reposets 0.4.2 → 1.0.0

package/services/ConfigFiles.js

@@ -1,119 +1,141 @@
 import { ConfigSchema } from "../schemas/config.js";
 import { CredentialsSchema } from "../schemas/credentials.js";
-import { AppDirsConfig, ConfigError, ConfigFile, ExplicitPath, FirstMatch, StaticDir, TomlCodec, UpwardWalk, XdgConfigLive, XdgConfigResolver, XdgSavePath } from "xdg-effect";
-import { Effect, Option } from "effect";
-import { existsSync, statSync } from "node:fs";
+import { Data, Effect, FileSystem, Layer } from "effect";
+import { AppConfig } from "@effected/app";
+import { ConfigFile, ConfigResolver, TomlCodec } from "@effected/config-file";
 
 //#region src/services/ConfigFiles.ts
+/**
+* The config file's fixed name, in every tier of the resolver chain.
+*
+* @public
+*/
 const CONFIG_FILENAME = "reposets.config.toml";
+/**
+* The credentials file's fixed name.
+*
+* @public
+*/
 const CREDENTIALS_FILENAME = "reposets.credentials.toml";
-const ReposetsConfigFile = ConfigFile.Tag("reposets/Config");
-const ReposetsCredentialsFile = ConfigFile.Tag("reposets/Credentials");
 /**
-* Validates all internal cross-references in a parsed config. Checks that
-* every group's settings, secrets, variables, rulesets, and environments
-* references point to defined top-level sections, and that environment-scoped
-* secret/variable groups reference defined environments. Collects ALL errors
-* into a single ConfigError.
+* Service identity for the parsed `reposets.config.toml`.
+*
+* @public
 */
-function validateConfigRefs(config) {
-	const errors = [];
-	const definedSettings = new Set(Object.keys(config.settings));
-	const definedSecrets = new Set(Object.keys(config.secrets));
-	const definedVariables = new Set(Object.keys(config.variables));
-	const definedRulesets = new Set(Object.keys(config.rulesets));
-	const definedEnvironments = new Set(Object.keys(config.environments));
-	const definedSecurity = new Set(Object.keys(config.security));
-	const definedCodeScanning = new Set(Object.keys(config.code_scanning));
-	for (const [groupName, group] of Object.entries(config.groups)) {
-		if (group.settings) {
-			for (const ref of group.settings) if (!definedSettings.has(ref)) errors.push(`group '${groupName}': unknown settings group '${ref}'`);
-		}
-		if (group.rulesets) {
-			for (const ref of group.rulesets) if (!definedRulesets.has(ref)) errors.push(`group '${groupName}': unknown ruleset '${ref}'`);
-		}
-		if (group.environments) {
-			for (const ref of group.environments) if (!definedEnvironments.has(ref)) errors.push(`group '${groupName}': unknown environment '${ref}'`);
-		}
-		if (group.security) {
-			for (const ref of group.security) if (!definedSecurity.has(ref)) errors.push(`group '${groupName}': unknown security group '${ref}'`);
-		}
-		if (group.code_scanning) {
-			for (const ref of group.code_scanning) if (!definedCodeScanning.has(ref)) errors.push(`group '${groupName}': unknown code_scanning group '${ref}'`);
-		}
-		if (group.secrets) {
-			if (group.secrets.actions) {
-				for (const ref of group.secrets.actions) if (!definedSecrets.has(ref)) errors.push(`group '${groupName}': unknown secrets group '${ref}'`);
-			}
-			if (group.secrets.dependabot) {
-				for (const ref of group.secrets.dependabot) if (!definedSecrets.has(ref)) errors.push(`group '${groupName}': unknown secrets group '${ref}'`);
-			}
-			if (group.secrets.codespaces) {
-				for (const ref of group.secrets.codespaces) if (!definedSecrets.has(ref)) errors.push(`group '${groupName}': unknown secrets group '${ref}'`);
-			}
-			if (group.secrets.environments) for (const [envName, secretGroups] of Object.entries(group.secrets.environments)) {
