@aspruyt/xfg 4.0.2 → 4.0.5

package/dist/cli/index.d.ts

@@ -1,3 +1,3 @@
 export { runSync } from "./sync-command.js";
-export { type IRepositoryProcessor, type ProcessorFactory, type IRulesetProcessor, type RulesetProcessorFactory, type RepoSettingsProcessorFactory, type ILabelsProcessor, type LabelsProcessorFactory, defaultProcessorFactory, defaultRulesetProcessorFactory, defaultRepoSettingsProcessorFactory, defaultLabelsProcessorFactory, } from "./types.js";
+export { type ProcessorFactory, type RulesetProcessorFactory, type RepoSettingsProcessorFactory, type LabelsProcessorFactory, } from "./types.js";
 export type { SyncOptions, SharedOptions } from "./sync-command.js";

package/dist/cli/index.js

@@ -1,7 +1 @@
-// CLI command implementations
 export { runSync } from "./sync-command.js";
-// Export types - using 'export type' for type aliases, but interfaces need special handling
-// For ESM compatibility, re-export everything from types.js
-export { 
-// Runtime values
-defaultProcessorFactory, defaultRulesetProcessorFactory, defaultRepoSettingsProcessorFactory, defaultLabelsProcessorFactory, } from "./types.js";

package/dist/cli/program.js

@@ -2,6 +2,7 @@ import { program, Command } from "commander";
 import { dirname, join } from "node:path";
 import { readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
+import { ValidationError } from "../shared/errors.js";
 import { runSync } from "./sync-command.js";
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
@@ -40,14 +41,14 @@ const syncCommand = new Command("sync")
     .option("-m, --merge <mode>", "PR merge mode: manual, auto (default, merge when checks pass), force (bypass requirements), direct (push to default branch, no PR)", (value) => {
     const valid = ["manual", "auto", "force", "direct"];
     if (!valid.includes(value)) {
-        throw new Error(`Invalid merge mode: ${value}. Valid: ${valid.join(", ")}`);
+        throw new ValidationError(`Invalid merge mode: ${value}. Valid: ${valid.join(", ")}`);
     }
     return value;
 })
     .option("--merge-strategy <strategy>", "Merge strategy: merge, squash (default), rebase", (value) => {
     const valid = ["merge", "squash", "rebase"];
     if (!valid.includes(value)) {
-        throw new Error(`Invalid merge strategy: ${value}. Valid: ${valid.join(", ")}`);
+        throw new ValidationError(`Invalid merge strategy: ${value}. Valid: ${valid.join(", ")}`);
     }
     return value;
 })

package/dist/cli/settings-report-builder.js

@@ -1,7 +1,7 @@
 export function buildSettingsReport(results) {
     const repos = [];
     const totals = {
-        settings: { add: 0, change: 0 },
+        settings: { create: 0, update: 0 },
         rulesets: { create: 0, update: 0, delete: 0 },
         labels: { create: 0, update: 0, delete: 0 },
     };
@@ -26,11 +26,11 @@ export function buildSettingsReport(results) {
                     newValue: entry.newValue,
                 };
                 repoChanges.settings.push(settingChange);
-                if (entry.action === "add") {
-                    totals.settings.add++;
+                if (entry.action === "create") {
+                    totals.settings.create++;
                 }
                 else {
-                    totals.settings.change++;
+                    totals.settings.update++;
                 }
             }
         }

