@theholocron/cli 5.0.0-alpha.16 → 5.0.0-alpha.160

package/dist/index.d.mts

@@ -1,18 +1,22 @@
-import { Analytics, Auth, AuthDescription, AuthEvent, AuthEventType, AuthIdentity, AuthUser, CARDINALITY, CapabilityImpls, CapabilityKey, Cardinality, CardinalityFor, Ci, CiRun, CiRunFilter, CiRunStatus, ConnectionStringOptions, CreateAuthUserInput, Deployment, DeploymentProject, DeploymentProjectSettings, DeploymentRecord, DeploymentTarget, DeploymentTrigger, Dns, DnsRecord, DnsRecordType, EnsureResult, Environment, EnvironmentReviewer, Environments, Errors, Issue, IssueSearchFilter, Issues, LabelDef, LifecycleResult, LifecycleSlot, Logs, NormalizedAuthUser, Notifications, PagesConfig, ParseWebhookInput, ProviderApiError, ProviderIdentity, PullRequest, REQUIRED_CAPABILITIES, RepoRef, RepoSettings, ResolvedCapability, Ruleset, SecretScope, Secrets, Source, StatusCategory, Storage, StorageBranch, TeamEntry, TeamPermission, Tooling, ToolingDoctorReport, TrackerDoctorReport, TrackerUser, Vault, WebhookDashboardInfo, WebhookVerificationError, Wiki, WikiDnsRecord, WikiProvisionOpts, WikiProxyConfig, Workers, isMulti } from "./plugin/capabilities.mjs";
+import { Analytics, Auth, AuthDescription, AuthEvent, AuthEventType, AuthIdentity, AuthUser, CARDINALITY, CapabilityImpls, CapabilityKey, Cardinality, CardinalityFor, Ci, CiRun, CiRunFilter, CiRunStatus, ConnectionStringOptions, CreateAuthUserInput, DeployFunctionConfig, DeployFunctionResult, DeployScriptConfig, DeployScriptResult, Deployment, DeploymentProject, DeploymentProjectSettings, DeploymentRecord, DeploymentTarget, DeploymentTrigger, Dns, DnsRecord, DnsRecordRequest, DnsRecordType, EnsureResult, Environment, EnvironmentReviewer, Environments, Errors, Issue, IssueSearchFilter, Issues, LabelDef, LifecycleResult, LifecycleSlot, Logs, Monitoring, MonitoringAssertion, MonitoringAssertionComparison, MonitoringAssertionSource, MonitoringCheck, MonitoringCheckInput, MonitoringHttpMethod, NormalizedAuthUser, Notifications, PagesConfig, ParseWebhookInput, ProviderApiError, ProviderIdentity, PullRequest, REQUIRED_CAPABILITIES, RepoRef, RepoSettings, ResolvedCapability, Ruleset, SecretScope, Secrets, Source, StatusCategory, Storage, StorageBranch, TeamEntry, TeamPermission, Tooling, ToolingDoctorReport, TrackerDoctorReport, TrackerUser, Vault, WebhookDashboardInfo, WebhookVerificationError, Wiki, WikiProvisionOpts, WikiProxyConfig, Workers, isMulti } from "./plugin/capabilities.mjs";
 import { AuthError, RequestOptions, ResolveTokenConfig as ResolveTokenConfig$1, ResolveTokenInput, RestClient, RestClientConfig, createRestClient } from "@theholocron/http-client";
+import { PackageJson } from "@theholocron/pkg-utils";
 import { ConfigFileError } from "@theholocron/datapad";
 import { LogLevel } from "@theholocron/observability/core";
-//#region src/auth/auth-resolver.d.ts
+import { WorkspacePackage } from "@theholocron/astromech";
+//#region src/auth/auth-resolver/auth-resolver.type.d.ts
 type ResolveTokenConfig = Omit<ResolveTokenConfig$1, "getKeyringToken">;
-/** Wraps `createResolveToken` from `@theholocron/http` and injects the
- *  system keyring so plugins stay at a one-liner call site. */
-declare function createResolveToken(config: ResolveTokenConfig): (input?: ResolveTokenInput) => string;
 interface FeatureResolverConfig {
   /** Env var name for this feature, e.g. `"HOLOCRON_ISSUES_TOKEN"`. */
   envName: string;
   /** Keyring account key, e.g. `"github.issues"`. */
   keyringKey: string;
 }
+//#endregion
+//#region src/auth/auth-resolver/auth-resolver.d.ts
+/** Wraps `createResolveToken` from `@theholocron/http` and injects the
+ *  system keyring so plugins stay at a one-liner call site. */
+declare function createResolveToken(config: ResolveTokenConfig): (input?: ResolveTokenInput) => string;
 /**
  * Build a strict, single-feature token resolver.
  *
@@ -22,7 +26,7 @@ interface FeatureResolverConfig {
  */
 declare function createFeatureResolver(config: FeatureResolverConfig): (input?: ResolveTokenInput) => string;
 //#endregion
-//#region src/auth/keyring.d.ts
+//#region src/auth/keyring/keyring.d.ts
 /**
  * Keyring-backed bootstrap credential store.
