@ngocsangairvds/vsaf 3.2.14 → 3.2.15

package/tools/vds-scripts/audit_orchestrator/src/vds_audit_orchestrator/sync_cmds.py

@@ -1,1247 +0,0 @@
-"""Sync commands for vds-audit CLI (Phase 91 decomposition)."""
-
-# pyright: reportUnusedVariable=false
-
-from __future__ import annotations
-
-import asyncio
-import re
-from dataclasses import replace
-from pathlib import Path
-from typing import Any
-from urllib.parse import urlparse
-
-import click
-import structlog
-import typer
-from click.core import ParameterSource
-from github import Github
-from rich.progress import Progress, SpinnerColumn, TextColumn
-from vds_git_orchestrator.orchestrator import GitOperation
-
-from vds_audit_orchestrator.cli_common import _STATE_DSN_ENV_VAR, _get_cli_ctx, console, sync_app
-from vds_audit_orchestrator.cli_impl import (
-    _DEFAULT_SYNC_WORKSPACE,
-    _build_repo_project_key_indexes,
-    _DebugArtifactsCollector,
-    _emit_json,
-    _emit_sync_decision,
-    _filter_auxiliary_repositories,
-    _load_manifest_payload_from_state,
-    _normalize_storage_key,
-    _normalize_sync_result,
-    _parse_auxiliary_project_selector,
-    _record_state_artifacts,
-    _require_producer_state_dsn,
-    _resolve_repo_sync_local_code_path,
-    _resolve_repo_sync_project_storage_key,
-    _sync_decision_from_status,
-    _validate_required_credentials,
-)
-from vds_audit_orchestrator.clients.bitbucket_cli_client import BitbucketCliClient
-from vds_audit_orchestrator.errors import DataSourceError
-from vds_audit_orchestrator.sources.base import ManifestFilters, RepoInfo, RepoSource
-from vds_audit_orchestrator.sources.bitbucket import BitbucketProjectSource
-from vds_audit_orchestrator.sources.git_url import GitUrlSource
-from vds_audit_orchestrator.sources.github import GitHubOrgSource
-from vds_audit_orchestrator.sources.local import LocalRepoSource
-from vds_audit_orchestrator.state.store import PostgresStateStore
-from vds_audit_orchestrator.sync.repo_sync import RepoSynchronizer
-
-logger = structlog.get_logger(__name__)
-_STORAGE_KEY_LIKE_BITBUCKET_PROJECT_RE = re.compile(r"^\d+(?:-\d+)+-[a-z0-9-]+$")
-
-
-def _dt_now_utc_iso() -> str:
-    return datetime.now(timezone.utc).isoformat()
-
-
-def _is_storage_key_like_bitbucket_project_key(project_key: str) -> bool:
-    return bool(_STORAGE_KEY_LIKE_BITBUCKET_PROJECT_RE.fullmatch(str(project_key or "").strip().lower()))
-
-
-def _is_numeric_page_id(value: str) -> bool:
-    return str(value or "").strip().isdigit()
-
-
-def _resolve_project_links_with_legacy_fallback(
-    *,
-    store: Any,
-    bitbucket_key: str,
-) -> list[dict[str, Any]]:
-    """Resolve junction links while remaining compatible with legacy store doubles.
-
-    Current runtime prefers ``resolve_project_links_from_bitbucket_key()`` so
-    repo-filter-aware multi-project junctions can be honored. Older tests and
-    lightweight store stubs may still expose only
-    ``resolve_project_from_bitbucket_key()``. Support both so the junction guard
-    logic keeps working during the migration.
-    """
-
-    normalized_key = _normalize_storage_key(bitbucket_key)
-
-    resolve_links = getattr(store, "resolve_project_links_from_bitbucket_key", None)
-    if callable(resolve_links):
-        raw_links = resolve_links(normalized_key)
-        if isinstance(raw_links, list):
-            links: list[dict[str, Any]] = []
-            for raw_link in raw_links:
-                if not isinstance(raw_link, dict):
-                    continue
-                project_key = str(raw_link.get("project_key", "") or "").strip()
-                if not project_key:
-                    continue
-                links.append(
-                    {
-                        "project_key": project_key,
-                        "repo_filter": raw_link.get("repo_filter"),
-                    }
-                )
-            if links:
-                return links
-
-    resolve_single = getattr(store, "resolve_project_from_bitbucket_key", None)
-    if callable(resolve_single):
-        resolved_project_key = resolve_single(normalized_key)
-        project_key = str(resolved_project_key or "").strip()
-        if project_key:
-            return [{"project_key": project_key, "repo_filter": None}]
-
-    return []
-
-
-def _parse_ops_repo_url(*, repo_url: str, fallback_project: str) -> tuple[str, str] | None:
-    parsed = urlparse(repo_url)
-    if parsed.scheme not in {"http", "https", "ssh", "git"}:
-        return None
-    segments = [segment for segment in parsed.path.split("/") if segment]
-    project_key = fallback_project
-    repo_name = ""
-    if "projects" in segments and "repos" in segments:
-        try:
-            project_idx = segments.index("projects")
-            repo_idx = segments.index("repos")
-            if project_idx + 1 < len(segments):
-                project_key = segments[project_idx + 1]
-            if repo_idx + 1 < len(segments):
-                repo_name = segments[repo_idx + 1]
-        except ValueError:
-            pass
-    if not repo_name and segments:
-        repo_name = segments[-1]
-    repo_name = repo_name.removesuffix(".git")
-    normalized_repo_name = _normalize_storage_key(repo_name)
-    if not normalized_repo_name:
-        return None
-    project_key_value = str(project_key or "OPS").strip() or "OPS"
-    return project_key_value, normalized_repo_name
-
-
-def _is_branch_option_explicitly_set() -> bool:
-    ctx = click.get_current_context(silent=True)
-    if ctx is None:
-        return False
-    return ctx.get_parameter_source("branch") == ParameterSource.COMMANDLINE
-
-
-def _apply_branch_override(*, repos: list[RepoInfo], branch: str, enabled: bool) -> list[RepoInfo]:
-    if not enabled:
-        return repos
-    normalized_branch = str(branch or "").strip()
-    if not normalized_branch:
-        return repos
-
-    updated: list[RepoInfo] = []
-    for repo in repos:
-        if isinstance(repo, RepoInfo):
-            updated.append(replace(repo, branch=normalized_branch))
-            continue
-        try:
-            repo.branch = normalized_branch  # type: ignore[attr-defined]
-            updated.append(repo)
-            continue
-        except Exception:
-            # Fallback for non-standard RepoInfo-like objects in tests or wrappers.
