reposets 4.0.0 → 4.0.2

package/bin/reposets.js

@@ -1,21 +1,21 @@
 #!/usr/bin/env node
-import { Invocation } from "../services/Invocation.js";
 import { CredentialsFilesLive } from "../services/ConfigFiles.js";
+import { Invocation } from "../services/Invocation.js";
 import { CACHE_OPTIONS, STORE_OPTIONS } from "../store/files.js";
 import { SyncJournalLive } from "../store/SyncJournal.js";
 import { credentialsCommand } from "../cli/commands/credentials.js";
 import { doctorCommand } from "../cli/commands/doctor.js";
-import { syncCommand } from "../cli/commands/sync.js";
 import { driftCommand } from "../cli/commands/drift.js";
 import { historyCommand } from "../cli/commands/history.js";
 import { initCommand } from "../cli/commands/init.js";
 import { listCommand } from "../cli/commands/list.js";
 import { nukeCommand } from "../cli/commands/nuke.js";
+import { syncCommand } from "../cli/commands/sync.js";
 import { validateCommand } from "../cli/commands/validate.js";
 import { ConfigFlag, ConfigLive } from "../cli/flags.js";
 import { Effect, Layer, Predicate } from "effect";
 import { App, AppCache, AppStore } from "@effected/app";
-import { NodeRuntime, NodeServices } from "@effect/platform-node";
+import { NodeCrypto, NodeRuntime, NodeServices } from "@effect/platform-node";
 import { CliAudience, CliRuntime, ConfigIssueRenderer, Fmt } from "@effected/cli";
 import { Command } from "effect/cli";
 
@@ -31,7 +31,7 @@ import { Command } from "effect/cli";
 * `0.0.0 (dev build)` from every build until the version was threaded down
 * from here through {@link Invocation}.
 */
-const VERSION = "4.0.0";
+const VERSION = "4.0.2";
 /**
 * The application's directories: XDG resolution and the `reposets` namespace
 * under it.
@@ -121,8 +121,9 @@ const cli = Command.make("reposets", {}, () => Effect.void).pipe(Command.withDes
 	credentialsCommand
 ]), Command.provide(ConfigLive), Command.provide(CredentialsFilesLive), Command.withGlobalFlags([ConfigFlag]), Command.withSharedFlags(CliAudience.flags()));
 /**
-* The platform: Node's services, the application's directories over them, and
-* the invocation facts.
+* The platform: Node's services, `SecureRandom` (which `NodeServices` no longer
+* carries; the journal mints run ids with it), the application's directories
+* over them, and the invocation facts.
 *
 * @remarks
 * `provideMerge` rather than `provide`, because commands require the platform
@@ -133,7 +134,7 @@ const cli = Command.make("reposets", {}, () => Effect.void).pipe(Command.withDes
 * colour-aware help formatter itself, closer to the program, and one set here
 * would be shadowed.
 */
-const PlatformLive = Layer.mergeAll(DirsLive, InvocationLive).pipe(Layer.provideMerge(NodeServices.layer));
+const PlatformLive = Layer.mergeAll(DirsLive, InvocationLive).pipe(Layer.provideMerge(Layer.mergeAll(NodeServices.layer, NodeCrypto.layerSecureRandom)));
 /**
 * Render a failure that escaped a command, one line at a time, to stderr.
 *

package/cli/commands/credentials.js

@@ -96,24 +96,6 @@ const SECRET_IN_NAME = "That looks like a token, not a name. It was not stored."
 /** What `--env` names, and what the prompt accepts for it: a shell variable identifier. */
 const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
 /**
-* Write credentials back to the file they were read from.
-*
-* @remarks
-* `ConfigFileShape.save` resolves its own default path — the XDG one — rather
-* than the path `discover` found. With a project-local
-* `reposets.credentials.toml` present, that splits reads from writes: `create`
-* lands in XDG while `list` keeps reading the local file, so a profile is
-* created that the user cannot see and that sync will not use. Writing back to
-* the discovered source keeps one file authoritative, and falls back to `save`
-* only when there is genuinely nothing to update.
-*/
-const saveWhereRead = (file, value) => Effect.gen(function* () {
-	const existing = (yield* file.discover.pipe(Effect.orElseSucceed(() => [])))[0];
-	if (existing === void 0) return yield* file.save(value);
-	yield* file.write(value, existing.path);
-	return existing.path;
-});
-/**
 * Refuse an invocation the user got wrong.
 *
 * @remarks
@@ -284,7 +266,7 @@ const createHandler = (input) => Effect.gen(function* () {
 		...actsAs,
 		github_token
 	};
-	const path = yield* saveWhereRead(credentialsFile, { profiles: {
+	const path = yield* credentialsFile.save({ profiles: {
 		...existing.profiles,
 		[profile]: record
 	} });
@@ -378,7 +360,7 @@ const deleteHandler = (profile) => Effect.gen(function* () {
 	}), "Provide --profile <name>: the profile to delete."));
 	if (credentials.profiles[name] === void 0) return yield* refuse(`Profile '${name}' not found.`);
 	const { [name]: _removed, ...remaining } = credentials.profiles;
-	const path = yield* saveWhereRead(credentialsFile, { profiles: remaining });
+	const path = yield* credentialsFile.save({ profiles: remaining });
 	yield* CliMessage.success(`Deleted profile '${name}' from ${path}.`);
 });
 const deleteCommand = Command.make("delete", { profile: profileFlag }, ({ profile }) => deleteHandler(Option.getOrUndefined(profile))).pipe(Command.withDescription("Remove a credential profile"));

