@theholocron/cli 5.0.0-alpha.13 → 5.0.0-alpha.133

package/dist/index.mjs

@@ -2,9 +2,11 @@ import { CARDINALITY, ProviderApiError, REQUIRED_CAPABILITIES, WebhookVerificati
 import { AuthError, createResolveToken as createResolveToken$1, createRestClient } from "@theholocron/http-client";
 import { createEnvLookup } from "@theholocron/env-utils";
 import { Entry, findCredentials } from "@napi-rs/keyring";
-import { execFile } from "node:child_process";
 import { readFile } from "node:fs/promises";
 import { basename, dirname, join } from "node:path";
+import load from "@commitlint/load";
+import lint from "@commitlint/lint";
+import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { loadTasksConfig } from "@theholocron/astromech/config";
 import { ConfigFileError, ConfigFileError as ConfigFileError$1, loadConfigFile } from "@theholocron/datapad";
@@ -113,6 +115,170 @@ function createFeatureResolver(config) {
 	};
 }
 //#endregion
+//#region src/commands/setup/derived-properties.ts
+/**
+* Repo archetype, in priority order:
+* 1. `*-template` repo name → `template` (independent of package shape).
+* 2. Monorepo whose primary published artifact is a CLI (some workspace
+*    package has `bin`) → `platform` — matches `holocron` itself: the CLI is
+*    the deliverable, the plugin packages are supporting infrastructure for
+*    it, not separate products.
+* 3. Monorepo with no CLI but at least one non-private workspace package →
+*    `library` — matches `clients`/`configs`/`utils`/`themes`/
+*    `observability`: a family of published packages, none of them a CLI.
+*    Checked *before* falling into the root-package branch below, because
+*    these repos' own root `package.json` is private and often carries
+*    `@theholocron/astro-config` for a docs site built from the monorepo
+*    root — without this check they'd wrongly resolve to `docs` off that
+*    root-level signal alone, when the docs site is a secondary concern of
+*    a library collection, not what the repo fundamentally is.
+* 4. Single-package repo with `package.json#bin` → `cli`.
+* 5. Docs-only site (astro/starlight present, root package private, no
+*    publishable exports) → `docs`.
+* 6. Private, non-publishable, non-docs → `app`.
+* 7. Otherwise, a single publishable package → `library`.
+*/
+function deriveProfile(input) {
+	if (/-template$/.test(input.repoName)) return "template";
+	if (input.isMonorepo) {
+		if (input.workspacePackageJsons.some((pkg) => Boolean(pkg.bin))) return "platform";
+		if (input.workspacePackageJsons.some((pkg) => pkg.private !== true)) return "library";
+	}
+	const pkg = input.rootPackageJson;
+	if (pkg?.bin) return "cli";
+	const deps = {
+		...pkg?.dependencies,
+		...pkg?.devDependencies
+	};
+	const isDocsSite = Boolean(deps["@theholocron/astro-config"] || deps["astro"]);
+	if (pkg?.private && isDocsSite) return "docs";
+	if (pkg?.private) return "app";
+	return "library";
+}
+const KNOWN_STACK_DEPS = [
+	"next",
+	"vite",
+	"astro",
+	"tsdown",
+	"rollup",
+	"webpack",
+	"storybook",
+	"vitest",
+	"playwright",
+	"turbo"
+];
+/**
+* Detected build/framework tooling — the literal "does this repo need
+* next/vite/tsdown" signal `holocron.config.ts` has no field for today
+* (framework choice isn't a config concept, unlike `providers`/`tasks`).
+* Curated table, not exhaustive by design — add to `KNOWN_STACK_DEPS` as new
+* frameworks show up rather than trying to detect anything on npm.
+*/
+function deriveStack(pkg) {
+	const deps = {
+		...pkg?.dependencies,
+		...pkg?.devDependencies
+	};
+	return KNOWN_STACK_DEPS.filter((name) => name in deps);
+}
+/** The provider capability keys actually wired in `providers: {}` — zero heuristics. */
+function deriveCapabilities(providers) {
+	return Object.keys(providers ?? {}).sort();
+}
+/**
+* `source` + `ci` are the minimal baseline every repo `holocron repo setup`
+* touches wires — every `holocron.config.ts` in this org already satisfies
+* this, so `non-compliant` here means drift (a provider manually removed
+* after setup), not an unmet aspirational policy. Deliberately not a richer
+* per-profile policy yet (e.g. "a `library` must have `deployment`") — that's
+* a Phase B (GitHub App) refinement once it can post *why* on a check run.
