@theholocron/cli 5.0.0-alpha.176 → 5.0.0-alpha.178

package/dist/cli.mjs

@@ -3,7 +3,7 @@ import { createRequire } from "node:module";
 import { existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, statSync, writeFileSync } from "node:fs";
 import { homedir, hostname, tmpdir, userInfo } from "node:os";
 import path, { basename, dirname, join, relative, resolve, sep } from "node:path";
-import { checkbox, confirm, input, select } from "@inquirer/prompts";
+import { checkbox, confirm, input, password, select } from "@inquirer/prompts";
 import { KNOWN_WORKFLOWS, createAlexignore, createAlexrc, createAstromech, createCommitMsg, createDependabot, createDevmoji, createEditorconfig, createEditorconfigChecker, createHeader, createLabeler, createPreCommit, createPrePush, createPrepareCommitMsg, createYamlignore, createYamllint, defaultListDirs, defaultPaths, defaultReadJson, deployOnRelease, extractPreviewConfig, readWorkspacePackages, reusableTemplates, workspacePackages } from "@theholocron/astromech";
 import { loadTasksConfig } from "@theholocron/astromech/config";
 import { lintCommitMsgFile } from "@theholocron/astromech/lint";
@@ -691,7 +691,8 @@ function searchChoices(items, term) {
 	return [...pool].sort((a, b) => rank(a) - rank(b)).map((i) => ({
 		name: i.name,
 		value: i.value,
-		description: i.description
+		description: i.description,
+		short: i.name.replace(/ ›$/, "")
 	}));
 }
 //#endregion
@@ -750,6 +751,200 @@ async function withSpinner(label, fn) {
 	}
 }
 //#endregion
+//#region src/ui/prompt-options/prompt-options.ts
+/**
+* A required option must not resolve to an empty answer — `optionArgv`/
+* `secretEnv` (child-argv.ts) both drop an empty-string value entirely,
+* which would silently invoke the child without a flag the caller asked
+* for. Passed as `validate` so inquirer re-prompts instead of accepting it.
+*/
+const requireNonEmpty = (value) => value.trim().length > 0 || "required";
+async function promptOne(option) {
+	if (option.secret || option.type === "password") return await password({
+		message: option.message,
+		...option.required ? { validate: requireNonEmpty } : {}
+	});
+	if (option.type === "confirm") return await confirm({
+		message: option.message,
+		default: option.default
+	});
+	if (option.type === "select") {
+		const choices = typeof option.choices === "function" ? option.choices() : option.choices ?? [];
+		return await select({
+			message: option.message,
+			choices: choices.map((c) => ({ value: c }))
+		});
+	}
+	if (option.arity && option.arity > 1) {
+		const values = [];
+		for (let n = 0; n < option.arity; n++) values.push(await input({
+			message: `${option.message} (${n + 1} of ${option.arity})`,
+			...option.required ? { validate: requireNonEmpty } : {}
+		}));
+		return values;
+	}
+	return await input({
+		message: option.message,
+		default: option.default,
+		...option.required ? { validate: requireNonEmpty } : {}
+	});
+}
+/**
+* For each of `options` not already present in `argv`, resolves a value —
+* `required` ones are always included, like required positionals, never
+* behind a selector; everything else is offered through one `checkbox()`
+* ("set any options?") and only the picked ones are then prompted in
+* `options`' own declaration order. An empty list (or every optional one
+* left unpicked) means zero prompts.
+*
+* A picked option (whether required or checkbox-picked) with
+* `askLast: true` (holocron#1052 follow-up — a time-sensitive secret like
+* an OTP, which should be typed as close as possible to when it's actually
+* used, or one that's always needed for a specific operator's own account
+* but not everyone's) isn't given a value here yet: it's returned in
+* `deferred` instead, for the caller to resolve via
+* `promptForDeferredOptions` right before the real (non-dry-run) spawn.
+*
+* `when`, evaluated against answers collected so far in that same
+* declaration order, can skip a picked option entirely. Skipped this way,
+* the option is simply absent from the result, exactly as if it had never
+* been picked — acceptable for a minor, genuinely optional dependency, but
+* prefer `OptionMode` (see `promptForOptions`) when the options have a
+* real either/or relationship, so nothing contingent is shown at all.
+*/
+async function promptForFlatOptions(commandName, options, argv) {
+	if (options.length === 0) return {
+		answers: {},
+		deferred: []
+	};
+	const answers = {};
+	const deferred = [];
+	const needsPrompt = (option) => {
+		const existing = argv[option.key];
+		return existing === void 0 || existing === "";
+	};
+	const required = options.filter((o) => o.required);
+	const optional = options.filter((o) => !o.required);
+	if ((required.some(needsPrompt) || optional.some(needsPrompt)) && !process.stdin.isTTY) throw new NonInteractiveError(`\`${commandName}\` has options only settable interactively — pass them directly: holocron ${commandName} [options]`);
+	for (const option of required) {
+		if (!needsPrompt(option)) {
+			answers[option.key] = argv[option.key];
+			continue;
+		}
+		if (option.askLast) {
+			deferred.push(option);
+			continue;
+		}
+		answers[option.key] = await promptOne(option);
+	}
+	for (const option of optional) if (!needsPrompt(option)) answers[option.key] = argv[option.key];
+	const selectable = optional.filter(needsPrompt);
+	if (selectable.length === 0) return {
+		answers,
+		deferred
+	};
+	const picked = await checkbox({
+		message: "Set any options? (space to select, enter to skip)",
+		choices: selectable.map((o) => ({
+			name: o.message,
+			value: o.key
+		}))
+	});
+	if (picked.length === 0) return {
+		answers,
+		deferred
+	};
+	const pickedSet = new Set(picked);
+	for (const option of optional) {
+		if (!pickedSet.has(option.key)) continue;
+		if (option.when && !option.when(answers)) continue;
+		if (option.askLast) {
+			deferred.push(option);
+			continue;
+		}
+		answers[option.key] = await promptOne(option);
+	}
+	return {
+		answers,
+		deferred
+	};
+}
+/**
+* For a `modes`-based command (holocron#1052 follow-up): asks which
+* mutually exclusive workflow first ("What would you like to do?"), then
+* offers only that mode's own options, via the exact same
+* `promptForFlatOptions` flow. The picked mode's `flag`, if it has one, is
+* folded in as an already-resolved `confirm`-type option so
+* `buildChildArgv` renders it with no special-casing — it just sees
+* another boolean option whose answer happens to already be `true`.
