dorfl 0.0.0 → 0.1.0

package/dist/repo-config.d.ts

@@ -0,0 +1,201 @@
+import { type Config, type PartialConfig } from './config.js';
+import { type EnvMap } from './env-config.js';
+import type { ConfigOverrideMap } from './config-override.js';
+/**
+ * The per-repo config layer.
+ *
+ * A repo may commit a `.dorfl.json` at its root. It travels WITH the repo
+ * (it is committed) and overrides the global `~/.config/dorfl/config.json`
+ * FOR THAT REPO ONLY — so repo-local properties (how this repo integrates, its
+ * acceptance `verify` gate, which remote arbitrates its claims) are agreed by all
+ * collaborators and agents rather than living in one person's global config.
+ *
+ * Resolution is per-key, highest wins:
+ *
+ *   flag (where a command offers one) > ENV (DORFL_*) > per-repo file >
+ *   global > built-in default
+ *
+ * The mechanism is multi-repo aware: each repo resolves against its OWN
+ * `.dorfl.json`, so repo A can be `merge` while repo B is `propose` in the
+ * SAME run (see {@link resolveRepoConfig}).
+ *
+ * Only keys that are genuinely repo properties are honoured in the COMMITTED
+ * per-repo file. Runner/host-only keys (`piBin`, `agentCmd`, `maxParallel`, …)
+ * describe the runner or the host machine, NOT a single repo;
+ * if present in a per-repo file they are ignored and reported with a clear
+ * message ({@link loadRepoConfig}).
+ *
+ * The sharpened host-only principle (ADR §13): **host-only keys must come from a
+ * per-machine source — a CLI flag, an `DORFL_*` env var, or the global
+ * config file — NEVER the committed repo file.** The allow/reject split below
+ * therefore governs ONLY the committed repo file; env (a per-machine source like
+ * the global file / a flag) may set ANY key, host-only included (see
+ * {@link envOverrides}).
+ *
+ * A repo with no `.dorfl.json` resolves to exactly the global config —
+ * behaviour is unchanged from before this layer existed.
+ */
+/**
+ * The conventional per-repo config filename, committed at the repo root. Derived
+ * from the single brand identity (`.{base}.json`) so a rename flips it in lockstep
+ * (see `brand.ts`).
+ */
+export declare const REPO_CONFIG_FILENAME: string;
+/**
+ * Config keys that are genuinely repo properties and so are honoured in a
+ * per-repo `.dorfl.json`. Deliberately a subset of {@link Config};
+ * extend this list as more keys become legitimately repo-scoped.
+ */
+export declare const REPO_ALLOWED_KEYS: readonly ["integration", "taskingIntegration", "tasksLandIn", "specsLandIn", "noPR", "verify", "prepare", "defaultArbiter", "autoBuild", "autoTask", "observationTriage", "mergeQuestions", "surfaceBlockers", "surfaceStaging", "selectionOrder", "model", "harness", "review", "reviewModel", "reviewMaxRounds", "taskerLoop", "taskerLoopMax", "taskerLoopModel", "freshWorktreeGate", "mergeRetries", "strictMergeApproval", "promptGuidance"];
+/** A key honoured in a per-repo file. */
+export type RepoAllowedKey = (typeof REPO_ALLOWED_KEYS)[number];
+/**
+ * Config keys that describe the RUNNER or the HOST machine, not a single repo,
+ * and so are rejected (ignored + reported) in a per-repo file. These remain the
+ * domain of the global config / CLI flags.
+ */
+export declare const REPO_REJECTED_KEYS: readonly ["maxParallel", "perRepoMax", "agentCmd", "piBin", "sessionsDir", "identity", "humanWorktreesDir"];
+/** A key rejected from a per-repo file. */
+export type RepoRejectedKey = (typeof REPO_REJECTED_KEYS)[number];
+/** The path to a repo's `.dorfl.json` (repo root + filename). */
+export declare function repoConfigPath(repoPath: string): string;
+/** The result of reading (and filtering) a repo's `.dorfl.json`. */
+export interface LoadedRepoConfig {
+    /** Where we looked (whether or not the file exists). */
+    path: string;
+    /**
+     * Only the repo-appropriate keys found in the file, ready to layer over the
+     * global config. Unknown and rejected keys are NOT present here.
+     */
+    config: PartialConfig;
+    /**
+     * Runner/host-only keys that WERE present in the file and were ignored. Empty
+     * when nothing was rejected.
+     */
+    rejected: string[];
+    /**
+     * A clear, human-facing message naming the rejected keys and the file they
+     * came from. `undefined` when nothing was rejected.
+     */
+    message?: string;
+}
+/**
+ * Read a repo's `.dorfl.json` and split it into the honoured subset and
+ * the rejected runner/host-only keys. A missing file is not an error (the repo
+ * simply resolves to the global config); invalid JSON is. Unknown keys are
+ * silently dropped (neither honoured nor reported as rejected). Only keys in
+ * {@link REPO_ALLOWED_KEYS} are carried into `config`.
+ */
+export declare function loadRepoConfig(repoPath: string): LoadedRepoConfig;
+/**
+ * The content-based half of {@link loadRepoConfig}: parse + apply the SAME
+ * allow/reject split to ALREADY-READ `.dorfl.json` bytes, labelling the
+ * source as `sourceLabel` (a path, or e.g. `<arbiter>/main:.dorfl.json`)
+ * in the rejected-key message. Used wherever the committed repo file is sourced
+ * from somewhere OTHER than a working-tree path — notably `do --remote`, which
+ * reads it from the arbiter's `main` (`git show`) since there is no checkout.
+ * Reuses the allow/reject SET verbatim (no parallel split), so a host-only key
+ * is rejected identically however the bytes were sourced. Invalid JSON throws.