+*/
+const REQUIRED_BASELINE = ["source", "ci"];
+function deriveCompliance(capabilities) {
+	return REQUIRED_BASELINE.every((key) => capabilities.includes(key)) ? "compliant" : "non-compliant";
+}
+/**
+* The Phase B refinement `deriveCompliance()`'s own doc comment names —
+* *why* a repo is non-compliant, not just that it is. `[]` when compliant.
+* Same `REQUIRED_BASELINE` `deriveCompliance()` checks against — one
+* table, not two independently-maintained baselines.
+*/
+function missingCapabilities(capabilities) {
+	return REQUIRED_BASELINE.filter((key) => !capabilities.includes(key));
+}
+/**
+* Reads each workspace package's actual `package.json` content (not just
+* `readWorkspacePackages()`'s `{ slug, name, dir }` — `deriveProfile()`'s
+* `platform` detection needs `bin`, which that helper doesn't carry).
+* Missing/invalid files are skipped, matching `readWorkspacePackages()`'s
+* own soft-fail behavior.
+*/
+async function readWorkspacePackageJsons(repoRoot, workspacePackages) {
+	const results = [];
+	for (const { slug, dir = "packages" } of workspacePackages) try {
+		const raw = await readFile(join(repoRoot, dir, slug, "package.json"), "utf8");
+		results.push(JSON.parse(raw));
+	} catch {}
+	return results;
+}
+//#endregion
+//#region src/commit-lint/lint-message.ts
+/**
+* Lints one commit message string against an already-loaded commitlint
+* config. The genuinely environment-independent half of commit-message
+* linting (holocron#789) — *obtaining* a `QualifiedConfig` differs by
+* caller (Sentinel isolates itself from any ambient config since it runs
+* standalone, away from a real repo checkout; `lintCommitMsgFile` below
+* just lets cosmiconfig discover the invoking repo's own
+* `commitlint.config.*`, matching `commitlint --edit`'s own contract) —
+* but linting one message against a loaded config is identical either way.
+*
+* Real `@commitlint/lint` — the same programmatic API `@commitlint/cli`
+* itself uses internally — never a reimplementation of commitlint's rules.
+*/
+/** `parserPreset.parserOpts`, if the loaded config sets one — same lookup `@commitlint/cli`'s own `selectParserOpts()` does. */
+function selectParserOpts(parserPreset) {
+	return parserPreset?.parserOpts;
+}
+async function lintCommitMessage(message, loaded) {
+	const opts = {
+		/* istanbul ignore next -- see comment above */
+		parserOpts: selectParserOpts(loaded.parserPreset) ?? {},
+		plugins: loaded.plugins,
+		/* istanbul ignore next -- see comment above */
+		ignores: loaded.ignores ?? [],
+		defaultIgnores: loaded.defaultIgnores !== false
+	};
+	const outcome = await lint(message, loaded.rules, opts);
+	if (outcome.valid) return [];
+	return outcome.errors.map((error) => ({
+		rule: error.name,
+		message: error.message
+	}));
+}
+//#endregion
+//#region src/commit-lint/lint-commit-msg-file.ts
+/**
+* `holocron run lint commit-msg <file>` — a real programmatic replacement for
+* shelling out to `commitlint --edit "$1"` from `.husky/commit-msg`
+* (holocron#789). Matches that CLI's own contract exactly: `file` is a
+* path to the commit message being written (the arg git's `commit-msg`
+* hook passes as `$1`), no `--config` override needed — `@commitlint/load`
+* runs from `cwd` with no seed, so cosmiconfig's own normal upward search
+* discovers the invoking repo's real `commitlint.config.*` file, exactly
+* as `commitlint --edit` (no `--config` flag) already does today. Unlike
+* Sentinel's `loadIsolatedConfig()`, no isolation is needed here — this
+* runs inside a real repo checkout with a real `node_modules`, not
+* standalone on a server.
