reposets 0.1.0

package/500.js

@@ -0,0 +1,2545 @@
+import { Context, Data, Effect, Layer, Option, Ref, Schema } from "effect";
+import { blake2b } from "blakejs";
+import tweetnacl from "tweetnacl";
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { dirname, isAbsolute, join, resolve } from "node:path";
+import { AppDirsConfig, ConfigError, ConfigFile, FirstMatch, TomlCodec, UpwardWalk, XdgConfig, XdgConfigLive, XdgSavePath } from "xdg-effect";
+import { Octokit } from "@octokit/rest";
+class ResolveError extends Data.TaggedError("ResolveError") {
+}
+class OnePasswordError extends Data.TaggedError("OnePasswordError") {
+}
+class GitHubApiError extends Data.TaggedError("GitHubApiError") {
+}
+class SyncError extends Data.TaggedError("SyncError") {
+}
+function encryptSecret(publicKey, secretValue) {
+    const messageBytes = Buffer.from(secretValue);
+    const publicKeyBytes = Buffer.from(publicKey, "base64");
+    const ephemeralKeyPair = tweetnacl.box.keyPair();
+    const nonceInput = new Uint8Array(64);
+    nonceInput.set(ephemeralKeyPair.publicKey);
+    nonceInput.set(publicKeyBytes, 32);
+    const nonce = blake2b(nonceInput, void 0, 24);
+    const ciphertext = tweetnacl.box(messageBytes, nonce, publicKeyBytes, ephemeralKeyPair.secretKey);
+    const sealed = new Uint8Array(ephemeralKeyPair.publicKey.length + ciphertext.length);
+    sealed.set(ephemeralKeyPair.publicKey);
+    sealed.set(ciphertext, ephemeralKeyPair.publicKey.length);
+    return Buffer.from(sealed).toString("base64");
+}
+const ResourceFileKind = Schema.Struct({
+    file: Schema.Record({
+        key: Schema.String,
+        value: Schema.String
+    }).annotations({
+        title: "File entries",
+        description: "Named entries with file path values, resolved relative to config directory",
+        jsonSchema: {
+            "x-tombi-additional-key-label": "name"
+        }
+    })
+});
+const ResourceValueKind = Schema.Struct({
+    value: Schema.Record({
+        key: Schema.String,
+        value: Schema.Union(Schema.String, Schema.Record({
+            key: Schema.String,
+            value: Schema.Unknown
+        }))
+    }).annotations({
+        title: "Value entries",
+        description: "Named entries with inline values. Strings used as-is, objects JSON-stringified.",
+        jsonSchema: {
+            "x-tombi-additional-key-label": "name"
+        }
+    })
+});
+const ResourceResolvedKind = Schema.Struct({
+    resolved: Schema.Record({
+        key: Schema.String,
+        value: Schema.String
+    }).annotations({
+        title: "Resolved entries",
+        description: "Named entries mapped to credential labels. Values come from the active credential profile.",
+        jsonSchema: {
+            "x-tombi-additional-key-label": "name"
+        }
+    })
+});
+const SecretGroupSchema = Schema.Union(ResourceFileKind, ResourceValueKind, ResourceResolvedKind).annotations({
+    identifier: "SecretGroup",
+    title: "Secret group",
+    description: "A group of secrets. Must be exactly one kind: file, value, or resolved."
+});
+const VariableGroupSchema = Schema.Union(ResourceFileKind, ResourceValueKind, ResourceResolvedKind).annotations({
+    identifier: "VariableGroup",
+    title: "Variable group",
+    description: "A group of variables. Must be exactly one kind: file, value, or resolved."
+});
+const CleanupScopeSchema = Schema.Union(Schema.Boolean, Schema.Struct({
+    preserve: Schema.Array(Schema.String).annotations({
+        title: "Preserve list",
+        description: "Resource names that should never be deleted during cleanup",
+        examples: [
+            [
+                "LEGACY_TOKEN",
+                "DEPLOY_KEY"
+            ]
+        ]
+    })
+})).annotations({
+    identifier: "CleanupScope",
+    title: "Cleanup scope",
+    description: "Controls cleanup for a single resource scope. false disables cleanup, true enables full cleanup, or specify names to preserve."
+});
+const CleanupSecretsSchema = Schema.Struct({
+    actions: Schema.optionalWith(CleanupScopeSchema, {
+        default: ()=>false
+    }).annotations({
+        title: "Clean up Actions secrets",
+        description: "Delete Actions secrets not declared in any referenced secret group",
+        default: false
+    }),
+    dependabot: Schema.optionalWith(CleanupScopeSchema, {
+        default: ()=>false
+    }).annotations({
+        title: "Clean up Dependabot secrets",
+        description: "Delete Dependabot secrets not declared in any referenced secret group",
+        default: false
+    }),
+    codespaces: Schema.optionalWith(CleanupScopeSchema, {
+        default: ()=>false
+    }).annotations({
+        title: "Clean up Codespaces secrets",
+        description: "Delete Codespaces secrets not declared in any referenced secret group",
+        default: false
+    }),
+    environments: Schema.optionalWith(CleanupScopeSchema, {
+        default: ()=>false
+    }).annotations({
+        title: "Clean up environment secrets",
+        description: "Delete environment secrets not declared in any referenced secret group",
+        default: false
+    })
+}).annotations({
+    identifier: "CleanupSecrets",
+    title: "Secrets cleanup configuration",
+    description: "Controls deletion of secrets by scope (Actions, Dependabot, Codespaces, environments)."
+});
+const CleanupVariablesSchema = Schema.Struct({
+    actions: Schema.optionalWith(CleanupScopeSchema, {
+        default: ()=>false
+    }).annotations({
+        title: "Clean up Actions variables",
+        description: "Delete Actions variables not declared in any referenced variable group",
+        default: false
+    }),
+    environments: Schema.optionalWith(CleanupScopeSchema, {
+        default: ()=>false
+    }).annotations({
+        title: "Clean up environment variables",
+        description: "Delete environment variables not declared in any referenced variable group",
+        default: false
+    })
+}).annotations({
+    identifier: "CleanupVariables",
+    title: "Variables cleanup configuration",
+    description: "Controls deletion of variables by scope (Actions, environments)."
+});
+const CleanupSchema = Schema.Struct({
+    secrets: Schema.optionalWith(CleanupSecretsSchema, {
+        default: ()=>({
+                actions: false,
+                dependabot: false,
+                codespaces: false,
+                environments: false
+            })
+    }).annotations({
+        title: "Secrets cleanup",
+        description: "Controls cleanup of secrets by scope"
+    }),
+    variables: Schema.optionalWith(CleanupVariablesSchema, {
+        default: ()=>({
+                actions: false,
+                environments: false
+            })
+    }).annotations({
+        title: "Variables cleanup",
+        description: "Controls cleanup of variables by scope"
+    }),
+    rulesets: Schema.optionalWith(CleanupScopeSchema, {
+        default: ()=>false
+    }).annotations({
+        title: "Clean up rulesets",
+        description: "Delete repository rulesets not declared in any referenced ruleset group",
+        default: false
+    }),
+    environments: Schema.optionalWith(CleanupScopeSchema, {
+        default: ()=>false
+    }).annotations({
+        title: "Clean up environments",
+        description: "Delete repository environments not declared in config",
+        default: false
+    })
+}).annotations({
+    identifier: "Cleanup",
+    title: "Cleanup configuration",
+    description: "Controls deletion of resources not declared in config. All disabled by default."
+});
+const ReviewerTypeSchema = Schema.Literal("User", "Team").annotations({
+    title: "Reviewer type",
+    description: "Whether the reviewer is an individual user or a team"
+});
+const ReviewerSchema = Schema.Struct({
+    type: ReviewerTypeSchema,
+    id: Schema.Int.annotations({
+        title: "Reviewer ID",
+        description: "The ID of the user or team"
+    })
+}).annotations({
+    identifier: "Reviewer",
+    title: "Reviewer",
+    description: "A user or team required to review deployments"
+});
+const DeploymentBranchPolicySchema = Schema.Struct({
+    name: Schema.String.annotations({
+        title: "Pattern",
+        description: "The name pattern (branch name, tag name, or glob) to allow deployments from"
+    }),
+    type: Schema.optionalWith(Schema.Literal("branch", "tag").annotations({
+        title: "Policy type",
+        description: 'Whether this policy matches branches or tags. Defaults to "branch".'
+    }), {
+        default: ()=>"branch"
+    })
+}).annotations({
+    identifier: "DeploymentBranchPolicy",
+    title: "Deployment branch policy",
+    description: "A custom branch or tag pattern that deployments are allowed from"
+});
+const DeploymentBranchesSchema = Schema.Union(Schema.Literal("all", "protected").annotations({
+    title: "Deployment branch preset",
+    description: '"all" allows any branch, "protected" allows only protected branches'
+}), Schema.Array(DeploymentBranchPolicySchema).annotations({
+    title: "Custom deployment policies",
+    description: "Array of branch or tag name patterns allowed to deploy to this environment"
+})).annotations({
+    identifier: "DeploymentBranches",
+    title: "Deployment branches",
+    description: 'Controls which branches can deploy. Use "all", "protected", or a list of custom policies.'
+});
+const EnvironmentSchema = Schema.Struct({
+    wait_timer: Schema.optional(Schema.Int.pipe(Schema.between(0, 43200)).annotations({
+        title: "Wait timer (minutes)",
+        description: "Number of minutes to wait before allowing deployments to proceed (0-43200)"
+    })),
+    prevent_self_review: Schema.optional(Schema.Boolean.annotations({
+        title: "Prevent self-review",
+        description: "Prevent the user who triggered the deployment from approving it"
+    })),
+    reviewers: Schema.optional(Schema.Array(ReviewerSchema).annotations({
+        title: "Required reviewers",
+        description: "Users or teams required to approve deployments to this environment"
+    })),
+    deployment_branches: Schema.optional(DeploymentBranchesSchema)
+}).annotations({
+    identifier: "Environment",
+    title: "Deployment environment",
+    description: "Configuration for a GitHub deployment environment",
+    jsonSchema: {
+        "x-tombi-table-keys-order": "schema"
+    }
+});
+const ResolvedRefSchema = Schema.Struct({
+    resolved: Schema.String.annotations({
+        title: "Credential label",
+        description: "Reference to a named value in the active credential profile's resolve section"
+    })
+}).annotations({
+    identifier: "ResolvedRef",
+    title: "Resolved reference",
+    description: "A reference to a credential-resolved value"
+});
+const ActorTypeSchema = Schema.Literal("Integration", "OrganizationAdmin", "RepositoryRole", "Team", "DeployKey").annotations({
+    title: "Actor type",
+    description: "The type of actor that can bypass a ruleset"
+});
+const BypassModeSchema = Schema.Literal("always", "pull_request", "exempt").annotations({
+    title: "Bypass mode",
+    description: "When the specified actor can bypass the ruleset"
+});
+const BypassActorSchema = Schema.Struct({
+    actor_id: Schema.optional(Schema.Union(Schema.Int, ResolvedRefSchema).annotations({
+        title: "Actor ID",
+        description: "The ID of the actor, or a { resolved } reference to a credential label."