-            updated.append(
-                RepoInfo(
-                    name=str(getattr(repo, "name", "") or ""),
-                    path=Path(getattr(repo, "path", Path.cwd())),
-                    project=str(getattr(repo, "project", "") or ""),
-                    branch=normalized_branch,
-                    url=getattr(repo, "url", None),
-                    tags=set(getattr(repo, "tags", set()) or set()),
-                    metadata=dict(getattr(repo, "metadata", {}) or {}),
-                )
-            )
-    return updated
-
-
-@sync_app.command(name="repos")
-def sync_repos(
-    repo_path: Path = typer.Option(None, "--local", "-l", help="Path to local repository or local workspace root"),
-    bitbucket_project: str = typer.Option(
-        None, "--bitbucket-project", "-b", help="Bitbucket project key (e.g., 'VDS')"
-    ),
-    github_org: str = typer.Option(None, "--github-org", "-g", help="GitHub organization name"),
-    git_url: str = typer.Option(
-        None, "--git-url", help="Direct Git URL to a repository (e.g., https://github.com/org/repo.git)"
-    ),
-    repo_name_match: str = typer.Option(
-        "*", "--name-match", "-n", help="Glob pattern to match repository names (e.g., 'insurance-*')"
-    ),
-    branch: str = typer.Option("main", "--branch", "-B", help="Default branch to clone/pull"),
-    local_workspace: Path = typer.Option(
-        _DEFAULT_SYNC_WORKSPACE,
-        "--workspace",
-        "-w",
-        help=f"Local directory to clone/sync repositories into (default: {_DEFAULT_SYNC_WORKSPACE})",
-    ),
-    operation: GitOperation = typer.Option(
-        GitOperation.PULL,
-        "--operation",
-        "-o",
-        help="Git operation to perform (for example: pull, fetch, clone, status).",
-        case_sensitive=False,
-    ),
-    concurrency: int = typer.Option(5, "--concurrency", "-c", min=1, help="Number of concurrent git operations"),
-    dry_run: bool = typer.Option(False, "--dry-run", help="Simulate operations without making changes"),
-    overwrite_local_with_remote: bool = typer.Option(
-        False,
-        "--overwrite-local/--no-overwrite-local",
-        help="When operation is pull, force local branch to match origin/<branch> and discard local divergence.",
-    ),
-    debug_artifacts: bool = typer.Option(
-        False,
-        "--debug-artifacts/--no-debug-artifacts",
-        help="Write optional debug artifacts: cache_trace.jsonl, sync_plan.json, state_diff.json.",
-    ),
-    debug_artifacts_dir: Path | None = typer.Option(
-        None,
-        "--debug-artifacts-dir",
-        help="Directory for debug artifacts (defaults to --workspace).",
-    ),
-    state_dsn: str | None = typer.Option(
-        None,
-        "--state-dsn",
-        envvar=_STATE_DSN_ENV_VAR,
-        help=f"Persist repository sync state to backend DSN (required; fallback: {_STATE_DSN_ENV_VAR}).",
-    ),
-    target_project_storage_key: str | None = typer.Option(
-        None,
-        "--project-storage-key",
-        help="Explicit canonical Confluence page_id project key for binding synced repos.",
-    ),
-    auxiliary_project: list[str] | None = typer.Option(
-        None,
-        "--auxiliary-project",
-        help="Additional auxiliary Bitbucket selectors (repeatable), format PROJECT[:repo1,repo2]. "
-        "Repos from 'DOPS' get role='auxiliary_config'; others get role='auxiliary_lib'.",
-    ),
-    include_ops_repo: list[str] | None = typer.Option(
-        None,
-        "--include-ops-repo",
-        help="Additional ops repo URL (repeatable). Synced with repo_type='ops'.",
-    ),
-) -> None:
-    """Synchronize repositories from various sources."""
-    resolved_state_dsn = _require_producer_state_dsn(state_dsn, command="sync repos")
-
-    async def _sync_impl():
-        ctx = _get_cli_ctx()
-        json_only = ctx.json_only
-        forced_project_storage_key = ""
-        if isinstance(target_project_storage_key, str) and target_project_storage_key.strip():
-            forced_project_storage_key = _normalize_storage_key(target_project_storage_key)
-            if not _is_numeric_page_id(forced_project_storage_key):
-                error_msg = (
-                    "Invalid --project-storage-key. Expected canonical numeric Confluence page_id "
-                    f"but got '{target_project_storage_key}'."
-                )
-                if json_only:
-                    _emit_json({"error": error_msg})
-                else:
-                    console.print(f"[red]Error:[/red] {error_msg}")
-                raise typer.Exit(1)
-
-        # Phase 95 (DD-150 hard-cut): If no --project-storage-key is provided,
-        # resolve from junction table only. No bitbucket-key auto-derive fallback.
-        junction_resolved_key = ""
-        # When a BB project is linked to multiple audit projects with repo_filter,
-        # store the full links list for per-repo resolution in the sync loop.
-        _junction_links: list[dict[str, Any]] = []
-        _junction_multi_project = False
-        # repo_filter for the forced project — used to skip repos that don't belong
-        # even when --project-storage-key is explicit (e.g., from prepare).
-        _forced_repo_filter: str = ""
-        if forced_project_storage_key and bitbucket_project and resolved_state_dsn:
-            try:
-                _store = PostgresStateStore(resolved_state_dsn)
-                try:
-                    _all_links = _resolve_project_links_with_legacy_fallback(
-                        store=_store,
-                        bitbucket_key=bitbucket_project,
-                    )
-                    for _link in _all_links:
-                        if str(_link.get("project_key", "")) == forced_project_storage_key:
-                            _forced_repo_filter = str(_link.get("repo_filter") or "")
-                            break
-                    if _forced_repo_filter:
-                        logger.info(
-                            "sync_repos_forced_project_repo_filter_applied",
-                            project_storage_key=forced_project_storage_key,
-                            repo_filter=_forced_repo_filter,
-                        )
-                finally:
-                    _store.close()
-            except Exception:
-                pass
-        if not forced_project_storage_key and bitbucket_project:
-            try:
-                store = PostgresStateStore(resolved_state_dsn)
-                try:
-                    _junction_links = _resolve_project_links_with_legacy_fallback(
-                        store=store,
-                        bitbucket_key=bitbucket_project,
-                    )
-                    if len(_junction_links) == 1:
-                        junction_resolved_key = str(_junction_links[0].get("project_key", ""))
-                    elif len(_junction_links) > 1:
-                        # Multiple projects share this BB key — per-repo resolution needed
-                        _junction_multi_project = True
-                        # Pick first link as default for project-level logging
-                        junction_resolved_key = str(_junction_links[0].get("project_key", ""))
-                        has_filters = any(link.get("repo_filter") for link in _junction_links)
-                        if not has_filters:
-                            logger.warning(
-                                "shared_bitbucket_project_no_repo_filters",
-                                bitbucket_project_key=bitbucket_project,
-                                linked_project_keys=[str(link.get("project_key", "")) for link in _junction_links],
-                                hint="Set repo_filter on junction links to partition repos across projects",
-                            )
-                finally:
-                    store.close()
-            except Exception:
-                junction_resolved_key = ""
-            if junction_resolved_key and not _is_numeric_page_id(junction_resolved_key):
-                logger.error(
-                    "sync_repos_project_resolution_invalid_linked_key",
-                    bitbucket_project_key=bitbucket_project,
-                    resolved_project_key=junction_resolved_key,
-                    reason="non_numeric_page_id",
-                )
-                junction_resolved_key = ""
-            if junction_resolved_key:
-                if not _junction_multi_project:
-                    forced_project_storage_key = junction_resolved_key
-                logger.info(
-                    "sync_repos_project_resolution",
-                    decision="linked_multi_project" if _junction_multi_project else "linked_existing",
-                    bitbucket_project_key=bitbucket_project,
-                    resolved_project_key=junction_resolved_key,
-                    multi_project=_junction_multi_project,
-                    link_count=len(_junction_links),
-                )
-            else:
-                logger.error(
-                    "sync_repos_project_resolution",
-                    decision="missing_link_requires_page_id",
-                    bitbucket_project_key=bitbucket_project,
-                    hint=(
-                        "No junction link found. Provide canonical --project-storage-key "
-                        "<Confluence page_id> or run parse-registry + prepare first."