+*/
+async function lintCommitMsgFile(filePath, cwd = process.cwd()) {
+	const violations = await lintCommitMessage(await readFile(filePath, "utf8"), await load({}, { cwd }));
+	return {
+		valid: violations.length === 0,
+		violations
+	};
+}
+//#endregion
 //#region src/config/config.ts
 var ConfigError = class extends Error {
 	name = "ConfigError";
@@ -217,7 +383,8 @@ function resolveConfig(raw) {
 		docs,
 		env: raw.env,
 		log: raw.log,
-		telemetry: raw.telemetry
+		telemetry: raw.telemetry,
+		eslint: raw.eslint
 	};
 }
 //#endregion
@@ -328,14 +495,19 @@ function defineConfig(config) {
 */
 const execFileAsync = promisify(execFile);
 /**
-* Read + parse + resolve `holocron.config.*` from the given directory.
+* Read + parse + resolve `holocron.config.*` starting from the given
+* directory, walking up through ancestors to the nearest `.git` boundary
+* when `cwd` itself has no match — every command is usable from any
+* subdirectory of a repo, not only its exact root (see
+* `@theholocron/datapad`'s own doc comment for the stop conditions).
 * Throws {@link ConfigFileError} when nothing is found or a file cannot
-* be loaded, or `ConfigError` when the config is invalid.
+* be loaded, or `ConfigError` when the config fails schema checks.
 */
 async function loadConfig(cwd) {
 	const found = await loadConfigFile({
 		cwd,
-		name: "holocron"
+		name: "holocron",
+		walkUp: true
 	});
 	if (!found) throw new ConfigFileError$1(`no holocron.config.{ts,js,mjs,cjs,json} found in ${cwd}. Create one — see the README for the schema.`);
 	return {
@@ -389,4 +561,97 @@ function parseGitRemoteUrl(url) {
 	if (sshMatch) return sshMatch[1];
 }
 //#endregion
-export { AuthError, CARDINALITY, ConfigError, ConfigFileError, ProviderApiError, REQUIRED_CAPABILITIES, WebhookVerificationError, compose, createFeatureResolver, createResolveToken, createRestClient, defineConfig, deleteToken, getToken, isMulti, listStoredProviders, loadConfig, resolveConfig, resolveEntry, resolvePluginPackage, setToken };
+//#region src/editorconfig/config.ts
+/**
+* The paths editorconfig-checker skips, read from the same
+* `editorconfig-checker.json` template `holocron repo setup` writes as a repo's
+* `.editorconfig-checker.json` — so Sentinel's central editorconfig check
+* (holocron#927) excludes exactly what CI's editorconfig-checker does, from
+* one source.
+*
+* The exclusion that matters most is `\.md$` / `\.mdx$`: the generated
+* `.editorconfig` gives every file tab indentation, but
+* `@theholocron/prettier-config` formats markdown with spaces, so a README's
+* indented code example would fail one tool or the other. Markdown is left
+* to prettier and markdownlint.
+*
+* Each entry is a regular-expression source, matched against a
+* repo-relative path, as editorconfig-checker itself treats them.
+*/
+const EDITORCONFIG_CHECKER_EXCLUDE = [
+	"(^|.+/)LICENSE$",
+	"^public/.*",
+	"\\.md$",
+	"\\.mdx$"
+];
+/** `true` when `path` matches any {@link EDITORCONFIG_CHECKER_EXCLUDE} pattern. */
+function isEditorConfigExcluded(path) {
+	return EDITORCONFIG_CHECKER_EXCLUDE.some((pattern) => new RegExp(pattern).test(path));
+}
+//#endregion
+//#region src/inclusive-language/config.ts
+/**
+* The org's canonical `alex` (inclusive-language) config, as raw parsed
+* data rather than the pre-rendered file strings `createRcConfig()`/
+* `createIgnoreConfig()` produce for `holocron repo setup` to write into a
+* repo's own `.alexrc.json`/`.alexignore`.
+*
+* `.alexrc.json` is explicitly "generated by `holocron repo setup` — do not
+* edit manually" (this repo's own `AGENTS.md`) — the real source of truth
+* is this JSON file, one canonical copy, not each repo's synced one. A
+* central Sentinel check (holocron#769/#793) reads it directly rather
+* than fetching each repo's own copy via the Contents API — the same "one
+* config, not N copies" reasoning `@theholocron/commitlint-config` already
+* established for commit-message linting.