+    })),
+    actor_type: ActorTypeSchema,
+    bypass_mode: Schema.optionalWith(BypassModeSchema, {
+        default: ()=>"always"
+    })
+}).annotations({
+    identifier: "BypassActor",
+    title: "Bypass actor",
+    description: "An actor that can bypass rules in a ruleset"
+});
+const RefNameConditionSchema = Schema.Struct({
+    include: Schema.optionalWith(Schema.Array(Schema.String).annotations({
+        title: "Include patterns",
+        description: "Ref name patterns to include. Accepts ~DEFAULT_BRANCH, ~ALL, or glob patterns.",
+        examples: [
+            [
+                "~DEFAULT_BRANCH"
+            ]
+        ]
+    }), {
+        default: ()=>[]
+    }),
+    exclude: Schema.optionalWith(Schema.Array(Schema.String).annotations({
+        title: "Exclude patterns",
+        description: "Ref name patterns to exclude"
+    }), {
+        default: ()=>[]
+    })
+}).annotations({
+    identifier: "RefNameCondition",
+    title: "Ref name condition",
+    description: "Conditions for matching ref names (branches or tags)"
+});
+const RulesetConditionsSchema = Schema.Struct({
+    ref_name: Schema.optional(RefNameConditionSchema)
+}).annotations({
+    identifier: "RulesetConditions",
+    title: "Ruleset conditions",
+    description: "Conditions that determine when the ruleset applies"
+});
+const RequiredReviewerSchema = Schema.Struct({
+    file_patterns: Schema.Array(Schema.String).annotations({
+        description: "File patterns this reviewer must approve (fnmatch syntax)"
+    }),
+    minimum_approvals: Schema.Int.annotations({
+        description: "Minimum approvals required from this team (0 = optional)"
+    }),
+    reviewer: Schema.Struct({
+        id: Schema.Int.annotations({
+            description: "Team ID"
+        }),
+        type: Schema.Literal("Team")
+    })
+});
+const StatusCheckSchema = Schema.Struct({
+    context: Schema.String.annotations({
+        description: "The status check context name that must be present on the commit"
+    }),
+    integration_id: Schema.optional(Schema.Union(Schema.Int, ResolvedRefSchema).annotations({
+        description: "The integration ID, or a { resolved } reference to a credential label"
+    }))
+});
+const WorkflowFileSchema = Schema.Struct({
+    path: Schema.String.annotations({
+        description: "Path to the workflow file"
+    }),
+    ref: Schema.optional(Schema.String.annotations({
+        description: "Branch or tag of the workflow file"
+    })),
+    repository_id: Schema.Union(Schema.Int, ResolvedRefSchema).annotations({
+        description: "Repository ID, or a { resolved } reference to a credential label"
+    }),
+    sha: Schema.optional(Schema.String.annotations({
+        description: "Commit SHA of the workflow file"
+    }))
+});
+const TargetPatternSchema = Schema.Union(Schema.Struct({
+    include: Schema.String.annotations({
+        title: "Include pattern",
+        description: "Glob pattern to include"
+    })
+}), Schema.Struct({
+    exclude: Schema.String.annotations({
+        title: "Exclude pattern",
+        description: "Glob pattern to exclude"
+    })
+})).annotations({
+    identifier: "TargetPattern",
+    title: "Target pattern",
+    description: "An include or exclude pattern for ref matching"
+});
+const TargetsSchema = Schema.Union(Schema.Literal("default", "all").annotations({
+    title: "Target preset",
+    description: "'default' targets the default branch; 'all' targets all branches/tags"
+}), Schema.Array(TargetPatternSchema).annotations({
+    title: "Custom target patterns",
+    description: "Array of include/exclude patterns for fine-grained ref targeting"
+})).annotations({
+    identifier: "Targets",
+    title: "Targets shorthand",
+    description: "Shorthand for specifying ref_name conditions: 'default', 'all', or custom patterns"
+});
+const PullRequestsShorthandSchema = Schema.Struct({
+    approvals: Schema.optionalWith(Schema.Int.pipe(Schema.between(0, 10)).annotations({
+        title: "Required approvals",
+        description: "Number of approving reviews required (0-10)"
+    }), {
+        default: ()=>0
+    }),
+    dismiss_stale_reviews: Schema.optionalWith(Schema.Boolean.annotations({
+        title: "Dismiss stale reviews",
+        description: "Dismiss previous approvals when new commits are pushed"
+    }), {
+        default: ()=>false
+    }),
+    code_owner_review: Schema.optionalWith(Schema.Boolean.annotations({
+        title: "Code owner review",
+        description: "Require review from code owners for files they own"
+    }), {
+        default: ()=>false
+    }),
+    last_push_approval: Schema.optionalWith(Schema.Boolean.annotations({
+        title: "Last push approval",
+        description: "Most recent push must be approved by someone other than the pusher"
+    }), {
+        default: ()=>false
+    }),
+    resolve_threads: Schema.optionalWith(Schema.Boolean.annotations({
+        title: "Resolve threads",
+        description: "All review conversations must be resolved before merging"
+    }), {
+        default: ()=>false
+    }),
+    merge_methods: Schema.optional(Schema.Array(Schema.Literal("merge", "squash", "rebase")).annotations({
+        title: "Merge methods",
+        description: "Allowed merge methods. At least one must be enabled."
+    })),
+    reviewers: Schema.optional(Schema.Array(RequiredReviewerSchema).annotations({
+        title: "Required reviewers",
+        description: "Teams that must approve specific file patterns"
+    }))
+}).annotations({
+    identifier: "PullRequestsShorthand",
+    title: "Pull requests shorthand",
+    description: "Simplified pull request configuration (branch rulesets only)"
+});
+const StatusChecksShorthandSchema = Schema.Struct({
+    update_branch: Schema.optional(Schema.Boolean.annotations({
+        title: "Strict status checks",
+        description: "PRs must be tested with the latest code"
+    })),
+    on_creation: Schema.optional(Schema.Boolean.annotations({
+        title: "Enforce on create",
+        description: "When false, allows branch creation even if checks would prohibit it"
+    })),
+    default_integration_id: Schema.optional(Schema.Union(Schema.Int, ResolvedRefSchema).annotations({
+        title: "Default integration ID",
+        description: "Default integration ID applied to all checks that do not specify one"
+    })),
+    required: Schema.Array(StatusCheckSchema).annotations({
+        title: "Required checks",
+        description: "Status checks that must pass"
+    })
+}).annotations({
+    identifier: "StatusChecksShorthand",
+    title: "Status checks shorthand",
+    description: "Simplified status checks configuration"
+});
+const EnforcementSchema = Schema.Literal("disabled", "active", "evaluate").annotations({
+    title: "Enforcement level",
+    description: "disabled = off, active = enforced, evaluate = test mode (GitHub Enterprise only)"
+});
+const PatternEntrySchema = Schema.Struct({
+    operator: Schema.Literal("starts_with", "ends_with", "contains", "regex").annotations({
+        title: "Operator",
+        description: "The operator to use for matching"
+    }),
+    pattern: Schema.String.annotations({
+        title: "Pattern",
+        description: "The pattern to match"
+    }),
+    name: Schema.optional(Schema.String.annotations({
+        title: "Rule name",
+        description: "Display name for this pattern rule"
+    })),
+    negate: Schema.optional(Schema.Boolean.annotations({
+        title: "Negate",
+        description: "If true, the rule fails when the pattern matches"
+    }))
+}).annotations({
+    identifier: "PatternEntry",
+    title: "Pattern entry",
+    description: "A pattern matching rule with operator, pattern, and optional name/negate"
+});
+const MergeQueueShorthandSchema = Schema.Struct({
+    check_timeout: Schema.Int.pipe(Schema.between(1, 360)).annotations({
+        title: "Check timeout (minutes)",
+        description: "Max time for status checks to report"
+    }),
+    grouping: Schema.Literal("ALLGREEN", "HEADGREEN").annotations({
+        title: "Grouping strategy",
+        description: "Whether all commits or only the head commit must pass checks"
+    }),
+    max_build: Schema.Int.pipe(Schema.between(0, 100)).annotations({
+        title: "Max entries to build",
+        description: "Max queued PRs requesting checks simultaneously"
+    }),
+    max_merge: Schema.Int.pipe(Schema.between(0, 100)).annotations({
+        title: "Max entries to merge",
+        description: "Max PRs merged together in a group"
+    }),
+    merge_method: Schema.Literal("MERGE", "SQUASH", "REBASE").annotations({
+        title: "Merge method",
+        description: "Merge method for queued PRs"
+    }),
+    min_merge: Schema.Int.pipe(Schema.between(0, 100)).annotations({
+        title: "Min entries to merge",
+        description: "Min PRs merged together in a group"
+    }),
+    min_wait: Schema.Int.pipe(Schema.between(0, 360)).annotations({
+        title: "Min wait time (minutes)",
+        description: "Wait time for min group size after first PR is added"
+    })
+}).annotations({
+    identifier: "MergeQueueShorthand",
+    title: "Merge queue",
+    description: "Merge queue configuration"
+});
+const CopilotReviewShorthandSchema = Schema.Struct({
+    draft_prs: Schema.optional(Schema.Boolean.annotations({
+        title: "Review draft PRs",
+        description: "Review draft PRs before they are marked ready"
+    })),
+    on_push: Schema.optional(Schema.Boolean.annotations({
+        title: "Review on push",
+        description: "Review each new push to the PR"
+    }))
+}).annotations({
+    identifier: "CopilotReviewShorthand",
+    title: "Copilot review",
+    description: "Copilot code review configuration"
+});
+const CodeScanningEntrySchema = Schema.Struct({
+    tool: Schema.String.annotations({
+        title: "Tool name",
+        description: "Name of the code scanning tool"
+    }),
+    alerts: Schema.Literal("none", "errors", "errors_and_warnings", "all").annotations({
+        title: "Alerts threshold",
+        description: "Severity level at which alerts block updates"
+    }),
+    security_alerts: Schema.Literal("none", "critical", "high_or_higher", "medium_or_higher", "all").annotations({
+        title: "Security alerts threshold",
+        description: "Severity level at which security alerts block updates"
+    })
+}).annotations({
+    identifier: "CodeScanningEntry",
+    title: "Code scanning tool",
+    description: "A code scanning tool with alert thresholds"
+});
+const WorkflowsShorthandSchema = Schema.Struct({
+    on_creation: Schema.optional(Schema.Boolean.annotations({
+        title: "Enforce on creation",
+        description: "Enforce workflows when a branch is created (false = skip on creation)"
+    })),
+    required: Schema.Array(WorkflowFileSchema).annotations({
+        title: "Required workflows",
+        description: "Workflows that must pass for this rule"
+    })
+}).annotations({
+    identifier: "WorkflowsShorthand",
+    title: "Workflows",
+    description: "Required workflow configuration"
+});
+const sharedRulesetFields = {
+    name: Schema.String.annotations({
+        title: "Ruleset name",
+        description: "The name of the ruleset (used for matching when creating or updating)"
+    }),
+    enforcement: EnforcementSchema,
+    conditions: Schema.optional(RulesetConditionsSchema),
+    bypass_actors: Schema.optional(Schema.Array(BypassActorSchema)),
+    creation: Schema.optional(Schema.Boolean.annotations({
+        title: "Creation shorthand",
+        description: "When true, adds a creation rule"
+    })),
+    update: Schema.optional(Schema.Boolean.annotations({
+        title: "Update shorthand",
+        description: "When true, adds an update rule with update_allows_fetch_and_merge: true"
+    })),
+    deletion: Schema.optional(Schema.Boolean.annotations({
+        title: "Deletion shorthand",
+        description: "When true, adds a deletion rule"
+    })),
+    required_linear_history: Schema.optional(Schema.Boolean.annotations({
+        title: "Required linear history shorthand",
+        description: "When true, adds a required_linear_history rule"
+    })),
+    required_signatures: Schema.optional(Schema.Boolean.annotations({
+        title: "Required signatures shorthand",
+        description: "When true, adds a required_signatures rule"
+    })),
+    non_fast_forward: Schema.optional(Schema.Boolean.annotations({
+        title: "Non-fast-forward shorthand",
+        description: "When true, adds a non_fast_forward rule"
+    })),
+    deployments: Schema.optional(Schema.Array(Schema.String).annotations({
+        title: "Deployments shorthand",
+        description: "Deployment environments that must succeed; converts to required_deployments rule"