+*/
+async function promptForModes(entry, modes, argv) {
+	if (!process.stdin.isTTY) throw new NonInteractiveError(`\`${entry.name}\` has options only settable interactively — pass them directly: holocron ${entry.name} [options]`);
+	const modeKey = await select({
+		message: "What would you like to do?",
+		choices: modes.map((m) => ({
+			name: m.message,
+			value: m.key,
+			description: m.description
+		}))
+	});
+	const mode = modes.find((m) => m.key === modeKey);
+	const options = mode.options ?? [];
+	const { answers, deferred } = await promptForFlatOptions(entry.name, options, argv);
+	if (!mode.flag) return {
+		options,
+		answers,
+		deferred
+	};
+	const flagOption = {
+		key: `__mode_${mode.key}`,
+		flag: mode.flag,
+		type: "confirm",
+		message: mode.message
+	};
+	return {
+		options: [flagOption, ...options],
+		answers: {
+			[flagOption.key]: true,
+			...answers
+		},
+		deferred
+	};
+}
+/**
+* Resolves `entry`'s options into a {@link ResolvedOptions} ready for
+* `buildChildArgv`/`secretEnv` — delegating to {@link promptForModes} when
+* `entry.modes` is set, or treating `entry.options` as a flat list
+* otherwise. See `promptForFlatOptions` for the flat-list prompting
+* algorithm itself. `result.deferred` still needs
+* {@link promptForDeferredOptions} before the real spawn.
+*/
+async function promptForOptions(entry, argv) {
+	if (entry.modes && entry.modes.length > 0) return promptForModes(entry, entry.modes, argv);
+	const options = entry.options ?? [];
+	const { answers, deferred } = await promptForFlatOptions(entry.name, options, argv);
+	return {
+		options,
+		answers,
+		deferred
+	};
+}
+/**
+* Collects a value for each of `deferred` — the `askLast: true` options
+* `promptForOptions` deliberately left unresolved. Call this as the very
+* last thing before the real (non-dry-run) spawn, never before: a dry-run
+* preview never reaches the real npm call these options exist for (an OTP
+* is never checked during `--dry-run`), and a time-sensitive code typed
+* any earlier — before a dry-run preview runs, before "proceed with the
+* real run?" waits on a human — risks going stale before it's actually
+* used. A no-op (no prompt at all) when `deferred` is empty.
+*/
+async function promptForDeferredOptions(deferred) {
+	const answers = {};
+	for (const option of deferred) answers[option.key] = await promptOne(option);
+	return answers;
+}
+//#endregion
 //#region src/ui/prompt-positionals/prompt-positionals.ts
 /**
 * For each of `entry.positionals` not already present in `argv`, prompts for
@@ -2257,7 +2452,7 @@ async function runDoctor(input) {
 			capability: row.capability,
 			provider: row.provider,
 			status: row.status,
-			detail: row.message
+			detail: row.logMessage ?? row.message
 		}, `doctor: ${row.capability}`);
 		print(statusRow(row.status, [`${pad(row.capability, 14)} via ${pad(row.provider, 14)}`, row.message]));
 	}
@@ -2296,8 +2491,33 @@ async function smokeCheck(key, provider, impl) {
 	try {
 		return await withTimeout(runSmokeCheck(key, provider, impl), SMOKE_CHECK_TIMEOUT_MS);
 	} catch (err) {
-		return mk(key, provider, "fail", errorMessage(err));
+		return mk(key, provider, "fail", smokeCheckErrorMessage(err), errorMessage(err));
+	}
+}
+/** Vendor response bodies land in the terminal — cap their length so one
+*  oversized error can't flood the report, and strip control characters
+*  (newlines included) so a crafted body can't forge extra report lines
+*  or inject terminal escape sequences. */
+const MAX_DETAIL_LENGTH = 200;
+function sanitizeDetail(text) {
+	const stripped = text.replace(/[\x00-\x1f\x7f]/g, " ").replace(/\s+/g, " ").trim();
+	return stripped.length > MAX_DETAIL_LENGTH ? `${stripped.slice(0, MAX_DETAIL_LENGTH)}…` : stripped;
+}
+/**
+* `errorMessage(err)` alone is just `"<Vendor> <METHOD> <path> → <status>"` —
+* the actual reason (what the vendor's response body said) lives in
+* `ProviderApiError.details`, a raw response-body string (not parsed JSON —
+* see AGENTS.md), and was being silently dropped. Appending it (sanitized
+* and length-capped — see `sanitizeDetail`) turns e.g. a bare "→ 400" into
+* something that actually explains itself, without the vendor text being
+* able to overwhelm or manipulate the terminal report.