-                    ),
-                )
-                error_msg = (
-                    f"No project link found for Bitbucket project '{bitbucket_project}'. "
-                    "Provide canonical --project-storage-key <Confluence page_id> "
-                    "or run parse-registry + prepare first."
-                )
-                if json_only:
-                    _emit_json({"error": error_msg})
-                else:
-                    console.print(f"[red]Error:[/red] {error_msg}")
-                raise typer.Exit(1)
-
-        provided_sources: list[str] = []
-        if repo_path is not None:
-            provided_sources.append("local")
-        if bitbucket_project:
-            provided_sources.append("bitbucket-project")
-        if github_org:
-            provided_sources.append("github-org")
-        if git_url:
-            provided_sources.append("git-url")
-
-        if not provided_sources:
-            error_msg = (
-                "At least one source must be specified: --local, --bitbucket-project, --github-org, or --git-url."
-            )
-            if json_only:
-                _emit_json({"error": error_msg})
-            else:
-                console.print(f"[red]Error:[/red] {error_msg}")
-            raise typer.Exit(1)
-
-        selected_source = provided_sources[0]
-        if len(provided_sources) > 1:
-            logger.warning(
-                "sync_repos_multiple_sources_provided",
-                provided_sources=provided_sources,
-                selected_source=selected_source,
-                precedence=["local", "bitbucket-project", "github-org", "git-url"],
-            )
-
-        if bitbucket_project:
-            _validate_required_credentials(command="sync repos", require_bitbucket=True)
-
-        # Initialize RepoSource with deterministic selector precedence.
-        source: RepoSource | None = None
-        if selected_source == "local":
-            assert repo_path is not None
-            source = LocalRepoSource(repo_path)
-        elif selected_source == "bitbucket-project":
-            bitbucket_client = BitbucketCliClient()
-            source = BitbucketProjectSource(bitbucket_client)
-        elif selected_source == "github-org":
-            assert github_org is not None
-            github_client = Github()
-            source = GitHubOrgSource(github_client, github_org)
-        elif selected_source == "git-url":
-            assert git_url is not None
-            source = GitUrlSource()  # GitUrlSource doesn't need external client initially
-
-        if not source:
-            error_msg = "Could not initialize a repository source."
-            if json_only:
-                _emit_json({"error": error_msg})
-            else:
-                console.print(f"[red]Error:[/red] {error_msg}")
-            raise typer.Exit(1)
-
-        filters = ManifestFilters(
-            project=bitbucket_project or github_org,  # Project applies to Bitbucket/GitHub
-            name_match=repo_name_match,
-        )
-
-        try:
-            branch_override_enabled = _is_branch_option_explicitly_set()
-            debug_trace = (
-                _DebugArtifactsCollector((debug_artifacts_dir or local_workspace).resolve())
-                if debug_artifacts
-                else None
-            )
-            try:
-                if not json_only:
-                    with Progress(
-                        SpinnerColumn(),
-                        TextColumn("[progress.description]{task.description}"),
-                        transient=True,
-                    ) as progress:
-                        progress.add_task(f"Discovering repositories from {type(source).__name__}...", total=None)
-                        repos_to_sync = await source.get_repositories(filters)
-                else:
-                    repos_to_sync = await source.get_repositories(filters)
-            except DataSourceError as exc:
-                error_context = exc.context if isinstance(exc.context, dict) else {}
-                project_hint = str(error_context.get("project_key") or bitbucket_project or github_org or "").strip()
-                diagnostic_parts = [
-                    f"Repository discovery failed via {type(source).__name__}",
-                ]
-                if project_hint:
-                    diagnostic_parts.append(f"for project '{project_hint}'")
-                diagnostic_parts.append(":")
-                discovery_error = str(error_context.get("error") or str(exc)).strip()
-                diagnostic_parts.append(discovery_error or str(exc))
-                attempt = error_context.get("attempt")
-                max_attempts = error_context.get("max_attempts")
-                if attempt is not None and max_attempts is not None:
-                    diagnostic_parts.append(f"(attempt {attempt}/{max_attempts})")
-                error_msg = " ".join(part for part in diagnostic_parts if part)
-                logger.exception(
-                    "sync_repos_discovery_failed",
-                    source_type=type(source).__name__,
-                    project_key=project_hint or None,
-                    operation=error_context.get("operation"),
-                    attempt=attempt,
-                    max_attempts=max_attempts,
-                    error=discovery_error or str(exc),
-                )
-                if json_only:
-                    _emit_json(
-                        {
-                            "error": error_msg,
-                            "source_type": type(source).__name__,
-                            "project_key": project_hint or None,
-                            "discovery_error": discovery_error or str(exc),
-                            "attempt": attempt,
-                            "max_attempts": max_attempts,
-                        }
-                    )
-                else:
-                    console.print(f"[red]Error:[/red] {error_msg}")
-                raise typer.Exit(1) from exc
-
-            if not repos_to_sync:
-                msg = "No repositories found matching the criteria."
