@aspruyt/xfg 4.0.0 → 4.0.2

package/dist/cli/types.d.ts

@@ -1,53 +1,24 @@
-import { RepoConfig } from "../config/index.js";
-import { RepoInfo } from "../shared/repo-detector.js";
+import type { MergeMode, MergeStrategy, RepoConfig } from "../config/index.js";
 import type { IRepoLifecycleManager } from "../lifecycle/index.js";
-import { type ProcessorResult, type ProcessorOptions } from "../sync/index.js";
-import { RulesetProcessorOptions, RulesetProcessorResult } from "../settings/rulesets/processor.js";
-import { type IRepoSettingsProcessor } from "../settings/repo-settings/processor.js";
-import { type ILabelsProcessor } from "../settings/labels/processor.js";
-/**
- * Processor interface for dependency injection in tests.
- */
-export interface IRepositoryProcessor {
-    process(repoConfig: RepoConfig, repoInfo: RepoInfo, options: ProcessorOptions): Promise<ProcessorResult>;
-}
-/**
- * Factory function type for creating processors.
- */
+import { type IRepositoryProcessor } from "../sync/index.js";
+import { type ISettingsProcessor, type IRulesetProcessor, type IRepoSettingsProcessor, type ILabelsProcessor } from "../settings/index.js";
+import type { RepoInfo } from "../shared/repo-detector.js";
+import type { ResultsCollector } from "./results-collector.js";
+export type { IRepositoryProcessor, IRulesetProcessor };
 export type ProcessorFactory = () => IRepositoryProcessor;
 /**
  * Default factory that creates a real RepositoryProcessor.
  */
 export declare const defaultProcessorFactory: ProcessorFactory;
 /**
- * Ruleset processor interface for dependency injection in tests.
- */
-export interface IRulesetProcessor {
-    process(repoConfig: RepoConfig, repoInfo: RepoInfo, options: RulesetProcessorOptions): Promise<RulesetProcessorResult>;
-}
-/**
- * Factory function type for creating ruleset processors.
- */
-export type RulesetProcessorFactory = () => IRulesetProcessor;
-/**
- * Default factory that creates a real RulesetProcessor.
+ * Generic factory type for settings processors.
  */
+export type SettingsProcessorFactory<T extends ISettingsProcessor> = () => T;
+export type RulesetProcessorFactory = SettingsProcessorFactory<IRulesetProcessor>;
+export type RepoSettingsProcessorFactory = SettingsProcessorFactory<IRepoSettingsProcessor>;
+export type LabelsProcessorFactory = SettingsProcessorFactory<ILabelsProcessor>;
 export declare const defaultRulesetProcessorFactory: RulesetProcessorFactory;
-/**
- * Repo settings processor factory function type.
- */
-export type RepoSettingsProcessorFactory = () => IRepoSettingsProcessor;
-/**
- * Default factory that creates a real RepoSettingsProcessor.
- */
 export declare const defaultRepoSettingsProcessorFactory: RepoSettingsProcessorFactory;
-/**
- * Labels processor interface for dependency injection in tests.
- */
-export type LabelsProcessorFactory = () => ILabelsProcessor;
-/**
- * Default factory that creates a real LabelsProcessor.
- */
 export declare const defaultLabelsProcessorFactory: LabelsProcessorFactory;
 /**
  * Dependencies for the sync command (dependency injection).
@@ -59,4 +30,53 @@ export interface SyncDependencies {
     repoSettingsProcessorFactory?: RepoSettingsProcessorFactory;
     labelsProcessorFactory?: LabelsProcessorFactory;
 }
+export interface SharedOptions {
+    config: string;
+    dryRun?: boolean;
+    workDir?: string;
+    retries?: number;
+    noDelete?: boolean;
+}
+export interface SyncOptions extends SharedOptions {
+    branch?: string;
+    merge?: MergeMode;
+    mergeStrategy?: MergeStrategy;
+    deleteBranch?: boolean;
+}
+export interface SyncResultEntry {
+    repoName: string;
+    success: boolean;
+    fileChanges: Array<{
+        path: string;
+        action: "create" | "update" | "delete";
+    }>;
+    prUrl?: string;
+    mergeOutcome?: "manual" | "auto" | "force" | "direct";
+    error?: string;
+}
+export interface SettingsResult {
+    success: boolean;
+    message: string;
+    skipped?: boolean;
+    planOutput?: {
+        lines?: string[];
+    };
+    warnings?: string[];
+}
+/**
+ * Context for applying repo settings (rulesets, labels, repo config).
+ * Groups parameters that were previously passed individually.
+ */
+export interface ApplyRepoSettingsContext {
+    repoConfig: RepoConfig;
+    repoInfo: RepoInfo;
+    repoName: string;
+    current: number;
+    options: SyncOptions;
+    token: string | undefined;
+    settingsCollector: ResultsCollector;
+    rulesetProcessorFactory: NonNullable<SyncDependencies["rulesetProcessorFactory"]>;
+    repoSettingsProcessorFactory: NonNullable<SyncDependencies["repoSettingsProcessorFactory"]>;
+    labelsProcessorFactory: NonNullable<SyncDependencies["labelsProcessorFactory"]>;
+}
 export type { IRepoSettingsProcessor, ILabelsProcessor };