  *
@@ -66,7 +70,20 @@ declare function deleteToken(provider: string): boolean;
  */
 declare function listStoredProviders(): string[];
 //#endregion
-//#region src/config/config.d.ts
+//#region src/commands/auth/auth.type.d.ts
+interface VerifyTokenSuccess {
+  ok: true;
+  /** "workplace: acme" / "user: cnewton@x" — surfaced in success output. */
+  subject: string;
+}
+interface VerifyTokenFailure {
+  ok: false;
+  /** Reason the token was rejected. Surfaces to the operator. */
+  message: string;
+}
+type VerifyTokenResult = VerifyTokenSuccess | VerifyTokenFailure;
+//#endregion
+//#region src/config/config/config.type.d.ts
 /** Structured-logging config. The Axiom **token** never lives here — only in
  *  env vars or the OS keyring — but the non-secret dataset name may. */
 interface LogConfig {
@@ -140,7 +157,7 @@ interface DocsConfig {
    * GitHub Pages build source.
    * "workflow" → GitHub Actions  (PUT { build_type: "workflow" })
    * "branch"   → classic gh-pages branch (PUT { build_type: "legacy", source: { branch: "gh-pages", path: "/" } })
-   * When absent, Pages is not managed by `holocron setup`.
+   * When absent, Pages is not managed by `holocron repo setup`.
    */
   build?: "workflow" | "branch";
   /**
@@ -162,7 +179,22 @@ interface RepoConfig {
   /** "owner/name" — the GitHub repository coordinate. Derived from the git remote when absent. */
   name?: string;
   /**
-   * Branch protection preset applied by `holocron setup`. When omitted,
+   * GitHub's repo-level default branch (`HEAD`) — what a fresh clone checks
+   * out, what `gh pr create`/the compare UI target by default, and what
+   * Sentinel's `validateConfig()` reads (D6: the App only ever reads config
+   * from the repo's default branch, never a PR ref, as a security boundary
+   * — never widen that to read PR branches instead of fixing this field).
+   * Synced by `holocron repo setup`. Omit to leave GitHub's current setting
+   * untouched — most repos never need this. Exists for a repo using a
+   * `main`/`alpha` prerelease-channel split (CLAUDE.md's Releases section)
+   * where active development happens on a non-`main` branch: set this to
+   * that branch so Sentinel validates against what's actually being
+   * developed, then change it back once that branch merges to `main` for a
+   * stable cut and stops being the active branch.
+   */
+  defaultBranch?: string;
+  /**
+   * Branch protection preset applied by `holocron repo setup`. When omitted,
    * no protection is applied and no `branch_protection_level` property is set.
    * Required-status-check contexts for `"strict"` are derived from the task
    * manifest — `{ required: true }` tasks + top-level `extraRequiredChecks`
@@ -170,7 +202,7 @@ interface RepoConfig {
    */
   protection?: RepoProtection;
   /**
-   * GitHub teams granted repository access. Synced by `holocron setup`, which
+   * GitHub teams granted repository access. Synced by `holocron repo setup`, which
    * also writes `.github/CODEOWNERS` for teams with write-or-higher permission.
    * String shorthand defaults to `push` (Write).
    */
@@ -270,7 +302,7 @@ interface StorybookDeployProject {
  * `run-chromatic` accepts either a plain boolean (single-project) or a
  * `ChromaticProjectConfig[]` object (multi-project monorepo).
  *
- * `docs` / `storybook` are high-level deploy shorthand that `holocron setup`
+ * `docs` / `storybook` are high-level deploy shorthand that `holocron repo setup`
  * translates to `type` / `storybook-projects` before writing the thin caller.
  * They also drive automatic `paths:` derivation so you never need to write
  * `paths:` manually for deploy entries.
@@ -298,18 +330,18 @@ interface TaskEntryConfig {
   with?: WorkflowWithConfig;
   paths?: string[];
   linters?: string[];
-  /** Emit a `.github/workflows/<name>.yml` thin caller + include in `holocron ci`. Default `true`. */
+  /** Emit a `.github/workflows/<name>.yml` thin caller + include in `holocron run ci`. Default `true`. */
   ci?: boolean;
   /** Write a `package.json` script + let `holocron run <name>` resolve the task. Default `true`. */
   local?: boolean;
-  /** The task's CI check context is a required status check + part of `holocron ci`'s default run. */
+  /** The task's CI check context is a required status check + part of `holocron run ci`'s default run. */
   required?: boolean;
 }
 interface HolocronConfig {
   /** Project name. Derived from package.json when absent. */
   name?: string;
   description?: string;
-  /** Project homepage URL. Synced to package.json#homepage and the GitHub repo's website field by `holocron sync`. */
+  /** Project homepage URL. Synced to package.json#homepage and the GitHub repo's website field by `holocron repo sync`. */
   homepage?: string;
   /**
    * Active org name for namespaced keyring lookup. When set, token resolution
@@ -335,7 +367,7 @@ interface HolocronConfig {
    * The task manifest — what this repo runs. Each entry is a task name
    * (backed by a reusable workflow in `theholocron/.github`), or the object
    * form to pass `with:` inputs. `@theholocron/astromech` reads this as the
-   * single source for `holocron run` / `holocron ci` / the generated CI
+   * single source for `holocron run` / `holocron run ci` / the generated CI
    * workflows / `package.json` scripts.
