@aspruyt/xfg 3.13.1 → 4.0.0

package/README.md

@@ -47,11 +47,8 @@ npm install -g @aspruyt/xfg
 # Authenticate (GitHub)
 gh auth login
 
-# Sync files across repos
+# Sync files, settings, rulesets, and labels across repos
 xfg sync --config ./config.yaml
-
-# Apply repository settings and rulesets
-xfg settings --config ./config.yaml
 ```
 
 ### Example Config

package/dist/cli/index.d.ts

@@ -1,6 +1,4 @@
 export { runSync } from "./sync-command.js";
-export { runSettings } from "./settings-command.js";
 export { program } from "./program.js";
 export { type IRepositoryProcessor, type ProcessorFactory, type IRulesetProcessor, type RulesetProcessorFactory, type RepoSettingsProcessorFactory, type IRepoSettingsProcessor, type ILabelsProcessor, type LabelsProcessorFactory, defaultProcessorFactory, defaultRulesetProcessorFactory, defaultRepoSettingsProcessorFactory, defaultLabelsProcessorFactory, } from "./types.js";
 export type { SyncOptions, SharedOptions } from "./sync-command.js";
-export type { SettingsOptions } from "./settings-command.js";

package/dist/cli/index.js

@@ -1,6 +1,5 @@
 // CLI command implementations
 export { runSync } from "./sync-command.js";
-export { runSettings } from "./settings-command.js";
 export { program } from "./program.js";
 // Export types - using 'export type' for type aliases, but interfaces need special handling
 // For ESM compatibility, re-export everything from types.js

package/dist/cli/program.js

@@ -3,7 +3,6 @@ import { dirname, join } from "node:path";
 import { readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { runSync } from "./sync-command.js";
-import { runSettings } from "./settings-command.js";
 // Get version from package.json
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
@@ -56,15 +55,4 @@ const syncCommand = new Command("sync")
 });
 addSharedOptions(syncCommand);
 program.addCommand(syncCommand);
-// Settings command (repository settings and rulesets)
-const settingsCommand = new Command("settings")
-    .description("Manage GitHub repository settings and rulesets")
-    .action((opts) => {
-    runSettings(opts).catch((error) => {
-        console.error("Fatal error:", error);
-        process.exit(1);
-    });
-});
-addSharedOptions(settingsCommand);
-program.addCommand(settingsCommand);
 export { program };

package/dist/cli/sync-command.d.ts

@@ -1,6 +1,5 @@
 import { MergeMode, MergeStrategy } from "../config/index.js";
-import { ProcessorFactory } from "./types.js";
-import { type IRepoLifecycleManager } from "../lifecycle/index.js";
+import { type SyncDependencies } from "./types.js";
 /**
  * Shared options common to all commands.
  */
@@ -23,4 +22,4 @@ export interface SyncOptions extends SharedOptions {
 /**
  * Run the sync command - synchronizes files across repositories.
  */
-export declare function runSync(options: SyncOptions, processorFactory?: ProcessorFactory, lifecycleManager?: IRepoLifecycleManager): Promise<void>;
+export declare function runSync(options: SyncOptions, deps?: SyncDependencies): Promise<void>;

package/dist/cli/sync-command.js

@@ -7,7 +7,10 @@ import { sanitizeBranchName, validateBranchName } from "../vcs/git-ops.js";
 import { hasGitHubAppCredentials, GitHubAppTokenManager, } from "../vcs/index.js";
 import { logger } from "../shared/logger.js";
 import { generateWorkspaceName } from "../shared/workspace-utils.js";
-import { defaultProcessorFactory } from "./types.js";
+import { defaultProcessorFactory, defaultRulesetProcessorFactory, defaultRepoSettingsProcessorFactory, defaultLabelsProcessorFactory, } from "./types.js";
+import { ResultsCollector } from "./settings/results-collector.js";
+import { buildSettingsReport } from "./settings-report-builder.js";
+import { formatSettingsReportCLI } from "../output/settings-report.js";
 import { buildSyncReport } from "./sync-report-builder.js";
 import { formatSyncReportCLI } from "../output/sync-report.js";
 import { buildLifecycleReport, formatLifecycleReportCLI, hasLifecycleChanges, } from "../output/lifecycle-report.js";
@@ -63,7 +66,8 @@ function determineMergeOutcome(result) {
 /**
  * Run the sync command - synchronizes files across repositories.