package/dist/cli/types.js

@@ -1,20 +1,9 @@
 import { RepositoryProcessor, } from "../sync/index.js";
-import { RulesetProcessor, } from "../settings/rulesets/processor.js";
-import { RepoSettingsProcessor, } from "../settings/repo-settings/processor.js";
-import { LabelsProcessor, } from "../settings/labels/processor.js";
+import { RulesetProcessor, RepoSettingsProcessor, LabelsProcessor, } from "../settings/index.js";
 /**
  * Default factory that creates a real RepositoryProcessor.
  */
 export const defaultProcessorFactory = () => new RepositoryProcessor();
-/**
- * Default factory that creates a real RulesetProcessor.
- */
 export const defaultRulesetProcessorFactory = () => new RulesetProcessor();
-/**
- * Default factory that creates a real RepoSettingsProcessor.
- */
 export const defaultRepoSettingsProcessorFactory = () => new RepoSettingsProcessor();
-/**
- * Default factory that creates a real LabelsProcessor.
- */
 export const defaultLabelsProcessorFactory = () => new LabelsProcessor();

package/dist/config/errors.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Thrown when config validation fails.
+ * Distinguishable from I/O errors by type, so callers and retry logic
+ * can treat validation failures as permanent without message-parsing.
+ */
+export declare class ValidationError extends Error {
+    readonly name = "ValidationError";
+    constructor(message: string);
+}

package/dist/config/errors.js

@@ -0,0 +1,11 @@
+/**
+ * Thrown when config validation fails.
+ * Distinguishable from I/O errors by type, so callers and retry logic
+ * can treat validation failures as permanent without message-parsing.
+ */
+export class ValidationError extends Error {
+    name = "ValidationError";
+    constructor(message) {
+        super(message);
+    }
+}

package/dist/config/file-reference-resolver.d.ts

@@ -1,5 +1,5 @@
 import type { ContentValue, RawConfig } from "./types.js";
-export interface FileReferenceOptions {
+interface FileReferenceOptions {
     configDir: string;
 }
 /**
@@ -18,3 +18,4 @@ export declare function resolveFileReference(reference: string, configDir: strin
  * Walks through files at root level and per-repo level.
  */
 export declare function resolveFileReferencesInConfig(raw: RawConfig, options: FileReferenceOptions): RawConfig;
+export {};

