@theholocron/cli 4.14.1 → 4.15.0

package/README.md

@@ -307,8 +307,8 @@ holocron auth list                # show all stored providers
 
 ## Logging
 
-Operational output goes through [`@theholocron/logger`](../logger) — separate from
-the user-facing `print` surface. Global flags:
+Operational output goes through `@theholocron/observability/logger` — separate
+from the user-facing `print` surface. Global flags:
 
 ```sh
 holocron doctor --verbose   # log level → debug (full structured output)
@@ -356,9 +356,11 @@ export default defineConfig({
 });
 ```
 
-Each SDK sits behind a Holocron-owned interface — `ErrorSink` (Sentry) /
-`AnalyticsSink` (PostHog) in `src/telemetry/sinks.ts`; `@sentry/node` and
-`posthog-node` are imported only from their adapter modules. See the
+Each SDK sits behind an interface from `@theholocron/observability` —
+`ErrorSink` (Sentry) / `AnalyticsSink` (PostHog); the adapters, and the only
+`@sentry/node` / `posthog-node` imports, live in that package. `telemetry.ts`
+holds the orchestration + the Holocron-specific credential resolution
+(`telemetry/resolve.ts`). See the
 [telemetry guide](https://docs.theholocron.dev/holocron/telemetry/).
 
 ## What's in here
@@ -370,8 +372,8 @@ Each SDK sits behind a Holocron-owned interface — `ErrorSink` (Sentry) /
 - `src/config/load-config.ts` — `loadConfig` — reads `holocron.config.*`
   (file discovery via [`@theholocron/datapad`](../datapad))
 - `src/define-config.ts` — `defineConfig` typed pass-through
-- `src/logger.ts` — CLI-side `@theholocron/logger` wiring (`buildCliLogger`,
-  `resolveLogLevel`)
+- `src/logger.ts` — CLI-side `@theholocron/observability/logger` wiring
+  (`buildCliLogger`, `resolveLogLevel`)
 - `src/loader.ts` — `PluginLoader` — dynamic-imports plugins, resolves
   capability config packages, builds the capability registry
 - `src/cli.ts` — yargs entry, dispatches subcommands. `holocron run` / `ci` are

