@aspruyt/xfg 6.0.3 → 6.2.0

package/dist/config/validators/file-validator.js

@@ -4,7 +4,15 @@ import { ValidationError } from "../../shared/errors.js";
 import { isPlainObject } from "../../shared/type-guards.js";
 export { isTextContent };
 export { isPlainObject as isObjectContent };
-const VALID_STRATEGIES = ["replace", "append", "prepend"];
+export function validValues(values) {
+    return values;
+}
+const VALID_STRATEGIES = validValues([
+    "replace",
+    "append",
+    "prepend",
+    "merge",
+]);
 /**
  * Check if file extension is for structured output (JSON/YAML).
  */

package/dist/config/validators/group-validator.d.ts

@@ -0,0 +1,3 @@
+import type { RawConfig } from "../types.js";
+export declare function validateGroups(config: RawConfig): void;
+export declare function validateConditionalGroups(config: RawConfig): void;

package/dist/config/validators/group-validator.js

@@ -0,0 +1,167 @@
+import { resolveExtendsChain } from "../extends-resolver.js";
+import { isPlainObject } from "../../shared/type-guards.js";
+import { ValidationError } from "../../shared/errors.js";
+import { validateFileConfigFields, validateSettings, buildRootSettingsContext, } from "./shared.js";
+function validateGroupExtends(groupName, extends_, groupNames) {
+    if (typeof extends_ === "string") {
+        if (extends_.length === 0) {
+            throw new ValidationError(`groups.${groupName}: 'extends' must be a non-empty string or array of strings`);
+        }
+        validateExtendsEntries(groupName, [extends_], groupNames);
+    }
+    else if (Array.isArray(extends_)) {
+        if (extends_.length === 0) {
+            throw new ValidationError(`groups.${groupName}: 'extends' must be a non-empty string or array of strings`);
+        }
+        validateExtendsEntries(groupName, extends_, groupNames);
+    }
+    else {
+        throw new ValidationError(`groups.${groupName}: 'extends' must be a non-empty string or array of strings`);
+    }
+}
+function validateExtendsEntries(groupName, entries, groupNames) {
+    const seen = new Set();
+    for (const entry of entries) {
+        if (typeof entry !== "string") {
+            throw new ValidationError(`groups.${groupName}: 'extends' array entries must be strings`);
+        }
+        if (entry.length === 0) {
+            throw new ValidationError(`groups.${groupName}: 'extends' array entries must be non-empty strings`);
+        }
+        if (entry === groupName) {
+            throw new ValidationError(`groups.${groupName}: extends cannot reference itself`);
+        }
+        if (!groupNames.has(entry)) {
+            throw new ValidationError(`groups.${groupName}: extends references undefined group '${entry}'`);
+        }
+        if (seen.has(entry)) {
+            throw new ValidationError(`groups.${groupName}: duplicate '${entry}' in extends`);
+        }
+        seen.add(entry);
+    }
+}
+function validateNoCircularExtends(groups) {
+    for (const name of Object.keys(groups)) {
+        if (!groups[name].extends)
+            continue;
+        try {
+            resolveExtendsChain(name, groups);
+        }
+        catch (error) {
+            throw new ValidationError(error instanceof Error ? error.message : String(error), { cause: error });
+        }
+    }
+}
+function validateGroupRefArray(arr, fieldName, ctx, groupNames) {
+    if (!Array.isArray(arr) || arr.length === 0) {
+        throw new ValidationError(`${ctx}: '${fieldName}' must be a non-empty array of strings`);
+    }
+    const seen = new Set();
+    for (const name of arr) {
+        if (typeof name !== "string") {
+            throw new ValidationError(`${ctx}: '${fieldName}' entries must be strings`);
+        }
+        if (!groupNames.includes(name)) {
+            throw new ValidationError(`${ctx}: group '${name}' in ${fieldName} is not defined in root 'groups'`);
+        }
+        if (seen.has(name)) {
+            throw new ValidationError(`${ctx}: duplicate group '${name}' in ${fieldName}`);
+        }
+        seen.add(name);
+    }
+}
+export function validateGroups(config) {
+    if (config.groups === undefined)
+        return;