package/dist/config/file-reference-resolver.js

@@ -2,6 +2,8 @@ import { readFileSync } from "node:fs";
 import { resolve, isAbsolute, normalize, extname, relative } from "node:path";
 import JSON5 from "json5";
 import { parse as parseYaml } from "yaml";
+import { toErrorMessage } from "../shared/type-guards.js";
+import { ValidationError } from "./errors.js";
 /**
  * Check if a value is a file reference (string starting with @)
  */
@@ -17,11 +19,11 @@ export function isFileReference(value) {
 export function resolveFileReference(reference, configDir) {
     const relativePath = reference.slice(1); // Remove @ prefix
     if (relativePath.length === 0) {
-        throw new Error(`Invalid file reference "${reference}": path is empty`);
+        throw new ValidationError(`Invalid file reference "${reference}": path is empty`);
     }
     // Security: block absolute paths
     if (isAbsolute(relativePath)) {
-        throw new Error(`File reference "${reference}" uses absolute path. Use relative paths only.`);
+        throw new ValidationError(`File reference "${reference}" uses absolute path. Use relative paths only.`);
     }
     const resolvedPath = resolve(configDir, relativePath);
     const normalizedResolved = normalize(resolvedPath);
@@ -32,7 +34,7 @@ export function resolveFileReference(reference, configDir) {
     // where normalize() returns paths with backslash separators.
     const pathFromConfig = relative(normalizedConfigDir, normalizedResolved);
     if (pathFromConfig.startsWith("..") || isAbsolute(pathFromConfig)) {
-        throw new Error(`File reference "${reference}" escapes config directory. ` +
+        throw new ValidationError(`File reference "${reference}" escapes config directory. ` +
             `References must be within "${configDir}".`);
     }
     // Load file
@@ -41,7 +43,7 @@ export function resolveFileReference(reference, configDir) {
         content = readFileSync(resolvedPath, "utf-8");
     }
     catch (error) {
-        const msg = error instanceof Error ? error.message : String(error);
+        const msg = toErrorMessage(error);
         throw new Error(`Failed to load file reference "${reference}": ${msg}`);
     }
     // Parse based on extension
@@ -51,7 +53,7 @@ export function resolveFileReference(reference, configDir) {
             return JSON.parse(content);
         }
         catch (error) {
-            const msg = error instanceof Error ? error.message : String(error);
+            const msg = toErrorMessage(error);
             throw new Error(`Invalid JSON in "${reference}": ${msg}`);
         }
     }
@@ -60,7 +62,7 @@ export function resolveFileReference(reference, configDir) {
             return JSON5.parse(content);
         }
         catch (error) {
-            const msg = error instanceof Error ? error.message : String(error);
+            const msg = toErrorMessage(error);
             throw new Error(`Invalid JSON5 in "${reference}": ${msg}`);
         }
     }
@@ -69,7 +71,7 @@ export function resolveFileReference(reference, configDir) {
             return parseYaml(content);
         }
         catch (error) {
-            const msg = error instanceof Error ? error.message : String(error);
+            const msg = toErrorMessage(error);
             throw new Error(`Invalid YAML in "${reference}": ${msg}`);
         }
     }
@@ -103,7 +105,7 @@ export function resolveFileReferencesInConfig(raw, options) {
     if (result.prTemplate && isFileReference(result.prTemplate)) {
         const resolved = resolveFileReference(result.prTemplate, configDir);
         if (typeof resolved !== "string") {
-            throw new Error(`prTemplate file reference "${result.prTemplate}" must resolve to a text file, not JSON/YAML`);
+            throw new ValidationError(`prTemplate file reference "${result.prTemplate}" must resolve to a text file, not JSON/YAML`);
         }
         result.prTemplate = resolved;
     }

package/dist/config/formatter.d.ts

@@ -1,8 +1,8 @@
-export type OutputFormat = "json" | "json5" | "yaml";
+type OutputFormat = "json" | "json5" | "yaml";
 /**
  * Options for content conversion.
  */
-export interface ConvertOptions {
+interface ConvertOptions {
     header?: string[];
     schemaUrl?: string;
 }
@@ -15,3 +15,4 @@ export declare function detectOutputFormat(fileName: string): OutputFormat;
  * Handles null content (empty files), text content (string/string[]), and object content (JSON/YAML).
  */
 export declare function convertContentToString(content: Record<string, unknown> | string | string[] | null, fileName: string, options?: ConvertOptions): string;
+export {};