package/dist/cli/sync-command.js

@@ -1,13 +1,22 @@
 import { resolve, join } from "node:path";
 import { existsSync } from "node:fs";
 import { loadRawConfig, normalizeConfig } from "../config/index.js";
+import { ValidationError, SyncError } from "../shared/errors.js";
 import { validateForSync } from "../config/validator.js";
 import { parseGitUrl, getRepoDisplayName, isGitHubRepo, } from "../shared/repo-detector.js";
-import { sanitizeBranchName, validateBranchName } from "../vcs/branch-utils.js";
+import { sanitizeBranchName, validateBranchName, } from "../shared/branch-utils.js";
 import { createTokenManager } from "../vcs/index.js";
-import { logger } from "../shared/logger.js";
+import { RepositoryProcessor } from "../sync/index.js";
+import { RulesetProcessor, RepoSettingsProcessor, LabelsProcessor, GitHubRulesetStrategy, GitHubRepoSettingsStrategy, GitHubLabelsStrategy, } from "../settings/index.js";
+import { ShellCommandExecutor } from "../shared/command-executor.js";
+import { Logger } from "../shared/logger.js";
 import { generateWorkspaceName } from "../shared/workspace-utils.js";
-import { defaultProcessorFactory, defaultRulesetProcessorFactory, defaultRepoSettingsProcessorFactory, defaultLabelsProcessorFactory, } from "./types.js";
+const defaultExecutor = new ShellCommandExecutor(process.env);
+const logger = new Logger(!!(process.env.DEBUG || process.env.XFG_DEBUG));
+const cwd = process.cwd();
+const defaultRulesetProcessorFactory = () => new RulesetProcessor(new GitHubRulesetStrategy(defaultExecutor, { cwd }));
+const defaultRepoSettingsProcessorFactory = () => new RepoSettingsProcessor(new GitHubRepoSettingsStrategy(defaultExecutor, { cwd }));
+const defaultLabelsProcessorFactory = () => new LabelsProcessor(new GitHubLabelsStrategy(defaultExecutor, { cwd }));
 import { ResultsCollector } from "./results-collector.js";
 import { buildSettingsReport } from "./settings-report-builder.js";
 import { formatSettingsReportCLI } from "../output/settings-report.js";
@@ -176,6 +185,7 @@ function displayReports(reportResults, lifecycleReportInputs, settingsCollector,
         sync: report,
         settings: settingsReport,
         dryRun,
+        summaryPath: process.env.GITHUB_STEP_SUMMARY,
     });
 }
 /**
@@ -219,11 +229,19 @@ async function processSingleRepo(repoConfig, index, ctx) {
     const repoToken = isGitHubRepo(repoInfo)
         ? (await resolveGitHubToken(repoInfo, ctx.tokenManager, repoName, logger, process.env.GH_TOKEN)).token
         : undefined;
-    const skipFileSync = await runLifecyclePhase(repoConfig, repoInfo, repoName, index, workDir, repoToken, ctx);
+    const repo = {
+        repoConfig,
+        repoInfo,
+        repoName,
+        index,
+        workDir,
+        token: repoToken,
+    };
+    const skipFileSync = await runLifecyclePhase(repo, ctx);
     if (skipFileSync)
         return;
     // Sync files via processor
-    await runFileSyncPhase(repoConfig, repoInfo, repoName, current, workDir, repoToken, ctx);
+    await runFileSyncPhase(repo, ctx);
     // Apply settings via API (GitHub-only — ADO and GitLab repos are skipped)
     await applyRepoSettings({
         repoConfig,
@@ -242,24 +260,27 @@ async function processSingleRepo(repoConfig, index, ctx) {
  * Run lifecycle check (repo existence, creation, forking).
  * Returns true if the main loop should skip file sync for this repo.
  */
-async function runLifecyclePhase(repoConfig, repoInfo, repoName, index, workDir, lifecycleToken, ctx) {
-    const current = index + 1;
+async function runLifecyclePhase(repo, ctx) {
+    const current = repo.index + 1;
     try {
-        const { outputLines, lifecycleResult } = await runLifecycleCheck(repoConfig, repoInfo, index, {
+        const { outputLines, lifecycleResult } = await runLifecycleCheck(repo.repoConfig, repo.repoInfo, {