-				if (!definedEnvironments.has(envName)) errors.push(`group '${groupName}': unknown environment '${envName}' in secrets.environments`);
-				for (const ref of secretGroups) if (!definedSecrets.has(ref)) errors.push(`group '${groupName}': in secrets.environments.'${envName}': unknown secrets group '${ref}'`);
-			}
-		}
-		if (group.variables) {
-			if (group.variables.actions) {
-				for (const ref of group.variables.actions) if (!definedVariables.has(ref)) errors.push(`group '${groupName}': unknown variables group '${ref}'`);
-			}
-			if (group.variables.environments) for (const [envName, varGroups] of Object.entries(group.variables.environments)) {
-				if (!definedEnvironments.has(envName)) errors.push(`group '${groupName}': unknown environment '${envName}' in variables.environments`);
-				for (const ref of varGroups) if (!definedVariables.has(ref)) errors.push(`group '${groupName}': in variables.environments.'${envName}': unknown variables group '${ref}'`);
-			}
-		}
-	}
-	if (errors.length > 0) return Effect.fail(new ConfigError({
-		operation: "validate",
-		reason: errors.join("\n")
-	}));
-	return Effect.succeed(config);
-}
+var ReposetsConfigFile = class extends ConfigFile.Service()("reposets/Config") {};
+/**
+* Service identity for the parsed `reposets.credentials.toml`.
+*
+* @public
+*/
+var ReposetsCredentialsFile = class extends ConfigFile.Service()("reposets/Credentials") {};
 /**
-* Creates a live Layer providing both config and credentials file services.
-* When configFlag is Some and points to a directory, prepends StaticDir resolver.
-* When configFlag is Some and points to a file, prepends ExplicitPath resolver.
-* Always includes UpwardWalk + XdgConfigResolver as fallback resolvers.
-* Passes validateConfigRefs as the validate callback on the config spec.
+* Reject keys the schema does not know about.
+*
+* @remarks
+* v4 carries `onExcessProperty` on `ParseOptions` — per decode call, not on the
+* schema — and `@effected/config-file` threads it through from `0.4.0`.
+*
+* Without it a config loader silently discards part of the user's file: a typo'd
+* section name does nothing and reports nothing, and a field removed in a
+* breaking schema change is ignored rather than rejected. Both matter here.
+* `op_service_account_token` was removed for a security reason — it stored the
+* credential that unlocks every other credential — and a migrating user who
+* keeps it must be told, not quietly ignored while believing a dead token is
+* live.
+*
+* This does **not** break the documented `[settings.*]` pass-through. Those keys
+* are covered by a `StructWithRest` rest schema, so they are not excess;
+* verified here and pinned by a test upstream.
+*
+* **Applied to credentials only, for now.** The config file keeps lenient
+* decoding because `doctor` diagnoses unknown keys with nearest-match
+* suggestions — strictly better output than a decode failure — and it locates
+* the file through `discover`, which decodes. Making the load strict means
+* `discover` fails and `doctor` reports "no config found" for a file that is
+* present and one character wrong, losing the diagnosis exactly when it is
+* wanted. Turning it on for config needs `doctor` to locate the file without
+* decoding first.
 */
-function makeConfigFilesLive(configFlag) {
-	const configResolvers = [];
-	if (Option.isSome(configFlag)) {
-		const flag = configFlag.value;
-		if (existsSync(flag) && statSync(flag).isDirectory()) configResolvers.push(StaticDir({
-			dir: flag,
-			filename: CONFIG_FILENAME
-		}));
-		else configResolvers.push(ExplicitPath(flag));
+const STRICT_KEYS = {
+	onExcessProperty: "error",
+	errors: "all"
+};
+/**
+* The credentials file, resolved by upward walk then XDG.