  */
-export async function runSync(options, processorFactory = defaultProcessorFactory, lifecycleManager) {
+export async function runSync(options, deps = {}) {
+    const { processorFactory = defaultProcessorFactory, lifecycleManager, rulesetProcessorFactory = defaultRulesetProcessorFactory, repoSettingsProcessorFactory = defaultRepoSettingsProcessorFactory, labelsProcessorFactory = defaultLabelsProcessorFactory, } = deps;
     const configPath = resolve(options.config);
     if (!existsSync(configPath)) {
         console.error(`Config file not found: ${configPath}`);
@@ -102,6 +106,7 @@ export async function runSync(options, processorFactory = defaultProcessorFactor
         : null;
     const reportResults = [];
     const lifecycleReportInputs = [];
+    const settingsCollector = new ResultsCollector();
     for (let i = 0; i < config.repos.length; i++) {
         const repoConfig = config.repos[i];
         if (options.merge || options.mergeStrategy || options.deleteBranch) {
@@ -230,6 +235,125 @@ export async function runSync(options, processorFactory = defaultProcessorFactor
                 error: error instanceof Error ? error.message : String(error),
             });
         }
+        // After file sync, apply settings via API (GitHub-only — ADO and GitLab repos are skipped)
+        if (repoConfig.settings && isGitHubRepo(repoInfo)) {
+            const githubRepo = repoInfo;
+            let settingsToken;
+            try {
+                settingsToken =
+                    (await tokenManager?.getTokenForRepo(githubRepo)) ??
+                        process.env.GH_TOKEN;
+            }
+            catch {
+                settingsToken = process.env.GH_TOKEN;
+            }
+            // Apply rulesets
+            if (repoConfig.settings.rulesets &&
+                Object.keys(repoConfig.settings.rulesets).length > 0) {
+                try {
+                    const rulesetProcessor = rulesetProcessorFactory();
+                    const rulesetResult = await rulesetProcessor.process(repoConfig, repoInfo, {
+                        dryRun: options.dryRun,
+                        noDelete: options.noDelete,
+                        token: settingsToken,
+                    });
+                    if (rulesetResult.planOutput?.lines?.length) {
+                        logger.info("");
+                        logger.info(`${repoName} - Rulesets:`);
+                        for (const line of rulesetResult.planOutput.lines) {
+                            logger.info(line);
+                        }
+                    }
+                    else if (!rulesetResult.skipped && rulesetResult.success) {
+                        logger.success(current, repoName, `Rulesets: ${rulesetResult.message}`);
+                    }
+                    if (!rulesetResult.skipped) {
+                        settingsCollector.getOrCreate(repoName).rulesetResult =
+                            rulesetResult;
+                    }
+                    if (!rulesetResult.success && !rulesetResult.skipped) {
+                        logger.error(current, repoName, `Rulesets: ${rulesetResult.message}`);
+                        settingsCollector.appendError(repoName, rulesetResult.message);
+                    }
+                }
+                catch (error) {
+                    logger.error(current, repoName, `Rulesets: ${String(error)}`);
+                    settingsCollector.appendError(repoName, error);
+                }
+            }
+            // Apply labels
+            if (repoConfig.settings.labels &&
+                Object.keys(repoConfig.settings.labels).length > 0) {
+                try {
+                    const labelsProcessor = labelsProcessorFactory();
+                    const labelsResult = await labelsProcessor.process(repoConfig, repoInfo, {
+                        dryRun: options.dryRun,
+                        noDelete: options.noDelete,
+                        token: settingsToken,
+                    });
+                    if (labelsResult.planOutput?.lines?.length) {
+                        logger.info("");
+                        logger.info(`${repoName} - Labels:`);
+                        for (const line of labelsResult.planOutput.lines) {
+                            logger.info(line);
+                        }
+                    }
+                    else if (!labelsResult.skipped && labelsResult.success) {
+                        logger.success(current, repoName, `Labels: ${labelsResult.message}`);
+                    }
+                    if (!labelsResult.skipped) {
+                        settingsCollector.getOrCreate(repoName).labelsResult = labelsResult;
+                    }
+                    if (!labelsResult.success && !labelsResult.skipped) {
+                        logger.error(current, repoName, `Labels: ${labelsResult.message}`);
+                        settingsCollector.appendError(repoName, labelsResult.message);