+*/
+function smokeCheckErrorMessage(err) {
+	if (err instanceof ProviderApiError$1 && err.details) {
+		const detail = sanitizeDetail(String(err.details));
+		if (detail) return `${errorMessage(err)}: ${detail}`;
 	}
+	return errorMessage(err);
 }
 async function runSmokeCheck(key, provider, impl) {
 	switch (key) {
@@ -2365,12 +2585,13 @@ async function runSmokeCheck(key, provider, impl) {
 function countResolvedLifecycle(report) {
 	return `${report.lifecycle.filter((l) => l.resolved).length}/${report.lifecycle.length} lifecycle slots ready`;
 }
-function mk(capability, provider, status, message) {
+function mk(capability, provider, status, message, logMessage) {
 	return {
 		capability,
 		provider,
 		status,
-		message
+		message,
+		...logMessage !== void 0 ? { logMessage } : {}
 	};
 }
 //#endregion
@@ -4155,8 +4376,22 @@ function printNextSteps$1(print, inputs) {
 	print("    7. Commit + push when capability is functionally complete.");
 }
 //#endregion
+//#region src/commands/publish/resolve-otp.ts
+/**
+* `argvOtp` if given, else the `HOLOCRON_OTP` env var — the secret-delivery
+* side of the interactive menu's options prompt (holocron#1052): a
+* menu-launched `package publish` delivers `--otp` through this env var
+* instead of argv, since `ps` and shell history both expose a child's argv
+* but never its env. A direct `holocron package publish --otp <code>`
+* invocation is unaffected; the flag always wins when both are present.
+*/
+function resolveOtp(argvOtp, env) {
+	return argvOtp ?? env.get("HOLOCRON_OTP");
+}
+//#endregion
 //#region src/commands/publish/default-exec.ts
 const defaultExec$1 = async (cmd, args, opts) => {
+	const { HOLOCRON_OTP: _omittedOtp, ...env } = process.env;
 	const result = spawnSync(cmd, args, {
 		cwd: opts.cwd,
 		encoding: "utf8",
@@ -4164,7 +4399,8 @@ const defaultExec$1 = async (cmd, args, opts) => {
 			"inherit",
 			"pipe",
 			"pipe"
-		]
+		],
+		env
 	});
 	return {
 		exitCode: result.status ?? -1,
@@ -4218,46 +4454,117 @@ function discoverManifests(cwd) {
 	}));
 }
 //#endregion
-//#region src/commands/publish/discover-public-packages.ts
-/** The names of `discoverPublicPackageEntries`' packages, without requiring a version. */
-function discoverPublicPackages(cwd) {
-	return discoverManifests(cwd).flatMap(({ manifest }) => !manifest.private && manifest.name ? [manifest.name] : []);
+//#region src/commands/publish/discover-public-package-entries.ts
+/**
+* Every public package (`!private && name`) with its version and a
+* `pnpm --filter`-ready path — {@link runSteadyPublish}'s `skipAlreadyPublished`
+* mode needs both to check `npm view <pkg>@<version>` and publish one
+* workspace at a time.
+*/
+function discoverPublicPackageEntries(cwd) {
+	return discoverManifests(cwd).flatMap(({ manifest, dir }) => !manifest.private && manifest.name && manifest.version ? [{
+		name: manifest.name,
+		version: manifest.version,
+		dir
+	}] : []);
+}
+//#endregion
+//#region src/commands/publish/filter-new-packages.ts
+/**
+* Keeps only the entries that don't exist on npm yet — the actual
+* chicken-and-egg case `--initial` exists for (ADR: npm requires a package
+* to exist before Trusted Publishing can be configured on it). Once a name
+* exists on npm at all, regardless of version, Trusted Publishing can
+* already be configured for it and every later version goes through the
+* steady-state publish instead — re-running `--initial` against it would
+* just hit a stale `pnpm publish` with no `--skip-already-published` safety
+* net. Existence, not version: unlike the steady-state publish's own
+* already-published check, this intentionally ignores the local version —
+* a package that exists on npm at an older version is still not `--initial`'s
+* problem.
+*
+* Prints one `statusRow("skip", …)` line per already-published entry as it
+* finds them — same shape `clone` uses for an already-cloned repo, with the
+* registry's own version (not the local one) in the message, since that's
+* what "already published" actually means — so the caller's own summary
+* line is the only other thing it needs to print. `nameWidth`/`dirWidth`
+* (computed by the caller across every discovered entry, not just the ones
+* landing here) keep these rows column-aligned with the "would
+* publish"/"published" rows the caller prints afterward for the entries
+* that come back from this function — the two sets only read as one table
+* when both pad to the same widths.
