@bensandee/tooling 0.51.1 → 0.52.0

package/dist/bin.mjs

@@ -1596,7 +1596,7 @@ async function generatePackageJson(ctx) {
 	const devDeps = { ...ROOT_DEV_DEPS };
 	if (!isMonorepo) Object.assign(devDeps, PER_PACKAGE_DEV_DEPS);
 	devDeps["@bensandee/config"] = isWorkspacePackage(ctx, "@bensandee/config") ? "workspace:*" : "0.10.2";
-	devDeps["@bensandee/tooling"] = isWorkspacePackage(ctx, "@bensandee/tooling") ? "workspace:*" : "0.51.1";
+	devDeps["@bensandee/tooling"] = isWorkspacePackage(ctx, "@bensandee/tooling") ? "workspace:*" : "0.52.0";
 	if (ctx.config.useEslintPlugin) devDeps["@bensandee/eslint-plugin"] = isWorkspacePackage(ctx, "@bensandee/eslint-plugin") ? "workspace:*" : "0.12.0";
 	if (ctx.config.formatter === "oxfmt") devDeps["oxfmt"] = {
 		"@changesets/cli": "2.30.0",
@@ -3370,7 +3370,7 @@ async function runGenerators(ctx) {
 function generateMigratePrompt(results, config, detected) {
 	const sections = [];
 	const timestamp = (/* @__PURE__ */ new Date()).toISOString();
-	sections.push(`# Migration Prompt\n\n_Generated by \`@bensandee/tooling@0.51.1 repo:sync\` on ${timestamp}_\n`);
+	sections.push(`# Migration Prompt\n\n_Generated by \`@bensandee/tooling@0.52.0 repo:sync\` on ${timestamp}_\n`);
 	const changed = results.filter((r) => r.action === "created" || r.action === "updated" || r.action === "archived");
 	if (changed.length > 0) {
 		const items = changed.map((r) => {
@@ -4125,6 +4125,116 @@ async function deleteActionSecret(executor, conn, secretName) {
 		throw new TransientError(`Failed to delete secret ${secretName}: ${String(res.status)} ${res.statusText}\n${body}`);
 	}
 }
+const WebhookSchema = z.object({
+	id: z.number(),
+	type: z.string(),
+	active: z.boolean(),
+	config: z.record(z.string(), z.string()).optional()
+});
+const WebhookListSchema = z.array(WebhookSchema);
+async function fetchHooks(executor, conn, endpoint) {
+	const res = await executor.fetch(`${conn.serverUrl}/api/v1${endpoint}`, { headers: { Authorization: `token ${conn.token}` } });
+	if (res.status === 401 || res.status === 403) return {
+		status: "unauthorized",
+		httpStatus: res.status
+	};
+	if (!res.ok) {
+		const body = await responseBodyText(res);
+		return {
+			status: "error",
+			httpStatus: res.status,
+			message: `${res.statusText}\n${body}`
+		};
+	}
+	const parsed = WebhookListSchema.safeParse(await res.json());
+	if (!parsed.success) throw new UnexpectedError(`Unexpected webhook list response for ${endpoint}: ${parsed.error.message}`);
+	return {
+		status: "ok",
+		hooks: parsed.data
+	};
+}
+/** List system-level webhooks. Requires admin token (read:admin scope). */
+async function listSystemHooks(executor, conn) {
+	return fetchHooks(executor, conn, "/admin/hooks");
+}
+/** List webhooks owned by the authenticated user. Requires read:user scope. */
+async function listUserHooks(executor, conn) {
+	return fetchHooks(executor, conn, "/user/hooks");
+}
+/** List webhooks for an organization. Requires read:organization scope. */
+async function listOrgHooks(executor, conn, org) {
+	return fetchHooks(executor, conn, `/orgs/${encodeURIComponent(org)}/hooks`);
+}
+/** List webhooks for a repository. Requires read:repository + repo admin. */
+async function listRepoHooks(executor, conn, repository) {
+	return fetchHooks(executor, conn, `/repos/${repository}/hooks`);
+}
+const AuthenticatedUserSchema = z.object({ login: z.string() });
+/** Return the login of the authenticated user, or null if the token is invalid. */
+async function getAuthenticatedUser(executor, conn) {
+	const res = await executor.fetch(`${conn.serverUrl}/api/v1/user`, { headers: { Authorization: `token ${conn.token}` } });
+	if (!res.ok) return {
+		ok: false,
+		httpStatus: res.status
+	};
+	const parsed = AuthenticatedUserSchema.safeParse(await res.json());
+	if (!parsed.success) throw new UnexpectedError(`Unexpected /user response: ${parsed.error.message}`);
+	return {
+		ok: true,
+		login: parsed.data.login
+	};
+}
+/**
+* Probe whether the token has admin access by requesting `/admin/users?limit=1`.
