feat(cycle): org-settings reconcile cycle (#5) (#22)

Reconciles org-level settings via GET/PATCH /orgs/{org}: default repo
permission, member repo-creation privileges, public metadata, and the
surfaced 2FA flag. PATCH is partial, so selective-by-omission holds by
sending only declared fields (no full-replacement RMW needed).

Registered in the cycle registry and exported from index. Action bundle
rebuilt.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: lex00

action/index.mjs

@@ -229338,9 +229338,95 @@ async function fetchLiveForOrg(client, orgLogin, repos, budget) {
   return { repos: liveRepos };
 }
 
+// src/cycles/org-settings.ts
+var VALID_DEFAULT_PERMISSIONS = /* @__PURE__ */ new Set(["none", "read", "write", "admin"]);
+function mapOrgToLive(raw) {
+  const live = {};
+  if (raw.description != null) live.description = raw.description;
+  if (raw.email != null) live.email = raw.email;
+  if (raw.blog != null) live.websiteUrl = raw.blog;
+  if (raw.default_repository_permission != null && VALID_DEFAULT_PERMISSIONS.has(raw.default_repository_permission)) {
+    live.defaultRepositoryPermission = raw.default_repository_permission;
+  }
+  if (typeof raw.members_can_create_public_repositories === "boolean") {
+    live.membersCanCreatePublicRepositories = raw.members_can_create_public_repositories;
+  }
+  if (typeof raw.members_can_create_private_repositories === "boolean") {
+    live.membersCanCreatePrivateRepositories = raw.members_can_create_private_repositories;
+  }
+  if (typeof raw.members_can_create_internal_repositories === "boolean") {
+    live.membersCanCreateInternalRepositories = raw.members_can_create_internal_repositories;
+  }
+  if (typeof raw.two_factor_requirement_enabled === "boolean") {
+    live.requireTwoFactorAuthentication = raw.two_factor_requirement_enabled;
+  }
+  return live;
+}
+function buildOrgPatchBody(desired) {
+  const body = {};
+  if (desired.description !== void 0) body.description = desired.description;
+  if (desired.email !== void 0) body.email = desired.email;
+  if (desired.websiteUrl !== void 0) body.blog = desired.websiteUrl;
+  if (desired.defaultRepositoryPermission !== void 0) {
+    body.default_repository_permission = desired.defaultRepositoryPermission;
+  }
+  if (desired.membersCanCreatePublicRepositories !== void 0) {
+    body.members_can_create_public_repositories = desired.membersCanCreatePublicRepositories;
+  }
+  if (desired.membersCanCreatePrivateRepositories !== void 0) {
+    body.members_can_create_private_repositories = desired.membersCanCreatePrivateRepositories;
+  }
+  if (desired.membersCanCreateInternalRepositories !== void 0) {
+    body.members_can_create_internal_repositories = desired.membersCanCreateInternalRepositories;
+  }
+  if (desired.requireTwoFactorAuthentication !== void 0) {
+    body.two_factor_requirement_enabled = desired.requireTwoFactorAuthentication;
+  }
+  return body;
+}
+var orgSettingsCycle = {
+  name: "org-settings",
+  // ── Part 2: fetchLive ──────────────────────────────────────────────────────
+  async fetchLive(client, orgLogin, _scope, budget) {
+    if (budget.exhausted) {
+      const { BudgetExhaustedError: BudgetExhaustedError2 } = await Promise.resolve().then(() => (init_runner(), runner_exports));
+      throw new BudgetExhaustedError2();
+    }
+    budget.use(1);
+    let raw;
+    try {
+      raw = await client.request("GET", `/orgs/${orgLogin}`);
+    } catch (err) {
+      if (err instanceof Error && err.message.includes("404")) {
+        return {};
+      }
+      throw err;
+    }
+    return { settings: mapOrgToLive(raw) };
+  },
+  // ── Part 3: buildDesired ───────────────────────────────────────────────────
+  buildDesired(orgConfig, _orgLogin, _scope) {
+    if (!orgConfig.settings) return {};
+    return { settings: orgConfig.settings };
+  },
+  // ── Part 4: apply ──────────────────────────────────────────────────────────
+  async apply(client, entry, orgLogin, _scope, budget) {
+    if (entry.resourceType !== "org-settings") {
+      return;
+    }
+    if (entry.kind === "delete") return;
+    const desired = entry.after;
+    const body = buildOrgPatchBody(desired);
+    if (Object.keys(body).length === 0) return;
+    budget.use(1);
+    await client.request("PATCH", `/orgs/${orgLogin}`, body);
+  }
+};
+
 // src/cli/registry.ts
 var CYCLE_REGISTRY = {
-  [branchProtectionCycle.name]: branchProtectionCycle
+  [branchProtectionCycle.name]: branchProtectionCycle,
+  [orgSettingsCycle.name]: orgSettingsCycle
 };
 
 // node_modules/@intentius/chant/src/audit/fetch.ts

src/cli/registry.ts

@@ -10,6 +10,7 @@
 
 import type { Cycle } from "../reconcile/runner.js";
 import { branchProtectionCycle } from "../cycles/branch-protection.js";
+import { orgSettingsCycle } from "../cycles/org-settings.js";
 
 /**
  * Registry of all available governance cycles, keyed by the name accepted by
@@ -20,4 +21,5 @@ import { branchProtectionCycle } from "../cycles/branch-protection.js";
  */
 export const CYCLE_REGISTRY: Record<string, Cycle> = {
   [branchProtectionCycle.name]: branchProtectionCycle,
+  [orgSettingsCycle.name]: orgSettingsCycle,
 };