `undefined` when nothing applies — `createLogger` then defaults
+* to `"info"`. Resolving the full chain here (rather than passing
+* `configLevel` straight through) keeps config below the env var.
+*/
+function resolveLogLevel(argv, configLevel) {
+	if (argv.verbose) return "debug";
+	if (argv.quiet) return "error";
+	return parseLogLevel(env.get("HOLOCRON_LOG_LEVEL")) ?? configLevel;
+}
+let root;
+let rootLevel;
+let rootCommand;
+let rootAxiomKey;
+/**
+* Resolve Axiom credentials for the CLI. Env vars win — same contract as
+* `@theholocron/logger`'s `resolveAxiomFromEnv`. Failing that, the CLI-only
+* bridge pairs the OS-keyring token (`axiom.<org>` then bare `axiom`) with a
+* dataset from `HOLOCRON_AXIOM_DATASET` / `AXIOM_DATASET` or
+* `holocron.config` `log.axiom.dataset`. Returns `undefined` unless both a
+* token and a dataset are found.
+*/
+function resolveCliAxiom(opts) {
+	const fromEnv = resolveAxiomFromEnv();
+	if (fromEnv) return fromEnv;
+	const dataset = env.get("HOLOCRON_AXIOM_DATASET") || env.get("AXIOM_DATASET") || opts.configAxiomDataset;
+	if (!dataset) return void 0;
+	const org = opts.org ?? env.get("HOLOCRON_ORG");
+	const token = (org ? getToken(`axiom.${org}`) : null) ?? getToken("axiom");
+	return token ? {
+		dataset,
+		token
+	} : void 0;
+}
+/**
+* The process-wide root logger. Built once (from `cli.ts`'s middleware,
+* with the command name + flags + env). Rebuilt at most once more when a
+* command's handler supplies `holocron.config` context the flag/env-only
+* first pass could not have known — `log.level` (unless `--verbose` /
+* `--quiet` already fixed it) or `log.axiom.dataset` + the resolved org
+* for a keyring-backed Axiom transport. That rebuild generates a fresh
+* `runId`, which is harmless: nothing logs between the middleware and the
+* handler.
+*/
+function buildCliLogger(argv, opts = {}) {
+	const { command, configLevel } = opts;
+	if (command) rootCommand = command;
+	const level = resolveLogLevel(argv, configLevel);
+	const axiom = resolveCliAxiom(opts);
+	const axiomKey = axiom?.dataset;
+	const rebuildForConfig = configLevel !== void 0 && level !== rootLevel && !argv.verbose && !argv.quiet;
+	if (!root || rebuildForConfig || axiomKey !== void 0 && axiomKey !== rootAxiomKey) {
+		const built = createLogger({
+			...level ? { level } : {},
+			...axiom ? { axiom } : {}
+		});
+		root = {
+			logger: rootCommand ? built.logger.child({ command: rootCommand }) : built.logger,
+			runId: built.runId
+		};
+		rootLevel = level;
+		rootAxiomKey = axiomKey;
+	}
+	return root;
+}
+/** Lazily-memoized `Logger` for module-level call sites with no `argv` in scope. */
+function getLogger() {
+	return (root ??= createLogger()).logger;
+}
+/** The current root logger's correlation id, if a root has been built. */
+function getRunId() {
+	return root?.runId;
+}
+//#endregion
 //#region src/ui/progress.ts
 /**
 * Runs `fn`, showing an ora spinner for its duration in TTY environments.
