@theholocron/cli 5.0.0-alpha.16 → 5.0.0-alpha.160

package/dist/plugin/capabilities.d.mts

@@ -1,5 +1,5 @@
 import { ProviderApiError } from "@theholocron/http-client";
-//#region src/plugin/capabilities.d.ts
+//#region src/plugin/capabilities/capabilities.type.d.ts
 /**
  * Capability interfaces — the contracts that providers implement.
  *
@@ -12,33 +12,8 @@ import { ProviderApiError } from "@theholocron/http-client";
  * See `docs/wiki/specifications/tech-architecture.spec.md` for the design narrative
  * (issue: #74).
  */
-type CapabilityKey = "source" | "ci" | "secrets" | "environments" | "issues" | "deployment" | "storage" | "auth" | "vault" | "dns" | "tooling" | "notifications" | "analytics" | "errors" | "logs" | "wiki" | "workers";
+type CapabilityKey = "source" | "ci" | "secrets" | "environments" | "issues" | "deployment" | "storage" | "auth" | "vault" | "dns" | "tooling" | "notifications" | "analytics" | "errors" | "logs" | "monitoring" | "wiki" | "workers";
 type Cardinality = "single" | "many";
-declare const CARDINALITY: {
-  readonly source: "single";
-  readonly ci: "single";
-  readonly secrets: "single";
-  readonly environments: "single";
-  readonly issues: "single";
-  readonly deployment: "single";
-  readonly storage: "single";
-  readonly auth: "single";
-  readonly vault: "single";
-  readonly dns: "single";
-  readonly tooling: "many";
-  readonly notifications: "many";
-  readonly analytics: "many";
-  readonly errors: "single";
-  readonly logs: "single";
-  readonly wiki: "single";
-  readonly workers: "single";
-};
-/**
- * No capabilities are strictly required — repos without secrets (e.g. org
- * community health repos) legitimately omit vault. Plugins validate their
- * own requirements at call time.
- */
-declare const REQUIRED_CAPABILITIES: readonly CapabilityKey[];
 interface ProviderIdentity {
   readonly key: CapabilityKey;
   readonly providerName: string;
@@ -364,9 +339,35 @@ interface DeploymentRecord {
   target?: DeploymentTrigger;
   status: "queued" | "building" | "ready" | "error" | "cancelled";
   createdAt?: string;
+  /** The provider's own reason when `status` is `"error"` (e.g. Vercel's `Command "npm install" exited with 1`). */
+  errorMessage?: string;
+}
+/** Config for `Deployment.deployFunction()` — source files, not a Git ref. */
+interface DeployFunctionConfig {
+  /**
+   * Files to deploy, keyed by path relative to the project root (e.g.
+   * `"api/webhook.js"`, `"package.json"`). Content is plain text — the
+   * provider handles any wire-format encoding.
+   */
+  files: Record<string, string>;
+  /**
+   * Named deployment target. Omit for a preview deployment — same
+   * semantics as `triggerDeployment`'s `target`.
+   */
+  target?: DeploymentTrigger;
+}
+interface DeployFunctionResult {
+  deploymentId: string;
+  url: string;
 }
 interface Deployment extends ProviderIdentity {
   readonly key: "deployment";
+  /**
+   * Custom domain declared in the deployment provider's configuration.
+   * `holocron repo setup` attaches it to the configured project and hands any
+   * returned verification record to the `dns` capability.
+   */
+  readonly domain?: string;
   listProjects(): Promise<DeploymentProject[]>;
   /** Create if missing, otherwise return existing. Idempotent. */
   ensureProject(input: {
@@ -390,6 +391,16 @@ interface Deployment extends ProviderIdentity {
     target?: DeploymentTrigger;
   }): Promise<DeploymentRecord>;
   getDeployment(deploymentId: string): Promise<DeploymentRecord>;
+  /**
+   * Deploy (or update) a project directly from source files, bypassing
+   * Git entirely — the non-git counterpart to `triggerDeployment`, for a
+   * consumer with no repo to link (a webhook receiver shipped as an npm
+   * package, for instance, rather than deployed from its own Git
+   * history). `projectId` may be a project name for providers that
+   * accept either. Optional — providers without a files-based deploy API
+   * omit this (e.g. Cloudflare Pages, git-source only today).
+   */
+  deployFunction?(projectId: string, config: DeployFunctionConfig): Promise<DeployFunctionResult>;
   /**
    * List preview deployments for a specific branch alias (e.g. "repo-pr-42").