package/dist/config/index.d.ts

@@ -1,7 +1,5 @@
-export type { MergeMode, MergeStrategy, PRMergeOptions, RulesetTarget, RulesetEnforcement, BypassActorType, BypassMode, PatternOperator, MergeMethod, AlertsThreshold, SecurityAlertsThreshold, BypassActor, RefNameCondition, RulesetConditions, StatusCheckConfig, RequiredReviewer, CodeScanningTool, WorkflowConfig, PullRequestRuleParameters, RequiredStatusChecksParameters, UpdateRuleParameters, RequiredDeploymentsParameters, CodeScanningParameters, CodeQualityParameters, WorkflowsParameters, PatternRuleParameters, FilePathRestrictionParameters, FileExtensionRestrictionParameters, MaxFilePathLengthParameters, MaxFileSizeParameters, PullRequestRule, RequiredStatusChecksRule, RequiredSignaturesRule, RequiredLinearHistoryRule, NonFastForwardRule, CreationRule, UpdateRule, DeletionRule, RequiredDeploymentsRule, CodeScanningRule, CodeQualityRule, WorkflowsRule, CommitAuthorEmailPatternRule, CommitMessagePatternRule, CommitterEmailPatternRule, BranchNamePatternRule, TagNamePatternRule, FilePathRestrictionRule, FileExtensionRestrictionRule, MaxFilePathLengthRule, MaxFileSizeRule, RulesetRule, Ruleset, SquashMergeCommitTitle, SquashMergeCommitMessage, MergeCommitTitle, MergeCommitMessage, RepoVisibility, GitHubRepoSettings, Label, RepoSettings, ContentValue, RawFileConfig, RawRepoFileOverride, RawGroupConfig, RawRootSettings, RawRepoSettings, RawRepoConfig, RawConfig, FileContent, RepoConfig, Config, } from "./types.js";
-export { RULESET_FIELD_MAP, RULESET_COMPARABLE_FIELDS } from "./types.js";
+export type { MergeMode, MergeStrategy, BypassActor, StatusCheckConfig, CodeScanningTool, PullRequestRuleParameters, RulesetRule, Ruleset, GitHubRepoSettings, Label, RepoSettings, ContentValue, RawFileConfig, RawRepoFileOverride, RawRepoSettings, RawRepoConfig, RawConfig, RepoConfig, Config, } from "./types.js";
+export { RULESET_COMPARABLE_FIELDS } from "./types.js";
 export { loadRawConfig, loadConfig, normalizeConfig } from "./loader.js";
-export { convertContentToString, detectOutputFormat, type OutputFormat, type ConvertOptions, } from "./formatter.js";
-export { isFileReference, resolveFileReference, type FileReferenceOptions, } from "./file-reference-resolver.js";
-export { arrayMergeStrategies, deepMerge, stripMergeDirectives, createMergeContext, isTextContent, mergeTextContent, type ArrayMergeStrategy, type ArrayMergeHandler, type MergeContext, } from "./merge.js";
-export { validateRawConfig, validateSettings, validateForSync, hasActionableSettings, } from "./validator.js";
+export { convertContentToString } from "./formatter.js";
+export { ValidationError } from "./errors.js";

package/dist/config/index.js

@@ -1,12 +1,8 @@
 // Re-export values (non-type exports)
-export { RULESET_FIELD_MAP, RULESET_COMPARABLE_FIELDS } from "./types.js";
+export { RULESET_COMPARABLE_FIELDS } from "./types.js";
 // Re-export loading functions
 export { loadRawConfig, loadConfig, normalizeConfig } from "./loader.js";
 // Config formatting
-export { convertContentToString, detectOutputFormat, } from "./formatter.js";
-// File reference resolution
-export { isFileReference, resolveFileReference, } from "./file-reference-resolver.js";
-// Deep merge utilities
-export { arrayMergeStrategies, deepMerge, stripMergeDirectives, createMergeContext, isTextContent, mergeTextContent, } from "./merge.js";
-// Validation
-export { validateRawConfig, validateSettings, validateForSync, hasActionableSettings, } from "./validator.js";
+export { convertContentToString } from "./formatter.js";
+// Errors
+export { ValidationError } from "./errors.js";

package/dist/config/loader.js

@@ -4,6 +4,8 @@ import { parse } from "yaml";
 import { validateRawConfig } from "./validator.js";
 import { normalizeConfig as normalizeConfigInternal } from "./normalizer.js";
 import { resolveFileReferencesInConfig } from "./file-reference-resolver.js";
+import { toErrorMessage } from "../shared/type-guards.js";
+import { ValidationError } from "./errors.js";
 export { normalizeConfigInternal as normalizeConfig };
 /**
  * Load and validate raw config without normalization.
@@ -17,8 +19,8 @@ export function loadRawConfig(filePath) {
         rawConfig = parse(content);
     }
     catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        throw new Error(`Failed to parse YAML config at ${filePath}: ${message}`);
+        const message = toErrorMessage(error);
+        throw new ValidationError(`Failed to parse YAML config at ${filePath}: ${message}`);
     }
     // Resolve file references before validation so content type checking works
     rawConfig = resolveFileReferencesInConfig(rawConfig, { configDir });