+*/
+const ALEX_CONFIG = { allow: [
+	"dead",
+	"execute",
+	"execution",
+	"executes",
+	"failure",
+	"failures",
+	"hook",
+	"hooks",
+	"husky",
+	"period"
+] };
+/**
+* Glob-ish path patterns `alex` skips. Kept as a literal here rather than
+* importing `../templates/configs/alexjs/alexignore` directly — that file
+* (like `commit-msg`/`pre-push`) is deliberately extensionless, matching
+* the real filename `holocron repo setup` writes, which ECMAScript's own
+* module resolution (`moduleResolution: "nodenext"`) can't import across
+* a package boundary without an extension. Keep in sync with that file by
+* hand; it changes rarely.
+*/
+const ALEX_IGNORE_PATTERNS = [
+	".github/*",
+	"CHANGELOG.md",
+	"LICENSE"
+];
+//#endregion
+//#region src/formatting/config.ts
+/**
+* The org's canonical prettier ignore-pattern list for a central Sentinel
+* check (holocron#769/#819) — the `PRETTIER_CONFIG` object itself doesn't
+* need a home here, since `@theholocron/prettier-config`'s default export
+* already *is* one canonical, importable config (the same "one config,
+* not N copies" reasoning `@theholocron/commitlint-config` established for
+* commit-message linting, and `ALEX_CONFIG` established for inclusive
+* language) — only the ignore list is a Sentinel-specific decision that
+* belongs alongside `ALEX_IGNORE_PATTERNS`, not inside the config package.
+*
+* Reuses `ALEX_IGNORE_PATTERNS`' own entries (`.github/*`, `CHANGELOG.md`,
+* `LICENSE` all independently confirmed to fail a real `prettier.check()`
+* today — machine-generated or unparseable content, same reasoning that
+* excluded them from alex), plus `pnpm-lock.yaml` — prettier-specific
+* (alex never reads a lockfile, but prettier would try to reformat it):
+* machine-written by pnpm's own writer, and not gitignored (lockfiles are
+* tracked), so prettier picks it up by default. Reformatting it just
+* fights every subsequent `pnpm install` (this repo's own `.prettierignore`
+* already excludes it for that exact reason).
+*/
+const PRETTIER_IGNORE_PATTERNS = [...ALEX_IGNORE_PATTERNS, "pnpm-lock.yaml"];
+//#endregion
+export { ALEX_CONFIG, ALEX_IGNORE_PATTERNS, AuthError, CARDINALITY, ConfigError, ConfigFileError, EDITORCONFIG_CHECKER_EXCLUDE, PRETTIER_IGNORE_PATTERNS, ProviderApiError, REQUIRED_CAPABILITIES, WebhookVerificationError, compose, createFeatureResolver, createResolveToken, createRestClient, defineConfig, deleteToken, deriveCapabilities, deriveCompliance, deriveProfile, deriveStack, getToken, isEditorConfigExcluded, isMulti, lintCommitMessage, lintCommitMsgFile, listStoredProviders, loadConfig, missingCapabilities, readWorkspacePackageJsons, resolveConfig, resolveEntry, resolvePluginPackage, setToken };

package/dist/plugin/capabilities.d.mts

@@ -12,7 +12,7 @@ import { ProviderApiError } from "@theholocron/http-client";
  * See `docs/wiki/specifications/tech-architecture.spec.md` for the design narrative
  * (issue: #74).
  */
-type CapabilityKey = "source" | "ci" | "secrets" | "environments" | "issues" | "deployment" | "storage" | "auth" | "vault" | "dns" | "tooling" | "notifications" | "analytics" | "errors" | "logs" | "wiki" | "workers";
+type CapabilityKey = "source" | "ci" | "secrets" | "environments" | "issues" | "deployment" | "storage" | "auth" | "vault" | "dns" | "tooling" | "notifications" | "analytics" | "errors" | "logs" | "monitoring" | "wiki" | "workers";
 type Cardinality = "single" | "many";
 declare const CARDINALITY: {
   readonly source: "single";
@@ -30,6 +30,7 @@ declare const CARDINALITY: {
   readonly analytics: "many";
   readonly errors: "single";
   readonly logs: "single";
+  readonly monitoring: "single";
   readonly wiki: "single";
   readonly workers: "single";
 };
@@ -364,9 +365,35 @@ interface DeploymentRecord {
   target?: DeploymentTrigger;
   status: "queued" | "building" | "ready" | "error" | "cancelled";
   createdAt?: string;
+  /** The provider's own reason when `status` is `"error"` (e.g. Vercel's `Command "npm install" exited with 1`). */
+  errorMessage?: string;
+}
+/** Config for `Deployment.deployFunction()` — source files, not a Git ref. */
+interface DeployFunctionConfig {
+  /**
+   * Files to deploy, keyed by path relative to the project root (e.g.