+*/
+async function filterNewPackages(entries, cwd, exec, print, nameWidth, dirWidth) {
+	const results = [];
+	for (const entry of entries) {
+		const view = await exec("npm", [
+			"view",
+			entry.name,
+			"version"
+		], { cwd });
+		const publishedVersion = view.exitCode === 0 ? view.stdout.trim() : "";
+		if (publishedVersion) {
+			print(statusRow("skip", [
+				pad(entry.name, nameWidth),
+				pad(entry.dir, dirWidth),
+				`already published (v${publishedVersion})`
+			]));
+			continue;
+		}
+		results.push(entry);
+	}
+	return results;
 }
 //#endregion
 //#region src/commands/publish/print-next-steps.ts
-function printNextSteps(print, env, packageNames, repoName) {
+function printNextSteps(print, env, packageNames, identity) {
+	print("");
+	print("→ next: configure Trusted Publisher for each package on npm:");
+	print("    Publisher: GitHub Actions");
+	print("    Label: Holocron Release");
+	print(`    Organization: ${identity.owner}`);
+	print(`    Repository: ${identity.repo}`);
+	print("    Workflow filename: delivery.publish.yml");
 	print("");
-	print("  → next: configure Trusted Publisher for each package on npm:");
+	print("→ packages to be published:");
 	for (const name of packageNames) print(`    https://www.npmjs.com/package/${name}/access`);
-	print(`    Publisher: GitHub Actions   Org: theholocron   Repo: ${repoName}   Workflow: delivery.publish.yml`);
 	if (env.get("NPM_TOKEN")) {
 		print("");
-		print("  → cleanup: $NPM_TOKEN was used. Revoke it now (no API for self-revoke; UI-only):");
+		print("→ cleanup: $NPM_TOKEN was used. Revoke it now (no API for self-revoke; UI-only):");
 		print("    https://www.npmjs.com/settings/~/tokens");
 	}
 }
 //#endregion
-//#region src/commands/publish/resolve-repo-name.ts
-async function resolveRepoName(cwd, exec) {
-	return (await readGitRemote(cwd, { exec: async (args, options) => {
-		const result = await exec("git", args, options);
-		if (result.exitCode !== 0) throw new Error(`git ${args.join(" ")} exited ${result.exitCode}`);
-		return result.stdout;
-	} }))?.repo ?? "unknown";
+//#region src/commands/publish/redact-otp.ts
+/**
+* Replaces the literal `otp` value in a "would run: pnpm ..." dry-run
+* preview line with `***` — the real `args` passed to `exec()` still need
+* the raw OTP (npm's own `--otp` flag has no env-var alternative), but the
+* preview is printed straight to the terminal / captured as dry-run output
+* and must never echo a live 2FA code back out.
+*/
+function redactOtp(args, otp) {
+	if (!otp) return [...args];
+	return args.map((arg) => arg === otp ? "***" : arg);
 }
 //#endregion
-//#region src/commands/publish/workspace-filter-args.ts
+//#region src/commands/publish/resolve-repo-identity.ts
 /**
-* `-r --filter=./packages/* --filter=./plugins/*` — whichever workspace
-* roots exist. Empty (single-package repo, no `-r`) when neither does.
-* Shared by every `pnpm publish` invocation below so a repo with only
-* `plugins/*` (or both) is covered the same as `packages/*`-only.
+* One git-remote read for both the org and repo shown in the Trusted
+* Publisher next-steps output — `readGitRemote` already parses out `owner`
+* alongside `repo`, so there's no reason to shell out to git twice for the
+* two halves of the same remote URL.
 */
-function workspaceFilterArgs(cwd) {
-	const filters = [];
-	if (hasPackagesDir(cwd)) filters.push("--filter=./packages/*");
-	if (hasPluginsDir(cwd)) filters.push("--filter=./plugins/*");
-	return filters.length > 0 ? ["-r", ...filters] : [];
+async function resolveRepoIdentity(cwd, exec) {
+	const remote = await readGitRemote(cwd, { exec: async (args, options) => {
+		const result = await exec("git", args, options);
+		if (result.exitCode !== 0) throw new Error(`git ${args.join(" ")} exited ${result.exitCode}`);
+		return result.stdout;
+	} });
+	return {
+		owner: remote?.owner ?? "unknown",
+		repo: remote?.repo ?? "unknown"
+	};
 }
 //#endregion
 //#region src/commands/publish/run-publish/run-publish.ts
@@ -4287,10 +4594,31 @@ function workspaceFilterArgs(cwd) {
 * outside the semantic-release/OIDC steady state) isn't built yet; the flag
 * exists so the surface doesn't need another rename when it is.
 *
+* Self-narrowing: a package that already exists on npm (any version) isn't
+* the chicken-and-egg case anymore — Trusted Publishing can already be
+* configured for it, and every later version goes through the steady-state
+* publish instead. So every publicly publishable package on disk is checked
+* against the registry first, and only the ones that don't exist yet are
+* actually targeted. Re-running `--initial` after adding one new package to
+* an already-bootstrapped monorepo publishes just that one. Nothing left to
+* bootstrap is reported as a success, not a failure.
+*
 * If `NPM_TOKEN` is detected in env, the command prints a final
 * "revoke this token at <url>" reminder — same pattern as `rando vc
 * setup` for the ephemeral GH admin PAT.
 */
+/**
+* The same `N <verb>, N failed, N skipped` shape `clone` ends on, styled the
+* same way (dim for a dry-run preview, success/fail for the real thing) —
+* `--initial` publishes in one atomic `pnpm publish` call rather than
+* `clone`'s per-repo loop, so `failedCount` is always either 0 or every
+* targeted package at once, never a partial count.