-                if json_only:
-                    _emit_json({"message": msg, "repositories_synced": []})
-                else:
-                    console.print(f"[yellow]{msg}[/yellow]")
-                return
-
-            repos_to_sync = _apply_branch_override(
-                repos=repos_to_sync,
-                branch=branch,
-                enabled=branch_override_enabled,
-            )
-
-            if debug_trace is not None:
-                for repo in sorted(repos_to_sync, key=lambda item: str(getattr(item, "name", ""))):
-                    debug_trace.add_sync_plan(
-                        project_storage_key=None,
-                        resource_type="repository",
-                        resource_id=str(getattr(repo, "name", "")) or None,
-                        decision="sync",
-                        reason="selected_by_filters",
-                    )
-
-            synchronizer = RepoSynchronizer(workspace_path=local_workspace)
-
-            if not json_only:
-                with Progress(
-                    SpinnerColumn(),
-                    TextColumn("[progress.description]{task.description}"),
-                    transient=True,
-                ) as progress:
-                    progress.add_task(f"Synchronizing {len(repos_to_sync)} repositories...", total=None)
-                    summary = await synchronizer.synchronize_repos(
-                        repos_to_sync=repos_to_sync,
-                        operation=operation,
-                        concurrency=concurrency,
-                        dry_run=dry_run,
-                        overwrite_local_with_remote=overwrite_local_with_remote,
-                    )
-            else:
-                summary = await synchronizer.synchronize_repos(
-                    repos_to_sync=repos_to_sync,
-                    operation=operation,
-                    concurrency=concurrency,
-                    dry_run=dry_run,
-                    overwrite_local_with_remote=overwrite_local_with_remote,
-                )
-
-            if debug_trace is not None:
-                for result in sorted(
-                    getattr(summary, "results", {}).values(),
-                    key=lambda entry: str(getattr(getattr(entry, "repository", None), "name", "")),
-                ):
-                    normalized = _normalize_sync_result(result, fallback_repo_name="")
-                    repo_name = normalized["repository_name"] or None
-                    status = str(normalized["status"])
-                    decision = _sync_decision_from_status(status)
-                    reason = str(
-                        normalized["operator_diagnostic"] or normalized["error"] or normalized["message"] or status
-                    )
-                    _emit_sync_decision(
-                        logger,
-                        trace=debug_trace,
-                        command="sync-repos",
-                        project_storage_key=None,
-                        resource_type="repository",
-                        resource_id=repo_name,
-                        decision=decision,
-                        reason=reason,
-                        token_before=normalized["token_before"],
-                        token_after=normalized["token_after"],
-                        duration_ms=normalized["duration_ms"],
-                        bytes_downloaded=None,
-                        cache_mode=None,
-                    )
-
-                state_diff_payload = {
-                    "total": int(getattr(summary, "total", 0)),
-                    "successes": int(getattr(summary, "successes", 0)),
-                    "failures": int(getattr(summary, "failures", 0)),
-                    "operation": operation.value,
-                    "dry_run": bool(dry_run),
-                    "overwrite_local_with_remote": bool(overwrite_local_with_remote),
-                }
-                debug_paths = debug_trace.write(command="sync-repos", state_diff=state_diff_payload)
-            else:
-                debug_paths = None
-
-            # Phase 36 hard-cutover: persist synchronized repository entities into centralized state.
-            repo_url_project_index: dict[str, set[str]] = {}
-            repo_slug_project_index: dict[str, set[str]] = {}
-            repo_tuple_slug_project_index: dict[tuple[str, str], set[str]] = {}
-            repo_tuple_url_project_index: dict[tuple[str, str], set[str]] = {}
-            try:
-                manifest_payload = _load_manifest_payload_from_state(resolved_state_dsn)
-            except Exception:
-                manifest_payload = None
-            if isinstance(manifest_payload, dict):
-                (
-                    repo_url_project_index,
-                    repo_slug_project_index,
-                    repo_tuple_slug_project_index,
-                    repo_tuple_url_project_index,
-                ) = _build_repo_project_key_indexes(manifest_payload)
-            results_map = getattr(summary, "results", {})
-            state_projects: dict[str, dict[str, Any]] = {}
-            for repo in repos_to_sync:
-                repo_name = str(getattr(repo, "name", "") or "").strip()
-                if not repo_name:
-                    continue
-                # Skip repos that don't match the forced project's repo_filter
-                if _forced_repo_filter:
-                    import fnmatch as _fnmatch_filter
-
-                    if not _fnmatch_filter.fnmatch(repo_name, _forced_repo_filter):
-                        logger.info(
-                            "sync_repos_skipped_by_repo_filter",
-                            repo_name=repo_name,
-                            repo_filter=_forced_repo_filter,
-                            project_storage_key=forced_project_storage_key,
-                        )
-                        continue
-                project_name = str(getattr(repo, "project", "") or "").strip() or "unknown"
-                bitbucket_project_key = project_name
-                repo_result = results_map.get(repo_name) if isinstance(results_map, dict) else None
-                normalized_result = (
-                    _normalize_sync_result(repo_result, fallback_repo_name=repo_name)
-                    if repo_result is not None
-                    else None
-                )
-                status = str((normalized_result or {}).get("status") or "unknown")
-                error = (normalized_result or {}).get("error")
-                repo_url = str(getattr(repo, "url", "") or "").strip()
-                default_branch = str(getattr(repo, "branch", "") or "").strip() or "main"
-                local_path_raw = getattr(repo, "path", None)
-                local_code_path = str(local_path_raw) if isinstance(local_path_raw, Path) else None
-                local_code_path = _resolve_repo_sync_local_code_path(
-                    repo=repo,
-                    repo_name=repo_name,
-                    project_key=bitbucket_project_key,
-                    workspace_path=local_workspace,
-                    hinted_local_code_path=local_code_path,
-                )
-                repo_metadata = getattr(repo, "metadata", {})
-                if not isinstance(repo_metadata, dict):
-                    repo_metadata = {}
-                if not repo_url:
-                    repo_url = str(
-                        repo_metadata.get("repo_url")
-                        or repo_metadata.get("clone_url")
-                        or repo_metadata.get("http_url")
-                        or ""
-                    ).strip()
-                if repo_url:
-                    parsed_repo_url = urlparse(repo_url)
-                    if parsed_repo_url.scheme not in {"http", "https"} or not parsed_repo_url.netloc:
-                        repo_url = ""
-                fallback_project_storage_key = ""
-                # Multi-project junction: resolve per-repo via repo_filter
-                if _junction_multi_project and _junction_links and not forced_project_storage_key:
-                    import fnmatch as _fnmatch
-
-                    _matched_pk = ""
-                    _catchall_pk = ""
-                    for _link in _junction_links:
-                        _pattern = _link.get("repo_filter")
-                        _pk = str(_link.get("project_key", ""))
-                        if _pattern:
-                            if _fnmatch.fnmatch(repo_name, _pattern):
-                                _matched_pk = _pk
-                                break
-                        elif not _catchall_pk:
-                            _catchall_pk = _pk
-                    project_storage_key = _matched_pk or _catchall_pk or junction_resolved_key
-                else:
-                    project_storage_key = (
-                        forced_project_storage_key
-                        if forced_project_storage_key
-                        else _resolve_repo_sync_project_storage_key(
-                            fallback_project_storage_key=fallback_project_storage_key,
-                            bitbucket_project_key=bitbucket_project_key,
-                            repo_name=repo_name,
-                            repo_url=repo_url,
-                            repo_url_index=repo_url_project_index,
-                            repo_slug_index=repo_slug_project_index,
-                            repo_tuple_slug_index=repo_tuple_slug_project_index,
-                            repo_tuple_url_index=repo_tuple_url_project_index,
-                        )
-                    )
-                if not _is_numeric_page_id(project_storage_key):
-                    error_msg = (
-                        "Cannot resolve canonical numeric project page_id for synchronized repository "
-                        f"'{repo_name}' (resolved '{project_storage_key or '<empty>'}'). "
-                        "Provide --project-storage-key <Confluence page_id> or run parse-registry + prepare first."