+   * `"api/webhook.js"`, `"package.json"`). Content is plain text — the
+   * provider handles any wire-format encoding.
+   */
+  files: Record<string, string>;
+  /**
+   * Named deployment target. Omit for a preview deployment — same
+   * semantics as `triggerDeployment`'s `target`.
+   */
+  target?: DeploymentTrigger;
+}
+interface DeployFunctionResult {
+  deploymentId: string;
+  url: string;
 }
 interface Deployment extends ProviderIdentity {
   readonly key: "deployment";
+  /**
+   * Custom domain declared in the deployment provider's configuration.
+   * `holocron repo setup` attaches it to the configured project and hands any
+   * returned verification record to the `dns` capability.
+   */
+  readonly domain?: string;
   listProjects(): Promise<DeploymentProject[]>;
   /** Create if missing, otherwise return existing. Idempotent. */
   ensureProject(input: {
@@ -390,6 +417,16 @@ interface Deployment extends ProviderIdentity {
     target?: DeploymentTrigger;
   }): Promise<DeploymentRecord>;
   getDeployment(deploymentId: string): Promise<DeploymentRecord>;
+  /**
+   * Deploy (or update) a project directly from source files, bypassing
+   * Git entirely — the non-git counterpart to `triggerDeployment`, for a
+   * consumer with no repo to link (a webhook receiver shipped as an npm
+   * package, for instance, rather than deployed from its own Git
+   * history). `projectId` may be a project name for providers that
+   * accept either. Optional — providers without a files-based deploy API
+   * omit this (e.g. Cloudflare Pages, git-source only today).
+   */
+  deployFunction?(projectId: string, config: DeployFunctionConfig): Promise<DeployFunctionResult>;
   /**
    * List preview deployments for a specific branch alias (e.g. "repo-pr-42").
    * Optional — providers that don't support listing by branch omit this.
@@ -402,10 +439,18 @@ interface Deployment extends ProviderIdentity {
   deletePreviewDeployments?(projectId: string, deploymentIds: string[]): Promise<number>;
   /**
    * Add a custom domain (or wildcard) to the project. Idempotent — no-op
-   * when the domain is already present. Optional: providers without a custom
-   * domain API omit this (e.g. Vercel manages domains separately).
+   * when the domain is already present. Optional: providers without a
+   * custom domain API omit this.
+   *
+   * Returns the DNS record needed to finish verification — `null` when
+   * the domain is already verified, or when the provider's API doesn't
+   * surface DNS-challenge details at all (e.g. Cloudflare Pages, whose
+   * custom-domain flow doesn't expose the same per-request verification
+   * handshake Vercel's does). Callers hand a non-null result straight
+   * to `dns.upsertRecord(result.zone, result.record)` — the exact
+   * pattern `setup` already uses for `Wiki.dnsRecord()`.
    */
-  ensureCustomDomain?(projectId: string, hostname: string): Promise<void>;
+  ensureCustomDomain?(projectId: string, hostname: string): Promise<DnsRecordRequest | null>;
 }
 interface StorageBranch {
   id: string;
@@ -573,11 +618,31 @@ interface DnsRecord {
   priority?: number;
   proxied?: boolean;
 }
+/**
+ * A DNS record a capability wants created, plus which zone it belongs
+ * to — the shape `Wiki.dnsRecord()` and `Deployment.ensureCustomDomain()`
+ * both hand off to `Dns.upsertRecord()`. Not tied to either capability;
+ * any provider that needs "here's a record, go create it" returns this.
+ */
+interface DnsRecordRequest {
+  /** Zone apex passed as the first argument to `dns.upsertRecord`. */
+  zone: string;
+  record: DnsRecord;
+}
 interface Dns extends ProviderIdentity {
   readonly key: "dns";
   listRecords(domain: string): Promise<DnsRecord[]>;
   upsertRecord(domain: string, record: DnsRecord): Promise<DnsRecord>;
   deleteRecord(domain: string, id: string): Promise<void>;
+  /**
+   * A `holocron doctor` smoke check with no specific domain to ask about —
+   * `listRecords` needs one, but doctor doesn't have one on hand. Verifies
+   * the token and reports how many zones it can see.