             dryRun: ctx.options.dryRun ?? false,
-            resolvedWorkDir: workDir,
+            resolvedWorkDir: repo.workDir,
             githubHosts: ctx.config.githubHosts,
-            token: lifecycleToken,
-        }, ctx.lifecycleManager, ctx.config.settings?.repo);
+            token: repo.token,
+            repoIndex: repo.index,
+            lifecycleManager: ctx.lifecycleManager,
+            repoSettings: ctx.config.settings?.repo,
+        });
         for (const line of outputLines) {
             logger.info(line);
         }
         const createSettings = toCreateRepoSettings(ctx.config.settings?.repo);
         ctx.lifecycleReportInputs.push({
-            repoName,
+            repoName: repo.repoName,
             action: lifecycleResult.action,
-            upstream: repoConfig.upstream,
-            source: repoConfig.source,
+            upstream: repo.repoConfig.upstream,
+            source: repo.repoConfig.source,
             settings: createSettings
                 ? {
                     visibility: createSettings.visibility,
@@ -270,7 +291,7 @@ async function runLifecyclePhase(repoConfig, repoInfo, repoName, index, workDir,
         // In dry-run, skip processing repos that don't exist yet
         if (ctx.options.dryRun && lifecycleResult.action !== "existed") {
             ctx.reportResults.push({
-                repoName,
+                repoName: repo.repoName,
                 success: true,
                 fileChanges: [],
             });
@@ -279,9 +300,9 @@ async function runLifecyclePhase(repoConfig, repoInfo, repoName, index, workDir,
         return false;
     }
     catch (error) {
-        logger.error(current, repoName, `Lifecycle error: ${toErrorMessage(error)}`);
+        logger.error(current, repo.repoName, `Lifecycle error: ${toErrorMessage(error)}`);
         ctx.reportResults.push({
-            repoName,
+            repoName: repo.repoName,
             success: false,
             fileChanges: [],
             error: toErrorMessage(error),
@@ -292,23 +313,25 @@ async function runLifecyclePhase(repoConfig, repoInfo, repoName, index, workDir,
 /**
  * Run the file sync processor for a single repo and collect results.
  */
-async function runFileSyncPhase(repoConfig, repoInfo, repoName, current, workDir, token, ctx) {
+async function runFileSyncPhase(repo, ctx) {
+    const current = repo.index + 1;
     try {
-        logger.progress(current, repoName, "Processing...");
-        const result = await ctx.processor.process(repoConfig, repoInfo, {
+        logger.progress(current, repo.repoName, "Processing...");
+        const result = await ctx.processor.process(repo.repoConfig, repo.repoInfo, {
             branchName: ctx.branchName,
-            workDir,
+            workDir: repo.workDir,
             configId: ctx.config.id,
             dryRun: ctx.options.dryRun,
             retries: ctx.options.retries,
+            executor: defaultExecutor,
             prTemplate: ctx.config.prTemplate,
             noDelete: ctx.options.noDelete,
-            token,
-            isGraphQLCommitMode: isGitHubRepo(repoInfo) && ctx.tokenManager !== null,
+            token: repo.token,
+            hasAppCredentials: isGitHubRepo(repo.repoInfo) && ctx.tokenManager !== null,
         });
         const mergeOutcome = determineMergeOutcome(result);
         ctx.reportResults.push({
-            repoName,
+            repoName: repo.repoName,
             success: result.success,
             fileChanges: (result.fileChanges ?? []).map((f) => ({
                 path: f.path,
@@ -319,19 +342,19 @@ async function runFileSyncPhase(repoConfig, repoInfo, repoName, current, workDir
             error: result.success ? undefined : result.message,
         });
         if (result.skipped) {
-            logger.skip(current, repoName, result.message);