-                    )
-                    if json_only:
-                        _emit_json({"error": error_msg})
-                    else:
-                        console.print(f"[red]Error:[/red] {error_msg}")
-                    raise typer.Exit(1)
-                project_payload = state_projects.setdefault(
-                    project_storage_key,
-                    {
-                        "project_storage_key": project_storage_key,
-                        "page_id": project_storage_key,
-                        "project_name": project_name,
-                        "bitbucket_links": [],
-                        "bitbucket": [],
-                        "sync_metadata": {
-                            "source": "sync-repos",
-                            "operation": operation.value,
-                            "dry_run": bool(dry_run),
-                            "overwrite_local_with_remote": bool(overwrite_local_with_remote),
-                        },
-                    },
-                )
-                if repo_url and repo_url not in project_payload["bitbucket_links"]:
-                    project_payload["bitbucket_links"].append(repo_url)
-                project_payload["bitbucket"].append(
-                    {
-                        "repo": repo_name,
-                        "repo_slug": repo_name,
-                        "repo_key": repo_name,
-                        "project": bitbucket_project_key,
-                        "bitbucket_repo_key": repo_name,
-                        "bitbucket_project_key": bitbucket_project_key,
-                        "repo_url": repo_url or None,
-                        "default_branch": default_branch,
-                        "status": status,
-                        "status_classification": normalized_result.get("status_classification"),
-                        "sync_decision": _sync_decision_from_status(status),
-                        "error": str(error) if error else None,
-                        "operator_diagnostic": normalized_result.get("operator_diagnostic"),
-                        "remote_default_branch_hint": normalized_result.get("remote_default_branch_hint"),
-                        "discovered_remote_branches": normalized_result.get("discovered_remote_branches"),
-                        "discovered_remote_branch_count": normalized_result.get("discovered_remote_branch_count"),
-                        "branch_hint_probe_error": normalized_result.get("branch_hint_probe_error"),
-                        "local_code_path": local_code_path,
-                        "repo_type": "primary",
-                        "last_commit": repo_metadata.get("last_commit"),
-                        "default_branch_ref": repo_metadata.get("default_branch_ref"),
-                        "clone_verified_at": (
-                            _dt_now_utc_iso() if local_code_path and Path(local_code_path).is_dir() else None
-                        ),
-                    }
-                )
-
-            ops_sync_summary: dict[str, Any] | None = None
-            if include_ops_repo:
-                ops_urls = [str(value or "").strip() for value in include_ops_repo if str(value or "").strip()]
-                seen_ops_urls: set[str] = set()
-                ops_urls = [url for url in ops_urls if not (url in seen_ops_urls or seen_ops_urls.add(url))]
-                fallback_ops_project = bitbucket_project or "OPS"
-                ops_repos_to_sync: list[RepoInfo] = []
-                for ops_url in ops_urls:
-                    parsed = _parse_ops_repo_url(repo_url=ops_url, fallback_project=fallback_ops_project)
-                    if parsed is None:
-                        logger.warning("sync_repos_include_ops_repo_invalid_url", repo_url=ops_url)
-                        continue
-                    ops_project_key, ops_repo_name = parsed
-                    ops_repos_to_sync.append(
-                        RepoInfo(
-                            name=ops_repo_name,
-                            path=local_workspace / f"{ops_project_key}-project" / ops_repo_name,
-                            project=ops_project_key,
-                            branch=branch,
-                            url=ops_url,
-                            tags={"ops"},
-                            metadata={"repo_type": "ops", "role": "ops"},
-                        )
-                    )
-                if ops_repos_to_sync:
-                    if not json_only:
-                        with Progress(
-                            SpinnerColumn(),
-                            TextColumn("[progress.description]{task.description}"),
-                            transient=True,
-                        ) as ops_progress:
-                            ops_progress.add_task(
-                                f"Syncing {len(ops_repos_to_sync)} ops repos...",
-                                total=None,
-                            )
-                            ops_summary = await synchronizer.synchronize_repos(
-                                repos_to_sync=ops_repos_to_sync,
-                                operation=operation,
-                                concurrency=concurrency,
-                                dry_run=dry_run,
-                                overwrite_local_with_remote=overwrite_local_with_remote,
-                            )
-                    else:
-                        ops_summary = await synchronizer.synchronize_repos(
-                            repos_to_sync=ops_repos_to_sync,
-                            operation=operation,
-                            concurrency=concurrency,
-                            dry_run=dry_run,
-                            overwrite_local_with_remote=overwrite_local_with_remote,
-                        )
-                    ops_results_map = getattr(ops_summary, "results", {})
-                    ops_project_storage_key = (
-                        forced_project_storage_key
-                        if forced_project_storage_key
-                        else (sorted(state_projects.keys())[0] if state_projects else "")
-                    )
-                    if not _is_numeric_page_id(ops_project_storage_key):
-                        error_msg = (
-                            "Cannot bind --include-ops-repo entries without a canonical numeric project page_id. "
-                            "Provide --project-storage-key <Confluence page_id>."