+    })),
+    targets: Schema.optional(TargetsSchema),
+    status_checks: Schema.optional(StatusChecksShorthandSchema),
+    commit_message: Schema.optional(Schema.Array(PatternEntrySchema).annotations({
+        title: "Commit message patterns",
+        description: "Commit message pattern rules"
+    })),
+    commit_author_email: Schema.optional(Schema.Array(PatternEntrySchema).annotations({
+        title: "Commit author email patterns",
+        description: "Commit author email pattern rules"
+    })),
+    committer_email: Schema.optional(Schema.Array(PatternEntrySchema).annotations({
+        title: "Committer email patterns",
+        description: "Committer email pattern rules"
+    }))
+};
+const BranchRulesetSchema = Schema.Struct({
+    ...sharedRulesetFields,
+    type: Schema.Literal("branch").annotations({
+        title: "Ruleset type",
+        description: "This ruleset applies to branches"
+    }),
+    pull_requests: Schema.optional(PullRequestsShorthandSchema),
+    merge_queue: Schema.optional(MergeQueueShorthandSchema),
+    copilot_review: Schema.optional(CopilotReviewShorthandSchema),
+    code_scanning: Schema.optional(Schema.Array(CodeScanningEntrySchema).annotations({
+        title: "Code scanning tools",
+        description: "Code scanning tool requirements"
+    })),
+    workflows: Schema.optional(WorkflowsShorthandSchema),
+    branch_name: Schema.optional(Schema.Array(PatternEntrySchema).annotations({
+        title: "Branch name patterns",
+        description: "Branch name pattern rules"
+    }))
+}).annotations({
+    identifier: "BranchRuleset",
+    title: "Branch ruleset",
+    description: "A ruleset that applies to branches",
+    jsonSchema: {
+        "x-tombi-table-keys-order": "schema"
+    }
+});
+const TagRulesetSchema = Schema.Struct({
+    ...sharedRulesetFields,
+    type: Schema.Literal("tag").annotations({
+        title: "Ruleset type",
+        description: "This ruleset applies to tags"
+    }),
+    tag_name: Schema.optional(Schema.Array(PatternEntrySchema).annotations({
+        title: "Tag name patterns",
+        description: "Tag name pattern rules"
+    }))
+}).annotations({
+    identifier: "TagRuleset",
+    title: "Tag ruleset",
+    description: "A ruleset that applies to tags",
+    jsonSchema: {
+        "x-tombi-table-keys-order": "schema"
+    }
+});
+const RulesetSchema = Schema.Union(BranchRulesetSchema, TagRulesetSchema).annotations({
+    identifier: "Ruleset",
+    title: "Repository ruleset",
+    description: "A set of rules to apply when specified conditions are met",
+    jsonSchema: {
+        "x-tombi-table-keys-order": "schema"
+    }
+});
+function buildRulesetPayload(ruleset) {
+    const rules = [];
+    if (true === ruleset.creation) rules.push({
+        type: "creation"
+    });
+    if (true === ruleset.update) rules.push({
+        type: "update",
+        parameters: {
+            update_allows_fetch_and_merge: true
+        }
+    });
+    if (true === ruleset.deletion) rules.push({
+        type: "deletion"
+    });
+    if (true === ruleset.required_linear_history) rules.push({
+        type: "required_linear_history"
+    });
+    if (true === ruleset.required_signatures) rules.push({
+        type: "required_signatures"
+    });
+    if (true === ruleset.non_fast_forward) rules.push({
+        type: "non_fast_forward"
+    });
+    if (void 0 !== ruleset.deployments && ruleset.deployments.length > 0) rules.push({
+        type: "required_deployments",
+        parameters: {
+            required_deployment_environments: ruleset.deployments
+        }
+    });
+    if ("branch" === ruleset.type && void 0 !== ruleset.pull_requests) {
+        const pr = ruleset.pull_requests;
+        rules.push({
+            type: "pull_request",
+            parameters: {
+                required_approving_review_count: pr.approvals,
+                dismiss_stale_reviews_on_push: pr.dismiss_stale_reviews,
+                require_code_owner_review: pr.code_owner_review,
+                require_last_push_approval: pr.last_push_approval,
+                required_review_thread_resolution: pr.resolve_threads,
+                ...void 0 !== pr.merge_methods ? {
+                    allowed_merge_methods: pr.merge_methods
+                } : {},
+                ...void 0 !== pr.reviewers ? {
+                    required_reviewers: pr.reviewers
+                } : {}
+            }
+        });
+    }
+    if (void 0 !== ruleset.status_checks) {
+        const sc = ruleset.status_checks;
+        const checks = sc.required.map((check)=>{
+            if (void 0 === check.integration_id && void 0 !== sc.default_integration_id) return {
+                ...check,
+                integration_id: sc.default_integration_id
+            };
+            return check;
+        });
+        rules.push({
+            type: "required_status_checks",
+            parameters: {
+                strict_required_status_checks_policy: sc.update_branch ?? true,
+                ...false === sc.on_creation ? {
+                    do_not_enforce_on_create: true
+                } : {},
+                required_status_checks: checks
+            }
+        });
+    }
+    if ("branch" === ruleset.type && void 0 !== ruleset.merge_queue) {
+        const mq = ruleset.merge_queue;
+        rules.push({
+            type: "merge_queue",
+            parameters: {
+                check_response_timeout_minutes: mq.check_timeout,
+                grouping_strategy: mq.grouping,
+                max_entries_to_build: mq.max_build,
+                max_entries_to_merge: mq.max_merge,
+                merge_method: mq.merge_method,
+                min_entries_to_merge: mq.min_merge,
+                min_entries_to_merge_wait_minutes: mq.min_wait
+            }
+        });
+    }
+    if ("branch" === ruleset.type && void 0 !== ruleset.copilot_review) {
+        const cr = ruleset.copilot_review;
+        rules.push({
+            type: "copilot_code_review",
+            parameters: {
+                ...void 0 !== cr.draft_prs ? {
+                    review_draft_pull_requests: cr.draft_prs
+                } : {},
+                ...void 0 !== cr.on_push ? {
+                    review_on_push: cr.on_push
+                } : {}
+            }
+        });
+    }
+    if ("branch" === ruleset.type && void 0 !== ruleset.code_scanning) rules.push({
+        type: "code_scanning",
+        parameters: {
+            code_scanning_tools: ruleset.code_scanning.map((entry)=>({
+                    tool: entry.tool,
+                    alerts_threshold: entry.alerts,
+                    security_alerts_threshold: entry.security_alerts
+                }))
+        }
+    });
+    if ("branch" === ruleset.type && void 0 !== ruleset.workflows) {
+        const wf = ruleset.workflows;
+        rules.push({
+            type: "workflows",
+            parameters: {
+                ...false === wf.on_creation ? {
+                    do_not_enforce_on_create: true
+                } : {},
+                workflows: wf.required
+            }
+        });
+    }
+    for (const [field, ruleType] of [
+        [
+            "commit_message",
+            "commit_message_pattern"
+        ],
+        [
+            "commit_author_email",
+            "commit_author_email_pattern"
+        ],
+        [
+            "committer_email",
+            "committer_email_pattern"
+        ]
+    ]){
+        const patterns = ruleset[field];
+        if (void 0 !== patterns) for (const entry of patterns)rules.push({
+            type: ruleType,
+            parameters: entry
+        });
+    }
+    if ("branch" === ruleset.type && void 0 !== ruleset.branch_name) for (const entry of ruleset.branch_name)rules.push({
+        type: "branch_name_pattern",
+        parameters: entry
+    });
+    if ("tag" === ruleset.type && void 0 !== ruleset.tag_name) for (const entry of ruleset.tag_name)rules.push({
+        type: "tag_name_pattern",
+        parameters: entry
+    });
+    let conditions = ruleset.conditions;
+    if (void 0 !== ruleset.targets) if ("default" === ruleset.targets) conditions = {
+        ref_name: {
+            include: [
+                "~DEFAULT_BRANCH"
+            ],
+            exclude: []
+        }
+    };
+    else if ("all" === ruleset.targets) conditions = {
+        ref_name: {
+            include: [
+                "~ALL"
+            ],
+            exclude: []
+        }
+    };
+    else {
+        const include = [];
+        const exclude = [];
+        for (const pattern of ruleset.targets)if ("include" in pattern) include.push(pattern.include);
+        else exclude.push(pattern.exclude);
+        conditions = {
+            ref_name: {
+                include,
+                exclude
+            }
+        };
+    }
+    return {
+        name: ruleset.name,
+        target: ruleset.type,
+        enforcement: ruleset.enforcement,
+        ...void 0 !== conditions ? {
+            conditions
+        } : {},
+        ...void 0 !== ruleset.bypass_actors ? {
+            bypass_actors: ruleset.bypass_actors
+        } : {},
+        ...rules.length > 0 ? {
+            rules
+        } : {}
+    };
+}
+const SecretScopesSchema = Schema.Struct({
+    actions: Schema.optional(Schema.Array(Schema.String).annotations({
+        title: "Action secret groups",
+        description: "Secret groups to sync as GitHub Actions repository secrets",
+        examples: [
+            [
+                "deploy",
+                "app"
+            ]
+        ]
+    })),
+    dependabot: Schema.optional(Schema.Array(Schema.String).annotations({
+        title: "Dependabot secret groups",
+        description: "Secret groups to sync as Dependabot secrets",
+        examples: [
+            [
+                "deploy"
+            ]
+        ]
+    })),
+    codespaces: Schema.optional(Schema.Array(Schema.String).annotations({
+        title: "Codespaces secret groups",
+        description: "Secret groups to sync as Codespaces secrets",
+        examples: [
+            [
+                "deploy"
+            ]
+        ]
+    })),
+    environments: Schema.optional(Schema.Record({
+        key: Schema.String,
+        value: Schema.Array(Schema.String).annotations({
+            title: "Environment secret groups",
+            description: "Secret groups to sync as environment secrets"
+        })
+    }).annotations({
+        title: "Environment secret scopes",
+        description: "Map of environment names to secret group references",
+        jsonSchema: {
+            "x-tombi-additional-key-label": "environment_name"
+        }
+    }))
+}).annotations({
+    identifier: "SecretScopes",
+    title: "Secret scopes",
+    description: "Assign secret groups to GitHub secret scopes (actions, dependabot, codespaces, environments)"
+});
+const VariableScopesSchema = Schema.Struct({
+    actions: Schema.optional(Schema.Array(Schema.String).annotations({
+        title: "Action variable groups",
+        description: "Variable groups to sync as GitHub Actions repository variables",
+        examples: [
+            [
+                "common"
+            ]
+        ]
+    })),
+    environments: Schema.optional(Schema.Record({
+        key: Schema.String,
+        value: Schema.Array(Schema.String).annotations({
+            title: "Environment variable groups",
+            description: "Variable groups to sync as environment variables"
+        })
+    }).annotations({
+        title: "Environment variable scopes",
+        description: "Map of environment names to variable group references",
+        jsonSchema: {
+            "x-tombi-additional-key-label": "environment_name"
+        }
+    }))
+}).annotations({
+    identifier: "VariableScopes",
+    title: "Variable scopes",
+    description: "Assign variable groups to GitHub variable scopes (actions, environments)"
+});
+const GroupSchema = Schema.Struct({
+    owner: Schema.optional(Schema.String.annotations({
+        title: "Owner override",
+        description: "GitHub user or organization that owns these repos. Overrides the top-level owner.",
+        examples: [
+            "savvy-web"
+        ]
+    })),
+    repos: Schema.Array(Schema.String).annotations({
+        title: "Repository names",
+        description: "List of repository names (without owner prefix) to sync in this group",
+        examples: [
+            [
+                "repo-one",
+                "repo-two",
+                "repo-three"
+            ]
+        ],
+        jsonSchema: {
+            "x-tombi-array-values-order": "ascending"
+        }
+    }),
+    credentials: Schema.optional(Schema.String.annotations({
+        title: "Credential profile",