+*/
+function printSummary(print, dryRun, publishedCount, failedCount, skippedCount) {
+	const summary = `${publishedCount} published, ${failedCount} failed, ${skippedCount} skipped`;
+	print("");
+	print(dryRun ? style.dim(`  dry-run: ${summary}`) : failedCount > 0 ? style.fail(`  ${summary}`) : style.success(`  ${summary}`));
+}
 async function runPublish(input = {}) {
 	const print = input.print ?? ((line) => console.log(line));
 	const logger = input.logger ?? getLogger();
@@ -4301,26 +4629,12 @@ async function runPublish(input = {}) {
 	const env = makeEnv(input.env);
 	const exec = input.exec ?? defaultExec$1;
 	const login = input.login ?? defaultLogin;
-	const publishArgs = [
-		...workspaceFilterArgs(cwd),
-		"publish",
-		"--access",
-		"public",
-		"--no-git-checks",
-		"--tag",
-		tag,
-		...otp ? ["--otp", otp] : []
-	];
-	print(`Holocron publish --initial${dryRun ? " (dry-run)" : ""}`);
-	print(`  cwd: ${cwd}`);
-	print(`  tag: ${tag}`);
 	logger.info({
 		tag,
 		dryRun: dryRun || void 0
 	}, "publish --initial: start");
-	if (otp) print(`  otp: <${otp.length} chars>`);
 	print("");
-	print("  → verifying npm auth (`npm whoami`)…");
+	print(style.dim("  → verifying npm auth (`npm whoami`)…"));
 	let whoami = await exec("npm", ["whoami"], { cwd });
 	if (whoami.exitCode !== 0) {
 		print("    not authenticated — running `npm login --auth-type=web`…");
@@ -4328,7 +4642,7 @@ async function runPublish(input = {}) {
 		if ((await login(cwd)).exitCode !== 0) {
 			const message = "npm login failed. Run `npm login --auth-type=web` (or `npm login`) manually, then re-run.";
 			print(`  ✗ ${message}`);
-			const packageNames = input.packages ?? discoverPublicPackages(cwd);
+			const packageNames = (input.packages ?? discoverPublicPackageEntries(cwd)).map((e) => e.name);
 			logger.warn({ reason: "npm login failed" }, "publish --initial: done");
 			return {
 				status: "fail",
@@ -4340,7 +4654,7 @@ async function runPublish(input = {}) {
 		if (whoami.exitCode !== 0) {
 			const message = "npm login completed but `npm whoami` still fails — check your npm account.";
 			print(`  ✗ ${message}`);
-			const packageNames = input.packages ?? discoverPublicPackages(cwd);
+			const packageNames = (input.packages ?? discoverPublicPackageEntries(cwd)).map((e) => e.name);
 			logger.warn({ reason: "npm whoami still fails after login" }, "publish --initial: done");
 			return {
 				status: "fail",
@@ -4349,10 +4663,35 @@ async function runPublish(input = {}) {
 			};
 		}
 	}
-	print(`    ✓ authed as ${whoami.stdout.trim() || "<unknown>"}`);
-	const packageNames = input.packages ?? discoverPublicPackages(cwd);
-	const repoName = input.repoName ?? await resolveRepoName(cwd, exec);
+	const whoamiName = whoami.stdout.trim() || "<unknown>";
+	print(style.dim(`    ✓ authed as ${whoamiName}`));
+	print("");
+	if (otp) print(style.dim(`  otp: <${otp.length} chars>`));
+	const discoveredEntries = input.packages ?? discoverPublicPackageEntries(cwd);
+	const nameWidth = Math.max(0, ...discoveredEntries.map((e) => e.name.length));
+	const dirWidth = Math.max(0, ...discoveredEntries.map((e) => e.dir.length));
+	const newEntries = input.packages ? [...discoveredEntries] : await filterNewPackages(discoveredEntries, cwd, exec, print, nameWidth, dirWidth);
+	const packageNames = newEntries.map((e) => e.name);
+	const skippedCount = input.packages ? 0 : discoveredEntries.length - newEntries.length;
+	const resolvedIdentity = input.repoName !== void 0 && input.orgName !== void 0 ? {
+		owner: input.orgName,
+		repo: input.repoName
+	} : await resolveRepoIdentity(cwd, exec);
+	const identity = {
+		owner: input.orgName ?? resolvedIdentity.owner,
+		repo: input.repoName ?? resolvedIdentity.repo
+	};
 	if (packageNames.length === 0) {
+		if (input.packages === void 0 && discoveredEntries.length > 0) {
+			const message = "nothing to publish — every public package already exists on npm; nothing new to bootstrap";
+			printSummary(print, dryRun, 0, 0, skippedCount);
+			logger.info({ reason: message }, "publish --initial: done");
+			return {
+				status: "ok",
+				message,
+				packageNames
+			};
+		}
 		const message = "nothing to publish (no packages/*, plugins/*, or root package.json is private or unnamed)";
 		print(`  ✗ ${message}`);
 		logger.warn({ reason: message }, "publish --initial: done");
@@ -4362,11 +4701,22 @@ async function runPublish(input = {}) {
 			packageNames
 		};
 	}
+	const publishArgs = [
+		...hasPackagesDir(cwd) || hasPluginsDir(cwd) ? ["-r", ...packageNames.map((name) => `--filter=${name}`)] : [],
+		"publish",
+		"--access",
+		"public",
+		"--no-git-checks",
+		"--tag",
+		tag,
+		...otp ? ["--otp", otp] : []
+	];
 	if (dryRun) {
 		print("");
-		print("  … (dry-run) skipping actual publish");
-		print(`    would run: pnpm ${publishArgs.join(" ")}`);
-		printNextSteps(print, env, packageNames, repoName);
+		for (const entry of newEntries) print(style.dim(`  ${pad(entry.name, nameWidth)}  ${pad(entry.dir, dirWidth)}  would publish (v${entry.version})`));
+		print(style.dim(`  would run: pnpm ${redactOtp(publishArgs, otp).join(" ")}`));
+		printSummary(print, dryRun, packageNames.length, 0, skippedCount);