    * Optional — providers that don't support listing by branch omit this.
@@ -402,10 +413,18 @@ interface Deployment extends ProviderIdentity {
   deletePreviewDeployments?(projectId: string, deploymentIds: string[]): Promise<number>;
   /**
    * Add a custom domain (or wildcard) to the project. Idempotent — no-op
-   * when the domain is already present. Optional: providers without a custom
-   * domain API omit this (e.g. Vercel manages domains separately).
+   * when the domain is already present. Optional: providers without a
+   * custom domain API omit this.
+   *
+   * Returns the DNS record needed to finish verification — `null` when
+   * the domain is already verified, or when the provider's API doesn't
+   * surface DNS-challenge details at all (e.g. Cloudflare Pages, whose
+   * custom-domain flow doesn't expose the same per-request verification
+   * handshake Vercel's does). Callers hand a non-null result straight
+   * to `dns.upsertRecord(result.zone, result.record)` — the exact
+   * pattern `setup` already uses for `Wiki.dnsRecord()`.
    */
-  ensureCustomDomain?(projectId: string, hostname: string): Promise<void>;
+  ensureCustomDomain?(projectId: string, hostname: string): Promise<DnsRecordRequest | null>;
 }
 interface StorageBranch {
   id: string;
@@ -517,9 +536,6 @@ interface ParseWebhookInput {
   /** The signing secret the auth provider issued for this webhook endpoint. */
   signingSecret: string;
 }
-declare class WebhookVerificationError extends Error {
-  name: string;
-}
 interface EnsureResult {
   /** True when the resource already existed (idempotent no-op). */
   alreadyExists: boolean;
@@ -573,11 +589,31 @@ interface DnsRecord {
   priority?: number;
   proxied?: boolean;
 }
+/**
+ * A DNS record a capability wants created, plus which zone it belongs
+ * to — the shape `Wiki.dnsRecord()` and `Deployment.ensureCustomDomain()`
+ * both hand off to `Dns.upsertRecord()`. Not tied to either capability;
+ * any provider that needs "here's a record, go create it" returns this.
+ */
+interface DnsRecordRequest {
+  /** Zone apex passed as the first argument to `dns.upsertRecord`. */
+  zone: string;
+  record: DnsRecord;
+}
 interface Dns extends ProviderIdentity {
   readonly key: "dns";
   listRecords(domain: string): Promise<DnsRecord[]>;
   upsertRecord(domain: string, record: DnsRecord): Promise<DnsRecord>;
   deleteRecord(domain: string, id: string): Promise<void>;
+  /**
+   * A `holocron doctor` smoke check with no specific domain to ask about —
+   * `listRecords` needs one, but doctor doesn't have one on hand. Verifies
+   * the token and reports how many zones it can see.
+   */
+  whoami?(): Promise<{
+    ok: boolean;
+    zones: number;
+  }>;
 }
 interface Errors extends ProviderIdentity {
   readonly key: "errors";
@@ -614,6 +650,74 @@ interface Logs extends ProviderIdentity {
     alreadyExists: boolean;
   }>;
 }
+type MonitoringAssertionSource = "status_code" | "response_time" | "body" | "header";
+type MonitoringAssertionComparison = "equals" | "not_equals" | "contains" | "not_contains" | "greater_than" | "less_than";
+interface MonitoringAssertion {
+  source: MonitoringAssertionSource;
+  comparison: MonitoringAssertionComparison;
+  /** Header name / JSON path — required when `source` needs one (e.g. `"header"`). */
+  property?: string;
+  target?: string;
+}
+type MonitoringHttpMethod = "GET" | "POST" | "PUT" | "HEAD" | "DELETE" | "PATCH";
+interface MonitoringCheckInput {
+  /** Also the idempotency key — `ensureCheck` finds-or-creates by this name. */
+  name: string;
+  url: string;
+  method?: MonitoringHttpMethod;
+  /** Minutes between runs. Adapters round to their own supported values. */
+  frequency?: number;
+  assertions?: MonitoringAssertion[];
+  activated?: boolean;
+  /**
+   * Provider-specific region/datacenter ids to run the check from (e.g.
+   * Checkly's `"us-east-1"`). Required by some providers — there's no
+   * universal default; an account with none configured rejects a check
+   * that omits this entirely.