package/dist/config/merge.d.ts

@@ -3,15 +3,6 @@
  * Supports configurable array merge strategies via $arrayMerge directive.
  */
 export type ArrayMergeStrategy = "replace" | "append" | "prepend";
-/**
- * Handler function type for array merge strategies.
- */
-export type ArrayMergeHandler = (base: unknown[], overlay: unknown[]) => unknown[];
-/**
- * Strategy map for array merge operations.
- * Extensible: add new strategies by adding to this map.
- */
-export declare const arrayMergeStrategies: Map<ArrayMergeStrategy, ArrayMergeHandler>;
 export interface MergeContext {
     arrayStrategies: Map<string, ArrayMergeStrategy>;
     defaultArrayStrategy: ArrayMergeStrategy;

package/dist/config/merge.js

@@ -2,21 +2,16 @@
  * Deep merge utilities for JSON configuration objects.
  * Supports configurable array merge strategies via $arrayMerge directive.
  */
+import { isPlainObject } from "../shared/type-guards.js";
 /**
  * Strategy map for array merge operations.
  * Extensible: add new strategies by adding to this map.
  */
-export const arrayMergeStrategies = new Map([
+const arrayMergeStrategies = new Map([
     ["replace", (_base, overlay) => overlay],
     ["append", (base, overlay) => [...base, ...overlay]],
     ["prepend", (base, overlay) => [...overlay, ...base]],
 ]);
-/**
- * Check if a value is a plain object (not null, not array).
- */
-function isPlainObject(val) {
-    return typeof val === "object" && val !== null && !Array.isArray(val);
-}
 /**
  * Merge two arrays based on the specified strategy.
  */

package/dist/config/normalizer.d.ts

@@ -1,4 +1,8 @@
 import type { RawConfig, Config, RepoSettings, RawRootSettings, RawRepoSettings } from "./types.js";
+/**
+ * Merges settings: per-repo settings deep merge with root settings.
+ * Returns undefined if no settings are defined.
+ */
 export declare function mergeSettings(root: RawRootSettings | undefined, perRepo: RawRepoSettings | undefined): RepoSettings | undefined;
 /**
  * Normalizes raw config into expanded, merged config.