+    if (!isPlainObject(config.groups)) {
+        throw new ValidationError("groups must be an object");
+    }
+    const rootCtx = buildRootSettingsContext(config);
+    const groupNames = new Set(Object.keys(config.groups));
+    for (const [groupName, group] of Object.entries(config.groups)) {
+        if (groupName === "inherit") {
+            throw new ValidationError("'inherit' is a reserved key and cannot be used as a group name");
+        }
+        if (groupName === "extends") {
+            throw new ValidationError("'extends' is a reserved key and cannot be used as a group name");
+        }
+        if (group.extends !== undefined) {
+            validateGroupExtends(groupName, group.extends, groupNames);
+        }
+        if (group.files) {
+            for (const [fileName, fileConfig] of Object.entries(group.files)) {
+                if (fileName === "inherit")
+                    continue;
+                if (fileConfig === false)
+                    continue;
+                if (fileConfig === undefined)
+                    continue;
+                validateFileConfigFields(fileConfig, fileName, `groups.${groupName}:`);
+            }
+        }
+        if (group.settings !== undefined) {
+            validateSettings(group.settings, `groups.${groupName}`, rootCtx);
+        }
+    }
+    validateNoCircularExtends(config.groups);
+}
+export function validateConditionalGroups(config) {
+    if (config.conditionalGroups === undefined)
+        return;
+    if (!Array.isArray(config.conditionalGroups)) {
+        throw new ValidationError("conditionalGroups must be an array");
+    }
+    const rootCtx = buildRootSettingsContext(config);
+    const groupNames = config.groups ? Object.keys(config.groups) : [];
+    for (let i = 0; i < config.conditionalGroups.length; i++) {
+        const entry = config.conditionalGroups[i];
+        const ctx = `conditionalGroups[${i}]`;
+        if (!entry.when || !isPlainObject(entry.when)) {
+            throw new ValidationError(`${ctx}: 'when' is required and must be an object`);
+        }
+        const { allOf, anyOf, noneOf } = entry.when;
+        if (!allOf && !anyOf && !noneOf) {
+            throw new ValidationError(`${ctx}: 'when' must have at least one of 'allOf', 'anyOf', or 'noneOf'`);
+        }
+        if (allOf !== undefined) {
+            validateGroupRefArray(allOf, "allOf", ctx, groupNames);
+        }
+        if (anyOf !== undefined) {
+            validateGroupRefArray(anyOf, "anyOf", ctx, groupNames);
+        }
+        if (noneOf !== undefined) {
+            validateGroupRefArray(noneOf, "noneOf", ctx, groupNames);
+        }
+        if (noneOf !== undefined) {
+            const noneOfSet = new Set(noneOf);
+            if (allOf !== undefined) {
+                for (const g of allOf) {
+                    if (noneOfSet.has(g)) {
+                        throw new ValidationError(`${ctx}: noneOf group '${g}' overlaps with allOf (contradictory condition)`);
+                    }
+                }
+            }
+            if (anyOf !== undefined) {
+                for (const g of anyOf) {
+                    if (noneOfSet.has(g)) {
+                        throw new ValidationError(`${ctx}: noneOf group '${g}' overlaps with anyOf (contradictory condition)`);
+                    }
+                }
+            }
+        }
+        if (entry.files) {
+            for (const [fileName, fileConfig] of Object.entries(entry.files)) {
+                if (fileName === "inherit")
+                    continue;
+                if (fileConfig === false)
+                    continue;
+                if (fileConfig === undefined)
+                    continue;
+                validateFileConfigFields(fileConfig, fileName, `${ctx}:`);
+            }
+        }
+        if (entry.settings !== undefined) {
+            validateSettings(entry.settings, ctx, rootCtx);
+        }
+    }
+}

package/dist/config/validators/repo-entry-validator.d.ts

@@ -0,0 +1,2 @@
+import type { RawConfig } from "../types.js";
+export declare function validateRepoEntry(config: RawConfig, repo: RawConfig["repos"][number], index: number): void;