package/cli/commands/doctor.js

@@ -1,10 +1,10 @@
 import { SettingsGroupSchema } from "../../schemas/config.js";
 import { profileOwner } from "../../schemas/credentials.js";
-import { Invocation } from "../../services/Invocation.js";
 import { CREDENTIALS_FILENAME, ReposetsConfigFile, ReposetsCredentialsFile } from "../../services/ConfigFiles.js";
-import { STORE_OPTIONS } from "../../store/files.js";
-import { OP_SERVICE_ACCOUNT_TOKEN, OnePasswordClientLive } from "../../services/OnePasswordClient.js";
 import { CredentialResolver, CredentialResolverLive } from "../../services/CredentialResolver.js";
+import { Invocation } from "../../services/Invocation.js";
+import { OP_SERVICE_ACCOUNT_TOKEN, OnePasswordClientLive } from "../../services/OnePasswordClient.js";
+import { STORE_OPTIONS } from "../../store/files.js";
 import { Config, Console, Effect, FileSystem, Layer, Option, Path, Predicate, Result } from "effect";
 import { AppStore } from "@effected/app";
 import { CliMessage, Doc, Fmt, SchemaIssueRenderer, Status } from "@effected/cli";
@@ -157,31 +157,15 @@ const REQUIRED_PERMISSIONS = [
 		"resolve team slugs (org-owned repos only)"
 	]
 ];
-const levenshtein = (a, b) => {
-	const matrix = [];
-	for (let i = 0; i <= a.length; i++) matrix[i] = [i];
-	for (let j = 0; j <= b.length; j++) matrix[0][j] = j;
-	for (let i = 1; i <= a.length; i++) for (let j = 1; j <= b.length; j++) {
-		const cost = a[i - 1] === b[j - 1] ? 0 : 1;
-		const row = matrix[i];
-		const prev = matrix[i - 1];
-		row[j] = Math.min(prev[j] + 1, row[j - 1] + 1, prev[j - 1] + cost);
-	}
-	return matrix[a.length][b.length];
-};
-/** The nearest known key within edit distance 3, if any. */
-const findClosestMatch = (key, known) => {
-	let best;
-	let bestDist = Number.POSITIVE_INFINITY;
-	for (const candidate of known) {
-		const dist = levenshtein(key, candidate);
-		if (dist < bestDist && dist <= 3) {
-			bestDist = dist;
-			best = candidate;
-		}
-	}
-	return best;
-};
+/**
+* The nearest known key within edit distance 3, if any.
+*
+* @remarks
+* Three edits, the threshold this check had before it moved onto the kit;
+* `Fmt.suggest` defaults to two, `effect/cli`'s threshold. Ties keep the
+* first known key, as before.
+*/
+const findClosestMatch = (key, known) => Fmt.suggest(key, known, { maxDistance: 3 })[0];
 /**
 * The credential resolver `doctor`'s live token check runs through.
 *

package/cli/commands/init.js

@@ -1,6 +1,6 @@
-import { Invocation } from "../../services/Invocation.js";
-import { CONFIG_FILENAME, CREDENTIALS_FILENAME } from "../../services/ConfigFiles.js";
 import { configSchemaHost, credentialsSchemaHost, schemaDirective } from "../../schemas/hosted.js";
+import { CONFIG_FILENAME, CREDENTIALS_FILENAME } from "../../services/ConfigFiles.js";
+import { Invocation } from "../../services/Invocation.js";
 import { Effect, FileSystem, Option, Path } from "effect";
 import { CliExit, CliMessage } from "@effected/cli";
 import { Command, Flag } from "effect/cli";