+*
+* @remarks
+* **No `--config` tier.** That flag names the *config* file; pointing it at a
+* directory would be ambiguous here and pointing it at a file would be wrong.
+* A credentials file is found next to the project or in the XDG config
+* directory, and nowhere else.
+*
+* `AppConfig.layer` appends its own XDG tier after the resolvers given here, so
+* the upward walk wins and the XDG fallback comes free.
+*
+* @public
+*/
+const CredentialsFilesLive = AppConfig.layer(ReposetsCredentialsFile, {
+	filename: CREDENTIALS_FILENAME,
+	schema: CredentialsSchema,
+	codec: TomlCodec,
+	resolvers: [ConfigResolver.upwardWalk({ filename: CREDENTIALS_FILENAME })],
+	parseOptions: STRICT_KEYS
+});
+/**
+* Raised when `--config` names a path that does not exist.
+*
+* @remarks
+* Config discovery is best-effort by contract — every `ConfigResolver` has
+* `never` in its error channel — so a resolver that finds nothing falls through
+* to the next tier. That is right for a probe and wrong for an explicit request:
+* `--config /nope.toml` would otherwise load the XDG config instead. The
+* distinction is enforced here rather than pushed into the resolver contract.
+*
+* @public
+*/
+var ConfigFlagNotFound = class extends Data.TaggedError("ConfigFlagNotFound") {
+	/**
+	* @remarks
+	* Without this, the class renders as a bare `ConfigFlagNotFound:` and the
+	* `path` never reaches the log line. The kit does the same on its own errors.
+	*/
+	get message() {
+		return `--config path does not exist: ${this.path}`;
 	}
-	configResolvers.push(UpwardWalk({ filename: CONFIG_FILENAME }), XdgConfigResolver({ filename: CONFIG_FILENAME }));
-	return XdgConfigLive.multi({
-		app: new AppDirsConfig({ namespace: "reposets" }),
-		configs: [{
-			tag: ReposetsConfigFile,
-			schema: ConfigSchema,
-			codec: TomlCodec,
-			strategy: FirstMatch,
-			resolvers: configResolvers,
-			validate: validateConfigRefs
-		}, {
-			tag: ReposetsCredentialsFile,
-			schema: CredentialsSchema,
-			codec: TomlCodec,
-			strategy: FirstMatch,
-			resolvers: [UpwardWalk({ filename: CREDENTIALS_FILENAME }), XdgConfigResolver({ filename: CREDENTIALS_FILENAME })],
-			defaultPath: XdgSavePath(CREDENTIALS_FILENAME)
-		}]
-	});
-}
+};
+/**
+* Builds the resolver tiers that must win over `AppConfig`'s own XDG chain.
+*
+* @remarks
+* `AppConfig.layer` prepends these, in order, ahead of `XdgConfig.resolver` and
+* the native-directory probe, so only the higher-priority tiers appear here.
+*/
+const resolversFor = (configFlag) => Effect.gen(function* () {
+	if (configFlag === void 0) return [ConfigResolver.upwardWalk({ filename: CONFIG_FILENAME })];
+	const info = yield* (yield* FileSystem.FileSystem).stat(configFlag).pipe(Effect.option);
+	if (info._tag === "None") return yield* new ConfigFlagNotFound({ path: configFlag });
+	return info.value.type === "Directory" ? [ConfigResolver.staticDir({
+		dir: configFlag,
+		filename: CONFIG_FILENAME
+	})] : [ConfigResolver.explicitPath(configFlag)];
+});
 /**
-* Default ConfigFiles layer with no --config flag override.
-* Used by CLI entrypoint when no flag is provided.
+* Builds the config-file layer for one invocation's `--config` flag.
+*
+* @remarks
+* Mints a fresh layer per call, so bind the result once per run rather than
+* inlining it at two provide sites.
+*
+* @public
 */
-const ConfigFilesLive = makeConfigFilesLive(Option.none());
+const makeConfigFilesLive = (configFlag) => Layer.unwrap(Effect.map(resolversFor(configFlag), (resolvers) => AppConfig.layer(ReposetsConfigFile, {
+	filename: CONFIG_FILENAME,
+	schema: ConfigSchema,
+	codec: TomlCodec,
+	resolvers,
+	parseOptions: STRICT_KEYS
+})));
 