+            logger.skip(current, repo.repoName, result.message);
         }
         else if (result.success) {
-            logger.success(current, repoName, result.message);
+            logger.success(current, repo.repoName, result.message);
         }
         else {
-            logger.error(current, repoName, result.message);
+            logger.error(current, repo.repoName, result.message);
         }
     }
     catch (error) {
-        logger.error(current, repoName, toErrorMessage(error));
+        logger.error(current, repo.repoName, toErrorMessage(error));
         ctx.reportResults.push({
-            repoName,
+            repoName: repo.repoName,
             success: false,
             fileChanges: [],
             error: toErrorMessage(error),
@@ -339,10 +362,10 @@ async function runFileSyncPhase(repoConfig, repoInfo, repoName, current, workDir
     }
 }
 export async function runSync(options, deps = {}) {
-    const { processorFactory = defaultProcessorFactory, lifecycleManager, rulesetProcessorFactory = defaultRulesetProcessorFactory, repoSettingsProcessorFactory = defaultRepoSettingsProcessorFactory, labelsProcessorFactory = defaultLabelsProcessorFactory, } = deps;
+    const { lifecycleManager, rulesetProcessorFactory = defaultRulesetProcessorFactory, repoSettingsProcessorFactory = defaultRepoSettingsProcessorFactory, labelsProcessorFactory = defaultLabelsProcessorFactory, } = deps;
     const configPath = resolve(options.config);
     if (!existsSync(configPath)) {
-        throw new Error(`Config file not found: ${configPath}`);
+        throw new ValidationError(`Config file not found: ${configPath}`);
     }
     logger.log(`Loading config from: ${configPath}`);
     if (options.dryRun) {
@@ -350,7 +373,7 @@ export async function runSync(options, deps = {}) {
     }
     const rawConfig = loadRawConfig(configPath);
     validateForSync(rawConfig);
-    const config = normalizeConfig(rawConfig);
+    const config = normalizeConfig(rawConfig, process.env);
     const fileNames = getUniqueFileNames(config);
     let branchName;
     if (options.branch) {
@@ -364,13 +387,26 @@ export async function runSync(options, deps = {}) {
     logger.log(`Found ${config.repos.length} repositories to process`);
     logger.log(`Target files: ${formatFileNames(fileNames)}`);
     logger.log(`Branch: ${branchName}\n`);
+    const tokenManager = createTokenManager(process.env.XFG_GITHUB_APP_ID && process.env.XFG_GITHUB_APP_PRIVATE_KEY
+        ? {
+            appId: process.env.XFG_GITHUB_APP_ID,
+            privateKey: process.env.XFG_GITHUB_APP_PRIVATE_KEY,
+        }
+        : undefined);
+    const processor = deps.processorFactory
+        ? deps.processorFactory()
+        : new RepositoryProcessor(undefined, logger, {
+            tokenManager,
+            envToken: process.env.GH_TOKEN,
+        });
     const ctx = {
         config,
         options,
         branchName,
-        processor: processorFactory(),
-        lifecycleManager: lifecycleManager ?? new RepoLifecycleManager(undefined, options.retries),
-        tokenManager: createTokenManager(),
+        processor,
+        lifecycleManager: lifecycleManager ??
+            new RepoLifecycleManager(undefined, defaultExecutor, options.retries, cwd, logger),
+        tokenManager,
         reportResults: [],
         lifecycleReportInputs: [],
         settingsCollector: new ResultsCollector(),
@@ -387,6 +423,6 @@ export async function runSync(options, deps = {}) {
     const hasErrors = ctx.reportResults.some((r) => r.error);
     const hasSettingsErrors = settingsResults.some((r) => r.error);
     if (hasErrors || hasSettingsErrors) {
-        throw new Error("One or more repositories had errors during sync");
+        throw new SyncError("One or more repositories had errors during sync");
     }
 }