+ */
+export declare function loadRepoConfigFromContent(content: string, sourceLabel: string): LoadedRepoConfig;
+/** Inputs to {@link resolveRepoConfig}. */
+export interface ResolveRepoConfigOptions {
+    /** Absolute path to the repo root (where `.dorfl.json` would live). */
+    repoPath: string;
+    /**
+     * The fully-resolved GLOBAL config (already merged over built-in defaults,
+     * e.g. via {@link mergeConfig} / `loadConfig`). The per-repo file and any
+     * flags layer OVER this; it provides the global + default layers of the
+     * precedence chain.
+     */
+    global: Config;
+    /**
+     * Command-level flag overrides (where a command offers one). These sit at the
+     * TOP of the precedence chain: flag > env > per-repo > global > default. Only
+     * keys a command actually exposes need appear here.
+     */
+    flags?: PartialConfig;
+    /**
+     * The raw environment map the `DORFL_*` layer is read from (defaults to
+     * `process.env`). Env sits ABOVE the per-repo file and BELOW a flag, and — as
+     * a per-machine source — may set ANY key, host-only included (it is NOT subject
+     * to the per-repo allow/reject split). Injectable so tests need not mutate the
+     * real `process.env`.
+     */
+    env?: EnvMap;
+    /**
+     * The per-machine {@link ConfigOverrideMap} (from `loadConfigOverride`),
+     * inserted between the committed per-repo file and env in the precedence chain
+     * (ADR `per-machine-config-override-layer`). The hub-key bucket beats the
+     * `"*"` bucket. Default: empty (no override applied) — byte-identical to the
+     * pre-override behaviour. Injectable so tests need not touch the real
+     * `~/.config/dorfl/`.
+     */
+    override?: ConfigOverrideMap;
+    /**
+     * The resolved arbiter URL used to compute the hub key (via
+     * {@link encodeRepoKey}) for the override lookup. If omitted, the URL is
+     * resolved from `repoPath` + `global.defaultArbiter` (`git remote get-url`).
+     * Unresolvable ⇒ the hub-key bucket is SKIPPED and only the `"*"` bucket
+     * applies (graceful degrade, never an error).
+     */
+    arbiterUrl?: string;
+}
+/** The effective config for one repo, plus any rejected-key diagnostics. */
+export interface ResolvedRepoConfig {
+    /** The layered, effective {@link Config} for this repo. */
+    config: Config;
+    /** Runner/host-only keys ignored in this repo's file (see {@link loadRepoConfig}). */
+    rejected: string[];
+    /** Clear message for the rejected keys, if any. */
+    message?: string;
+}
+/**
+ * Resolve the effective config for ONE repo by layering, per key:
+ *
+ *   flag > ENV (DORFL_*) > per-repo `.dorfl.json` > global >
+ *   built-in default
+ *
+ * The `global` argument already carries the global + default layers (it is the
+ * output of `loadConfig`/`mergeConfig`). We layer the repo's honoured keys over
+ * it, then the `DORFL_*` env layer over that (env may set host-only keys
+ * the per-repo file rejected — it is a per-machine source), then any flags on
+ * top. The shared `global` object is never mutated, so calling this once per repo
+ * in a multi-repo run yields INDEPENDENT results — repo A can be `merge` while
+ * repo B is `propose` in the same run.
+ *
+ * A repo with no `.dorfl.json` (and no env) resolves to exactly `global`
+ * (unchanged behaviour).
+ */
+export declare function resolveRepoConfig(options: ResolveRepoConfigOptions): ResolvedRepoConfig;
+/**
+ * Layer an ALREADY-LOADED {@link LoadedRepoConfig} (the honoured subset + its
+ * rejected-key diagnostics) into the SAME precedence chain {@link resolveRepoConfig}
+ * applies:
+ *
+ *   flag > ENV (DORFL_*) > per-repo > global > built-in default
+ *
+ * This is the source-agnostic core: {@link resolveRepoConfig} feeds it a
+ * working-tree read ({@link loadRepoConfig}); `do --remote` feeds it the arbiter's
+ * committed file read from `main` via {@link loadRepoConfigFromContent}. EITHER
+ * way the layering + the rejected-key passthrough are IDENTICAL — only the bytes'
+ * origin differs (the task's one genuinely-new seam).
+ */
+export declare function resolveRepoConfigFromLoaded(repo: LoadedRepoConfig, options: {
+    global: Config;
+    flags?: PartialConfig;
+    env?: EnvMap;
+    /**
+     * The per-machine {@link ConfigOverrideMap}; default empty (no override).
+     * Inserted between the committed per-repo file and env in the precedence
+     * chain (ADR `per-machine-config-override-layer`).
+     */
+    override?: ConfigOverrideMap;
+    /**
+     * The resolved arbiter URL used to look up the hub-key override bucket
+     * (via {@link encodeRepoKey}). Unresolvable ⇒ skip the hub-key bucket;
+     * the `"*"` bucket still applies (graceful degrade).
+     */
+    arbiterUrl?: string;
+}): ResolvedRepoConfig;
+//# sourceMappingURL=repo-config.d.ts.map

package/dist/repo-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repo-config.d.ts","sourceRoot":"","sources":["../src/repo-config.ts"],"names":[],"mappings":"AAEA,OAAO,EAGN,KAAK,MAAM,EACX,KAAK,aAAa,EAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAe,KAAK,MAAM,EAAC,MAAM,iBAAiB,CAAC;AAG1D,OAAO,KAAK,EAAC,iBAAiB,EAAC,MAAM,sBAAsB,CAAC;AAG5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,QAA2B,CAAC;AAE7D;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,obA4JgB,CAAC;AAE/C,yCAAyC;AACzC,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhE;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,6GAyBrB,CAAC;AAEX,2CAA2C;AAC3C,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAIlE,iEAAiE;AACjE,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,oEAAoE;AACpE,MAAM,WAAW,gBAAgB;IAChC,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,MAAM,EAAE,aAAa,CAAC;IACtB;;;OAGG;IACH,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,gBAAgB,CAcjE;AAED;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACxC,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,GACjB,gBAAgB,CA0ClB;AAMD,2CAA2C;AAC3C,MAAM,WAAW,wBAAwB;IACxC,uEAAuE;IACvE,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AAyBD,4EAA4E;AAC5E,MAAM,WAAW,kBAAkB;IAClC,2DAA2D;IAC3D,MAAM,EAAE,MAAM,CAAC;IACf,sFAAsF;IACtF,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,iBAAiB,CAChC,OAAO,EAAE,wBAAwB,GAC/B,kBAAkB,CAiBpB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,2BAA2B,CAC1C,IAAI,EAAE,gBAAgB,EACtB,OAAO,EAAE;IACR,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB,GACC,kBAAkB,CAiCpB"}

package/dist/repo-config.js

@@ -0,0 +1,414 @@
+import { readFileSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { mergeConfig, warnDeprecatedConfigKeys, } from './config.js';
+import { envOverrides } from './env-config.js';
+import { brand } from './brand.js';
+import { encodeRepoKey } from './repo-key.js';
+import { run } from './git.js';
+/**
+ * The per-repo config layer.