+		printNextSteps(print, env, packageNames, identity);
 		logger.info({
 			tag,
 			status: "dry-run",
@@ -4379,7 +4729,7 @@ async function runPublish(input = {}) {
 		};
 	}
 	print("");
-	print("  → publishing all public @theholocron/* packages…");
+	print(`  → publishing ${packageNames.length} new package${packageNames.length === 1 ? "" : "s"}…`);
 	const publish = await exec("pnpm", publishArgs, { cwd });
 	if (publish.exitCode !== 0) {
 		const message = `publish failed (exit ${publish.exitCode}): ${publish.stderr.trim() || publish.stdout.trim() || "no output"}`;
@@ -4389,6 +4739,12 @@ async function runPublish(input = {}) {
 			print("  → hint: your npm account requires 2FA for writes. Re-run with `--otp <code>`:");
 			print(`    pnpm exec tsx packages/cli/src/cli.ts package publish --initial --otp <6-digit-code>`);
 		}
+		for (const entry of newEntries) print(statusRow("fail", [
+			pad(entry.name, nameWidth),
+			pad(entry.dir, dirWidth),
+			"publish failed"
+		]));
+		printSummary(print, dryRun, 0, packageNames.length, skippedCount);
 		logger.warn({
 			tag,
 			reason: message
@@ -4399,8 +4755,13 @@ async function runPublish(input = {}) {
 			packageNames
 		};
 	}
-	print("    ✓ publish complete");
-	printNextSteps(print, env, packageNames, repoName);
+	for (const entry of newEntries) print(statusRow("ok", [
+		pad(entry.name, nameWidth),
+		pad(entry.dir, dirWidth),
+		`published (v${entry.version})`
+	]));
+	printSummary(print, dryRun, packageNames.length, 0, skippedCount);
+	printNextSteps(print, env, packageNames, identity);
 	logger.info({
 		tag,
 		status: "ok",
@@ -4412,19 +4773,18 @@ async function runPublish(input = {}) {
 	};
 }
 //#endregion
-//#region src/commands/publish/discover-public-package-entries.ts
+//#region src/commands/publish/workspace-filter-args.ts
 /**
-* Every public package (`!private && name`) with its version and a
-* `pnpm --filter`-ready path — {@link runSteadyPublish}'s `skipAlreadyPublished`
-* mode needs both to check `npm view <pkg>@<version>` and publish one
-* workspace at a time.
+* `-r --filter=./packages/* --filter=./plugins/*` — whichever workspace
+* roots exist. Empty (single-package repo, no `-r`) when neither does.
+* Shared by every `pnpm publish` invocation below so a repo with only
+* `plugins/*` (or both) is covered the same as `packages/*`-only.
 */
-function discoverPublicPackageEntries(cwd) {
-	return discoverManifests(cwd).flatMap(({ manifest, dir }) => !manifest.private && manifest.name && manifest.version ? [{
-		name: manifest.name,
-		version: manifest.version,
-		dir
-	}] : []);
+function workspaceFilterArgs(cwd) {
+	const filters = [];
+	if (hasPackagesDir(cwd)) filters.push("--filter=./packages/*");
+	if (hasPluginsDir(cwd)) filters.push("--filter=./plugins/*");
+	return filters.length > 0 ? ["-r", ...filters] : [];
 }
 //#endregion
 //#region src/commands/publish/run-steady-publish/run-steady-publish.ts
@@ -4498,7 +4858,7 @@ async function runSteadyPublish(input = {}) {
 				...otpFlags
 			];
 			print(`  … (dry-run) skipping actual publish`);
-			print(`    would run: pnpm ${args.join(" ")}`);
+			print(`    would run: pnpm ${redactOtp(args, otp).join(" ")}`);
 		}
 		logger.info({
 			tag,
@@ -4531,6 +4891,15 @@ async function runSteadyPublish(input = {}) {
 				...otpFlags
 			], { cwd });
 			if (publish.exitCode !== 0) {
+				const recheck = await exec("npm", [
+					"view",
+					`${entry.name}@${entry.version}`,
+					"version"
+				], { cwd });
+				if (recheck.exitCode === 0 && recheck.stdout.trim()) {
+					print(`    skip ${entry.name}@${entry.version} (published concurrently by another run)`);
+					continue;
+				}
 				const message = `publish failed for ${entry.name}@${entry.version} (exit ${publish.exitCode}): ${publish.stderr.trim() || publish.stdout.trim() || "no output"}`;
 				print(`  ✗ ${message}`);
 				logger.warn({
@@ -4593,6 +4962,12 @@ async function runSteadyPublish(input = {}) {
 	};
 }
 //#endregion
+//#region src/commands/publish/discover-public-packages.ts
+/** The names of `discoverPublicPackageEntries`' packages, without requiring a version. */
+function discoverPublicPackages(cwd) {
+	return discoverManifests(cwd).flatMap(({ manifest }) => !manifest.private && manifest.name ? [manifest.name] : []);
+}
+//#endregion
 //#region src/commands/publish/is-eotp.ts
 function isEotp(parsed) {
 	return typeof parsed === "object" && parsed !== null && "error" in parsed && parsed.error?.code === "EOTP";
@@ -8788,6 +9163,18 @@ async function runUpgradeNode(input) {
 //#endregion
 //#region src/interactive-menu/child-argv/child-argv.ts
 /**
+* Whether `option`'s answer must be delivered via env, never argv — true for
+* an explicit `secret: true`, and also for any `type: "password"` option
+* even if `secret` was left unset. `promptOne` (prompt-options.ts) already
+* treats these two as interchangeable triggers for masking the input
+* itself; `buildChildArgv`/`secretEnv` need to agree, or a password-typed
+* option that forgot to also set `secret: true` would mask the keystrokes
+* on screen while still leaking the typed value into the child's argv.