package/dist/cli/sync-report-builder.d.ts

@@ -1,12 +1,8 @@
-import type { SyncReport } from "../output/sync-report.js";
-interface FileChangeInput {
-    path: string;
-    action: "create" | "update" | "delete";
-}
+import type { SyncReport, ReportFileChange } from "../output/sync-report.js";
 interface SyncResultInput {
     repoName: string;
     success: boolean;
-    fileChanges: FileChangeInput[];
+    fileChanges: ReportFileChange[];
     prUrl?: string;
     mergeOutcome?: "manual" | "auto" | "force" | "direct";
     error?: string;

package/dist/cli/types.d.ts

@@ -1,25 +1,14 @@
 import type { MergeMode, MergeStrategy, RepoConfig } from "../config/index.js";
 import type { IRepoLifecycleManager } from "../lifecycle/index.js";
-import { type IRepositoryProcessor } from "../sync/index.js";
-import { type ISettingsProcessor, type IRulesetProcessor, type IRepoSettingsProcessor, type ILabelsProcessor } from "../settings/index.js";
+import type { IRepositoryProcessor } from "../sync/index.js";
+import type { ISettingsProcessor, IRulesetProcessor, IRepoSettingsProcessor, ILabelsProcessor } from "../settings/index.js";
 import type { RepoInfo } from "../shared/repo-detector.js";
 import type { ResultsCollector } from "./results-collector.js";
-export type { IRepositoryProcessor, IRulesetProcessor };
 export type ProcessorFactory = () => IRepositoryProcessor;
-/**
- * Default factory that creates a real RepositoryProcessor.
- */
-export declare const defaultProcessorFactory: ProcessorFactory;
-/**
- * Generic factory type for settings processors.
- */
 export type SettingsProcessorFactory<T extends ISettingsProcessor> = () => T;
 export type RulesetProcessorFactory = SettingsProcessorFactory<IRulesetProcessor>;
 export type RepoSettingsProcessorFactory = SettingsProcessorFactory<IRepoSettingsProcessor>;
 export type LabelsProcessorFactory = SettingsProcessorFactory<ILabelsProcessor>;
-export declare const defaultRulesetProcessorFactory: RulesetProcessorFactory;
-export declare const defaultRepoSettingsProcessorFactory: RepoSettingsProcessorFactory;
-export declare const defaultLabelsProcessorFactory: LabelsProcessorFactory;
 /**
  * Dependencies for the sync command (dependency injection).
  */
@@ -79,4 +68,3 @@ export interface ApplyRepoSettingsContext {
     repoSettingsProcessorFactory: NonNullable<SyncDependencies["repoSettingsProcessorFactory"]>;
     labelsProcessorFactory: NonNullable<SyncDependencies["labelsProcessorFactory"]>;
 }
-export type { IRepoSettingsProcessor, ILabelsProcessor };

package/dist/cli/types.js

@@ -1,9 +1 @@
-import { RepositoryProcessor, } from "../sync/index.js";
-import { RulesetProcessor, RepoSettingsProcessor, LabelsProcessor, } from "../settings/index.js";
-/**
- * Default factory that creates a real RepositoryProcessor.
- */
-export const defaultProcessorFactory = () => new RepositoryProcessor();
-export const defaultRulesetProcessorFactory = () => new RulesetProcessor();
-export const defaultRepoSettingsProcessorFactory = () => new RepoSettingsProcessor();
-export const defaultLabelsProcessorFactory = () => new LabelsProcessor();
+export {};

package/dist/config/file-reference-resolver.js

@@ -3,7 +3,7 @@ import { resolve, isAbsolute, normalize, extname, relative } from "node:path";
 import JSON5 from "json5";
 import { parse as parseYaml } from "yaml";
 import { toErrorMessage } from "../shared/type-guards.js";
-import { ValidationError } from "./errors.js";
+import { ValidationError } from "../shared/errors.js";
 /**
  * Check if a value is a file reference (string starting with @)
  */
@@ -44,40 +44,30 @@ export function resolveFileReference(reference, configDir) {
     }
     catch (error) {
         const msg = toErrorMessage(error);
-        throw new Error(`Failed to load file reference "${reference}": ${msg}`);
+        throw new ValidationError(`Failed to load file reference "${reference}": ${msg}`);
     }
     // Parse based on extension
     const ext = extname(relativePath).toLowerCase();
     if (ext === ".json") {
-        try {
-            return JSON.parse(content);
-        }
-        catch (error) {
-            const msg = toErrorMessage(error);
-            throw new Error(`Invalid JSON in "${reference}": ${msg}`);
-        }
+        return parseWithContext(() => JSON.parse(content), `Invalid JSON in "${reference}"`);
     }
     if (ext === ".json5") {
-        try {
-            return JSON5.parse(content);
-        }
-        catch (error) {
-            const msg = toErrorMessage(error);
-            throw new Error(`Invalid JSON5 in "${reference}": ${msg}`);
-        }
+        return parseWithContext(() => JSON5.parse(content), `Invalid JSON5 in "${reference}"`);
     }
     if (ext === ".yaml" || ext === ".yml") {
-        try {
-            return parseYaml(content);
-        }
-        catch (error) {
-            const msg = toErrorMessage(error);
-            throw new Error(`Invalid YAML in "${reference}": ${msg}`);
-        }
+        return parseWithContext(() => parseYaml(content), `Invalid YAML in "${reference}"`);
     }
     // Text file - return as string
     return content;
 }
+function parseWithContext(fn, errorPrefix) {
+    try {
+        return fn();
+    }
+    catch (error) {
+        throw new ValidationError(`${errorPrefix}: ${toErrorMessage(error)}`);
+    }
+}
 /**
  * Recursively resolve file references in a content value.
  * Only string values starting with @ are resolved.