-                        )
-                        if json_only:
-                            _emit_json({"error": error_msg})
-                        else:
-                            console.print(f"[red]Error:[/red] {error_msg}")
-                        raise typer.Exit(1)
-                    ops_project_payload = state_projects.setdefault(
-                        ops_project_storage_key,
-                        {
-                            "project_storage_key": ops_project_storage_key,
-                            "page_id": ops_project_storage_key,
-                            "project_name": bitbucket_project or "ops",
-                            "bitbucket_links": [],
-                            "bitbucket": [],
-                            "sync_metadata": {
-                                "source": "sync-repos",
-                                "operation": operation.value,
-                                "dry_run": bool(dry_run),
-                                "overwrite_local_with_remote": bool(overwrite_local_with_remote),
-                            },
-                        },
-                    )
-                    for ops_repo in ops_repos_to_sync:
-                        ops_repo_name = str(getattr(ops_repo, "name", "") or "").strip()
-                        if not ops_repo_name:
-                            continue
-                        ops_result = ops_results_map.get(ops_repo_name) if isinstance(ops_results_map, dict) else None
-                        ops_normalized = (
-                            _normalize_sync_result(ops_result, fallback_repo_name=ops_repo_name)
-                            if ops_result is not None
-                            else None
-                        )
-                        ops_status = str((ops_normalized or {}).get("status") or "unknown")
-                        ops_error = (ops_normalized or {}).get("error")
-                        ops_repo_url = str(getattr(ops_repo, "url", "") or "").strip()
-                        ops_default_branch = str(getattr(ops_repo, "branch", "") or "").strip() or "main"
-                        ops_local_path_raw = getattr(ops_repo, "path", None)
-                        ops_local_code_path = str(ops_local_path_raw) if isinstance(ops_local_path_raw, Path) else None
-                        ops_local_code_path = _resolve_repo_sync_local_code_path(
-                            repo=ops_repo,
-                            repo_name=ops_repo_name,
-                            project_key=str(getattr(ops_repo, "project", "") or "OPS"),
-                            workspace_path=local_workspace,
-                            hinted_local_code_path=ops_local_code_path,
-                        )
-                        ops_project_key = str(getattr(ops_repo, "project", "") or "OPS").strip() or "OPS"
-                        if ops_repo_url and ops_repo_url not in ops_project_payload["bitbucket_links"]:
-                            ops_project_payload["bitbucket_links"].append(ops_repo_url)
-                        ops_project_payload["bitbucket"].append(
-                            {
-                                "repo": ops_repo_name,
-                                "repo_slug": ops_repo_name,
-                                "repo_key": ops_repo_name,
-                                "project": ops_project_key,
-                                "bitbucket_repo_key": ops_repo_name,
-                                "bitbucket_project_key": ops_project_key,
-                                "repo_url": ops_repo_url or None,
-                                "default_branch": ops_default_branch,
-                                "status": ops_status,
-                                "status_classification": ops_normalized.get("status_classification"),
-                                "sync_decision": _sync_decision_from_status(ops_status),
-                                "error": str(ops_error) if ops_error else None,
-                                "operator_diagnostic": ops_normalized.get("operator_diagnostic"),
-                                "remote_default_branch_hint": ops_normalized.get("remote_default_branch_hint"),
-                                "discovered_remote_branches": ops_normalized.get("discovered_remote_branches"),
-                                "discovered_remote_branch_count": ops_normalized.get("discovered_remote_branch_count"),
-                                "branch_hint_probe_error": ops_normalized.get("branch_hint_probe_error"),
-                                "local_code_path": ops_local_code_path,
-                                "role": "ops",
-                                "repo_type": "ops",
-                            }
-                        )
-                    ops_sync_summary = {
-                        "total": int(getattr(ops_summary, "total", 0)),
-                        "successes": int(getattr(ops_summary, "successes", 0)),
-                        "failures": int(getattr(ops_summary, "failures", 0)),
-                        "repos": [repo.name for repo in ops_repos_to_sync],
-                    }
-            repo_sync_payload = {
-                "kind": "repo_sync",
-                "operation": operation.value,
-                "dry_run": bool(dry_run),
-                "overwrite_local_with_remote": bool(overwrite_local_with_remote),
-                "projects": sorted(
-                    state_projects.values(),
-                    key=lambda item: (
-                        str(item.get("project_name") or ""),
-                        str(item.get("project_storage_key") or ""),
-                    ),
-                ),
-            }
-            invalid_project_identities: list[dict[str, Any]] = []
-            for project_key, project_payload in state_projects.items():
-                if not isinstance(project_payload, dict):
-                    invalid_project_identities.append(
-                        {"project_key": str(project_key or ""), "reason": "payload_not_dict"}
-                    )
-                    continue
-                canonical_project_key = str(
-                    project_payload.get("project_storage_key") or project_key or forced_project_storage_key
-                ).strip()
-                if canonical_project_key:
-                    project_payload["project_storage_key"] = canonical_project_key
-                page_id = str(project_payload.get("page_id") or "").strip()
-                if not page_id and canonical_project_key:
-                    project_payload["page_id"] = canonical_project_key
-                    page_id = canonical_project_key
-                if not page_id and forced_project_storage_key:
-                    project_payload["page_id"] = forced_project_storage_key
-                    page_id = forced_project_storage_key
-                if not page_id:
-                    invalid_project_identities.append(
-                        {
-                            "project_key": str(project_key or ""),
-                            "project_storage_key": canonical_project_key,
-                            "project_name": str(project_payload.get("project_name") or ""),
-                            "reason": "missing_page_id",
-                        }
-                    )
-                    continue
-                if not _is_numeric_page_id(page_id):
-                    invalid_project_identities.append(
-                        {
-                            "project_key": str(project_key or ""),
-                            "project_storage_key": canonical_project_key,
-                            "project_name": str(project_payload.get("project_name") or ""),
-                            "page_id": page_id,
-                            "reason": "invalid_page_id",
-                        }
-                    )
-            if invalid_project_identities:
-                logger.error(
-                    "sync_repos_invalid_project_identity_payload",
-                    invalid_project_identities=invalid_project_identities,
-                )
-                raise ValueError(
-                    "Cannot record repo_sync artifacts: invalid project page_id in sync payload "
-                    f"for {len(invalid_project_identities)} project(s)."