+        description: "Name of the credential profile to use. If only one profile exists, it is used automatically.",
+        examples: [
+            "personal",
+            "work"
+        ]
+    })),
+    settings: Schema.optional(Schema.Array(Schema.String).annotations({
+        title: "Settings groups",
+        description: "Names of settings groups to apply to these repos",
+        examples: [
+            [
+                "oss-defaults"
+            ]
+        ]
+    })),
+    environments: Schema.optional(Schema.Array(Schema.String).annotations({
+        title: "Environments",
+        description: "Names of environment definitions to create/update for these repos",
+        examples: [
+            [
+                "staging",
+                "production"
+            ]
+        ]
+    })),
+    secrets: Schema.optional(SecretScopesSchema),
+    variables: Schema.optional(VariableScopesSchema),
+    rulesets: Schema.optional(Schema.Array(Schema.String).annotations({
+        title: "Rulesets",
+        description: "Names of rulesets to apply to these repos",
+        examples: [
+            [
+                "workflow",
+                "release"
+            ]
+        ]
+    })),
+    cleanup: Schema.optional(CleanupSchema)
+}).annotations({
+    identifier: "Group",
+    title: "Repository group",
+    description: "A named group of repositories with their resource assignments",
+    jsonSchema: {
+        "x-tombi-table-keys-order": "schema"
+    }
+});
+const SquashMergeCommitTitleSchema = Schema.Literal("PR_TITLE", "COMMIT_OR_PR_TITLE").annotations({
+    title: "Squash merge commit title",
+    description: "Default title for squash merge commits: PR_TITLE uses the pull request title, COMMIT_OR_PR_TITLE uses the commit message if only one commit, otherwise the PR title"
+});
+const SquashMergeCommitMessageSchema = Schema.Literal("PR_BODY", "COMMIT_MESSAGES", "BLANK").annotations({
+    title: "Squash merge commit message",
+    description: "Default message body for squash merge commits: PR_BODY uses the pull request body, COMMIT_MESSAGES concatenates all commit messages, BLANK leaves it empty"
+});
+const MergeCommitTitleSchema = Schema.Literal("PR_TITLE", "MERGE_MESSAGE").annotations({
+    title: "Merge commit title",
+    description: "Default title for merge commits: PR_TITLE uses the pull request title, MERGE_MESSAGE uses the classic merge message"
+});
+const MergeCommitMessageSchema = Schema.Literal("PR_BODY", "PR_TITLE", "BLANK").annotations({
+    title: "Merge commit message",
+    description: "Default message body for merge commits: PR_BODY uses the pull request body, PR_TITLE uses the PR title, BLANK leaves it empty"
+});
+const SettingsGroupSchema = Schema.Struct({
+    is_template: Schema.optional(Schema.Boolean.annotations({
+        title: "Template repository",
+        description: "Whether the repository is a template that can be used to generate new repositories"
+    })),
+    has_wiki: Schema.optional(Schema.Boolean.annotations({
+        title: "Wikis",
+        description: "Enable the wiki feature for the repository"
+    })),
+    has_issues: Schema.optional(Schema.Boolean.annotations({
+        title: "Issues",
+        description: "Enable the issues feature for the repository"
+    })),
+    has_projects: Schema.optional(Schema.Boolean.annotations({
+        title: "Projects",
+        description: "Enable the projects feature for the repository"
+    })),
+    has_discussions: Schema.optional(Schema.Boolean.annotations({
+        title: "Discussions",
+        description: "Enable the discussions feature for the repository"
+    })),
+    has_sponsorships: Schema.optional(Schema.Boolean.annotations({
+        title: "Sponsorships",
+        description: "Display a Sponsor button for the repository (synced via GraphQL)"
+    })),
+    has_pull_requests: Schema.optional(Schema.Boolean.annotations({
+        title: "Pull requests",
+        description: "Enable the pull requests feature for the repository (synced via GraphQL)"
+    })),
+    allow_forking: Schema.optional(Schema.Boolean.annotations({
+        title: "Allow forking",
+        description: "Allow forking of the repository"
+    })),
+    allow_merge_commit: Schema.optional(Schema.Boolean.annotations({
+        title: "Allow merge commits",
+        description: "Allow merge commits when merging pull requests"
+    })),
+    allow_squash_merge: Schema.optional(Schema.Boolean.annotations({
+        title: "Allow squash merging",
+        description: "Allow squash merging when merging pull requests"
+    })),
+    allow_rebase_merge: Schema.optional(Schema.Boolean.annotations({
+        title: "Allow rebase merging",
+        description: "Allow rebase merging when merging pull requests"
+    })),
+    allow_auto_merge: Schema.optional(Schema.Boolean.annotations({
+        title: "Allow auto-merge",
+        description: "Allow pull requests to be automatically merged once all requirements are met"
+    })),
+    allow_update_branch: Schema.optional(Schema.Boolean.annotations({
+        title: "Always suggest updating pull request branches",
+        description: "Show the update branch button on pull requests"
+    })),
+    squash_merge_commit_title: Schema.optional(SquashMergeCommitTitleSchema),
+    squash_merge_commit_message: Schema.optional(SquashMergeCommitMessageSchema),
+    merge_commit_title: Schema.optional(MergeCommitTitleSchema),
+    merge_commit_message: Schema.optional(MergeCommitMessageSchema),
+    delete_branch_on_merge: Schema.optional(Schema.Boolean.annotations({
+        title: "Automatically delete head branches",
+        description: "Automatically delete head branches after pull requests are merged"
+    })),
+    web_commit_signoff_required: Schema.optional(Schema.Boolean.annotations({
+        title: "Require commit signoff",
+        description: "Require contributors to sign off on web-based commits"
+    }))
+}, {
+    key: Schema.String,
+    value: Schema.Unknown
+}).annotations({
+    identifier: "SettingsGroup",
+    title: "Settings group",
+    description: "GitHub repository settings to apply. Known fields are typed; additional fields are passed through to the API.",
+    jsonSchema: {
+        "x-tombi-table-keys-order": "schema"
+    }
+});
+const LogLevelSchema = Schema.Literal("silent", "info", "verbose", "debug").annotations({
+    identifier: "LogLevel",
+    title: "Log level",
+    description: "Controls output verbosity: silent (none), info (summaries), verbose (per-operation), debug (with sources)"
+});
+const ConfigSchema = Schema.Struct({
+    owner: Schema.optional(Schema.String.annotations({
+        title: "Default owner",
+        description: "Default GitHub user or organization for all groups. Can be overridden per group.",
+        examples: [
+            "spencerbeggs",
+            "savvy-web"
+        ]
+    })),
+    log_level: Schema.optionalWith(LogLevelSchema, {
+        default: ()=>"info"
+    }).annotations({
+        title: "Log level",
+        description: "Default output verbosity. Can be overridden with --log-level CLI flag."
+    }),
+    settings: Schema.optionalWith(Schema.Record({
+        key: Schema.String,
+        value: SettingsGroupSchema
+    }).annotations({
+        title: "Settings groups",
+        description: "Named groups of GitHub repository settings (passed to the repos.update API)",
+        jsonSchema: {
+            "x-tombi-additional-key-label": "setting_group"
+        }
+    }), {
+        default: ()=>({})
+    }),
+    secrets: Schema.optionalWith(Schema.Record({
+        key: Schema.String,
+        value: SecretGroupSchema
+    }).annotations({
+        title: "Secret groups",
+        description: "Named groups of secrets. Each group is one kind: file, value, or resolved.",
+        jsonSchema: {
+            "x-tombi-additional-key-label": "secret_group"
+        }
+    }), {
+        default: ()=>({})
+    }),
+    variables: Schema.optionalWith(Schema.Record({
+        key: Schema.String,
+        value: VariableGroupSchema
+    }).annotations({
+        title: "Variable groups",
+        description: "Named groups of variables. Each group is one kind: file, value, or resolved.",
+        jsonSchema: {
+            "x-tombi-additional-key-label": "variable_group"
+        }
+    }), {
+        default: ()=>({})
+    }),
+    rulesets: Schema.optionalWith(Schema.Record({
+        key: Schema.String,
+        value: RulesetSchema
+    }).annotations({
+        title: "Rulesets",
+        description: "Named rulesets defining branch/tag/push protection rules",
+        jsonSchema: {
+            "x-tombi-additional-key-label": "ruleset_name"
+        }
+    }), {
+        default: ()=>({})
+    }),
+    environments: Schema.optionalWith(Schema.Record({
+        key: Schema.String,
+        value: EnvironmentSchema
+    }).annotations({
+        title: "Environments",
+        description: "Named deployment environment configurations",
+        jsonSchema: {
+            "x-tombi-additional-key-label": "environment_name"
+        }
+    }), {
+        default: ()=>({})
+    }),
+    groups: Schema.Record({
+        key: Schema.String,
+        value: GroupSchema
+    }).annotations({
+        title: "Groups",
+        description: "Named groups of repositories with their settings, secrets, variables, and ruleset assignments",
+        jsonSchema: {
+            "x-tombi-additional-key-label": "group_name"
+        }
+    })
+}).annotations({
+    identifier: "Config",
+    title: "reposets Configuration",
+    description: "Configuration for syncing GitHub repository settings, secrets, variables, and rulesets",
+    jsonSchema: {
+        "x-tombi-table-keys-order": "schema"
+    }
+});
+const ResolveSectionSchema = Schema.Struct({
+    op: Schema.optional(Schema.Record({
+        key: Schema.String,
+        value: Schema.String
+    }).annotations({
+        title: "1Password references",
+        description: "Named values resolved via 1Password SDK. Values are op:// reference strings.",
+        jsonSchema: {
+            "x-tombi-additional-key-label": "label"
+        }
+    })),
+    file: Schema.optional(Schema.Record({
+        key: Schema.String,
+        value: Schema.String
+    }).annotations({
+        title: "File references",
+        description: "Named values read from files. Values are file paths relative to the credentials directory.",
+        jsonSchema: {
+            "x-tombi-additional-key-label": "label"
+        }
+    })),
+    value: Schema.optional(Schema.Record({
+        key: Schema.String,
+        value: Schema.Union(Schema.String, Schema.Record({
+            key: Schema.String,
+            value: Schema.Unknown
+        }))
+    }).annotations({
+        title: "Inline values",
+        description: "Named inline values. Strings are used as-is, objects are JSON-stringified.",
+        jsonSchema: {
+            "x-tombi-additional-key-label": "label"
+        }
+    }))
+}).annotations({
+    identifier: "ResolveSection",
+    title: "Resolve section",
+    description: "Named values resolved from 1Password, files, or inline. Referenced by config templates."
+});
+const CredentialProfileSchema = Schema.Struct({
+    github_token: Schema.String.annotations({
+        title: "GitHub token",
+        description: "A GitHub personal access token (fine-grained) with repo administration and secrets permissions",
+        examples: [
+            "ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
+        ]
+    }),
+    op_service_account_token: Schema.optional(Schema.String.annotations({
+        title: "1Password service account token",
+        description: "A 1Password service account token for resolving op:// secret references",
+        examples: [
+            "ops_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
+        ]
+    })),
+    resolve: Schema.optional(ResolveSectionSchema)
+}).annotations({
+    identifier: "CredentialProfile",
+    title: "Credential profile",
+    description: "Authentication credentials for a GitHub account with optional resolved value definitions"
+});
+const CredentialsSchema = Schema.Struct({
+    profiles: Schema.optionalWith(Schema.Record({
+        key: Schema.String,
+        value: CredentialProfileSchema
+    }).annotations({
+        title: "Credential profiles",
+        description: "Named credential profiles. If only one profile is defined, it is used automatically for all repo groups.",
+        jsonSchema: {
+            "x-tombi-additional-key-label": "profile_name"
+        }
+    }), {
+        default: ()=>({})
+    })
+}).annotations({
+    identifier: "Credentials",
+    title: "reposets Credentials",
+    description: "Authentication profiles for reposets. This file should be gitignored."