 //#endregion
-export { CONFIG_FILENAME, CREDENTIALS_FILENAME, ConfigFilesLive, ReposetsConfigFile, ReposetsCredentialsFile, makeConfigFilesLive, validateConfigRefs };
+export { CONFIG_FILENAME, CREDENTIALS_FILENAME, ConfigFlagNotFound, CredentialsFilesLive, ReposetsConfigFile, ReposetsCredentialsFile, makeConfigFilesLive };

package/services/CredentialResolver.js

@@ -1,40 +1,104 @@
-import { ResolveError } from "../errors.js";
 import { OnePasswordClient } from "./OnePasswordClient.js";
-import { Context, Effect, Layer } from "effect";
+import { Context, Data, Effect, Layer, Redacted } from "effect";
+import { env } from "node:process";
 import { readFileSync } from "node:fs";
 import { isAbsolute, resolve } from "node:path";
 
 //#region src/services/CredentialResolver.ts
-var CredentialResolver = class extends Context.Tag("CredentialResolver")() {};
-const CredentialResolverLive = Layer.effect(CredentialResolver, Effect.gen(function* () {
-	const opClient = yield* OnePasswordClient;
-	return { resolveAll(profile, basePath) {
-		return Effect.gen(function* () {
-			const result = /* @__PURE__ */ new Map();
-			const resolveSection = profile.resolve;
-			if (!resolveSection) return result;
-			if (resolveSection.value) for (const [label, val] of Object.entries(resolveSection.value)) if (typeof val === "string") result.set(label, val);
-			else result.set(label, JSON.stringify(val));
-			if (resolveSection.file) for (const [label, filePath] of Object.entries(resolveSection.file)) {
-				const fullPath = isAbsolute(filePath) ? filePath : resolve(basePath, filePath);
-				const content = yield* Effect.try({
-					try: () => readFileSync(fullPath, "utf-8").trim(),
-					catch: (error) => new ResolveError({ message: `Failed to read file for label '${label}': ${error instanceof Error ? error.message : String(error)}` })
-				});
-				result.set(label, content);
-			}
-			if (resolveSection.op) {
-				const opToken = profile.op_service_account_token;
-				if (!opToken) return yield* Effect.fail(new ResolveError({ message: "No 1Password service account token provided but resolve.op entries are defined" }));
-				for (const [label, reference] of Object.entries(resolveSection.op)) {
-					const value = yield* opClient.resolve(reference, opToken).pipe(Effect.mapError((err) => new ResolveError({ message: `Failed to resolve label '${label}': ${err.message}` })));
-					result.set(label, value);
-				}
-			}
-			return result;
-		});
-	} };
-}));
+/**
+* A credential could not be resolved.
+*
+* @remarks
+* Every field is an **address**, never a value: the label a config refers to,
+* the kind of source it named, and why that source did not yield anything. A
+* file's contents, an environment variable's value and a 1Password item's value
+* are all deliberately absent — this error is the most likely thing to be
+* printed when credential handling goes wrong, which makes it the most likely
+* place to leak.
+*
+* @public
+*/
+var ResolveError = class extends Data.TaggedError("ResolveError") {
+	get message() {
+		return `Failed to resolve '${this.label}' from ${this.source}: ${this.reason}`;
+	}
+};
+/** Read an environment variable, failing in terms of its name. */
+const fromEnv = (label, variable) => Effect.suspend(() => {
+	const value = env[variable];
+	return value === void 0 ? Effect.fail(new ResolveError({
+		label,
+		source: "env",
+		reason: `environment variable ${variable} is not set`