+   */
+  whoami?(): Promise<{
+    ok: boolean;
+    zones: number;
+  }>;
 }
 interface Errors extends ProviderIdentity {
   readonly key: "errors";
@@ -614,6 +679,50 @@ interface Logs extends ProviderIdentity {
     alreadyExists: boolean;
   }>;
 }
+type MonitoringAssertionSource = "status_code" | "response_time" | "body" | "header";
+type MonitoringAssertionComparison = "equals" | "not_equals" | "contains" | "not_contains" | "greater_than" | "less_than";
+interface MonitoringAssertion {
+  source: MonitoringAssertionSource;
+  comparison: MonitoringAssertionComparison;
+  /** Header name / JSON path — required when `source` needs one (e.g. `"header"`). */
+  property?: string;
+  target?: string;
+}
+type MonitoringHttpMethod = "GET" | "POST" | "PUT" | "HEAD" | "DELETE" | "PATCH";
+interface MonitoringCheckInput {
+  /** Also the idempotency key — `ensureCheck` finds-or-creates by this name. */
+  name: string;
+  url: string;
+  method?: MonitoringHttpMethod;
+  /** Minutes between runs. Adapters round to their own supported values. */
+  frequency?: number;
+  assertions?: MonitoringAssertion[];
+  activated?: boolean;
+}
+interface MonitoringCheck {
+  id: string;
+  name: string;
+}
+interface Monitoring extends ProviderIdentity {
+  readonly key: "monitoring";
+  /**
+   * Checks this provider is configured to ensure exist — populated from
+   * the provider's own config (`holocron.config.ts`'s provider tuple),
+   * the same place `Deployment.domain` comes from. `holocron repo setup`
+   * loops this list and calls `ensureCheck` for each; empty when none
+   * are configured.
+   */
+  readonly checks: readonly MonitoringCheckInput[];
+  /** Auth sanity-check. Throws ProviderApiError on auth failure. */
+  whoami?(): Promise<{
+    ok: boolean;
+  }>;
+  /** Idempotent find-or-create-or-update by `input.name`. */
+  ensureCheck(input: MonitoringCheckInput): Promise<{
+    check: MonitoringCheck;
+    alreadyExists: boolean;
+  }>;
+}
 interface ToolingDoctorReport {
   ok: boolean;
   message: string;
@@ -651,18 +760,6 @@ interface WikiProvisionOpts {
   /** Project display name used in the wiki title (e.g. "Holocron"). */
   name?: string;
 }
-/**
- * DNS record that `setup` should create for a wiki custom domain.
- * Returned by `Wiki.dnsRecord()` when a custom domain is configured.
- */
-interface WikiDnsRecord {
-  /** Zone apex passed as the first argument to `dns.upsertRecord`. */
-  zone: string;
-  /** Full hostname for the CNAME (e.g. "wiki.theholocron.dev"). */
-  cname: string;
-  /** CNAME target (e.g. "holocron.docs.buildwithfern.com"). */
-  target: string;
-}
 /**
  * Reverse-proxy configuration returned by `Wiki.proxyConfig()`.
  * Used by `setup` to deploy a Worker that forwards traffic to the wiki
@@ -691,7 +788,7 @@ interface Wiki extends ProviderIdentity {
    * Returns null when no custom domain is set.
    * Called by `setup` to provision the CNAME via the `dns` capability.
    */
-  dnsRecord?(): WikiDnsRecord | null;
+  dnsRecord?(): DnsRecordRequest | null;
   /**
    * Reverse-proxy config when the wiki provider requires a Worker-level
    * proxy in addition to the CNAME. Returns null when no proxy is needed.
@@ -699,12 +796,34 @@ interface Wiki extends ProviderIdentity {
    */
   proxyConfig?(): WikiProxyConfig | null;
 }
+/** Config for `Workers.deployScript()` — an arbitrary Worker, not a generated reverse-proxy. */
+interface DeployScriptConfig {
+  /** The full Worker script source — a single ES module (`export default { fetch(...) {...} }`). */
+  code: string;
+  /**
+   * Secret bindings — `env.<name>` in the deployed Worker. Values are
+   * write-only; the provider never echoes them back, here or anywhere else.
