reposets 0.4.1 → 0.4.2

package/index.js

@@ -1,2 +1,19 @@
-export { BypassActorSchema, CONFIG_FILENAME, CREDENTIALS_FILENAME, CleanupSchema, CleanupScopeSchema, ConfigFilesLive, ConfigSchema, CredentialProfileSchema, CredentialResolver, CredentialResolverLive, CredentialsSchema, GitHubApiError, GitHubClient, GitHubClientLive, GitHubClientTest, GroupSchema, LogLevelSchema, OnePasswordClient, OnePasswordClientLive, OnePasswordClientTest, OnePasswordError, ReposetsConfigFile, ReposetsCredentialsFile, ResolveError, ResolveSectionSchema, ResolvedRefSchema, RulesetSchema, SecretGroupSchema, SyncEngine, SyncEngineLive, SyncError, SyncLogger, SyncLoggerLive, VariableGroupSchema, buildRulesetPayload, encryptSecret, makeConfigFilesLive, validateConfigRefs } from "./500.js";
-export { AppDirs, ConfigError as XdgConfigError, ConfigFile } from "xdg-effect";
+import { GitHubApiError, OnePasswordError, ResolveError, SyncError } from "./errors.js";
+import { encryptSecret } from "./lib/crypto.js";
+import { CleanupSchema, CleanupScopeSchema, SecretGroupSchema, VariableGroupSchema } from "./schemas/common.js";
+import { BypassActorSchema, ResolvedRefSchema, RulesetSchema, buildRulesetPayload } from "./schemas/ruleset.js";
+import { ConfigSchema, GroupSchema, LogLevelSchema } from "./schemas/config.js";
+import { CredentialProfileSchema, CredentialsSchema, ResolveSectionSchema } from "./schemas/credentials.js";
+import { CONFIG_FILENAME, CREDENTIALS_FILENAME, ConfigFilesLive, ReposetsConfigFile, ReposetsCredentialsFile, makeConfigFilesLive, validateConfigRefs } from "./services/ConfigFiles.js";
+import { OnePasswordClient, OnePasswordClientLive, OnePasswordClientTest } from "./services/OnePasswordClient.js";
+import { CredentialResolver, CredentialResolverLive } from "./services/CredentialResolver.js";
+import { GitHubClient, GitHubClientLive, GitHubClientTest } from "./services/GitHubClient.js";
+import { SyncLogger, SyncLoggerLive } from "./services/SyncLogger.js";
+import { SyncEngine, SyncEngineLive } from "./services/SyncEngine.js";
+import { AppDirs, ConfigError as XdgConfigError, ConfigFile } from "xdg-effect";
+
+//#region src/index.ts
+/* v8 ignore stop */
+
+//#endregion
+export { AppDirs, BypassActorSchema, CONFIG_FILENAME, CREDENTIALS_FILENAME, CleanupSchema, CleanupScopeSchema, ConfigFile, ConfigFilesLive, ConfigSchema, CredentialProfileSchema, CredentialResolver, CredentialResolverLive, CredentialsSchema, GitHubApiError, GitHubClient, GitHubClientLive, GitHubClientTest, GroupSchema, LogLevelSchema, OnePasswordClient, OnePasswordClientLive, OnePasswordClientTest, OnePasswordError, ReposetsConfigFile, ReposetsCredentialsFile, ResolveError, ResolveSectionSchema, ResolvedRefSchema, RulesetSchema, SecretGroupSchema, SyncEngine, SyncEngineLive, SyncError, SyncLogger, SyncLoggerLive, VariableGroupSchema, XdgConfigError, buildRulesetPayload, encryptSecret, makeConfigFilesLive, validateConfigRefs };

package/lib/crypto.js

@@ -0,0 +1,27 @@
+import { blake2b } from "blakejs";
+import nacl from "tweetnacl";
+
+//#region src/lib/crypto.ts
+/**
+* Encrypt a secret using libsodium's sealed box algorithm.
+* Implementation based on tweetsodium using tweetnacl + blakejs.
+*
+* The sealed box format is: ephemeral_public_key (32 bytes) || ciphertext
+*/
+function encryptSecret(publicKey, secretValue) {
+	const messageBytes = Buffer.from(secretValue);
+	const publicKeyBytes = Buffer.from(publicKey, "base64");
+	const ephemeralKeyPair = nacl.box.keyPair();
+	const nonceInput = new Uint8Array(64);
+	nonceInput.set(ephemeralKeyPair.publicKey);
+	nonceInput.set(publicKeyBytes, 32);
+	const nonce = blake2b(nonceInput, void 0, 24);
+	const ciphertext = nacl.box(messageBytes, nonce, publicKeyBytes, ephemeralKeyPair.secretKey);
+	const sealed = new Uint8Array(ephemeralKeyPair.publicKey.length + ciphertext.length);
+	sealed.set(ephemeralKeyPair.publicKey);
+	sealed.set(ciphertext, ephemeralKeyPair.publicKey.length);
+	return Buffer.from(sealed).toString("base64");
+}
+
+//#endregion
+export { encryptSecret };