package/dist/config/validators/repo-entry-validator.js

@@ -0,0 +1,165 @@
+import { expandRepoGroups } from "../extends-resolver.js";
+import { validateFileName } from "./file-validator.js";
+import { isPlainObject } from "../../shared/type-guards.js";
+import { escapeRegExp } from "../../shared/regex-utils.js";
+import { ValidationError } from "../../shared/errors.js";
+import { validateFileConfigFields, validateSettings, buildRootSettingsContext, enrichSettingsContext, } from "./shared.js";
+function isValidGitUrl(url) {
+    return /^git@[^:]+:.+$/.test(url) || /^https?:\/\/[^/]+\/.+$/.test(url);
+}
+function isGitHubUrl(url, githubHosts) {
+    const hosts = ["github.com", ...(githubHosts ?? [])];
+    for (const host of hosts) {
+        if (url.startsWith(`git@${host}:`) ||
+            url.match(new RegExp(`^https?://${escapeRegExp(host)}/`))) {
+            return true;
+        }
+    }
+    return false;
+}
+function getGitDisplayName(git) {
+    if (Array.isArray(git)) {
+        return git.length > 0 ? git[0] : "(empty git array)";
+    }
+    return git;
+}
+function validateRepoGitField(repo, index) {
+    if (!repo.git) {
+        throw new ValidationError(`Repo at index ${index} missing required field: git`);
+    }
+    if (Array.isArray(repo.git) && repo.git.length === 0) {
+        throw new ValidationError(`Repo at index ${index} has empty git array`);
+    }
+    return getGitDisplayName(repo.git);
+}
+function validateRepoOrigins(config, repo, repoLabel) {
+    if (repo.upstream !== undefined && repo.source !== undefined) {
+        throw new ValidationError(`Repo ${repoLabel}: 'upstream' and 'source' are mutually exclusive. ` +
+            `Use 'upstream' to fork, or 'source' to migrate, not both.`);
+    }
+    if (repo.upstream !== undefined) {
+        if (typeof repo.upstream !== "string") {
+            throw new ValidationError(`Repo ${repoLabel}: 'upstream' must be a string`);
+        }
+        if (!isValidGitUrl(repo.upstream)) {
+            throw new ValidationError(`Repo ${repoLabel}: 'upstream' must be a valid git URL ` +
+                `(SSH: git@host:path or HTTPS: https://host/path)`);
+        }
+    }
+    if (repo.source !== undefined) {
+        if (typeof repo.source !== "string") {
+            throw new ValidationError(`Repo ${repoLabel}: 'source' must be a string`);
+        }
+        if (!isValidGitUrl(repo.source)) {
+            throw new ValidationError(`Repo ${repoLabel}: 'source' must be a valid git URL ` +
+                `(SSH: git@host:path or HTTPS: https://host/path)`);
+        }
+        if (isGitHubUrl(repo.source, config.githubHosts)) {
+            throw new ValidationError(`Repo ${repoLabel}: 'source' cannot be a GitHub URL. ` +
+                `Migration from GitHub is not supported. Currently supported sources: Azure DevOps`);
+        }
+    }
+}
+function validateRepoGroups(config, repo, index) {
+    if (repo.groups === undefined)
+        return;
+    if (!Array.isArray(repo.groups) ||
+        !repo.groups.every((g) => typeof g === "string")) {
+        throw new ValidationError(`Repo at index ${index}: groups must be an array of strings`);
+    }
+    const seen = new Set();
+    for (const groupName of repo.groups) {
+        if (!config.groups || !config.groups[groupName]) {
+            throw new ValidationError(`Repo at index ${index}: group '${groupName}' is not defined in root 'groups'`);
+        }
+        if (seen.has(groupName)) {
+            throw new ValidationError(`Repo at index ${index}: duplicate group '${groupName}'`);
+        }
+        seen.add(groupName);
+    }
+}
+function validateRepoFiles(config, repo, index, repoLabel) {
+    if (!repo.files)
+        return;
+    if (!isPlainObject(repo.files)) {
+        throw new ValidationError(`Repo at index ${index}: files must be an object`);
+    }
+    const knownFiles = new Set(config.files ? Object.keys(config.files) : []);
+    if (repo.groups && config.groups) {
+        const expandedGroups = expandRepoGroups(repo.groups, config.groups);
+        for (const groupName of expandedGroups) {
+            const group = config.groups[groupName];
+            if (group?.files) {
+                for (const fileName of Object.keys(group.files)) {
+                    if (fileName !== "inherit")
+                        knownFiles.add(fileName);
+                }
+            }
+        }
+    }
+    if (config.conditionalGroups) {
+        for (const cg of config.conditionalGroups) {
+            if (cg.files) {
+                for (const fileName of Object.keys(cg.files)) {
+                    if (fileName !== "inherit")
+                        knownFiles.add(fileName);
+                }
+            }
+        }
+    }
+    for (const fileName of Object.keys(repo.files)) {
+        if (fileName === "inherit") {
+            const inheritValue = repo.files.inherit;
+            if (typeof inheritValue !== "boolean") {
+                throw new ValidationError(`Repo at index ${index}: files.inherit must be a boolean`);
+            }
+            continue;
+        }
+        if (!knownFiles.has(fileName)) {
+            const fileEntry = repo.files[fileName];
+            const isStandaloneDefinition = fileEntry != null &&
+                fileEntry !== false &&
+                typeof fileEntry === "object" &&
+                "content" in fileEntry &&
+                fileEntry.content !== undefined &&
+                fileEntry.content !== null;
+            if (!isStandaloneDefinition) {
+                throw new ValidationError(`Repo at index ${index} references undefined file '${fileName}'. File must be defined in root 'files' object or in a referenced group, or provide content inline.`);
+            }
+            validateFileName(fileName);
+        }
+        const fileOverride = repo.files[fileName];
+        if (fileOverride === false) {
+            continue;
+        }
+        if (fileOverride.override && !fileOverride.content) {
+            throw new ValidationError(`Repo ${repoLabel} has override: true for file '${fileName}' but no content defined. ` +
+                `Use content: "" for an empty text file override, or content: {} for an empty JSON/YAML override.`);
+        }
+        validateFileConfigFields(fileOverride, fileName, `Repo ${repoLabel}:`);
+    }
+}
+function validateRepoSettingsEntry(config, repo, repoLabel) {
+    if (repo.settings === undefined)
+        return;
+    const rootCtx = buildRootSettingsContext(config);
+    if (repo.groups && config.groups) {
+        const expandedGroups = expandRepoGroups(repo.groups, config.groups);
+        for (const groupName of expandedGroups) {
+            enrichSettingsContext(rootCtx, config.groups[groupName]?.settings);
+        }
+    }
+    if (config.conditionalGroups) {
+        for (const cg of config.conditionalGroups) {
+            enrichSettingsContext(rootCtx, cg.settings);
+        }
+    }
+    validateSettings(repo.settings, `Repo ${repoLabel}`, rootCtx);
+}
+export function validateRepoEntry(config, repo, index) {
+    const repoLabel = validateRepoGitField(repo, index);
+    validateRepoOrigins(config, repo, repoLabel);
+    validateRepoGroups(config, repo, index);
+    validateRepoFiles(config, repo, index, repoLabel);
+    validateRepoSettingsEntry(config, repo, repoLabel);
+}