+   */
+  locations?: string[];
+  /**
+   * Inverts pass/fail: set this when the check's expected-healthy
+   * response is itself an HTTP error status (e.g. asserting a 404/405
+   * on an endpoint that should reject certain requests). Without it,
+   * most providers classify any 4xx/5xx response as a failure at the
+   * platform level *before* evaluating `assertions` at all — a custom
+   * assertion that matches the "expected" error status does not
+   * override that baseline classification on its own.
+   */
+  shouldFail?: boolean;
+  /**
+   * Raw request body to send with the check — e.g. simulating a webhook
+   * delivery to verify signature/auth checking is wired correctly
+   * end-to-end, rather than just confirming the endpoint is reachable.
+   * Omitted entirely by default (no body sent).
+   */
+  body?: string;
+}
+interface MonitoringCheck {
+  id: string;
+  name: string;
+}
+interface Monitoring extends ProviderIdentity {
+  readonly key: "monitoring";
+  /**
+   * Checks this provider is configured to ensure exist — populated from
+   * the provider's own config (`holocron.config.ts`'s provider tuple),
+   * the same place `Deployment.domain` comes from. `holocron repo setup`
+   * loops this list and calls `ensureCheck` for each; empty when none
+   * are configured.
+   */
+  readonly checks: readonly MonitoringCheckInput[];
+  /** Auth sanity-check. Throws ProviderApiError on auth failure. */
+  whoami?(): Promise<{
+    ok: boolean;
+  }>;
+  /** Idempotent find-or-create-or-update by `input.name`. */
+  ensureCheck(input: MonitoringCheckInput): Promise<{
+    check: MonitoringCheck;
+    alreadyExists: boolean;
+  }>;
+}
 interface ToolingDoctorReport {
   ok: boolean;
   message: string;
@@ -651,18 +755,6 @@ interface WikiProvisionOpts {
   /** Project display name used in the wiki title (e.g. "Holocron"). */
   name?: string;
 }
-/**
- * DNS record that `setup` should create for a wiki custom domain.
- * Returned by `Wiki.dnsRecord()` when a custom domain is configured.
- */
-interface WikiDnsRecord {
-  /** Zone apex passed as the first argument to `dns.upsertRecord`. */
-  zone: string;
-  /** Full hostname for the CNAME (e.g. "wiki.theholocron.dev"). */
-  cname: string;
-  /** CNAME target (e.g. "holocron.docs.buildwithfern.com"). */
-  target: string;
-}
 /**
  * Reverse-proxy configuration returned by `Wiki.proxyConfig()`.
  * Used by `setup` to deploy a Worker that forwards traffic to the wiki
@@ -691,7 +783,7 @@ interface Wiki extends ProviderIdentity {
    * Returns null when no custom domain is set.
    * Called by `setup` to provision the CNAME via the `dns` capability.
    */
-  dnsRecord?(): WikiDnsRecord | null;
+  dnsRecord?(): DnsRecordRequest | null;
   /**
    * Reverse-proxy config when the wiki provider requires a Worker-level
    * proxy in addition to the CNAME. Returns null when no proxy is needed.
@@ -699,12 +791,34 @@ interface Wiki extends ProviderIdentity {
    */
   proxyConfig?(): WikiProxyConfig | null;
 }
+/** Config for `Workers.deployScript()` — an arbitrary Worker, not a generated reverse-proxy. */
+interface DeployScriptConfig {
+  /** The full Worker script source — a single ES module (`export default { fetch(...) {...} }`). */
+  code: string;
+  /**
+   * Secret bindings — `env.<name>` in the deployed Worker. Values are
+   * write-only; the provider never echoes them back, here or anywhere else.
+   */
+  secrets?: Record<string, string>;
+  /**
+   * Route pattern(s) this Worker should serve (e.g.
+   * `"sentinel.theholocron.dev/*"`). Omit for a Worker reached only via
+   * its `*.workers.dev` URL.
+   */
+  routes?: string[];
+}
+interface DeployScriptResult {
+  /** The deployed script's name at the provider. */
+  scriptName: string;
+}
 /**
- * Edge Worker / reverse-proxy management capability.
+ * Edge Worker management capability.
  *
- * Deploys and manages Worker scripts that proxy traffic to a configured
- * target. Used by `setup` to wire wiki custom-domain proxies when the
- * wiki provider requires a Worker in addition to the CNAME.
+ * Deploys and manages Worker scripts. `upsertProxy` is the existing,
+ * narrower case `setup` uses to wire wiki custom-domain reverse-proxies;
+ * `deployScript` is the general case — any Worker, any code, its own
+ * secrets — for a consumer that isn't a reverse-proxy (a webhook
+ * receiver, for instance).