+});
+const CONFIG_FILENAME = "reposets.config.toml";
+const CREDENTIALS_FILENAME = "reposets.credentials.toml";
+const ReposetsConfigFile = ConfigFile.Tag("reposets/Config");
+const ReposetsCredentialsFile = ConfigFile.Tag("reposets/Credentials");
+const xdgLayer = XdgConfigLive({
+    app: new AppDirsConfig({
+        namespace: "reposets"
+    }),
+    config: {
+        tag: ReposetsConfigFile,
+        schema: ConfigSchema,
+        codec: TomlCodec,
+        strategy: FirstMatch,
+        resolvers: [
+            UpwardWalk({
+                filename: CONFIG_FILENAME
+            }),
+            XdgConfig({
+                filename: CONFIG_FILENAME
+            })
+        ]
+    }
+});
+const credentialsLayer = ConfigFile.Live({
+    tag: ReposetsCredentialsFile,
+    schema: CredentialsSchema,
+    codec: TomlCodec,
+    strategy: FirstMatch,
+    resolvers: [
+        UpwardWalk({
+            filename: CREDENTIALS_FILENAME
+        }),
+        XdgConfig({
+            filename: CREDENTIALS_FILENAME
+        })
+    ],
+    defaultPath: XdgSavePath(CREDENTIALS_FILENAME)
+}).pipe(Layer.provide(xdgLayer));
+const ConfigFilesLive = Layer.mergeAll(xdgLayer, credentialsLayer);
+function resolveConfigFlag(configFlag) {
+    if (Option.isNone(configFlag)) return;
+    const flag = configFlag.value;
+    if (existsSync(flag) && statSync(flag).isDirectory()) return join(flag, CONFIG_FILENAME);
+    return flag;
+}
+function loadConfigWithDir(configFile, configFlag) {
+    const resolved = resolveConfigFlag(configFlag);
+    if (resolved) return Effect.map(configFile.loadFrom(resolved), (config)=>({
+            config,
+            configDir: dirname(resolved)
+        }));
+    return Effect.flatMap(configFile.discover, (sources)=>{
+        if (0 === sources.length) return Effect.fail(new ConfigError({
+            operation: "discover",
+            reason: "No config file found"
+        }));
+        return Effect.succeed({
+            config: sources[0].value,
+            configDir: dirname(sources[0].path)
+        });
+    });
+}
+class OnePasswordClient extends Context.Tag("OnePasswordClient")() {
+}
+const OnePasswordClientLive = Layer.succeed(OnePasswordClient, {
+    resolve (reference, serviceAccountToken) {
+        return Effect.tryPromise({
+            try: async ()=>{
+                const { createClient } = await import("@1password/sdk");
+                const client = await createClient({
+                    auth: serviceAccountToken,
+                    integrationName: "reposets",
+                    integrationVersion: "1.0.0"
+                });
+                return await client.secrets.resolve(reference);
+            },
+            catch: (error)=>new OnePasswordError({
+                    message: `Failed to resolve ${reference}: ${error instanceof Error ? error.message : String(error)}`
+                })
+        });
+    }
+});
+function OnePasswordClientTest(stubs) {
+    return Layer.succeed(OnePasswordClient, {
+        resolve (reference, _serviceAccountToken) {
+            const value = stubs[reference];
+            if (void 0 === value) return Effect.fail(new OnePasswordError({
+                message: `Test stub: unknown reference ${reference}`
+            }));
+            return Effect.succeed(value);
+        }
+    });
+}
+class CredentialResolver extends Context.Tag("CredentialResolver")() {
+}
+const CredentialResolverLive = Layer.effect(CredentialResolver, Effect.gen(function*() {
+    const opClient = yield* OnePasswordClient;
+    return {
+        resolveAll (profile, basePath) {
+            return Effect.gen(function*() {
+                const result = new Map();
+                const resolveSection = profile.resolve;
+                if (!resolveSection) return result;
+                if (resolveSection.value) for (const [label, val] of Object.entries(resolveSection.value))if ("string" == typeof val) result.set(label, val);
+                else result.set(label, JSON.stringify(val));
+                if (resolveSection.file) for (const [label, filePath] of Object.entries(resolveSection.file)){
+                    const fullPath = isAbsolute(filePath) ? filePath : resolve(basePath, filePath);
+                    const content = yield* Effect["try"]({
+                        try: ()=>readFileSync(fullPath, "utf-8").trim(),
+                        catch: (error)=>new ResolveError({
+                                message: `Failed to read file for label '${label}': ${error instanceof Error ? error.message : String(error)}`
+                            })
+                    });
+                    result.set(label, content);
+                }
+                if (resolveSection.op) {
+                    const opToken = profile.op_service_account_token;
+                    if (!opToken) return yield* Effect.fail(new ResolveError({
+                        message: "No 1Password service account token provided but resolve.op entries are defined"
+                    }));
+                    for (const [label, reference] of Object.entries(resolveSection.op)){
+                        const value = yield* opClient.resolve(reference, opToken).pipe(Effect.mapError((err)=>new ResolveError({
+                                message: `Failed to resolve label '${label}': ${err.message}`
+                            })));
+                        result.set(label, value);
+                    }
+                }
+                return result;
+            });
+        }
+    };
+}));
+class GitHubClient extends Context.Tag("GitHubClient")() {
+}
+const ORG_ONLY_SETTINGS = new Set([
+    "allow_forking"
+]);
+const GRAPHQL_SETTINGS = {
+    has_sponsorships: "hasSponsorshipsEnabled",
+    has_pull_requests: "hasPullRequestsEnabled"
+};
+function GitHubClientLive(token) {
+    return Layer.succeed(GitHubClient, (()=>{
+        const octokit = new Octokit({
+            auth: token
+        });
+        function wrapError(error) {
+            if (error instanceof Error) {
+                const asAny = error;
+                const status = "number" == typeof asAny.status ? asAny.status : void 0;
+                if (void 0 !== status) return new GitHubApiError({
+                    message: error.message,
+                    status
+                });
+                return new GitHubApiError({
+                    message: error.message
+                });
+            }
+            return new GitHubApiError({
+                message: String(error)
+            });
+        }
+        const ownerTypeCache = new Map();
+        return {
+            getOwnerType (owner) {
+                return Effect.tryPromise({
+                    try: async ()=>{
+                        const cached = ownerTypeCache.get(owner);
+                        if (cached) return cached;
+                        const { data } = await octokit.users.getByUsername({
+                            username: owner
+                        });
+                        const ownerType = "Organization" === data.type ? "Organization" : "User";
+                        ownerTypeCache.set(owner, ownerType);
+                        return ownerType;
+                    },
+                    catch: wrapError
+                });
+            },
+            syncSecret (owner, repo, name, value, scope) {
+                return Effect.tryPromise({
+                    try: async ()=>{
+                        if ("actions" === scope) {
+                            const { data: publicKey } = await octokit.actions.getRepoPublicKey({
+                                owner,
+                                repo
+                            });
+                            const encryptedValue = encryptSecret(publicKey.key, value);
+                            await octokit.actions.createOrUpdateRepoSecret({
+                                owner,
+                                repo,
+                                secret_name: name,
+                                encrypted_value: encryptedValue,
+                                key_id: publicKey.key_id
+                            });
+                        } else if ("dependabot" === scope) {
+                            const { data: publicKey } = await octokit.dependabot.getRepoPublicKey({
+                                owner,
+                                repo
+                            });
+                            const encryptedValue = encryptSecret(publicKey.key, value);
+                            await octokit.dependabot.createOrUpdateRepoSecret({
+                                owner,
+                                repo,
+                                secret_name: name,
+                                encrypted_value: encryptedValue,
+                                key_id: publicKey.key_id
+                            });
+                        } else {
+                            const { data: publicKey } = await octokit.codespaces.getRepoPublicKey({
+                                owner,
+                                repo
+                            });
+                            const encryptedValue = encryptSecret(publicKey.key, value);
+                            await octokit.codespaces.createOrUpdateRepoSecret({
+                                owner,
+                                repo,
+                                secret_name: name,
+                                encrypted_value: encryptedValue,
+                                key_id: publicKey.key_id
+                            });
+                        }
+                    },
+                    catch: wrapError
+                });
+            },
+            syncVariable (owner, repo, name, value) {
+                return Effect.tryPromise({
+                    try: async ()=>{
+                        const { data } = await octokit.actions.listRepoVariables({
+                            owner,
+                            repo
+                        });
+                        const exists = data.variables.some((v)=>v.name === name);
+                        if (exists) await octokit.actions.updateRepoVariable({
+                            owner,
+                            repo,
+                            name,
+                            value
+                        });
+                        else await octokit.actions.createRepoVariable({
+                            owner,
+                            repo,
+                            name,
+                            value
+                        });
+                    },
+                    catch: wrapError
+                });
+            },
+            syncSettings (owner, repo, settings) {
+                return Effect.tryPromise({
+                    try: async ()=>{
+                        const restSettings = {};
+                        const graphqlInput = {};
+                        for (const [key, value] of Object.entries(settings)){
+                            const graphqlField = GRAPHQL_SETTINGS[key];
+                            if (void 0 !== graphqlField) graphqlInput[graphqlField] = value;
+                            else restSettings[key] = value;
+                        }
+                        if (false === restSettings.allow_merge_commit) {
+                            delete restSettings.merge_commit_title;
+                            delete restSettings.merge_commit_message;
+                        }
+                        if (false === restSettings.allow_squash_merge) {
+                            delete restSettings.squash_merge_commit_title;
+                            delete restSettings.squash_merge_commit_message;
+                        }
+                        if (Object.keys(restSettings).length > 0) await octokit.repos.update({
+                            owner,
+                            repo,
+                            ...restSettings
+                        });
+                        if (Object.keys(graphqlInput).length > 0) {
+                            const { data: repoData } = await octokit.repos.get({
+                                owner,
+                                repo
+                            });
+                            await octokit.graphql(`mutation UpdateRepository($input: UpdateRepositoryInput!) {
+										updateRepository(input: $input) {
+											repository { id }
+										}
+									}`, {
+                                input: {
+                                    repositoryId: repoData.node_id,
+                                    ...graphqlInput
+                                }
+                            });
+                        }
+                    },
+                    catch: wrapError
+                });
+            },
+            syncRuleset (owner, repo, name, payload) {
+                return Effect.tryPromise({
+                    try: async ()=>{
+                        const { data: existing } = await octokit.repos.getRepoRulesets({
+                            owner,
+                            repo
+                        });
+                        const match = existing.find((r)=>r.name === name);
+                        const body = {
+                            name: payload.name,
+                            target: payload.target,
+                            enforcement: payload.enforcement,
+                            ...void 0 !== payload.conditions ? {
+                                conditions: payload.conditions
+                            } : {},
+                            ...void 0 !== payload.rules ? {
+                                rules: payload.rules
+                            } : {},
+                            ...void 0 !== payload.bypass_actors ? {
+                                bypass_actors: payload.bypass_actors
+                            } : {}
+                        };
+                        if (match) await octokit.repos.updateRepoRuleset({
+                            owner,
+                            repo,
+                            ruleset_id: match.id,
+                            ...body
+                        });
+                        else await octokit.repos.createRepoRuleset({
+                            owner,
+                            repo,
+                            ...body
+                        });
+                    },
+                    catch: wrapError
+                });
+            },
+            listSecrets (owner, repo, scope) {
+                return Effect.tryPromise({
+                    try: async ()=>{
+                        if ("actions" === scope) {
+                            const { data } = await octokit.actions.listRepoSecrets({
+                                owner,
+                                repo
+                            });
+                            return data.secrets.map((s)=>({
+                                    name: s.name
+                                }));
+                        }
+                        if ("dependabot" === scope) {
+                            const { data } = await octokit.dependabot.listRepoSecrets({
+                                owner,
+                                repo
+                            });
+                            return data.secrets.map((s)=>({
+                                    name: s.name
+                                }));
+                        }
+                        {
+                            const { data } = await octokit.codespaces.listRepoSecrets({
+                                owner,
+                                repo
+                            });
+                            return data.secrets.map((s)=>({
+                                    name: s.name
+                                }));
+                        }
+                    },
+                    catch: wrapError
+                });
+            },
+            listVariables (owner, repo) {
+                return Effect.tryPromise({
+                    try: async ()=>{
+                        const { data } = await octokit.actions.listRepoVariables({
+                            owner,
+                            repo
+                        });
+                        return data.variables.map((v)=>({
+                                name: v.name