+ *
+ * A repo may commit a `.dorfl.json` at its root. It travels WITH the repo
+ * (it is committed) and overrides the global `~/.config/dorfl/config.json`
+ * FOR THAT REPO ONLY — so repo-local properties (how this repo integrates, its
+ * acceptance `verify` gate, which remote arbitrates its claims) are agreed by all
+ * collaborators and agents rather than living in one person's global config.
+ *
+ * Resolution is per-key, highest wins:
+ *
+ *   flag (where a command offers one) > ENV (DORFL_*) > per-repo file >
+ *   global > built-in default
+ *
+ * The mechanism is multi-repo aware: each repo resolves against its OWN
+ * `.dorfl.json`, so repo A can be `merge` while repo B is `propose` in the
+ * SAME run (see {@link resolveRepoConfig}).
+ *
+ * Only keys that are genuinely repo properties are honoured in the COMMITTED
+ * per-repo file. Runner/host-only keys (`piBin`, `agentCmd`, `maxParallel`, …)
+ * describe the runner or the host machine, NOT a single repo;
+ * if present in a per-repo file they are ignored and reported with a clear
+ * message ({@link loadRepoConfig}).
+ *
+ * The sharpened host-only principle (ADR §13): **host-only keys must come from a
+ * per-machine source — a CLI flag, an `DORFL_*` env var, or the global
+ * config file — NEVER the committed repo file.** The allow/reject split below
+ * therefore governs ONLY the committed repo file; env (a per-machine source like
+ * the global file / a flag) may set ANY key, host-only included (see
+ * {@link envOverrides}).
+ *
+ * A repo with no `.dorfl.json` resolves to exactly the global config —
+ * behaviour is unchanged from before this layer existed.
+ */
+/**
+ * The conventional per-repo config filename, committed at the repo root. Derived
+ * from the single brand identity (`.{base}.json`) so a rename flips it in lockstep
+ * (see `brand.ts`).
+ */
+export const REPO_CONFIG_FILENAME = brand.repoConfigFilename;
+/**
+ * Config keys that are genuinely repo properties and so are honoured in a
+ * per-repo `.dorfl.json`. Deliberately a subset of {@link Config};
+ * extend this list as more keys become legitimately repo-scoped.
+ */
+export const REPO_ALLOWED_KEYS = [
+    'integration',
+    // `taskingIntegration` (the per-TRANSITION override for the prd→tasks TASKING
+    // transition ONLY) is a genuine repo property exactly like `integration`: whether
+    // THIS repo tasks a prd straight onto `main` (task FILES land, no PR) while it
+    // still BUILDS each task as a reviewable PR is agreed by all collaborators +
+    // travels with the repo. Resolved per-repo through the SAME chain as
+    // `integration`, then falls back to `integration` when unset. DISTINCT from
+    // intake's per-EMITTED-TYPE `{task, prd}` resolver (front door, author-trust):
+    // this is a per-lifecycle-transition knob, inside the boundary, config-resolved.
+    'taskingIntegration',
+    // `tasksLandIn` (the per-repo TASK-PLACEMENT default — staging vs pool, prd
+    // `staging-pool-position-gate-and-trust-model` US #5) is a genuine repo property
+    // exactly like `taskingIntegration`/`integration`: whether THIS repo's tasker
+    // output lands STAGED (`pre-backlog/`, review-without-PR human-promote path) or
+    // straight in the agent-eligible POOL (`ready/`, trusted fast-path) is agreed
+    // by all collaborators + travels with the repo. Resolved per-repo through the
+    // SAME chain as `taskingIntegration` (flag > env > per-repo > global > built-in
+    // `pre-backlog`). DISTINCT from intake's per-emitted-type stamps (front door):
+    // this is a per-lifecycle PLACEMENT knob, inside the trust boundary,
+    // config-resolved. Fed into the shared placement resolver as the
+    // configured-default rung (`src/placement.ts`).
+    'tasksLandIn',
+    // `specsLandIn` (the per-repo SPEC-PLACEMENT default — staging vs pool, spec
+    // `staging-pool-position-gate-and-trust-model` US #2/#5/#6/#12) is a genuine
+    // repo property exactly like `tasksLandIn`: whether THIS repo's intake-
+    // authored specs land STAGED (`specs/proposed/`, review-without-PR human-promote
+    // path) or straight in the auto-tasking POOL (`specs/ready/`, trusted fast-path)
+    // is agreed by all collaborators + travels with the repo. Resolved per-repo
+    // through the SAME chain as `tasksLandIn` (flag `--specs-land-in` > env
+    // `DORFL_SPECS_LAND_IN` > per-repo > global > built-in). Fed into the shared
+    // placement resolver as the configured-default rung for the spec lifecycle
+    // (`src/placement.ts`). The sole spec-placement key after the prd → spec HARD
+    // CUTOVER (the legacy `prdsLandIn` key is GONE — clean break, no accepted alias).