package/dist/config/formatter.d.ts

@@ -1,14 +1,8 @@
 type OutputFormat = "json" | "json5" | "yaml";
-/**
- * Options for content conversion.
- */
 interface ConvertOptions {
     header?: string[];
     schemaUrl?: string;
 }
-/**
- * Detects output format from file extension.
- */
 export declare function detectOutputFormat(fileName: string): OutputFormat;
 /**
  * Converts content to string in the appropriate format.

package/dist/config/formatter.js

@@ -1,7 +1,4 @@
 import { Document, stringify } from "yaml";
-/**
- * Detects output format from file extension.
- */
 export function detectOutputFormat(fileName) {
     const ext = fileName.toLowerCase().split(".").pop();
     if (ext === "yaml" || ext === "yml") {
@@ -54,7 +51,6 @@ function buildCommentOnlyYaml(header, schemaUrl) {
  * Handles null content (empty files), text content (string/string[]), and object content (JSON/YAML).
  */
 export function convertContentToString(content, fileName, options) {
-    // Handle empty file case
     if (content === null) {
         const format = detectOutputFormat(fileName);
         if (format === "yaml" && options) {
@@ -65,18 +61,13 @@ export function convertContentToString(content, fileName, options) {
         }
         return "";
     }
-    // Handle string content (text file)
     if (typeof content === "string") {
-        // Ensure trailing newline for text files
         return content.endsWith("\n") ? content : content + "\n";
     }
-    // Handle string[] content (text file with lines)
     if (Array.isArray(content)) {
-        // Join lines with newlines and ensure trailing newline
         const text = content.join("\n");
         return text.length > 0 ? text + "\n" : "";
     }
-    // Handle object content (JSON/YAML)
     const format = detectOutputFormat(fileName);
     if (format === "yaml") {
         // Use Document API for YAML to support comments

package/dist/config/index.d.ts

@@ -1,5 +1,4 @@
-export type { MergeMode, MergeStrategy, BypassActor, StatusCheckConfig, CodeScanningTool, PullRequestRuleParameters, RulesetRule, Ruleset, GitHubRepoSettings, Label, RepoSettings, ContentValue, RawFileConfig, RawRepoFileOverride, RawRepoSettings, RawRepoConfig, RawConfig, RepoConfig, Config, } from "./types.js";
+export type { MergeMode, MergeStrategy, BypassActor, StatusCheckConfig, CodeScanningTool, PullRequestRuleParameters, RulesetRule, Ruleset, GitHubRepoSettings, RepoVisibility, SquashMergeCommitTitle, SquashMergeCommitMessage, MergeCommitTitle, MergeCommitMessage, Label, RepoSettings, ContentValue, RawFileConfig, RawRepoFileOverride, RawRepoSettings, RawRepoConfig, RawConfig, RepoConfig, Config, } from "./types.js";
 export { RULESET_COMPARABLE_FIELDS } from "./types.js";
 export { loadRawConfig, loadConfig, normalizeConfig } from "./loader.js";
 export { convertContentToString } from "./formatter.js";
-export { ValidationError } from "./errors.js";

package/dist/config/index.js

@@ -4,5 +4,3 @@ export { RULESET_COMPARABLE_FIELDS } from "./types.js";
 export { loadRawConfig, loadConfig, normalizeConfig } from "./loader.js";
 // Config formatting
 export { convertContentToString } from "./formatter.js";
-// Errors
-export { ValidationError } from "./errors.js";