@@ -356,6 +444,7 @@ function resolveAuthSetToken(input) {
 }
 async function runAuthSet(input) {
 	const print = input.print ?? ((l) => console.log(l));
+	const logger = input.logger ?? getLogger();
 	const importer = input.importer ?? defaultImporter$1;
 	const { provider } = input;
 	const keyringKey = input.org ? `${provider}.${input.org}` : provider;
@@ -374,6 +463,11 @@ async function runAuthSet(input) {
 			const hint = await tryLoadHint(importer, packageName);
 			if (hint) print(style.hint(`  hint: ${hint}`));
 		}
+		logger.warn({
+			provider,
+			keyringKey,
+			reason: "no token supplied"
+		}, `auth set: ${keyringKey}`);
 		return {
 			status: "fail",
 			message: "no token supplied"
@@ -387,6 +481,12 @@ async function runAuthSet(input) {
 			if (!verified.ok) {
 				print(style.fail(`token rejected by ${provider}: ${verified.message}`));
 				if (module.AUTH_HINT) print(style.hint(`  hint: ${module.AUTH_HINT}`));
+				logger.warn({
+					provider,
+					keyringKey,
+					verified: false,
+					reason: verified.message
+				}, `auth set: ${keyringKey}`);
 				return {
 					status: "fail",
 					message: verified.message
@@ -401,12 +501,24 @@ async function runAuthSet(input) {
 	}
 	if (!setToken(keyringKey, token)) {
 		print(style.fail(`keyring unavailable — token not stored. Use env vars instead.`));
+		logger.warn({
+			provider,
+			keyringKey,
+			reason: "keyring unavailable"
+		}, `auth set: ${keyringKey}`);
 		return {
 			status: "fail",
 			message: "keyring unavailable"
 		};
 	}
 	print(style.success(`stored ${keyringKey} token${subject ? ` (${subject})` : ""}`));
+	logger.info({
+		provider,
+		keyringKey,
+		verified: subject !== void 0,
+		...subject ? { subject } : {},
+		status: "ok"
+	}, `auth set: ${keyringKey}`);
 	return {
 		status: "ok",
 		...subject ? { message: subject } : {}
@@ -414,11 +526,20 @@ async function runAuthSet(input) {
 }
 function runAuthUnset(input) {
 	const print = input.print ?? ((l) => console.log(l));
+	const logger = input.logger ?? getLogger();
 	if (deleteToken(input.provider)) {
 		print(style.success(`removed ${input.provider} token`));
+		logger.info({
+			provider: input.provider,
+			status: "ok"
+		}, `auth unset: ${input.provider}`);
 		return { status: "ok" };
 	}
 	print(style.dim(`no stored token for ${input.provider}`));
+	logger.info({
+		provider: input.provider,
+		status: "skip"
+	}, `auth unset: ${input.provider}`);
 	return {
 		status: "skip",
 		message: "nothing to remove"
@@ -426,12 +547,19 @@ function runAuthUnset(input) {
 }
 async function runAuthCheck(input) {
 	const print = input.print ?? ((l) => console.log(l));
+	const logger = input.logger ?? getLogger();
 	const importer = input.importer ?? defaultImporter$1;
 	const { provider } = input;
 	const keyringKey = input.org ? `${provider}.${input.org}` : provider;
 	const token = getToken(keyringKey);
 	if (!token) {
 		print(style.dim(`no stored token for ${keyringKey}`));
+		logger.info({
+			provider,
+			keyringKey,
+			status: "skip",
+			reason: "no stored token"
+		}, `auth check: ${keyringKey}`);
 		return {
 			status: "skip",
 			message: "no stored token"
@@ -458,6 +586,13 @@ async function runAuthCheck(input) {
 		const verified = input.showSpinner !== false ? await withSpinner(`Verifying ${keyringKey} token…`, verify) : await verify();
 		if (verified.ok) {
 			print(style.success(`${keyringKey}: ok — ${verified.subject}`));
+			logger.info({
+				provider,
+				keyringKey,
+				verified: true,
+				subject: verified.subject,
+				status: "ok"
+			}, `auth check: ${keyringKey}`);
 			return {
 				status: "ok",
 				message: verified.subject
@@ -465,6 +600,13 @@ async function runAuthCheck(input) {
 		}
 		print(style.fail(`${keyringKey}: rejected — ${verified.message}`));
 		if (module.AUTH_HINT) print(style.hint(`  hint: ${module.AUTH_HINT}`));
+		logger.warn({
+			provider,
+			keyringKey,
+			verified: false,
+			reason: verified.message,
+			status: "fail"
+		}, `auth check: ${keyringKey}`);
 		return {
 			status: "fail",
 			message: verified.message
@@ -472,6 +614,12 @@ async function runAuthCheck(input) {
 	} catch (err) {
 		const msg = err instanceof Error ? err.message : String(err);
 		print(style.fail(`${keyringKey}: cannot verify — ${msg}`));
+		logger.warn({
+			provider,
+			keyringKey,
+			reason: msg,
+			status: "fail"
+		}, `auth check: ${keyringKey}`);
 		return {
 			status: "fail",
 			message: msg
@@ -480,28 +628,42 @@ async function runAuthCheck(input) {
 }
 async function runAuthList(input = {}) {
 	const print = input.print ?? ((l) => console.log(l));
+	const logger = input.logger ?? getLogger();
 	const importer = input.importer ?? defaultImporter$1;
 	const providers = listStoredProviders();
 	if (providers.length === 0) {
 		print(style.dim("no stored tokens."));
 		print(style.hint("run: holocron auth set <provider> <token>"));
+		logger.info({ providers: 0 }, "auth list: done");
 		return {
 			status: "ok",
 			message: "none"
 		};
 	}
+	let ok = 0;
+	let fail = 0;
 	for (const provider of providers.sort()) {
 		const check = await runAuthCheck({
 			provider,
 			importer,
 			print: () => {},
+			logger,
 			showSpinner: false
 		});
 		const label = `${provider}${check.message ? ` — ${check.message}` : ""}`;
-		if (check.status === "ok") print(`  ${style.success(label)}`);
-		else if (check.status === "fail") print(`  ${style.fail(label)}`);
-		else print(`  ${style.dim(`· ${label}`)}`);
+		if (check.status === "ok") {
+			ok += 1;
+			print(`  ${style.success(label)}`);
+		} else if (check.status === "fail") {
+			fail += 1;
+			print(`  ${style.fail(label)}`);
+		} else print(`  ${style.dim(`· ${label}`)}`);
 	}
+	logger.info({
+		providers: providers.length,
+		ok,
+		fail
+	}, "auth list: done");
 	return { status: "ok" };
 }
 async function tryLoadHint(importer, packageName) {
@@ -512,94 +674,6 @@ async function tryLoadHint(importer, packageName) {
 	}
 }
 //#endregion
-//#region src/logger.ts
-/**
-* CLI-side wiring for `@theholocron/logger`.