package/dist/config/validators/repo-settings-validator.js

@@ -1,13 +1,24 @@
 import { ValidationError } from "../../shared/errors.js";
-const VALID_VISIBILITY = ["public", "private", "internal"];
-const VALID_SQUASH_MERGE_COMMIT_TITLE = ["PR_TITLE", "COMMIT_OR_PR_TITLE"];
-const VALID_SQUASH_MERGE_COMMIT_MESSAGE = [
+import { validValues } from "./file-validator.js";
+const VALID_VISIBILITY = validValues([
+    "public",
+    "private",
+    "internal",
+]);
+const VALID_SQUASH_MERGE_COMMIT_TITLE = validValues([
+    "PR_TITLE",
+    "COMMIT_OR_PR_TITLE",
+]);
+const VALID_SQUASH_MERGE_COMMIT_MESSAGE = validValues(["PR_BODY", "COMMIT_MESSAGES", "BLANK"]);
+const VALID_MERGE_COMMIT_TITLE = validValues([
+    "PR_TITLE",
+    "MERGE_MESSAGE",
+]);
+const VALID_MERGE_COMMIT_MESSAGE = validValues([
     "PR_BODY",
-    "COMMIT_MESSAGES",
+    "PR_TITLE",
     "BLANK",
-];
-const VALID_MERGE_COMMIT_TITLE = ["PR_TITLE", "MERGE_MESSAGE"];
-const VALID_MERGE_COMMIT_MESSAGE = ["PR_BODY", "PR_TITLE", "BLANK"];
+]);
 /**
  * Validates GitHub repository settings.
  */