+*
+* Returns true on 2xx, false on 401/403. Any other status is treated as not-admin
+* to keep enumeration conservative.
+*/
+async function hasAdminAccess(executor, conn) {
+	return (await executor.fetch(`${conn.serverUrl}/api/v1/admin/users?limit=1`, { headers: { Authorization: `token ${conn.token}` } })).ok;
+}
+const OrgSchema = z.object({ username: z.string() });
+const OrgListSchema = z.array(OrgSchema);
+const PAGE_LIMIT = 50;
+async function paginate(executor, conn, endpoint, extract) {
+	const all = [];
+	let page = 1;
+	const separator = endpoint.includes("?") ? "&" : "?";
+	for (;;) {
+		const url = `${conn.serverUrl}/api/v1${endpoint}${separator}page=${String(page)}&limit=${String(PAGE_LIMIT)}`;
+		const res = await executor.fetch(url, { headers: { Authorization: `token ${conn.token}` } });
+		if (!res.ok) {
+			const body = await responseBodyText(res);
+			throw new TransientError(`Failed to fetch ${endpoint} (page ${String(page)}): ${String(res.status)} ${res.statusText}\n${body}`);
+		}
+		const items = extract(await res.json());
+		all.push(...items);
+		if (items.length < PAGE_LIMIT) break;
+		page++;
+	}
+	return all;
+}
+/**
+* List organizations. When `mode` is "admin", uses `/admin/orgs` (all orgs on
+* the instance). When "user", uses `/user/orgs` (only the token user's orgs).
+*/
+async function listOrgs(executor, conn, mode) {
+	const endpoint = mode === "admin" ? "/admin/orgs" : "/user/orgs";
+	return (await paginate(executor, conn, endpoint, (raw) => {
+		const parsed = OrgListSchema.safeParse(raw);
+		if (!parsed.success) throw new UnexpectedError(`Unexpected ${endpoint} response: ${parsed.error.message}`);
+		return parsed.data;
+	})).map((o) => o.username);
+}
+const RepoSearchSchema = z.object({ data: z.array(z.object({ full_name: z.string() })) });
+/** List repositories visible to the token via `/repos/search`. */
+async function searchRepos(executor, conn) {
+	return (await paginate(executor, conn, "/repos/search", (raw) => {
+		const parsed = RepoSearchSchema.safeParse(raw);
+		if (!parsed.success) throw new UnexpectedError(`Unexpected /repos/search response: ${parsed.error.message}`);
+		return parsed.data.data;
+	})).map((r) => r.full_name);
+}
 //#endregion
 //#region src/release/version.ts
 const BRANCH = "changeset-release/main";
@@ -5480,15 +5590,33 @@ function parseComposeServices(cwd, composeFiles) {
 function stripComposeVariables(image) {
 	return image.replace(/\$\{[^}]*\}/g, "");
 }
+/** Resolve a compose service image string to its bare name (variables and :tag stripped). */
+function bareImageName(image) {
+	return stripComposeVariables(image).split(":")[0] || void 0;
+}
 /** Extract deduplicated bare image names (without tags) from parsed services. */
 function extractComposeImageNames(services) {
 	const names = /* @__PURE__ */ new Set();
 	for (const service of services) if (service.image) {
-		const bare = stripComposeVariables(service.image).split(":")[0];
+		const bare = bareImageName(service.image);
 		if (bare) names.add(bare);
 	}
 	return [...names];
 }
+/**
+* Whether a service's image refers to an image this repo builds locally.
+* Matches the bare image name (variables/tag stripped) against the list of
+* detected Docker package image names, using the same exact-or-suffix match
+* as the cross-reference warning in docker:check.
+*/
+function isLocallyBuiltService(service, locallyBuiltImageNames) {
+	if (!service.image) return false;
+	const bare = bareImageName(service.image);
+	if (!bare) return false;
+	if (locallyBuiltImageNames.has(bare)) return true;
+	for (const name of locallyBuiltImageNames) if (bare.endsWith(`/${name}`)) return true;
+	return false;
+}
 /** Generate health checks from parsed services: services with exposed ports get HTTP checks, unless they define a compose-level healthcheck. */
 function deriveHealthChecks(services) {
 	return services.filter((s) => s.hostPort !== void 0 && !s.hasHealthcheck).map((s) => ({
@@ -5518,27 +5646,22 @@ const CHECK_HEALTHCHECK = {
 	start_interval: "5s"
 };
 /**
-* Whether a service image references a compose variable substitution (e.g. `${REGISTRY:-}…`).