package/cli/commands/nuke.js

@@ -1,5 +1,5 @@
-import { Invocation } from "../../services/Invocation.js";
 import { CONFIG_FILENAME, CREDENTIALS_FILENAME } from "../../services/ConfigFiles.js";
+import { Invocation } from "../../services/Invocation.js";
 import { CACHE_OPTIONS, STORE_OPTIONS } from "../../store/files.js";
 import { Effect, FileSystem, Path } from "effect";
 import { AppCache, AppStore } from "@effected/app";

package/cli/commands/sync.js

@@ -1,11 +1,11 @@
+import { danglingReferences } from "../../lib/config-refs.js";
 import { ReposetsConfigFile, ReposetsCredentialsFile } from "../../services/ConfigFiles.js";
-import { SyncJournal, SyncJournalLive } from "../../store/SyncJournal.js";
-import { OnePasswordClientLive } from "../../services/OnePasswordClient.js";
 import { CredentialResolver, CredentialResolverLive } from "../../services/CredentialResolver.js";
-import { danglingReferences } from "../../lib/config-refs.js";
+import { OnePasswordClientLive } from "../../services/OnePasswordClient.js";
 import { SyncLogger, SyncLoggerLive } from "../../services/SyncLogger.js";
 import { AppliedStateLive } from "../../store/AppliedState.js";
 import { RepoCacheLive } from "../../store/RepoCache.js";
+import { SyncJournal, SyncJournalLive } from "../../store/SyncJournal.js";
 import { PHASE_NAMES } from "../../sync/phase.js";
 import { allPhases } from "../../sync/phases/index.js";
 import { SyncEngine, SyncEngineLive } from "../../sync/SyncEngine.js";

package/cli/commands/validate.js

@@ -1,7 +1,7 @@
-import { ReposetsConfigFile, ReposetsCredentialsFile } from "../../services/ConfigFiles.js";
 import { danglingReferences } from "../../lib/config-refs.js";
 import { undefinedCredentialLabels } from "../../lib/credential-labels.js";
 import { orgOnlyViolations } from "../../lib/org-only.js";
+import { ReposetsConfigFile, ReposetsCredentialsFile } from "../../services/ConfigFiles.js";
 import { Effect } from "effect";
 import { CliExit, CliMessage, Doc, Status } from "@effected/cli";
 import { Command } from "effect/cli";

package/index.js

@@ -1,5 +1,5 @@
 import { ConfigSchema } from "./schemas/config.js";
-import { Invocation } from "./services/Invocation.js";
 import { CONFIG_FILENAME, ConfigFlagMissingConfig, ConfigFlagNotFound, ReposetsConfigFile, makeConfigFilesLive } from "./services/ConfigFiles.js";
+import { Invocation } from "./services/Invocation.js";
 
 export { CONFIG_FILENAME, ConfigFlagMissingConfig, ConfigFlagNotFound, ConfigSchema, Invocation, ReposetsConfigFile, makeConfigFilesLive };

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "reposets",
-	"version": "4.0.0",
+	"version": "4.0.2",
 	"private": false,
 	"description": "CLI tool to sync GitHub repo settings, secrets and rulesets across personal repositories",
 	"keywords": [
@@ -48,20 +48,22 @@
 	},
 	"dependencies": {
 		"@1password/sdk": "^0.5.0",
-		"@effect/platform-node": "^4.0.6",
-		"@effected/app": "^0.28.0",
-		"@effected/cli": "^0.23.0",
-		"@effected/config-file": "^0.21.0",
-		"@effected/env": "^0.6.0",
-		"@effected/github": "^0.25.1",
-		"@effected/glob": "^0.15.0",
-		"@effected/schemastore": "^0.26.3",
-		"@effected/store": "^0.20.0",
-		"@effected/toml": "^0.16.0",
-		"@effected/walker": "^0.21.0",
-		"@effected/xdg": "^0.16.0",
+		"@effect/platform-node": "~4.1.1",
+		"@effected/app": "^0.30.0",
+		"@effected/cli": "^0.25.0",
+		"@effected/config-file": "^0.23.0",
+		"@effected/env": "^0.9.0",
+		"@effected/github": "^0.27.0",
+		"@effected/glob": "^0.17.0",
+		"@effected/jsonc": "^0.22.0",
+		"@effected/schemastore": "^0.28.0",
+		"@effected/store": "^0.22.0",
+		"@effected/toml": "^0.18.0",
+		"@effected/walker": "^0.24.0",
+		"@effected/xdg": "^0.18.0",
+		"@effected/yaml": "^0.27.0",
 		"blakejs": "^1.2.1",
-		"effect": "^4.0.6",
+		"effect": "~4.1.1",
 		"ink": "^8.0.0",
 		"react": "^19.3.1"
 	},