+    'specsLandIn',
+    // `noPR` (the PR-INTENT axis — push the branch but deliberately skip the PR) is
+    // a genuine repo property exactly like `integration`/`review`: whether this
+    // repo's propose runs open a PR is agreed by all collaborators + travels with
+    // the repo. Resolved per-repo through the SAME chain. (The removed `provider`
+    // OVERRIDE is gone — a stale `provider` key is ignored with a deprecation
+    // warning, see `loadRepoConfigFromContent`.)
+    'noPR',
+    'verify',
+    // `prepare` (the env-prep / install step run ONCE before the first `verify` on
+    // a fresh worktree) is a genuine repo property exactly like `verify` — how this
+    // repo's environment is made ready (install deps / submodules / codegen) is
+    // agreed by all collaborators + travels with the repo. Resolved per-repo
+    // through the SAME chain as `verify`. Install belongs HERE, never baked into
+    // `verify`.
+    'prepare',
+    'defaultArbiter',
+    // `autoBuild` (may an agent auto-BUILD undeclared, not-`humanOnly` tasks in
+    // this repo?) is a genuine repo property — the build member of the symmetric
+    // per-action gate family.
+    'autoBuild',
+    // `autoTask` (may an agent auto-task undeclared prds in this repo?) is a
+    // genuine repo property — the tasking-autonomy mirror of `autoBuild`
+    // (`work/prds/auto-task.md`), resolved per-repo through the same chain.
+    'autoTask',
+    // `observationTriage` (the 3-state `off|ask|auto` gate over the observation
+    // INBOX) is a genuine repo property — the observation-side question-surfacing
+    // gate (ADR `ci-config-policy-and-gate-family`), resolved per-repo through the
+    // same chain as `integration`/`autoBuild`. It REPLACES the old `autoTriage`
+    // boolean (no alias; no external users owed a migration window, 2026-06-12).
+    'observationTriage',
+    // `mergeQuestions` (the 3-state `off|ask|auto` gate over the MERGE-QUESTION
+    // SURFACER — prd `land-time-reverify-and-parallel-merge-ceiling` Story 17 /
+    // task `merge-questions-gate-axis`) is a genuine repo property exactly like
+    // `observationTriage`: whether THIS repo's unmerged `work/*` branches surface
+    // as merge-questions (and whether they auto-land) is agreed by all
+    // collaborators + travels with the repo. SEPARATE axis from
+    // `observationTriage` (never rides it) with a HIGHER default (`ask`, never
+    // `off` — a dropped merge-question means pushed work never lands). Resolved
+    // per-repo through the SAME precedence chain as the rest of the gate family
+    // (flag > env > per-repo > global > default `ask`).
+    'mergeQuestions',
+    // `surfaceBlockers` (the BOOLEAN gate over DECLARED blocked work — whether a
+    // task/prd carrying `needsAnswers:true` is rendered into a question sidecar) is a
+    // genuine repo property — the blocked-work side of the question-surfacing gate
+    // family (ADR `ci-config-policy-and-gate-family`), the orthogonal peer of
+    // `observationTriage`, resolved per-repo through the same chain as `autoBuild`.
+    'surfaceBlockers',
+    // `surfaceStaging` (the BOOLEAN gate-family member that widens SURFACE into
+    // STAGING — prd `staging-surface-and-apply-promote-safety` F2) is a genuine
+    // repo property exactly like its siblings (`surfaceBlockers`/`autoBuild`):
+    // whether THIS repo inspects staging for questions is agreed by all
+    // collaborators + travels with the repo. Default `true`; resolved per-repo
+    // through the SAME chain (flag > env > per-repo > global > built-in `true`).
+    // Does NOT touch the BUILD/claim candidate set — staging stays non-claimable.
+    'surfaceStaging',
+    // `selectionOrder` (the configurable order across the four orderable auto-pick
+    // pools — build/task/surface/triage; `apply` is pinned first) is a genuine repo
+    // property — the per-repo selection-order field ADR `ci-config-policy-and-gate-
+    // family` specifies, resolved per-repo like `autoTask`. SUBSUMES the removed
+    // `prdsFirst` boolean (a preset keyword or an explicit pool-name list).
+    'selectionOrder',
+    // `model` (which model this repo's work runs on) and `harness` (which adapter)
+    // are legitimate repo properties (ADR §13) — model is routing intent, not auth,
+    // and a repo may prefer a given harness. `piBin`/`agentCmd` stay host-only
+    // (machine paths/commands), so they are rejected below.
+    'model',
+    'harness',
+    // Gate 2 (PR/code review) policy is a genuine repo property (GATES prd
+    // `work/prds/tasked/review.md`), resolved per-repo like `integration`/`autoBuild`:
+    // whether this repo runs Gate 2 (`review`), which model the review agent runs
+    // on (`reviewModel`), and the revise↔review loop bound (`reviewMaxRounds`).
+    // `reviewModel` is routing intent (not auth), so — like `model` — it is
+    // repo-appropriate, not host-only.
+    'review',
+    'reviewModel',
+    'reviewMaxRounds',
+    // The tasker IMPROVER-loop family (`taskerLoop` on/off, `taskerLoopMax` hard
+    // cap on in-context review passes, `taskerLoopModel` the loop reviewer's
+    // de-correlated model) are genuine repo properties — like `review`/`reviewModel`
+    // they tune the per-repo review discipline, resolved per-repo through the same
+    // chain. They live on the LOOP (task-generation review), not on a gate, and are
+    // DISTINCT from the acceptance gate's `--review*` family.
+    'taskerLoop',
+    'taskerLoopMax',
+    'taskerLoopModel',
+    // `freshWorktreeGate` (run the acceptance gate against the REBASED tip in a
+    // clean throwaway worktree, ON by default) is a genuine repo property exactly
+    // like `verify`/`prepare`/`review`: whether this repo's gate tests the merged
+    // artifact (and pays the per-gate install cost) is agreed by all collaborators
+    // + travels with the repo. Resolved per-repo through the SAME chain.