-* Consumers use this pattern to parametrize the build-vs-registry split, so such services
-* are locally built rather than pulled from a registry — forcing `pull_policy: never` for
-* the check avoids failures when the base compose sets `pull_policy: always` for prod deploys.
-*/
-function isLocallyBuiltImage(image) {
-	return image !== void 0 && /\$\{[^}]*\}/.test(image);
-}
-/**
 * Generate a check overlay YAML string from parsed services.
 * Sets `restart: "no"` on all services, overrides healthcheck intervals
 * for services that define a healthcheck in the base compose file, and
-* forces `pull_policy: never` on services whose image uses a variable
-* substitution (locally-built images that aren't pushed to a registry).
+* forces `pull_policy: never` on services whose image is locally built by
+* this repo (matched against `locallyBuiltImageNames`). The override
+* prevents pull failures when the consumer's base compose sets
+* `pull_policy: always` for prod deploys against images that only exist
+* in the local Docker cache after `docker:build`.
 */
-function generateCheckOverlay(services) {
+function generateCheckOverlay(services, locallyBuiltImageNames = []) {
+	const localSet = new Set(locallyBuiltImageNames);
 	const serviceOverrides = {};
 	for (const service of services) {
 		const override = { restart: "no" };
 		if (service.hasHealthcheck) override["healthcheck"] = { ...CHECK_HEALTHCHECK };
-		if (isLocallyBuiltImage(service.image)) override["pull_policy"] = "never";
+		if (isLocallyBuiltService(service, localSet)) override["pull_policy"] = "never";
 		serviceOverrides[service.name] = override;
 	}
 	return stringify({ services: serviceOverrides });
@@ -5649,15 +5772,19 @@ const dockerCheckCommand = defineCommand({
 		const services = parseComposeServices(composeCwd, defaults.composeFiles);
 		const fileReader = createFileReader();
 		const rootPkgRaw = fileReader.readFile(path.join(cwd, "package.json"));
+		const locallyBuiltImageNames = [];
 		if (rootPkgRaw) {
 			const rootPkg = parsePackageJson(rootPkgRaw);
 			if (rootPkg?.name) {
 				const dockerPackages = detectDockerPackages(fileReader, cwd, rootPkg.name);
 				const composeImages = extractComposeImageNames(services);
-				for (const pkg of dockerPackages) if (!composeImages.some((img) => img === pkg.imageName || img.endsWith(`/${pkg.imageName}`))) log.warn(`Docker package "${pkg.dir}" (image: ${pkg.imageName}) is not referenced in any compose service.`);
+				for (const pkg of dockerPackages) {
+					locallyBuiltImageNames.push(pkg.imageName);
+					if (!composeImages.some((img) => img === pkg.imageName || img.endsWith(`/${pkg.imageName}`))) log.warn(`Docker package "${pkg.dir}" (image: ${pkg.imageName}) is not referenced in any compose service.`);
+				}
 			}
 		}
-		const tempOverlayPath = writeTempOverlay(generateCheckOverlay(services));
+		const tempOverlayPath = writeTempOverlay(generateCheckOverlay(services, locallyBuiltImageNames));
 		const composeFiles = [
 			...defaults.composeFiles,
 			tempOverlayPath,
@@ -6329,6 +6456,85 @@ const forgejoSecretsCommand = defineCommand({
 	}
 });
 //#endregion
+//#region src/commands/forgejo-webhooks.ts
+/** Render a WebhookFetchStatus, logging warnings for unauthorized/error cases. */
+function collectGroup(label, scopeHint, status) {
+	if (status.status === "ok") return status.hooks.length > 0 ? {
+		label,
+		hooks: status.hooks
+	} : null;
+	if (status.status === "unauthorized") {
+		log.warn(`${label}: HTTP ${String(status.httpStatus)} — token likely missing scope: ${scopeHint}`);
+		return null;
+	}
+	log.warn(`${label}: HTTP ${String(status.httpStatus)} ${status.message}`);
+	return null;
+}
+async function runListWebhooks(executor, conn) {
+	const userResult = await getAuthenticatedUser(executor, conn);