  */
 interface Workers extends ProviderIdentity {
   readonly key: "workers";
@@ -714,6 +828,17 @@ interface Workers extends ProviderIdentity {
    * `config.headers` on each request.
    */
   upsertProxy(hostname: string, config: WikiProxyConfig): Promise<void>;
+  /** Deploy (or update) an arbitrary Worker script, optionally with secrets and routes. */
+  deployScript(name: string, config: DeployScriptConfig): Promise<DeployScriptResult>;
+  /**
+   * A `holocron doctor` smoke check — every other method either mutates or
+   * needs a specific script/zone doctor has no way to supply up front.
+   * Reports how many Worker scripts the token can see.
+   */
+  whoami?(): Promise<{
+    ok: boolean;
+    scripts: number;
+  }>;
 }
 interface CapabilityImpls {
   source: Source;
@@ -731,12 +856,44 @@ interface CapabilityImpls {
   analytics: Analytics;
   errors: Errors;
   logs: Logs;
+  monitoring: Monitoring;
   wiki: Wiki;
   workers: Workers;
 }
 type CardinalityFor<K extends CapabilityKey> = (typeof CARDINALITY)[K];
 /** Resolved runtime shape: single → one impl; many → array. */
 type ResolvedCapability<K extends CapabilityKey> = CardinalityFor<K> extends "many" ? CapabilityImpls[K][] : CapabilityImpls[K];
+//#endregion
+//#region src/plugin/capabilities/capabilities.d.ts
+declare const CARDINALITY: {
+  readonly source: "single";
+  readonly ci: "single";
+  readonly secrets: "single";
+  readonly environments: "single";
+  readonly issues: "single";
+  readonly deployment: "single";
+  readonly storage: "single";
+  readonly auth: "single";
+  readonly vault: "single";
+  readonly dns: "single";
+  readonly tooling: "many";
+  readonly notifications: "many";
+  readonly analytics: "many";
+  readonly errors: "single";
+  readonly logs: "single";
+  readonly monitoring: "single";
+  readonly wiki: "single";
+  readonly workers: "single";
+};
+/**
+ * No capabilities are strictly required — repos without secrets (e.g. org
+ * community health repos) legitimately omit vault. Plugins validate their
+ * own requirements at call time.
+ */
+declare const REQUIRED_CAPABILITIES: readonly CapabilityKey[];
+declare class WebhookVerificationError extends Error {
+  name: string;
+}
 declare function isMulti<K extends CapabilityKey>(key: K): CardinalityFor<K> extends "many" ? true : false;
 //#endregion
-export { Analytics, Auth, AuthDescription, AuthEvent, AuthEventType, AuthIdentity, AuthUser, CARDINALITY, CapabilityImpls, CapabilityKey, Cardinality, CardinalityFor, Ci, CiRun, CiRunFilter, CiRunStatus, ConnectionStringOptions, CreateAuthUserInput, Deployment, DeploymentProject, DeploymentProjectSettings, DeploymentRecord, DeploymentTarget, DeploymentTrigger, Dns, DnsRecord, DnsRecordType, EnsureResult, Environment, EnvironmentReviewer, Environments, Errors, Issue, IssueSearchFilter, Issues, LabelDef, LifecycleResult, LifecycleSlot, Logs, NormalizedAuthUser, Notifications, PagesConfig, ParseWebhookInput, ProviderApiError, ProviderIdentity, PullRequest, REQUIRED_CAPABILITIES, RepoRef, RepoSettings, ResolvedCapability, Ruleset, SecretScope, Secrets, Source, StatusCategory, Storage, StorageBranch, TeamEntry, TeamPermission, Tooling, ToolingDoctorReport, TrackerDoctorReport, TrackerUser, Vault, WebhookDashboardInfo, WebhookVerificationError, Wiki, WikiDnsRecord, WikiProvisionOpts, WikiProxyConfig, Workers, isMulti };
