@theholocron/cli 5.0.0-alpha.125 → 5.0.0-alpha.127

package/README.md

@@ -513,7 +513,16 @@ Axiom shipping activates when a token (`HOLOCRON_AXIOM_TOKEN` / `AXIOM_TOKEN`
 → OS keyring `axiom.<org>` → `axiom`) **and** a dataset
 (`HOLOCRON_AXIOM_DATASET` / `AXIOM_DATASET` → `log.axiom.dataset` in
 `holocron.config`) both resolve; env vars win. The token is never read from a
-config file. See the [logging guide](https://docs.theholocron.dev/holocron/logging/).
+config file.
+
+The dataset side of that resolution is **execution-context-aware** (ADR-0012):
+a `global`-context command (`clone`, `new`, `auth set`, `upgrade node`, `plugin
+create`, …) always ships to holocron's own dataset regardless of `$PWD` — it
+isn't "about" any repo, so routing it through whichever repo's `.envrc`
+happens to be active would be wrong. `repo-aware` / `workspace` commands
+(`doctor`, `deploy`, `sync`, …) keep the env-var/config chain above, so a
+per-repo `HOLOCRON_AXIOM_DATASET` — e.g. via a `.envrc` + `direnv` — separates
+each consuming repo's logs. See the [logging guide](https://docs.theholocron.dev/holocron/logging/).
 