+                            }));
+                    },
+                    catch: wrapError
+                });
+            },
+            listRulesets (owner, repo) {
+                return Effect.tryPromise({
+                    try: async ()=>{
+                        const { data } = await octokit.repos.getRepoRulesets({
+                            owner,
+                            repo
+                        });
+                        return data.map((r)=>({
+                                name: r.name,
+                                id: r.id,
+                                source_type: r.source_type
+                            }));
+                    },
+                    catch: wrapError
+                });
+            },
+            deleteSecret (owner, repo, name, scope) {
+                return Effect.tryPromise({
+                    try: async ()=>{
+                        if ("actions" === scope) await octokit.actions.deleteRepoSecret({
+                            owner,
+                            repo,
+                            secret_name: name
+                        });
+                        else if ("dependabot" === scope) await octokit.dependabot.deleteRepoSecret({
+                            owner,
+                            repo,
+                            secret_name: name
+                        });
+                        else await octokit.codespaces.deleteRepoSecret({
+                            owner,
+                            repo,
+                            secret_name: name
+                        });
+                    },
+                    catch: wrapError
+                });
+            },
+            deleteVariable (owner, repo, name) {
+                return Effect.tryPromise({
+                    try: async ()=>{
+                        await octokit.actions.deleteRepoVariable({
+                            owner,
+                            repo,
+                            name
+                        });
+                    },
+                    catch: wrapError
+                });
+            },
+            deleteRuleset (owner, repo, rulesetId) {
+                return Effect.tryPromise({
+                    try: async ()=>{
+                        await octokit.repos.deleteRepoRuleset({
+                            owner,
+                            repo,
+                            ruleset_id: rulesetId
+                        });
+                    },
+                    catch: wrapError
+                });
+            },
+            syncEnvironment (owner, repo, name, config) {
+                return Effect.tryPromise({
+                    try: async ()=>{
+                        await octokit.repos.createOrUpdateEnvironment({
+                            owner,
+                            repo,
+                            environment_name: name,
+                            ...config
+                        });
+                    },
+                    catch: wrapError
+                });
+            },
+            syncEnvironmentSecret (owner, repo, envName, name, value) {
+                return Effect.tryPromise({
+                    try: async ()=>{
+                        const { data: publicKey } = await octokit.actions.getEnvironmentPublicKey({
+                            owner,
+                            repo,
+                            environment_name: envName
+                        });
+                        const encrypted_value = encryptSecret(publicKey.key, value);
+                        await octokit.actions.createOrUpdateEnvironmentSecret({
+                            owner,
+                            repo,
+                            environment_name: envName,
+                            secret_name: name,
+                            encrypted_value,
+                            key_id: publicKey.key_id
+                        });
+                    },
+                    catch: wrapError
+                });
+            },
+            syncEnvironmentVariable (owner, repo, envName, name, value) {
+                return Effect.tryPromise({
+                    try: async ()=>{
+                        const { data } = await octokit.actions.listEnvironmentVariables({
+                            owner,
+                            repo,
+                            environment_name: envName
+                        });
+                        const exists = data.variables.some((v)=>v.name === name);
+                        if (exists) await octokit.actions.updateEnvironmentVariable({
+                            owner,
+                            repo,
+                            environment_name: envName,
+                            name,
+                            value
+                        });
+                        else await octokit.actions.createEnvironmentVariable({
+                            owner,
+                            repo,
+                            environment_name: envName,
+                            name,
+                            value
+                        });
+                    },
+                    catch: wrapError
+                });
+            },
+            listEnvironments (owner, repo) {
+                return Effect.tryPromise({
+                    try: async ()=>{
+                        const { data } = await octokit.repos.getAllEnvironments({
+                            owner,
+                            repo
+                        });
+                        return (data.environments ?? []).map((e)=>({
+                                name: e.name
+                            }));
+                    },
+                    catch: wrapError
+                });
+            },
+            listEnvironmentSecrets (owner, repo, envName) {
+                return Effect.tryPromise({
+                    try: async ()=>{
+                        const { data } = await octokit.actions.listEnvironmentSecrets({
+                            owner,
+                            repo,
+                            environment_name: envName
+                        });
+                        return data.secrets.map((s)=>({
+                                name: s.name
+                            }));
+                    },
+                    catch: wrapError
+                });
+            },
+            listEnvironmentVariables (owner, repo, envName) {
+                return Effect.tryPromise({
+                    try: async ()=>{
+                        const { data } = await octokit.actions.listEnvironmentVariables({
+                            owner,
+                            repo,
+                            environment_name: envName
+                        });
+                        return data.variables.map((v)=>({
+                                name: v.name
+                            }));
+                    },
+                    catch: wrapError
+                });
+            },
+            deleteEnvironment (owner, repo, name) {
+                return Effect.tryPromise({
+                    try: async ()=>{
+                        await octokit.repos.deleteAnEnvironment({
+                            owner,
+                            repo,
+                            environment_name: name
+                        });
+                    },
+                    catch: wrapError
+                });
+            },
+            deleteEnvironmentSecret (owner, repo, envName, name) {
+                return Effect.tryPromise({
+                    try: async ()=>{
+                        await octokit.actions.deleteEnvironmentSecret({
+                            owner,
+                            repo,
+                            environment_name: envName,
+                            secret_name: name
+                        });
+                    },
+                    catch: wrapError
+                });
+            },
+            deleteEnvironmentVariable (owner, repo, envName, name) {
+                return Effect.tryPromise({
+                    try: async ()=>{
+                        await octokit.actions.deleteEnvironmentVariable({
+                            owner,
+                            repo,
+                            environment_name: envName,
+                            name
+                        });
+                    },
+                    catch: wrapError
+                });
+            }
+        };
+    })());
+}
+function GitHubClientTest() {
+    const recorded = [];
+    const layer = Layer.succeed(GitHubClient, {
+        getOwnerType (_owner) {
+            return Effect.succeed("User");
+        },
+        syncSecret (owner, repo, name, _value, scope) {
+            recorded.push({
+                method: "syncSecret",
+                args: {
+                    owner,
+                    repo,
+                    name,
+                    scope
+                }
+            });
+            return Effect["void"];
+        },
+        syncVariable (owner, repo, name, _value) {
+            recorded.push({
+                method: "syncVariable",
+                args: {
+                    owner,
+                    repo,
+                    name
+                }
+            });
+            return Effect["void"];
+        },
+        syncSettings (owner, repo, settings) {
+            recorded.push({
+                method: "syncSettings",
+                args: {
+                    owner,
+                    repo,
+                    settings
+                }
+            });
+            return Effect["void"];
+        },
+        syncRuleset (owner, repo, name, _payload) {
+            recorded.push({
+                method: "syncRuleset",
+                args: {
+                    owner,
+                    repo,
+                    name
+                }
+            });
+            return Effect["void"];
+        },
+        listSecrets (_owner, _repo, _scope) {
+            return Effect.succeed([]);
+        },
+        listVariables (_owner, _repo) {
+            return Effect.succeed([]);
+        },
+        listRulesets (_owner, _repo) {
+            return Effect.succeed([]);
+        },
+        deleteSecret (owner, repo, name, scope) {
+            recorded.push({
+                method: "deleteSecret",
+                args: {
+                    owner,
+                    repo,
+                    name,
+                    scope
+                }
+            });
+            return Effect["void"];
+        },
+        deleteVariable (owner, repo, name) {
+            recorded.push({
+                method: "deleteVariable",
+                args: {
+                    owner,
+                    repo,
+                    name
+                }
+            });
+            return Effect["void"];
+        },
+        deleteRuleset (owner, repo, rulesetId) {
+            recorded.push({
+                method: "deleteRuleset",
+                args: {
+                    owner,
+                    repo,
+                    rulesetId
+                }
+            });
+            return Effect["void"];
+        },
+        syncEnvironment (owner, repo, name, _config) {
+            recorded.push({
+                method: "syncEnvironment",
+                args: {
+                    owner,
+                    repo,
+                    name
+                }
+            });
+            return Effect["void"];
+        },
+        syncEnvironmentSecret (owner, repo, envName, name, _value) {
+            recorded.push({
+                method: "syncEnvironmentSecret",
+                args: {
+                    owner,
+                    repo,
+                    envName,
+                    name
+                }
+            });
+            return Effect["void"];
+        },
+        syncEnvironmentVariable (owner, repo, envName, name, _value) {
+            recorded.push({
+                method: "syncEnvironmentVariable",
+                args: {
+                    owner,
+                    repo,
+                    envName,
+                    name
+                }
+            });
+            return Effect["void"];
+        },
+        listEnvironments (_owner, _repo) {
+            return Effect.succeed([]);
+        },
+        listEnvironmentSecrets (_owner, _repo, _envName) {
+            return Effect.succeed([]);
+        },
+        listEnvironmentVariables (_owner, _repo, _envName) {
+            return Effect.succeed([]);
+        },
+        deleteEnvironment (owner, repo, name) {
+            recorded.push({
+                method: "deleteEnvironment",
+                args: {
+                    owner,
+                    repo,
+                    name
+                }
+            });
+            return Effect["void"];
+        },
+        deleteEnvironmentSecret (owner, repo, envName, name) {
+            recorded.push({
+                method: "deleteEnvironmentSecret",
+                args: {
+                    owner,
+                    repo,
+                    envName,
+                    name
+                }
+            });
+            return Effect["void"];
+        },
+        deleteEnvironmentVariable (owner, repo, envName, name) {
+            recorded.push({
+                method: "deleteEnvironmentVariable",
+                args: {
+                    owner,
+                    repo,
+                    envName,
+                    name
+                }
+            });
+            return Effect["void"];
+        }
+    });
+    return {
+        layer,
+        calls: ()=>[
+                ...recorded
+            ]
+    };
+}
+class SyncLogger extends Context.Tag("SyncLogger")() {
+}
+function pluralize(resource, count) {
+    if (1 === count) return resource;
+    if ("ruleset" === resource) return "rulesets";
+    return `${resource}s`;
+}
+function SyncLoggerLive(config) {
+    const { dryRun, logLevel, output } = config;
+    return Layer.effect(SyncLogger, Effect.gen(function*() {
+        const errors = yield* Ref.make([]);
+        const currentRepo = yield* Ref.make("");
+        function emit(line) {
+            if (output) return Ref.update(output, (lines)=>[
+                    ...lines,
+                    line
+                ]);
+            return Effect.sync(()=>{
+                process.stdout.write(`${line}\n`);
+            });
+        }
+        function isVisible(tier) {
+            if ("silent" === logLevel) return false;
+            const levels = [
+                "info",
+                "verbose",
+                "debug"
+            ];
+            return levels.indexOf(logLevel) >= levels.indexOf(tier);
+        }
+        function formatVerb(pastTense, presentTense) {
+            if (dryRun) return `would ${presentTense}`.padEnd(14);
+            return pastTense.padEnd(8);
+        }
+        return {
+            groupStart (name, repoCount) {
+                if (!isVisible("info")) return Effect["void"];
+                return emit(`group: ${name} (${repoCount} ${1 === repoCount ? "repo" : "repos"})`);
+            },
+            repoStart (owner, repo) {
+                const repoSlug = `${owner}/${repo}`;
+                if (!isVisible("info")) return Ref.set(currentRepo, repoSlug);
+                return Effect.gen(function*() {
+                    yield* Ref.set(currentRepo, repoSlug);
+                    yield* emit(`  repo: ${repoSlug}`);
+                });
+            },
+            repoSkip (owner, repo, reason) {
+                if (!isVisible("info")) return Effect["void"];
+                return Effect.gen(function*() {
+                    yield* emit(`  repo: ${owner}/${repo}`);
+                    yield* emit(`    skip    ${reason}`);
+                });
+            },
+            syncSummary (resource, count, detail) {
+                if (!isVisible("info")) return Effect["void"];
+                const verb = formatVerb("synced", "sync");
+                const noun = pluralize(resource, count);
+                const suffix = detail ? ` (${detail})` : "";
+                return emit(`    ${verb}${count} ${noun}${suffix}`);
+            },
+            settingsApplied () {