+	})) : Effect.succeed(Redacted.make(value, { label }));
+});
+/** Read a file, failing in terms of its path. */
+const fromFile = (label, filePath, basePath) => Effect.try({
+	try: () => {
+		const fullPath = isAbsolute(filePath) ? filePath : resolve(basePath, filePath);
+		return Redacted.make(readFileSync(fullPath, "utf-8").trim(), { label });
+	},
+	catch: (error) => new ResolveError({
+		label,
+		source: "file",
+		reason: error instanceof Error ? error.message : String(error)
+	})
+});
+/**
+* Turns the references in a credential profile into usable values.
+*
+* @remarks
+* Everything this service returns is {@link Redacted.Redacted}. A redacted value
+* renders as `<redacted>` through `toString`, template interpolation and
+* `JSON.stringify`, so the common ways a secret escapes — a log line, an error
+* message, a serialised object — are closed structurally rather than by
+* discipline. Reading the plaintext takes `Redacted.value`, which greps.
+*
+* All four `resolve` sub-groups are read: `op`, `env`, `file` and `value`.
+*
+* This docstring used to say the opposite — that `value` had been dropped from
+* the section — and the implementation matched the docstring rather than the
+* schema. That decision *was* made and then reversed: `value` holds named values
+* generally, and its common use is non-secret structured data, so the rule that
+* survived is narrower than "no inline anything". A *credential* is never
+* inlined, and that is enforced on `github_token`.
+*
+* The cost of the disagreement: every inline label resolved to nothing, and its
+* consumers reported that the label "is not defined in the active profile's
+* `[resolve]` section" — about a label that was declared and simply never read.
+* A schema and a docstring disagreed, and the code followed the docstring.
+*
+* @public
+*/
+var CredentialResolver = class extends Context.Service()("reposets/CredentialResolver", { make: Effect.gen(function* () {
+	const onePassword = yield* OnePasswordClient;
+	/** One `op://` reference, with 1Password's failure restated in this service's terms. */
+	const fromOnePassword = (label, reference) => onePassword.resolve(reference).pipe(Effect.mapError((error) => new ResolveError({
+		label,
+		source: "op",
+		reason: error.message
+	})));
+	const fromSource = (label, source) => "op" in source ? fromOnePassword(label, source.op) : fromEnv(label, source.env);
+	return {
+		resolveGitHubToken: (profile) => fromSource("github_token", profile.github_token),
+		resolveAll: (profile, basePath) => Effect.gen(function* () {
+			const resolved = /* @__PURE__ */ new Map();
+			const section = profile.resolve;
+			if (section === void 0) return resolved;
+			for (const [label, reference] of Object.entries(section.op ?? {})) resolved.set(label, yield* fromOnePassword(label, reference));
+			for (const [label, variable] of Object.entries(section.env ?? {})) resolved.set(label, yield* fromEnv(label, variable));
+			for (const [label, filePath] of Object.entries(section.file ?? {})) resolved.set(label, yield* fromFile(label, filePath, basePath));
+			for (const [label, value] of Object.entries(section.value ?? {})) resolved.set(label, Redacted.make(typeof value === "string" ? value : JSON.stringify(value), { label }));
+			return resolved;
+		})
+	};
+}) }) {};
+/**
+* Live resolver, over the ambient {@link OnePasswordClient}.
+*
+* @public
+*/
+const CredentialResolverLive = Layer.effect(CredentialResolver, CredentialResolver.make);
 