package/package.json

@@ -1,75 +1,63 @@
 {
-  "name": "reposets",
-  "version": "0.4.1",
-  "private": false,
-  "description": "CLI tool to sync GitHub repo settings, secrets and rulesets across personal repositories",
-  "keywords": [
-    "github",
-    "sync",
-    "cli",
-    "secrets",
-    "rulesets",
-    "variables",
-    "environments",
-    "toml",
-    "effect",
-    "xdg",
-    "repository",
-    "settings",
-    "automation",
-    "devops"
-  ],
-  "homepage": "https://github.com/spencerbeggs/reposets#readme",
-  "bugs": {
-    "url": "https://github.com/spencerbeggs/reposets/issues"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/spencerbeggs/reposets.git",
-    "directory": "package"
-  },
-  "license": "MIT",
-  "author": {
-    "name": "C. Spencer Beggs",
-    "email": "spencer@beggs.codes",
-    "url": "https://spencerbeg.gs"
-  },
-  "type": "module",
-  "exports": {
-    ".": {
-      "types": "./index.d.ts",
-      "import": "./index.js"
-    }
-  },
-  "bin": {
-    "reposets": "bin/reposets.js"
-  },
-  "dependencies": {
-    "@1password/sdk": "^0.4.0",
-    "@effect/cli": "^0.75.1",
-    "@effect/platform": "^0.96.1",
-    "@effect/platform-node": "^0.106.0",
-    "@octokit/rest": "^22.0.1",
-    "blakejs": "^1.2.1",
-    "effect": "^3.21.2",
-    "smol-toml": "^1.6.1",
-    "tweetnacl": "^1.0.3",
-    "xdg-effect": "^1.0.1"
-  },
-  "engines": {
-    "node": ">=20.0.0"
-  },
-  "files": [
-    "!reposets.api.json",
-    "!tsconfig.json",
-    "!tsdoc.json",
-    "500.js",
-    "LICENSE",
-    "README.md",
-    "bin/reposets.js",
-    "index.d.ts",
-    "index.js",
-    "package.json",
-    "tsdoc-metadata.json"
-  ]
+	"name": "reposets",
+	"version": "0.4.2",
+	"private": false,
+	"description": "CLI tool to sync GitHub repo settings, secrets and rulesets across personal repositories",
+	"keywords": [
+		"github",
+		"sync",
+		"cli",
+		"secrets",
+		"rulesets",
+		"variables",
+		"environments",
+		"toml",
+		"effect",
+		"xdg",
+		"repository",
+		"settings",
+		"automation",
+		"devops"
+	],
+	"homepage": "https://github.com/spencerbeggs/reposets#readme",
+	"bugs": {
+		"url": "https://github.com/spencerbeggs/reposets/issues"
+	},
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/spencerbeggs/reposets.git",
+		"directory": "package"
+	},
+	"license": "MIT",
+	"author": {
+		"name": "C. Spencer Beggs",
+		"email": "spencer@beggs.codes",
+		"url": "https://spencerbeg.gs"
+	},
+	"type": "module",
+	"exports": {
+		".": {
+			"types": "./index.d.ts",
+			"import": "./index.js"
+		},
+		"./package.json": "./package.json"
+	},
+	"bin": {
+		"reposets": "bin/reposets.js"
+	},
+	"dependencies": {
+		"@1password/sdk": "^0.4.0",
+		"@effect/cli": "^0.75.2",
+		"@effect/platform": "^0.96.1",
+		"@effect/platform-node": "^0.107.0",
+		"@octokit/rest": "^22.0.1",
+		"blakejs": "^1.2.1",
+		"effect": "^3.21.3",
+		"smol-toml": ">=1.6.1",
+		"tweetnacl": "^1.0.3",
+		"xdg-effect": "^1.0.3"
+	},
+	"engines": {
+		"node": ">=24.11.0"
+	}
 }