+                    }
+                }
+                catch (error) {
+                    logger.error(current, repoName, `Labels: ${String(error)}`);
+                    settingsCollector.appendError(repoName, error);
+                }
+            }
+            // Apply repo settings
+            if (repoConfig.settings.repo &&
+                Object.keys(repoConfig.settings.repo).length > 0) {
+                try {
+                    const repoSettingsProcessor = repoSettingsProcessorFactory();
+                    const repoSettingsResult = await repoSettingsProcessor.process(repoConfig, repoInfo, {
+                        dryRun: options.dryRun,
+                        token: settingsToken,
+                    });
+                    if (repoSettingsResult.planOutput?.lines?.length) {
+                        logger.info("");
+                        logger.info(`${repoName} - Repo Settings:`);
+                        for (const line of repoSettingsResult.planOutput.lines) {
+                            logger.info(line);
+                        }
+                        if (repoSettingsResult.warnings?.length) {
+                            for (const warning of repoSettingsResult.warnings) {
+                                logger.info(`Warning: ${warning}`);
+                            }
+                        }
+                    }
+                    else if (!repoSettingsResult.skipped &&
+                        repoSettingsResult.success) {
+                        logger.success(current, repoName, `Repo settings: ${repoSettingsResult.message}`);
+                    }
+                    if (!repoSettingsResult.skipped) {
+                        settingsCollector.getOrCreate(repoName).settingsResult =
+                            repoSettingsResult;
+                    }
+                    if (!repoSettingsResult.success && !repoSettingsResult.skipped) {
+                        logger.error(current, repoName, `Repo settings: ${repoSettingsResult.message}`);
+                        settingsCollector.appendError(repoName, repoSettingsResult.message);
+                    }
+                }
+                catch (error) {
+                    logger.error(current, repoName, `Repo settings: ${String(error)}`);
+                    settingsCollector.appendError(repoName, error);
+                }
+            }
+        }
     }
     // Build and display lifecycle report (before sync report)
     const lifecycleReport = buildLifecycleReport(lifecycleReportInputs);
@@ -245,15 +369,30 @@ export async function runSync(options, processorFactory = defaultProcessorFactor
     for (const line of formatSyncReportCLI(report)) {
         console.log(line);
     }
+    // Build and display settings report (if any settings were processed)
+    const settingsResults = settingsCollector.getAll();
+    let settingsReport;
+    if (settingsResults.length > 0) {
+        settingsReport = buildSettingsReport(settingsResults);
+        const settingsLines = formatSettingsReportCLI(settingsReport);
+        if (settingsLines.length > 0) {
+            console.log("");
+            for (const line of settingsLines) {
+                console.log(line);
+            }
+        }
+    }
     // Write unified summary to GITHUB_STEP_SUMMARY
     writeUnifiedSummary({
         lifecycle: lifecycleReport,
         sync: report,
+        settings: settingsReport,
         dryRun: options.dryRun ?? false,
     });
-    // Exit with error if any failures
+    // Exit with error if any failures (file sync or settings)
     const hasErrors = reportResults.some((r) => r.error);
-    if (hasErrors) {
+    const hasSettingsErrors = settingsResults.some((r) => r.error);
+    if (hasErrors || hasSettingsErrors) {
         process.exit(1);
     }
 }

package/dist/cli/types.d.ts

@@ -1,5 +1,6 @@
 import { RepoConfig } from "../config/index.js";
 import { RepoInfo } from "../shared/repo-detector.js";
+import type { IRepoLifecycleManager } from "../lifecycle/index.js";
 import { type ProcessorResult, type ProcessorOptions } from "../sync/index.js";
 import { RulesetProcessorOptions, RulesetProcessorResult } from "../settings/rulesets/processor.js";
 import { type IRepoSettingsProcessor } from "../settings/repo-settings/processor.js";
@@ -9,10 +10,6 @@ import { type ILabelsProcessor } from "../settings/labels/processor.js";
  */
 export interface IRepositoryProcessor {
     process(repoConfig: RepoConfig, repoInfo: RepoInfo, options: ProcessorOptions): Promise<ProcessorResult>;
-    updateManifestOnly(repoInfo: RepoInfo, repoConfig: RepoConfig, options: ProcessorOptions, manifestUpdate: {
-        rulesets?: string[];
-        labels?: string[];
-    }): Promise<ProcessorResult>;
 }
 /**
  * Factory function type for creating processors.
@@ -52,4 +49,14 @@ export type LabelsProcessorFactory = () => ILabelsProcessor;
  * Default factory that creates a real LabelsProcessor.