package/dist/cli.mjs

@@ -11,7 +11,7 @@ import { AuthError, ProviderApiError, ProviderApiError as ProviderApiError$1, cr
 import { createEnvLookup } from "@theholocron/env-utils";
 import { Entry, findCredentials } from "@napi-rs/keyring";
 import { pathToFileURL } from "node:url";
-import { createLogger, parseLogLevel, resolveAxiomFromEnv } from "@theholocron/logger";
+import { createLogger, parseLogLevel, resolveAxiomFromEnv } from "@theholocron/observability/logger";
 import ora from "ora";
 import chalk from "chalk";
 import { execFile, execFileSync, spawnSync } from "node:child_process";
@@ -21,8 +21,9 @@ import { createHash } from "node:crypto";
 import { generateReadme } from "@theholocron/components-doc/markdown";
 import { getClients, getConfigs, getDocs, getPlugins, getSkills, getThemes, getUtils } from "@theholocron/registry-doc";
 import { createGitHubClient } from "@theholocron/github-client";
-import { PostHog } from "posthog-node";
-import * as Sentry from "@sentry/node";
+import { PostHogSink } from "@theholocron/observability/analytics";
+import { NoopAnalyticsSink, NoopErrorSink, redactObject } from "@theholocron/observability/core";
+import { SentrySink } from "@theholocron/observability/errors";
 import { promisify } from "node:util";
 import { ConfigFileError, loadConfigFile } from "@theholocron/datapad";
 //#region src/env.ts
@@ -299,13 +300,6 @@ function resolveConfig(raw) {
 //#endregion
 //#region src/logger.ts
 /**
-* CLI-side wiring for `@theholocron/logger`.
-*
-* `logger` is the operational-output channel — internal state, debug
-* traces, errors, structured context that routes to Axiom. It runs in
-* parallel to `print` (user-facing UX output) and does not replace it.
-*/
-/**
 * Resolve the explicit level to hand to `createLogger`, in priority order:
 *
 * 1. `--verbose` → `"debug"`   2. `--quiet` → `"error"`
@@ -327,7 +321,7 @@ let rootCommand;
 let rootAxiomKey;
 /**
 * Resolve Axiom credentials for the CLI. Env vars win — same contract as
-* `@theholocron/logger`'s `resolveAxiomFromEnv`. Failing that, the CLI-only
+* `@theholocron/observability`'s `resolveAxiomFromEnv`. Failing that, the CLI-only
 * bridge pairs the OS-keyring token (`axiom.<org>` then bare `axiom`) with a
 * dataset from `HOLOCRON_AXIOM_DATASET` / `AXIOM_DATASET` or
 * `holocron.config` `log.axiom.dataset`. Returns `undefined` unless both a
@@ -5821,58 +5815,6 @@ async function writeWorkflowFile(repoRoot, filename, content) {
 	await writeFile(join(dir, filename), content, "utf8");
 }
 //#endregion
-//#region src/telemetry/posthog-sink.ts
-/**
-* `PostHogSink` — the **only** `posthog-node` call site. A portable
-* `AnalyticsSink` adapter: usage, adoption, retention. It reads no environment
-* and ships no credentials — the constructor takes a resolved `key` + `host`;
-* the caller (the CLI's `telemetry.ts`, via `telemetry/resolve.ts`) owns the
-* env chain and the fallback. An empty `key` is the caller's signal to install
-* a `NoopAnalyticsSink` instead — it is never passed here.
-*
-* Destined for `@theholocron/observability/analytics` (#635).
-*/
-var PostHogSink = class {
-	#client;
-	constructor(config) {
-		this.#client = new PostHog(config.key, { host: config.host });
-	}
-	identify(distinctId, props) {
-		this.#client.identify({
-			distinctId,
-			properties: props
-		});
-	}
-	capture(distinctId, event, props) {
-		this.#client.capture({
-			distinctId,
-			event,
-			properties: props
-		});
-	}
-	async shutdown() {
-		await this.#client.shutdown();
-	}
-};
-//#endregion
-//#region src/telemetry/redact.ts
-/**
-* Token-shape scrubbing for telemetry payloads — a raw token never leaves the
-* process, even when a value is controlled. Regex-on-the-serialised-string
-* (matches a token shape *anywhere*), distinct from `@theholocron/logger`'s
-* field-path redaction. Shared by {@link scrubError} (Sentry `beforeSend`) and
-* the PostHog `event()` path.
-*/
-const TOKEN_RE = /\b(ghp_|ghs_|glpat-|xoxb-|xoxp-|npm_|sk-|[A-Z][A-Z0-9_]{2,}_TOKEN[=\s])[^\s"]*/g;
-/** Replace token-shaped substrings in a string with `[REDACTED]`. */
-function redact(raw) {
-	return raw.replace(TOKEN_RE, "[REDACTED]");
-}
-/** Deep-scrub every string in an object by round-tripping through {@link redact}. */
-function redactObject(value) {
-	return JSON.parse(redact(JSON.stringify(value)));
-}
-//#endregion
 //#region src/telemetry/resolve.ts
 /**
 * Holocron-specific credential resolution for the telemetry sinks — the env
@@ -5908,76 +5850,16 @@ function resolvePostHogHost() {
 	return env.get("HOLOCRON_POSTHOG_HOST") ?? env.get("POSTHOG_HOST") ?? DEFAULT_POSTHOG_HOST;
 }
 //#endregion
-//#region src/telemetry/sentry-sink.ts
-/** `beforeSend` — token-shaped strings never leave the process. */
-function scrubError(event, _hint) {
-	return redactObject(event);
-}
-var SentrySink = class {
-	init(ctx) {
-		Sentry.init({
-			dsn: ctx.dsn,
-			release: ctx.release,
-			environment: ctx.environment,
-			tracesSampleRate: 1,
-			beforeSend: scrubError
-		});
-		Sentry.startSession();
-		for (const [key, value] of Object.entries(ctx.tags)) Sentry.setTag(key, value);
-	}
-	startSpan(name) {
-		Sentry.setTag("command", name);
-		const span = Sentry.startInactiveSpan({
-			name,
-			op: "holocron.command",
-			forceTransaction: true
-		});
-		return {
-			setStatus: (ok) => span.setStatus({ code: ok ? 1 : 2 }),
-			end: () => span.end()
-		};
-	}
-	captureException(err) {
-		Sentry.captureException(err);
-	}
-	endSession() {
-		Sentry.endSession();
-	}
-	async flush() {
-		await Sentry.close(2e3);
-	}
-};
-//#endregion
-//#region src/telemetry/sinks.ts
-/**
-* The disabled path made explicit — one shared no-op instead of a scatter of
-* `if (!enabled) return` guards. Used when telemetry is opted out
-* (`HOLOCRON_TELEMETRY=false`, `config.telemetry.enabled: false`) or no
-* credentials resolve.
-*/
-var NoopErrorSink = class {
-	init() {}
-	startSpan() {}
-	captureException() {}
-	endSession() {}
-	async flush() {}
-};
-/** @see NoopErrorSink */
-var NoopAnalyticsSink = class {
-	identify() {}
-	capture() {}
-	async shutdown() {}
-};
-//#endregion
 //#region src/telemetry.ts
 /**
 * CLI self-telemetry orchestration — errors (Sentry), usage analytics (PostHog).
 *
-* This module holds *no* vendor SDK import. Each concern sits behind a
-* Holocron-owned interface ({@link ErrorSink} / {@link AnalyticsSink}); the
-* concrete `SentrySink` / `PostHogSink` are the only `@sentry/node` /
-* `posthog-node` call sites, and a `Noop*Sink` is installed when telemetry is
-* off. Same seam `@theholocron/logger` uses for Pino.
+* This module holds *no* vendor SDK import. Each concern sits behind an
+* interface from `@theholocron/observability` ({@link ErrorSink} /
+* {@link AnalyticsSink}); the `SentrySink` / `PostHogSink` adapters there are
+* the only `@sentry/node` / `posthog-node` call sites, and a `Noop*Sink` is
+* installed when telemetry is off. Same seam the package's `Logger` uses for
+* Pino.
 *
 * Activation is env-var + shipped-fallback, resolved here (`telemetry/resolve.ts`)
 * and passed to the sink — the adapters read no environment. The single kill