    *
    * Supported values (intent-facing vocabulary — epic #672, D3):
@@ -348,7 +380,7 @@ interface HolocronConfig {
    *   "knowledge.wiki" | "knowledge.docs" | "knowledge.components" |
    *   "review" | "tag" | "stale" | "greetings" | "dependencies" | "bookkeeping"
    *
-   * `holocron setup` writes `.github/workflows/<name>.yml` for each entry,
+   * `holocron repo setup` writes `.github/workflows/<name>.yml` for each entry,
    * calling the corresponding reusable workflow in `theholocron/.github`.
    * Files are overwritten on each run — they are generated artifacts.
    *
@@ -397,7 +429,7 @@ interface HolocronConfig {
    * }
    * ```
    * Each `tokenName` maps to a repository secret named
-   * `CHROMATIC_PROJECT_TOKEN_<TOKENNAME>`. `holocron setup` expands this
+   * `CHROMATIC_PROJECT_TOKEN_<TOKENNAME>`. `holocron repo setup` expands this
    * to the flat `run-chromatic: true` + `chromatic-projects: <json>` inputs
    * that the reusable workflow accepts.
    *
@@ -407,7 +439,7 @@ interface HolocronConfig {
    */
   tasks?: Array<string | TaskEntryConfig>;
   /**
-   * Opt out of `holocron sync`'s `package.json` script writes. Default `true`.
+   * Opt out of `holocron repo sync`'s `package.json` script writes. Default `true`.
    */
   syncScripts?: boolean;
   /**
@@ -418,15 +450,15 @@ interface HolocronConfig {
   holocronScript?: string;
   /**
    * Required status-check contexts not backed by a `required` task (codecov
-   * gates, the bundle-build check, …). `holocron setup` appends these to the
+   * gates, the bundle-build check, …). `holocron repo setup` appends these to the
    * task-derived list from `astromech.requiredChecks()`.
    */
   extraRequiredChecks?: string[];
   /**
-   * Git hooks `holocron setup` installs. `true` / `{ prePush: true }` writes
-   * `.husky/pre-push` (runs `holocron ci` before every push); `false` /
+   * Git hooks `holocron repo setup` installs. `true` / `{ prePush: true }` writes
+   * `.husky/pre-push` (runs `holocron run ci` before every push); `false` /
    * `{ prePush: false }` opts out. Omitted → on for `protection: "strict"`,
-   * off otherwise. `--hooks` / `--no-hooks` on `holocron setup` override.
+   * off otherwise. `--hooks` / `--no-hooks` on `holocron repo setup` override.
    */
   hooks?: boolean | {
     prePush?: boolean;
@@ -435,7 +467,7 @@ interface HolocronConfig {
   apps?: AppConfig[];
   doctor?: DoctorConfig;
   /**
-   * Agent runtime that determines where skills are installed by `holocron setup`.
+   * Agent runtime that determines where skills are installed by `holocron repo setup`.
    * Skills are installed to `.agents/skills/<name>/` (canonical) with a
    * relative symlink at the agent-specific path:
    * - `"claude"` → `.claude/skills/<name>` → `../../.agents/skills/<name>`
@@ -443,7 +475,7 @@ interface HolocronConfig {
    */
   agent?: "claude" | "codex" | "gemini";
   /**
-   * Skill names from `@theholocron/skills` to install during `holocron setup`.
+   * Skill names from `@theholocron/skills` to install during `holocron repo setup`.
    * Installed paths are gitignored and managed by setup — do not commit them.
    *
    * @example
@@ -451,7 +483,7 @@ interface HolocronConfig {
    */
   skills?: string[];
   /**
-   * GitHub Pages configuration. When present, `holocron setup` calls the
+   * GitHub Pages configuration. When present, `holocron repo setup` calls the
    * Pages API using `HOLOCRON_DEPLOY_TOKEN` (requires `pages:write` + `repo` scope).
    * When absent, Pages is left as-is.
    *
@@ -487,6 +519,29 @@ interface HolocronConfig {
    * { analytics: "none" }
    */
   telemetry?: TelemetryConfig;
+  /**
+   * ESLint bundle option overrides that Sentinel's centralized static-
+   * analysis check (holocron#849) can't otherwise see. Bucket 1 checks
+   * never read a PR's own committed files for config — this is the
+   * declared source of truth Sentinel reads instead, so its check stays
+   * in sync with what each package's own `eslint.config.ts` already
+   * enforces locally and in CI.
+   */
+  eslint?: EslintConfig;
+}
+/**
+ * Repo-root-relative directories treated as browser-targeted for eslint's
+ * node-builtins compatibility checks — mirrors
+ * `@theholocron/eslint-config`'s `library({ browserPackages })` option.