package/dist/config/normalizer.js

@@ -1,5 +1,55 @@
 import { deepMerge, stripMergeDirectives, createMergeContext, isTextContent, mergeTextContent, } from "./merge.js";
 import { interpolateContent } from "../shared/env.js";
+/**
+ * Clone content, stripping merge directives from object content.
+ * Text content is cloned as-is since it has no merge directives.
+ */
+function cloneContent(content) {
+    if (isTextContent(content)) {
+        return structuredClone(content);
+    }
+    return stripMergeDirectives(structuredClone(content));
+}
+/**
+ * Resolve the final content for a file by applying override/inherit/merge rules.
+ *
+ * Returns null when the file should be empty (e.g. override with no content,
+ * or root file with no content and no repo override).
+ */
+function resolveFileContent(rootContent, repoOverride, mergeStrategy) {
+    // Override mode: use only repo content
+    if (repoOverride?.override) {
+        return repoOverride.content !== undefined
+            ? cloneContent(repoOverride.content)
+            : null;
+    }
+    // Root has no content — use repo content if provided, otherwise empty
+    if (rootContent === undefined) {
+        return repoOverride?.content ? cloneContent(repoOverride.content) : null;
+    }
+    // No repo override — use root content as-is
+    if (!repoOverride?.content) {
+        return structuredClone(rootContent);
+    }
+    // Both exist — merge
+    return mergeContentPair(rootContent, repoOverride.content, mergeStrategy);
+}
+/**
+ * Merge two content values using the appropriate strategy.
+ * Handles text+text, object+object, and type mismatch cases.
+ */
+function mergeContentPair(base, overlay, strategy) {
+    if (isTextContent(base) && isTextContent(overlay)) {
+        return mergeTextContent(base, overlay, strategy);
+    }
+    if (!isTextContent(base) && !isTextContent(overlay)) {
+        const ctx = createMergeContext(strategy);
+        const merged = deepMerge(structuredClone(base), overlay, ctx);
+        return stripMergeDirectives(merged);
+    }
+    // Type mismatch — overlay wins
+    return overlay;
+}
 /**
  * Checks whether an object's `inherit` property is not explicitly set to false.
  * Replaces the repeated `(x )?.inherit !== false` pattern.
@@ -59,10 +109,6 @@ function mergeRuleset(root, perRepo) {
     const merged = deepMerge(structuredClone(root), perRepo, ctx);
     return merged;
 }
-/**
- * Merges settings: per-repo settings deep merge with root settings.
- * Returns undefined if no settings are defined.
- */
 /**
  * Merges root and per-repo label configs.
  * Per-repo labels override root labels by name.
@@ -99,6 +145,10 @@ function mergeLabels(rootLabels, repoLabels) {
     }
     return Object.keys(result).length > 0 ? result : undefined;
 }
+/**
+ * Merges settings: per-repo settings deep merge with root settings.
+ * Returns undefined if no settings are defined.
+ */
 export function mergeSettings(root, perRepo) {
     if (!root && !perRepo)
         return undefined;
@@ -106,7 +156,6 @@ export function mergeSettings(root, perRepo) {
     // Merge rulesets by name - each ruleset is deep merged
     const rootRulesets = root?.rulesets ?? {};
     const repoRulesets = perRepo?.rulesets ?? {};
-    // Check if repo opts out of all inherited rulesets
     const inheritRulesets = shouldInherit(repoRulesets);
     const allRulesetNames = new Set([
         ...Object.keys(rootRulesets).filter((name) => name !== "inherit"),
@@ -194,19 +243,8 @@ function mergeGroupFiles(rootFiles, groupNames, groupDefs) {
                     // override:true or one side missing content — use overlay content
                     mergedContent = overlay.content ?? existing.content;
                 }
-                else if (isTextContent(existing.content) &&
-                    isTextContent(overlay.content)) {
-                    mergedContent = mergeTextContent(existing.content, overlay.content, existing.mergeStrategy ?? "replace");
-                }
-                else if (!isTextContent(existing.content) &&
-                    !isTextContent(overlay.content)) {
-                    const ctx = createMergeContext(existing.mergeStrategy ?? "replace");
-                    mergedContent = deepMerge(structuredClone(existing.content), overlay.content, ctx);
-                    mergedContent = stripMergeDirectives(mergedContent);
-                }
                 else {
-                    // Type mismatch — overlay wins
-                    mergedContent = overlay.content;
+                    mergedContent = mergeContentPair(existing.content, overlay.content, existing.mergeStrategy ?? "replace");
                 }
                 const { override: _override, ...restFileConfig } = fileConfig;
                 accumulated[fileName] = {
@@ -332,7 +370,6 @@ function mergeGroupSettings(rootSettings, groupNames, groupDefs) {
 export function normalizeConfig(raw) {
     const expandedRepos = [];
     for (const rawRepo of raw.repos) {
-        // Step 1: Expand git arrays
         const gitUrls = Array.isArray(rawRepo.git) ? rawRepo.git : [rawRepo.git];
         // Resolve groups: build effective root files/prOptions/settings by merging group layers
         const effectiveRootFiles = rawRepo.groups?.length
@@ -347,9 +384,7 @@ export function normalizeConfig(raw) {
         const fileNames = Object.keys(effectiveRootFiles);
         for (const gitUrl of gitUrls) {
             const files = [];
-            // Check if repo opts out of all inherited files
             const inheritFiles = shouldInherit(rawRepo.files);