 //#endregion
-export { CredentialResolver, CredentialResolverLive };
+export { CredentialResolver, CredentialResolverLive, ResolveError };

package/services/OnePasswordClient.js

@@ -1,30 +1,102 @@
-import { OnePasswordError } from "../errors.js";
-import { Context, Effect, Layer } from "effect";
+import { Context, Data, Effect, Layer, Redacted } from "effect";
+import { env } from "node:process";
 
 //#region src/services/OnePasswordClient.ts
-var OnePasswordClient = class extends Context.Tag("OnePasswordClient")() {};
-/* v8 ignore start -- live 1Password SDK calls, tested via OnePasswordClientTest */
-const OnePasswordClientLive = Layer.succeed(OnePasswordClient, { resolve(reference, serviceAccountToken) {
-	return Effect.tryPromise({
+/**
+* The environment variable the 1Password SDK is authenticated from.
+*
+* @public
+*/
+const OP_SERVICE_ACCOUNT_TOKEN = "OP_SERVICE_ACCOUNT_TOKEN";
+/**
+* A 1Password reference could not be resolved.
+*
+* @remarks
+* Carries the `op://` **reference** — an address, safe to print — and never the
+* value it points at. `reason` holds the SDK's own diagnostic, which describes
+* why a lookup failed rather than what it would have returned.
+*
+* @public
+*/
+var OnePasswordError = class extends Data.TaggedError("OnePasswordError") {
+	get message() {
+		return `Failed to resolve ${this.reference}: ${this.reason}`;
+	}
+};
+/** Read the service account token, failing in terms of the reference that needed it. */
+const serviceAccountToken = (reference) => Effect.suspend(() => {
+	const token = env[OP_SERVICE_ACCOUNT_TOKEN];
+	return token === void 0 || token === "" ? Effect.fail(new OnePasswordError({
+		reference,
+		reason: `${OP_SERVICE_ACCOUNT_TOKEN} is not set in the environment`
+	})) : Effect.succeed(token);
+});
+/**
+* Resolves `op://` references through the 1Password SDK.
+*
+* @remarks
+* Resolved values come back as {@link Redacted.Redacted}. That is the point of
+* this service's return type rather than a convention: a redacted value renders
+* as `<redacted>` through `toString`, template interpolation and
+* `JSON.stringify`, so a secret cannot reach a log line or an error message by
+* being accidentally formatted. Reading it requires `Redacted.value`, which is
+* greppable.
+*
+* The service account token is read from the environment at call time, not
+* taken as a parameter and not read from the credentials file. It authenticates
+* the SDK that resolves everything else, so keeping it beside the references it
+* unlocks would put the one credential that opens all the others in the file
+* those others merely point out of. Reading it lazily also means a config with
+* no `op` entries never needs it.
+*
+* @public
+*/
+var OnePasswordClient = class OnePasswordClient extends Context.Service()("reposets/OnePasswordClient", { make: Effect.succeed({ resolve: (reference) => Effect.gen(function* () {
+	const token = yield* serviceAccountToken(reference);
+	const value = yield* Effect.tryPromise({
 		try: async () => {
 			const { createClient } = await import("@1password/sdk");
 			return await (await createClient({
-				auth: serviceAccountToken,
+				auth: token,
 				integrationName: "reposets",
 				integrationVersion: "1.0.0"
 			})).secrets.resolve(reference);
 		},
-		catch: (error) => new OnePasswordError({ message: `Failed to resolve ${reference}: ${error instanceof Error ? error.message : String(error)}` })
+		catch: (error) => new OnePasswordError({
+			reference,
+			reason: error instanceof Error ? error.message : String(error)
+		})
 	});
-} });
-/* v8 ignore stop */
-function OnePasswordClientTest(stubs) {
-	return Layer.succeed(OnePasswordClient, { resolve(reference, _serviceAccountToken) {
+	return Redacted.make(value, { label: reference });
+}) }) }) {
+	/**
+	* A double over a fixed reference → value table.
+	*
+	* @remarks
+	* An unknown reference fails exactly as a missing 1Password item does, so a
+	* test can exercise the not-found path without a vault.
+	*/
+	static layerTest = (stubs) => Layer.succeed(OnePasswordClient, { resolve: (reference) => {
 		const value = stubs[reference];
-		if (value === void 0) return Effect.fail(new OnePasswordError({ message: `Test stub: unknown reference ${reference}` }));
-		return Effect.succeed(value);
+		return value === void 0 ? Effect.fail(new OnePasswordError({
+			reference,
+			reason: "no item found at that reference"
+		})) : Effect.succeed(Redacted.make(value, { label: reference }));
 	} });
-}
+};
+/**
+* Live 1Password client.
+*
+* @remarks
+* **Builds one SDK client per reference resolved**, which means one
+* authentication handshake per secret rather than one per run. That is v3's
+* behaviour, ported unchanged rather than quietly improved; a profile with
+* twenty `op` entries pays for it twenty times. Memoising the client is the
+* obvious fix and a deliberate follow-up, not an oversight.
+*
+* @public
+*/
+const OnePasswordClientLive = Layer.effect(OnePasswordClient, OnePasswordClient.make);
 
 //#endregion
-export { OnePasswordClient, OnePasswordClientLive, OnePasswordClientTest };
+export { OP_SERVICE_ACCOUNT_TOKEN, OnePasswordClient, OnePasswordClientLive, OnePasswordError };