+ * Only needed for a package whose own `eslint.config.ts` already declares
+ * `browserPackages` (a deliberate outlier, not the norm — see that
+ * package's own config file for why).
+ *
+ * @example
+ * { browserPackages: ["packages/github-client/src/app-auth"] }
+ */
+interface EslintConfig {
+  browserPackages?: string[];
 }
 interface ResolvedTuple {
   provider: string;
@@ -526,7 +581,10 @@ interface ResolvedHolocronConfig {
   env?: EnvConfig;
   log?: LogConfig;
   telemetry?: TelemetryConfig;
+  eslint?: EslintConfig;
 }
+//#endregion
+//#region src/config/config/config.d.ts
 declare class ConfigError extends Error {
   name: string;
 }
@@ -539,7 +597,7 @@ declare function resolvePluginPackage(provider: string): string;
 declare function resolveEntry(key: CapabilityKey, raw: RawProviderEntry): ResolvedProviderEntry;
 declare function resolveConfig(raw: HolocronConfig): ResolvedHolocronConfig;
 //#endregion
-//#region src/config/compose.d.ts
+//#region src/config/compose/compose.type.d.ts
 type TaskEntry = NonNullable<HolocronConfig["tasks"]>[number];
 /** A single composable capability fragment. */
 interface Capability {
@@ -578,6 +636,8 @@ interface ComposedPreset {
   domain?: string;
   docs?: DocsConfig;
 }
+//#endregion
+//#region src/config/compose/compose.d.ts
 /**
  * Merge any number of capability fragments into a single preset object that
  * spreads directly into `defineConfig()`.
@@ -601,20 +661,99 @@ interface ComposedPreset {
  */
 declare function compose(...args: (Capability | Capability[])[]): ComposedPreset;
 //#endregion
-//#region src/config/define-config.d.ts
+//#region src/config/define-config/define-config.d.ts
 declare function defineConfig(config: HolocronConfig): HolocronConfig;
 //#endregion
-//#region src/config/load-config.d.ts
+//#region src/config/load-config/load-config.type.d.ts
 interface LoadedConfig {
   resolved: ResolvedHolocronConfig;
   /** Absolute path to the file the config was read from. */
   filepath: string;
 }
+//#endregion
+//#region src/config/load-config/load-config.d.ts
 /**
- * Read + parse + resolve `holocron.config.*` from the given directory.
+ * Read + parse + resolve `holocron.config.*` starting from the given
+ * directory, walking up through ancestors to the nearest `.git` boundary
+ * when `cwd` itself has no match — every command is usable from any
+ * subdirectory of a repo, not only its exact root (see
+ * `@theholocron/datapad`'s own doc comment for the stop conditions).
  * Throws {@link ConfigFileError} when nothing is found or a file cannot
- * be loaded, or `ConfigError` when the config is invalid.
+ * be loaded, or `ConfigError` when the config fails schema checks.
  */
 declare function loadConfig(cwd: string): Promise<LoadedConfig>;
 //#endregion
-export { Analytics, AppConfig, Auth, AuthDescription, AuthError, AuthEvent, AuthEventType, AuthIdentity, AuthUser, CARDINALITY, Capability, CapabilityConfigPackage, CapabilityImpls, CapabilityKey, Cardinality, CardinalityFor, ChromaticProjectConfig, Ci, CiRun, CiRunFilter, CiRunStatus, ComposedPreset, ConfigError, ConfigFileError, ConnectionStringOptions, CreateAuthUserInput, Deployment, DeploymentProject, DeploymentProjectSettings, DeploymentRecord, DeploymentTarget, DeploymentTrigger, Dns, DnsRecord, DnsRecordType, DocsConfig, DoctorConfig, EnsureResult, EnvConfig, Environment, EnvironmentReviewer, Environments, Errors, FeatureResolverConfig, HolocronConfig, Issue, IssueSearchFilter, Issues, LabelDef, LifecycleResult, LifecycleSlot, LoadedConfig, LogConfig, Logs, MultiEntry, NormalizedAuthUser, Notifications, PagesConfig, ParseWebhookInput, ProviderApiError, ProviderIdentity, ProviderOptions, PullRequest, REQUIRED_CAPABILITIES, RawProviderEntry, RawProvidersConfig, RepoConfig, RepoProperties, RepoProtection, RepoRef, RepoSettings, type RequestOptions, ResolveTokenConfig, type ResolveTokenInput, ResolvedCapability, ResolvedHolocronConfig, ResolvedProviderEntry, ResolvedProvidersConfig, ResolvedTuple, type RestClient, type RestClientConfig, Ruleset, SecretScope, Secrets, SingleEntry, Source, StatusCategory, Storage, StorageBranch, StorybookDeployProject, TaskEntryConfig, TeamEntry, TeamPermission, TelemetryConfig, Tooling, ToolingDoctorReport, TrackerDoctorReport, TrackerUser, Vault, WebhookDashboardInfo, WebhookVerificationError, Wiki, WikiDnsRecord, WikiProvisionOpts, WikiProxyConfig, Workers, WorkflowWithConfig, compose, createFeatureResolver, createResolveToken, createRestClient, defineConfig, deleteToken, getToken, isMulti, listStoredProviders, loadConfig, resolveConfig, resolveEntry, resolvePluginPackage, setToken };
+//#region src/commands/setup/derived-properties/derived-properties.type.d.ts
+/**
+ * Derived custom-properties (#677). Unlike the existing 6 GitHub
+ * custom-properties fields (`lifecycle`, `open_source`, `runtime_environment`,
+ * `uses_external_packages`, `monorepo`, `branch_protection_level`) — which
+ * mirror what `holocron.config.ts` already states explicitly — these four are
+ * *derived*: signal that isn't an explicit config field today (framework
+ * choice, repo archetype, capability drift). See
+ * `.notes/tech-holocron-platform.spec.md` → "Custom-properties sync — field
+ * definitions (#677)" for the full design.