+    'freshWorktreeGate',
+    // `mergeRetries` (the cross-job merge serialiser's CAS-retry cap — prd
+    // `land-time-reverify-and-parallel-merge-ceiling` Story 5 / Applied Answer q1 (a))
+    // is a genuine repo property exactly like `freshWorktreeGate`: "how many
+    // re-rebase-and-retry attempts before a contender bounces to needs-attention"
+    // is agreed by all collaborators in a wide-matrix CI repo + travels with the
+    // repo. Resolved per-repo through the SAME chain as `freshWorktreeGate`
+    // (flag > env > per-repo > global > default). Safety is unchanged — a lost
+    // CAS still costs only a re-rebase + re-gate retry, never a `--force`.
+    'mergeRetries',
+    // `strictMergeApproval` (the OPT-IN strictness layered on the OQ6
+    // stale-approval default — prd `land-time-reverify-and-parallel-merge-ceiling`
+    // sidecar OQ6 / task `strict-merge-approval-gate`) is a genuine repo property
+    // exactly like `mergeQuestions`/`mergeRetries`: whether THIS repo re-surfaces
+    // the merge-question on a merge-base change (the host-agnostic analogue of
+    // GitHub's "dismiss stale approvals when the base changes") instead of
+    // auto-landing on a green re-verify is agreed by all collaborators + travels
+    // with the repo. Resolved per-repo through the SAME gate-family precedence
+    // chain (flag > env > per-repo > global > default `false`). SEPARATE,
+    // independent axis — does NOT alter `mergeQuestions`/`observationTriage`
+    // default or shape. The re-surface vs. land branch is
+    // `apply-rung-merge-disposition`'s consumer, never here.
+    'strictMergeApproval',
+    // `promptGuidance` (the NUDGE namespace — prompt-text knobs that strengthen
+    // the worker's in-band wrapper line, e.g. `testFirst`) is a genuine repo
+    // property: "is this repo nudged toward test-first?" travels with the repo
+    // and is agreed by all collaborators. CATEGORICALLY SEPARATE from the gate
+    // family (`verify`/`autoBuild`/`humanOnly`) — a nudge changes the agent's
+    // disposition, NEVER the acceptance bar. Resolved per-repo through the SAME
+    // chain as `autoBuild` (flag > env > per-repo > global > default).
+    'promptGuidance',
+];
+/**
+ * Config keys that describe the RUNNER or the HOST machine, not a single repo,
+ * and so are rejected (ignored + reported) in a per-repo file. These remain the
+ * domain of the global config / CLI flags.
+ */
+export const REPO_REJECTED_KEYS = [
+    'maxParallel',
+    'perRepoMax',
+    'agentCmd',
+    // `piBin` is a machine PATH/command, not repo policy, so it is host-only and
+    // rejected per-repo (ADR §13). It must come from a per-machine source — a
+    // flag, an `DORFL_PI_BIN` env var, or the global file — never a
+    // committed repo file. (`harness`, by contrast, is repo-appropriate and so is
+    // deliberately NOT rejected.)
+    'piBin',
+    // `sessionsDir` is a machine PATH (where the host writes pi session logs), not
+    // repo policy, so it is host-only and rejected per-repo: a committed repo file
+    // must NOT redirect where the host writes sessions. It must come from a per-
+    // machine source — a flag (`--sessions-dir`), `DORFL_SESSIONS_DIR`, or
+    // the global file (exactly like `piBin`).
+    'sessionsDir',
+    // `identity` carries SECRETS (a `gh` token, an SSH key path) and is a per-
+    // MACHINE concept (a bot's credentials), never repo policy — so a committed
+    // repo file must NOT supply it. Host-only: it comes from the global config
+    // only. Rejected per-repo (ADR identity §; same class as `piBin`).
+    'identity',
+    // Reserved/future host-only keys callers may name; rejected proactively so a
+    // typo or a copy-pasted global config never silently leaks host policy into a
+    // repo. (`humanWorktreesDir` is a planned host-only path.)
+    'humanWorktreesDir',
+];
+const ALLOWED_SET = new Set(REPO_ALLOWED_KEYS);
+/** The path to a repo's `.dorfl.json` (repo root + filename). */
+export function repoConfigPath(repoPath) {
+    return join(repoPath, REPO_CONFIG_FILENAME);
+}
+/**
+ * Read a repo's `.dorfl.json` and split it into the honoured subset and
+ * the rejected runner/host-only keys. A missing file is not an error (the repo
+ * simply resolves to the global config); invalid JSON is. Unknown keys are
+ * silently dropped (neither honoured nor reported as rejected). Only keys in
+ * {@link REPO_ALLOWED_KEYS} are carried into `config`.
+ */
+export function loadRepoConfig(repoPath) {
+    const path = repoConfigPath(repoPath);
+    if (!existsSync(path)) {
+        return { path, config: {}, rejected: [] };
+    }
+    let raw;
+    try {
+        raw = readFileSync(path, 'utf8');
+    }
+    catch (err) {
+        throw new Error(`Failed to read ${path}: ${err.message}`);
+    }
+    return loadRepoConfigFromContent(raw, path);
+}
+/**
+ * The content-based half of {@link loadRepoConfig}: parse + apply the SAME
+ * allow/reject split to ALREADY-READ `.dorfl.json` bytes, labelling the
+ * source as `sourceLabel` (a path, or e.g. `<arbiter>/main:.dorfl.json`)
+ * in the rejected-key message. Used wherever the committed repo file is sourced
+ * from somewhere OTHER than a working-tree path — notably `do --remote`, which
+ * reads it from the arbiter's `main` (`git show`) since there is no checkout.
+ * Reuses the allow/reject SET verbatim (no parallel split), so a host-only key
+ * is rejected identically however the bytes were sourced. Invalid JSON throws.