package/dist/config/loader.d.ts

@@ -6,4 +6,4 @@ export { normalizeConfigInternal as normalizeConfig };
  * Use this when you need to perform command-specific validation before normalizing.
  */
 export declare function loadRawConfig(filePath: string): RawConfig;
-export declare function loadConfig(filePath: string): Config;
+export declare function loadConfig(filePath: string, env: Record<string, string | undefined>): Config;

package/dist/config/loader.js

@@ -5,7 +5,7 @@ import { validateRawConfig } from "./validator.js";
 import { normalizeConfig as normalizeConfigInternal } from "./normalizer.js";
 import { resolveFileReferencesInConfig } from "./file-reference-resolver.js";
 import { toErrorMessage } from "../shared/type-guards.js";
-import { ValidationError } from "./errors.js";
+import { ValidationError } from "../shared/errors.js";
 export { normalizeConfigInternal as normalizeConfig };
 /**
  * Load and validate raw config without normalization.
@@ -27,7 +27,7 @@ export function loadRawConfig(filePath) {
     validateRawConfig(rawConfig);
     return rawConfig;
 }
-export function loadConfig(filePath) {
+export function loadConfig(filePath, env) {
     const rawConfig = loadRawConfig(filePath);
-    return normalizeConfigInternal(rawConfig);
+    return normalizeConfigInternal(rawConfig, env);
 }

package/dist/config/normalizer.d.ts

@@ -8,4 +8,4 @@ export declare function mergeSettings(root: RawRootSettings | undefined, perRepo
  * Normalizes raw config into expanded, merged config.
  * Pipeline: expand git arrays -> merge content -> interpolate env vars
  */
-export declare function normalizeConfig(raw: RawConfig): Config;
+export declare function normalizeConfig(raw: RawConfig, env: Record<string, string | undefined>): Config;