  */
 export declare const defaultLabelsProcessorFactory: LabelsProcessorFactory;
+/**
+ * Dependencies for the sync command (dependency injection).
+ */
+export interface SyncDependencies {
+    processorFactory?: ProcessorFactory;
+    lifecycleManager?: IRepoLifecycleManager;
+    rulesetProcessorFactory?: RulesetProcessorFactory;
+    repoSettingsProcessorFactory?: RepoSettingsProcessorFactory;
+    labelsProcessorFactory?: LabelsProcessorFactory;
+}
 export type { IRepoSettingsProcessor, ILabelsProcessor };

package/dist/config/index.d.ts

@@ -4,4 +4,4 @@ export { loadRawConfig, loadConfig, normalizeConfig } from "./loader.js";
 export { convertContentToString, detectOutputFormat, type OutputFormat, type ConvertOptions, } from "./formatter.js";
 export { isFileReference, resolveFileReference, type FileReferenceOptions, } from "./file-reference-resolver.js";
 export { arrayMergeStrategies, deepMerge, stripMergeDirectives, createMergeContext, isTextContent, mergeTextContent, type ArrayMergeStrategy, type ArrayMergeHandler, type MergeContext, } from "./merge.js";
-export { validateRawConfig, validateSettings, validateForSync, validateForSettings, hasActionableSettings, } from "./validator.js";
+export { validateRawConfig, validateSettings, validateForSync, hasActionableSettings, } from "./validator.js";

package/dist/config/index.js

@@ -9,4 +9,4 @@ export { isFileReference, resolveFileReference, } from "./file-reference-resolve
 // Deep merge utilities
 export { arrayMergeStrategies, deepMerge, stripMergeDirectives, createMergeContext, isTextContent, mergeTextContent, } from "./merge.js";
 // Validation
-export { validateRawConfig, validateSettings, validateForSync, validateForSettings, hasActionableSettings, } from "./validator.js";
+export { validateRawConfig, validateSettings, validateForSync, hasActionableSettings, } from "./validator.js";

package/dist/config/validator.d.ts

@@ -17,8 +17,3 @@ export declare function validateForSync(config: RawConfig): void;
  * Checks if settings contain actionable configuration.
  */
 export declare function hasActionableSettings(settings: RawRootSettings | RawRepoSettings | undefined): boolean;
-/**
- * Validates that config is suitable for the settings command.
- * @throws Error if no settings are defined or no actionable settings exist
- */
-export declare function validateForSettings(config: RawConfig): void;

package/dist/config/validator.js

@@ -537,9 +537,19 @@ export function validateForSync(config) {
     const hasGroupFiles = config.groups &&
         Object.values(config.groups).some((g) => g.files &&
             Object.keys(g.files).filter((k) => k !== "inherit" && g.files[k] !== false).length > 0);
-    if (!hasRootFiles && !hasGroupFiles) {
-        throw new Error("The 'sync' command requires files defined in root 'files' or in at least one group. " +
-            "To manage repository settings instead, use 'xfg settings'.");
+    const hasSettings = hasActionableSettings(config.settings);
+    const hasRepoSettings = config.repos.some((repo) => hasActionableSettings(repo.settings));
+    const hasGroupSettings = config.groups &&
+        typeof config.groups === "object" &&
+        !Array.isArray(config.groups) &&
+        Object.values(config.groups).some((g) => g.settings && hasActionableSettings(g.settings));
+    if (!hasRootFiles &&
+        !hasGroupFiles &&
+        !hasSettings &&
+        !hasRepoSettings &&
+        !hasGroupSettings) {
+        throw new Error("Config requires at least one of: 'files' or 'settings'. " +
+            "Use 'files' to sync configuration files, or 'settings' to manage repository settings.");
     }
 }
 /**
@@ -564,30 +574,3 @@ export function hasActionableSettings(settings) {
     }
     return false;
 }
-/**
- * Validates that config is suitable for the settings command.