+ */
+type HolocronProfile = "library" | "cli" | "plugin" | "template" | "app" | "docs" | "platform";
+/** The `package.json` shape profile derivation reads — `@theholocron/pkg-utils`'s `PackageJson`, under the name Sentinel already imports. */
+type PackageJsonLike = PackageJson;
+interface DeriveProfileInput {
+  rootPackageJson: PackageJsonLike | null;
+  repoName: string;
+  isMonorepo: boolean;
+  /** `packages/*` package.json contents, monorepo repos only — used to find the primary published artifact. */
+  workspacePackageJsons: PackageJsonLike[];
+}
+//#endregion
+//#region src/commands/setup/derived-properties/derived-properties.d.ts
+/**
+ * Repo archetype, in priority order:
+ * 1. `*-template` repo name → `template` (independent of package shape).
+ * 2. Monorepo whose primary published artifact is a CLI (some workspace
+ *    package has `bin`) → `platform` — matches `holocron` itself: the CLI is
+ *    the deliverable, the plugin packages are supporting infrastructure for
+ *    it, not separate products.
+ * 3. Monorepo with no CLI but at least one non-private workspace package →
+ *    `library` — matches `clients`/`configs`/`utils`/`themes`/
+ *    `observability`: a family of published packages, none of them a CLI.
+ *    Checked *before* falling into the root-package branch below, because
+ *    these repos' own root `package.json` is private and often carries
+ *    `@theholocron/astro-config` for a docs site built from the monorepo
+ *    root — without this check they'd wrongly resolve to `docs` off that
+ *    root-level signal alone, when the docs site is a secondary concern of
+ *    a library collection, not what the repo fundamentally is.
+ * 4. Single-package repo with `package.json#bin` → `cli`.
+ * 5. Docs-only site (astro/starlight present, root package private, no
+ *    publishable exports) → `docs`.
+ * 6. Private, non-publishable, non-docs → `app`.
+ * 7. Otherwise, a single publishable package → `library`.
+ */
+declare function deriveProfile(input: DeriveProfileInput): HolocronProfile;
+/**
+ * Detected build/framework tooling — the literal "does this repo need
+ * next/vite/tsdown" signal `holocron.config.ts` has no field for today
+ * (framework choice isn't a config concept, unlike `providers`/`tasks`).
+ * Curated table, not exhaustive by design — add to `KNOWN_STACK_DEPS` as new
+ * frameworks show up rather than trying to detect anything on npm.
+ */
+declare function deriveStack(pkg: PackageJsonLike | null): string[];
+/** The provider capability keys actually wired in `providers: {}` — zero heuristics. */
+declare function deriveCapabilities(providers: ResolvedProvidersConfig | undefined): string[];
+declare function deriveCompliance(capabilities: readonly string[]): "compliant" | "non-compliant";
+/**
+ * The Phase B refinement `deriveCompliance()`'s own doc comment names —
+ * *why* a repo is non-compliant, not just that it is. `[]` when compliant.
+ * Same `REQUIRED_BASELINE` `deriveCompliance()` checks against — one
+ * table, not two independently-maintained baselines.
+ */
+declare function missingCapabilities(capabilities: readonly string[]): string[];
+/**
+ * Reads each workspace package's actual `package.json` content (not just
+ * `readWorkspacePackages()`'s `{ slug, name, dir }` — `deriveProfile()`'s
+ * `platform` detection needs `bin`, which that helper doesn't carry).
+ * Missing/invalid files are skipped, matching `readWorkspacePackages()`'s
+ * own soft-fail behavior.