-*
-* `logger` is the operational-output channel — internal state, debug
-* traces, errors, structured context that routes to Axiom. It runs in
-* parallel to `print` (user-facing UX output) and does not replace it.
-*/
-/**
-* Resolve the explicit level to hand to `createLogger`, in priority order:
-*
-* 1. `--verbose` → `"debug"`   2. `--quiet` → `"error"`
-* 3. `HOLOCRON_LOG_LEVEL` env var
-* 4. `holocron.config` `log.level` (`configLevel`)
-*
-* Returns `undefined` when nothing applies — `createLogger` then defaults
-* to `"info"`. Resolving the full chain here (rather than passing
-* `configLevel` straight through) keeps config below the env var.
-*/
-function resolveLogLevel(argv, configLevel) {
-	if (argv.verbose) return "debug";
-	if (argv.quiet) return "error";
-	return parseLogLevel(env.get("HOLOCRON_LOG_LEVEL")) ?? configLevel;
-}
-let root;
-let rootLevel;
-let rootCommand;
-let rootAxiomKey;
-/**
-* Resolve Axiom credentials for the CLI. Env vars win — same contract as
-* `@theholocron/logger`'s `resolveAxiomFromEnv`. Failing that, the CLI-only
-* bridge pairs the OS-keyring token (`axiom.<org>` then bare `axiom`) with a
-* dataset from `HOLOCRON_AXIOM_DATASET` / `AXIOM_DATASET` or
-* `holocron.config` `log.axiom.dataset`. Returns `undefined` unless both a
-* token and a dataset are found.
-*/
-function resolveCliAxiom(opts) {
-	const fromEnv = resolveAxiomFromEnv();
-	if (fromEnv) return fromEnv;
-	const dataset = env.get("HOLOCRON_AXIOM_DATASET") || env.get("AXIOM_DATASET") || opts.configAxiomDataset;
-	if (!dataset) return void 0;
-	const org = opts.org ?? env.get("HOLOCRON_ORG");
-	const token = (org ? getToken(`axiom.${org}`) : null) ?? getToken("axiom");
-	return token ? {
-		dataset,
-		token
-	} : void 0;
-}
-/**
-* The process-wide root logger. Built once (from `cli.ts`'s middleware,
-* with the command name + flags + env). Rebuilt at most once more when a
-* command's handler supplies `holocron.config` context the flag/env-only
-* first pass could not have known — `log.level` (unless `--verbose` /
-* `--quiet` already fixed it) or `log.axiom.dataset` + the resolved org
-* for a keyring-backed Axiom transport. That rebuild generates a fresh
-* `runId`, which is harmless: nothing logs between the middleware and the
-* handler.
-*/
-function buildCliLogger(argv, opts = {}) {
-	const { command, configLevel } = opts;
-	if (command) rootCommand = command;
-	const level = resolveLogLevel(argv, configLevel);
-	const axiom = resolveCliAxiom(opts);
-	const axiomKey = axiom?.dataset;
-	const rebuildForConfig = configLevel !== void 0 && level !== rootLevel && !argv.verbose && !argv.quiet;
-	if (!root || rebuildForConfig || axiomKey !== void 0 && axiomKey !== rootAxiomKey) {
-		const built = createLogger({
-			...level ? { level } : {},
-			...axiom ? { axiom } : {}
-		});
-		root = {
-			logger: rootCommand ? built.logger.child({ command: rootCommand }) : built.logger,
-			runId: built.runId
-		};
-		rootLevel = level;
-		rootAxiomKey = axiomKey;
-	}
-	return root;
-}
-/** Lazily-memoized `Logger` for module-level call sites with no `argv` in scope. */
-function getLogger() {
-	return (root ??= createLogger()).logger;
-}
-/** The current root logger's correlation id, if a root has been built. */
-function getRunId() {
-	return root?.runId;
-}
-//#endregion
 //#region src/plugin/loader.ts
 /**
 * `PluginLoader` — loads provider plugins per the resolved config and