-                )
-            logger.info(
-                "sync_repos_state_payload_project_identities",
-                projects=[
-                    {
-                        "project_storage_key": str(project_payload.get("project_storage_key") or ""),
-                        "page_id": str(project_payload.get("page_id") or ""),
-                        "project_name": str(project_payload.get("project_name") or ""),
-                    }
-                    for project_payload in state_projects.values()
-                    if isinstance(project_payload, dict)
-                ],
-            )
-            _record_state_artifacts(state_dsn=resolved_state_dsn, payload=repo_sync_payload)
-
-            # Phase 95 (AC-264.4): upsert junction link after sync
-            if bitbucket_project and state_projects:
-                try:
-                    store = PostgresStateStore(resolved_state_dsn)
-                    try:
-                        normalized_bb_key = _normalize_storage_key(bitbucket_project)
-                        if _is_storage_key_like_bitbucket_project_key(normalized_bb_key):
-                            logger.warning(
-                                "sync_repos_junction_link_rejected_storage_key_like_bitbucket_project",
-                                raw_bitbucket_project_key=bitbucket_project,
-                                normalized_bitbucket_project_key=normalized_bb_key,
-                            )
-                        else:
-                            for pkey in state_projects:
-                                store.upsert_project_bitbucket_link_by_keys(
-                                    project_key=pkey,
-                                    bitbucket_project_key=normalized_bb_key,
-                                    source="sync_repos",
-                                )
-                        cleanup_result = store.cleanup_spurious_project_bitbucket_links()
-                        logger.info(
-                            "sync_repos_runtime_spurious_junction_cleanup",
-                            links_removed=int((cleanup_result or {}).get("links_removed", 0)),
-                        )
-                    finally:
-                        store.close()
-                except Exception as exc:
-                    logger.warning(
-                        "sync_repos_junction_link_failed",
-                        bitbucket_project=bitbucket_project,
-                        error=str(exc),
-                    )
-
-            # Phase 81: sync auxiliary Bitbucket projects and register with role tags.
-            auxiliary_summaries: list[dict[str, Any]] = []
-            for aux_selector in auxiliary_project or []:
-                aux_selector_value = str(aux_selector or "").strip()
-                if not aux_selector_value:
-                    continue
-                try:
-                    aux_project_key, aux_repo_filters = _parse_auxiliary_project_selector(aux_selector_value)
-                except ValueError as exc:
-                    logger.warning(
-                        "auxiliary_project_selector_invalid",
-                        selector=aux_selector_value,
-                        error=str(exc),
-                    )
-                    continue
-
-                role = "auxiliary_config" if aux_project_key.upper() == "DOPS" else "auxiliary_lib"
-                try:
-                    _validate_required_credentials(command="sync repos", require_bitbucket=True)
-                    aux_bb_client = BitbucketCliClient()
-                    aux_source: RepoSource = BitbucketProjectSource(aux_bb_client)
-                    aux_filters = ManifestFilters(project=aux_project_key, name_match=repo_name_match)
-                    if not json_only:
-                        with Progress(
-                            SpinnerColumn(),
-                            TextColumn("[progress.description]{task.description}"),
-                            transient=True,
-                        ) as aux_progress:
-                            aux_progress.add_task(f"Discovering auxiliary repos from {aux_project_key}...", total=None)
-                            aux_repos = await aux_source.get_repositories(aux_filters)
-                    else:
-                        aux_repos = await aux_source.get_repositories(aux_filters)
-                    aux_repos = _filter_auxiliary_repositories(
-                        aux_repos,
-                        selected_repo_slugs=aux_repo_filters,
-                    )
-                    aux_repos = _apply_branch_override(
-                        repos=aux_repos,
-                        branch=branch,
-                        enabled=branch_override_enabled,
-                    )
-                    if not aux_repos:
-                        logger.info(
-                            "auxiliary_project_empty",
-                            project=aux_project_key,
-                            selected_repos=list(aux_repo_filters),
-                        )
-                        continue
-                    aux_synchronizer = RepoSynchronizer(workspace_path=local_workspace)
-                    if not json_only:
-                        with Progress(
-                            SpinnerColumn(),
-                            TextColumn("[progress.description]{task.description}"),
-                            transient=True,
-                        ) as aux_progress:
-                            aux_progress.add_task(
-                                f"Syncing {len(aux_repos)} auxiliary repos ({aux_project_key})...",
-                                total=None,
-                            )
-                            aux_summary = await aux_synchronizer.synchronize_repos(
-                                repos_to_sync=aux_repos,
-                                operation=operation,
-                                concurrency=concurrency,
-                                dry_run=dry_run,
-                                overwrite_local_with_remote=overwrite_local_with_remote,
-                            )
-                    else:
-                        aux_summary = await aux_synchronizer.synchronize_repos(
-                            repos_to_sync=aux_repos,
-                            operation=operation,
-                            concurrency=concurrency,
-                            dry_run=dry_run,
-                            overwrite_local_with_remote=overwrite_local_with_remote,
-                        )
-                    # Build state entries for auxiliary repos with role tag.
-                    aux_results_map = getattr(aux_summary, "results", {})
-                    aux_state_repos: list[dict[str, Any]] = []
-                    for aux_repo in aux_repos:
-                        aux_repo_name = str(getattr(aux_repo, "name", "") or "").strip()
-                        if not aux_repo_name:
-                            continue
-                        aux_repo_result = (
-                            aux_results_map.get(aux_repo_name) if isinstance(aux_results_map, dict) else None
-                        )
-                        aux_normalized = (
-                            _normalize_sync_result(aux_repo_result, fallback_repo_name=aux_repo_name)
-                            if aux_repo_result is not None
-                            else None
-                        )
-                        aux_status = str((aux_normalized or {}).get("status") or "unknown")
-                        aux_error = (aux_normalized or {}).get("error")
-                        aux_repo_url = str(getattr(aux_repo, "url", "") or "").strip()
-                        aux_repo_metadata = getattr(aux_repo, "metadata", {})
-                        if not isinstance(aux_repo_metadata, dict):
-                            aux_repo_metadata = {}
-                        if not aux_repo_url:
-                            aux_repo_url = str(
-                                aux_repo_metadata.get("repo_url")
-                                or aux_repo_metadata.get("clone_url")
-                                or aux_repo_metadata.get("http_url")
-                                or ""
-                            ).strip()
-                        aux_default_branch = str(getattr(aux_repo, "branch", "") or "").strip() or "main"
-                        aux_local_path_raw = getattr(aux_repo, "path", None)
-                        aux_local_code_path = str(aux_local_path_raw) if isinstance(aux_local_path_raw, Path) else None
-                        aux_local_code_path = _resolve_repo_sync_local_code_path(
-                            repo=aux_repo,
-                            repo_name=aux_repo_name,
-                            project_key=aux_project_key,
-                            workspace_path=local_workspace,
-                            hinted_local_code_path=aux_local_code_path,
-                        )
-                        aux_state_repos.append(
-                            {
-                                "repo": aux_repo_name,
-                                "repo_slug": aux_repo_name,
-                                "repo_key": aux_repo_name,
-                                "project": aux_project_key,
-                                "bitbucket_project_key": aux_project_key,
-                                "repo_url": aux_repo_url or None,
-                                "default_branch": aux_default_branch,
-                                "status": aux_status,
-                                "status_classification": aux_normalized.get("status_classification"),
-                                "sync_decision": _sync_decision_from_status(aux_status),
-                                "error": str(aux_error) if aux_error else None,
-                                "operator_diagnostic": aux_normalized.get("operator_diagnostic"),
-                                "remote_default_branch_hint": aux_normalized.get("remote_default_branch_hint"),
-                                "discovered_remote_branches": aux_normalized.get("discovered_remote_branches"),
-                                "discovered_remote_branch_count": aux_normalized.get("discovered_remote_branch_count"),
-                                "branch_hint_probe_error": aux_normalized.get("branch_hint_probe_error"),
-                                "local_code_path": aux_local_code_path,
-                                "role": role,
-                                "repo_type": "primary",
-                                "last_commit": aux_repo_metadata.get("last_commit"),
-                                "default_branch_ref": aux_repo_metadata.get("default_branch_ref"),
-                            }
-                        )
-                    aux_project_storage_key = forced_project_storage_key if forced_project_storage_key else ""
-                    if not _is_numeric_page_id(aux_project_storage_key):
-                        raise ValueError(
-                            "Cannot bind --auxiliary-project entries without a canonical numeric project page_id. "
-                            "Provide --project-storage-key <Confluence page_id>."