+ */
+declare function readWorkspacePackageJsons(repoRoot: string, workspacePackages: readonly WorkspacePackage[]): Promise<PackageJsonLike[]>;
+//#endregion
+export { Analytics, type AppConfig, Auth, AuthDescription, AuthError, AuthEvent, AuthEventType, AuthIdentity, AuthUser, CARDINALITY, type Capability, type CapabilityConfigPackage, CapabilityImpls, CapabilityKey, Cardinality, CardinalityFor, type ChromaticProjectConfig, Ci, CiRun, CiRunFilter, CiRunStatus, type ComposedPreset, ConfigError, ConfigFileError, ConnectionStringOptions, CreateAuthUserInput, DeployFunctionConfig, DeployFunctionResult, DeployScriptConfig, DeployScriptResult, Deployment, DeploymentProject, DeploymentProjectSettings, DeploymentRecord, DeploymentTarget, DeploymentTrigger, type DeriveProfileInput, Dns, DnsRecord, DnsRecordRequest, DnsRecordType, type DocsConfig, type DoctorConfig, EnsureResult, type EnvConfig, Environment, EnvironmentReviewer, Environments, Errors, type EslintConfig, type FeatureResolverConfig, type HolocronConfig, type HolocronProfile, Issue, IssueSearchFilter, Issues, LabelDef, LifecycleResult, LifecycleSlot, type LoadedConfig, type LogConfig, Logs, Monitoring, MonitoringAssertion, MonitoringAssertionComparison, MonitoringAssertionSource, MonitoringCheck, MonitoringCheckInput, MonitoringHttpMethod, type MultiEntry, NormalizedAuthUser, Notifications, type PackageJsonLike, PagesConfig, ParseWebhookInput, ProviderApiError, ProviderIdentity, type ProviderOptions, PullRequest, REQUIRED_CAPABILITIES, type RawProviderEntry, type RawProvidersConfig, type RepoConfig, type RepoProperties, type RepoProtection, RepoRef, RepoSettings, type RequestOptions, type ResolveTokenConfig, type ResolveTokenInput, ResolvedCapability, type ResolvedHolocronConfig, type ResolvedProviderEntry, type ResolvedProvidersConfig, type ResolvedTuple, type RestClient, type RestClientConfig, Ruleset, SecretScope, Secrets, type SingleEntry, Source, StatusCategory, Storage, StorageBranch, type StorybookDeployProject, type TaskEntry, type TaskEntryConfig, TeamEntry, TeamPermission, type TelemetryConfig, Tooling, ToolingDoctorReport, TrackerDoctorReport, TrackerUser, Vault, type VerifyTokenFailure, type VerifyTokenResult, type VerifyTokenSuccess, WebhookDashboardInfo, WebhookVerificationError, Wiki, WikiProvisionOpts, WikiProxyConfig, Workers, type WorkflowWithConfig, compose, createFeatureResolver, createResolveToken, createRestClient, defineConfig, deleteToken, deriveCapabilities, deriveCompliance, deriveProfile, deriveStack, getToken, isMulti, listStoredProviders, loadConfig, missingCapabilities, readWorkspacePackageJsons, resolveConfig, resolveEntry, resolvePluginPackage, setToken };

package/dist/index.mjs

@@ -1,14 +1,16 @@
 import { CARDINALITY, ProviderApiError, REQUIRED_CAPABILITIES, WebhookVerificationError, isMulti } from "./plugin/capabilities.mjs";
 import { AuthError, createResolveToken as createResolveToken$1, createRestClient } from "@theholocron/http-client";
-import { createEnvLookup } from "@theholocron/env-utils";
+import { createEnvLookup, withEnvPrefix } from "@theholocron/env-utils";
 import { Entry, findCredentials } from "@napi-rs/keyring";
-import { execFile } from "node:child_process";
-import { readFile } from "node:fs/promises";
 import { basename, dirname, join } from "node:path";
-import { promisify } from "node:util";
+import { readPackageJson } from "@theholocron/pkg-utils";
 import { loadTasksConfig } from "@theholocron/astromech/config";
 import { ConfigFileError, ConfigFileError as ConfigFileError$1, loadConfigFile } from "@theholocron/datapad";
-createEnvLookup();
+import { readGitRemote } from "@theholocron/git-utils";
+//#region src/env/env.ts
+/** Singleton env for simple global lookups throughout the CLI. */
+const env = createEnvLookup();
+withEnvPrefix(env, "HOLOCRON");
 /**
 * Create an injectable env for commands that accept a fake env in tests.
 * Pass `input.env` when available, falls back to `process.env`.
@@ -17,7 +19,7 @@ function makeEnv(source) {
 	return createEnvLookup(source);
 }
 //#endregion
-//#region src/auth/keyring.ts
+//#region src/auth/keyring/keyring.ts
 /**
 * Keyring-backed bootstrap credential store.
 *
@@ -87,7 +89,7 @@ function listStoredProviders() {
 	}
 }
 //#endregion
-//#region src/auth/auth-resolver.ts
+//#region src/auth/auth-resolver/auth-resolver.ts
 /** Wraps `createResolveToken` from `@theholocron/http` and injects the
 *  system keyring so plugins stay at a one-liner call site. */
 function createResolveToken(config) {
@@ -113,7 +115,114 @@ function createFeatureResolver(config) {
 	};
 }
 //#endregion
-//#region src/config/config.ts
+//#region src/commands/setup/derived-properties/derived-properties.ts
+/**
+* Repo archetype, in priority order:
+* 1. `*-template` repo name → `template` (independent of package shape).
+* 2. Monorepo whose primary published artifact is a CLI (some workspace
+*    package has `bin`) → `platform` — matches `holocron` itself: the CLI is
+*    the deliverable, the plugin packages are supporting infrastructure for
+*    it, not separate products.