- * @throws Error if no settings are defined or no actionable settings exist
- */
-export function validateForSettings(config) {
-    // Check if settings exist at root, in any repo, or in any group
-    const hasRootSettings = config.settings !== undefined;
-    const hasRepoSettings = config.repos.some((repo) => repo.settings !== undefined);
-    const hasGroupSettings = config.groups &&
-        typeof config.groups === "object" &&
-        !Array.isArray(config.groups) &&
-        Object.values(config.groups).some((g) => g.settings && typeof g.settings === "object");
-    if (!hasRootSettings && !hasRepoSettings && !hasGroupSettings) {
-        throw new Error("The 'settings' command requires a 'settings' section at root level, " +
-            "in at least one repo, or in at least one group. To sync files instead, use 'xfg sync'.");
-    }
-    // Check if there's at least one actionable setting
-    const rootActionable = hasActionableSettings(config.settings);
-    const repoActionable = config.repos.some((repo) => hasActionableSettings(repo.settings));
-    const groupActionable = config.groups &&
-        Object.values(config.groups).some((g) => hasActionableSettings(g.settings));
-    if (!rootActionable && !repoActionable && !groupActionable) {
-        throw new Error("No actionable settings configured. Currently supported: rulesets, repo, labels. " +
-            "To sync files instead, use 'xfg sync'. " +
-            "See docs: https://anthony-spruyt.github.io/xfg/settings");
-    }
-}

package/dist/index.d.ts

@@ -1,3 +1,3 @@
-export { runSync, runSettings } from "./cli/index.js";
-export type { SyncOptions, SettingsOptions, SharedOptions, } from "./cli/index.js";
+export { runSync } from "./cli/index.js";
+export type { SyncOptions, SharedOptions } from "./cli/index.js";
 export { type IRepositoryProcessor, type ProcessorFactory, defaultProcessorFactory, type IRulesetProcessor, type RulesetProcessorFactory, defaultRulesetProcessorFactory, type RepoSettingsProcessorFactory, defaultRepoSettingsProcessorFactory, type ILabelsProcessor, type LabelsProcessorFactory, defaultLabelsProcessorFactory, } from "./cli/index.js";

package/dist/index.js

@@ -1,3 +1,3 @@
 // Public API for library consumers
-export { runSync, runSettings } from "./cli/index.js";
+export { runSync } from "./cli/index.js";
 export { defaultProcessorFactory, defaultRulesetProcessorFactory, defaultRepoSettingsProcessorFactory, defaultLabelsProcessorFactory, } from "./cli/index.js";

package/dist/lifecycle/github-lifecycle-provider.d.ts

@@ -52,6 +52,15 @@ export declare class GitHubLifecycleProvider implements IRepoLifecycleProvider {
      * GitHub automatically updates the default branch pointer.
      */
     private renameBranch;
+    /**
+     * Poll until the GitHub API reports the expected default branch.
+     * After a branch rename, the API may lag for a few seconds.
+     *
+     * Note: Uses the same executor.exec pattern as the rest of this class.
+     * The command arguments are constructed from trusted RepoInfo values
+     * (validated during config parsing), not user input.
+     */
+    private waitForDefaultBranch;
     /**
      * Delete the README.md that --add-readme creates.
      * This leaves the repo with a default branch established (from the initial

package/dist/lifecycle/github-lifecycle-provider.js

@@ -165,6 +165,9 @@ export class GitHubLifecycleProvider {
             })).trim();
             if (actualBranch !== settings.defaultBranch) {
                 await this.renameBranch(repoInfo, actualBranch, settings.defaultBranch, token);
+                // Wait for the rename to propagate — GitHub's API may still report
+                // the old default branch for a few seconds after the rename call.
+                await this.waitForDefaultBranch(repoInfo, settings.defaultBranch, token);
             }
         }
         // Delete the README so xfg sync starts from a clean state.
@@ -340,6 +343,34 @@ export class GitHubLifecycleProvider {
             retries: this.retries,
         });
     }
+    /**
+     * Poll until the GitHub API reports the expected default branch.
+     * After a branch rename, the API may lag for a few seconds.
+     *
+     * Note: Uses the same executor.exec pattern as the rest of this class.
+     * The command arguments are constructed from trusted RepoInfo values
+     * (validated during config parsing), not user input.