+ */
+export function loadRepoConfigFromContent(content, sourceLabel) {
+    let parsed;
+    try {
+        parsed = JSON.parse(content);
+    }
+    catch (err) {
+        throw new Error(`Invalid JSON in ${sourceLabel}: ${err.message}`);
+    }
+    // Drop (with a one-line warning) any DEPRECATED key (e.g. the removed `provider`
+    // override) before the allow/reject split, so an existing committed config keeps
+    // working — ignored, never an error, and never mistaken for an unknown key.
+    warnDeprecatedConfigKeys(parsed, sourceLabel);
+    const config = {};
+    const rejected = [];
+    for (const key of Object.keys(parsed)) {
+        const value = parsed[key];
+        if (value === undefined) {
+            continue;
+        }
+        if (ALLOWED_SET.has(key)) {
+            // Type matches by construction: key ∈ REPO_ALLOWED_KEYS ⊂ keyof Config.
+            config[key] = value;
+        }
+        else if (isRejectedKey(key)) {
+            rejected.push(key);
+        }
+        // else: unknown key ⇒ silently ignored.
+    }
+    const rejectedMessage = rejected.length > 0
+        ? `Ignoring runner/host-only key(s) in ${REPO_CONFIG_FILENAME} ` +
+            `(${sourceLabel}): ${rejected.join(', ')}. ` +
+            `These describe the runner/host, not a single repo, and belong in ` +
+            `the global config or a CLI flag.`
+        : undefined;
+    const message = rejectedMessage;
+    return { path: sourceLabel, config, rejected, ...(message ? { message } : {}) };
+}
+function isRejectedKey(key) {
+    return REPO_REJECTED_KEYS.includes(key);
+}
+/**
+ * The thin `git remote get-url <name>` reader used by {@link resolveRepoConfig}
+ * to derive a CHECKOUT's arbiter URL for the override hub-key lookup. Mirrors
+ * `resolveArbiterUrlFromCheckout` in `do.ts` (which is the same primitive on the
+ * `do --isolated` path); duplicated here — a single-line `run('git', …)` call —
+ * to avoid a `repo-config.ts` → `do.ts` dependency that would close a cycle
+ * (`do.ts` → `repo-mirror.ts` → `repo-config.ts`). Returns `undefined` when the
+ * remote is unset or the cwd is not a git repo — the override layer DEGRADES
+ * GRACEFULLY on an unresolvable URL.
+ */
+function gitRemoteGetUrl(cwd, remote, env) {
+    const res = run('git', ['remote', 'get-url', remote], cwd, { env });
+    if (res.status !== 0) {
+        return undefined;
+    }
+    const url = res.stdout.trim();
+    return url === '' ? undefined : url;
+}
+/**
+ * Resolve the effective config for ONE repo by layering, per key:
+ *
+ *   flag > ENV (DORFL_*) > per-repo `.dorfl.json` > global >
+ *   built-in default
+ *
+ * The `global` argument already carries the global + default layers (it is the
+ * output of `loadConfig`/`mergeConfig`). We layer the repo's honoured keys over
+ * it, then the `DORFL_*` env layer over that (env may set host-only keys
+ * the per-repo file rejected — it is a per-machine source), then any flags on
+ * top. The shared `global` object is never mutated, so calling this once per repo
+ * in a multi-repo run yields INDEPENDENT results — repo A can be `merge` while
+ * repo B is `propose` in the same run.
+ *
+ * A repo with no `.dorfl.json` (and no env) resolves to exactly `global`
+ * (unchanged behaviour).
+ */
+export function resolveRepoConfig(options) {
+    const { repoPath, global, flags, env, override } = options;
+    const repo = loadRepoConfig(repoPath);
+    // Resolve the arbiter URL for the override hub-key lookup from the CHECKOUT's
+    // configured `<defaultArbiter>` remote (the working-tree analogue of the
+    // mirror's `origin`). Unresolvable (no remote, not a git repo) ⇒ hub-key
+    // lookup skipped; the `"*"` bucket still applies (graceful degrade).
+    const arbiterRemote = flags?.defaultArbiter ?? global.defaultArbiter;
+    const arbiterUrl = options.arbiterUrl ?? gitRemoteGetUrl(repoPath, arbiterRemote, env);
+    return resolveRepoConfigFromLoaded(repo, {
+        global,
+        flags,
+        env,
+        override,
+        ...(arbiterUrl !== undefined ? { arbiterUrl } : {}),
+    });
+}
+/**
+ * Layer an ALREADY-LOADED {@link LoadedRepoConfig} (the honoured subset + its
+ * rejected-key diagnostics) into the SAME precedence chain {@link resolveRepoConfig}
+ * applies:
+ *
+ *   flag > ENV (DORFL_*) > per-repo > global > built-in default
+ *
+ * This is the source-agnostic core: {@link resolveRepoConfig} feeds it a
+ * working-tree read ({@link loadRepoConfig}); `do --remote` feeds it the arbiter's
+ * committed file read from `main` via {@link loadRepoConfigFromContent}. EITHER
+ * way the layering + the rejected-key passthrough are IDENTICAL — only the bytes'
+ * origin differs (the task's one genuinely-new seam).
+ */
+export function resolveRepoConfigFromLoaded(repo, options) {
+    const { global, flags, env, override, arbiterUrl } = options;
+    // The per-machine override layer (ADR `per-machine-config-override-layer`):
+    // the `"*"` (all-repos) bucket then the hub-key (this-repo) bucket, spread
+    // BETWEEN the committed per-repo file and env. Hub-key beats `"*"`. An
+    // unresolvable arbiter URL skips the hub-key lookup but keeps `"*"` — never
+    // an error. The override may set ANY key (host-only included): it is a
+    // per-machine source like env / flag / the global file, NOT subject to the
+    // per-repo allow/reject split.
+    const overrideStar = override?.['*'] ?? {};
+    const hubKey = arbiterUrl !== undefined ? encodeRepoKey(arbiterUrl) : undefined;
+    const overrideHub = hubKey !== undefined && override !== undefined
+        ? (override[hubKey] ?? {})
+        : {};
+    // mergeConfig copies `global` (spreads DEFAULT_CONFIG then assigns) so the
+    // shared global object is never mutated. Layer per-repo, then the override
+    // (`"*"` then hub-key — hub-key wins), then env (a per-machine source — may
+    // set host-only keys), then flags on top.