+*/
+function isSecretOption(option) {
+	return Boolean(option.secret) || option.type === "password";
+}
+/**
 * `--token` (repeatable), `--org`, `--cwd`, `--dry-run` — the global flags a
 * menu-launched child should inherit from the parent invocation. Everything
 * else (command-specific options) was never captured by the top-level `$0`
@@ -8807,17 +9194,78 @@ function forwardedFlags(argv, dryRunOverride) {
 	if (dryRunOverride ?? argv.dryRun === true) out.push("--dry-run");
 	return out;
 }
-/** `entry.spawnArgs` if set, else `entry.name` split into tokens — resolved positionals appended, then forwarded flags. */
-function buildChildArgv(entry, positionals, parentArgv, dryRunOverride) {
+/**
+* `option`'s own argv tokens for `value` (never called for a `secret`
+* option — those are delivered via {@link secretEnv} instead, never argv).
+*
+* - boolean `true` → `--flag`; `false` → `--no-flag` when the yargs
+*   default is `true` (`negatable: true` — answering "no" must actively
+*   override it, not just omit the flag and silently keep the default),
+*   otherwise omitted (the yargs default is already `false`).
+* - string/select → `--flag value`, omitted when empty.
+* - `arity`-valued array → `--flag v1 v2 ...`.
+*/
+function optionArgv(option, value) {
+	if (value === void 0) return [];
+	if (typeof value === "boolean") {
+		if (value) return [option.flag];
+		return option.negatable ? [`--no-${option.flag.replace(/^--/, "")}`] : [];
+	}
+	if (Array.isArray(value)) return value.length === 0 ? [] : [option.flag, ...value];
+	return value === "" ? [] : [option.flag, value];
+}
+/**
+* `entry.spawnArgs` if set, else `entry.name` split into tokens — resolved
+* positionals, then non-secret option flags, then forwarded flags, appended
+* in that order. `resolved` is whatever {@link promptForOptions} returned —
+* for a `modes`-based command, that's already the picked mode's own options
+* (plus a synthetic entry for its `flag`, if any), so this renders either
+* shape identically with no need to know which kind of command it came from.
+*/
+function buildChildArgv(entry, positionals, resolved, parentArgv, dryRunOverride) {
+	const optionArgs = resolved.options.flatMap((option) => isSecretOption(option) ? [] : optionArgv(option, resolved.answers[option.key]));
 	return [
 		...entry.spawnArgs ?? entry.name.split(" "),
 		...positionals,
+		...optionArgs,
 		...forwardedFlags(parentArgv, dryRunOverride)
 	];
 }
+/**
+* Secret option answers, keyed by the env var their handler reads instead
+* of argv (`ps` and shell history expose argv, never a child's own env) —
+* `HOLOCRON_<KEY_IN_SCREAMING_SNAKE_CASE>`, e.g. `otp` → `HOLOCRON_OTP`.
+* Merged into {@link spawnChild}'s `extraEnv` alongside `NO_UPDATE_NOTIFIER`
+* and (for a preview spawn) `DRY_RUN_PREVIEW_ENV_VAR`.
+*/
+function secretEnv(resolved) {
+	const out = {};
+	for (const option of resolved.options) {
+		if (!isSecretOption(option)) continue;
+		const value = resolved.answers[option.key];
+		if (typeof value !== "string" || value === "") continue;
+		out[`HOLOCRON_${option.key.replace(/([A-Z])/g, "_$1").toUpperCase()}`] = value;
+	}
+	return out;
+}
 //#endregion
 //#region src/interactive-menu/command-registry/command-registry.ts
 const numeric = (value) => /^\d+$/.test(value) ? true : "enter a number";
+const PUBLISH_TAG_OPTION = {
+	key: "tag",
+	flag: "--tag",
+	type: "input",
+	message: "npm dist-tag (blank = alpha for a bootstrap publish, latest otherwise):"
+};
+const PUBLISH_OTP_OPTION = {
+	key: "otp",
+	flag: "--otp",
+	type: "password",
+	secret: true,
+	askLast: true,
+	required: Boolean(env.get("HOLOCRON_NPM_ENFORCE_2FA")),
+	message: "One-time password (2FA), if npm requires it for this publish:"
+};
 /**
 * The full command surface, hand-maintained in parallel with `cli.ts`'s
 * yargs registrations (this module does not introspect yargs at runtime).
@@ -8928,7 +9376,56 @@ const COMMAND_REGISTRY = [
 		name: "package publish",
 		description: "Publish @theholocron/* packages to npm",
 		positionals: [],
-		supportsDryRun: true
+		supportsDryRun: true,
+		modes: [
+			{
+				key: "steady",
+				message: "Publish a new version",
+				options: [
+					PUBLISH_TAG_OPTION,
+					PUBLISH_OTP_OPTION,
+					{
+						key: "provenance",
+						flag: "--provenance",
+						type: "confirm",
+						default: true,
+						negatable: true,
+						message: "Publish with --provenance? (on by default)"
+					},
+					{
+						key: "skipAlreadyPublished",
+						flag: "--skip-already-published",
+						type: "confirm",
+						default: false,
+						message: "Skip a package already published at this exact version, instead of one bulk publish?"