 ### Telemetry
 

package/dist/cli.mjs

@@ -303,6 +303,63 @@ function resolveConfig(raw) {
 	};
 }
 //#endregion
+//#region src/commands/contexts.ts
+/**
+* Command → context. Keys are the command name as it lands in yargs'
+* `argv._` — the full path for sub-commands (`"auth set"`, `"upgrade
+* node"`), the bare verb otherwise.
+*
+* - **`global`** — needs nothing but the CLI binary. Works anywhere.
+* - **`repo-aware`** — reads `./holocron.config` + `./package.json`
+*   relative to cwd, but never touches the plugin loader.
+* - **`workspace`** — needs the configured providers' plugin packages to
+*   resolve (devDeps in a repo, or `pnpm exec`).
+*/
+const COMMAND_CONTEXTS = {
+	clone: "global",
+	new: "global",
+	"upgrade node": "global",
+	"upgrade deps": "global",
+	"plugin create": "global",
+	"auth set": "global",
+	"auth unset": "global",
+	"auth list": "global",
+	"auth check": "global",
+	"bump-versions": "global",
+	publish: "global",
+	"skills install": "global",
+	"skills remove": "global",
+	"skills update": "global",
+	"lint commit-msg": "global",
+	run: "repo-aware",
+	ci: "repo-aware",
+	"deploy-on-release": "repo-aware",
+	"config show": "repo-aware",
+	"sync-readme": "repo-aware",
+	doctor: "workspace",
+	setup: "workspace",
+	"secret set": "workspace",
+	"secrets sync": "workspace",
+	deploy: "workspace",
+	"cleanup-preview": "workspace",
+	sync: "workspace",
+	"sync-github": "workspace"
+};
+/**
+* The context for a command name from `argv._`. Falls back to the leading
+* verb (`"auth foo"` → `"auth"`) and finally `undefined` for a name the
+* map doesn't know — callers treat unknown as "don't guard".
+*/
+function contextForCommand(name) {
+	const map = COMMAND_CONTEXTS;
+	if (map[name]) return map[name];
+	return map[name.split(" ")[0] ?? ""];
+}
+/** Command names in a given context, in registration order. */
+function commandsInContext(context) {
+	return Object.entries(COMMAND_CONTEXTS).filter(([, c]) => c === context).map(([name]) => name);
+}
+//#endregion
 //#region src/ui/style.ts
 const style = {
 	success: (msg) => `${chalk.green("✓")} ${msg}`,
@@ -318,6 +375,16 @@ const style = {
 //#endregion
 //#region src/logger.ts
 /**
+* Dataset for `global`-context commands (`clone`, `auth set`, `upgrade
+* node`, …) — ADR-0012. These commands aren't "about" any repo, so their
+* logs must never depend on `$PWD` or which repo's `.envrc` happens to be
+* active; they always ship to holocron's own dataset instead of whatever
+* `HOLOCRON_AXIOM_DATASET` resolves to locally. Mirrors
+* `telemetry/resolve.ts`'s `FALLBACK_DSN` — a holocron-owned default, not a
+* per-repo override.
+*/
+const GLOBAL_AXIOM_DATASET = "holocron-global";
+/**
 * Resolve the explicit level to hand to `createLogger`, in priority order:
 *
 * 1. `--log <level>`           2. `--verbose` → `"debug"`   3. `--quiet` → `"error"`
@@ -356,20 +423,29 @@ let rootLevel;
 let rootCommand;
 let rootAxiomKey;
 /**
-* Resolve Axiom credentials for the CLI. Env vars win — same contract as
-* `@theholocron/observability`'s `resolveAxiomFromEnv`. Failing that, the CLI-only
-* bridge pairs the OS-keyring token (`axiom.<org>` then bare `axiom`) with a
-* dataset from `HOLOCRON_AXIOM_DATASET` / `AXIOM_DATASET` or
-* `holocron.config` `log.axiom.dataset`. Returns `undefined` unless both a
-* token and a dataset are found.
+* Resolve Axiom credentials for the CLI.
+*
+* A `global`-context command (ADR-0012) always resolves to
+* {@link GLOBAL_AXIOM_DATASET}, ignoring `HOLOCRON_AXIOM_DATASET` /
+* `AXIOM_DATASET` / `holocron.config` `log.axiom.dataset` entirely — it
+* isn't "about" any repo, so the active directory's dataset is never the
+* right answer. Everything else keeps the existing chain: env vars win
+* (same contract as `@theholocron/observability`'s `resolveAxiomFromEnv`),
+* falling back to the CLI-only bridge that pairs the OS-keyring token
+* (`axiom.<org>` then bare `axiom`) with a dataset from
+* `HOLOCRON_AXIOM_DATASET` / `AXIOM_DATASET` or `log.axiom.dataset`.
+* Returns `undefined` unless both a token and a dataset are found.
 */
 function resolveCliAxiom(opts) {
-	const fromEnv = resolveAxiomFromEnv();
-	if (fromEnv) return fromEnv;
-	const dataset = env.get("HOLOCRON_AXIOM_DATASET") || env.get("AXIOM_DATASET") || opts.configAxiomDataset;
+	const isGlobal = contextForCommand(opts.command ?? rootCommand ?? "") === "global";
+	if (!isGlobal) {
+		const fromEnv = resolveAxiomFromEnv();
+		if (fromEnv) return fromEnv;
+	}
+	const dataset = isGlobal ? GLOBAL_AXIOM_DATASET : env.get("HOLOCRON_AXIOM_DATASET") || env.get("AXIOM_DATASET") || opts.configAxiomDataset;
 	if (!dataset) return void 0;
 	const org = opts.org ?? env.get("HOLOCRON_ORG");
-	const token = (org ? getToken(`axiom.${org}`) : null) ?? getToken("axiom");
+	const token = env.get("HOLOCRON_AXIOM_TOKEN") || env.get("AXIOM_TOKEN") || (org ? getToken(`axiom.${org}`) : null) || getToken("axiom");
 	return token ? {
 		dataset,
 		token
@@ -1337,53 +1413,6 @@ async function runClone(input) {
 	};
 }
 //#endregion
-//#region src/commands/contexts.ts
-/**
-* Command → context. Keys are the command name as it lands in yargs'
-* `argv._` — the full path for sub-commands (`"auth set"`, `"upgrade
-* node"`), the bare verb otherwise.
-*
-* - **`global`** — needs nothing but the CLI binary. Works anywhere.
-* - **`repo-aware`** — reads `./holocron.config` + `./package.json`
-*   relative to cwd, but never touches the plugin loader.
-* - **`workspace`** — needs the configured providers' plugin packages to
-*   resolve (devDeps in a repo, or `pnpm exec`).
-*/
-const COMMAND_CONTEXTS = {
-	clone: "global",
-	new: "global",
-	"upgrade node": "global",
-	"upgrade deps": "global",
-	"plugin create": "global",
-	"auth set": "global",
-	"auth unset": "global",
-	"auth list": "global",
-	"auth check": "global",
-	"bump-versions": "global",
-	publish: "global",
-	"skills install": "global",
-	"skills remove": "global",
-	"skills update": "global",
-	"lint commit-msg": "global",
-	run: "repo-aware",
-	ci: "repo-aware",
-	"deploy-on-release": "repo-aware",
-	"config show": "repo-aware",
-	"sync-readme": "repo-aware",
-	doctor: "workspace",
-	setup: "workspace",
-	"secret set": "workspace",
-	"secrets sync": "workspace",
-	deploy: "workspace",
-	"cleanup-preview": "workspace",
-	sync: "workspace",
-	"sync-github": "workspace"
-};
-/** Command names in a given context, in registration order. */
-function commandsInContext(context) {
-	return Object.entries(COMMAND_CONTEXTS).filter(([, c]) => c === context).map(([name]) => name);
-}
-//#endregion
 //#region src/commands/deploy.ts
 /**
 * `holocron deploy` — trigger a deployment via the configured