package/dist/config/validators/ruleset-validator.js

@@ -1,9 +1,6 @@
 import { ValidationError } from "../../shared/errors.js";
 import { isPlainObject } from "../../shared/type-guards.js";
-/** Compile-time validates an array matches a type union, while keeping string[] runtime type for .includes() */
-function validValues(values) {
-    return values;
-}
+import { validValues } from "./file-validator.js";
 const VALID_RULESET_TARGETS = validValues(["branch", "tag"]);
 const VALID_ENFORCEMENT_LEVELS = validValues([
     "active",
@@ -64,7 +61,7 @@ const VALID_RULE_TYPES = validValues([
     "max_file_size",
 ]);
 // Intentionally duplicated from merge.ts — validator should not depend on merge internals
-const VALID_MERGE_STRATEGIES = ["replace", "append", "prepend"];
+const VALID_MERGE_STRATEGIES = ["replace", "append", "prepend", "merge"];
 /**
  * Checks if a value is an $arrayMerge directive: { $arrayMerge: strategy, $values: [...] }
  */

package/dist/config/validators/shared.d.ts

@@ -0,0 +1,11 @@
+import type { RawConfig, RawRootSettings, RawRepoSettings } from "../types.js";
+export interface RootSettingsContext {
+    rulesetNames: string[];
+    hasRepoSettings: boolean;
+    hasCodeScanningSettings: boolean;
+    labelNames: string[];
+}
+export declare function buildRootSettingsContext(config: RawConfig): RootSettingsContext;
+export declare function validateFileConfigFields(fileConfig: Record<string, unknown>, fileName: string, context: string): void;
+export declare function validateSettings(settings: unknown, context: string, rootCtx?: RootSettingsContext): void;
+export declare function enrichSettingsContext(rootCtx: RootSettingsContext, settings: RawRepoSettings | RawRootSettings | undefined): void;