+     */
+    async waitForDefaultBranch(repoInfo, expectedBranch, token, timeoutMs = 15000, pollMs = 1000) {
+        const tokenPrefix = this.buildTokenPrefix(token);
+        const hostnameFlag = getHostnameFlag(repoInfo);
+        const hostnamePart = hostnameFlag ? `${hostnameFlag} ` : "";
+        const apiPath = `repos/${escapeShellArg(repoInfo.owner)}/${escapeShellArg(repoInfo.repo)}`;
+        const startTime = Date.now();
+        while (Date.now() - startTime < timeoutMs) {
+            try {
+                const branch = (await this.executor.exec(`${tokenPrefix}gh api ${hostnamePart}${apiPath} --jq '.default_branch'`, this.cwd)).trim();
+                if (branch === expectedBranch) {
+                    return;
+                }
+            }
+            catch {
+                // API call failed, continue polling
+            }
+            await new Promise((resolve) => setTimeout(resolve, pollMs));
+        }
+        // Don't throw — rename succeeded, this is just a best-effort wait
+    }
     /**
      * Delete the README.md that --add-readme creates.
      * This leaves the repo with a default branch established (from the initial

package/dist/settings/labels/diff.d.ts

@@ -25,9 +25,9 @@ export interface LabelChange {
  *
  * @param current - Current labels from GitHub API
  * @param desired - Desired labels from config (name -> label)
- * @param managedLabels - Names of labels managed by xfg (from manifest)
+ * @param deleteOrphaned - If true, delete current labels not in desired config
  * @param noDelete - If true, skip delete operations
  * @returns Array of changes to apply
  * @throws Error if rename collisions are detected
  */
-export declare function diffLabels(current: GitHubLabel[], desired: Record<string, Label>, managedLabels: string[], noDelete: boolean): LabelChange[];
+export declare function diffLabels(current: GitHubLabel[], desired: Record<string, Label>, deleteOrphaned: boolean, noDelete: boolean): LabelChange[];

package/dist/settings/labels/diff.js

@@ -11,19 +11,18 @@ import { normalizeColor } from "./converter.js";
  *
  * @param current - Current labels from GitHub API
  * @param desired - Desired labels from config (name -> label)
- * @param managedLabels - Names of labels managed by xfg (from manifest)
+ * @param deleteOrphaned - If true, delete current labels not in desired config
  * @param noDelete - If true, skip delete operations
  * @returns Array of changes to apply
  * @throws Error if rename collisions are detected
  */
-export function diffLabels(current, desired, managedLabels, noDelete) {
+export function diffLabels(current, desired, deleteOrphaned, noDelete) {
     const changes = [];
     // Build case-insensitive lookup of current labels
     const currentByName = new Map();
     for (const label of current) {
         currentByName.set(label.name.toLowerCase(), label);
     }
-    const managedSet = new Set(managedLabels.map((n) => n.toLowerCase()));
     // Collect rename targets for collision detection
     const renameTargets = new Map(); // lowercase target -> source name
     for (const [name, label] of Object.entries(desired)) {
@@ -38,10 +37,10 @@ export function diffLabels(current, desired, managedLabels, noDelete) {
     // Determine which labels will be deleted (for collision checking)
     const desiredLower = new Set(Object.keys(desired).map((n) => n.toLowerCase()));
     const deletedNames = new Set();
-    if (!noDelete) {
-        for (const name of managedSet) {
-            if (!desiredLower.has(name) && currentByName.has(name)) {
-                deletedNames.add(name);
+    if (deleteOrphaned && !noDelete) {
+        for (const nameLower of currentByName.keys()) {
+            if (!desiredLower.has(nameLower)) {
+                deletedNames.add(nameLower);
             }
         }
     }
@@ -130,18 +129,15 @@ export function diffLabels(current, desired, managedLabels, noDelete) {
             }
         }
     }
-    // Check for orphaned labels (in manifest but not in desired config)
-    if (!noDelete) {
-        for (const name of managedSet) {
-            if (!desiredLower.has(name)) {
-                const currentLabel = currentByName.get(name);
-                if (currentLabel) {
-                    changes.push({
-                        action: "delete",
-                        name: currentLabel.name,
-                        current: currentLabel,
-                    });
-                }
+    // Desired-state orphan detection: delete ALL current not in desired
+    if (deleteOrphaned && !noDelete) {
+        for (const [nameLower, currentLabel] of currentByName) {
+            if (!desiredLower.has(nameLower)) {
+                changes.push({
+                    action: "delete",
+                    name: currentLabel.name,
+                    current: currentLabel,
+                });
             }
         }
     }

package/dist/settings/labels/processor.d.ts

@@ -6,9 +6,7 @@ export interface ILabelsProcessor {
     process(repoConfig: RepoConfig, repoInfo: RepoInfo, options: LabelsProcessorOptions): Promise<LabelsProcessorResult>;
 }
 export interface LabelsProcessorOptions {
-    configId: string;
     dryRun?: boolean;
-    managedLabels: string[];
     noDelete?: boolean;
     token?: string;
 }
@@ -24,9 +22,6 @@ export interface LabelsProcessorResult {
         delete: number;
         unchanged: number;
     };
-    manifestUpdate?: {
-        labels: string[];
-    };
     planOutput?: LabelsPlanResult;
 }
 /**
@@ -45,11 +40,6 @@ export declare class LabelsProcessor implements ILabelsProcessor {
      * Format change counts into a summary string.