package/schemas/common.js

@@ -0,0 +1,130 @@
+import { Jsonifiable, taplo, tombi } from "xdg-effect";
+import { Schema } from "effect";
+
+//#region src/schemas/common.ts
+const ResourceFileKind = Schema.Struct({ file: Schema.Record({
+	key: Schema.String,
+	value: Schema.String
+}).annotations({
+	title: "File entries",
+	description: "Named entries with file path values, resolved relative to config directory",
+	jsonSchema: tombi({ additionalKeyLabel: "name" })
+}) });
+const ResourceValueKind = Schema.Struct({ value: Schema.Record({
+	key: Schema.String,
+	value: Schema.Union(Schema.String, Schema.Record({
+		key: Schema.String,
+		value: Jsonifiable
+	}))
+}).annotations({
+	title: "Value entries",
+	description: "Named entries with inline values. Strings used as-is, objects JSON-stringified.",
+	jsonSchema: tombi({ additionalKeyLabel: "name" })
+}) });
+const ResourceResolvedKind = Schema.Struct({ resolved: Schema.Record({
+	key: Schema.String,
+	value: Schema.String
+}).annotations({
+	title: "Resolved entries",
+	description: "Named entries mapped to credential labels. Values come from the active credential profile.",
+	jsonSchema: tombi({ additionalKeyLabel: "name" })
+}) });
+const SecretGroupSchema = Schema.Union(ResourceFileKind, ResourceValueKind, ResourceResolvedKind).annotations({
+	identifier: "SecretGroup",
+	title: "Secret group",
+	description: "A group of secrets. Must be exactly one kind: file, value, or resolved.",
+	jsonSchema: taplo({ links: { key: "https://github.com/spencerbeggs/reposets/blob/main/docs/secrets-and-variables.md" } })
+});
+const VariableGroupSchema = Schema.Union(ResourceFileKind, ResourceValueKind, ResourceResolvedKind).annotations({
+	identifier: "VariableGroup",
+	title: "Variable group",
+	description: "A group of variables. Must be exactly one kind: file, value, or resolved.",
+	jsonSchema: taplo({ links: { key: "https://github.com/spencerbeggs/reposets/blob/main/docs/secrets-and-variables.md" } })
+});
+const CleanupScopeSchema = Schema.Union(Schema.Boolean, Schema.Struct({ preserve: Schema.Array(Schema.String).annotations({
+	title: "Preserve list",
+	description: "Resource names that should never be deleted during cleanup",
+	examples: [["LEGACY_TOKEN", "DEPLOY_KEY"]]
+}) })).annotations({
+	identifier: "CleanupScope",
+	title: "Cleanup scope",
+	description: "Controls cleanup for a single resource scope. false disables cleanup, true enables full cleanup, or specify names to preserve."
+});
+const CleanupSecretsSchema = Schema.Struct({
+	actions: Schema.optionalWith(CleanupScopeSchema, { default: () => false }).annotations({
+		title: "Clean up Actions secrets",
+		description: "Delete Actions secrets not declared in any referenced secret group",
+		default: false
+	}),
+	dependabot: Schema.optionalWith(CleanupScopeSchema, { default: () => false }).annotations({
+		title: "Clean up Dependabot secrets",
+		description: "Delete Dependabot secrets not declared in any referenced secret group",
+		default: false
+	}),
+	codespaces: Schema.optionalWith(CleanupScopeSchema, { default: () => false }).annotations({
+		title: "Clean up Codespaces secrets",
+		description: "Delete Codespaces secrets not declared in any referenced secret group",
+		default: false
+	}),
+	environments: Schema.optionalWith(CleanupScopeSchema, { default: () => false }).annotations({
+		title: "Clean up environment secrets",
+		description: "Delete environment secrets not declared in any referenced secret group",
+		default: false
+	})
+}).annotations({
+	identifier: "CleanupSecrets",
+	title: "Secrets cleanup configuration",
+	description: "Controls deletion of secrets by scope (Actions, Dependabot, Codespaces, environments)."
+});
+const CleanupVariablesSchema = Schema.Struct({
+	actions: Schema.optionalWith(CleanupScopeSchema, { default: () => false }).annotations({
+		title: "Clean up Actions variables",
+		description: "Delete Actions variables not declared in any referenced variable group",
+		default: false
+	}),
+	environments: Schema.optionalWith(CleanupScopeSchema, { default: () => false }).annotations({
+		title: "Clean up environment variables",
+		description: "Delete environment variables not declared in any referenced variable group",
+		default: false
+	})
+}).annotations({
+	identifier: "CleanupVariables",
+	title: "Variables cleanup configuration",
+	description: "Controls deletion of variables by scope (Actions, environments)."
+});
+const CleanupSchema = Schema.Struct({
+	secrets: Schema.optionalWith(CleanupSecretsSchema, { default: () => ({
+		actions: false,
+		dependabot: false,
+		codespaces: false,
+		environments: false
+	}) }).annotations({
+		title: "Secrets cleanup",
+		description: "Controls cleanup of secrets by scope"
+	}),
+	variables: Schema.optionalWith(CleanupVariablesSchema, { default: () => ({
+		actions: false,
+		environments: false
+	}) }).annotations({
+		title: "Variables cleanup",
+		description: "Controls cleanup of variables by scope"
+	}),
+	rulesets: Schema.optionalWith(CleanupScopeSchema, { default: () => false }).annotations({
+		title: "Clean up rulesets",
+		description: "Delete repository rulesets not declared in any referenced ruleset group",
+		default: false
+	}),
+	environments: Schema.optionalWith(CleanupScopeSchema, { default: () => false }).annotations({
+		title: "Clean up environments",
+		description: "Delete repository environments not declared in config",
+		default: false
+	})
+}).annotations({
+	identifier: "Cleanup",
+	title: "Cleanup configuration",
+	description: "Controls deletion of resources not declared in config. All disabled by default.",
+	jsonSchema: taplo({ links: { key: "https://github.com/spencerbeggs/reposets/blob/main/docs/cleanup.md" } })
+});
+
+//#endregion
+export { CleanupSchema, CleanupScopeSchema, SecretGroupSchema, VariableGroupSchema };