+	if (!userResult.ok) throw new FatalError(`Token is invalid or lacks read:user scope (HTTP ${String(userResult.httpStatus)})`);
+	const user = userResult.login;
+	const isAdmin = await hasAdminAccess(executor, conn);
+	const groups = [];
+	const systemGroup = collectGroup("System", "read:admin", await listSystemHooks(executor, conn));
+	if (systemGroup) groups.push(systemGroup);
+	const userGroup = collectGroup(`User: ${user}`, "read:user", await listUserHooks(executor, conn));
+	if (userGroup) groups.push(userGroup);
+	const orgs = await listOrgs(executor, conn, isAdmin ? "admin" : "user");
+	for (const org of orgs) {
+		const orgGroup = collectGroup(`Org: ${org}`, "read:organization", await listOrgHooks(executor, conn, org));
+		if (orgGroup) groups.push(orgGroup);
+	}
+	const repos = await searchRepos(executor, conn);
+	for (const repo of repos) {
+		const repoGroup = collectGroup(`Repo: ${repo}`, "read:repository + repo admin", await listRepoHooks(executor, conn, repo));
+		if (repoGroup) groups.push(repoGroup);
+	}
+	return {
+		user,
+		isAdmin,
+		groups,
+		totalCount: groups.reduce((sum, g) => sum + g.hooks.length, 0)
+	};
+}
+function renderText(inventory, serverUrl) {
+	log.info(`Forgejo Webhook Inventory — ${serverUrl}`);
+	log.info(`Token user: ${inventory.user}${inventory.isAdmin ? " (admin)" : ""}`);
+	if (inventory.groups.length === 0) {
+		log.info("No webhooks found.");
+		return;
+	}
+	for (const group of inventory.groups) {
+		log.info(`${group.label} (${String(group.hooks.length)} webhook(s))`);
+		for (const hook of group.hooks) {
+			const url = hook.config?.["url"] ?? "n/a";
+			log.info(`  id=${String(hook.id)}  type=${hook.type}  active=${String(hook.active)}  url=${url}`);
+		}
+	}
+	log.info(`Total: ${String(inventory.totalCount)} webhook(s)`);
+	if (inventory.isAdmin) log.info("Note: User-level webhooks for other accounts cannot be enumerated via the API. Check the admin UI or run this command with tokens from individual user accounts.");
+}
+const forgejoWebhooksCommand = defineCommand({
+	meta: {
+		name: "forgejo:webhooks",
+		description: "Enumerate webhooks across a Forgejo instance (system, user, org, and repo levels)"
+	},
+	args: { json: {
+		type: "boolean",
+		description: "Emit results as JSON instead of a human-readable summary"
+	} },
+	async run({ args }) {
+		const resolved = resolveConnection(process.cwd());
+		if (resolved.type !== "forgejo") throw new FatalError("forgejo:webhooks requires a Forgejo repository");
+		const inventory = await runListWebhooks(createRealExecutor(), resolved.conn);
+		if (args.json) {
+			console.log(JSON.stringify(inventory, null, 2));
+			return;
+		}
+		renderText(inventory, resolved.conn.serverUrl);
+	}
+});
+//#endregion
 //#region src/release/webhook.ts
 /** Build a webhook payload from simple release context. */
 function buildSimplePayload(options) {
@@ -6487,7 +6693,7 @@ const webhookSendCommand = defineCommand({
 const main = defineCommand({
 	meta: {
 		name: "bst",
-		version: "0.51.1",
+		version: "0.52.0",
 		description: "Bootstrap and maintain standardized TypeScript project tooling"
 	},
 	subCommands: {
@@ -6505,10 +6711,11 @@ const main = defineCommand({
 		"hooks:sync": hooksSyncCommand,
 		"setup:secrets": setupSecretsCommand,
 		"forgejo:secrets": forgejoSecretsCommand,
+		"forgejo:webhooks": forgejoWebhooksCommand,
 		"webhook:send": webhookSendCommand
 	}
 });
-console.log(`@bensandee/tooling v0.51.1`);
+console.log(`@bensandee/tooling v0.52.0`);
 async function run() {
 	await runMain(main);
 	process.exit(process.exitCode ?? 0);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bensandee/tooling",
-  "version": "0.51.1",
+  "version": "0.52.0",
   "description": "CLI tool to bootstrap and maintain standardized TypeScript project tooling",
   "license": "MIT",
   "repository": {