package/dist/config/validators/shared.js

@@ -0,0 +1,242 @@
+import { isTextContent, isObjectContent, isStructuredFileExtension, validValues, VALID_STRATEGIES, } from "./file-validator.js";
+import { validateRuleset } from "./ruleset-validator.js";
+import { validateRepoSettings } from "./repo-settings-validator.js";
+import { isPlainObject } from "../../shared/type-guards.js";
+import { ValidationError } from "../../shared/errors.js";
+export function buildRootSettingsContext(config) {
+    return {
+        rulesetNames: config.settings?.rulesets
+            ? Object.keys(config.settings.rulesets).filter((k) => k !== "inherit")
+            : [],
+        hasRepoSettings: config.settings?.repo !== undefined && config.settings.repo !== false,
+        hasCodeScanningSettings: config.settings?.codeScanning !== undefined &&
+            config.settings.codeScanning !== false,
+        labelNames: config.settings?.labels
+            ? Object.keys(config.settings.labels).filter((k) => k !== "inherit")
+            : [],
+    };
+}
+export function validateFileConfigFields(fileConfig, fileName, context) {
+    if (fileConfig.content !== undefined) {
+        const hasText = isTextContent(fileConfig.content);
+        const hasObject = isObjectContent(fileConfig.content);
+        if (!hasText && !hasObject) {
+            throw new ValidationError(`${context} file '${fileName}' content must be an object, string, or array of strings`);
+        }
+        const isStructured = isStructuredFileExtension(fileName);
+        if (isStructured && hasText) {
+            throw new ValidationError(`${context} file '${fileName}' has JSON/YAML extension but string content. Use object content for structured files.`);
+        }
+        if (!isStructured && hasObject) {
+            throw new ValidationError(`${context} file '${fileName}' has text extension but object content. Use string or string[] for text files, or use .json/.yaml/.yml extension.`);
+        }
+    }
+    if (fileConfig.mergeStrategy !== undefined &&
+        !VALID_STRATEGIES.includes(fileConfig.mergeStrategy)) {
+        throw new ValidationError(`${context} file '${fileName}' has invalid mergeStrategy: ${fileConfig.mergeStrategy}. Must be one of: ${VALID_STRATEGIES.join(", ")}`);
+    }
+    const booleanFields = [
+        "createOnly",
+        "executable",
+        "template",
+        "deleteOrphaned",
+    ];
+    for (const field of booleanFields) {
+        if (fileConfig[field] !== undefined &&
+            typeof fileConfig[field] !== "boolean") {
+            throw new ValidationError(`${context} file '${fileName}' ${field} must be a boolean`);
+        }
+    }
+    const stringFields = ["schemaUrl"];
+    for (const field of stringFields) {
+        if (fileConfig[field] !== undefined &&
+            typeof fileConfig[field] !== "string") {
+            throw new ValidationError(`${context} file '${fileName}' ${field} must be a string`);
+        }
+    }
+    if (fileConfig.header !== undefined) {
+        if (typeof fileConfig.header !== "string" &&
+            (!Array.isArray(fileConfig.header) ||
+                !fileConfig.header.every((h) => typeof h === "string"))) {
+            throw new ValidationError(`${context} file '${fileName}' header must be a string or array of strings`);
+        }
+    }
+    if (fileConfig.vars !== undefined) {
+        if (!isPlainObject(fileConfig.vars)) {
+            throw new ValidationError(`${context} file '${fileName}' vars must be an object with string values`);
+        }
+        for (const [key, value] of Object.entries(fileConfig.vars)) {
+            if (typeof value !== "string") {
+                throw new ValidationError(`${context} file '${fileName}' vars.${key} must be a string`);
+            }
+        }
+    }
+}
+function validateLabel(label, name, context) {
+    if (!isPlainObject(label)) {
+        throw new ValidationError(`${context}: label '${name}' must be an object`);
+    }
+    const l = label;
+    if (typeof l.color !== "string" || !/^#?[0-9a-fA-F]{6}$/.test(l.color)) {
+        throw new ValidationError(`${context}: label '${name}' color must be a 6-character hex code (with or without #)`);
+    }
+    if (l.description !== undefined) {
+        if (typeof l.description !== "string") {
+            throw new ValidationError(`${context}: label '${name}' description must be a string`);
+        }
+        if (l.description.length > 100) {
+            throw new ValidationError(`${context}: label '${name}' description exceeds 100 characters (GitHub limit)`);
+        }
+    }
+    if (l.new_name !== undefined && typeof l.new_name !== "string") {
+        throw new ValidationError(`${context}: label '${name}' new_name must be a string`);
+    }
+}
+const VALID_CODE_SCANNING_STATES = validValues([
+    "configured",
+    "not-configured",
+]);
+const VALID_CODE_SCANNING_QUERY_SUITES = validValues([
+    "default",
+    "extended",
+]);
+const VALID_CODE_SCANNING_LANGUAGES = validValues([
+    "actions",
+    "c-cpp",
+    "csharp",
+    "go",
+    "java-kotlin",
+    "javascript-typescript",
+    "python",
+    "ruby",
+    "swift",
+]);
+function validateCodeScanningSettings(settings, context) {
+    if (!isPlainObject(settings)) {
+        throw new ValidationError(`${context}: must be an object`);