+export { Analytics, Auth, AuthDescription, AuthEvent, AuthEventType, AuthIdentity, AuthUser, CARDINALITY, CapabilityImpls, CapabilityKey, Cardinality, CardinalityFor, Ci, CiRun, CiRunFilter, CiRunStatus, ConnectionStringOptions, CreateAuthUserInput, DeployFunctionConfig, DeployFunctionResult, DeployScriptConfig, DeployScriptResult, Deployment, DeploymentProject, DeploymentProjectSettings, DeploymentRecord, DeploymentTarget, DeploymentTrigger, Dns, DnsRecord, DnsRecordRequest, DnsRecordType, EnsureResult, Environment, EnvironmentReviewer, Environments, Errors, Issue, IssueSearchFilter, Issues, LabelDef, LifecycleResult, LifecycleSlot, Logs, Monitoring, MonitoringAssertion, MonitoringAssertionComparison, MonitoringAssertionSource, MonitoringCheck, MonitoringCheckInput, MonitoringHttpMethod, NormalizedAuthUser, Notifications, PagesConfig, ParseWebhookInput, ProviderApiError, ProviderIdentity, PullRequest, REQUIRED_CAPABILITIES, RepoRef, RepoSettings, ResolvedCapability, Ruleset, SecretScope, Secrets, Source, StatusCategory, Storage, StorageBranch, TeamEntry, TeamPermission, Tooling, ToolingDoctorReport, TrackerDoctorReport, TrackerUser, Vault, WebhookDashboardInfo, WebhookVerificationError, Wiki, WikiProvisionOpts, WikiProxyConfig, Workers, isMulti };

package/dist/plugin/capabilities.mjs

@@ -1,5 +1,5 @@
 import { ProviderApiError } from "@theholocron/http-client";
-//#region src/plugin/capabilities.ts
+//#region src/plugin/capabilities/capabilities.ts
 const CARDINALITY = {
 	source: "single",
 	ci: "single",
@@ -16,6 +16,7 @@ const CARDINALITY = {
 	analytics: "many",
 	errors: "single",
 	logs: "single",
+	monitoring: "single",
 	wiki: "single",
 	workers: "single"
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theholocron/cli",
-  "version": "5.0.0-alpha.16",
+  "version": "5.0.0-alpha.160",
   "description": "The Holocron CLI - a pluggable, capability-based orchestrator for spinning up and operating software projects.",
   "keywords": [
     "cli",
@@ -46,24 +46,31 @@
     "@napi-rs/keyring": "^1.3.0",
     "@sentry/node": "^10.70.0",
     "@theholocron/components-doc": "^1.6.0",
-    "@theholocron/env-utils": "^1.6.0",
-    "@theholocron/github-client": "^1.17.0",
-    "@theholocron/http-client": "^1.17.0",
-    "@theholocron/observability": "^0.3.0",
+    "@theholocron/env-utils": "^1.15.1",
+    "@theholocron/fs-utils": "^1.15.1",
+    "@theholocron/git-utils": "^1.15.1",
+    "@theholocron/github-client": "^1.42.1",
+    "@theholocron/http-client": "^1.42.1",
+    "@theholocron/json-utils": "^1.15.1",
+    "@theholocron/misc-utils": "^1.15.1",
+    "@theholocron/observability": "^0.6.0",
+    "@theholocron/pkg-utils": "^1.15.1",
     "@theholocron/registry-doc": "^1.12.0",
     "chalk": "^6.0.0",
+    "dotenv": "^17.4.2",
     "ora": "^9.4.1",
     "pino": "^10.3.1",
     "pino-pretty": "^13.1.3",
     "posthog-node": "^5.51.6",
     "yargs": "^18.1.0",
-    "@theholocron/astromech": "5.0.0-alpha.16",
-    "@theholocron/datapad": "5.0.0-alpha.16"
+    "@theholocron/astromech": "5.0.0-alpha.160",
+    "@theholocron/datapad": "5.0.0-alpha.160"
   },
   "devDependencies": {
-    "@theholocron/eslint-config": "^8.0.0",
-    "@theholocron/tsconfig": "^8.0.0",
-    "@theholocron/vitest-config": "^8.0.0",
+    "@theholocron/eslint-config": "^8.8.0",
+    "@theholocron/rollup-plugin-transform-template": "^8.8.0",
+    "@theholocron/tsconfig": "^8.8.0",
+    "@theholocron/vitest-config": "^8.8.0",
     "@types/node": "^26",
     "@types/yargs": "^17.0.35",
     "@vitest/coverage-v8": "^4.1.11",
@@ -74,8 +81,7 @@
     "tsdown": "^0.22.14",
     "tsx": "4.23.12",
     "typescript": "^5.9.3",
-    "vitest": "^4.1.11",
-    "@theholocron/rollup-plugin-transform-template": "5.0.0-alpha.16"
+    "vitest": "^4.1.11"
   },
   "engines": {
     "node": ">=22.0.0"