+                if (!isVisible("info")) return Effect["void"];
+                const verb = formatVerb("applied", "apply");
+                return emit(`    ${verb}settings`);
+            },
+            cleanupSummary (resource, count, names) {
+                if (!isVisible("info")) return Effect["void"];
+                const verb = formatVerb("deleted", "delete");
+                const noun = pluralize(resource, count);
+                const suffix = names.length > 0 ? ` (${names.join(", ")})` : "";
+                return emit(`    ${verb}${count} ${noun}${suffix}`);
+            },
+            syncOperation (verb, resource, name, detail, source) {
+                if (!isVisible("verbose")) return Effect["void"];
+                const formattedVerb = formatVerb(verb, verb);
+                const nameStr = name ? ` ${name}` : "";
+                const suffix = detail ? ` ${detail}` : "";
+                const sourceSuffix = source && isVisible("debug") ? ` <- ${source}` : "";
+                return emit(`    ${formattedVerb}${resource}${nameStr}${suffix}${sourceSuffix}`);
+            },
+            syncError (context, message) {
+                if (!isVisible("info")) return Effect["void"];
+                return Effect.gen(function*() {
+                    const repo = yield* Ref.get(currentRepo);
+                    yield* Ref.update(errors, (errs)=>[
+                            ...errs,
+                            {
+                                repo,
+                                context,
+                                message
+                            }
+                        ]);
+                    yield* emit(`    error   ${context}: ${message}`);
+                });
+            },
+            finish () {
+                if (!isVisible("info")) return Effect["void"];
+                return Effect.gen(function*() {
+                    const errs = yield* Ref.get(errors);
+                    if (0 === errs.length) yield* emit("Sync complete!");
+                    else {
+                        const label = 1 === errs.length ? "error" : "errors";
+                        yield* emit(`Sync complete with ${errs.length} ${label}:`);
+                        for (const err of errs)yield* emit(`  ${err.repo}: ${err.context} \u2014 ${err.message}`);
+                    }
+                });
+            }
+        };
+    }));
+}
+class SyncEngine extends Context.Tag("SyncEngine")() {
+}
+function isCleanupActive(scope) {
+    return false !== scope;
+}
+function getPreserveList(scope) {
+    if ("object" == typeof scope && "preserve" in scope) return new Set(scope.preserve);
+    return new Set();
+}
+function resolveResourceGroup(group, credentialMap, basePath) {
+    return Effect.gen(function*() {
+        const result = new Map();
+        if ("file" in group) for (const [name, filePath] of Object.entries(group.file)){
+            const fullPath = isAbsolute(filePath) ? filePath : resolve(basePath, filePath);
+            const content = yield* Effect["try"]({
+                try: ()=>readFileSync(fullPath, "utf-8").trim(),
+                catch: (error)=>new ResolveError({
+                        message: `Failed to read file for '${name}': ${error instanceof Error ? error.message : String(error)}`
+                    })
+            });
+            result.set(name, content);
+        }
+        else if ("value" in group) for (const [name, val] of Object.entries(group.value))result.set(name, "string" == typeof val ? val : JSON.stringify(val));
+        else if ("resolved" in group) for (const [name, label] of Object.entries(group.resolved)){
+            const value = credentialMap.get(label);
+            if (void 0 === value) yield* Effect.fail(new ResolveError({
+                message: `Credential label '${label}' not found for '${name}'`
+            }));
+            else result.set(name, value);
+        }
+        return result;
+    });
+}
+function resolveRulesetRefs(ruleset, credentialMap) {
+    const json = JSON.parse(JSON.stringify(ruleset));
+    substituteResolved(json, credentialMap);
+    return json;
+}
+function substituteResolved(obj, credentialMap) {
+    for (const [key, value] of Object.entries(obj))if (value && "object" == typeof value && !Array.isArray(value)) {
+        const rec = value;
+        if ("resolved" in rec && "string" == typeof rec.resolved) {
+            const resolved = credentialMap.get(rec.resolved);
+            if (void 0 === resolved) throw new Error(`Credential label '${rec.resolved}' not found for ruleset field '${key}'`);
+            const num = Number(resolved);
+            obj[key] = Number.isNaN(num) ? resolved : num;
+        } else substituteResolved(rec, credentialMap);
+    } else if (Array.isArray(value)) {
+        for (const item of value)if (item && "object" == typeof item) substituteResolved(item, credentialMap);
+    }
+}
+function groupEntryNames(group) {
+    if ("file" in group) return Object.keys(group.file);
+    if ("value" in group) return Object.keys(group.value);
+    if ("resolved" in group) return Object.keys(group.resolved);
+    return [];
+}
+const SyncEngineLive = Layer.effect(SyncEngine, Effect.gen(function*() {
+    const github = yield* GitHubClient;
+    const credResolver = yield* CredentialResolver;
+    const logger = yield* SyncLogger;
+    return {
+        syncAll (config, credentials, options) {
+            return Effect.gen(function*() {
+                const { dryRun, noCleanup, groupFilter, repoFilter } = options;
+                const profileEntries = Object.entries(credentials.profiles);
+                const defaultProfileName = 1 === profileEntries.length ? profileEntries[0]?.[0] ?? "default" : "default";
+                const defaultProfile = credentials.profiles[defaultProfileName];
+                const groups = Object.entries(config.groups);
+                for (const [groupName, group] of groups){
+                    if (groupFilter && groupName !== groupFilter) continue;
+                    const owner = group.owner ?? config.owner ?? "";
+                    const profileName = group.credentials ?? defaultProfileName;
+                    const profile = credentials.profiles[profileName] ?? defaultProfile;
+                    yield* logger.groupStart(groupName, group.repos.length);
+                    const credentialMap = profile ? yield* credResolver.resolveAll(profile, options.configDir) : new Map();
+                    const ownerType = yield* github.getOwnerType(owner).pipe(Effect.catchTag("GitHubApiError", ()=>Effect.succeed("User")));
+                    const secretScopes = [
+                        "actions",
+                        "dependabot",
+                        "codespaces"
+                    ];
+                    const resolvedSecrets = new Map();
+                    for (const scope of secretScopes){
+                        const groupRefs = group.secrets?.[scope] ?? [];
+                        for (const groupRef of groupRefs){
+                            const secretGroup = config.secrets[groupRef];
+                            if (!secretGroup) continue;
+                            const entries = yield* resolveResourceGroup(secretGroup, credentialMap, options.configDir);
+                            const scopeMap = resolvedSecrets.get(scope) ?? new Map();
+                            for (const [name, value] of entries)scopeMap.set(name, value);
+                            resolvedSecrets.set(scope, scopeMap);
+                        }
+                    }
+                    const resolvedVariables = new Map();
+                    const variableGroupRefs = group.variables?.actions ?? [];
+                    for (const groupRef of variableGroupRefs){
+                        const variableGroup = config.variables[groupRef];
+                        if (!variableGroup) continue;
+                        const entries = yield* resolveResourceGroup(variableGroup, credentialMap, options.configDir);
+                        for (const [name, value] of entries)resolvedVariables.set(name, value);
+                    }
+                    const groupRulesetRefs = group.rulesets ?? [];
+                    const rulesetMap = new Map();
+                    for (const ref of groupRulesetRefs){
+                        const ruleset = config.rulesets[ref];
+                        if (ruleset) {
+                            const resolved = resolveRulesetRefs(ruleset, credentialMap);
+                            const payload = buildRulesetPayload(resolved);
+                            rulesetMap.set(ref, payload);
+                        }
+                    }
+                    const envRefs = group.environments ?? [];
+                    const envSecretMapping = group.secrets?.environments ?? {};
+                    const envVariableMapping = group.variables?.environments ?? {};
+                    const resolvedEnvSecrets = new Map();
+                    for (const [envName, groupRefs] of Object.entries(envSecretMapping)){
+                        const envMap = new Map();
+                        for (const groupRef of groupRefs){
+                            const secretGroup = config.secrets[groupRef];
+                            if (!secretGroup) continue;
+                            const entries = yield* resolveResourceGroup(secretGroup, credentialMap, options.configDir);
+                            for (const [name, value] of entries)envMap.set(name, value);
+                        }
+                        resolvedEnvSecrets.set(envName, envMap);
+                    }
+                    const resolvedEnvVariables = new Map();
+                    for (const [envName, groupRefs] of Object.entries(envVariableMapping)){
+                        const envMap = new Map();
+                        for (const groupRef of groupRefs){
+                            const variableGroup = config.variables[groupRef];
+                            if (!variableGroup) continue;
+                            const entries = yield* resolveResourceGroup(variableGroup, credentialMap, options.configDir);
+                            for (const [name, value] of entries)envMap.set(name, value);
+                        }
+                        resolvedEnvVariables.set(envName, envMap);
+                    }
+                    const effectiveCleanup = group.cleanup ?? {
+                        secrets: {
+                            actions: false,
+                            dependabot: false,
+                            codespaces: false,
+                            environments: false
+                        },
+                        variables: {
+                            actions: false,
+                            environments: false
+                        },
+                        rulesets: false,
+                        environments: false
+                    };
+                    const configuredSecretNames = (scope)=>{
+                        const refs = group.secrets?.[scope] ?? [];
+                        const names = new Set();
+                        for (const ref of refs){
+                            const grp = config.secrets[ref];
+                            if (grp) for (const name of groupEntryNames(grp))names.add(name);
+                        }
+                        return names;
+                    };
+                    const configuredVariableNames = ()=>{
+                        const refs = group.variables?.actions ?? [];
+                        const names = new Set();
+                        for (const ref of refs){
+                            const grp = config.variables[ref];
+                            if (grp) for (const name of groupEntryNames(grp))names.add(name);
+                        }
+                        return names;
+                    };
+                    const configuredRulesetNames = ()=>{
+                        const refs = group.rulesets ?? [];
+                        const names = new Set();
+                        for (const ref of refs){
+                            const ruleset = config.rulesets[ref];
+                            if (ruleset) names.add(ruleset.name);
+                        }
+                        return names;
+                    };
+                    const settingGroupRefs = group.settings ?? [];
+                    const mergedSettings = {};
+                    const skippedSettings = [];
+                    for (const ref of settingGroupRefs){
+                        const settingGroup = config.settings[ref];
+                        if (settingGroup) Object.assign(mergedSettings, settingGroup);
+                    }
+                    if ("User" === ownerType) {
+                        for (const key of ORG_ONLY_SETTINGS)if (key in mergedSettings) {
+                            delete mergedSettings[key];
+                            skippedSettings.push(key);
+                        }
+                    }
+                    const hasSecrets = secretScopes.some((s)=>(resolvedSecrets.get(s)?.size ?? 0) > 0);
+                    const hasVariables = resolvedVariables.size > 0;
+                    const hasRulesets = rulesetMap.size > 0;
+                    const hasSettings = Object.keys(mergedSettings).length > 0;
+                    const hasEnvironments = envRefs.length > 0;
+                    const hasEnvSecrets = resolvedEnvSecrets.size > 0;
+                    const hasEnvVariables = resolvedEnvVariables.size > 0;
+                    const hasCleanup = !noCleanup && (isCleanupActive(effectiveCleanup.secrets.actions) || isCleanupActive(effectiveCleanup.secrets.dependabot) || isCleanupActive(effectiveCleanup.secrets.codespaces) || isCleanupActive(effectiveCleanup.secrets.environments) || isCleanupActive(effectiveCleanup.variables.actions) || isCleanupActive(effectiveCleanup.variables.environments) || isCleanupActive(effectiveCleanup.rulesets) || isCleanupActive(effectiveCleanup.environments));
+                    for (const repoName of group.repos)if (!repoFilter || repoName === repoFilter) {
+                        if (!hasSecrets && !hasVariables && !hasRulesets && !hasSettings && !hasEnvironments && !hasEnvSecrets && !hasEnvVariables && !hasCleanup) {
+                            yield* logger.repoSkip(owner, repoName, "no changes configured");
+                            continue;
+                        }
+                        yield* logger.repoStart(owner, repoName);
+                        if (!dryRun) {
+                            if (hasSettings) {
+                                yield* logger.syncOperation("apply", "settings", "");
+                                yield* github.syncSettings(owner, repoName, mergedSettings).pipe(Effect.catchTag("GitHubApiError", (err)=>logger.syncError("settings", err.message)));
+                            }
+                            for (const key of skippedSettings)yield* logger.syncOperation("skip", "setting", key, "(org-only, owner is a personal account)");
+                            for (const envName of envRefs){
+                                const envConfig = config.environments[envName];
+                                if (envConfig) {
+                                    yield* logger.syncOperation("sync", "environment", envName);
+                                    yield* github.syncEnvironment(owner, repoName, envName, envConfig).pipe(Effect.catchTag("GitHubApiError", (err)=>logger.syncError(`environment ${envName}`, err.message)));
+                                }
+                            }
+                            for (const scope of secretScopes){
+                                const scopeMap = resolvedSecrets.get(scope);
+                                if (scopeMap) for (const [name, value] of scopeMap){
+                                    yield* logger.syncOperation("sync", "secret", name, `(${scope})`);
+                                    yield* github.syncSecret(owner, repoName, name, value, scope).pipe(Effect.catchTag("GitHubApiError", (err)=>logger.syncError(`secret ${name} (${scope})`, err.message)));
+                                }
+                            }
+                            for (const [envName, envMap] of resolvedEnvSecrets)for (const [name, value] of envMap){