+* 3. Monorepo with no CLI but at least one non-private workspace package →
+*    `library` — matches `clients`/`configs`/`utils`/`themes`/
+*    `observability`: a family of published packages, none of them a CLI.
+*    Checked *before* falling into the root-package branch below, because
+*    these repos' own root `package.json` is private and often carries
+*    `@theholocron/astro-config` for a docs site built from the monorepo
+*    root — without this check they'd wrongly resolve to `docs` off that
+*    root-level signal alone, when the docs site is a secondary concern of
+*    a library collection, not what the repo fundamentally is.
+* 4. Single-package repo with `package.json#bin` → `cli`.
+* 5. Docs-only site (astro/starlight present, root package private, no
+*    publishable exports) → `docs`.
+* 6. Private, non-publishable, non-docs → `app`.
+* 7. Otherwise, a single publishable package → `library`.
+*/
+function deriveProfile(input) {
+	if (/-template$/.test(input.repoName)) return "template";
+	if (input.isMonorepo) {
+		if (input.workspacePackageJsons.some((pkg) => Boolean(pkg.bin))) return "platform";
+		if (input.workspacePackageJsons.some((pkg) => pkg.private !== true)) return "library";
+	}
+	const pkg = input.rootPackageJson;
+	if (pkg?.bin) return "cli";
+	const deps = {
+		...pkg?.dependencies,
+		...pkg?.devDependencies
+	};
+	const isDocsSite = Boolean(deps["@theholocron/astro-config"] || deps["astro"]);
+	if (pkg?.private && isDocsSite) return "docs";
+	if (pkg?.private) return "app";
+	return "library";
+}
+const KNOWN_STACK_DEPS = [
+	"next",
+	"vite",
+	"astro",
+	"tsdown",
+	"rollup",
+	"webpack",
+	"storybook",
+	"vitest",
+	"playwright",
+	"turbo"
+];
+/**
+* Detected build/framework tooling — the literal "does this repo need
+* next/vite/tsdown" signal `holocron.config.ts` has no field for today
+* (framework choice isn't a config concept, unlike `providers`/`tasks`).
+* Curated table, not exhaustive by design — add to `KNOWN_STACK_DEPS` as new
+* frameworks show up rather than trying to detect anything on npm.
+*/
+function deriveStack(pkg) {
+	const deps = {
+		...pkg?.dependencies,
+		...pkg?.devDependencies
+	};
+	return KNOWN_STACK_DEPS.filter((name) => name in deps);
+}
+/** The provider capability keys actually wired in `providers: {}` — zero heuristics. */
+function deriveCapabilities(providers) {
+	return Object.keys(providers ?? {}).sort();
+}
+/**
+* `source` + `ci` are the minimal baseline every repo `holocron repo setup`
+* touches wires — every `holocron.config.ts` in this org already satisfies
+* this, so `non-compliant` here means drift (a provider manually removed
+* after setup), not an unmet aspirational policy. Deliberately not a richer
+* per-profile policy yet (e.g. "a `library` must have `deployment`") — that's
+* a Phase B (GitHub App) refinement once it can post *why* on a check run.
+*/
+const REQUIRED_BASELINE = ["source", "ci"];
+function deriveCompliance(capabilities) {
+	return REQUIRED_BASELINE.every((key) => capabilities.includes(key)) ? "compliant" : "non-compliant";
+}
+/**
+* The Phase B refinement `deriveCompliance()`'s own doc comment names —
+* *why* a repo is non-compliant, not just that it is. `[]` when compliant.
+* Same `REQUIRED_BASELINE` `deriveCompliance()` checks against — one
+* table, not two independently-maintained baselines.
+*/
+function missingCapabilities(capabilities) {
+	return REQUIRED_BASELINE.filter((key) => !capabilities.includes(key));
+}
+/**
+* Reads each workspace package's actual `package.json` content (not just
+* `readWorkspacePackages()`'s `{ slug, name, dir }` — `deriveProfile()`'s
+* `platform` detection needs `bin`, which that helper doesn't carry).
+* Missing/invalid files are skipped, matching `readWorkspacePackages()`'s
+* own soft-fail behavior.
+*/
+async function readWorkspacePackageJsons(repoRoot, workspacePackages) {
+	const results = [];
+	for (const { slug, dir = "packages" } of workspacePackages) {
+		const pkg = await readPackageJson(join(repoRoot, dir, slug));
+		if (pkg) results.push(pkg);
+	}
+	return results;
+}
+//#endregion
+//#region src/config/config/config.ts
 var ConfigError = class extends Error {
 	name = "ConfigError";
 };
@@ -217,11 +326,12 @@ function resolveConfig(raw) {
 		docs,
 		env: raw.env,
 		log: raw.log,
-		telemetry: raw.telemetry
+		telemetry: raw.telemetry,
+		eslint: raw.eslint
 	};
 }
 //#endregion
-//#region src/config/compose.ts
+//#region src/config/compose/compose.ts
 function taskName(e) {
 	return typeof e === "string" ? e : e.name;
 }
@@ -309,12 +419,12 @@ function compose(...args) {
 	};
 }
 //#endregion
-//#region src/config/define-config.ts
+//#region src/config/define-config/define-config.ts
 function defineConfig(config) {
 	return config;
 }
 //#endregion
-//#region src/config/load-config.ts
+//#region src/config/load-config/load-config.ts
 /**
 * `holocron.config.{ts,js,mjs,cjs,json}` loader.
