Rebuild as a hexagonal Bitwarden vault-management toolkit

.config/dotnet-tools.json

@@ -0,0 +1,20 @@
+{
+  "version": 1,
+  "isRoot": true,
+  "tools": {
+    "husky": {
+      "version": "0.9.1",
+      "commands": [
+        "husky"
+      ],
+      "rollForward": false
+    },
+    "fallout.globaltool": {
+      "version": "10.4.0",
+      "commands": [
+        "fallout"
+      ],
+      "rollForward": true
+    }
+  }
+}

.fallout/.gitignore

@@ -0,0 +1 @@
+/temp

.fallout/build.schema.json

@@ -0,0 +1,113 @@
+{
+  "$schema": "http://json-schema.org/draft-04/schema#",
+  "definitions": {
+    "Host": {
+      "type": "string",
+      "enum": [
+        "AppVeyor",
+        "AzurePipelines",
+        "Bamboo",
+        "Bitbucket",
+        "Bitrise",
+        "GitHubActions",
+        "GitLab",
+        "Jenkins",
+        "Rider",
+        "SpaceAutomation",
+        "TeamCity",
+        "Terminal",
+        "TravisCI",
+        "VisualStudio",
+        "VSCode"
+      ]
+    },
+    "ExecutableTarget": {
+      "type": "string",
+      "enum": [
+        "Compile",
+        "Test",
+        "TestLive"
+      ]
+    },
+    "Verbosity": {
+      "type": "string",
+      "description": "",
+      "enum": [
+        "Verbose",
+        "Normal",
+        "Minimal",
+        "Quiet"
+      ]
+    },
+    "FalloutBuild": {
+      "properties": {
+        "Continue": {
+          "type": "boolean",
+          "description": "Indicates to continue a previously failed build attempt"
+        },
+        "Help": {
+          "type": "boolean",
+          "description": "Shows the help text for this build assembly"
+        },
+        "Host": {
+          "description": "Host for execution. Default is 'automatic'",
+          "$ref": "#/definitions/Host"
+        },
+        "NoLogo": {
+          "type": "boolean",
+          "description": "Disables displaying the NUKE logo"
+        },
+        "Partition": {
+          "type": "string",
+          "description": "Partition to use on CI"
+        },
+        "Plan": {
+          "type": "boolean",
+          "description": "Shows the execution plan (HTML)"
+        },
+        "Profile": {
+          "type": "array",
+          "description": "Defines the profiles to load",
+          "items": {
+            "type": "string"
+          }
+        },
+        "Root": {
+          "type": "string",
+          "description": "Root directory during build execution"
+        },
+        "Skip": {
+          "type": "array",
+          "description": "List of targets to be skipped. Empty list skips all dependencies",
+          "items": {
+            "$ref": "#/definitions/ExecutableTarget"
+          }
+        },
+        "Target": {
+          "type": "array",
+          "description": "List of targets to be invoked. Default is '{default_target}'",
+          "items": {
+            "$ref": "#/definitions/ExecutableTarget"
+          }
+        },
+        "Verbosity": {
+          "description": "Logging verbosity during build execution. Default is 'Normal'",
+          "$ref": "#/definitions/Verbosity"
+        },
+        "BuildProjectFile": {
+          "type": [
+            "null",
+            "string"
+          ],
+          "description": "Path to the build project (.csproj) relative to the repository root. Defaults to 'build/_build.csproj' when unset. Read by the Fallout global tool's in-tool runner."
+        }
+      }
+    }
+  },
+  "allOf": [
+    {},
+    {
+      "$ref": "#/definitions/FalloutBuild"
+    }
+  ]
+}