package/services/ConfigFiles.js

@@ -78,6 +78,13 @@ const STRICT_KEYS = {
 * `upwardWalk` defaults to `process.cwd()` when given no `cwd`, which made
 * config discovery the one reader of `process` below the entrypoint.
 *
+* **Writes go back to the file that was found.** `AppConfig` pins
+* `saveTarget: "default"`, the XDG path, which would split reads from writes
+* when a project-local `reposets.credentials.toml` exists: `credentials create`
+* would land in XDG while `list` and `sync` keep reading the local file.
+* `"source"` writes to the highest-priority file the chain found, and to XDG
+* only when there is none.
+*
 * @public
 */
 const CredentialsFilesLive = Layer.unwrap(Effect.map(Invocation, ({ cwd }) => AppConfig.layer(ReposetsCredentialsFile, {
@@ -88,7 +95,8 @@ const CredentialsFilesLive = Layer.unwrap(Effect.map(Invocation, ({ cwd }) => Ap
 		filename: CREDENTIALS_FILENAME,
 		cwd
 	})],
-	parseOptions: STRICT_KEYS
+	parseOptions: STRICT_KEYS,
+	saveTarget: "source"
 })));
 /**
 * Raised when `--config` names a path that does not exist.

package/store/SyncJournal.js

@@ -1,5 +1,6 @@
-import { Context, Crypto, DateTime, Effect, Layer } from "effect";
+import { Context, DateTime, Effect, Layer } from "effect";
 import { Store } from "@effected/store";
+import { SecureRandom } from "effect/crypto";
 
 // src/store/SyncJournal.ts
 /**
@@ -15,11 +16,11 @@ import { Store } from "@effected/store";
 */
 var SyncJournal = class extends Context.Service()("reposets/SyncJournal", { make: Effect.gen(function* () {
 	const store = yield* Store;
-	const crypto = yield* Crypto.Crypto;
+	const random = yield* SecureRandom.SecureRandom;
 	const sql = store.client;
 	return {
 		startRun: (options) => Effect.gen(function* () {
-			const id = yield* crypto.randomUUIDv7();
+			const id = yield* random.uuidV7();
 			const startedAt = yield* DateTime.now;
 			yield* sql`
 						INSERT INTO sync_run (id, started_at, group_name, dry_run)

package/sync/SyncEngine.js

@@ -1,8 +1,8 @@
 import { profileOwner } from "../schemas/credentials.js";
-import { SyncJournal } from "../store/SyncJournal.js";
 import { CredentialResolver } from "../services/CredentialResolver.js";
 import { SyncLogger } from "../services/SyncLogger.js";
 import { RepoCache } from "../store/RepoCache.js";
+import { SyncJournal } from "../store/SyncJournal.js";
 import { emptyResult, mergeResults, selectPhases } from "./phase.js";
 import { Context, Effect, Layer } from "effect";
 import { GitHubRepository, Repo, RepoRef } from "@effected/github";

package/sync/phases/code-scanning.js

@@ -1,9 +1,9 @@
+import { fingerprint } from "../../lib/fingerprint.js";
 import { SyncLogger } from "../../services/SyncLogger.js";
 import { AppliedState, lookup } from "../../store/AppliedState.js";
 import { RepoCache } from "../../store/RepoCache.js";
-import { read } from "./resource.js";
-import { fingerprint } from "../../lib/fingerprint.js";
 import { decide, isDrift, needsApply } from "../decide.js";
+import { read } from "./resource.js";
 import { Effect, Option } from "effect";
 import { Fmt } from "@effected/cli";
 import { CodeScanning, WorkflowDispatch } from "@effected/github";

package/sync/phases/environments.js

@@ -1,6 +1,6 @@
+import { fingerprint } from "../../lib/fingerprint.js";
 import { SyncLogger } from "../../services/SyncLogger.js";
 import { AppliedState, lookup } from "../../store/AppliedState.js";
-import { fingerprint } from "../../lib/fingerprint.js";
 import { decide, isDrift, needsApply } from "../decide.js";
 import { Effect, Option } from "effect";
 import { Fmt } from "@effected/cli";

package/sync/phases/index.js

@@ -1,4 +1,3 @@
-import { capture, declaredNames, resolveGroups } from "./resource.js";
 import { cleanupPhase } from "./cleanup.js";
 import { codeScanningPhase } from "./code-scanning.js";
 import { environmentsPhase } from "./environments.js";
@@ -7,6 +6,7 @@ import { secretsPhase } from "./secrets.js";
 import { securityPhase } from "./security.js";
 import { settingsPhase } from "./settings.js";
 import { variablesPhase } from "./variables.js";
+import { capture, declaredNames, resolveGroups } from "./resource.js";
 import { Effect } from "effect";
 