 *
@@ -326,34 +436,39 @@ function defineConfig(config) {
 * Probe order is TS-first (`.ts` → `.js` → `.mjs` → `.cjs` → `.json`) —
 * see ADR-0010 / issue #75 / #81.
 */
-const execFileAsync = promisify(execFile);
 /**
-* Read + parse + resolve `holocron.config.*` from the given directory.
+* Read + parse + resolve `holocron.config.*` starting from the given
+* directory, walking up through ancestors to the nearest `.git` boundary
+* when `cwd` itself has no match — every command is usable from any
+* subdirectory of a repo, not only its exact root (see
+* `@theholocron/datapad`'s own doc comment for the stop conditions).
 * Throws {@link ConfigFileError} when nothing is found or a file cannot
-* be loaded, or `ConfigError` when the config is invalid.
+* be loaded, or `ConfigError` when the config fails schema checks.
 */
 async function loadConfig(cwd) {
 	const found = await loadConfigFile({
 		cwd,
-		name: "holocron"
+		name: "holocron",
+		walkUp: true
 	});
 	if (!found) throw new ConfigFileError$1(`no holocron.config.{ts,js,mjs,cjs,json} found in ${cwd}. Create one — see the README for the schema.`);
 	return {
-		resolved: resolveConfig(await deriveDefaults(dirname(found.filepath), found.config)),
+		resolved: resolveConfig(await deriveDefaults(found)),
 		filepath: found.filepath
 	};
 }
-async function deriveDefaults(configDir, raw) {
-	const result = { ...raw };
+async function deriveDefaults(found) {
+	const configDir = dirname(found.filepath);
+	const result = { ...found.config };
 	if (!result.name) result.name = await readPackageJsonName(configDir) ?? basename(configDir);
 	if (result.repo && !result.repo.name) {
-		const repoName = await readGitRemote(configDir);
-		if (repoName) result.repo = {
+		const remote = await readGitRemote(configDir);
+		if (remote?.host === "github.com") result.repo = {
 			...result.repo,
-			name: repoName
+			name: remote.slug
 		};
 	}
-	const manifest = await loadTasksConfig(configDir);
+	const manifest = await loadTasksConfig(configDir, { holocron: found });
 	if (manifest.tasks) result.tasks = manifest.tasks;
 	if (manifest.syncScripts !== void 0) result.syncScripts = manifest.syncScripts;
 	if (manifest.holocronScript !== void 0) result.holocronScript = manifest.holocronScript;
@@ -362,31 +477,8 @@ async function deriveDefaults(configDir, raw) {
 	return result;
 }
 async function readPackageJsonName(dir) {
-	try {
-		const content = await readFile(join(dir, "package.json"), "utf8");
-		const pkg = JSON.parse(content);
-		return typeof pkg.name === "string" ? pkg.name.replace(/^@[^/]+\//, "") : void 0;
-	} catch {
-		return;
-	}
-}
-async function readGitRemote(dir) {
-	try {
-		const { stdout } = await execFileAsync("git", [
-			"remote",
-			"get-url",
-			"origin"
-		], { cwd: dir });
-		return parseGitRemoteUrl(stdout.trim());
-	} catch {
-		return;
-	}
-}
-function parseGitRemoteUrl(url) {
-	const httpsMatch = url.match(/github\.com\/([^/]+\/[^/]+?)(?:\.git)?$/);
-	if (httpsMatch) return httpsMatch[1];
-	const sshMatch = url.match(/github\.com:([^/]+\/[^/]+?)(?:\.git)?$/);
-	if (sshMatch) return sshMatch[1];
+	const name = (await readPackageJson(dir))?.name;
+	return name === void 0 ? void 0 : name.replace(/^@[^/]+\//, "");
 }
 //#endregion
-export { AuthError, CARDINALITY, ConfigError, ConfigFileError, ProviderApiError, REQUIRED_CAPABILITIES, WebhookVerificationError, compose, createFeatureResolver, createResolveToken, createRestClient, defineConfig, deleteToken, getToken, isMulti, listStoredProviders, loadConfig, resolveConfig, resolveEntry, resolvePluginPackage, setToken };
+export { AuthError, CARDINALITY, ConfigError, ConfigFileError, ProviderApiError, REQUIRED_CAPABILITIES, WebhookVerificationError, compose, createFeatureResolver, createResolveToken, createRestClient, defineConfig, deleteToken, deriveCapabilities, deriveCompliance, deriveProfile, deriveStack, getToken, isMulti, listStoredProviders, loadConfig, missingCapabilities, readWorkspacePackageJsons, resolveConfig, resolveEntry, resolvePluginPackage, setToken };