+   */
+  secrets?: Record<string, string>;
+  /**
+   * Route pattern(s) this Worker should serve (e.g.
+   * `"sentinel.theholocron.dev/*"`). Omit for a Worker reached only via
+   * its `*.workers.dev` URL.
+   */
+  routes?: string[];
+}
+interface DeployScriptResult {
+  /** The deployed script's name at the provider. */
+  scriptName: string;
+}
 /**
- * Edge Worker / reverse-proxy management capability.
+ * Edge Worker management capability.
  *
- * Deploys and manages Worker scripts that proxy traffic to a configured
- * target. Used by `setup` to wire wiki custom-domain proxies when the
- * wiki provider requires a Worker in addition to the CNAME.
+ * Deploys and manages Worker scripts. `upsertProxy` is the existing,
+ * narrower case `setup` uses to wire wiki custom-domain reverse-proxies;
+ * `deployScript` is the general case — any Worker, any code, its own
+ * secrets — for a consumer that isn't a reverse-proxy (a webhook
+ * receiver, for instance).
  */
 interface Workers extends ProviderIdentity {
   readonly key: "workers";
@@ -714,6 +833,17 @@ interface Workers extends ProviderIdentity {
    * `config.headers` on each request.
    */
   upsertProxy(hostname: string, config: WikiProxyConfig): Promise<void>;
+  /** Deploy (or update) an arbitrary Worker script, optionally with secrets and routes. */
+  deployScript(name: string, config: DeployScriptConfig): Promise<DeployScriptResult>;
+  /**
+   * A `holocron doctor` smoke check — every other method either mutates or
+   * needs a specific script/zone doctor has no way to supply up front.
+   * Reports how many Worker scripts the token can see.
+   */
+  whoami?(): Promise<{
+    ok: boolean;
+    scripts: number;
+  }>;
 }
 interface CapabilityImpls {
   source: Source;
@@ -731,6 +861,7 @@ interface CapabilityImpls {
   analytics: Analytics;
   errors: Errors;
   logs: Logs;
+  monitoring: Monitoring;
   wiki: Wiki;
   workers: Workers;
 }
@@ -739,4 +870,4 @@ type CardinalityFor<K extends CapabilityKey> = (typeof CARDINALITY)[K];
 type ResolvedCapability<K extends CapabilityKey> = CardinalityFor<K> extends "many" ? CapabilityImpls[K][] : CapabilityImpls[K];
 declare function isMulti<K extends CapabilityKey>(key: K): CardinalityFor<K> extends "many" ? true : false;
 //#endregion
-export { Analytics, Auth, AuthDescription, AuthEvent, AuthEventType, AuthIdentity, AuthUser, CARDINALITY, CapabilityImpls, CapabilityKey, Cardinality, CardinalityFor, Ci, CiRun, CiRunFilter, CiRunStatus, ConnectionStringOptions, CreateAuthUserInput, Deployment, DeploymentProject, DeploymentProjectSettings, DeploymentRecord, DeploymentTarget, DeploymentTrigger, Dns, DnsRecord, DnsRecordType, EnsureResult, Environment, EnvironmentReviewer, Environments, Errors, Issue, IssueSearchFilter, Issues, LabelDef, LifecycleResult, LifecycleSlot, Logs, NormalizedAuthUser, Notifications, PagesConfig, ParseWebhookInput, ProviderApiError, ProviderIdentity, PullRequest, REQUIRED_CAPABILITIES, RepoRef, RepoSettings, ResolvedCapability, Ruleset, SecretScope, Secrets, Source, StatusCategory, Storage, StorageBranch, TeamEntry, TeamPermission, Tooling, ToolingDoctorReport, TrackerDoctorReport, TrackerUser, Vault, WebhookDashboardInfo, WebhookVerificationError, Wiki, WikiDnsRecord, WikiProvisionOpts, WikiProxyConfig, Workers, isMulti };