+					}
+				]
+			},
+			{
+				key: "initial",
+				message: "Initial publish (--initial)",
+				description: "Use only for a package's very first publish.",
+				flag: "--initial",
+				options: [PUBLISH_TAG_OPTION, PUBLISH_OTP_OPTION]
+			},
+			{
+				key: "syncTrust",
+				message: "Sync Trusted Publisher workflow filename across every public package (--sync-trust)",
+				options: [{
+					key: "syncTrust",
+					flag: "--sync-trust",
+					type: "input",
+					arity: 2,
+					required: true,
+					message: "Workflow filename (old, then new)"
+				}, {
+					key: "repo",
+					flag: "--repo",
+					type: "input",
+					message: "owner/repo for Trusted Publisher config (blank = theholocron/holocron):"
+				}]
+			}
+		]
 	},
 	{
 		name: "repo sync",
@@ -9150,6 +9647,25 @@ function spawnChild(args, extraEnv) {
 	});
 }
 /**
+* Collects `resolved.deferred`'s values (holocron#1052 follow-up) and folds
+* them into `resolved.answers` — call this once, right before building the
+* real (non-dry-run) spawn's argv, never any earlier: a dry-run preview and
+* a human confirming "proceed with the real run?" can both take a while,
+* and a time-sensitive secret (an OTP) typed before either risks going
+* stale before it's actually used. A no-op when nothing was deferred.
+*/
+async function resolveForRealSpawn(resolved) {
+	if (!resolved.deferred || resolved.deferred.length === 0) return resolved;
+	const deferredAnswers = await promptForDeferredOptions(resolved.deferred);
+	return {
+		...resolved,
+		answers: {
+			...resolved.answers,
+			...deferredAnswers
+		}
+	};
+}
+/**
 * Whether `launchMenu` should auto-preview a picked command before running
 * it for real — only when the command's handler actually honours
 * `--dry-run` ({@link CommandEntry.supportsDryRun}) and the top-level
@@ -9202,8 +9718,13 @@ async function launchMenu(entries, parentArgv, pickMessage, nonInteractiveMessag
 		else picked = entries.find((e) => e.name === value);
 	}
 	const positionals = await promptForPositionals(picked, {});
+	const resolvedOptions = await promptForOptions(picked, {});
+	const extraEnv = secretEnv(resolvedOptions);
 	if (shouldPreviewDryRun(picked, parentArgv)) {
-		const dryExit = await spawnChild(buildChildArgv(picked, positionals, parentArgv, true), { [DRY_RUN_PREVIEW_ENV_VAR]: "1" });
+		const dryExit = await spawnChild(buildChildArgv(picked, positionals, resolvedOptions, parentArgv, true), {
+			[DRY_RUN_PREVIEW_ENV_VAR]: "1",
+			...extraEnv
+		});
 		if (dryExit === 2) {
 			process.exitCode = 0;
 			return;
@@ -9219,10 +9740,12 @@ async function launchMenu(entries, parentArgv, pickMessage, nonInteractiveMessag
 			process.exitCode = 0;
 			return;
 		}
-		process.exitCode = await spawnChild(buildChildArgv(picked, positionals, parentArgv, false));
+		const forReal = await resolveForRealSpawn(resolvedOptions);
+		process.exitCode = await spawnChild(buildChildArgv(picked, positionals, forReal, parentArgv, false), secretEnv(forReal));
 		return;
 	}
-	process.exitCode = await spawnChild(buildChildArgv(picked, positionals, parentArgv));
+	const forReal = await resolveForRealSpawn(resolvedOptions);
+	process.exitCode = await spawnChild(buildChildArgv(picked, positionals, forReal, parentArgv), secretEnv(forReal));
 }
 //#endregion
 //#region src/interactive-menu/run-menu-entries/run-menu-entries.ts
@@ -10357,6 +10880,7 @@ try {
 		default: false,
 		describe: "Steady-state only: check `npm view <pkg>@<version>` before publishing each package and skip it if that exact version already exists, instead of one bulk publish. For repos that ship many independently-versioned packages where a release doesn't bump every one."
 	}), async (argv) => {
+		const otp = resolveOtp(argv.otp, env);
 		if (argv.syncTrust) {
 			const [oldFile, newFile] = argv.syncTrust;
 			if (!oldFile || !newFile) {
@@ -10374,12 +10898,14 @@ try {
 			return;
 		}
 		if (argv.initial) {
-			if ((await runPublish({
+			const report = await runPublish({
 				cwd: argv.cwd,
 				dryRun: argv.dryRun,
 				...argv.tag ? { tag: argv.tag } : {},
-				...argv.otp ? { otp: argv.otp } : {}
-			})).status === "fail") process.exitCode = 1;
+				...otp ? { otp } : {}
+			});
+			if (report.status === "fail") process.exitCode = 1;
+			else if (report.status === "ok" && report.packageNames.length === 0 && env.get("HOLOCRON_DRY_RUN_PREVIEW") === "1") process.exitCode = 2;
 			return;
 		}
 		if ((await runSteadyPublish({
@@ -10388,7 +10914,7 @@ try {
 			provenance: argv.provenance,
 			skipAlreadyPublished: argv.skipAlreadyPublished,
 			...argv.tag ? { tag: argv.tag } : {},
-			...argv.otp ? { otp: argv.otp } : {}
+			...otp ? { otp } : {}
 		})).status === "fail") process.exitCode = 1;
 	}).command("$0", false, () => {}, async (argv) => {
 		await launchGroupMenu("package", argv);