+    const config = mergeConfig({
+        ...global,
+        ...repo.config,
+        ...overrideStar,
+        ...overrideHub,
+        ...envOverrides(env),
+        ...(flags ?? {}),
+    });
+    return {
+        config,
+        rejected: repo.rejected,
+        ...(repo.message ? { message: repo.message } : {}),
+    };
+}
+//# sourceMappingURL=repo-config.js.map

package/dist/repo-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repo-config.js","sourceRoot":"","sources":["../src/repo-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,YAAY,EAAE,UAAU,EAAC,MAAM,SAAS,CAAC;AACjD,OAAO,EAAC,IAAI,EAAC,MAAM,WAAW,CAAC;AAC/B,OAAO,EACN,WAAW,EACX,wBAAwB,GAGxB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAC,YAAY,EAAc,MAAM,iBAAiB,CAAC;AAC1D,OAAO,EAAC,KAAK,EAAC,MAAM,YAAY,CAAC;AACjC,OAAO,EAAC,aAAa,EAAC,MAAM,eAAe,CAAC;AAE5C,OAAO,EAAC,GAAG,EAAC,MAAM,UAAU,CAAC;AAE7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,CAAC,kBAAkB,CAAC;AAE7D;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAChC,aAAa;IACb,8EAA8E;IAC9E,kFAAkF;IAClF,+EAA+E;IAC/E,6EAA6E;IAC7E,qEAAqE;IACrE,4EAA4E;IAC5E,+EAA+E;IAC/E,iFAAiF;IACjF,oBAAoB;IACpB,4EAA4E;IAC5E,iFAAiF;IACjF,8EAA8E;IAC9E,gFAAgF;IAChF,8EAA8E;IAC9E,8EAA8E;IAC9E,gFAAgF;IAChF,+EAA+E;IAC/E,qEAAqE;IACrE,iEAAiE;IACjE,gDAAgD;IAChD,aAAa;IACb,6EAA6E;IAC7E,6EAA6E;IAC7E,wEAAwE;IACxE,iFAAiF;IACjF,iFAAiF;IACjF,4EAA4E;IAC5E,wEAAwE;IACxE,6EAA6E;IAC7E,2EAA2E;IAC3E,8EAA8E;IAC9E,kFAAkF;IAClF,aAAa;IACb,gFAAgF;IAChF,4EAA4E;IAC5E,8EAA8E;IAC9E,8EAA8E;IAC9E,0EAA0E;IAC1E,6CAA6C;IAC7C,MAAM;IACN,QAAQ;IACR,+EAA+E;IAC/E,gFAAgF;IAChF,4EAA4E;IAC5E,yEAAyE;IACzE,6EAA6E;IAC7E,YAAY;IACZ,SAAS;IACT,gBAAgB;IAChB,4EAA4E;IAC5E,6EAA6E;IAC7E,0BAA0B;IAC1B,WAAW;IACX,yEAAyE;IACzE,qEAAqE;IACrE,wEAAwE;IACxE,UAAU;IACV,4EAA4E;IAC5E,8EAA8E;IAC9E,+EAA+E;IAC/E,4EAA4E;IAC5E,6EAA6E;IAC7E,mBAAmB;IACnB,4EAA4E;IAC5E,4EAA4E;IAC5E,4EAA4E;IAC5E,8EAA8E;IAC9E,mEAAmE;IACnE,4DAA4D;IAC5D,2EAA2E;IAC3E,4EAA4E;IAC5E,4EAA4E;IAC5E,oDAAoD;IACpD,gBAAgB;IAChB,6EAA6E;IAC7E,kFAAkF;IAClF,+EAA+E;IAC/E,0EAA0E;IAC1E,gFAAgF;IAChF,iBAAiB;IACjB,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,oEAAoE;IACpE,2EAA2E;IAC3E,6EAA6E;IAC7E,8EAA8E;IAC9E,gBAAgB;IAChB,+EAA+E;IAC/E,gFAAgF;IAChF,gFAAgF;IAChF,6EAA6E;IAC7E,wEAAwE;IACxE,gBAAgB;IAChB,+EAA+E;IAC/E,gFAAgF;IAChF,2EAA2E;IAC3E,wDAAwD;IACxD,OAAO;IACP,SAAS;IACT,uEAAuE;IACvE,mFAAmF;IACnF,8EAA8E;IAC9E,4EAA4E;IAC5E,wEAAwE;IACxE,mCAAmC;IACnC,QAAQ;IACR,aAAa;IACb,iBAAiB;IACjB,6EAA6E;IAC7E,yEAAyE;IACzE,iFAAiF;IACjF,+EAA+E;IAC/E,gFAAgF;IAChF,0DAA0D;IAC1D,YAAY;IACZ,eAAe;IACf,iBAAiB;IACjB,4EAA4E;IAC5E,8EAA8E;IAC9E,8EAA8E;IAC9E,+EAA+E;IAC/E,qEAAqE;IACrE,mBAAmB;IACnB,uEAAuE;IACvE,mFAAmF;IACnF,yEAAyE;IACzE,8EAA8E;IAC9E,6EAA6E;IAC7E,wEAAwE;IACxE,2EAA2E;IAC3E,uEAAuE;IACvE,cAAc;IACd,kEAAkE;IAClE,+EAA+E;IAC/E,8EAA8E;IAC9E,8EAA8E;IAC9E,2EAA2E;IAC3E,uEAAuE;IACvE,6EAA6E;IAC7E,2EAA2E;IAC3E,sEAAsE;IACtE,yEAAyE;IACzE,sDAAsD;IACtD,yDAAyD;IACzD,qBAAqB;IACrB,4EAA4E;IAC5E,yEAAyE;IACzE,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,4EAA4E;IAC5E,mEAAmE;IACnE,gBAAgB;CAC6B,CAAC;AAK/C;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IACjC,aAAa;IACb,YAAY;IACZ,UAAU;IACV,6EAA6E;IAC7E,0EAA0E;IAC1E,gEAAgE;IAChE,8EAA8E;IAC9E,8BAA8B;IAC9B,OAAO;IACP,+EAA+E;IAC/E,+EAA+E;IAC/E,6EAA6E;IAC7E,uEAAuE;IACvE,0CAA0C;IAC1C,aAAa;IACb,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,mEAAmE;IACnE,UAAU;IACV,6EAA6E;IAC7E,8EAA8E;IAC9E,2DAA2D;IAC3D,mBAAmB;CACV,CAAC;AAKX,MAAM,WAAW,GAAG,IAAI,GAAG,CAAS,iBAAiB,CAAC,CAAC;AAEvD,iEAAiE;AACjE,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC9C,OAAO,IAAI,CAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC;AAC7C,CAAC;AAuBD;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC9C,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,OAAO,EAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAC,CAAC;IACzC,CAAC;IAED,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACJ,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,kBAAkB,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,OAAO,yBAAyB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,yBAAyB,CACxC,OAAe,EACf,WAAmB;IAEnB,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAA4B,CAAC;IACzD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACd,mBAAmB,WAAW,KAAM,GAAa,CAAC,OAAO,EAAE,CAC3D,CAAC;IACH,CAAC;IAED,iFAAiF;IACjF,iFAAiF;IACjF,4EAA4E;IAC5E,wBAAwB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAE9C,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACzB,SAAS;QACV,CAAC;QACD,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,wEAAwE;YACvE,MAAkC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAClD,CAAC;aAAM,IAAI,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;QACD,wCAAwC;IACzC,CAAC;IAED,MAAM,eAAe,GACpB,QAAQ,CAAC,MAAM,GAAG,CAAC;QAClB,CAAC,CAAC,uCAAuC,oBAAoB,GAAG;YAC/D,IAAI,WAAW,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAC5C,mEAAmE;YACnE,kCAAkC;QACnC,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,OAAO,GAAG,eAAe,CAAC;IAEhC,OAAO,EAAC,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAC,OAAO,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAC,CAAC;AAC7E,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IACjC,OAAQ,kBAAwC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAChE,CAAC;AA8CD;;;;;;;;;GASG;AACH,SAAS,eAAe,CACvB,GAAW,EACX,MAAc,EACd,GAAkC;IAElC,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,EAAC,GAAG,EAAC,CAAC,CAAC;IAClE,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,OAAO,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC;AACrC,CAAC;AAYD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,iBAAiB,CAChC,OAAiC;IAEjC,MAAM,EAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAC,GAAG,OAAO,CAAC;IACzD,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACtC,8EAA8E;IAC9E,yEAAyE;IACzE,yEAAyE;IACzE,qEAAqE;IACrE,MAAM,aAAa,GAAG,KAAK,EAAE,cAAc,IAAI,MAAM,CAAC,cAAc,CAAC;IACrE,MAAM,UAAU,GACf,OAAO,CAAC,UAAU,IAAI,eAAe,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;IACrE,OAAO,2BAA2B,CAAC,IAAI,EAAE;QACxC,MAAM;QACN,KAAK;QACL,GAAG;QACH,QAAQ;QACR,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAC,UAAU,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACjD,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,2BAA2B,CAC1C,IAAsB,EACtB,OAgBC;IAED,MAAM,EAAC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAC,GAAG,OAAO,CAAC;IAC3D,4EAA4E;IAC5E,2EAA2E;IAC3E,uEAAuE;IACvE,4EAA4E;IAC5E,uEAAuE;IACvE,2EAA2E;IAC3E,+BAA+B;IAC/B,MAAM,YAAY,GAAG,QAAQ,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3C,MAAM,MAAM,GACX,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,MAAM,WAAW,GAChB,MAAM,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS;QAC7C,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC1B,CAAC,CAAC,EAAE,CAAC;IACP,2EAA2E;IAC3E,2EAA2E;IAC3E,4EAA4E;IAC5E,0CAA0C;IAC1C,MAAM,MAAM,GAAG,WAAW,CAAC;QAC1B,GAAG,MAAM;QACT,GAAG,IAAI,CAAC,MAAM;QACd,GAAG,YAAY;QACf,GAAG,WAAW;QACd,GAAG,YAAY,CAAC,GAAG,CAAC;QACpB,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;KAChB,CAAC,CAAC;IACH,OAAO;QACN,MAAM;QACN,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC;AACH,CAAC"}

package/dist/repo-key.d.ts

@@ -0,0 +1,20 @@
+/**
+ * The arbiter-URL → **hub key** encoder, extracted from `repo-mirror.ts` so it
+ * is importable WITHOUT pulling in the rest of the hub-mirror plumbing (which
+ * itself depends on `repo-config.ts`). The split exists for ONE reason: the
+ * per-machine `config.override.json` layer (resolved in `repo-config.ts`)
+ * needs the hub key to look up the per-repo override bucket — but
+ * `repo-config.ts` cannot import from `repo-mirror.ts` without a cycle. The
+ * key encoder is pure (URL → string) and has no business depending on the
+ * mirror or the per-repo config, so it lives here. `repo-mirror.ts` re-exports
+ * {@link encodeRepoKey} so existing callers see no change.
+ */
+/**
+ * Deterministically encode an arbiter remote URL into a hierarchical hub key:
+ * drop the scheme / user / `.git` suffix, then replace `.` → `-` **per path
+ * segment** (lossless and reversible; avoids the dotted-segment hazard that
+ * trips editors / tools and our own dotdir-pruning). E.g.
+ * `git@github.com:wighawag/dorfl.git` → `github-com/wighawag/dorfl`.
+ */
+export declare function encodeRepoKey(url: string): string;
+//# sourceMappingURL=repo-key.d.ts.map