-            // Step 2: Process each file definition
             for (const fileName of fileNames) {
                 // Skip reserved key
                 if (fileName === "inherit")
@@ -365,56 +400,7 @@ export function normalizeConfig(raw) {
                 }
                 const fileConfig = effectiveRootFiles[fileName];
                 const fileStrategy = fileConfig.mergeStrategy ?? "replace";
-                // Step 3: Compute merged content for this file
-                let mergedContent;
-                if (repoOverride?.override) {
-                    // Override mode: use only repo file content (may be undefined for empty file)
-                    if (repoOverride.content === undefined) {
-                        mergedContent = null;
-                    }
-                    else if (isTextContent(repoOverride.content)) {
-                        // Text content: use as-is (no merge directives to strip)
-                        mergedContent = structuredClone(repoOverride.content);
-                    }
-                    else {
-                        mergedContent = stripMergeDirectives(structuredClone(repoOverride.content));
-                    }
-                }
-                else if (fileConfig.content === undefined) {
-                    // Root file has no content = empty file (unless repo provides content)
-                    if (repoOverride?.content) {
-                        if (isTextContent(repoOverride.content)) {
-                            mergedContent = structuredClone(repoOverride.content);
-                        }
-                        else {
-                            mergedContent = stripMergeDirectives(structuredClone(repoOverride.content));
-                        }
-                    }
-                    else {
-                        mergedContent = null;
-                    }
-                }
-                else if (!repoOverride?.content) {
-                    // No repo override: use file base content as-is
-                    mergedContent = structuredClone(fileConfig.content);
-                }
-                else {
-                    // Merge mode: handle text vs object content
-                    if (isTextContent(fileConfig.content)) {
-                        // Text content merging - validate overlay is also text
-                        if (!isTextContent(repoOverride.content)) {
-                            throw new Error(`Expected text content for ${fileName}, got object`);
-                        }
-                        mergedContent = mergeTextContent(fileConfig.content, repoOverride.content, fileStrategy);
-                    }
-                    else {
-                        // Object content: deep merge file base + repo overlay
-                        const ctx = createMergeContext(fileStrategy);
-                        mergedContent = deepMerge(structuredClone(fileConfig.content), repoOverride.content, ctx);
-                        mergedContent = stripMergeDirectives(mergedContent);
-                    }
-                }
-                // Step 4: Interpolate env vars (only if content exists)
+                let mergedContent = resolveFileContent(fileConfig.content, repoOverride, fileStrategy);
                 if (mergedContent !== null) {
                     mergedContent = interpolateContent(mergedContent, { strict: true });
                 }
@@ -459,46 +445,11 @@ export function normalizeConfig(raw) {
             });
         }
     }
-    // Normalize root settings (filter out inherit key if present)
-    let normalizedRootSettings;
-    if (raw.settings) {
-        normalizedRootSettings = {};
-        if (raw.settings.rulesets) {
-            const filteredRulesets = {};
-            for (const [name, ruleset] of Object.entries(raw.settings.rulesets)) {
-                if (name === "inherit" || ruleset === false)
-                    continue;
-                filteredRulesets[name] = ruleset;
-            }
-            if (Object.keys(filteredRulesets).length > 0) {
-                normalizedRootSettings.rulesets = filteredRulesets;
-            }
-        }
-        if (raw.settings.repo) {
-            normalizedRootSettings.repo = raw.settings.repo;
-        }
-        if (raw.settings.labels) {
-            const filteredLabels = {};
-            for (const [name, label] of Object.entries(raw.settings.labels)) {
-                if (name === "inherit" || label === false)
-                    continue;
-                const l = label;
-                filteredLabels[name] = {
-                    ...l,
-                    color: l.color.replace(/^#/, "").toLowerCase(),
-                };
-            }
-            if (Object.keys(filteredLabels).length > 0) {
-                normalizedRootSettings.labels = filteredLabels;
-            }
-        }
-        if (raw.settings.deleteOrphaned !== undefined) {
-            normalizedRootSettings.deleteOrphaned = raw.settings.deleteOrphaned;
-        }
-        if (Object.keys(normalizedRootSettings).length === 0) {
-            normalizedRootSettings = undefined;
-        }
-    }
+    // Normalize root settings by reusing mergeSettings with no per-repo overlay.
+    // This filters out inherit/false entries from rulesets/labels, normalizes
+    // label colors, and handles deleteOrphaned — the same logic that per-repo
+    // merging already applies.
+    const normalizedRootSettings = mergeSettings(raw.settings, undefined);
     return {
         id: raw.id,
         repos: expandedRepos,