+    }
+    if (settings.state === undefined) {
+        throw new ValidationError(`${context}: state is required`);
+    }
+    if (!VALID_CODE_SCANNING_STATES.includes(settings.state)) {
+        throw new ValidationError(`${context}: state must be one of: ${VALID_CODE_SCANNING_STATES.join(", ")}`);
+    }
+    if (settings.querySuite !== undefined &&
+        !VALID_CODE_SCANNING_QUERY_SUITES.includes(settings.querySuite)) {
+        throw new ValidationError(`${context}: querySuite must be one of: ${VALID_CODE_SCANNING_QUERY_SUITES.join(", ")}`);
+    }
+    if (settings.languages !== undefined) {
+        if (!Array.isArray(settings.languages)) {
+            throw new ValidationError(`${context}: languages must be an array`);
+        }
+        for (const lang of settings.languages) {
+            if (!VALID_CODE_SCANNING_LANGUAGES.includes(lang)) {
+                throw new ValidationError(`${context}: invalid language "${lang}". Valid languages: ${VALID_CODE_SCANNING_LANGUAGES.join(", ")}`);
+            }
+        }
+    }
+}
+function validateSettingsRulesets(settings, context, rootCtx) {
+    if (settings.rulesets === undefined)
+        return;
+    if (!isPlainObject(settings.rulesets)) {
+        throw new ValidationError(`${context}: rulesets must be an object`);
+    }
+    const rulesets = settings.rulesets;
+    for (const [name, ruleset] of Object.entries(rulesets)) {
+        if (name === "inherit")
+            continue;
+        if (ruleset === false) {
+            if (rootCtx && !rootCtx.rulesetNames.includes(name)) {
+                throw new ValidationError(`${context}: Cannot opt out of '${name}' - not defined in root settings.rulesets`);
+            }
+            continue;
+        }
+        validateRuleset(ruleset, name, context);
+    }
+}
+function validateSettingsLabels(settings, context, rootCtx) {
+    if (settings.labels === undefined)
+        return;
+    if (!isPlainObject(settings.labels)) {
+        throw new ValidationError(`${context}: labels must be an object`);
+    }
+    const labels = settings.labels;
+    for (const [name, label] of Object.entries(labels)) {
+        if (name === "inherit")
+            continue;
+        if (label === false) {
+            if (rootCtx && !rootCtx.labelNames.includes(name)) {
+                throw new ValidationError(`${context}: Cannot opt out of label '${name}' - not defined in root settings.labels`);
+            }
+            continue;
+        }
+        validateLabel(label, name, context);
+    }
+}
+function validateSettingsDeleteOrphaned(settings, context) {
+    if (settings.deleteOrphaned !== undefined &&
+        typeof settings.deleteOrphaned !== "boolean") {
+        throw new ValidationError(`${context}: settings.deleteOrphaned must be a boolean`);
+    }
+}
+function validateSettingsRepo(settings, context, rootCtx) {
+    if (settings.repo === undefined)
+        return;
+    if (settings.repo === false) {
+        if (!rootCtx) {
+            throw new ValidationError(`${context}: repo: false is not valid at root level. Define repo settings or remove the field.`);
+        }
+        if (!rootCtx.hasRepoSettings) {
+            throw new ValidationError(`${context}: Cannot opt out of repo settings — not defined in root settings.repo`);
+        }
+        return;
+    }
+    validateRepoSettings(settings.repo, context);
+}
+function validateSettingsCodeScanning(settings, context, rootCtx) {
+    if (settings.codeScanning === undefined)
+        return;
+    if (settings.codeScanning === false) {
+        if (!rootCtx) {
+            throw new ValidationError(`${context}: codeScanning: false is not valid at root level. Define codeScanning settings or remove the field.`);
+        }
+        if (!rootCtx.hasCodeScanningSettings) {
+            throw new ValidationError(`${context}: Cannot opt out of code scanning settings — not defined in root settings.codeScanning`);
+        }
+        return;
+    }
+    validateCodeScanningSettings(settings.codeScanning, `${context} codeScanning`);
+}
+export function validateSettings(settings, context, rootCtx) {
+    if (!isPlainObject(settings)) {
+        throw new ValidationError(`${context}: settings must be an object`);
+    }
+    validateSettingsRulesets(settings, context, rootCtx);
+    validateSettingsLabels(settings, context, rootCtx);
+    validateSettingsDeleteOrphaned(settings, context);
+    validateSettingsRepo(settings, context, rootCtx);
+    validateSettingsCodeScanning(settings, context, rootCtx);
+}
+export function enrichSettingsContext(rootCtx, settings) {
+    if (!settings)
+        return;
+    if (settings.rulesets) {
+        for (const name of Object.keys(settings.rulesets)) {
+            if (name !== "inherit")
+                rootCtx.rulesetNames.push(name);
+        }
+    }
+    if (settings.labels) {
+        for (const name of Object.keys(settings.labels)) {
+            if (name !== "inherit")
+                rootCtx.labelNames.push(name);
+        }
+    }
+    if (settings.repo !== undefined && settings.repo !== false) {
+        rootCtx.hasRepoSettings = true;
+    }
+    if (settings.codeScanning !== undefined && settings.codeScanning !== false) {
+        rootCtx.hasCodeScanningSettings = true;
+    }
+}