+export { Analytics, Auth, AuthDescription, AuthEvent, AuthEventType, AuthIdentity, AuthUser, CARDINALITY, CapabilityImpls, CapabilityKey, Cardinality, CardinalityFor, Ci, CiRun, CiRunFilter, CiRunStatus, ConnectionStringOptions, CreateAuthUserInput, DeployFunctionConfig, DeployFunctionResult, DeployScriptConfig, DeployScriptResult, Deployment, DeploymentProject, DeploymentProjectSettings, DeploymentRecord, DeploymentTarget, DeploymentTrigger, Dns, DnsRecord, DnsRecordRequest, DnsRecordType, EnsureResult, Environment, EnvironmentReviewer, Environments, Errors, Issue, IssueSearchFilter, Issues, LabelDef, LifecycleResult, LifecycleSlot, Logs, Monitoring, MonitoringAssertion, MonitoringAssertionComparison, MonitoringAssertionSource, MonitoringCheck, MonitoringCheckInput, MonitoringHttpMethod, NormalizedAuthUser, Notifications, PagesConfig, ParseWebhookInput, ProviderApiError, ProviderIdentity, PullRequest, REQUIRED_CAPABILITIES, RepoRef, RepoSettings, ResolvedCapability, Ruleset, SecretScope, Secrets, Source, StatusCategory, Storage, StorageBranch, TeamEntry, TeamPermission, Tooling, ToolingDoctorReport, TrackerDoctorReport, TrackerUser, Vault, WebhookDashboardInfo, WebhookVerificationError, Wiki, WikiProvisionOpts, WikiProxyConfig, Workers, isMulti };

package/dist/plugin/capabilities.mjs

@@ -16,6 +16,7 @@ const CARDINALITY = {
 	analytics: "many",
 	errors: "single",
 	logs: "single",
+	monitoring: "single",
 	wiki: "single",
 	workers: "single"
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theholocron/cli",
-  "version": "5.0.0-alpha.13",
+  "version": "5.0.0-alpha.133",
   "description": "The Holocron CLI - a pluggable, capability-based orchestrator for spinning up and operating software projects.",
   "keywords": [
     "cli",
@@ -41,15 +41,19 @@
   ],
   "dependencies": {
     "@axiomhq/pino": "^2.0.0",
+    "@commitlint/lint": "^21.2.3",
+    "@commitlint/load": "^21.2.3",
+    "@commitlint/types": "^21.2.3",
     "@inquirer/prompts": "^8.5.2",
     "@inquirer/search": "^4.3.3",
     "@napi-rs/keyring": "^1.3.0",
     "@sentry/node": "^10.70.0",
     "@theholocron/components-doc": "^1.6.0",
-    "@theholocron/env-utils": "^1.6.0",
-    "@theholocron/github-client": "^1.17.0",
-    "@theholocron/http-client": "^1.17.0",
-    "@theholocron/observability": "^0.3.0",
+    "@theholocron/env-utils": "^1.9.2",
+    "@theholocron/github-client": "^1.40.0",
+    "@theholocron/http-client": "^1.40.0",
+    "@theholocron/misc-utils": "^1.9.2",
+    "@theholocron/observability": "^0.5.0",
     "@theholocron/registry-doc": "^1.12.0",
     "chalk": "^6.0.0",
     "ora": "^9.4.1",
@@ -57,13 +61,15 @@
     "pino-pretty": "^13.1.3",
     "posthog-node": "^5.51.6",
     "yargs": "^18.1.0",
-    "@theholocron/astromech": "5.0.0-alpha.13",
-    "@theholocron/datapad": "5.0.0-alpha.13"
+    "@theholocron/astromech": "5.0.0-alpha.133",
+    "@theholocron/datapad": "5.0.0-alpha.133"
   },
   "devDependencies": {
-    "@theholocron/eslint-config": "^8.0.0",
-    "@theholocron/tsconfig": "^8.0.0",
-    "@theholocron/vitest-config": "^8.0.0",
+    "@commitlint/config-conventional": "^21.2.3",
+    "@theholocron/commitlint-config": "^8.7.1",
+    "@theholocron/eslint-config": "^8.7.1",
+    "@theholocron/tsconfig": "^8.7.1",
+    "@theholocron/vitest-config": "^8.7.0",
     "@types/node": "^26",
     "@types/yargs": "^17.0.35",
     "@vitest/coverage-v8": "^4.1.11",
@@ -75,7 +81,7 @@
     "tsx": "4.23.12",
     "typescript": "^5.9.3",
     "vitest": "^4.1.11",
-    "@theholocron/rollup-plugin-transform-template": "5.0.0-alpha.13"
+    "@theholocron/rollup-plugin-transform-template": "5.0.0-alpha.133"
   },
   "engines": {
     "node": ">=22.0.0"