+                                yield* logger.syncOperation("sync", "secret", name, `(env: ${envName})`);
+                                yield* github.syncEnvironmentSecret(owner, repoName, envName, name, value).pipe(Effect.catchTag("GitHubApiError", (err)=>logger.syncError(`secret ${name} (env: ${envName})`, err.message)));
+                            }
+                            for (const [name, value] of resolvedVariables){
+                                yield* logger.syncOperation("sync", "variable", name);
+                                yield* github.syncVariable(owner, repoName, name, value).pipe(Effect.catchTag("GitHubApiError", (err)=>logger.syncError(`variable ${name}`, err.message)));
+                            }
+                            for (const [envName, envMap] of resolvedEnvVariables)for (const [name, value] of envMap){
+                                yield* logger.syncOperation("sync", "variable", name, `(env: ${envName})`);
+                                yield* github.syncEnvironmentVariable(owner, repoName, envName, name, value).pipe(Effect.catchTag("GitHubApiError", (err)=>logger.syncError(`variable ${name} (env: ${envName})`, err.message)));
+                            }
+                            for (const [_key, ruleset] of rulesetMap){
+                                yield* logger.syncOperation("sync", "ruleset", ruleset.name);
+                                yield* github.syncRuleset(owner, repoName, ruleset.name, ruleset).pipe(Effect.catchTag("GitHubApiError", (err)=>logger.syncError(`ruleset ${ruleset.name}`, err.message)));
+                            }
+                        }
+                        if (hasEnvironments) yield* logger.syncSummary("environment", envRefs.length, "");
+                        if (hasSecrets) {
+                            const scopeCounts = [];
+                            let totalSecrets = 0;
+                            for (const scope of secretScopes){
+                                const count = resolvedSecrets.get(scope)?.size ?? 0;
+                                if (count > 0) {
+                                    scopeCounts.push(`${scope}: ${count}`);
+                                    totalSecrets += count;
+                                }
+                            }
+                            yield* logger.syncSummary("secret", totalSecrets, scopeCounts.join(", "));
+                        }
+                        if (hasVariables) yield* logger.syncSummary("variable", resolvedVariables.size, "");
+                        if (hasSettings) yield* logger.settingsApplied();
+                        if (rulesetMap.size > 0) yield* logger.syncSummary("ruleset", rulesetMap.size, "");
+                        if (!noCleanup) {
+                            if (isCleanupActive(effectiveCleanup.secrets.actions)) {
+                                const configured = configuredSecretNames("actions");
+                                const preserved = getPreserveList(effectiveCleanup.secrets.actions);
+                                const existing = yield* github.listSecrets(owner, repoName, "actions").pipe(Effect.catchTag("GitHubApiError", (err)=>Effect.gen(function*() {
+                                        yield* logger.syncError("list secrets (actions)", err.message);
+                                        return [];
+                                    })));
+                                const toDelete = [];
+                                for (const { name } of existing)if (!configured.has(name) && !preserved.has(name)) {
+                                    toDelete.push(name);
+                                    yield* logger.syncOperation("delete", "secret", name, "(actions)");
+                                    if (!dryRun) yield* github.deleteSecret(owner, repoName, name, "actions").pipe(Effect.catchTag("GitHubApiError", (err)=>logger.syncError(`delete secret ${name} (actions)`, err.message)));
+                                }
+                                if (toDelete.length > 0) yield* logger.cleanupSummary("secret", toDelete.length, toDelete);
+                            }
+                            if (isCleanupActive(effectiveCleanup.secrets.dependabot)) {
+                                const configured = configuredSecretNames("dependabot");
+                                const preserved = getPreserveList(effectiveCleanup.secrets.dependabot);
+                                const existing = yield* github.listSecrets(owner, repoName, "dependabot").pipe(Effect.catchTag("GitHubApiError", (err)=>Effect.gen(function*() {
+                                        yield* logger.syncError("list secrets (dependabot)", err.message);
+                                        return [];
+                                    })));
+                                const toDelete = [];
+                                for (const { name } of existing)if (!configured.has(name) && !preserved.has(name)) {
+                                    toDelete.push(name);
+                                    yield* logger.syncOperation("delete", "secret", name, "(dependabot)");
+                                    if (!dryRun) yield* github.deleteSecret(owner, repoName, name, "dependabot").pipe(Effect.catchTag("GitHubApiError", (err)=>logger.syncError(`delete secret ${name} (dependabot)`, err.message)));
+                                }
+                                if (toDelete.length > 0) yield* logger.cleanupSummary("secret", toDelete.length, toDelete);
+                            }
+                            if (isCleanupActive(effectiveCleanup.secrets.codespaces)) {
+                                const configured = configuredSecretNames("codespaces");
+                                const preserved = getPreserveList(effectiveCleanup.secrets.codespaces);
+                                const existing = yield* github.listSecrets(owner, repoName, "codespaces").pipe(Effect.catchTag("GitHubApiError", (err)=>Effect.gen(function*() {
+                                        yield* logger.syncError("list secrets (codespaces)", err.message);
+                                        return [];
+                                    })));
+                                const toDelete = [];
+                                for (const { name } of existing)if (!configured.has(name) && !preserved.has(name)) {
+                                    toDelete.push(name);
+                                    yield* logger.syncOperation("delete", "secret", name, "(codespaces)");
+                                    if (!dryRun) yield* github.deleteSecret(owner, repoName, name, "codespaces").pipe(Effect.catchTag("GitHubApiError", (err)=>logger.syncError(`delete secret ${name} (codespaces)`, err.message)));
+                                }
+                                if (toDelete.length > 0) yield* logger.cleanupSummary("secret", toDelete.length, toDelete);
+                            }
+                            if (isCleanupActive(effectiveCleanup.secrets.environments)) {
+                                const preserved = getPreserveList(effectiveCleanup.secrets.environments);
+                                const allEnvNames = new Set([
+                                    ...envRefs,
+                                    ...Object.keys(envSecretMapping)
+                                ]);
+                                for (const envName of allEnvNames){
+                                    const configuredNames = new Set();
+                                    for (const ref of envSecretMapping[envName] ?? []){
+                                        const grp = config.secrets[ref];
+                                        if (grp) for (const name of groupEntryNames(grp))configuredNames.add(name);
+                                    }
+                                    const existing = yield* github.listEnvironmentSecrets(owner, repoName, envName).pipe(Effect.catchTag("GitHubApiError", (err)=>Effect.gen(function*() {
+                                            yield* logger.syncError(`list secrets (env: ${envName})`, err.message);
+                                            return [];
+                                        })));
+                                    const toDelete = [];
+                                    for (const { name } of existing)if (!configuredNames.has(name) && !preserved.has(name)) {
+                                        toDelete.push(name);
+                                        yield* logger.syncOperation("delete", "secret", name, `(env: ${envName})`);
+                                        if (!dryRun) yield* github.deleteEnvironmentSecret(owner, repoName, envName, name).pipe(Effect.catchTag("GitHubApiError", (err)=>logger.syncError(`delete secret ${name} (env: ${envName})`, err.message)));
+                                    }
+                                    if (toDelete.length > 0) yield* logger.cleanupSummary("secret", toDelete.length, toDelete);
+                                }
+                            }
+                            if (isCleanupActive(effectiveCleanup.variables.actions)) {
+                                const configured = configuredVariableNames();
+                                const preserved = getPreserveList(effectiveCleanup.variables.actions);
+                                const existing = yield* github.listVariables(owner, repoName).pipe(Effect.catchTag("GitHubApiError", (err)=>Effect.gen(function*() {
+                                        yield* logger.syncError("list variables", err.message);
+                                        return [];
+                                    })));
+                                const toDelete = [];
+                                for (const { name } of existing)if (!configured.has(name) && !preserved.has(name)) {
+                                    toDelete.push(name);
+                                    yield* logger.syncOperation("delete", "variable", name);
+                                    if (!dryRun) yield* github.deleteVariable(owner, repoName, name).pipe(Effect.catchTag("GitHubApiError", (err)=>logger.syncError(`delete variable ${name}`, err.message)));
+                                }
+                                if (toDelete.length > 0) yield* logger.cleanupSummary("variable", toDelete.length, toDelete);
+                            }
+                            if (isCleanupActive(effectiveCleanup.variables.environments)) {
+                                const preserved = getPreserveList(effectiveCleanup.variables.environments);
+                                const allEnvVarNames = new Set([
+                                    ...envRefs,
+                                    ...Object.keys(envVariableMapping)
+                                ]);
+                                for (const envName of allEnvVarNames){
+                                    const configuredNames = new Set();
+                                    for (const ref of envVariableMapping[envName] ?? []){
+                                        const grp = config.variables[ref];
+                                        if (grp) for (const name of groupEntryNames(grp))configuredNames.add(name);
+                                    }
+                                    const existing = yield* github.listEnvironmentVariables(owner, repoName, envName).pipe(Effect.catchTag("GitHubApiError", (err)=>Effect.gen(function*() {
+                                            yield* logger.syncError(`list variables (env: ${envName})`, err.message);
+                                            return [];
+                                        })));
+                                    const toDelete = [];
+                                    for (const { name } of existing)if (!configuredNames.has(name) && !preserved.has(name)) {
+                                        toDelete.push(name);
+                                        yield* logger.syncOperation("delete", "variable", name, `(env: ${envName})`);
+                                        if (!dryRun) yield* github.deleteEnvironmentVariable(owner, repoName, envName, name).pipe(Effect.catchTag("GitHubApiError", (err)=>logger.syncError(`delete variable ${name} (env: ${envName})`, err.message)));
+                                    }
+                                    if (toDelete.length > 0) yield* logger.cleanupSummary("variable", toDelete.length, toDelete);
+                                }
+                            }
+                            if (isCleanupActive(effectiveCleanup.rulesets)) {
+                                const configured = configuredRulesetNames();
+                                const preserved = getPreserveList(effectiveCleanup.rulesets);
+                                const existing = yield* github.listRulesets(owner, repoName).pipe(Effect.catchTag("GitHubApiError", (err)=>Effect.gen(function*() {
+                                        yield* logger.syncError("list rulesets", err.message);
+                                        return [];
+                                    })));
+                                const toDelete = [];
+                                for (const { name, id, source_type } of existing)if ("Repository" === source_type) {
+                                    if (!configured.has(name) && !preserved.has(name)) {
+                                        toDelete.push(name);
+                                        yield* logger.syncOperation("delete", "ruleset", name);
+                                        if (!dryRun) yield* github.deleteRuleset(owner, repoName, id).pipe(Effect.catchTag("GitHubApiError", (err)=>logger.syncError(`delete ruleset ${name}`, err.message)));
+                                    }
+                                }
+                                if (toDelete.length > 0) yield* logger.cleanupSummary("ruleset", toDelete.length, toDelete);
+                            }
+                            if (isCleanupActive(effectiveCleanup.environments)) {
+                                const configuredEnvNames = new Set(envRefs);
+                                const preserved = getPreserveList(effectiveCleanup.environments);
+                                const existing = yield* github.listEnvironments(owner, repoName).pipe(Effect.catchTag("GitHubApiError", (err)=>Effect.gen(function*() {
+                                        yield* logger.syncError("list environments", err.message);
+                                        return [];
+                                    })));
+                                const toDelete = [];
+                                for (const { name } of existing)if (!configuredEnvNames.has(name) && !preserved.has(name)) {
+                                    toDelete.push(name);
+                                    yield* logger.syncOperation("delete", "environment", name);
+                                    if (!dryRun) yield* github.deleteEnvironment(owner, repoName, name).pipe(Effect.catchTag("GitHubApiError", (err)=>logger.syncError(`delete environment ${name}`, err.message)));
+                                }
+                                if (toDelete.length > 0) yield* logger.cleanupSummary("environment", toDelete.length, toDelete);
+                            }
+                        }
+                    }
+                }
+                yield* logger.finish();
+            }).pipe(Effect.catchAll((error)=>Effect.fail(error instanceof SyncError ? error : new SyncError({
+                    message: error instanceof Error ? error.message : String(error)
+                }))));
+        }
+    };
+}));
+export { BypassActorSchema, CleanupSchema, CleanupScopeSchema, ConfigFilesLive, ConfigSchema, CredentialProfileSchema, CredentialResolver, CredentialResolverLive, CredentialsSchema, GitHubApiError, GitHubClient, GitHubClientLive, GitHubClientTest, GroupSchema, LogLevelSchema, OnePasswordClient, OnePasswordClientLive, OnePasswordClientTest, OnePasswordError, ReposetsConfigFile, ReposetsCredentialsFile, ResolveError, ResolveSectionSchema, ResolvedRefSchema, RulesetSchema, SecretGroupSchema, SyncEngine, SyncEngineLive, SyncError, SyncLogger, SyncLoggerLive, VariableGroupSchema, buildRulesetPayload, encryptSecret, loadConfigWithDir, resolveConfigFlag };