.fallout/parameters.json

@@ -0,0 +1,3 @@
+{
+  "Solution": "BitwardenSharp.slnx"
+}

.github/workflows/build.yml

@@ -0,0 +1,54 @@
+# ------------------------------------------------------------------------------
+# <auto-generated>
+#
+#     This code was generated.
+#
+#     - To turn off auto-generation set:
+#
+#         [GitHubActions (AutoGenerate = false)]
+#
+#     - To trigger manual generation invoke:
+#
+#         fallout --generate-configuration GitHubActions_build --host GitHubActions
+#
+# </auto-generated>
+# ------------------------------------------------------------------------------
+
+name: build
+
+on:
+  push:
+    branches:
+      - develop
+      - main
+  pull_request:
+    branches:
+      - develop
+      - main
+      - 'release/*'
+      - 'hotfix/*'
+      - 'support/*'
+
+jobs:
+  ubuntu-latest:
+    name: ubuntu-latest
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - name: 'Cache: .fallout/temp, ~/.nuget/packages'
+        uses: actions/cache@v6
+        with:
+          path: |
+            .fallout/temp
+            ~/.nuget/packages
+          key: ${{ runner.os }}-${{ hashFiles('**/global.json', '**/*.csproj', '**/Directory.Packages.props') }}
+      - name: 'Setup: .NET SDK'
+        uses: actions/setup-dotnet@v6
+        with:
+          global-json-file: global.json
+      - name: 'Restore: dotnet tools'
+        run: dotnet tool restore
+      - name: 'Run: Test'
+        run: dotnet fallout Test

.github/workflows/publish.yml

@@ -0,0 +1,48 @@
+# ------------------------------------------------------------------------------
+# <auto-generated>
+#
+#     This code was generated.
+#
+#     - To turn off auto-generation set:
+#
+#         [GitHubActions (AutoGenerate = false)]
+#
+#     - To trigger manual generation invoke:
+#
+#         fallout --generate-configuration GitHubActions_publish --host GitHubActions
+#
+# </auto-generated>
+# ------------------------------------------------------------------------------
+
+name: publish
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+jobs:
+  ubuntu-latest:
+    name: ubuntu-latest
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - name: 'Cache: .fallout/temp, ~/.nuget/packages'
+        uses: actions/cache@v6
+        with:
+          path: |
+            .fallout/temp
+            ~/.nuget/packages
+          key: ${{ runner.os }}-${{ hashFiles('**/global.json', '**/*.csproj', '**/Directory.Packages.props') }}
+      - name: 'Setup: .NET SDK'
+        uses: actions/setup-dotnet@v6
+        with:
+          global-json-file: global.json
+      - name: 'Restore: dotnet tools'
+        run: dotnet tool restore
+      - name: 'Run: Test'
+        run: dotnet fallout Test
+        env:
+          NuGetApiKey: ${{ secrets.NUGET_API_KEY }}

.gitignore

@@ -416,3 +416,22 @@ FodyWeavers.xsd
 *.msix
 *.msm
 *.msp
+
+# ── Vault data — never commit ────────────────────────────────────────────────
+# A `bw list items` dump is the entire vault in PLAINTEXT: every password, TOTP
+# seed and note. One careless `git add -A` publishes the lot, and git history
+# keeps it even after a later delete. The pre-commit hook in .husky/ is the
+# active guard; these patterns are the passive one.
+items.json
+folders.json
+*vault-dump*.json
+*vault-export*.json
+bw-export*.json
+*.bitwarden.json
+REVIEW.md
+report.json
+merge-log.json
+
+# Session key / master password must never reach disk in this repo
+.bw-session
+secrets.env

.husky/pre-commit

@@ -0,0 +1,10 @@
+#!/usr/bin/env sh
+# Husky.NET-managed pre-commit guard. Sourcing husky.sh is optional (honors HUSKY=0
+# and re-execs under `sh -e`); the guard also runs standalone on a fresh clone
+# before `dotnet husky install` has regenerated _/.
+husky_sh="$(dirname -- "$0")/_/husky.sh"
+[ -f "$husky_sh" ] && . "$husky_sh"
+
+# GitHub's secret scanning and push protection are free for public repos only, and
+# this is a private repo on a free-tier org. This is the substitute.
+sh "$(dirname -- "$0")/scan-secrets.sh"