-                        )
-                    aux_state_payload: dict[str, Any] = {
-                        "kind": "repo_sync",
-                        "operation": operation.value,
-                        "dry_run": bool(dry_run),
-                        "overwrite_local_with_remote": bool(overwrite_local_with_remote),
-                        "auxiliary": True,
-                        "projects": [
-                            {
-                                "project_storage_key": aux_project_storage_key,
-                                "page_id": aux_project_storage_key,
-                                "project_name": aux_project_key,
-                                "bitbucket_links": [r["repo_url"] for r in aux_state_repos if r.get("repo_url")],
-                                "bitbucket": aux_state_repos,
-                                "sync_metadata": {
-                                    "source": "sync-repos-auxiliary",
-                                    "operation": operation.value,
-                                    "dry_run": bool(dry_run),
-                                    "overwrite_local_with_remote": bool(overwrite_local_with_remote),
-                                    "role": role,
-                                },
-                            }
-                        ],
-                    }
-                    _record_state_artifacts(state_dsn=resolved_state_dsn, payload=aux_state_payload)
-                    auxiliary_summaries.append(
-                        {
-                            "project": aux_project_key,
-                            "role": role,
-                            "total": int(getattr(aux_summary, "total", 0)),
-                            "successes": int(getattr(aux_summary, "successes", 0)),
-                            "failures": int(getattr(aux_summary, "failures", 0)),
-                            "repos": [r.name for r in aux_repos],
-                        }
-                    )
-                    if not json_only:
-                        console.print(
-                            f"[green]Auxiliary project {aux_project_key} ({role}): "
-                            f"{getattr(aux_summary, 'successes', 0)}/{getattr(aux_summary, 'total', 0)} synced.[/green]"
-                        )
-                except Exception as aux_err:
-                    logger.warning("auxiliary_sync_failed", project=aux_project_key, error=str(aux_err))
-                    if not json_only:
-                        console.print(
-                            f"[yellow]Warning: auxiliary project {aux_project_key} sync failed: {aux_err}[/yellow]"
-                        )
-
-            if json_only:
-                if hasattr(summary, "model_dump"):
-                    summary_payload = summary.model_dump()  # type: ignore[attr-defined]
-                else:
-                    summary_payload = {
-                        "total": int(getattr(summary, "total", 0)),
-                        "successes": int(getattr(summary, "successes", 0)),
-                        "updates": int(getattr(summary, "updates", 0)),
-                        "failures": int(getattr(summary, "failures", 0)),
-                        "results": {
-                            str(key): {
-                                "status": normalized["status"],
-                                "status_classification": normalized["status_classification"],
-                                "sync_decision": _sync_decision_from_status(normalized["status"]),
-                                "updated": bool(normalized["updated"]),
-                                "error": normalized["error"],
-                                "operator_diagnostic": normalized["operator_diagnostic"],
-                                "remote_default_branch_hint": normalized["remote_default_branch_hint"],
-                                "discovered_remote_branches": normalized["discovered_remote_branches"],
-                                "discovered_remote_branch_count": normalized["discovered_remote_branch_count"],
-                                "branch_hint_probe_error": normalized["branch_hint_probe_error"],
-                                "repository": str(normalized["repository_name"] or key),
-                                "message": normalized["message"] or None,
-                            }
-                            for key, value in (getattr(summary, "results", {}) or {}).items()
-                            for normalized in [_normalize_sync_result(value, fallback_repo_name=str(key))]
-                        },
-                    }
-                payload: dict[str, Any] = {
-                    "action": "sync_repos",
-                    "selected_source": selected_source,
-                    "overwrite_local_with_remote": bool(overwrite_local_with_remote),
-                    "summary": summary_payload,
-                    "repositories_synced": [r.name for r in repos_to_sync],
-                }
-                if auxiliary_summaries:
-                    payload["auxiliary_projects"] = auxiliary_summaries
-                if ops_sync_summary is not None:
-                    payload["ops_repos"] = ops_sync_summary
-                if debug_paths is not None:
-                    payload["debug_artifacts"] = debug_paths
-                _emit_json(payload)
-            else:
-                console.print("[green]Repository synchronization complete.[/green]")
-                console.print(f"Source: {selected_source}")
-                console.print(f"Total: {summary.total}, Successes: {summary.successes}, Failures: {summary.failures}")
-                if ops_sync_summary is not None:
-                    console.print(f"Ops repos: {ops_sync_summary['successes']}/{ops_sync_summary['total']} synced")
-                if debug_paths is not None:
-                    console.print(f"Debug artifacts: {debug_paths['cache_trace_path']}")
-                if summary.failures > 0:
-                    console.print("[red]Some repositories failed to synchronize.[/red]")
-                    for key, result in (getattr(summary, "results", {}) or {}).items():
-                        normalized = _normalize_sync_result(result, fallback_repo_name=str(key))
-                        if _sync_decision_from_status(normalized["status"]) == "failed":
-                            repo_name = str(normalized["repository_name"] or key)
-                            reason = str(
-                                normalized["operator_diagnostic"]
-                                or normalized["error"]
-                                or normalized["message"]
-                                or "failed"
-                            )
-                            status_classification = str(normalized["status_classification"] or "").strip()
-                            if status_classification:
-                                reason = f"{status_classification}: {reason}"
-                            console.print(f"  [red]- {repo_name}: {reason}[/red]")
-                else:
-                    console.print("[green]All repositories synchronized successfully.[/green]")
-
-        except typer.Exit:
-            raise
-        except Exception as e:
-            error_msg = f"Repository synchronization failed: {e}"
-            if json_only:
-                _emit_json({"error": error_msg})
-            else:
-                console.print(f"[red]Error:[/red] {error_msg}")
-                logger.exception("repo_sync_failed")
-            raise typer.Exit(1) from e
-
-    asyncio.run(_sync_impl())