 // src/sync/phases/index.ts

package/sync/phases/rulesets.js

@@ -1,10 +1,10 @@
+import { fingerprint } from "../../lib/fingerprint.js";
 import { buildRulesetPayload } from "../../schemas/ruleset.js";
 import { SyncLogger } from "../../services/SyncLogger.js";
 import { AppliedState, lookup } from "../../store/AppliedState.js";
 import { RepoCache } from "../../store/RepoCache.js";
-import { capture, read } from "./resource.js";
-import { fingerprint } from "../../lib/fingerprint.js";
 import { decide, isDrift, needsApply } from "../decide.js";
+import { capture, read } from "./resource.js";
 import { Effect, Option, Redacted } from "effect";
 import { Ruleset } from "@effected/github";
 

package/sync/phases/secrets.js

@@ -1,8 +1,8 @@
+import { fingerprint } from "../../lib/fingerprint.js";
 import { SyncLogger } from "../../services/SyncLogger.js";
 import { AppliedState, lookup } from "../../store/AppliedState.js";
-import { capture, resolveGroups } from "./resource.js";
-import { fingerprint } from "../../lib/fingerprint.js";
 import { decide, isDrift, needsApply } from "../decide.js";
+import { capture, resolveGroups } from "./resource.js";
 import { Effect, FileSystem, Option, Path, Redacted } from "effect";
 import { RepositorySecret } from "@effected/github";
 

package/sync/phases/security.js

@@ -1,6 +1,6 @@
+import { fingerprint } from "../../lib/fingerprint.js";
 import { SyncLogger } from "../../services/SyncLogger.js";
 import { AppliedState, lookup } from "../../store/AppliedState.js";
-import { fingerprint } from "../../lib/fingerprint.js";
 import { decide, isDrift, needsApply } from "../decide.js";
 import { Effect, Option } from "effect";
 import { Fmt } from "@effected/cli";

package/sync/phases/settings.js

@@ -1,9 +1,9 @@
+import { fingerprint } from "../../lib/fingerprint.js";
 import { SyncLogger } from "../../services/SyncLogger.js";
 import { AppliedState, lookup } from "../../store/AppliedState.js";
 import { RepoCache } from "../../store/RepoCache.js";
-import { read } from "./resource.js";
-import { fingerprint } from "../../lib/fingerprint.js";
 import { decide, isDrift, needsApply } from "../decide.js";
+import { read } from "./resource.js";
 import { Effect, Option } from "effect";
 import { GitHubRepository, Ruleset } from "@effected/github";
 
@@ -237,7 +237,7 @@ const settingsPhase = Effect.gen(function* () {
 		};
 		let sent;
 		if (!ctx.dryRun) {
-			const outcome = yield* read(settingsClient.applySettings(desired));
+			const outcome = yield* read(settingsClient.applySettings(desired, { unknownKeys: "send" }));
 			if ("failed" in outcome) return {
 				changes: [],
 				errors: [...errors, {
@@ -245,6 +245,7 @@ const settingsPhase = Effect.gen(function* () {
 					message: outcome.failed
 				}]
 			};
+			for (const key of outcome.value.unverified) yield* logger.syncOperation("apply", "setting", key, "(unconfirmed: GitHub does not describe this field)");
 			sent = [...outcome.value.rest, ...outcome.value.graphql];
 			yield* applied.record({
 				repo: ctx.slug,

package/sync/phases/variables.js

@@ -1,8 +1,8 @@
+import { fingerprint } from "../../lib/fingerprint.js";
 import { SyncLogger } from "../../services/SyncLogger.js";
 import { AppliedState, lookup } from "../../store/AppliedState.js";
-import { capture, resolveGroups } from "./resource.js";
-import { fingerprint } from "../../lib/fingerprint.js";
 import { decide, isDrift, needsApply } from "../decide.js";
+import { capture, resolveGroups } from "./resource.js";
 import { Effect, FileSystem, Option, Path, Redacted } from "effect";
 import { RepositoryVariable } from "@effected/github";
 

package/tsdoc-metadata.json

@@ -5,7 +5,7 @@
   "toolPackages": [
     {
       "packageName": "@microsoft/api-extractor",
-      "packageVersion": "7.59.4"
+      "packageVersion": "7.60.0"
     }
   ]
 }