      */
     private formatChangeSummary;
-    /**
-     * Compute manifest update based on current config.
-     * Only labels with deleteOrphaned enabled should be tracked.
-     */
-    private computeManifestUpdate;
     /**
      * Resolves a GitHub App installation token for the given repo.
      */

package/dist/settings/labels/processor.js

@@ -29,7 +29,7 @@ export class LabelsProcessor {
      */
     async process(repoConfig, repoInfo, options) {
         const repoName = getRepoDisplayName(repoInfo);
-        const { dryRun, managedLabels, noDelete, token } = options;
+        const { dryRun, noDelete, token } = options;
         // Check if this is a GitHub repo
         if (!isGitHubRepo(repoInfo)) {
             return {
@@ -44,7 +44,7 @@ export class LabelsProcessor {
         const desiredLabels = settings?.labels ?? {};
         const deleteOrphaned = settings?.deleteOrphaned ?? false;
         // If no labels configured, skip
-        if (Object.keys(desiredLabels).length === 0 && managedLabels.length === 0) {
+        if (Object.keys(desiredLabels).length === 0) {
             return {
                 success: true,
                 repoName,
@@ -58,7 +58,7 @@ export class LabelsProcessor {
             const strategyOptions = { token: effectiveToken, host: githubRepo.host };
             const currentLabels = await this.strategy.list(githubRepo, strategyOptions);
             // Compute diff
-            const changes = diffLabels(currentLabels, desiredLabels, managedLabels, noDelete ?? false);
+            const changes = diffLabels(currentLabels, desiredLabels, deleteOrphaned, noDelete ?? false);
             // Count changes by type
             const changeCounts = {
                 create: changes.filter((c) => c.action === "create").length,
@@ -77,7 +77,6 @@ export class LabelsProcessor {
                     dryRun: true,
                     changes: changeCounts,
                     planOutput,
-                    manifestUpdate: this.computeManifestUpdate(desiredLabels, deleteOrphaned),
                 };
             }
             // Apply changes (diff is already sorted: delete, update, create, unchanged)
@@ -133,7 +132,6 @@ export class LabelsProcessor {
                 message: appliedCount > 0 ? `Applied: ${summary}` : "No changes needed",
                 changes: changeCounts,
                 planOutput,
-                manifestUpdate: this.computeManifestUpdate(desiredLabels, deleteOrphaned),
             };
         }
         catch (error) {
@@ -160,17 +158,6 @@ export class LabelsProcessor {
             parts.push(`${counts.unchanged} unchanged`);
         return parts.length > 0 ? parts.join(", ") : "no changes";
     }
-    /**
-     * Compute manifest update based on current config.
-     * Only labels with deleteOrphaned enabled should be tracked.
-     */
-    computeManifestUpdate(labels, deleteOrphaned) {
-        if (!deleteOrphaned) {
-            return undefined;
-        }
-        const labelNames = Object.keys(labels).sort();
-        return { labels: labelNames };
-    }
     /**
      * Resolves a GitHub App installation token for the given repo.
      */

package/dist/settings/rulesets/diff.d.ts

@@ -25,10 +25,10 @@ export declare function projectToDesiredShape(current: unknown, desired: unknown
  *
  * @param current - Current rulesets from GitHub API
  * @param desired - Desired rulesets from config (name → ruleset)
- * @param managedNames - Names of rulesets managed by xfg (from manifest)
+ * @param deleteOrphaned - When true, delete ALL current rulesets not in desired (desired-state model)
  * @returns Array of changes to apply
  */
-export declare function diffRulesets(current: GitHubRuleset[], desired: Map<string, Ruleset>, managedNames: string[]): RulesetChange[];
+export declare function diffRulesets(current: GitHubRuleset[], desired: Map<string, Ruleset>, deleteOrphaned: boolean): RulesetChange[];
 /**
  * Formats diff output for display (dry-run mode).
  *