package/dist/config/normalizer.js

@@ -104,17 +104,12 @@ function mergeRuleset(root, perRepo) {
         return structuredClone(perRepo ?? {});
     if (!perRepo)
         return structuredClone(root);
-    // Deep merge using the existing merge utility with replace strategy
+    // Deep merge using the existing merge utility with replace strategy.
+    // deepMerge operates on Record<string, unknown> — the cast is safe because
+    // merging two Ruleset-shaped objects preserves the Ruleset structure.
     const ctx = createMergeContext("replace");
-    const merged = deepMerge(structuredClone(root), perRepo, ctx);
-    return merged;
+    return deepMerge(structuredClone(root), perRepo, ctx);
 }
-/**
- * Merges root and per-repo label configs.
- * Per-repo labels override root labels by name.
- * inherit: false skips all root labels.
- * label: false opts out of a specific root label.
- */
 function mergeLabels(rootLabels, repoLabels) {
     if (!rootLabels && !repoLabels)
         return undefined;
@@ -135,12 +130,12 @@ function mergeLabels(rootLabels, repoLabels) {
             continue;
         if (!inheritLabels && !repoLabel && rootLabel)
             continue;
-        const merged = {
-            ...(rootLabel && rootLabel !== false ? rootLabel : {}),
-            ...(repoLabel && repoLabel !== false ? repoLabel : {}),
-        };
-        // Strip # from color and lowercase
-        merged.color = merged.color.replace(/^#/, "").toLowerCase();
+        const base = rootLabel && typeof rootLabel === "object" ? rootLabel : {};
+        const overlay = repoLabel && typeof repoLabel === "object" ? repoLabel : {};
+        const color = (overlay.color ?? base.color ?? "")
+            .replace(/^#/, "")
+            .toLowerCase();
+        const merged = { ...base, ...overlay, color };
         result[name] = merged;
     }
     return Object.keys(result).length > 0 ? result : undefined;
@@ -363,11 +358,41 @@ function mergeGroupSettings(rootSettings, groupNames, groupDefs) {
     }
     return accumulated;
 }
+/**
+ * Resolves a single file entry by merging root config with repo overrides.
+ * Returns null if the file should be skipped.
+ */
+function resolveFileEntry(fileName, fileConfig, repoOverride, inheritFiles, globalDeleteOrphaned, env) {
+    if (repoOverride === false)
+        return null;
+    if (!inheritFiles && !repoOverride)
+        return null;
+    const fileStrategy = fileConfig.mergeStrategy ?? "replace";
+    let mergedContent = resolveFileContent(fileConfig.content, repoOverride, fileStrategy);
+    if (mergedContent !== null) {
+        mergedContent = interpolateContent(mergedContent, { strict: true, env });
+    }
+    return {
+        fileName,
+        content: mergedContent,
+        createOnly: repoOverride?.createOnly ?? fileConfig.createOnly,
+        executable: repoOverride?.executable ?? fileConfig.executable,
+        header: normalizeHeader(repoOverride?.header ?? fileConfig.header),
+        schemaUrl: repoOverride?.schemaUrl ?? fileConfig.schemaUrl,
+        template: repoOverride?.template ?? fileConfig.template,
+        vars: fileConfig.vars || repoOverride?.vars
+            ? { ...fileConfig.vars, ...repoOverride?.vars }
+            : undefined,
+        deleteOrphaned: repoOverride?.deleteOrphaned ??
+            fileConfig.deleteOrphaned ??
+            globalDeleteOrphaned,
+    };
+}
 /**
  * Normalizes raw config into expanded, merged config.
  * Pipeline: expand git arrays -> merge content -> interpolate env vars
  */
-export function normalizeConfig(raw) {
+export function normalizeConfig(raw, env) {
     const expandedRepos = [];
     for (const rawRepo of raw.repos) {
         const gitUrls = Array.isArray(rawRepo.git) ? rawRepo.git : [rawRepo.git];
@@ -389,47 +414,9 @@ export function normalizeConfig(raw) {
                 // Skip reserved key
                 if (fileName === "inherit")
                     continue;
-                const repoOverride = rawRepo.files?.[fileName];
-                // Skip excluded files (set to false)
-                if (repoOverride === false) {
-                    continue;
-                }
-                // Skip if inherit: false and no repo-specific override
-                if (!inheritFiles && !repoOverride) {
-                    continue;
-                }
-                const fileConfig = effectiveRootFiles[fileName];
-                const fileStrategy = fileConfig.mergeStrategy ?? "replace";
-                let mergedContent = resolveFileContent(fileConfig.content, repoOverride, fileStrategy);
-                if (mergedContent !== null) {
-                    mergedContent = interpolateContent(mergedContent, { strict: true });
-                }
-                // Resolve fields: per-repo overrides root level
-                const createOnly = repoOverride?.createOnly ?? fileConfig.createOnly;
-                const executable = repoOverride?.executable ?? fileConfig.executable;
-                const header = normalizeHeader(repoOverride?.header ?? fileConfig.header);
-                const schemaUrl = repoOverride?.schemaUrl ?? fileConfig.schemaUrl;
-                // Template: per-repo overrides root level
-                const template = repoOverride?.template ?? fileConfig.template;
-                // Vars: merge root + per-repo (per-repo takes precedence)
-                const vars = fileConfig.vars || repoOverride?.vars
-                    ? { ...fileConfig.vars, ...repoOverride?.vars }
-                    : undefined;
-                // deleteOrphaned: per-repo overrides per-file overrides global
-                const deleteOrphaned = repoOverride?.deleteOrphaned ??
-                    fileConfig.deleteOrphaned ??
-                    raw.deleteOrphaned;
-                files.push({
-                    fileName,
-                    content: mergedContent,
-                    createOnly,
-                    executable,
-                    header,
-                    schemaUrl,
-                    template,
-                    vars,
-                    deleteOrphaned,
-                });
+                const entry = resolveFileEntry(fileName, effectiveRootFiles[fileName], rawRepo.files?.[fileName], inheritFiles, raw.deleteOrphaned, env);
+                if (entry)
+                    files.push(entry);
             }
             // Merge PR options: per-repo overrides effective (root + groups)
             const prOptions = mergePROptions(effectivePROptions, rawRepo.prOptions);